src/drivers/driver_nl80211.c

   1 /*
   2  * Driver interaction with Linux nl80211/cfg80211
   3  * Copyright (c) 2002-2012, Jouni Malinen <j@w1.fi>
   4  * Copyright (c) 2003-2004, Instant802 Networks, Inc.
   5  * Copyright (c) 2005-2006, Devicescape Software, Inc.
   6  * Copyright (c) 2007, Johannes Berg <johannes@sipsolutions.net>
   7  * Copyright (c) 2009-2010, Atheros Communications
   8  *
   9  * This software may be distributed under the terms of the BSD license.
  10  * See README for more details.
  11  */
  12
  13 #include "includes.h"
  14 #include <sys/ioctl.h>
  15 #include <sys/types.h>
  16 #include <sys/stat.h>
  17 #include <fcntl.h>
  18 #include <net/if.h>
  19 #include <netlink/genl/genl.h>
  20 #include <netlink/genl/family.h>
  21 #include <netlink/genl/ctrl.h>
  22 #include <linux/rtnetlink.h>
  23 #include <netpacket/packet.h>
  24 #include <linux/filter.h>
  25 #include <linux/errqueue.h>
  26 #include "nl80211_copy.h"
  27
  28 #include "common.h"
  29 #include "eloop.h"
  30 #include "utils/list.h"
  31 #include "common/ieee802_11_defs.h"
  32 #include "common/ieee802_11_common.h"
  33 #include "l2_packet/l2_packet.h"
  34 #include "netlink.h"
  35 #include "linux_ioctl.h"
  36 #include "radiotap.h"
  37 #include "radiotap_iter.h"
  38 #include "rfkill.h"
  39 #include "driver.h"
  40
  41 #ifndef SO_WIFI_STATUS
  42 # if defined(__sparc__)
  43 #  define SO_WIFI_STATUS        0x0025
  44 # elif defined(__parisc__)
  45 #  define SO_WIFI_STATUS        0x4022
  46 # else
  47 #  define SO_WIFI_STATUS        41
  48 # endif
  49
  50 # define SCM_WIFI_STATUS        SO_WIFI_STATUS
  51 #endif
  52
  53 #ifndef SO_EE_ORIGIN_TXSTATUS
  54 #define SO_EE_ORIGIN_TXSTATUS   4
  55 #endif
  56
  57 #ifndef PACKET_TX_TIMESTAMP
  58 #define PACKET_TX_TIMESTAMP     16
  59 #endif
  60
  61 #ifdef ANDROID
  62 #include "android_drv.h"
  63
  64 /* system/core/libnl_2 in AOSP does not include nla_put_u32() */
  65 int nla_put_u32(struct nl_msg *msg, int attrtype, uint32_t value)
  66 {
  67         return nla_put(msg, attrtype, sizeof(uint32_t), &value);
  68 }
  69 #endif /* ANDROID */
  70 #ifdef CONFIG_LIBNL20
  71 /* libnl 2.0 compatibility code */
  72 #define nl_handle nl_sock
  73 #define nl80211_handle_alloc nl_socket_alloc_cb
  74 #define nl80211_handle_destroy nl_socket_free
  75 #else
  76 /*
  77  * libnl 1.1 has a bug, it tries to allocate socket numbers densely
  78  * but when you free a socket again it will mess up its bitmap and
  79  * and use the wrong number the next time it needs a socket ID.
  80  * Therefore, we wrap the handle alloc/destroy and add our own pid
  81  * accounting.
  82  */
  83 static uint32_t port_bitmap[32] = { 0 };
  84
  85 static struct nl_handle *nl80211_handle_alloc(void *cb)
  86 {
  87         struct nl_handle *handle;
  88         uint32_t pid = getpid() & 0x3FFFFF;
  89         int i;
  90
  91         handle = nl_handle_alloc_cb(cb);
  92
  93         for (i = 0; i < 1024; i++) {
  94                 if (port_bitmap[i / 32] & (1 << (i % 32)))
  95                         continue;
  96                 port_bitmap[i / 32] |= 1 << (i % 32);
  97                 pid += i << 22;
  98                 break;
  99         }
 100
 101         nl_socket_set_local_port(handle, pid);
 102
 103         return handle;
 104 }
 105
 106 static void nl80211_handle_destroy(struct nl_handle *handle)
 107 {
 108         uint32_t port = nl_socket_get_local_port(handle);
 109
 110         port >>= 22;
 111         port_bitmap[port / 32] &= ~(1 << (port % 32));
 112
 113         nl_handle_destroy(handle);
 114 }
 115 #endif /* CONFIG_LIBNL20 */
 116
 117
 118 static struct nl_handle * nl_create_handle(struct nl_cb *cb, const char *dbg)
 119 {
 120         struct nl_handle *handle;
 121
 122         handle = nl80211_handle_alloc(cb);
 123         if (handle == NULL) {
 124                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate netlink "
 125                            "callbacks (%s)", dbg);
 126                 return NULL;
 127         }
 128
 129         if (genl_connect(handle)) {
 130                 wpa_printf(MSG_ERROR, "nl80211: Failed to connect to generic "
 131                            "netlink (%s)", dbg);
 132                 nl80211_handle_destroy(handle);
 133                 return NULL;
 134         }
 135
 136         return handle;
 137 }
 138
 139
 140 static void nl_destroy_handles(struct nl_handle **handle)
 141 {
 142         if (*handle == NULL)
 143                 return;
 144         nl80211_handle_destroy(*handle);
 145         *handle = NULL;
 146 }
 147
 148
 149 #ifndef IFF_LOWER_UP
 150 #define IFF_LOWER_UP   0x10000         /* driver signals L1 up         */
 151 #endif
 152 #ifndef IFF_DORMANT
 153 #define IFF_DORMANT    0x20000         /* driver signals dormant       */
 154 #endif
 155
 156 #ifndef IF_OPER_DORMANT
 157 #define IF_OPER_DORMANT 5
 158 #endif
 159 #ifndef IF_OPER_UP
 160 #define IF_OPER_UP 6
 161 #endif
 162
 163 struct nl80211_global {
 164         struct dl_list interfaces;
 165         int if_add_ifindex;
 166         struct netlink_data *netlink;
 167         struct nl_cb *nl_cb;
 168         struct nl_handle *nl;
 169         int nl80211_id;
 170         int ioctl_sock; /* socket for ioctl() use */
 171
 172         struct nl_handle *nl_event;
 173 };
 174
 175 struct nl80211_wiphy_data {
 176         struct dl_list list;
 177         struct dl_list bsss;
 178         struct dl_list drvs;
 179
 180         struct nl_handle *nl_beacons;
 181         struct nl_cb *nl_cb;
 182
 183         int wiphy_idx;
 184 };
 185
 186 static void nl80211_global_deinit(void *priv);
 187 static void wpa_driver_nl80211_deinit(void *priv);
 188
 189 struct i802_bss {
 190         struct wpa_driver_nl80211_data *drv;
 191         struct i802_bss *next;
 192         int ifindex;
 193         char ifname[IFNAMSIZ + 1];
 194         char brname[IFNAMSIZ];
 195         unsigned int beacon_set:1;
 196         unsigned int added_if_into_bridge:1;
 197         unsigned int added_bridge:1;
 198         unsigned int in_deinit:1;
 199
 200         u8 addr[ETH_ALEN];
 201
 202         int freq;
 203
 204         struct nl_handle *nl_preq, *nl_mgmt;
 205         struct nl_cb *nl_cb;
 206
 207         struct nl80211_wiphy_data *wiphy_data;
 208         struct dl_list wiphy_list;
 209 };
 210
 211 struct wpa_driver_nl80211_data {
 212         struct nl80211_global *global;
 213         struct dl_list list;
 214         struct dl_list wiphy_list;
 215         char phyname[32];
 216         void *ctx;
 217         int ifindex;
 218         int if_removed;
 219         int if_disabled;
 220         int ignore_if_down_event;
 221         struct rfkill_data *rfkill;
 222         struct wpa_driver_capa capa;
 223         int has_capability;
 224
 225         int operstate;
 226
 227         int scan_complete_events;
 228
 229         struct nl_cb *nl_cb;
 230
 231         u8 auth_bssid[ETH_ALEN];
 232         u8 bssid[ETH_ALEN];
 233         int associated;
 234         u8 ssid[32];
 235         size_t ssid_len;
 236         enum nl80211_iftype nlmode;
 237         enum nl80211_iftype ap_scan_as_station;
 238         unsigned int assoc_freq;
 239
 240         int monitor_sock;
 241         int monitor_ifidx;
 242         int monitor_refcount;
 243
 244         unsigned int disabled_11b_rates:1;
 245         unsigned int pending_remain_on_chan:1;
 246         unsigned int in_interface_list:1;
 247         unsigned int device_ap_sme:1;
 248         unsigned int poll_command_supported:1;
 249         unsigned int data_tx_status:1;
 250         unsigned int scan_for_auth:1;
 251         unsigned int retry_auth:1;
 252         unsigned int use_monitor:1;
 253
 254         u64 remain_on_chan_cookie;
 255         u64 send_action_cookie;
 256
 257         unsigned int last_mgmt_freq;
 258
 259         struct wpa_driver_scan_filter *filter_ssids;
 260         size_t num_filter_ssids;
 261
 262         struct i802_bss first_bss;
 263
 264         int eapol_tx_sock;
 265
 266 #ifdef HOSTAPD
 267         int eapol_sock; /* socket for EAPOL frames */
 268
 269         int default_if_indices[16];
 270         int *if_indices;
 271         int num_if_indices;
 272
 273         int last_freq;
 274         int last_freq_ht;
 275 #endif /* HOSTAPD */
 276
 277         /* From failed authentication command */
 278         int auth_freq;
 279         u8 auth_bssid_[ETH_ALEN];
 280         u8 auth_ssid[32];
 281         size_t auth_ssid_len;
 282         int auth_alg;
 283         u8 *auth_ie;
 284         size_t auth_ie_len;
 285         u8 auth_wep_key[4][16];
 286         size_t auth_wep_key_len[4];
 287         int auth_wep_tx_keyidx;
 288         int auth_local_state_change;
 289         int auth_p2p;
 290 };
 291
 292
 293 static void wpa_driver_nl80211_scan_timeout(void *eloop_ctx,
 294                                             void *timeout_ctx);
 295 static int wpa_driver_nl80211_set_mode(struct i802_bss *bss,
 296                                        enum nl80211_iftype nlmode);
 297 static int
 298 wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv);
 299 static int wpa_driver_nl80211_mlme(struct wpa_driver_nl80211_data *drv,
 300                                    const u8 *addr, int cmd, u16 reason_code,
 301                                    int local_state_change);
 302 static void nl80211_remove_monitor_interface(
 303         struct wpa_driver_nl80211_data *drv);
 304 static int nl80211_send_frame_cmd(struct i802_bss *bss,
 305                                   unsigned int freq, unsigned int wait,
 306                                   const u8 *buf, size_t buf_len, u64 *cookie,
 307                                   int no_cck, int no_ack, int offchanok);
 308 static int wpa_driver_nl80211_probe_req_report(void *priv, int report);
 309 #ifdef ANDROID
 310 static int android_pno_start(struct i802_bss *bss,
 311                              struct wpa_driver_scan_params *params);
 312 static int android_pno_stop(struct i802_bss *bss);
 313 #endif /* ANDROID */
 314
 315 #ifdef HOSTAPD
 316 static void add_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx);
 317 static void del_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx);
 318 static int have_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx);
 319 static int wpa_driver_nl80211_if_remove(void *priv,
 320                                         enum wpa_driver_if_type type,
 321                                         const char *ifname);
 322 #else /* HOSTAPD */
 323 static inline void add_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
 324 {
 325 }
 326
 327 static inline void del_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
 328 {
 329 }
 330
 331 static inline int have_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
 332 {
 333         return 0;
 334 }
 335 #endif /* HOSTAPD */
 336
 337 static int i802_set_freq(void *priv, struct hostapd_freq_params *freq);
 338 static int nl80211_disable_11b_rates(struct wpa_driver_nl80211_data *drv,
 339                                      int ifindex, int disabled);
 340
 341 static int nl80211_leave_ibss(struct wpa_driver_nl80211_data *drv);
 342 static int wpa_driver_nl80211_authenticate_retry(
 343         struct wpa_driver_nl80211_data *drv);
 344
 345
 346 static int is_ap_interface(enum nl80211_iftype nlmode)
 347 {
 348         return (nlmode == NL80211_IFTYPE_AP ||
 349                 nlmode == NL80211_IFTYPE_P2P_GO);
 350 }
 351
 352
 353 static int is_sta_interface(enum nl80211_iftype nlmode)
 354 {
 355         return (nlmode == NL80211_IFTYPE_STATION ||
 356                 nlmode == NL80211_IFTYPE_P2P_CLIENT);
 357 }
 358
 359
 360 static int is_p2p_interface(enum nl80211_iftype nlmode)
 361 {
 362         return (nlmode == NL80211_IFTYPE_P2P_CLIENT ||
 363                 nlmode == NL80211_IFTYPE_P2P_GO);
 364 }
 365
 366
 367 struct nl80211_bss_info_arg {
 368         struct wpa_driver_nl80211_data *drv;
 369         struct wpa_scan_results *res;
 370         unsigned int assoc_freq;
 371         u8 assoc_bssid[ETH_ALEN];
 372 };
 373
 374 static int bss_info_handler(struct nl_msg *msg, void *arg);
 375
 376
 377 /* nl80211 code */
 378 static int ack_handler(struct nl_msg *msg, void *arg)
 379 {
 380         int *err = arg;
 381         *err = 0;
 382         return NL_STOP;
 383 }
 384
 385 static int finish_handler(struct nl_msg *msg, void *arg)
 386 {
 387         int *ret = arg;
 388         *ret = 0;
 389         return NL_SKIP;
 390 }
 391
 392 static int error_handler(struct sockaddr_nl *nla, struct nlmsgerr *err,
 393                          void *arg)
 394 {
 395         int *ret = arg;
 396         *ret = err->error;
 397         return NL_SKIP;
 398 }
 399
 400
 401 static int no_seq_check(struct nl_msg *msg, void *arg)
 402 {
 403         return NL_OK;
 404 }
 405
 406
 407 static int send_and_recv(struct nl80211_global *global,
 408                          struct nl_handle *nl_handle, struct nl_msg *msg,
 409                          int (*valid_handler)(struct nl_msg *, void *),
 410                          void *valid_data)
 411 {
 412         struct nl_cb *cb;
 413         int err = -ENOMEM;
 414
 415         cb = nl_cb_clone(global->nl_cb);
 416         if (!cb)
 417                 goto out;
 418
 419         err = nl_send_auto_complete(nl_handle, msg);
 420         if (err < 0)
 421                 goto out;
 422
 423         err = 1;
 424
 425         nl_cb_err(cb, NL_CB_CUSTOM, error_handler, &err);
 426         nl_cb_set(cb, NL_CB_FINISH, NL_CB_CUSTOM, finish_handler, &err);
 427         nl_cb_set(cb, NL_CB_ACK, NL_CB_CUSTOM, ack_handler, &err);
 428
 429         if (valid_handler)
 430                 nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM,
 431                           valid_handler, valid_data);
 432
 433         while (err > 0)
 434                 nl_recvmsgs(nl_handle, cb);
 435  out:
 436         nl_cb_put(cb);
 437         nlmsg_free(msg);
 438         return err;
 439 }
 440
 441
 442 static int send_and_recv_msgs_global(struct nl80211_global *global,
 443                                      struct nl_msg *msg,
 444                                      int (*valid_handler)(struct nl_msg *, void *),
 445                                      void *valid_data)
 446 {
 447         return send_and_recv(global, global->nl, msg, valid_handler,
 448                              valid_data);
 449 }
 450
 451
 452 static int send_and_recv_msgs(struct wpa_driver_nl80211_data *drv,
 453                               struct nl_msg *msg,
 454                               int (*valid_handler)(struct nl_msg *, void *),
 455                               void *valid_data)
 456 {
 457         return send_and_recv(drv->global, drv->global->nl, msg,
 458                              valid_handler, valid_data);
 459 }
 460
 461
 462 struct family_data {
 463         const char *group;
 464         int id;
 465 };
 466
 467
 468 static int family_handler(struct nl_msg *msg, void *arg)
 469 {
 470         struct family_data *res = arg;
 471         struct nlattr *tb[CTRL_ATTR_MAX + 1];
 472         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 473         struct nlattr *mcgrp;
 474         int i;
 475
 476         nla_parse(tb, CTRL_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 477                   genlmsg_attrlen(gnlh, 0), NULL);
 478         if (!tb[CTRL_ATTR_MCAST_GROUPS])
 479                 return NL_SKIP;
 480
 481         nla_for_each_nested(mcgrp, tb[CTRL_ATTR_MCAST_GROUPS], i) {
 482                 struct nlattr *tb2[CTRL_ATTR_MCAST_GRP_MAX + 1];
 483                 nla_parse(tb2, CTRL_ATTR_MCAST_GRP_MAX, nla_data(mcgrp),
 484                           nla_len(mcgrp), NULL);
 485                 if (!tb2[CTRL_ATTR_MCAST_GRP_NAME] ||
 486                     !tb2[CTRL_ATTR_MCAST_GRP_ID] ||
 487                     os_strncmp(nla_data(tb2[CTRL_ATTR_MCAST_GRP_NAME]),
 488                                res->group,
 489                                nla_len(tb2[CTRL_ATTR_MCAST_GRP_NAME])) != 0)
 490                         continue;
 491                 res->id = nla_get_u32(tb2[CTRL_ATTR_MCAST_GRP_ID]);
 492                 break;
 493         };
 494
 495         return NL_SKIP;
 496 }
 497
 498
 499 static int nl_get_multicast_id(struct nl80211_global *global,
 500                                const char *family, const char *group)
 501 {
 502         struct nl_msg *msg;
 503         int ret = -1;
 504         struct family_data res = { group, -ENOENT };
 505
 506         msg = nlmsg_alloc();
 507         if (!msg)
 508                 return -ENOMEM;
 509         genlmsg_put(msg, 0, 0, genl_ctrl_resolve(global->nl, "nlctrl"),
 510                     0, 0, CTRL_CMD_GETFAMILY, 0);
 511         NLA_PUT_STRING(msg, CTRL_ATTR_FAMILY_NAME, family);
 512
 513         ret = send_and_recv_msgs_global(global, msg, family_handler, &res);
 514         msg = NULL;
 515         if (ret == 0)
 516                 ret = res.id;
 517
 518 nla_put_failure:
 519         nlmsg_free(msg);
 520         return ret;
 521 }
 522
 523
 524 static void * nl80211_cmd(struct wpa_driver_nl80211_data *drv,
 525                           struct nl_msg *msg, int flags, uint8_t cmd)
 526 {
 527         return genlmsg_put(msg, 0, 0, drv->global->nl80211_id,
 528                            0, flags, cmd, 0);
 529 }
 530
 531
 532 struct wiphy_idx_data {
 533         int wiphy_idx;
 534 };
 535
 536
 537 static int netdev_info_handler(struct nl_msg *msg, void *arg)
 538 {
 539         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 540         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 541         struct wiphy_idx_data *info = arg;
 542
 543         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 544                   genlmsg_attrlen(gnlh, 0), NULL);
 545
 546         if (tb[NL80211_ATTR_WIPHY])
 547                 info->wiphy_idx = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
 548
 549         return NL_SKIP;
 550 }
 551
 552
 553 static int nl80211_get_wiphy_index(struct i802_bss *bss)
 554 {
 555         struct nl_msg *msg;
 556         struct wiphy_idx_data data = {
 557                 .wiphy_idx = -1,
 558         };
 559
 560         msg = nlmsg_alloc();
 561         if (!msg)
 562                 return -1;
 563
 564         nl80211_cmd(bss->drv, msg, 0, NL80211_CMD_GET_INTERFACE);
 565
 566         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
 567
 568         if (send_and_recv_msgs(bss->drv, msg, netdev_info_handler, &data) == 0)
 569                 return data.wiphy_idx;
 570         msg = NULL;
 571 nla_put_failure:
 572         nlmsg_free(msg);
 573         return -1;
 574 }
 575
 576
 577 static int nl80211_register_beacons(struct wpa_driver_nl80211_data *drv,
 578                                     struct nl80211_wiphy_data *w)
 579 {
 580         struct nl_msg *msg;
 581         int ret = -1;
 582
 583         msg = nlmsg_alloc();
 584         if (!msg)
 585                 return -1;
 586
 587         nl80211_cmd(drv, msg, 0, NL80211_CMD_REGISTER_BEACONS);
 588
 589         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, w->wiphy_idx);
 590
 591         ret = send_and_recv(drv->global, w->nl_beacons, msg, NULL, NULL);
 592         msg = NULL;
 593         if (ret) {
 594                 wpa_printf(MSG_DEBUG, "nl80211: Register beacons command "
 595                            "failed: ret=%d (%s)",
 596                            ret, strerror(-ret));
 597                 goto nla_put_failure;
 598         }
 599         ret = 0;
 600 nla_put_failure:
 601         nlmsg_free(msg);
 602         return ret;
 603 }
 604
 605
 606 static void nl80211_recv_beacons(int sock, void *eloop_ctx, void *handle)
 607 {
 608         struct nl80211_wiphy_data *w = eloop_ctx;
 609
 610         wpa_printf(MSG_EXCESSIVE, "nl80211: Beacon event message available");
 611
 612         nl_recvmsgs(handle, w->nl_cb);
 613 }
 614
 615
 616 static int process_beacon_event(struct nl_msg *msg, void *arg)
 617 {
 618         struct nl80211_wiphy_data *w = arg;
 619         struct wpa_driver_nl80211_data *drv;
 620         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 621         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 622         union wpa_event_data event;
 623
 624         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 625                   genlmsg_attrlen(gnlh, 0), NULL);
 626
 627         if (gnlh->cmd != NL80211_CMD_FRAME) {
 628                 wpa_printf(MSG_DEBUG, "nl80211: Unexpected beacon event? (%d)",
 629                            gnlh->cmd);
 630                 return NL_SKIP;
 631         }
 632
 633         if (!tb[NL80211_ATTR_FRAME])
 634                 return NL_SKIP;
 635
 636         dl_list_for_each(drv, &w->drvs, struct wpa_driver_nl80211_data,
 637                          wiphy_list) {
 638                 os_memset(&event, 0, sizeof(event));
 639                 event.rx_mgmt.frame = nla_data(tb[NL80211_ATTR_FRAME]);
 640                 event.rx_mgmt.frame_len = nla_len(tb[NL80211_ATTR_FRAME]);
 641                 wpa_supplicant_event(drv->ctx, EVENT_RX_MGMT, &event);
 642         }
 643
 644         return NL_SKIP;
 645 }
 646
 647
 648 static struct nl80211_wiphy_data *
 649 nl80211_get_wiphy_data_ap(struct i802_bss *bss)
 650 {
 651         static DEFINE_DL_LIST(nl80211_wiphys);
 652         struct nl80211_wiphy_data *w;
 653         int wiphy_idx, found = 0;
 654         struct i802_bss *tmp_bss;
 655
 656         if (bss->wiphy_data != NULL)
 657                 return bss->wiphy_data;
 658
 659         wiphy_idx = nl80211_get_wiphy_index(bss);
 660
 661         dl_list_for_each(w, &nl80211_wiphys, struct nl80211_wiphy_data, list) {
 662                 if (w->wiphy_idx == wiphy_idx)
 663                         goto add;
 664         }
 665
 666         /* alloc new one */
 667         w = os_zalloc(sizeof(*w));
 668         if (w == NULL)
 669                 return NULL;
 670         w->wiphy_idx = wiphy_idx;
 671         dl_list_init(&w->bsss);
 672         dl_list_init(&w->drvs);
 673
 674         w->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
 675         if (!w->nl_cb) {
 676                 os_free(w);
 677                 return NULL;
 678         }
 679         nl_cb_set(w->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM, no_seq_check, NULL);
 680         nl_cb_set(w->nl_cb, NL_CB_VALID, NL_CB_CUSTOM, process_beacon_event,
 681                   w);
 682
 683         w->nl_beacons = nl_create_handle(bss->drv->global->nl_cb,
 684                                          "wiphy beacons");
 685         if (w->nl_beacons == NULL) {
 686                 os_free(w);
 687                 return NULL;
 688         }
 689
 690         if (nl80211_register_beacons(bss->drv, w)) {
 691                 nl_destroy_handles(&w->nl_beacons);
 692                 os_free(w);
 693                 return NULL;
 694         }
 695
 696         eloop_register_read_sock(nl_socket_get_fd(w->nl_beacons),
 697                                  nl80211_recv_beacons, w, w->nl_beacons);
 698
 699         dl_list_add(&nl80211_wiphys, &w->list);
 700
 701 add:
 702         /* drv entry for this bss already there? */
 703         dl_list_for_each(tmp_bss, &w->bsss, struct i802_bss, wiphy_list) {
 704                 if (tmp_bss->drv == bss->drv) {
 705                         found = 1;
 706                         break;
 707                 }
 708         }
 709         /* if not add it */
 710         if (!found)
 711                 dl_list_add(&w->drvs, &bss->drv->wiphy_list);
 712
 713         dl_list_add(&w->bsss, &bss->wiphy_list);
 714         bss->wiphy_data = w;
 715         return w;
 716 }
 717
 718
 719 static void nl80211_put_wiphy_data_ap(struct i802_bss *bss)
 720 {
 721         struct nl80211_wiphy_data *w = bss->wiphy_data;
 722         struct i802_bss *tmp_bss;
 723         int found = 0;
 724
 725         if (w == NULL)
 726                 return;
 727         bss->wiphy_data = NULL;
 728         dl_list_del(&bss->wiphy_list);
 729
 730         /* still any for this drv present? */
 731         dl_list_for_each(tmp_bss, &w->bsss, struct i802_bss, wiphy_list) {
 732                 if (tmp_bss->drv == bss->drv) {
 733                         found = 1;
 734                         break;
 735                 }
 736         }
 737         /* if not remove it */
 738         if (!found)
 739                 dl_list_del(&bss->drv->wiphy_list);
 740
 741         if (!dl_list_empty(&w->bsss))
 742                 return;
 743
 744         eloop_unregister_read_sock(nl_socket_get_fd(w->nl_beacons));
 745
 746         nl_cb_put(w->nl_cb);
 747         nl_destroy_handles(&w->nl_beacons);
 748         dl_list_del(&w->list);
 749         os_free(w);
 750 }
 751
 752
 753 static int wpa_driver_nl80211_get_bssid(void *priv, u8 *bssid)
 754 {
 755         struct i802_bss *bss = priv;
 756         struct wpa_driver_nl80211_data *drv = bss->drv;
 757         if (!drv->associated)
 758                 return -1;
 759         os_memcpy(bssid, drv->bssid, ETH_ALEN);
 760         return 0;
 761 }
 762
 763
 764 static int wpa_driver_nl80211_get_ssid(void *priv, u8 *ssid)
 765 {
 766         struct i802_bss *bss = priv;
 767         struct wpa_driver_nl80211_data *drv = bss->drv;
 768         if (!drv->associated)
 769                 return -1;
 770         os_memcpy(ssid, drv->ssid, drv->ssid_len);
 771         return drv->ssid_len;
 772 }
 773
 774
 775 static void wpa_driver_nl80211_event_link(struct wpa_driver_nl80211_data *drv,
 776                                           char *buf, size_t len, int del)
 777 {
 778         union wpa_event_data event;
 779
 780         os_memset(&event, 0, sizeof(event));
 781         if (len > sizeof(event.interface_status.ifname))
 782                 len = sizeof(event.interface_status.ifname) - 1;
 783         os_memcpy(event.interface_status.ifname, buf, len);
 784         event.interface_status.ievent = del ? EVENT_INTERFACE_REMOVED :
 785                 EVENT_INTERFACE_ADDED;
 786
 787         wpa_printf(MSG_DEBUG, "RTM_%sLINK, IFLA_IFNAME: Interface '%s' %s",
 788                    del ? "DEL" : "NEW",
 789                    event.interface_status.ifname,
 790                    del ? "removed" : "added");
 791
 792         if (os_strcmp(drv->first_bss.ifname, event.interface_status.ifname) == 0) {
 793                 if (del) {
 794                         if (drv->if_removed) {
 795                                 wpa_printf(MSG_DEBUG, "nl80211: if_removed "
 796                                            "already set - ignore event");
 797                                 return;
 798                         }
 799                         drv->if_removed = 1;
 800                 } else {
 801                         if (if_nametoindex(drv->first_bss.ifname) == 0) {
 802                                 wpa_printf(MSG_DEBUG, "nl80211: Interface %s "
 803                                            "does not exist - ignore "
 804                                            "RTM_NEWLINK",
 805                                            drv->first_bss.ifname);
 806                                 return;
 807                         }
 808                         if (!drv->if_removed) {
 809                                 wpa_printf(MSG_DEBUG, "nl80211: if_removed "
 810                                            "already cleared - ignore event");
 811                                 return;
 812                         }
 813                         drv->if_removed = 0;
 814                 }
 815         }
 816
 817         wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_STATUS, &event);
 818 }
 819
 820
 821 static int wpa_driver_nl80211_own_ifname(struct wpa_driver_nl80211_data *drv,
 822                                          u8 *buf, size_t len)
 823 {
 824         int attrlen, rta_len;
 825         struct rtattr *attr;
 826
 827         attrlen = len;
 828         attr = (struct rtattr *) buf;
 829
 830         rta_len = RTA_ALIGN(sizeof(struct rtattr));
 831         while (RTA_OK(attr, attrlen)) {
 832                 if (attr->rta_type == IFLA_IFNAME) {
 833                         if (os_strcmp(((char *) attr) + rta_len, drv->first_bss.ifname)
 834                             == 0)
 835                                 return 1;
 836                         else
 837                                 break;
 838                 }
 839                 attr = RTA_NEXT(attr, attrlen);
 840         }
 841
 842         return 0;
 843 }
 844
 845
 846 static int wpa_driver_nl80211_own_ifindex(struct wpa_driver_nl80211_data *drv,
 847                                           int ifindex, u8 *buf, size_t len)
 848 {
 849         if (drv->ifindex == ifindex)
 850                 return 1;
 851
 852         if (drv->if_removed && wpa_driver_nl80211_own_ifname(drv, buf, len)) {
 853                 drv->first_bss.ifindex = if_nametoindex(drv->first_bss.ifname);
 854                 wpa_printf(MSG_DEBUG, "nl80211: Update ifindex for a removed "
 855                            "interface");
 856                 wpa_driver_nl80211_finish_drv_init(drv);
 857                 return 1;
 858         }
 859
 860         return 0;
 861 }
 862
 863
 864 static struct wpa_driver_nl80211_data *
 865 nl80211_find_drv(struct nl80211_global *global, int idx, u8 *buf, size_t len)
 866 {
 867         struct wpa_driver_nl80211_data *drv;
 868         dl_list_for_each(drv, &global->interfaces,
 869                          struct wpa_driver_nl80211_data, list) {
 870                 if (wpa_driver_nl80211_own_ifindex(drv, idx, buf, len) ||
 871                     have_ifidx(drv, idx))
 872                         return drv;
 873         }
 874         return NULL;
 875 }
 876
 877
 878 static void wpa_driver_nl80211_event_rtm_newlink(void *ctx,
 879                                                  struct ifinfomsg *ifi,
 880                                                  u8 *buf, size_t len)
 881 {
 882         struct nl80211_global *global = ctx;
 883         struct wpa_driver_nl80211_data *drv;
 884         int attrlen, rta_len;
 885         struct rtattr *attr;
 886         u32 brid = 0;
 887         char namebuf[IFNAMSIZ];
 888
 889         drv = nl80211_find_drv(global, ifi->ifi_index, buf, len);
 890         if (!drv) {
 891                 wpa_printf(MSG_DEBUG, "nl80211: Ignore event for foreign "
 892                            "ifindex %d", ifi->ifi_index);
 893                 return;
 894         }
 895
 896         wpa_printf(MSG_DEBUG, "RTM_NEWLINK: operstate=%d ifi_flags=0x%x "
 897                    "(%s%s%s%s)",
 898                    drv->operstate, ifi->ifi_flags,
 899                    (ifi->ifi_flags & IFF_UP) ? "[UP]" : "",
 900                    (ifi->ifi_flags & IFF_RUNNING) ? "[RUNNING]" : "",
 901                    (ifi->ifi_flags & IFF_LOWER_UP) ? "[LOWER_UP]" : "",
 902                    (ifi->ifi_flags & IFF_DORMANT) ? "[DORMANT]" : "");
 903
 904         if (!drv->if_disabled && !(ifi->ifi_flags & IFF_UP)) {
 905                 if (if_indextoname(ifi->ifi_index, namebuf) &&
 906                     linux_iface_up(drv->global->ioctl_sock,
 907                                    drv->first_bss.ifname) > 0) {
 908                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface down "
 909                                    "event since interface %s is up", namebuf);
 910                         return;
 911                 }
 912                 wpa_printf(MSG_DEBUG, "nl80211: Interface down");
 913                 if (drv->ignore_if_down_event) {
 914                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface down "
 915                                    "event generated by mode change");
 916                         drv->ignore_if_down_event = 0;
 917                 } else {
 918                         drv->if_disabled = 1;
 919                         wpa_supplicant_event(drv->ctx,
 920                                              EVENT_INTERFACE_DISABLED, NULL);
 921                 }
 922         }
 923
 924         if (drv->if_disabled && (ifi->ifi_flags & IFF_UP)) {
 925                 if (if_indextoname(ifi->ifi_index, namebuf) &&
 926                     linux_iface_up(drv->global->ioctl_sock,
 927                                    drv->first_bss.ifname) == 0) {
 928                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface up "
 929                                    "event since interface %s is down",
 930                                    namebuf);
 931                 } else if (if_nametoindex(drv->first_bss.ifname) == 0) {
 932                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface up "
 933                                    "event since interface %s does not exist",
 934                                    drv->first_bss.ifname);
 935                 } else if (drv->if_removed) {
 936                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface up "
 937                                    "event since interface %s is marked "
 938                                    "removed", drv->first_bss.ifname);
 939                 } else {
 940                         wpa_printf(MSG_DEBUG, "nl80211: Interface up");
 941                         drv->if_disabled = 0;
 942                         wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_ENABLED,
 943                                              NULL);
 944                 }
 945         }
 946
 947         /*
 948          * Some drivers send the association event before the operup event--in
 949          * this case, lifting operstate in wpa_driver_nl80211_set_operstate()
 950          * fails. This will hit us when wpa_supplicant does not need to do
 951          * IEEE 802.1X authentication
 952          */
 953         if (drv->operstate == 1 &&
 954             (ifi->ifi_flags & (IFF_LOWER_UP | IFF_DORMANT)) == IFF_LOWER_UP &&
 955             !(ifi->ifi_flags & IFF_RUNNING))
 956                 netlink_send_oper_ifla(drv->global->netlink, drv->ifindex,
 957                                        -1, IF_OPER_UP);
 958
 959         attrlen = len;
 960         attr = (struct rtattr *) buf;
 961         rta_len = RTA_ALIGN(sizeof(struct rtattr));
 962         while (RTA_OK(attr, attrlen)) {
 963                 if (attr->rta_type == IFLA_IFNAME) {
 964                         wpa_driver_nl80211_event_link(
 965                                 drv,
 966                                 ((char *) attr) + rta_len,
 967                                 attr->rta_len - rta_len, 0);
 968                 } else if (attr->rta_type == IFLA_MASTER)
 969                         brid = nla_get_u32((struct nlattr *) attr);
 970                 attr = RTA_NEXT(attr, attrlen);
 971         }
 972
 973         if (ifi->ifi_family == AF_BRIDGE && brid) {
 974                 /* device has been added to bridge */
 975                 if_indextoname(brid, namebuf);
 976                 wpa_printf(MSG_DEBUG, "nl80211: Add ifindex %u for bridge %s",
 977                            brid, namebuf);
 978                 add_ifidx(drv, brid);
 979         }
 980 }
 981
 982
 983 static void wpa_driver_nl80211_event_rtm_dellink(void *ctx,
 984                                                  struct ifinfomsg *ifi,
 985                                                  u8 *buf, size_t len)
 986 {
 987         struct nl80211_global *global = ctx;
 988         struct wpa_driver_nl80211_data *drv;
 989         int attrlen, rta_len;
 990         struct rtattr *attr;
 991         u32 brid = 0;
 992
 993         drv = nl80211_find_drv(global, ifi->ifi_index, buf, len);
 994         if (!drv) {
 995                 wpa_printf(MSG_DEBUG, "nl80211: Ignore dellink event for "
 996                            "foreign ifindex %d", ifi->ifi_index);
 997                 return;
 998         }
 999
1000         attrlen = len;
1001         attr = (struct rtattr *) buf;
1002
1003         rta_len = RTA_ALIGN(sizeof(struct rtattr));
1004         while (RTA_OK(attr, attrlen)) {
1005                 if (attr->rta_type == IFLA_IFNAME) {
1006                         wpa_driver_nl80211_event_link(
1007                                 drv,
1008                                 ((char *) attr) + rta_len,
1009                                 attr->rta_len - rta_len, 1);
1010                 } else if (attr->rta_type == IFLA_MASTER)
1011                         brid = nla_get_u32((struct nlattr *) attr);
1012                 attr = RTA_NEXT(attr, attrlen);
1013         }
1014
1015         if (ifi->ifi_family == AF_BRIDGE && brid) {
1016                 /* device has been removed from bridge */
1017                 char namebuf[IFNAMSIZ];
1018                 if_indextoname(brid, namebuf);
1019                 wpa_printf(MSG_DEBUG, "nl80211: Remove ifindex %u for bridge "
1020                            "%s", brid, namebuf);
1021                 del_ifidx(drv, brid);
1022         }
1023 }
1024
1025
1026 static void mlme_event_auth(struct wpa_driver_nl80211_data *drv,
1027                             const u8 *frame, size_t len)
1028 {
1029         const struct ieee80211_mgmt *mgmt;
1030         union wpa_event_data event;
1031
1032         mgmt = (const struct ieee80211_mgmt *) frame;
1033         if (len < 24 + sizeof(mgmt->u.auth)) {
1034                 wpa_printf(MSG_DEBUG, "nl80211: Too short association event "
1035                            "frame");
1036                 return;
1037         }
1038
1039         os_memcpy(drv->auth_bssid, mgmt->sa, ETH_ALEN);
1040         os_memset(&event, 0, sizeof(event));
1041         os_memcpy(event.auth.peer, mgmt->sa, ETH_ALEN);
1042         event.auth.auth_type = le_to_host16(mgmt->u.auth.auth_alg);
1043         event.auth.status_code = le_to_host16(mgmt->u.auth.status_code);
1044         if (len > 24 + sizeof(mgmt->u.auth)) {
1045                 event.auth.ies = mgmt->u.auth.variable;
1046                 event.auth.ies_len = len - 24 - sizeof(mgmt->u.auth);
1047         }
1048
1049         wpa_supplicant_event(drv->ctx, EVENT_AUTH, &event);
1050 }
1051
1052
1053 static unsigned int nl80211_get_assoc_freq(struct wpa_driver_nl80211_data *drv)
1054 {
1055         struct nl_msg *msg;
1056         int ret;
1057         struct nl80211_bss_info_arg arg;
1058
1059         os_memset(&arg, 0, sizeof(arg));
1060         msg = nlmsg_alloc();
1061         if (!msg)
1062                 goto nla_put_failure;
1063
1064         nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_SCAN);
1065         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1066
1067         arg.drv = drv;
1068         ret = send_and_recv_msgs(drv, msg, bss_info_handler, &arg);
1069         msg = NULL;
1070         if (ret == 0) {
1071                 wpa_printf(MSG_DEBUG, "nl80211: Operating frequency for the "
1072                            "associated BSS from scan results: %u MHz",
1073                            arg.assoc_freq);
1074                 return arg.assoc_freq ? arg.assoc_freq : drv->assoc_freq;
1075         }
1076         wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d "
1077                    "(%s)", ret, strerror(-ret));
1078 nla_put_failure:
1079         nlmsg_free(msg);
1080         return drv->assoc_freq;
1081 }
1082
1083
1084 static void mlme_event_assoc(struct wpa_driver_nl80211_data *drv,
1085                             const u8 *frame, size_t len)
1086 {
1087         const struct ieee80211_mgmt *mgmt;
1088         union wpa_event_data event;
1089         u16 status;
1090
1091         mgmt = (const struct ieee80211_mgmt *) frame;
1092         if (len < 24 + sizeof(mgmt->u.assoc_resp)) {
1093                 wpa_printf(MSG_DEBUG, "nl80211: Too short association event "
1094                            "frame");
1095                 return;
1096         }
1097
1098         status = le_to_host16(mgmt->u.assoc_resp.status_code);
1099         if (status != WLAN_STATUS_SUCCESS) {
1100                 os_memset(&event, 0, sizeof(event));
1101                 event.assoc_reject.bssid = mgmt->bssid;
1102                 if (len > 24 + sizeof(mgmt->u.assoc_resp)) {
1103                         event.assoc_reject.resp_ies =
1104                                 (u8 *) mgmt->u.assoc_resp.variable;
1105                         event.assoc_reject.resp_ies_len =
1106                                 len - 24 - sizeof(mgmt->u.assoc_resp);
1107                 }
1108                 event.assoc_reject.status_code = status;
1109
1110                 wpa_supplicant_event(drv->ctx, EVENT_ASSOC_REJECT, &event);
1111                 return;
1112         }
1113
1114         drv->associated = 1;
1115         os_memcpy(drv->bssid, mgmt->sa, ETH_ALEN);
1116
1117         os_memset(&event, 0, sizeof(event));
1118         if (len > 24 + sizeof(mgmt->u.assoc_resp)) {
1119                 event.assoc_info.resp_ies = (u8 *) mgmt->u.assoc_resp.variable;
1120                 event.assoc_info.resp_ies_len =
1121                         len - 24 - sizeof(mgmt->u.assoc_resp);
1122         }
1123
1124         event.assoc_info.freq = drv->assoc_freq;
1125
1126         wpa_supplicant_event(drv->ctx, EVENT_ASSOC, &event);
1127 }
1128
1129
1130 static void mlme_event_connect(struct wpa_driver_nl80211_data *drv,
1131                                enum nl80211_commands cmd, struct nlattr *status,
1132                                struct nlattr *addr, struct nlattr *req_ie,
1133                                struct nlattr *resp_ie)
1134 {
1135         union wpa_event_data event;
1136
1137         if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) {
1138                 /*
1139                  * Avoid reporting two association events that would confuse
1140                  * the core code.
1141                  */
1142                 wpa_printf(MSG_DEBUG, "nl80211: Ignore connect event (cmd=%d) "
1143                            "when using userspace SME", cmd);
1144                 return;
1145         }
1146
1147         os_memset(&event, 0, sizeof(event));
1148         if (cmd == NL80211_CMD_CONNECT &&
1149             nla_get_u16(status) != WLAN_STATUS_SUCCESS) {
1150                 if (addr)
1151                         event.assoc_reject.bssid = nla_data(addr);
1152                 if (resp_ie) {
1153                         event.assoc_reject.resp_ies = nla_data(resp_ie);
1154                         event.assoc_reject.resp_ies_len = nla_len(resp_ie);
1155                 }
1156                 event.assoc_reject.status_code = nla_get_u16(status);
1157                 wpa_supplicant_event(drv->ctx, EVENT_ASSOC_REJECT, &event);
1158                 return;
1159         }
1160
1161         drv->associated = 1;
1162         if (addr)
1163                 os_memcpy(drv->bssid, nla_data(addr), ETH_ALEN);
1164
1165         if (req_ie) {
1166                 event.assoc_info.req_ies = nla_data(req_ie);
1167                 event.assoc_info.req_ies_len = nla_len(req_ie);
1168         }
1169         if (resp_ie) {
1170                 event.assoc_info.resp_ies = nla_data(resp_ie);
1171                 event.assoc_info.resp_ies_len = nla_len(resp_ie);
1172         }
1173
1174         event.assoc_info.freq = nl80211_get_assoc_freq(drv);
1175
1176         wpa_supplicant_event(drv->ctx, EVENT_ASSOC, &event);
1177 }
1178
1179
1180 static void mlme_event_disconnect(struct wpa_driver_nl80211_data *drv,
1181                                   struct nlattr *reason, struct nlattr *addr,
1182                                   struct nlattr *by_ap)
1183 {
1184         union wpa_event_data data;
1185
1186         if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) {
1187                 /*
1188                  * Avoid reporting two disassociation events that could
1189                  * confuse the core code.
1190                  */
1191                 wpa_printf(MSG_DEBUG, "nl80211: Ignore disconnect "
1192                            "event when using userspace SME");
1193                 return;
1194         }
1195
1196         drv->associated = 0;
1197         os_memset(&data, 0, sizeof(data));
1198         if (reason)
1199                 data.deauth_info.reason_code = nla_get_u16(reason);
1200         data.deauth_info.locally_generated = by_ap == NULL;
1201         wpa_supplicant_event(drv->ctx, EVENT_DEAUTH, &data);
1202 }
1203
1204
1205 static void mlme_event_ch_switch(struct wpa_driver_nl80211_data *drv,
1206                                  struct nlattr *freq, struct nlattr *type)
1207 {
1208         union wpa_event_data data;
1209         int ht_enabled = 1;
1210         int chan_offset = 0;
1211
1212         wpa_printf(MSG_DEBUG, "nl80211: Channel switch event");
1213
1214         if (!freq || !type)
1215                 return;
1216
1217         switch (nla_get_u32(type)) {
1218         case NL80211_CHAN_NO_HT:
1219                 ht_enabled = 0;
1220                 break;
1221         case NL80211_CHAN_HT20:
1222                 break;
1223         case NL80211_CHAN_HT40PLUS:
1224                 chan_offset = 1;
1225                 break;
1226         case NL80211_CHAN_HT40MINUS:
1227                 chan_offset = -1;
1228                 break;
1229         }
1230
1231         data.ch_switch.freq = nla_get_u32(freq);
1232         data.ch_switch.ht_enabled = ht_enabled;
1233         data.ch_switch.ch_offset = chan_offset;
1234
1235         wpa_supplicant_event(drv->ctx, EVENT_CH_SWITCH, &data);
1236 }
1237
1238
1239 static void mlme_timeout_event(struct wpa_driver_nl80211_data *drv,
1240                                enum nl80211_commands cmd, struct nlattr *addr)
1241 {
1242         union wpa_event_data event;
1243         enum wpa_event_type ev;
1244
1245         if (nla_len(addr) != ETH_ALEN)
1246                 return;
1247
1248         wpa_printf(MSG_DEBUG, "nl80211: MLME event %d; timeout with " MACSTR,
1249                    cmd, MAC2STR((u8 *) nla_data(addr)));
1250
1251         if (cmd == NL80211_CMD_AUTHENTICATE)
1252                 ev = EVENT_AUTH_TIMED_OUT;
1253         else if (cmd == NL80211_CMD_ASSOCIATE)
1254                 ev = EVENT_ASSOC_TIMED_OUT;
1255         else
1256                 return;
1257
1258         os_memset(&event, 0, sizeof(event));
1259         os_memcpy(event.timeout_event.addr, nla_data(addr), ETH_ALEN);
1260         wpa_supplicant_event(drv->ctx, ev, &event);
1261 }
1262
1263
1264 static void mlme_event_mgmt(struct wpa_driver_nl80211_data *drv,
1265                             struct nlattr *freq, struct nlattr *sig,
1266                             const u8 *frame, size_t len)
1267 {
1268         const struct ieee80211_mgmt *mgmt;
1269         union wpa_event_data event;
1270         u16 fc, stype;
1271         int ssi_signal = 0;
1272
1273         mgmt = (const struct ieee80211_mgmt *) frame;
1274         if (len < 24) {
1275                 wpa_printf(MSG_DEBUG, "nl80211: Too short action frame");
1276                 return;
1277         }
1278
1279         fc = le_to_host16(mgmt->frame_control);
1280         stype = WLAN_FC_GET_STYPE(fc);
1281
1282         if (sig)
1283                 ssi_signal = (s32) nla_get_u32(sig);
1284
1285         os_memset(&event, 0, sizeof(event));
1286         if (freq) {
1287                 event.rx_action.freq = nla_get_u32(freq);
1288                 drv->last_mgmt_freq = event.rx_action.freq;
1289         }
1290         if (stype == WLAN_FC_STYPE_ACTION) {
1291                 event.rx_action.da = mgmt->da;
1292                 event.rx_action.sa = mgmt->sa;
1293                 event.rx_action.bssid = mgmt->bssid;
1294                 event.rx_action.category = mgmt->u.action.category;
1295                 event.rx_action.data = &mgmt->u.action.category + 1;
1296                 event.rx_action.len = frame + len - event.rx_action.data;
1297                 wpa_supplicant_event(drv->ctx, EVENT_RX_ACTION, &event);
1298         } else {
1299                 event.rx_mgmt.frame = frame;
1300                 event.rx_mgmt.frame_len = len;
1301                 event.rx_mgmt.ssi_signal = ssi_signal;
1302                 wpa_supplicant_event(drv->ctx, EVENT_RX_MGMT, &event);
1303         }
1304 }
1305
1306
1307 static void mlme_event_mgmt_tx_status(struct wpa_driver_nl80211_data *drv,
1308                                       struct nlattr *cookie, const u8 *frame,
1309                                       size_t len, struct nlattr *ack)
1310 {
1311         union wpa_event_data event;
1312         const struct ieee80211_hdr *hdr;
1313         u16 fc;
1314
1315         if (!is_ap_interface(drv->nlmode)) {
1316                 u64 cookie_val;
1317
1318                 if (!cookie)
1319                         return;
1320
1321                 cookie_val = nla_get_u64(cookie);
1322                 wpa_printf(MSG_DEBUG, "nl80211: Action TX status:"
1323                            " cookie=0%llx%s (ack=%d)",
1324                            (long long unsigned int) cookie_val,
1325                            cookie_val == drv->send_action_cookie ?
1326                            " (match)" : " (unknown)", ack != NULL);
1327                 if (cookie_val != drv->send_action_cookie)
1328                         return;
1329         }
1330
1331         hdr = (const struct ieee80211_hdr *) frame;
1332         fc = le_to_host16(hdr->frame_control);
1333
1334         os_memset(&event, 0, sizeof(event));
1335         event.tx_status.type = WLAN_FC_GET_TYPE(fc);
1336         event.tx_status.stype = WLAN_FC_GET_STYPE(fc);
1337         event.tx_status.dst = hdr->addr1;
1338         event.tx_status.data = frame;
1339         event.tx_status.data_len = len;
1340         event.tx_status.ack = ack != NULL;
1341         wpa_supplicant_event(drv->ctx, EVENT_TX_STATUS, &event);
1342 }
1343
1344
1345 static void mlme_event_deauth_disassoc(struct wpa_driver_nl80211_data *drv,
1346                                        enum wpa_event_type type,
1347                                        const u8 *frame, size_t len)
1348 {
1349         const struct ieee80211_mgmt *mgmt;
1350         union wpa_event_data event;
1351         const u8 *bssid = NULL;
1352         u16 reason_code = 0;
1353
1354         mgmt = (const struct ieee80211_mgmt *) frame;
1355         if (len >= 24) {
1356                 bssid = mgmt->bssid;
1357
1358                 if (drv->associated != 0 &&
1359                     os_memcmp(bssid, drv->bssid, ETH_ALEN) != 0 &&
1360                     os_memcmp(bssid, drv->auth_bssid, ETH_ALEN) != 0) {
1361                         /*
1362                          * We have presumably received this deauth as a
1363                          * response to a clear_state_mismatch() outgoing
1364                          * deauth.  Don't let it take us offline!
1365                          */
1366                         wpa_printf(MSG_DEBUG, "nl80211: Deauth received "
1367                                    "from Unknown BSSID " MACSTR " -- ignoring",
1368                                    MAC2STR(bssid));
1369                         return;
1370                 }
1371         }
1372
1373         drv->associated = 0;
1374         os_memset(&event, 0, sizeof(event));
1375
1376         /* Note: Same offset for Reason Code in both frame subtypes */
1377         if (len >= 24 + sizeof(mgmt->u.deauth))
1378                 reason_code = le_to_host16(mgmt->u.deauth.reason_code);
1379
1380         if (type == EVENT_DISASSOC) {
1381                 event.disassoc_info.locally_generated =
1382                         !os_memcmp(mgmt->sa, drv->first_bss.addr, ETH_ALEN);
1383                 event.disassoc_info.addr = bssid;
1384                 event.disassoc_info.reason_code = reason_code;
1385                 if (frame + len > mgmt->u.disassoc.variable) {
1386                         event.disassoc_info.ie = mgmt->u.disassoc.variable;
1387                         event.disassoc_info.ie_len = frame + len -
1388                                 mgmt->u.disassoc.variable;
1389                 }
1390         } else {
1391                 event.deauth_info.locally_generated =
1392                         !os_memcmp(mgmt->sa, drv->first_bss.addr, ETH_ALEN);
1393                 event.deauth_info.addr = bssid;
1394                 event.deauth_info.reason_code = reason_code;
1395                 if (frame + len > mgmt->u.deauth.variable) {
1396                         event.deauth_info.ie = mgmt->u.deauth.variable;
1397                         event.deauth_info.ie_len = frame + len -
1398                                 mgmt->u.deauth.variable;
1399                 }
1400         }
1401
1402         wpa_supplicant_event(drv->ctx, type, &event);
1403 }
1404
1405
1406 static void mlme_event_unprot_disconnect(struct wpa_driver_nl80211_data *drv,
1407                                          enum wpa_event_type type,
1408                                          const u8 *frame, size_t len)
1409 {
1410         const struct ieee80211_mgmt *mgmt;
1411         union wpa_event_data event;
1412         u16 reason_code = 0;
1413
1414         if (len < 24)
1415                 return;
1416
1417         mgmt = (const struct ieee80211_mgmt *) frame;
1418
1419         os_memset(&event, 0, sizeof(event));
1420         /* Note: Same offset for Reason Code in both frame subtypes */
1421         if (len >= 24 + sizeof(mgmt->u.deauth))
1422                 reason_code = le_to_host16(mgmt->u.deauth.reason_code);
1423
1424         if (type == EVENT_UNPROT_DISASSOC) {
1425                 event.unprot_disassoc.sa = mgmt->sa;
1426                 event.unprot_disassoc.da = mgmt->da;
1427                 event.unprot_disassoc.reason_code = reason_code;
1428         } else {
1429                 event.unprot_deauth.sa = mgmt->sa;
1430                 event.unprot_deauth.da = mgmt->da;
1431                 event.unprot_deauth.reason_code = reason_code;
1432         }
1433
1434         wpa_supplicant_event(drv->ctx, type, &event);
1435 }
1436
1437
1438 static void mlme_event(struct wpa_driver_nl80211_data *drv,
1439                        enum nl80211_commands cmd, struct nlattr *frame,
1440                        struct nlattr *addr, struct nlattr *timed_out,
1441                        struct nlattr *freq, struct nlattr *ack,
1442                        struct nlattr *cookie, struct nlattr *sig)
1443 {
1444         if (timed_out && addr) {
1445                 mlme_timeout_event(drv, cmd, addr);
1446                 return;
1447         }
1448
1449         if (frame == NULL) {
1450                 wpa_printf(MSG_DEBUG, "nl80211: MLME event %d without frame "
1451                            "data", cmd);
1452                 return;
1453         }
1454
1455         wpa_printf(MSG_DEBUG, "nl80211: MLME event %d", cmd);
1456         wpa_hexdump(MSG_MSGDUMP, "nl80211: MLME event frame",
1457                     nla_data(frame), nla_len(frame));
1458
1459         switch (cmd) {
1460         case NL80211_CMD_AUTHENTICATE:
1461                 mlme_event_auth(drv, nla_data(frame), nla_len(frame));
1462                 break;
1463         case NL80211_CMD_ASSOCIATE:
1464                 mlme_event_assoc(drv, nla_data(frame), nla_len(frame));
1465                 break;
1466         case NL80211_CMD_DEAUTHENTICATE:
1467                 mlme_event_deauth_disassoc(drv, EVENT_DEAUTH,
1468                                            nla_data(frame), nla_len(frame));
1469                 break;
1470         case NL80211_CMD_DISASSOCIATE:
1471                 mlme_event_deauth_disassoc(drv, EVENT_DISASSOC,
1472                                            nla_data(frame), nla_len(frame));
1473                 break;
1474         case NL80211_CMD_FRAME:
1475                 mlme_event_mgmt(drv, freq, sig, nla_data(frame),
1476                                 nla_len(frame));
1477                 break;
1478         case NL80211_CMD_FRAME_TX_STATUS:
1479                 mlme_event_mgmt_tx_status(drv, cookie, nla_data(frame),
1480                                           nla_len(frame), ack);
1481                 break;
1482         case NL80211_CMD_UNPROT_DEAUTHENTICATE:
1483                 mlme_event_unprot_disconnect(drv, EVENT_UNPROT_DEAUTH,
1484                                              nla_data(frame), nla_len(frame));
1485                 break;
1486         case NL80211_CMD_UNPROT_DISASSOCIATE:
1487                 mlme_event_unprot_disconnect(drv, EVENT_UNPROT_DISASSOC,
1488                                              nla_data(frame), nla_len(frame));
1489                 break;
1490         default:
1491                 break;
1492         }
1493 }
1494
1495
1496 static void mlme_event_michael_mic_failure(struct wpa_driver_nl80211_data *drv,
1497                                            struct nlattr *tb[])
1498 {
1499         union wpa_event_data data;
1500
1501         wpa_printf(MSG_DEBUG, "nl80211: MLME event Michael MIC failure");
1502         os_memset(&data, 0, sizeof(data));
1503         if (tb[NL80211_ATTR_MAC]) {
1504                 wpa_hexdump(MSG_DEBUG, "nl80211: Source MAC address",
1505                             nla_data(tb[NL80211_ATTR_MAC]),
1506                             nla_len(tb[NL80211_ATTR_MAC]));
1507                 data.michael_mic_failure.src = nla_data(tb[NL80211_ATTR_MAC]);
1508         }
1509         if (tb[NL80211_ATTR_KEY_SEQ]) {
1510                 wpa_hexdump(MSG_DEBUG, "nl80211: TSC",
1511                             nla_data(tb[NL80211_ATTR_KEY_SEQ]),
1512                             nla_len(tb[NL80211_ATTR_KEY_SEQ]));
1513         }
1514         if (tb[NL80211_ATTR_KEY_TYPE]) {
1515                 enum nl80211_key_type key_type =
1516                         nla_get_u32(tb[NL80211_ATTR_KEY_TYPE]);
1517                 wpa_printf(MSG_DEBUG, "nl80211: Key Type %d", key_type);
1518                 if (key_type == NL80211_KEYTYPE_PAIRWISE)
1519                         data.michael_mic_failure.unicast = 1;
1520         } else
1521                 data.michael_mic_failure.unicast = 1;
1522
1523         if (tb[NL80211_ATTR_KEY_IDX]) {
1524                 u8 key_id = nla_get_u8(tb[NL80211_ATTR_KEY_IDX]);
1525                 wpa_printf(MSG_DEBUG, "nl80211: Key Id %d", key_id);
1526         }
1527
1528         wpa_supplicant_event(drv->ctx, EVENT_MICHAEL_MIC_FAILURE, &data);
1529 }
1530
1531
1532 static void mlme_event_join_ibss(struct wpa_driver_nl80211_data *drv,
1533                                  struct nlattr *tb[])
1534 {
1535         if (tb[NL80211_ATTR_MAC] == NULL) {
1536                 wpa_printf(MSG_DEBUG, "nl80211: No address in IBSS joined "
1537                            "event");
1538                 return;
1539         }
1540         os_memcpy(drv->bssid, nla_data(tb[NL80211_ATTR_MAC]), ETH_ALEN);
1541         drv->associated = 1;
1542         wpa_printf(MSG_DEBUG, "nl80211: IBSS " MACSTR " joined",
1543                    MAC2STR(drv->bssid));
1544
1545         wpa_supplicant_event(drv->ctx, EVENT_ASSOC, NULL);
1546 }
1547
1548
1549 static void mlme_event_remain_on_channel(struct wpa_driver_nl80211_data *drv,
1550                                          int cancel_event, struct nlattr *tb[])
1551 {
1552         unsigned int freq, chan_type, duration;
1553         union wpa_event_data data;
1554         u64 cookie;
1555
1556         if (tb[NL80211_ATTR_WIPHY_FREQ])
1557                 freq = nla_get_u32(tb[NL80211_ATTR_WIPHY_FREQ]);
1558         else
1559                 freq = 0;
1560
1561         if (tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE])
1562                 chan_type = nla_get_u32(tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1563         else
1564                 chan_type = 0;
1565
1566         if (tb[NL80211_ATTR_DURATION])
1567                 duration = nla_get_u32(tb[NL80211_ATTR_DURATION]);
1568         else
1569                 duration = 0;
1570
1571         if (tb[NL80211_ATTR_COOKIE])
1572                 cookie = nla_get_u64(tb[NL80211_ATTR_COOKIE]);
1573         else
1574                 cookie = 0;
1575
1576         wpa_printf(MSG_DEBUG, "nl80211: Remain-on-channel event (cancel=%d "
1577                    "freq=%u channel_type=%u duration=%u cookie=0x%llx (%s))",
1578                    cancel_event, freq, chan_type, duration,
1579                    (long long unsigned int) cookie,
1580                    cookie == drv->remain_on_chan_cookie ? "match" : "unknown");
1581
1582         if (cookie != drv->remain_on_chan_cookie)
1583                 return; /* not for us */
1584
1585         if (cancel_event)
1586                 drv->pending_remain_on_chan = 0;
1587
1588         os_memset(&data, 0, sizeof(data));
1589         data.remain_on_channel.freq = freq;
1590         data.remain_on_channel.duration = duration;
1591         wpa_supplicant_event(drv->ctx, cancel_event ?
1592                              EVENT_CANCEL_REMAIN_ON_CHANNEL :
1593                              EVENT_REMAIN_ON_CHANNEL, &data);
1594 }
1595
1596
1597 static void send_scan_event(struct wpa_driver_nl80211_data *drv, int aborted,
1598                             struct nlattr *tb[])
1599 {
1600         union wpa_event_data event;
1601         struct nlattr *nl;
1602         int rem;
1603         struct scan_info *info;
1604 #define MAX_REPORT_FREQS 50
1605         int freqs[MAX_REPORT_FREQS];
1606         int num_freqs = 0;
1607
1608         if (drv->scan_for_auth) {
1609                 drv->scan_for_auth = 0;
1610                 wpa_printf(MSG_DEBUG, "nl80211: Scan results for missing "
1611                            "cfg80211 BSS entry");
1612                 wpa_driver_nl80211_authenticate_retry(drv);
1613                 return;
1614         }
1615
1616         os_memset(&event, 0, sizeof(event));
1617         info = &event.scan_info;
1618         info->aborted = aborted;
1619
1620         if (tb[NL80211_ATTR_SCAN_SSIDS]) {
1621                 nla_for_each_nested(nl, tb[NL80211_ATTR_SCAN_SSIDS], rem) {
1622                         struct wpa_driver_scan_ssid *s =
1623                                 &info->ssids[info->num_ssids];
1624                         s->ssid = nla_data(nl);
1625                         s->ssid_len = nla_len(nl);
1626                         info->num_ssids++;
1627                         if (info->num_ssids == WPAS_MAX_SCAN_SSIDS)
1628                                 break;
1629                 }
1630         }
1631         if (tb[NL80211_ATTR_SCAN_FREQUENCIES]) {
1632                 nla_for_each_nested(nl, tb[NL80211_ATTR_SCAN_FREQUENCIES], rem)
1633                 {
1634                         freqs[num_freqs] = nla_get_u32(nl);
1635                         num_freqs++;
1636                         if (num_freqs == MAX_REPORT_FREQS - 1)
1637                                 break;
1638                 }
1639                 info->freqs = freqs;
1640                 info->num_freqs = num_freqs;
1641         }
1642         wpa_supplicant_event(drv->ctx, EVENT_SCAN_RESULTS, &event);
1643 }
1644
1645
1646 static int get_link_signal(struct nl_msg *msg, void *arg)
1647 {
1648         struct nlattr *tb[NL80211_ATTR_MAX + 1];
1649         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1650         struct nlattr *sinfo[NL80211_STA_INFO_MAX + 1];
1651         static struct nla_policy policy[NL80211_STA_INFO_MAX + 1] = {
1652                 [NL80211_STA_INFO_SIGNAL] = { .type = NLA_U8 },
1653         };
1654         struct nlattr *rinfo[NL80211_RATE_INFO_MAX + 1];
1655         static struct nla_policy rate_policy[NL80211_RATE_INFO_MAX + 1] = {
1656                 [NL80211_RATE_INFO_BITRATE] = { .type = NLA_U16 },
1657                 [NL80211_RATE_INFO_MCS] = { .type = NLA_U8 },
1658                 [NL80211_RATE_INFO_40_MHZ_WIDTH] = { .type = NLA_FLAG },
1659                 [NL80211_RATE_INFO_SHORT_GI] = { .type = NLA_FLAG },
1660         };
1661         struct wpa_signal_info *sig_change = arg;
1662
1663         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1664                   genlmsg_attrlen(gnlh, 0), NULL);
1665         if (!tb[NL80211_ATTR_STA_INFO] ||
1666             nla_parse_nested(sinfo, NL80211_STA_INFO_MAX,
1667                              tb[NL80211_ATTR_STA_INFO], policy))
1668                 return NL_SKIP;
1669         if (!sinfo[NL80211_STA_INFO_SIGNAL])
1670                 return NL_SKIP;
1671
1672         sig_change->current_signal =
1673                 (s8) nla_get_u8(sinfo[NL80211_STA_INFO_SIGNAL]);
1674
1675         if (sinfo[NL80211_STA_INFO_TX_BITRATE]) {
1676                 if (nla_parse_nested(rinfo, NL80211_RATE_INFO_MAX,
1677                                      sinfo[NL80211_STA_INFO_TX_BITRATE],
1678                                      rate_policy)) {
1679                         sig_change->current_txrate = 0;
1680                 } else {
1681                         if (rinfo[NL80211_RATE_INFO_BITRATE]) {
1682                                 sig_change->current_txrate =
1683                                         nla_get_u16(rinfo[
1684                                              NL80211_RATE_INFO_BITRATE]) * 100;
1685                         }
1686                 }
1687         }
1688
1689         return NL_SKIP;
1690 }
1691
1692
1693 static int nl80211_get_link_signal(struct wpa_driver_nl80211_data *drv,
1694                                    struct wpa_signal_info *sig)
1695 {
1696         struct nl_msg *msg;
1697
1698         sig->current_signal = -9999;
1699         sig->current_txrate = 0;
1700
1701         msg = nlmsg_alloc();
1702         if (!msg)
1703                 return -ENOMEM;
1704
1705         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_STATION);
1706
1707         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1708         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, drv->bssid);
1709
1710         return send_and_recv_msgs(drv, msg, get_link_signal, sig);
1711  nla_put_failure:
1712         nlmsg_free(msg);
1713         return -ENOBUFS;
1714 }
1715
1716
1717 static int get_link_noise(struct nl_msg *msg, void *arg)
1718 {
1719         struct nlattr *tb[NL80211_ATTR_MAX + 1];
1720         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1721         struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
1722         static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
1723                 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
1724                 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
1725         };
1726         struct wpa_signal_info *sig_change = arg;
1727
1728         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1729                   genlmsg_attrlen(gnlh, 0), NULL);
1730
1731         if (!tb[NL80211_ATTR_SURVEY_INFO]) {
1732                 wpa_printf(MSG_DEBUG, "nl80211: survey data missing!");
1733                 return NL_SKIP;
1734         }
1735
1736         if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
1737                              tb[NL80211_ATTR_SURVEY_INFO],
1738                              survey_policy)) {
1739                 wpa_printf(MSG_DEBUG, "nl80211: failed to parse nested "
1740                            "attributes!");
1741                 return NL_SKIP;
1742         }
1743
1744         if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY])
1745                 return NL_SKIP;
1746
1747         if (nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]) !=
1748             sig_change->frequency)
1749                 return NL_SKIP;
1750
1751         if (!sinfo[NL80211_SURVEY_INFO_NOISE])
1752                 return NL_SKIP;
1753
1754         sig_change->current_noise =
1755                 (s8) nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
1756
1757         return NL_SKIP;
1758 }
1759
1760
1761 static int nl80211_get_link_noise(struct wpa_driver_nl80211_data *drv,
1762                                   struct wpa_signal_info *sig_change)
1763 {
1764         struct nl_msg *msg;
1765
1766         sig_change->current_noise = 9999;
1767         sig_change->frequency = drv->assoc_freq;
1768
1769         msg = nlmsg_alloc();
1770         if (!msg)
1771                 return -ENOMEM;
1772
1773         nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_SURVEY);
1774
1775         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1776
1777         return send_and_recv_msgs(drv, msg, get_link_noise, sig_change);
1778  nla_put_failure:
1779         nlmsg_free(msg);
1780         return -ENOBUFS;
1781 }
1782
1783
1784 static int get_noise_for_scan_results(struct nl_msg *msg, void *arg)
1785 {
1786         struct nlattr *tb[NL80211_ATTR_MAX + 1];
1787         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1788         struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
1789         static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
1790                 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
1791                 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
1792         };
1793         struct wpa_scan_results *scan_results = arg;
1794         struct wpa_scan_res *scan_res;
1795         size_t i;
1796
1797         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1798                   genlmsg_attrlen(gnlh, 0), NULL);
1799
1800         if (!tb[NL80211_ATTR_SURVEY_INFO]) {
1801                 wpa_printf(MSG_DEBUG, "nl80211: Survey data missing");
1802                 return NL_SKIP;
1803         }
1804
1805         if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
1806                              tb[NL80211_ATTR_SURVEY_INFO],
1807                              survey_policy)) {
1808                 wpa_printf(MSG_DEBUG, "nl80211: Failed to parse nested "
1809                            "attributes");
1810                 return NL_SKIP;
1811         }
1812
1813         if (!sinfo[NL80211_SURVEY_INFO_NOISE])
1814                 return NL_SKIP;
1815
1816         if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY])
1817                 return NL_SKIP;
1818
1819         for (i = 0; i < scan_results->num; ++i) {
1820                 scan_res = scan_results->res[i];
1821                 if (!scan_res)
1822                         continue;
1823                 if ((int) nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]) !=
1824                     scan_res->freq)
1825                         continue;
1826                 if (!(scan_res->flags & WPA_SCAN_NOISE_INVALID))
1827                         continue;
1828                 scan_res->noise = (s8)
1829                         nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
1830                 scan_res->flags &= ~WPA_SCAN_NOISE_INVALID;
1831         }
1832
1833         return NL_SKIP;
1834 }
1835
1836
1837 static int nl80211_get_noise_for_scan_results(
1838         struct wpa_driver_nl80211_data *drv,
1839         struct wpa_scan_results *scan_res)
1840 {
1841         struct nl_msg *msg;
1842
1843         msg = nlmsg_alloc();
1844         if (!msg)
1845                 return -ENOMEM;
1846
1847         nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_SURVEY);
1848
1849         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1850
1851         return send_and_recv_msgs(drv, msg, get_noise_for_scan_results,
1852                                   scan_res);
1853  nla_put_failure:
1854         nlmsg_free(msg);
1855         return -ENOBUFS;
1856 }
1857
1858
1859 static void nl80211_cqm_event(struct wpa_driver_nl80211_data *drv,
1860                               struct nlattr *tb[])
1861 {
1862         static struct nla_policy cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
1863                 [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
1864                 [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U8 },
1865                 [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
1866                 [NL80211_ATTR_CQM_PKT_LOSS_EVENT] = { .type = NLA_U32 },
1867         };
1868         struct nlattr *cqm[NL80211_ATTR_CQM_MAX + 1];
1869         enum nl80211_cqm_rssi_threshold_event event;
1870         union wpa_event_data ed;
1871         struct wpa_signal_info sig;
1872         int res;
1873
1874         if (tb[NL80211_ATTR_CQM] == NULL ||
1875             nla_parse_nested(cqm, NL80211_ATTR_CQM_MAX, tb[NL80211_ATTR_CQM],
1876                              cqm_policy)) {
1877                 wpa_printf(MSG_DEBUG, "nl80211: Ignore invalid CQM event");
1878                 return;
1879         }
1880
1881         os_memset(&ed, 0, sizeof(ed));
1882
1883         if (cqm[NL80211_ATTR_CQM_PKT_LOSS_EVENT]) {
1884                 if (!tb[NL80211_ATTR_MAC])
1885                         return;
1886                 os_memcpy(ed.low_ack.addr, nla_data(tb[NL80211_ATTR_MAC]),
1887                           ETH_ALEN);
1888                 wpa_supplicant_event(drv->ctx, EVENT_STATION_LOW_ACK, &ed);
1889                 return;
1890         }
1891
1892         if (cqm[NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] == NULL)
1893                 return;
1894         event = nla_get_u32(cqm[NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT]);
1895
1896         if (event == NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH) {
1897                 wpa_printf(MSG_DEBUG, "nl80211: Connection quality monitor "
1898                            "event: RSSI high");
1899                 ed.signal_change.above_threshold = 1;
1900         } else if (event == NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW) {
1901                 wpa_printf(MSG_DEBUG, "nl80211: Connection quality monitor "
1902                            "event: RSSI low");
1903                 ed.signal_change.above_threshold = 0;
1904         } else
1905                 return;
1906
1907         res = nl80211_get_link_signal(drv, &sig);
1908         if (res == 0) {
1909                 ed.signal_change.current_signal = sig.current_signal;
1910                 ed.signal_change.current_txrate = sig.current_txrate;
1911                 wpa_printf(MSG_DEBUG, "nl80211: Signal: %d dBm  txrate: %d",
1912                            sig.current_signal, sig.current_txrate);
1913         }
1914
1915         res = nl80211_get_link_noise(drv, &sig);
1916         if (res == 0) {
1917                 ed.signal_change.current_noise = sig.current_noise;
1918                 wpa_printf(MSG_DEBUG, "nl80211: Noise: %d dBm",
1919                            sig.current_noise);
1920         }
1921
1922         wpa_supplicant_event(drv->ctx, EVENT_SIGNAL_CHANGE, &ed);
1923 }
1924
1925
1926 static void nl80211_new_station_event(struct wpa_driver_nl80211_data *drv,
1927                                       struct nlattr **tb)
1928 {
1929         u8 *addr;
1930         union wpa_event_data data;
1931
1932         if (tb[NL80211_ATTR_MAC] == NULL)
1933                 return;
1934         addr = nla_data(tb[NL80211_ATTR_MAC]);
1935         wpa_printf(MSG_DEBUG, "nl80211: New station " MACSTR, MAC2STR(addr));
1936
1937         if (is_ap_interface(drv->nlmode) && drv->device_ap_sme) {
1938                 u8 *ies = NULL;
1939                 size_t ies_len = 0;
1940                 if (tb[NL80211_ATTR_IE]) {
1941                         ies = nla_data(tb[NL80211_ATTR_IE]);
1942                         ies_len = nla_len(tb[NL80211_ATTR_IE]);
1943                 }
1944                 wpa_hexdump(MSG_DEBUG, "nl80211: Assoc Req IEs", ies, ies_len);
1945                 drv_event_assoc(drv->ctx, addr, ies, ies_len, 0);
1946                 return;
1947         }
1948
1949         if (drv->nlmode != NL80211_IFTYPE_ADHOC)
1950                 return;
1951
1952         os_memset(&data, 0, sizeof(data));
1953         os_memcpy(data.ibss_rsn_start.peer, addr, ETH_ALEN);
1954         wpa_supplicant_event(drv->ctx, EVENT_IBSS_RSN_START, &data);
1955 }
1956
1957
1958 static void nl80211_del_station_event(struct wpa_driver_nl80211_data *drv,
1959                                       struct nlattr **tb)
1960 {
1961         u8 *addr;
1962         union wpa_event_data data;
1963
1964         if (tb[NL80211_ATTR_MAC] == NULL)
1965                 return;
1966         addr = nla_data(tb[NL80211_ATTR_MAC]);
1967         wpa_printf(MSG_DEBUG, "nl80211: Delete station " MACSTR,
1968                    MAC2STR(addr));
1969
1970         if (is_ap_interface(drv->nlmode) && drv->device_ap_sme) {
1971                 drv_event_disassoc(drv->ctx, addr);
1972                 return;
1973         }
1974
1975         if (drv->nlmode != NL80211_IFTYPE_ADHOC)
1976                 return;
1977
1978         os_memset(&data, 0, sizeof(data));
1979         os_memcpy(data.ibss_peer_lost.peer, addr, ETH_ALEN);
1980         wpa_supplicant_event(drv->ctx, EVENT_IBSS_PEER_LOST, &data);
1981 }
1982
1983
1984 static void nl80211_rekey_offload_event(struct wpa_driver_nl80211_data *drv,
1985                                         struct nlattr **tb)
1986 {
1987         struct nlattr *rekey_info[NUM_NL80211_REKEY_DATA];
1988         static struct nla_policy rekey_policy[NUM_NL80211_REKEY_DATA] = {
1989                 [NL80211_REKEY_DATA_KEK] = {
1990                         .minlen = NL80211_KEK_LEN,
1991                         .maxlen = NL80211_KEK_LEN,
1992                 },
1993                 [NL80211_REKEY_DATA_KCK] = {
1994                         .minlen = NL80211_KCK_LEN,
1995                         .maxlen = NL80211_KCK_LEN,
1996                 },
1997                 [NL80211_REKEY_DATA_REPLAY_CTR] = {
1998                         .minlen = NL80211_REPLAY_CTR_LEN,
1999                         .maxlen = NL80211_REPLAY_CTR_LEN,
2000                 },
2001         };
2002         union wpa_event_data data;
2003
2004         if (!tb[NL80211_ATTR_MAC])
2005                 return;
2006         if (!tb[NL80211_ATTR_REKEY_DATA])
2007                 return;
2008         if (nla_parse_nested(rekey_info, MAX_NL80211_REKEY_DATA,
2009                              tb[NL80211_ATTR_REKEY_DATA], rekey_policy))
2010                 return;
2011         if (!rekey_info[NL80211_REKEY_DATA_REPLAY_CTR])
2012                 return;
2013
2014         os_memset(&data, 0, sizeof(data));
2015         data.driver_gtk_rekey.bssid = nla_data(tb[NL80211_ATTR_MAC]);
2016         wpa_printf(MSG_DEBUG, "nl80211: Rekey offload event for BSSID " MACSTR,
2017                    MAC2STR(data.driver_gtk_rekey.bssid));
2018         data.driver_gtk_rekey.replay_ctr =
2019                 nla_data(rekey_info[NL80211_REKEY_DATA_REPLAY_CTR]);
2020         wpa_hexdump(MSG_DEBUG, "nl80211: Rekey offload - Replay Counter",
2021                     data.driver_gtk_rekey.replay_ctr, NL80211_REPLAY_CTR_LEN);
2022         wpa_supplicant_event(drv->ctx, EVENT_DRIVER_GTK_REKEY, &data);
2023 }
2024
2025
2026 static void nl80211_pmksa_candidate_event(struct wpa_driver_nl80211_data *drv,
2027                                           struct nlattr **tb)
2028 {
2029         struct nlattr *cand[NUM_NL80211_PMKSA_CANDIDATE];
2030         static struct nla_policy cand_policy[NUM_NL80211_PMKSA_CANDIDATE] = {
2031                 [NL80211_PMKSA_CANDIDATE_INDEX] = { .type = NLA_U32 },
2032                 [NL80211_PMKSA_CANDIDATE_BSSID] = {
2033                         .minlen = ETH_ALEN,
2034                         .maxlen = ETH_ALEN,
2035                 },
2036                 [NL80211_PMKSA_CANDIDATE_PREAUTH] = { .type = NLA_FLAG },
2037         };
2038         union wpa_event_data data;
2039
2040         if (!tb[NL80211_ATTR_PMKSA_CANDIDATE])
2041                 return;
2042         if (nla_parse_nested(cand, MAX_NL80211_PMKSA_CANDIDATE,
2043                              tb[NL80211_ATTR_PMKSA_CANDIDATE], cand_policy))
2044                 return;
2045         if (!cand[NL80211_PMKSA_CANDIDATE_INDEX] ||
2046             !cand[NL80211_PMKSA_CANDIDATE_BSSID])
2047                 return;
2048
2049         os_memset(&data, 0, sizeof(data));
2050         os_memcpy(data.pmkid_candidate.bssid,
2051                   nla_data(cand[NL80211_PMKSA_CANDIDATE_BSSID]), ETH_ALEN);
2052         data.pmkid_candidate.index =
2053                 nla_get_u32(cand[NL80211_PMKSA_CANDIDATE_INDEX]);
2054         data.pmkid_candidate.preauth =
2055                 cand[NL80211_PMKSA_CANDIDATE_PREAUTH] != NULL;
2056         wpa_supplicant_event(drv->ctx, EVENT_PMKID_CANDIDATE, &data);
2057 }
2058
2059
2060 static void nl80211_client_probe_event(struct wpa_driver_nl80211_data *drv,
2061                                        struct nlattr **tb)
2062 {
2063         union wpa_event_data data;
2064
2065         if (!tb[NL80211_ATTR_MAC] || !tb[NL80211_ATTR_ACK])
2066                 return;
2067
2068         os_memset(&data, 0, sizeof(data));
2069         os_memcpy(data.client_poll.addr,
2070                   nla_data(tb[NL80211_ATTR_MAC]), ETH_ALEN);
2071
2072         wpa_supplicant_event(drv->ctx, EVENT_DRIVER_CLIENT_POLL_OK, &data);
2073 }
2074
2075
2076 static void nl80211_spurious_frame(struct i802_bss *bss, struct nlattr **tb,
2077                                    int wds)
2078 {
2079         struct wpa_driver_nl80211_data *drv = bss->drv;
2080         union wpa_event_data event;
2081
2082         if (!tb[NL80211_ATTR_MAC])
2083                 return;
2084
2085         os_memset(&event, 0, sizeof(event));
2086         event.rx_from_unknown.bssid = bss->addr;
2087         event.rx_from_unknown.addr = nla_data(tb[NL80211_ATTR_MAC]);
2088         event.rx_from_unknown.wds = wds;
2089
2090         wpa_supplicant_event(drv->ctx, EVENT_RX_FROM_UNKNOWN, &event);
2091 }
2092
2093
2094 static void do_process_drv_event(struct wpa_driver_nl80211_data *drv,
2095                                  int cmd, struct nlattr **tb)
2096 {
2097         if (drv->ap_scan_as_station != NL80211_IFTYPE_UNSPECIFIED &&
2098             (cmd == NL80211_CMD_NEW_SCAN_RESULTS ||
2099              cmd == NL80211_CMD_SCAN_ABORTED)) {
2100                 wpa_driver_nl80211_set_mode(&drv->first_bss,
2101                                             drv->ap_scan_as_station);
2102                 drv->ap_scan_as_station = NL80211_IFTYPE_UNSPECIFIED;
2103         }
2104
2105         switch (cmd) {
2106         case NL80211_CMD_TRIGGER_SCAN:
2107                 wpa_printf(MSG_DEBUG, "nl80211: Scan trigger");
2108                 break;
2109         case NL80211_CMD_START_SCHED_SCAN:
2110                 wpa_printf(MSG_DEBUG, "nl80211: Sched scan started");
2111                 break;
2112         case NL80211_CMD_SCHED_SCAN_STOPPED:
2113                 wpa_printf(MSG_DEBUG, "nl80211: Sched scan stopped");
2114                 wpa_supplicant_event(drv->ctx, EVENT_SCHED_SCAN_STOPPED, NULL);
2115                 break;
2116         case NL80211_CMD_NEW_SCAN_RESULTS:
2117                 wpa_printf(MSG_DEBUG, "nl80211: New scan results available");
2118                 drv->scan_complete_events = 1;
2119                 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv,
2120                                      drv->ctx);
2121                 send_scan_event(drv, 0, tb);
2122                 break;
2123         case NL80211_CMD_SCHED_SCAN_RESULTS:
2124                 wpa_printf(MSG_DEBUG,
2125                            "nl80211: New sched scan results available");
2126                 send_scan_event(drv, 0, tb);
2127                 break;
2128         case NL80211_CMD_SCAN_ABORTED:
2129                 wpa_printf(MSG_DEBUG, "nl80211: Scan aborted");
2130                 /*
2131                  * Need to indicate that scan results are available in order
2132                  * not to make wpa_supplicant stop its scanning.
2133                  */
2134                 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv,
2135                                      drv->ctx);
2136                 send_scan_event(drv, 1, tb);
2137                 break;
2138         case NL80211_CMD_AUTHENTICATE:
2139         case NL80211_CMD_ASSOCIATE:
2140         case NL80211_CMD_DEAUTHENTICATE:
2141         case NL80211_CMD_DISASSOCIATE:
2142         case NL80211_CMD_FRAME_TX_STATUS:
2143         case NL80211_CMD_UNPROT_DEAUTHENTICATE:
2144         case NL80211_CMD_UNPROT_DISASSOCIATE:
2145                 mlme_event(drv, cmd, tb[NL80211_ATTR_FRAME],
2146                            tb[NL80211_ATTR_MAC], tb[NL80211_ATTR_TIMED_OUT],
2147                            tb[NL80211_ATTR_WIPHY_FREQ], tb[NL80211_ATTR_ACK],
2148                            tb[NL80211_ATTR_COOKIE],
2149                            tb[NL80211_ATTR_RX_SIGNAL_DBM]);
2150                 break;
2151         case NL80211_CMD_CONNECT:
2152         case NL80211_CMD_ROAM:
2153                 mlme_event_connect(drv, cmd,
2154                                    tb[NL80211_ATTR_STATUS_CODE],
2155                                    tb[NL80211_ATTR_MAC],
2156                                    tb[NL80211_ATTR_REQ_IE],
2157                                    tb[NL80211_ATTR_RESP_IE]);
2158                 break;
2159         case NL80211_CMD_CH_SWITCH_NOTIFY:
2160                 mlme_event_ch_switch(drv, tb[NL80211_ATTR_WIPHY_FREQ],
2161                                      tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
2162                 break;
2163         case NL80211_CMD_DISCONNECT:
2164                 mlme_event_disconnect(drv, tb[NL80211_ATTR_REASON_CODE],
2165                                       tb[NL80211_ATTR_MAC],
2166                                       tb[NL80211_ATTR_DISCONNECTED_BY_AP]);
2167                 break;
2168         case NL80211_CMD_MICHAEL_MIC_FAILURE:
2169                 mlme_event_michael_mic_failure(drv, tb);
2170                 break;
2171         case NL80211_CMD_JOIN_IBSS:
2172                 mlme_event_join_ibss(drv, tb);
2173                 break;
2174         case NL80211_CMD_REMAIN_ON_CHANNEL:
2175                 mlme_event_remain_on_channel(drv, 0, tb);
2176                 break;
2177         case NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL:
2178                 mlme_event_remain_on_channel(drv, 1, tb);
2179                 break;
2180         case NL80211_CMD_NOTIFY_CQM:
2181                 nl80211_cqm_event(drv, tb);
2182                 break;
2183         case NL80211_CMD_REG_CHANGE:
2184                 wpa_printf(MSG_DEBUG, "nl80211: Regulatory domain change");
2185                 wpa_supplicant_event(drv->ctx, EVENT_CHANNEL_LIST_CHANGED,
2186                                      NULL);
2187                 break;
2188         case NL80211_CMD_REG_BEACON_HINT:
2189                 wpa_printf(MSG_DEBUG, "nl80211: Regulatory beacon hint");
2190                 wpa_supplicant_event(drv->ctx, EVENT_CHANNEL_LIST_CHANGED,
2191                                      NULL);
2192                 break;
2193         case NL80211_CMD_NEW_STATION:
2194                 nl80211_new_station_event(drv, tb);
2195                 break;
2196         case NL80211_CMD_DEL_STATION:
2197                 nl80211_del_station_event(drv, tb);
2198                 break;
2199         case NL80211_CMD_SET_REKEY_OFFLOAD:
2200                 nl80211_rekey_offload_event(drv, tb);
2201                 break;
2202         case NL80211_CMD_PMKSA_CANDIDATE:
2203                 nl80211_pmksa_candidate_event(drv, tb);
2204                 break;
2205         case NL80211_CMD_PROBE_CLIENT:
2206                 nl80211_client_probe_event(drv, tb);
2207                 break;
2208         default:
2209                 wpa_printf(MSG_DEBUG, "nl80211: Ignored unknown event "
2210                            "(cmd=%d)", cmd);
2211                 break;
2212         }
2213 }
2214
2215
2216 static int process_drv_event(struct nl_msg *msg, void *arg)
2217 {
2218         struct wpa_driver_nl80211_data *drv = arg;
2219         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
2220         struct nlattr *tb[NL80211_ATTR_MAX + 1];
2221
2222         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
2223                   genlmsg_attrlen(gnlh, 0), NULL);
2224
2225         if (tb[NL80211_ATTR_IFINDEX]) {
2226                 int ifindex = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
2227                 if (ifindex != drv->ifindex && !have_ifidx(drv, ifindex)) {
2228                         wpa_printf(MSG_DEBUG, "nl80211: Ignored event (cmd=%d)"
2229                                    " for foreign interface (ifindex %d)",
2230                                    gnlh->cmd, ifindex);
2231                         return NL_SKIP;
2232                 }
2233         }
2234
2235         do_process_drv_event(drv, gnlh->cmd, tb);
2236         return NL_SKIP;
2237 }
2238
2239
2240 static int process_global_event(struct nl_msg *msg, void *arg)
2241 {
2242         struct nl80211_global *global = arg;
2243         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
2244         struct nlattr *tb[NL80211_ATTR_MAX + 1];
2245         struct wpa_driver_nl80211_data *drv, *tmp;
2246         int ifidx = -1;
2247
2248         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
2249                   genlmsg_attrlen(gnlh, 0), NULL);
2250
2251         if (tb[NL80211_ATTR_IFINDEX])
2252                 ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
2253
2254         dl_list_for_each_safe(drv, tmp, &global->interfaces,
2255                               struct wpa_driver_nl80211_data, list) {
2256                 if (ifidx == -1 || ifidx == drv->ifindex ||
2257                     have_ifidx(drv, ifidx))
2258                         do_process_drv_event(drv, gnlh->cmd, tb);
2259         }
2260
2261         return NL_SKIP;
2262 }
2263
2264
2265 static int process_bss_event(struct nl_msg *msg, void *arg)
2266 {
2267         struct i802_bss *bss = arg;
2268         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
2269         struct nlattr *tb[NL80211_ATTR_MAX + 1];
2270
2271         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
2272                   genlmsg_attrlen(gnlh, 0), NULL);
2273
2274         switch (gnlh->cmd) {
2275         case NL80211_CMD_FRAME:
2276         case NL80211_CMD_FRAME_TX_STATUS:
2277                 mlme_event(bss->drv, gnlh->cmd, tb[NL80211_ATTR_FRAME],
2278                            tb[NL80211_ATTR_MAC], tb[NL80211_ATTR_TIMED_OUT],
2279                            tb[NL80211_ATTR_WIPHY_FREQ], tb[NL80211_ATTR_ACK],
2280                            tb[NL80211_ATTR_COOKIE],
2281                            tb[NL80211_ATTR_RX_SIGNAL_DBM]);
2282                 break;
2283         case NL80211_CMD_UNEXPECTED_FRAME:
2284                 nl80211_spurious_frame(bss, tb, 0);
2285                 break;
2286         case NL80211_CMD_UNEXPECTED_4ADDR_FRAME:
2287                 nl80211_spurious_frame(bss, tb, 1);
2288                 break;
2289         default:
2290                 wpa_printf(MSG_DEBUG, "nl80211: Ignored unknown event "
2291                            "(cmd=%d)", gnlh->cmd);
2292                 break;
2293         }
2294
2295         return NL_SKIP;
2296 }
2297
2298
2299 static void wpa_driver_nl80211_event_receive(int sock, void *eloop_ctx,
2300                                              void *handle)
2301 {
2302         struct nl_cb *cb = eloop_ctx;
2303
2304         wpa_printf(MSG_DEBUG, "nl80211: Event message available");
2305
2306         nl_recvmsgs(handle, cb);
2307 }
2308
2309
2310 /**
2311  * wpa_driver_nl80211_set_country - ask nl80211 to set the regulatory domain
2312  * @priv: driver_nl80211 private data
2313  * @alpha2_arg: country to which to switch to
2314  * Returns: 0 on success, -1 on failure
2315  *
2316  * This asks nl80211 to set the regulatory domain for given
2317  * country ISO / IEC alpha2.
2318  */
2319 static int wpa_driver_nl80211_set_country(void *priv, const char *alpha2_arg)
2320 {
2321         struct i802_bss *bss = priv;
2322         struct wpa_driver_nl80211_data *drv = bss->drv;
2323         char alpha2[3];
2324         struct nl_msg *msg;
2325
2326         msg = nlmsg_alloc();
2327         if (!msg)
2328                 return -ENOMEM;
2329
2330         alpha2[0] = alpha2_arg[0];
2331         alpha2[1] = alpha2_arg[1];
2332         alpha2[2] = '\0';
2333
2334         nl80211_cmd(drv, msg, 0, NL80211_CMD_REQ_SET_REG);
2335
2336         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, alpha2);
2337         if (send_and_recv_msgs(drv, msg, NULL, NULL))
2338                 return -EINVAL;
2339         return 0;
2340 nla_put_failure:
2341         nlmsg_free(msg);
2342         return -EINVAL;
2343 }
2344
2345
2346 struct wiphy_info_data {
2347         struct wpa_driver_capa *capa;
2348
2349         unsigned int error:1;
2350         unsigned int device_ap_sme:1;
2351         unsigned int poll_command_supported:1;
2352         unsigned int data_tx_status:1;
2353         unsigned int monitor_supported:1;
2354 };
2355
2356
2357 static unsigned int probe_resp_offload_support(int supp_protocols)
2358 {
2359         unsigned int prot = 0;
2360
2361         if (supp_protocols & NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS)
2362                 prot |= WPA_DRIVER_PROBE_RESP_OFFLOAD_WPS;
2363         if (supp_protocols & NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS2)
2364                 prot |= WPA_DRIVER_PROBE_RESP_OFFLOAD_WPS2;
2365         if (supp_protocols & NL80211_PROBE_RESP_OFFLOAD_SUPPORT_P2P)
2366                 prot |= WPA_DRIVER_PROBE_RESP_OFFLOAD_P2P;
2367         if (supp_protocols & NL80211_PROBE_RESP_OFFLOAD_SUPPORT_80211U)
2368                 prot |= WPA_DRIVER_PROBE_RESP_OFFLOAD_INTERWORKING;
2369
2370         return prot;
2371 }
2372
2373
2374 static int wiphy_info_handler(struct nl_msg *msg, void *arg)
2375 {
2376         struct nlattr *tb[NL80211_ATTR_MAX + 1];
2377         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
2378         struct wiphy_info_data *info = arg;
2379         int p2p_go_supported = 0, p2p_client_supported = 0;
2380         int p2p_concurrent = 0, p2p_multichan_concurrent = 0;
2381         int auth_supported = 0, connect_supported = 0;
2382         struct wpa_driver_capa *capa = info->capa;
2383         static struct nla_policy
2384         iface_combination_policy[NUM_NL80211_IFACE_COMB] = {
2385                 [NL80211_IFACE_COMB_LIMITS] = { .type = NLA_NESTED },
2386                 [NL80211_IFACE_COMB_MAXNUM] = { .type = NLA_U32 },
2387                 [NL80211_IFACE_COMB_STA_AP_BI_MATCH] = { .type = NLA_FLAG },
2388                 [NL80211_IFACE_COMB_NUM_CHANNELS] = { .type = NLA_U32 },
2389         },
2390         iface_limit_policy[NUM_NL80211_IFACE_LIMIT] = {
2391                 [NL80211_IFACE_LIMIT_TYPES] = { .type = NLA_NESTED },
2392                 [NL80211_IFACE_LIMIT_MAX] = { .type = NLA_U32 },
2393         };
2394
2395         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
2396                   genlmsg_attrlen(gnlh, 0), NULL);
2397
2398         if (tb[NL80211_ATTR_MAX_NUM_SCAN_SSIDS])
2399                 capa->max_scan_ssids =
2400                         nla_get_u8(tb[NL80211_ATTR_MAX_NUM_SCAN_SSIDS]);
2401
2402         if (tb[NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS])
2403                 capa->max_sched_scan_ssids =
2404                         nla_get_u8(tb[NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS]);
2405
2406         if (tb[NL80211_ATTR_MAX_MATCH_SETS])
2407                 capa->max_match_sets =
2408                         nla_get_u8(tb[NL80211_ATTR_MAX_MATCH_SETS]);
2409
2410         if (tb[NL80211_ATTR_SUPPORTED_IFTYPES]) {
2411                 struct nlattr *nl_mode;
2412                 int i;
2413                 nla_for_each_nested(nl_mode,
2414                                     tb[NL80211_ATTR_SUPPORTED_IFTYPES], i) {
2415                         switch (nla_type(nl_mode)) {
2416                         case NL80211_IFTYPE_AP:
2417                                 capa->flags |= WPA_DRIVER_FLAGS_AP;
2418                                 break;
2419                         case NL80211_IFTYPE_P2P_GO:
2420                                 p2p_go_supported = 1;
2421                                 break;
2422                         case NL80211_IFTYPE_P2P_CLIENT:
2423                                 p2p_client_supported = 1;
2424                                 break;
2425                         case NL80211_IFTYPE_MONITOR:
2426                                 info->monitor_supported = 1;
2427                                 break;
2428                         }
2429                 }
2430         }
2431
2432         if (tb[NL80211_ATTR_INTERFACE_COMBINATIONS]) {
2433                 struct nlattr *nl_combi;
2434                 int rem_combi;
2435
2436                 nla_for_each_nested(nl_combi,
2437                                     tb[NL80211_ATTR_INTERFACE_COMBINATIONS],
2438                                     rem_combi) {
2439                         struct nlattr *tb_comb[NUM_NL80211_IFACE_COMB];
2440                         struct nlattr *tb_limit[NUM_NL80211_IFACE_LIMIT];
2441                         struct nlattr *nl_limit, *nl_mode;
2442                         int err, rem_limit, rem_mode;
2443                         int combination_has_p2p = 0, combination_has_mgd = 0;
2444
2445                         err = nla_parse_nested(tb_comb, MAX_NL80211_IFACE_COMB,
2446                                                nl_combi,
2447                                                iface_combination_policy);
2448                         if (err || !tb_comb[NL80211_IFACE_COMB_LIMITS] ||
2449                             !tb_comb[NL80211_IFACE_COMB_MAXNUM] ||
2450                             !tb_comb[NL80211_IFACE_COMB_NUM_CHANNELS])
2451                                 goto broken_combination;
2452
2453                         nla_for_each_nested(nl_limit,
2454                                             tb_comb[NL80211_IFACE_COMB_LIMITS],
2455                                             rem_limit) {
2456                                 err = nla_parse_nested(tb_limit,
2457                                                        MAX_NL80211_IFACE_LIMIT,
2458                                                        nl_limit,
2459                                                        iface_limit_policy);
2460                                 if (err ||
2461                                     !tb_limit[NL80211_IFACE_LIMIT_TYPES])
2462                                         goto broken_combination;
2463
2464                                 nla_for_each_nested(
2465                                         nl_mode,
2466                                         tb_limit[NL80211_IFACE_LIMIT_TYPES],
2467                                         rem_mode) {
2468                                         int ift = nla_type(nl_mode);
2469                                         if (ift == NL80211_IFTYPE_P2P_GO ||
2470                                             ift == NL80211_IFTYPE_P2P_CLIENT)
2471                                                 combination_has_p2p = 1;
2472                                         if (ift == NL80211_IFTYPE_STATION)
2473                                                 combination_has_mgd = 1;
2474                                 }
2475                                 if (combination_has_p2p && combination_has_mgd)
2476                                         break;
2477                         }
2478
2479                         if (combination_has_p2p && combination_has_mgd) {
2480                                 p2p_concurrent = 1;
2481                                 if (nla_get_u32(tb_comb[NL80211_IFACE_COMB_NUM_CHANNELS]) > 1)
2482                                         p2p_multichan_concurrent = 1;
2483                                 break;
2484                         }
2485
2486 broken_combination:
2487                         ;
2488                 }
2489         }
2490
2491         if (tb[NL80211_ATTR_SUPPORTED_COMMANDS]) {
2492                 struct nlattr *nl_cmd;
2493                 int i;
2494
2495                 nla_for_each_nested(nl_cmd,
2496                                     tb[NL80211_ATTR_SUPPORTED_COMMANDS], i) {
2497                         switch (nla_get_u32(nl_cmd)) {
2498                         case NL80211_CMD_AUTHENTICATE:
2499                                 auth_supported = 1;
2500                                 break;
2501                         case NL80211_CMD_CONNECT:
2502                                 connect_supported = 1;
2503                                 break;
2504                         case NL80211_CMD_START_SCHED_SCAN:
2505                                 capa->sched_scan_supported = 1;
2506                                 break;
2507                         case NL80211_CMD_PROBE_CLIENT:
2508                                 info->poll_command_supported = 1;
2509                                 break;
2510                         }
2511                 }
2512         }
2513
2514         if (tb[NL80211_ATTR_OFFCHANNEL_TX_OK]) {
2515                 wpa_printf(MSG_DEBUG, "nl80211: Using driver-based "
2516                            "off-channel TX");
2517                 capa->flags |= WPA_DRIVER_FLAGS_OFFCHANNEL_TX;
2518         }
2519
2520         if (tb[NL80211_ATTR_ROAM_SUPPORT]) {
2521                 wpa_printf(MSG_DEBUG, "nl80211: Using driver-based roaming");
2522                 capa->flags |= WPA_DRIVER_FLAGS_BSS_SELECTION;
2523         }
2524
2525         /* default to 5000 since early versions of mac80211 don't set it */
2526         capa->max_remain_on_chan = 5000;
2527
2528         if (tb[NL80211_ATTR_SUPPORT_AP_UAPSD])
2529                 capa->flags |= WPA_DRIVER_FLAGS_AP_UAPSD;
2530
2531         if (tb[NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION])
2532                 capa->max_remain_on_chan =
2533                         nla_get_u32(tb[NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION]);
2534
2535         if (auth_supported)
2536                 capa->flags |= WPA_DRIVER_FLAGS_SME;
2537         else if (!connect_supported) {
2538                 wpa_printf(MSG_INFO, "nl80211: Driver does not support "
2539                            "authentication/association or connect commands");
2540                 info->error = 1;
2541         }
2542
2543         if (p2p_go_supported && p2p_client_supported)
2544                 capa->flags |= WPA_DRIVER_FLAGS_P2P_CAPABLE;
2545         if (p2p_concurrent) {
2546                 wpa_printf(MSG_DEBUG, "nl80211: Use separate P2P group "
2547                            "interface (driver advertised support)");
2548                 capa->flags |= WPA_DRIVER_FLAGS_P2P_CONCURRENT;
2549                 capa->flags |= WPA_DRIVER_FLAGS_P2P_MGMT_AND_NON_P2P;
2550
2551                 if (p2p_multichan_concurrent) {
2552                         wpa_printf(MSG_DEBUG, "nl80211: Enable multi-channel "
2553                                    "concurrent (driver advertised support)");
2554                         capa->flags |=
2555                                 WPA_DRIVER_FLAGS_MULTI_CHANNEL_CONCURRENT;
2556                 }
2557         }
2558
2559         if (tb[NL80211_ATTR_TDLS_SUPPORT]) {
2560                 wpa_printf(MSG_DEBUG, "nl80211: TDLS supported");
2561                 capa->flags |= WPA_DRIVER_FLAGS_TDLS_SUPPORT;
2562
2563                 if (tb[NL80211_ATTR_TDLS_EXTERNAL_SETUP]) {
2564                         wpa_printf(MSG_DEBUG, "nl80211: TDLS external setup");
2565                         capa->flags |=
2566                                 WPA_DRIVER_FLAGS_TDLS_EXTERNAL_SETUP;
2567                 }
2568         }
2569
2570         if (tb[NL80211_ATTR_DEVICE_AP_SME])
2571                 info->device_ap_sme = 1;
2572
2573         if (tb[NL80211_ATTR_FEATURE_FLAGS]) {
2574                 u32 flags = nla_get_u32(tb[NL80211_ATTR_FEATURE_FLAGS]);
2575
2576                 if (flags & NL80211_FEATURE_SK_TX_STATUS)
2577                         info->data_tx_status = 1;
2578
2579                 if (flags & NL80211_FEATURE_INACTIVITY_TIMER)
2580                         capa->flags |= WPA_DRIVER_FLAGS_INACTIVITY_TIMER;
2581         }
2582
2583         if (tb[NL80211_ATTR_PROBE_RESP_OFFLOAD]) {
2584                 int protocols =
2585                         nla_get_u32(tb[NL80211_ATTR_PROBE_RESP_OFFLOAD]);
2586                 wpa_printf(MSG_DEBUG, "nl80211: Supports Probe Response "
2587                            "offload in AP mode");
2588                 capa->flags |= WPA_DRIVER_FLAGS_PROBE_RESP_OFFLOAD;
2589                 capa->probe_resp_offloads =
2590                         probe_resp_offload_support(protocols);
2591         }
2592
2593         return NL_SKIP;
2594 }
2595
2596
2597 static int wpa_driver_nl80211_get_info(struct wpa_driver_nl80211_data *drv,
2598                                        struct wiphy_info_data *info)
2599 {
2600         struct nl_msg *msg;
2601
2602         os_memset(info, 0, sizeof(*info));
2603         info->capa = &drv->capa;
2604
2605         msg = nlmsg_alloc();
2606         if (!msg)
2607                 return -1;
2608
2609         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_WIPHY);
2610
2611         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->first_bss.ifindex);
2612
2613         if (send_and_recv_msgs(drv, msg, wiphy_info_handler, info) == 0)
2614                 return 0;
2615         msg = NULL;
2616 nla_put_failure:
2617         nlmsg_free(msg);
2618         return -1;
2619 }
2620
2621
2622 static int wpa_driver_nl80211_capa(struct wpa_driver_nl80211_data *drv)
2623 {
2624         struct wiphy_info_data info;
2625         if (wpa_driver_nl80211_get_info(drv, &info))
2626                 return -1;
2627
2628         if (info.error)
2629                 return -1;
2630
2631         drv->has_capability = 1;
2632         /* For now, assume TKIP, CCMP, WPA, WPA2 are supported */
2633         drv->capa.key_mgmt = WPA_DRIVER_CAPA_KEY_MGMT_WPA |
2634                 WPA_DRIVER_CAPA_KEY_MGMT_WPA_PSK |
2635                 WPA_DRIVER_CAPA_KEY_MGMT_WPA2 |
2636                 WPA_DRIVER_CAPA_KEY_MGMT_WPA2_PSK;
2637         drv->capa.enc = WPA_DRIVER_CAPA_ENC_WEP40 |
2638                 WPA_DRIVER_CAPA_ENC_WEP104 |
2639                 WPA_DRIVER_CAPA_ENC_TKIP |
2640                 WPA_DRIVER_CAPA_ENC_CCMP;
2641         drv->capa.auth = WPA_DRIVER_AUTH_OPEN |
2642                 WPA_DRIVER_AUTH_SHARED |
2643                 WPA_DRIVER_AUTH_LEAP;
2644
2645         drv->capa.flags |= WPA_DRIVER_FLAGS_SANE_ERROR_CODES;
2646         drv->capa.flags |= WPA_DRIVER_FLAGS_SET_KEYS_AFTER_ASSOC_DONE;
2647         drv->capa.flags |= WPA_DRIVER_FLAGS_EAPOL_TX_STATUS;
2648
2649         if (!info.device_ap_sme) {
2650                 drv->capa.flags |= WPA_DRIVER_FLAGS_DEAUTH_TX_STATUS;
2651
2652                 /*
2653                  * No AP SME is currently assumed to also indicate no AP MLME
2654                  * in the driver/firmware.
2655                  */
2656                 drv->capa.flags |= WPA_DRIVER_FLAGS_AP_MLME;
2657         }
2658
2659         drv->device_ap_sme = info.device_ap_sme;
2660         drv->poll_command_supported = info.poll_command_supported;
2661         drv->data_tx_status = info.data_tx_status;
2662
2663         /*
2664          * If poll command is supported mac80211 is new enough to
2665          * have everything we need to not need monitor interfaces.
2666          */
2667         drv->use_monitor = !info.poll_command_supported;
2668
2669         if (drv->device_ap_sme && drv->use_monitor) {
2670                 /*
2671                  * Non-mac80211 drivers may not support monitor interface.
2672                  * Make sure we do not get stuck with incorrect capability here
2673                  * by explicitly testing this.
2674                  */
2675                 if (!info.monitor_supported) {
2676                         wpa_printf(MSG_DEBUG, "nl80211: Disable use_monitor "
2677                                    "with device_ap_sme since no monitor mode "
2678                                    "support detected");
2679                         drv->use_monitor = 0;
2680                 }
2681         }
2682
2683         /*
2684          * If we aren't going to use monitor interfaces, but the
2685          * driver doesn't support data TX status, we won't get TX
2686          * status for EAPOL frames.
2687          */
2688         if (!drv->use_monitor && !info.data_tx_status)
2689                 drv->capa.flags &= ~WPA_DRIVER_FLAGS_EAPOL_TX_STATUS;
2690
2691         return 0;
2692 }
2693
2694
2695 #ifdef ANDROID
2696 static int android_genl_ctrl_resolve(struct nl_handle *handle,
2697                                      const char *name)
2698 {
2699         /*
2700          * Android ICS has very minimal genl_ctrl_resolve() implementation, so
2701          * need to work around that.
2702          */
2703         struct nl_cache *cache = NULL;
2704         struct genl_family *nl80211 = NULL;
2705         int id = -1;
2706
2707         if (genl_ctrl_alloc_cache(handle, &cache) < 0) {
2708                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate generic "
2709                            "netlink cache");
2710                 goto fail;
2711         }
2712
2713         nl80211 = genl_ctrl_search_by_name(cache, name);
2714         if (nl80211 == NULL)
2715                 goto fail;
2716
2717         id = genl_family_get_id(nl80211);
2718
2719 fail:
2720         if (nl80211)
2721                 genl_family_put(nl80211);
2722         if (cache)
2723                 nl_cache_free(cache);
2724
2725         return id;
2726 }
2727 #define genl_ctrl_resolve android_genl_ctrl_resolve
2728 #endif /* ANDROID */
2729
2730
2731 static int wpa_driver_nl80211_init_nl_global(struct nl80211_global *global)
2732 {
2733         int ret;
2734
2735         global->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
2736         if (global->nl_cb == NULL) {
2737                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate netlink "
2738                            "callbacks");
2739                 return -1;
2740         }
2741
2742         global->nl = nl_create_handle(global->nl_cb, "nl");
2743         if (global->nl == NULL)
2744                 goto err;
2745
2746         global->nl80211_id = genl_ctrl_resolve(global->nl, "nl80211");
2747         if (global->nl80211_id < 0) {
2748                 wpa_printf(MSG_ERROR, "nl80211: 'nl80211' generic netlink not "
2749                            "found");
2750                 goto err;
2751         }
2752
2753         global->nl_event = nl_create_handle(global->nl_cb, "event");
2754         if (global->nl_event == NULL)
2755                 goto err;
2756
2757         ret = nl_get_multicast_id(global, "nl80211", "scan");
2758         if (ret >= 0)
2759                 ret = nl_socket_add_membership(global->nl_event, ret);
2760         if (ret < 0) {
2761                 wpa_printf(MSG_ERROR, "nl80211: Could not add multicast "
2762                            "membership for scan events: %d (%s)",
2763                            ret, strerror(-ret));
2764                 goto err;
2765         }
2766
2767         ret = nl_get_multicast_id(global, "nl80211", "mlme");
2768         if (ret >= 0)
2769                 ret = nl_socket_add_membership(global->nl_event, ret);
2770         if (ret < 0) {
2771                 wpa_printf(MSG_ERROR, "nl80211: Could not add multicast "
2772                            "membership for mlme events: %d (%s)",
2773                            ret, strerror(-ret));
2774                 goto err;
2775         }
2776
2777         ret = nl_get_multicast_id(global, "nl80211", "regulatory");
2778         if (ret >= 0)
2779                 ret = nl_socket_add_membership(global->nl_event, ret);
2780         if (ret < 0) {
2781                 wpa_printf(MSG_DEBUG, "nl80211: Could not add multicast "
2782                            "membership for regulatory events: %d (%s)",
2783                            ret, strerror(-ret));
2784                 /* Continue without regulatory events */
2785         }
2786
2787         nl_cb_set(global->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM,
2788                   no_seq_check, NULL);
2789         nl_cb_set(global->nl_cb, NL_CB_VALID, NL_CB_CUSTOM,
2790                   process_global_event, global);
2791
2792         eloop_register_read_sock(nl_socket_get_fd(global->nl_event),
2793                                  wpa_driver_nl80211_event_receive,
2794                                  global->nl_cb, global->nl_event);
2795
2796         return 0;
2797
2798 err:
2799         nl_destroy_handles(&global->nl_event);
2800         nl_destroy_handles(&global->nl);
2801         nl_cb_put(global->nl_cb);
2802         global->nl_cb = NULL;
2803         return -1;
2804 }
2805
2806
2807 static int wpa_driver_nl80211_init_nl(struct wpa_driver_nl80211_data *drv)
2808 {
2809         drv->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
2810         if (!drv->nl_cb) {
2811                 wpa_printf(MSG_ERROR, "nl80211: Failed to alloc cb struct");
2812                 return -1;
2813         }
2814
2815         nl_cb_set(drv->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM,
2816                   no_seq_check, NULL);
2817         nl_cb_set(drv->nl_cb, NL_CB_VALID, NL_CB_CUSTOM,
2818                   process_drv_event, drv);
2819
2820         return 0;
2821 }
2822
2823
2824 static void wpa_driver_nl80211_rfkill_blocked(void *ctx)
2825 {
2826         wpa_printf(MSG_DEBUG, "nl80211: RFKILL blocked");
2827         /*
2828          * This may be for any interface; use ifdown event to disable
2829          * interface.
2830          */
2831 }
2832
2833
2834 static void wpa_driver_nl80211_rfkill_unblocked(void *ctx)
2835 {
2836         struct wpa_driver_nl80211_data *drv = ctx;
2837         wpa_printf(MSG_DEBUG, "nl80211: RFKILL unblocked");
2838         if (linux_set_iface_flags(drv->global->ioctl_sock,
2839                                   drv->first_bss.ifname, 1)) {
2840                 wpa_printf(MSG_DEBUG, "nl80211: Could not set interface UP "
2841                            "after rfkill unblock");
2842                 return;
2843         }
2844         /* rtnetlink ifup handler will report interface as enabled */
2845 }
2846
2847
2848 static void nl80211_get_phy_name(struct wpa_driver_nl80211_data *drv)
2849 {
2850         /* Find phy (radio) to which this interface belongs */
2851         char buf[90], *pos;
2852         int f, rv;
2853
2854         drv->phyname[0] = '\0';
2855         snprintf(buf, sizeof(buf) - 1, "/sys/class/net/%s/phy80211/name",
2856                  drv->first_bss.ifname);
2857         f = open(buf, O_RDONLY);
2858         if (f < 0) {
2859                 wpa_printf(MSG_DEBUG, "Could not open file %s: %s",
2860                            buf, strerror(errno));
2861                 return;
2862         }
2863
2864         rv = read(f, drv->phyname, sizeof(drv->phyname) - 1);
2865         close(f);
2866         if (rv < 0) {
2867                 wpa_printf(MSG_DEBUG, "Could not read file %s: %s",
2868                            buf, strerror(errno));
2869                 return;
2870         }
2871
2872         drv->phyname[rv] = '\0';
2873         pos = os_strchr(drv->phyname, '\n');
2874         if (pos)
2875                 *pos = '\0';
2876         wpa_printf(MSG_DEBUG, "nl80211: interface %s in phy %s",
2877                    drv->first_bss.ifname, drv->phyname);
2878 }
2879
2880
2881 static void wpa_driver_nl80211_handle_eapol_tx_status(int sock,
2882                                                       void *eloop_ctx,
2883                                                       void *handle)
2884 {
2885         struct wpa_driver_nl80211_data *drv = eloop_ctx;
2886         u8 data[2048];
2887         struct msghdr msg;
2888         struct iovec entry;
2889         u8 control[512];
2890         struct cmsghdr *cmsg;
2891         int res, found_ee = 0, found_wifi = 0, acked = 0;
2892         union wpa_event_data event;
2893
2894         memset(&msg, 0, sizeof(msg));
2895         msg.msg_iov = &entry;
2896         msg.msg_iovlen = 1;
2897         entry.iov_base = data;
2898         entry.iov_len = sizeof(data);
2899         msg.msg_control = &control;
2900         msg.msg_controllen = sizeof(control);
2901
2902         res = recvmsg(sock, &msg, MSG_ERRQUEUE);
2903         /* if error or not fitting 802.3 header, return */
2904         if (res < 14)
2905                 return;
2906
2907         for (cmsg = CMSG_FIRSTHDR(&msg); cmsg; cmsg = CMSG_NXTHDR(&msg, cmsg))
2908         {
2909                 if (cmsg->cmsg_level == SOL_SOCKET &&
2910                     cmsg->cmsg_type == SCM_WIFI_STATUS) {
2911                         int *ack;
2912
2913                         found_wifi = 1;
2914                         ack = (void *)CMSG_DATA(cmsg);
2915                         acked = *ack;
2916                 }
2917
2918                 if (cmsg->cmsg_level == SOL_PACKET &&
2919                     cmsg->cmsg_type == PACKET_TX_TIMESTAMP) {
2920                         struct sock_extended_err *err =
2921                                 (struct sock_extended_err *)CMSG_DATA(cmsg);
2922
2923                         if (err->ee_origin == SO_EE_ORIGIN_TXSTATUS)
2924                                 found_ee = 1;
2925                 }
2926         }
2927
2928         if (!found_ee || !found_wifi)
2929                 return;
2930
2931         memset(&event, 0, sizeof(event));
2932         event.eapol_tx_status.dst = data;
2933         event.eapol_tx_status.data = data + 14;
2934         event.eapol_tx_status.data_len = res - 14;
2935         event.eapol_tx_status.ack = acked;
2936         wpa_supplicant_event(drv->ctx, EVENT_EAPOL_TX_STATUS, &event);
2937 }
2938
2939
2940 static int nl80211_init_bss(struct i802_bss *bss)
2941 {
2942         bss->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
2943         if (!bss->nl_cb)
2944                 return -1;
2945
2946         nl_cb_set(bss->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM,
2947                   no_seq_check, NULL);
2948         nl_cb_set(bss->nl_cb, NL_CB_VALID, NL_CB_CUSTOM,
2949                   process_bss_event, bss);
2950
2951         return 0;
2952 }
2953
2954
2955 static void nl80211_destroy_bss(struct i802_bss *bss)
2956 {
2957         nl_cb_put(bss->nl_cb);
2958         bss->nl_cb = NULL;
2959 }
2960
2961
2962 /**
2963  * wpa_driver_nl80211_init - Initialize nl80211 driver interface
2964  * @ctx: context to be used when calling wpa_supplicant functions,
2965  * e.g., wpa_supplicant_event()
2966  * @ifname: interface name, e.g., wlan0
2967  * @global_priv: private driver global data from global_init()
2968  * Returns: Pointer to private data, %NULL on failure
2969  */
2970 static void * wpa_driver_nl80211_init(void *ctx, const char *ifname,
2971                                       void *global_priv)
2972 {
2973         struct wpa_driver_nl80211_data *drv;
2974         struct rfkill_config *rcfg;
2975         struct i802_bss *bss;
2976
2977         if (global_priv == NULL)
2978                 return NULL;
2979         drv = os_zalloc(sizeof(*drv));
2980         if (drv == NULL)
2981                 return NULL;
2982         drv->global = global_priv;
2983         drv->ctx = ctx;
2984         bss = &drv->first_bss;
2985         bss->drv = drv;
2986         os_strlcpy(bss->ifname, ifname, sizeof(bss->ifname));
2987         drv->monitor_ifidx = -1;
2988         drv->monitor_sock = -1;
2989         drv->eapol_tx_sock = -1;
2990         drv->ap_scan_as_station = NL80211_IFTYPE_UNSPECIFIED;
2991
2992         if (wpa_driver_nl80211_init_nl(drv)) {
2993                 os_free(drv);
2994                 return NULL;
2995         }
2996
2997         if (nl80211_init_bss(bss))
2998                 goto failed;
2999
3000         nl80211_get_phy_name(drv);
3001
3002         rcfg = os_zalloc(sizeof(*rcfg));
3003         if (rcfg == NULL)
3004                 goto failed;
3005         rcfg->ctx = drv;
3006         os_strlcpy(rcfg->ifname, ifname, sizeof(rcfg->ifname));
3007         rcfg->blocked_cb = wpa_driver_nl80211_rfkill_blocked;
3008         rcfg->unblocked_cb = wpa_driver_nl80211_rfkill_unblocked;
3009         drv->rfkill = rfkill_init(rcfg);
3010         if (drv->rfkill == NULL) {
3011                 wpa_printf(MSG_DEBUG, "nl80211: RFKILL status not available");
3012                 os_free(rcfg);
3013         }
3014
3015         if (wpa_driver_nl80211_finish_drv_init(drv))
3016                 goto failed;
3017
3018         drv->eapol_tx_sock = socket(PF_PACKET, SOCK_DGRAM, 0);
3019         if (drv->eapol_tx_sock < 0)
3020                 goto failed;
3021
3022         if (drv->data_tx_status) {
3023                 int enabled = 1;
3024
3025                 if (setsockopt(drv->eapol_tx_sock, SOL_SOCKET, SO_WIFI_STATUS,
3026                                &enabled, sizeof(enabled)) < 0) {
3027                         wpa_printf(MSG_DEBUG,
3028                                 "nl80211: wifi status sockopt failed\n");
3029                         drv->data_tx_status = 0;
3030                         if (!drv->use_monitor)
3031                                 drv->capa.flags &=
3032                                         ~WPA_DRIVER_FLAGS_EAPOL_TX_STATUS;
3033                 } else {
3034                         eloop_register_read_sock(drv->eapol_tx_sock,
3035                                 wpa_driver_nl80211_handle_eapol_tx_status,
3036                                 drv, NULL);
3037                 }
3038         }
3039
3040         if (drv->global) {
3041                 dl_list_add(&drv->global->interfaces, &drv->list);
3042                 drv->in_interface_list = 1;
3043         }
3044
3045         return bss;
3046
3047 failed:
3048         wpa_driver_nl80211_deinit(bss);
3049         return NULL;
3050 }
3051
3052
3053 static int nl80211_register_frame(struct i802_bss *bss,
3054                                   struct nl_handle *nl_handle,
3055                                   u16 type, const u8 *match, size_t match_len)
3056 {
3057         struct wpa_driver_nl80211_data *drv = bss->drv;
3058         struct nl_msg *msg;
3059         int ret = -1;
3060
3061         msg = nlmsg_alloc();
3062         if (!msg)
3063                 return -1;
3064
3065         wpa_printf(MSG_DEBUG, "nl80211: Register frame type=0x%x nl_handle=%p",
3066                    type, nl_handle);
3067         wpa_hexdump(MSG_DEBUG, "nl80211: Register frame match",
3068                     match, match_len);
3069
3070         nl80211_cmd(drv, msg, 0, NL80211_CMD_REGISTER_ACTION);
3071
3072         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
3073         NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE, type);
3074         NLA_PUT(msg, NL80211_ATTR_FRAME_MATCH, match_len, match);
3075
3076         ret = send_and_recv(drv->global, nl_handle, msg, NULL, NULL);
3077         msg = NULL;
3078         if (ret) {
3079                 wpa_printf(MSG_DEBUG, "nl80211: Register frame command "
3080                            "failed (type=%u): ret=%d (%s)",
3081                            type, ret, strerror(-ret));
3082                 wpa_hexdump(MSG_DEBUG, "nl80211: Register frame match",
3083                             match, match_len);
3084                 goto nla_put_failure;
3085         }
3086         ret = 0;
3087 nla_put_failure:
3088         nlmsg_free(msg);
3089         return ret;
3090 }
3091
3092
3093 static int nl80211_alloc_mgmt_handle(struct i802_bss *bss)
3094 {
3095         struct wpa_driver_nl80211_data *drv = bss->drv;
3096
3097         if (bss->nl_mgmt) {
3098                 wpa_printf(MSG_DEBUG, "nl80211: Mgmt reporting "
3099                            "already on! (nl_mgmt=%p)", bss->nl_mgmt);
3100                 return -1;
3101         }
3102
3103         bss->nl_mgmt = nl_create_handle(drv->nl_cb, "mgmt");
3104         if (bss->nl_mgmt == NULL)
3105                 return -1;
3106
3107         eloop_register_read_sock(nl_socket_get_fd(bss->nl_mgmt),
3108                                  wpa_driver_nl80211_event_receive, bss->nl_cb,
3109                                  bss->nl_mgmt);
3110
3111         return 0;
3112 }
3113
3114
3115 static int nl80211_register_action_frame(struct i802_bss *bss,
3116                                          const u8 *match, size_t match_len)
3117 {
3118         u16 type = (WLAN_FC_TYPE_MGMT << 2) | (WLAN_FC_STYPE_ACTION << 4);
3119         return nl80211_register_frame(bss, bss->nl_mgmt,
3120                                       type, match, match_len);
3121 }
3122
3123
3124 static int nl80211_mgmt_subscribe_non_ap(struct i802_bss *bss)
3125 {
3126         struct wpa_driver_nl80211_data *drv = bss->drv;
3127
3128         if (nl80211_alloc_mgmt_handle(bss))
3129                 return -1;
3130         wpa_printf(MSG_DEBUG, "nl80211: Subscribe to mgmt frames with non-AP "
3131                    "handle %p", bss->nl_mgmt);
3132
3133 #if defined(CONFIG_P2P) || defined(CONFIG_INTERWORKING)
3134         /* GAS Initial Request */
3135         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0a", 2) < 0)
3136                 return -1;
3137         /* GAS Initial Response */
3138         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0b", 2) < 0)
3139                 return -1;
3140         /* GAS Comeback Request */
3141         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0c", 2) < 0)
3142                 return -1;
3143         /* GAS Comeback Response */
3144         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0d", 2) < 0)
3145                 return -1;
3146 #endif /* CONFIG_P2P || CONFIG_INTERWORKING */
3147 #ifdef CONFIG_P2P
3148         /* P2P Public Action */
3149         if (nl80211_register_action_frame(bss,
3150                                           (u8 *) "\x04\x09\x50\x6f\x9a\x09",
3151                                           6) < 0)
3152                 return -1;
3153         /* P2P Action */
3154         if (nl80211_register_action_frame(bss,
3155                                           (u8 *) "\x7f\x50\x6f\x9a\x09",
3156                                           5) < 0)
3157                 return -1;
3158 #endif /* CONFIG_P2P */
3159 #ifdef CONFIG_IEEE80211W
3160         /* SA Query Response */
3161         if (nl80211_register_action_frame(bss, (u8 *) "\x08\x01", 2) < 0)
3162                 return -1;
3163 #endif /* CONFIG_IEEE80211W */
3164 #ifdef CONFIG_TDLS
3165         if ((drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT)) {
3166                 /* TDLS Discovery Response */
3167                 if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0e", 2) <
3168                     0)
3169                         return -1;
3170         }
3171 #endif /* CONFIG_TDLS */
3172
3173         /* FT Action frames */
3174         if (nl80211_register_action_frame(bss, (u8 *) "\x06", 1) < 0)
3175                 return -1;
3176         else
3177                 drv->capa.key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_FT |
3178                         WPA_DRIVER_CAPA_KEY_MGMT_FT_PSK;
3179
3180         /* WNM - BSS Transition Management Request */
3181         if (nl80211_register_action_frame(bss, (u8 *) "\x0a\x07", 2) < 0)
3182                 return -1;
3183
3184         return 0;
3185 }
3186
3187
3188 static int nl80211_register_spurious_class3(struct i802_bss *bss)
3189 {
3190         struct wpa_driver_nl80211_data *drv = bss->drv;
3191         struct nl_msg *msg;
3192         int ret = -1;
3193
3194         msg = nlmsg_alloc();
3195         if (!msg)
3196                 return -1;
3197
3198         nl80211_cmd(drv, msg, 0, NL80211_CMD_UNEXPECTED_FRAME);
3199
3200         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
3201
3202         ret = send_and_recv(drv->global, bss->nl_mgmt, msg, NULL, NULL);
3203         msg = NULL;
3204         if (ret) {
3205                 wpa_printf(MSG_DEBUG, "nl80211: Register spurious class3 "
3206                            "failed: ret=%d (%s)",
3207                            ret, strerror(-ret));
3208                 goto nla_put_failure;
3209         }
3210         ret = 0;
3211 nla_put_failure:
3212         nlmsg_free(msg);
3213         return ret;
3214 }
3215
3216
3217 static int nl80211_mgmt_subscribe_ap(struct i802_bss *bss)
3218 {
3219         static const int stypes[] = {
3220                 WLAN_FC_STYPE_AUTH,
3221                 WLAN_FC_STYPE_ASSOC_REQ,
3222                 WLAN_FC_STYPE_REASSOC_REQ,
3223                 WLAN_FC_STYPE_DISASSOC,
3224                 WLAN_FC_STYPE_DEAUTH,
3225                 WLAN_FC_STYPE_ACTION,
3226                 WLAN_FC_STYPE_PROBE_REQ,
3227 /* Beacon doesn't work as mac80211 doesn't currently allow
3228  * it, but it wouldn't really be the right thing anyway as
3229  * it isn't per interface ... maybe just dump the scan
3230  * results periodically for OLBC?
3231  */
3232 //              WLAN_FC_STYPE_BEACON,
3233         };
3234         unsigned int i;
3235
3236         if (nl80211_alloc_mgmt_handle(bss))
3237                 return -1;
3238         wpa_printf(MSG_DEBUG, "nl80211: Subscribe to mgmt frames with AP "
3239                    "handle %p", bss->nl_mgmt);
3240
3241         for (i = 0; i < sizeof(stypes) / sizeof(stypes[0]); i++) {
3242                 if (nl80211_register_frame(bss, bss->nl_mgmt,
3243                                            (WLAN_FC_TYPE_MGMT << 2) |
3244                                            (stypes[i] << 4),
3245                                            NULL, 0) < 0) {
3246                         goto out_err;
3247                 }
3248         }
3249
3250         if (nl80211_register_spurious_class3(bss))
3251                 goto out_err;
3252
3253         if (nl80211_get_wiphy_data_ap(bss) == NULL)
3254                 goto out_err;
3255
3256         return 0;
3257
3258 out_err:
3259         eloop_unregister_read_sock(nl_socket_get_fd(bss->nl_mgmt));
3260         nl_destroy_handles(&bss->nl_mgmt);
3261         return -1;
3262 }
3263
3264
3265 static int nl80211_mgmt_subscribe_ap_dev_sme(struct i802_bss *bss)
3266 {
3267         if (nl80211_alloc_mgmt_handle(bss))
3268                 return -1;
3269         wpa_printf(MSG_DEBUG, "nl80211: Subscribe to mgmt frames with AP "
3270                    "handle %p (device SME)", bss->nl_mgmt);
3271
3272         if (nl80211_register_frame(bss, bss->nl_mgmt,
3273                                    (WLAN_FC_TYPE_MGMT << 2) |
3274                                    (WLAN_FC_STYPE_ACTION << 4),
3275                                    NULL, 0) < 0)
3276                 goto out_err;
3277
3278         return 0;
3279
3280 out_err:
3281         eloop_unregister_read_sock(nl_socket_get_fd(bss->nl_mgmt));
3282         nl_destroy_handles(&bss->nl_mgmt);
3283         return -1;
3284 }
3285
3286
3287 static void nl80211_mgmt_unsubscribe(struct i802_bss *bss, const char *reason)
3288 {
3289         if (bss->nl_mgmt == NULL)
3290                 return;
3291         wpa_printf(MSG_DEBUG, "nl80211: Unsubscribe mgmt frames handle %p "
3292                    "(%s)", bss->nl_mgmt, reason);
3293         eloop_unregister_read_sock(nl_socket_get_fd(bss->nl_mgmt));
3294         nl_destroy_handles(&bss->nl_mgmt);
3295
3296         nl80211_put_wiphy_data_ap(bss);
3297 }
3298
3299
3300 static void wpa_driver_nl80211_send_rfkill(void *eloop_ctx, void *timeout_ctx)
3301 {
3302         wpa_supplicant_event(timeout_ctx, EVENT_INTERFACE_DISABLED, NULL);
3303 }
3304
3305
3306 static int
3307 wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv)
3308 {
3309         struct i802_bss *bss = &drv->first_bss;
3310         int send_rfkill_event = 0;
3311
3312         drv->ifindex = if_nametoindex(bss->ifname);
3313         drv->first_bss.ifindex = drv->ifindex;
3314
3315 #ifndef HOSTAPD
3316         /*
3317          * Make sure the interface starts up in station mode unless this is a
3318          * dynamically added interface (e.g., P2P) that was already configured
3319          * with proper iftype.
3320          */
3321         if (drv->ifindex != drv->global->if_add_ifindex &&
3322             wpa_driver_nl80211_set_mode(bss, NL80211_IFTYPE_STATION) < 0) {
3323                 wpa_printf(MSG_ERROR, "nl80211: Could not configure driver to "
3324                            "use managed mode");
3325                 return -1;
3326         }
3327
3328         if (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 1)) {
3329                 if (rfkill_is_blocked(drv->rfkill)) {
3330                         wpa_printf(MSG_DEBUG, "nl80211: Could not yet enable "
3331                                    "interface '%s' due to rfkill",
3332                                    bss->ifname);
3333                         drv->if_disabled = 1;
3334                         send_rfkill_event = 1;
3335                 } else {
3336                         wpa_printf(MSG_ERROR, "nl80211: Could not set "
3337                                    "interface '%s' UP", bss->ifname);
3338                         return -1;
3339                 }
3340         }
3341
3342         netlink_send_oper_ifla(drv->global->netlink, drv->ifindex,
3343                                1, IF_OPER_DORMANT);
3344 #endif /* HOSTAPD */
3345
3346         if (wpa_driver_nl80211_capa(drv))
3347                 return -1;
3348
3349         if (linux_get_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
3350                                bss->addr))
3351                 return -1;
3352
3353         if (send_rfkill_event) {
3354                 eloop_register_timeout(0, 0, wpa_driver_nl80211_send_rfkill,
3355                                        drv, drv->ctx);
3356         }
3357
3358         return 0;
3359 }
3360
3361
3362 static int wpa_driver_nl80211_del_beacon(struct wpa_driver_nl80211_data *drv)
3363 {
3364         struct nl_msg *msg;
3365
3366         msg = nlmsg_alloc();
3367         if (!msg)
3368                 return -ENOMEM;
3369
3370         nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_BEACON);
3371         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
3372
3373         return send_and_recv_msgs(drv, msg, NULL, NULL);
3374  nla_put_failure:
3375         nlmsg_free(msg);
3376         return -ENOBUFS;
3377 }
3378
3379
3380 /**
3381  * wpa_driver_nl80211_deinit - Deinitialize nl80211 driver interface
3382  * @priv: Pointer to private nl80211 data from wpa_driver_nl80211_init()
3383  *
3384  * Shut down driver interface and processing of driver events. Free
3385  * private data buffer if one was allocated in wpa_driver_nl80211_init().
3386  */
3387 static void wpa_driver_nl80211_deinit(void *priv)
3388 {
3389         struct i802_bss *bss = priv;
3390         struct wpa_driver_nl80211_data *drv = bss->drv;
3391
3392         bss->in_deinit = 1;
3393         if (drv->data_tx_status)
3394                 eloop_unregister_read_sock(drv->eapol_tx_sock);
3395         if (drv->eapol_tx_sock >= 0)
3396                 close(drv->eapol_tx_sock);
3397
3398         if (bss->nl_preq)
3399                 wpa_driver_nl80211_probe_req_report(bss, 0);
3400         if (bss->added_if_into_bridge) {
3401                 if (linux_br_del_if(drv->global->ioctl_sock, bss->brname,
3402                                     bss->ifname) < 0)
3403                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
3404                                    "interface %s from bridge %s: %s",
3405                                    bss->ifname, bss->brname, strerror(errno));
3406         }
3407         if (bss->added_bridge) {
3408                 if (linux_br_del(drv->global->ioctl_sock, bss->brname) < 0)
3409                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
3410                                    "bridge %s: %s",
3411                                    bss->brname, strerror(errno));
3412         }
3413
3414         nl80211_remove_monitor_interface(drv);
3415
3416         if (is_ap_interface(drv->nlmode))
3417                 wpa_driver_nl80211_del_beacon(drv);
3418
3419 #ifdef HOSTAPD
3420         if (drv->last_freq_ht) {
3421                 /* Clear HT flags from the driver */
3422                 struct hostapd_freq_params freq;
3423                 os_memset(&freq, 0, sizeof(freq));
3424                 freq.freq = drv->last_freq;
3425                 i802_set_freq(priv, &freq);
3426         }
3427
3428         if (drv->eapol_sock >= 0) {
3429                 eloop_unregister_read_sock(drv->eapol_sock);
3430                 close(drv->eapol_sock);
3431         }
3432
3433         if (drv->if_indices != drv->default_if_indices)
3434                 os_free(drv->if_indices);
3435 #endif /* HOSTAPD */
3436
3437         if (drv->disabled_11b_rates)
3438                 nl80211_disable_11b_rates(drv, drv->ifindex, 0);
3439
3440         netlink_send_oper_ifla(drv->global->netlink, drv->ifindex, 0,
3441                                IF_OPER_UP);
3442         rfkill_deinit(drv->rfkill);
3443
3444         eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
3445
3446         (void) linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 0);
3447         wpa_driver_nl80211_set_mode(bss, NL80211_IFTYPE_STATION);
3448         nl80211_mgmt_unsubscribe(bss, "deinit");
3449
3450         nl_cb_put(drv->nl_cb);
3451
3452         nl80211_destroy_bss(&drv->first_bss);
3453
3454         os_free(drv->filter_ssids);
3455
3456         os_free(drv->auth_ie);
3457
3458         if (drv->in_interface_list)
3459                 dl_list_del(&drv->list);
3460
3461         os_free(drv);
3462 }
3463
3464
3465 /**
3466  * wpa_driver_nl80211_scan_timeout - Scan timeout to report scan completion
3467  * @eloop_ctx: Driver private data
3468  * @timeout_ctx: ctx argument given to wpa_driver_nl80211_init()
3469  *
3470  * This function can be used as registered timeout when starting a scan to
3471  * generate a scan completed event if the driver does not report this.
3472  */
3473 static void wpa_driver_nl80211_scan_timeout(void *eloop_ctx, void *timeout_ctx)
3474 {
3475         struct wpa_driver_nl80211_data *drv = eloop_ctx;
3476         if (drv->ap_scan_as_station != NL80211_IFTYPE_UNSPECIFIED) {
3477                 wpa_driver_nl80211_set_mode(&drv->first_bss,
3478                                             drv->ap_scan_as_station);
3479                 drv->ap_scan_as_station = NL80211_IFTYPE_UNSPECIFIED;
3480         }
3481         wpa_printf(MSG_DEBUG, "Scan timeout - try to get results");
3482         wpa_supplicant_event(timeout_ctx, EVENT_SCAN_RESULTS, NULL);
3483 }
3484
3485
3486 static struct nl_msg *
3487 nl80211_scan_common(struct wpa_driver_nl80211_data *drv, u8 cmd,
3488                     struct wpa_driver_scan_params *params)
3489 {
3490         struct nl_msg *msg;
3491         int err;
3492         size_t i;
3493
3494         msg = nlmsg_alloc();
3495         if (!msg)
3496                 return NULL;
3497
3498         nl80211_cmd(drv, msg, 0, cmd);
3499
3500         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, drv->ifindex) < 0)
3501                 goto fail;
3502
3503         if (params->num_ssids) {
3504                 struct nl_msg *ssids = nlmsg_alloc();
3505                 if (ssids == NULL)
3506                         goto fail;
3507                 for (i = 0; i < params->num_ssids; i++) {
3508                         wpa_hexdump_ascii(MSG_MSGDUMP, "nl80211: Scan SSID",
3509                                           params->ssids[i].ssid,
3510                                           params->ssids[i].ssid_len);
3511                         if (nla_put(ssids, i + 1, params->ssids[i].ssid_len,
3512                                     params->ssids[i].ssid) < 0) {
3513                                 nlmsg_free(ssids);
3514                                 goto fail;
3515                         }
3516                 }
3517                 err = nla_put_nested(msg, NL80211_ATTR_SCAN_SSIDS, ssids);
3518                 nlmsg_free(ssids);
3519                 if (err < 0)
3520                         goto fail;
3521         }
3522
3523         if (params->extra_ies) {
3524                 wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan extra IEs",
3525                             params->extra_ies, params->extra_ies_len);
3526                 if (nla_put(msg, NL80211_ATTR_IE, params->extra_ies_len,
3527                             params->extra_ies) < 0)
3528                         goto fail;
3529         }
3530
3531         if (params->freqs) {
3532                 struct nl_msg *freqs = nlmsg_alloc();
3533                 if (freqs == NULL)
3534                         goto fail;
3535                 for (i = 0; params->freqs[i]; i++) {
3536                         wpa_printf(MSG_MSGDUMP, "nl80211: Scan frequency %u "
3537                                    "MHz", params->freqs[i]);
3538                         if (nla_put_u32(freqs, i + 1, params->freqs[i]) < 0) {
3539                                 nlmsg_free(freqs);
3540                                 goto fail;
3541                         }
3542                 }
3543                 err = nla_put_nested(msg, NL80211_ATTR_SCAN_FREQUENCIES,
3544                                      freqs);
3545                 nlmsg_free(freqs);
3546                 if (err < 0)
3547                         goto fail;
3548         }
3549
3550         os_free(drv->filter_ssids);
3551         drv->filter_ssids = params->filter_ssids;
3552         params->filter_ssids = NULL;
3553         drv->num_filter_ssids = params->num_filter_ssids;
3554
3555         return msg;
3556
3557 fail:
3558         nlmsg_free(msg);
3559         return NULL;
3560 }
3561
3562
3563 /**
3564  * wpa_driver_nl80211_scan - Request the driver to initiate scan
3565  * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
3566  * @params: Scan parameters
3567  * Returns: 0 on success, -1 on failure
3568  */
3569 static int wpa_driver_nl80211_scan(void *priv,
3570                                    struct wpa_driver_scan_params *params)
3571 {
3572         struct i802_bss *bss = priv;
3573         struct wpa_driver_nl80211_data *drv = bss->drv;
3574         int ret = -1, timeout;
3575         struct nl_msg *msg, *rates = NULL;
3576
3577         drv->scan_for_auth = 0;
3578
3579         msg = nl80211_scan_common(drv, NL80211_CMD_TRIGGER_SCAN, params);
3580         if (!msg)
3581                 return -1;
3582
3583         if (params->p2p_probe) {
3584                 wpa_printf(MSG_DEBUG, "nl80211: P2P probe - mask SuppRates");
3585
3586                 rates = nlmsg_alloc();
3587                 if (rates == NULL)
3588                         goto nla_put_failure;
3589
3590                 /*
3591                  * Remove 2.4 GHz rates 1, 2, 5.5, 11 Mbps from supported rates
3592                  * by masking out everything else apart from the OFDM rates 6,
3593                  * 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS rates. All 5 GHz
3594                  * rates are left enabled.
3595                  */
3596                 NLA_PUT(rates, NL80211_BAND_2GHZ, 8,
3597                         "\x0c\x12\x18\x24\x30\x48\x60\x6c");
3598                 if (nla_put_nested(msg, NL80211_ATTR_SCAN_SUPP_RATES, rates) <
3599                     0)
3600                         goto nla_put_failure;
3601
3602                 NLA_PUT_FLAG(msg, NL80211_ATTR_TX_NO_CCK_RATE);
3603         }
3604
3605         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3606         msg = NULL;
3607         if (ret) {
3608                 wpa_printf(MSG_DEBUG, "nl80211: Scan trigger failed: ret=%d "
3609                            "(%s)", ret, strerror(-ret));
3610 #ifdef HOSTAPD
3611                 if (is_ap_interface(drv->nlmode)) {
3612                         /*
3613                          * mac80211 does not allow scan requests in AP mode, so
3614                          * try to do this in station mode.
3615                          */
3616                         if (wpa_driver_nl80211_set_mode(
3617                                     bss, NL80211_IFTYPE_STATION))
3618                                 goto nla_put_failure;
3619
3620                         if (wpa_driver_nl80211_scan(drv, params)) {
3621                                 wpa_driver_nl80211_set_mode(bss, drv->nlmode);
3622                                 goto nla_put_failure;
3623                         }
3624
3625                         /* Restore AP mode when processing scan results */
3626                         drv->ap_scan_as_station = drv->nlmode;
3627                         ret = 0;
3628                 } else
3629                         goto nla_put_failure;
3630 #else /* HOSTAPD */
3631                 goto nla_put_failure;
3632 #endif /* HOSTAPD */
3633         }
3634
3635         /* Not all drivers generate "scan completed" wireless event, so try to
3636          * read results after a timeout. */
3637         timeout = 10;
3638         if (drv->scan_complete_events) {
3639                 /*
3640                  * The driver seems to deliver events to notify when scan is
3641                  * complete, so use longer timeout to avoid race conditions
3642                  * with scanning and following association request.
3643                  */
3644                 timeout = 30;
3645         }
3646         wpa_printf(MSG_DEBUG, "Scan requested (ret=%d) - scan timeout %d "
3647                    "seconds", ret, timeout);
3648         eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
3649         eloop_register_timeout(timeout, 0, wpa_driver_nl80211_scan_timeout,
3650                                drv, drv->ctx);
3651
3652 nla_put_failure:
3653         nlmsg_free(msg);
3654         nlmsg_free(rates);
3655         return ret;
3656 }
3657
3658
3659 /**
3660  * wpa_driver_nl80211_sched_scan - Initiate a scheduled scan
3661  * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
3662  * @params: Scan parameters
3663  * @interval: Interval between scan cycles in milliseconds
3664  * Returns: 0 on success, -1 on failure or if not supported
3665  */
3666 static int wpa_driver_nl80211_sched_scan(void *priv,
3667                                          struct wpa_driver_scan_params *params,
3668                                          u32 interval)
3669 {
3670         struct i802_bss *bss = priv;
3671         struct wpa_driver_nl80211_data *drv = bss->drv;
3672         int ret = -1;
3673         struct nl_msg *msg;
3674         struct nl_msg *match_set_ssid = NULL, *match_sets = NULL;
3675         struct nl_msg *match_set_rssi = NULL;
3676         size_t i;
3677
3678 #ifdef ANDROID
3679         if (!drv->capa.sched_scan_supported)
3680                 return android_pno_start(bss, params);
3681 #endif /* ANDROID */
3682
3683         msg = nl80211_scan_common(drv, NL80211_CMD_START_SCHED_SCAN, params);
3684         if (!msg)
3685                 goto nla_put_failure;
3686
3687         NLA_PUT_U32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL, interval);
3688
3689         if ((drv->num_filter_ssids &&
3690             (int) drv->num_filter_ssids <= drv->capa.max_match_sets) ||
3691             params->filter_rssi) {
3692                 match_sets = nlmsg_alloc();
3693                 if (match_sets == NULL)
3694                         goto nla_put_failure;
3695
3696                 for (i = 0; i < drv->num_filter_ssids; i++) {
3697                         wpa_hexdump_ascii(MSG_MSGDUMP,
3698                                           "nl80211: Sched scan filter SSID",
3699                                           drv->filter_ssids[i].ssid,
3700                                           drv->filter_ssids[i].ssid_len);
3701
3702                         match_set_ssid = nlmsg_alloc();
3703                         if (match_set_ssid == NULL)
3704                                 goto nla_put_failure;
3705                         NLA_PUT(match_set_ssid,
3706                                 NL80211_ATTR_SCHED_SCAN_MATCH_SSID,
3707                                 drv->filter_ssids[i].ssid_len,
3708                                 drv->filter_ssids[i].ssid);
3709
3710                         if (nla_put_nested(match_sets, i + 1, match_set_ssid) <
3711                             0)
3712                                 goto nla_put_failure;
3713                 }
3714
3715                 if (params->filter_rssi) {
3716                         match_set_rssi = nlmsg_alloc();
3717                         if (match_set_rssi == NULL)
3718                                 goto nla_put_failure;
3719                         NLA_PUT_U32(match_set_rssi,
3720                                     NL80211_SCHED_SCAN_MATCH_ATTR_RSSI,
3721                                     params->filter_rssi);
3722                         wpa_printf(MSG_MSGDUMP,
3723                                    "nl80211: Sched scan RSSI filter %d dBm",
3724                                    params->filter_rssi);
3725                         if (nla_put_nested(match_sets, 0, match_set_rssi) < 0)
3726                                 goto nla_put_failure;
3727                 }
3728
3729                 if (nla_put_nested(msg, NL80211_ATTR_SCHED_SCAN_MATCH,
3730                                    match_sets) < 0)
3731                         goto nla_put_failure;
3732         }
3733
3734         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3735
3736         /* TODO: if we get an error here, we should fall back to normal scan */
3737
3738         msg = NULL;
3739         if (ret) {
3740                 wpa_printf(MSG_DEBUG, "nl80211: Sched scan start failed: "
3741                            "ret=%d (%s)", ret, strerror(-ret));
3742                 goto nla_put_failure;
3743         }
3744
3745         wpa_printf(MSG_DEBUG, "nl80211: Sched scan requested (ret=%d) - "
3746                    "scan interval %d msec", ret, interval);
3747
3748 nla_put_failure:
3749         nlmsg_free(match_set_ssid);
3750         nlmsg_free(match_sets);
3751         nlmsg_free(match_set_rssi);
3752         nlmsg_free(msg);
3753         return ret;
3754 }
3755
3756
3757 /**
3758  * wpa_driver_nl80211_stop_sched_scan - Stop a scheduled scan
3759  * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
3760  * Returns: 0 on success, -1 on failure or if not supported
3761  */
3762 static int wpa_driver_nl80211_stop_sched_scan(void *priv)
3763 {
3764         struct i802_bss *bss = priv;
3765         struct wpa_driver_nl80211_data *drv = bss->drv;
3766         int ret = 0;
3767         struct nl_msg *msg;
3768
3769 #ifdef ANDROID
3770         if (!drv->capa.sched_scan_supported)
3771                 return android_pno_stop(bss);
3772 #endif /* ANDROID */
3773
3774         msg = nlmsg_alloc();
3775         if (!msg)
3776                 return -1;
3777
3778         nl80211_cmd(drv, msg, 0, NL80211_CMD_STOP_SCHED_SCAN);
3779
3780         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
3781
3782         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3783         msg = NULL;
3784         if (ret) {
3785                 wpa_printf(MSG_DEBUG, "nl80211: Sched scan stop failed: "
3786                            "ret=%d (%s)", ret, strerror(-ret));
3787                 goto nla_put_failure;
3788         }
3789
3790         wpa_printf(MSG_DEBUG, "nl80211: Sched scan stop sent (ret=%d)", ret);
3791
3792 nla_put_failure:
3793         nlmsg_free(msg);
3794         return ret;
3795 }
3796
3797
3798 static const u8 * nl80211_get_ie(const u8 *ies, size_t ies_len, u8 ie)
3799 {
3800         const u8 *end, *pos;
3801
3802         if (ies == NULL)
3803                 return NULL;
3804
3805         pos = ies;
3806         end = ies + ies_len;
3807
3808         while (pos + 1 < end) {
3809                 if (pos + 2 + pos[1] > end)
3810                         break;
3811                 if (pos[0] == ie)
3812                         return pos;
3813                 pos += 2 + pos[1];
3814         }
3815
3816         return NULL;
3817 }
3818
3819
3820 static int nl80211_scan_filtered(struct wpa_driver_nl80211_data *drv,
3821                                  const u8 *ie, size_t ie_len)
3822 {
3823         const u8 *ssid;
3824         size_t i;
3825
3826         if (drv->filter_ssids == NULL)
3827                 return 0;
3828
3829         ssid = nl80211_get_ie(ie, ie_len, WLAN_EID_SSID);
3830         if (ssid == NULL)
3831                 return 1;
3832
3833         for (i = 0; i < drv->num_filter_ssids; i++) {
3834                 if (ssid[1] == drv->filter_ssids[i].ssid_len &&
3835                     os_memcmp(ssid + 2, drv->filter_ssids[i].ssid, ssid[1]) ==
3836                     0)
3837                         return 0;
3838         }
3839
3840         return 1;
3841 }
3842
3843
3844 static int bss_info_handler(struct nl_msg *msg, void *arg)
3845 {
3846         struct nlattr *tb[NL80211_ATTR_MAX + 1];
3847         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
3848         struct nlattr *bss[NL80211_BSS_MAX + 1];
3849         static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = {
3850                 [NL80211_BSS_BSSID] = { .type = NLA_UNSPEC },
3851                 [NL80211_BSS_FREQUENCY] = { .type = NLA_U32 },
3852                 [NL80211_BSS_TSF] = { .type = NLA_U64 },
3853                 [NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 },
3854                 [NL80211_BSS_CAPABILITY] = { .type = NLA_U16 },
3855                 [NL80211_BSS_INFORMATION_ELEMENTS] = { .type = NLA_UNSPEC },
3856                 [NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 },
3857                 [NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 },
3858                 [NL80211_BSS_STATUS] = { .type = NLA_U32 },
3859                 [NL80211_BSS_SEEN_MS_AGO] = { .type = NLA_U32 },
3860                 [NL80211_BSS_BEACON_IES] = { .type = NLA_UNSPEC },
3861         };
3862         struct nl80211_bss_info_arg *_arg = arg;
3863         struct wpa_scan_results *res = _arg->res;
3864         struct wpa_scan_res **tmp;
3865         struct wpa_scan_res *r;
3866         const u8 *ie, *beacon_ie;
3867         size_t ie_len, beacon_ie_len;
3868         u8 *pos;
3869         size_t i;
3870
3871         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
3872                   genlmsg_attrlen(gnlh, 0), NULL);
3873         if (!tb[NL80211_ATTR_BSS])
3874                 return NL_SKIP;
3875         if (nla_parse_nested(bss, NL80211_BSS_MAX, tb[NL80211_ATTR_BSS],
3876                              bss_policy))
3877                 return NL_SKIP;
3878         if (bss[NL80211_BSS_STATUS]) {
3879                 enum nl80211_bss_status status;
3880                 status = nla_get_u32(bss[NL80211_BSS_STATUS]);
3881                 if (status == NL80211_BSS_STATUS_ASSOCIATED &&
3882                     bss[NL80211_BSS_FREQUENCY]) {
3883                         _arg->assoc_freq =
3884                                 nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
3885                         wpa_printf(MSG_DEBUG, "nl80211: Associated on %u MHz",
3886                                    _arg->assoc_freq);
3887                 }
3888                 if (status == NL80211_BSS_STATUS_ASSOCIATED &&
3889                     bss[NL80211_BSS_BSSID]) {
3890                         os_memcpy(_arg->assoc_bssid,
3891                                   nla_data(bss[NL80211_BSS_BSSID]), ETH_ALEN);
3892                         wpa_printf(MSG_DEBUG, "nl80211: Associated with "
3893                                    MACSTR, MAC2STR(_arg->assoc_bssid));
3894                 }
3895         }
3896         if (!res)
3897                 return NL_SKIP;
3898         if (bss[NL80211_BSS_INFORMATION_ELEMENTS]) {
3899                 ie = nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
3900                 ie_len = nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
3901         } else {
3902                 ie = NULL;
3903                 ie_len = 0;
3904         }
3905         if (bss[NL80211_BSS_BEACON_IES]) {
3906                 beacon_ie = nla_data(bss[NL80211_BSS_BEACON_IES]);
3907                 beacon_ie_len = nla_len(bss[NL80211_BSS_BEACON_IES]);
3908         } else {
3909                 beacon_ie = NULL;
3910                 beacon_ie_len = 0;
3911         }
3912
3913         if (nl80211_scan_filtered(_arg->drv, ie ? ie : beacon_ie,
3914                                   ie ? ie_len : beacon_ie_len))
3915                 return NL_SKIP;
3916
3917         r = os_zalloc(sizeof(*r) + ie_len + beacon_ie_len);
3918         if (r == NULL)
3919                 return NL_SKIP;
3920         if (bss[NL80211_BSS_BSSID])
3921                 os_memcpy(r->bssid, nla_data(bss[NL80211_BSS_BSSID]),
3922                           ETH_ALEN);
3923         if (bss[NL80211_BSS_FREQUENCY])
3924                 r->freq = nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
3925         if (bss[NL80211_BSS_BEACON_INTERVAL])
3926                 r->beacon_int = nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]);
3927         if (bss[NL80211_BSS_CAPABILITY])
3928                 r->caps = nla_get_u16(bss[NL80211_BSS_CAPABILITY]);
3929         r->flags |= WPA_SCAN_NOISE_INVALID;
3930         if (bss[NL80211_BSS_SIGNAL_MBM]) {
3931                 r->level = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]);
3932                 r->level /= 100; /* mBm to dBm */
3933                 r->flags |= WPA_SCAN_LEVEL_DBM | WPA_SCAN_QUAL_INVALID;
3934         } else if (bss[NL80211_BSS_SIGNAL_UNSPEC]) {
3935                 r->level = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]);
3936                 r->flags |= WPA_SCAN_QUAL_INVALID;
3937         } else
3938                 r->flags |= WPA_SCAN_LEVEL_INVALID | WPA_SCAN_QUAL_INVALID;
3939         if (bss[NL80211_BSS_TSF])
3940                 r->tsf = nla_get_u64(bss[NL80211_BSS_TSF]);
3941         if (bss[NL80211_BSS_SEEN_MS_AGO])
3942                 r->age = nla_get_u32(bss[NL80211_BSS_SEEN_MS_AGO]);
3943         r->ie_len = ie_len;
3944         pos = (u8 *) (r + 1);
3945         if (ie) {
3946                 os_memcpy(pos, ie, ie_len);
3947                 pos += ie_len;
3948         }
3949         r->beacon_ie_len = beacon_ie_len;
3950         if (beacon_ie)
3951                 os_memcpy(pos, beacon_ie, beacon_ie_len);
3952
3953         if (bss[NL80211_BSS_STATUS]) {
3954                 enum nl80211_bss_status status;
3955                 status = nla_get_u32(bss[NL80211_BSS_STATUS]);
3956                 switch (status) {
3957                 case NL80211_BSS_STATUS_AUTHENTICATED:
3958                         r->flags |= WPA_SCAN_AUTHENTICATED;
3959                         break;
3960                 case NL80211_BSS_STATUS_ASSOCIATED:
3961                         r->flags |= WPA_SCAN_ASSOCIATED;
3962                         break;
3963                 default:
3964                         break;
3965                 }
3966         }
3967
3968         /*
3969          * cfg80211 maintains separate BSS table entries for APs if the same
3970          * BSSID,SSID pair is seen on multiple channels. wpa_supplicant does
3971          * not use frequency as a separate key in the BSS table, so filter out
3972          * duplicated entries. Prefer associated BSS entry in such a case in
3973          * order to get the correct frequency into the BSS table.
3974          */
3975         for (i = 0; i < res->num; i++) {
3976                 const u8 *s1, *s2;
3977                 if (os_memcmp(res->res[i]->bssid, r->bssid, ETH_ALEN) != 0)
3978                         continue;
3979
3980                 s1 = nl80211_get_ie((u8 *) (res->res[i] + 1),
3981                                     res->res[i]->ie_len, WLAN_EID_SSID);
3982                 s2 = nl80211_get_ie((u8 *) (r + 1), r->ie_len, WLAN_EID_SSID);
3983                 if (s1 == NULL || s2 == NULL || s1[1] != s2[1] ||
3984                     os_memcmp(s1, s2, 2 + s1[1]) != 0)
3985                         continue;
3986
3987                 /* Same BSSID,SSID was already included in scan results */
3988                 wpa_printf(MSG_DEBUG, "nl80211: Remove duplicated scan result "
3989                            "for " MACSTR, MAC2STR(r->bssid));
3990
3991                 if ((r->flags & WPA_SCAN_ASSOCIATED) &&
3992                     !(res->res[i]->flags & WPA_SCAN_ASSOCIATED)) {
3993                         os_free(res->res[i]);
3994                         res->res[i] = r;
3995                 } else
3996                         os_free(r);
3997                 return NL_SKIP;
3998         }
3999
4000         tmp = os_realloc_array(res->res, res->num + 1,
4001                                sizeof(struct wpa_scan_res *));
4002         if (tmp == NULL) {
4003                 os_free(r);
4004                 return NL_SKIP;
4005         }
4006         tmp[res->num++] = r;
4007         res->res = tmp;
4008
4009         return NL_SKIP;
4010 }
4011
4012
4013 static void clear_state_mismatch(struct wpa_driver_nl80211_data *drv,
4014                                  const u8 *addr)
4015 {
4016         if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) {
4017                 wpa_printf(MSG_DEBUG, "nl80211: Clear possible state "
4018                            "mismatch (" MACSTR ")", MAC2STR(addr));
4019                 wpa_driver_nl80211_mlme(drv, addr,
4020                                         NL80211_CMD_DEAUTHENTICATE,
4021                                         WLAN_REASON_PREV_AUTH_NOT_VALID, 1);
4022         }
4023 }
4024
4025
4026 static void wpa_driver_nl80211_check_bss_status(
4027         struct wpa_driver_nl80211_data *drv, struct wpa_scan_results *res)
4028 {
4029         size_t i;
4030
4031         for (i = 0; i < res->num; i++) {
4032                 struct wpa_scan_res *r = res->res[i];
4033                 if (r->flags & WPA_SCAN_AUTHENTICATED) {
4034                         wpa_printf(MSG_DEBUG, "nl80211: Scan results "
4035                                    "indicates BSS status with " MACSTR
4036                                    " as authenticated",
4037                                    MAC2STR(r->bssid));
4038                         if (is_sta_interface(drv->nlmode) &&
4039                             os_memcmp(r->bssid, drv->bssid, ETH_ALEN) != 0 &&
4040                             os_memcmp(r->bssid, drv->auth_bssid, ETH_ALEN) !=
4041                             0) {
4042                                 wpa_printf(MSG_DEBUG, "nl80211: Unknown BSSID"
4043                                            " in local state (auth=" MACSTR
4044                                            " assoc=" MACSTR ")",
4045                                            MAC2STR(drv->auth_bssid),
4046                                            MAC2STR(drv->bssid));
4047                                 clear_state_mismatch(drv, r->bssid);
4048                         }
4049                 }
4050
4051                 if (r->flags & WPA_SCAN_ASSOCIATED) {
4052                         wpa_printf(MSG_DEBUG, "nl80211: Scan results "
4053                                    "indicate BSS status with " MACSTR
4054                                    " as associated",
4055                                    MAC2STR(r->bssid));
4056                         if (is_sta_interface(drv->nlmode) &&
4057                             !drv->associated) {
4058                                 wpa_printf(MSG_DEBUG, "nl80211: Local state "
4059                                            "(not associated) does not match "
4060                                            "with BSS state");
4061                                 clear_state_mismatch(drv, r->bssid);
4062                         } else if (is_sta_interface(drv->nlmode) &&
4063                                    os_memcmp(drv->bssid, r->bssid, ETH_ALEN) !=
4064                                    0) {
4065                                 wpa_printf(MSG_DEBUG, "nl80211: Local state "
4066                                            "(associated with " MACSTR ") does "
4067                                            "not match with BSS state",
4068                                            MAC2STR(drv->bssid));
4069                                 clear_state_mismatch(drv, r->bssid);
4070                                 clear_state_mismatch(drv, drv->bssid);
4071                         }
4072                 }
4073         }
4074 }
4075
4076
4077 static struct wpa_scan_results *
4078 nl80211_get_scan_results(struct wpa_driver_nl80211_data *drv)
4079 {
4080         struct nl_msg *msg;
4081         struct wpa_scan_results *res;
4082         int ret;
4083         struct nl80211_bss_info_arg arg;
4084
4085         res = os_zalloc(sizeof(*res));
4086         if (res == NULL)
4087                 return NULL;
4088         msg = nlmsg_alloc();
4089         if (!msg)
4090                 goto nla_put_failure;
4091
4092         nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_SCAN);
4093         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
4094
4095         arg.drv = drv;
4096         arg.res = res;
4097         ret = send_and_recv_msgs(drv, msg, bss_info_handler, &arg);
4098         msg = NULL;
4099         if (ret == 0) {
4100                 wpa_printf(MSG_DEBUG, "nl80211: Received scan results (%lu "
4101                            "BSSes)", (unsigned long) res->num);
4102                 nl80211_get_noise_for_scan_results(drv, res);
4103                 return res;
4104         }
4105         wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d "
4106                    "(%s)", ret, strerror(-ret));
4107 nla_put_failure:
4108         nlmsg_free(msg);
4109         wpa_scan_results_free(res);
4110         return NULL;
4111 }
4112
4113
4114 /**
4115  * wpa_driver_nl80211_get_scan_results - Fetch the latest scan results
4116  * @priv: Pointer to private wext data from wpa_driver_nl80211_init()
4117  * Returns: Scan results on success, -1 on failure
4118  */
4119 static struct wpa_scan_results *
4120 wpa_driver_nl80211_get_scan_results(void *priv)
4121 {
4122         struct i802_bss *bss = priv;
4123         struct wpa_driver_nl80211_data *drv = bss->drv;
4124         struct wpa_scan_results *res;
4125
4126         res = nl80211_get_scan_results(drv);
4127         if (res)
4128                 wpa_driver_nl80211_check_bss_status(drv, res);
4129         return res;
4130 }
4131
4132
4133 static void nl80211_dump_scan(struct wpa_driver_nl80211_data *drv)
4134 {
4135         struct wpa_scan_results *res;
4136         size_t i;
4137
4138         res = nl80211_get_scan_results(drv);
4139         if (res == NULL) {
4140                 wpa_printf(MSG_DEBUG, "nl80211: Failed to get scan results");
4141                 return;
4142         }
4143
4144         wpa_printf(MSG_DEBUG, "nl80211: Scan result dump");
4145         for (i = 0; i < res->num; i++) {
4146                 struct wpa_scan_res *r = res->res[i];
4147                 wpa_printf(MSG_DEBUG, "nl80211: %d/%d " MACSTR "%s%s",
4148                            (int) i, (int) res->num, MAC2STR(r->bssid),
4149                            r->flags & WPA_SCAN_AUTHENTICATED ? " [auth]" : "",
4150                            r->flags & WPA_SCAN_ASSOCIATED ? " [assoc]" : "");
4151         }
4152
4153         wpa_scan_results_free(res);
4154 }
4155
4156
4157 static int wpa_driver_nl80211_set_key(const char *ifname, void *priv,
4158                                       enum wpa_alg alg, const u8 *addr,
4159                                       int key_idx, int set_tx,
4160                                       const u8 *seq, size_t seq_len,
4161                                       const u8 *key, size_t key_len)
4162 {
4163         struct i802_bss *bss = priv;
4164         struct wpa_driver_nl80211_data *drv = bss->drv;
4165         int ifindex = if_nametoindex(ifname);
4166         struct nl_msg *msg;
4167         int ret;
4168
4169         wpa_printf(MSG_DEBUG, "%s: ifindex=%d alg=%d addr=%p key_idx=%d "
4170                    "set_tx=%d seq_len=%lu key_len=%lu",
4171                    __func__, ifindex, alg, addr, key_idx, set_tx,
4172                    (unsigned long) seq_len, (unsigned long) key_len);
4173 #ifdef CONFIG_TDLS
4174         if (key_idx == -1)
4175                 key_idx = 0;
4176 #endif /* CONFIG_TDLS */
4177
4178         msg = nlmsg_alloc();
4179         if (!msg)
4180                 return -ENOMEM;
4181
4182         if (alg == WPA_ALG_NONE) {
4183                 nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_KEY);
4184         } else {
4185                 nl80211_cmd(drv, msg, 0, NL80211_CMD_NEW_KEY);
4186                 NLA_PUT(msg, NL80211_ATTR_KEY_DATA, key_len, key);
4187                 switch (alg) {
4188                 case WPA_ALG_WEP:
4189                         if (key_len == 5)
4190                                 NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
4191                                             WLAN_CIPHER_SUITE_WEP40);
4192                         else
4193                                 NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
4194                                             WLAN_CIPHER_SUITE_WEP104);
4195                         break;
4196                 case WPA_ALG_TKIP:
4197                         NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
4198                                     WLAN_CIPHER_SUITE_TKIP);
4199                         break;
4200                 case WPA_ALG_CCMP:
4201                         NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
4202                                     WLAN_CIPHER_SUITE_CCMP);
4203                         break;
4204                 case WPA_ALG_GCMP:
4205                         NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
4206                                     WLAN_CIPHER_SUITE_GCMP);
4207                         break;
4208                 case WPA_ALG_IGTK:
4209                         NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
4210                                     WLAN_CIPHER_SUITE_AES_CMAC);
4211                         break;
4212                 default:
4213                         wpa_printf(MSG_ERROR, "%s: Unsupported encryption "
4214                                    "algorithm %d", __func__, alg);
4215                         nlmsg_free(msg);
4216                         return -1;
4217                 }
4218         }
4219
4220         if (seq && seq_len)
4221                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, seq_len, seq);
4222
4223         if (addr && !is_broadcast_ether_addr(addr)) {
4224                 wpa_printf(MSG_DEBUG, "   addr=" MACSTR, MAC2STR(addr));
4225                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
4226
4227                 if (alg != WPA_ALG_WEP && key_idx && !set_tx) {
4228                         wpa_printf(MSG_DEBUG, "   RSN IBSS RX GTK");
4229                         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE,
4230                                     NL80211_KEYTYPE_GROUP);
4231                 }
4232         } else if (addr && is_broadcast_ether_addr(addr)) {
4233                 struct nl_msg *types;
4234                 int err;
4235                 wpa_printf(MSG_DEBUG, "   broadcast key");
4236                 types = nlmsg_alloc();
4237                 if (!types)
4238                         goto nla_put_failure;
4239                 NLA_PUT_FLAG(types, NL80211_KEY_DEFAULT_TYPE_MULTICAST);
4240                 err = nla_put_nested(msg, NL80211_ATTR_KEY_DEFAULT_TYPES,
4241                                      types);
4242                 nlmsg_free(types);
4243                 if (err)
4244                         goto nla_put_failure;
4245         }
4246         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
4247         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
4248
4249         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4250         if ((ret == -ENOENT || ret == -ENOLINK) && alg == WPA_ALG_NONE)
4251                 ret = 0;
4252         if (ret)
4253                 wpa_printf(MSG_DEBUG, "nl80211: set_key failed; err=%d %s)",
4254                            ret, strerror(-ret));
4255
4256         /*
4257          * If we failed or don't need to set the default TX key (below),
4258          * we're done here.
4259          */
4260         if (ret || !set_tx || alg == WPA_ALG_NONE)
4261                 return ret;
4262         if (is_ap_interface(drv->nlmode) && addr &&
4263             !is_broadcast_ether_addr(addr))
4264                 return ret;
4265
4266         msg = nlmsg_alloc();
4267         if (!msg)
4268                 return -ENOMEM;
4269
4270         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_KEY);
4271         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
4272         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
4273         if (alg == WPA_ALG_IGTK)
4274                 NLA_PUT_FLAG(msg, NL80211_ATTR_KEY_DEFAULT_MGMT);
4275         else
4276                 NLA_PUT_FLAG(msg, NL80211_ATTR_KEY_DEFAULT);
4277         if (addr && is_broadcast_ether_addr(addr)) {
4278                 struct nl_msg *types;
4279                 int err;
4280                 types = nlmsg_alloc();
4281                 if (!types)
4282                         goto nla_put_failure;
4283                 NLA_PUT_FLAG(types, NL80211_KEY_DEFAULT_TYPE_MULTICAST);
4284                 err = nla_put_nested(msg, NL80211_ATTR_KEY_DEFAULT_TYPES,
4285                                      types);
4286                 nlmsg_free(types);
4287                 if (err)
4288                         goto nla_put_failure;
4289         } else if (addr) {
4290                 struct nl_msg *types;
4291                 int err;
4292                 types = nlmsg_alloc();
4293                 if (!types)
4294                         goto nla_put_failure;
4295                 NLA_PUT_FLAG(types, NL80211_KEY_DEFAULT_TYPE_UNICAST);
4296                 err = nla_put_nested(msg, NL80211_ATTR_KEY_DEFAULT_TYPES,
4297                                      types);
4298                 nlmsg_free(types);
4299                 if (err)
4300                         goto nla_put_failure;
4301         }
4302
4303         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4304         if (ret == -ENOENT)
4305                 ret = 0;
4306         if (ret)
4307                 wpa_printf(MSG_DEBUG, "nl80211: set_key default failed; "
4308                            "err=%d %s)", ret, strerror(-ret));
4309         return ret;
4310
4311 nla_put_failure:
4312         nlmsg_free(msg);
4313         return -ENOBUFS;
4314 }
4315
4316
4317 static int nl_add_key(struct nl_msg *msg, enum wpa_alg alg,
4318                       int key_idx, int defkey,
4319                       const u8 *seq, size_t seq_len,
4320                       const u8 *key, size_t key_len)
4321 {
4322         struct nlattr *key_attr = nla_nest_start(msg, NL80211_ATTR_KEY);
4323         if (!key_attr)
4324                 return -1;
4325
4326         if (defkey && alg == WPA_ALG_IGTK)
4327                 NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT_MGMT);
4328         else if (defkey)
4329                 NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT);
4330
4331         NLA_PUT_U8(msg, NL80211_KEY_IDX, key_idx);
4332
4333         switch (alg) {
4334         case WPA_ALG_WEP:
4335                 if (key_len == 5)
4336                         NLA_PUT_U32(msg, NL80211_KEY_CIPHER,
4337                                     WLAN_CIPHER_SUITE_WEP40);
4338                 else
4339                         NLA_PUT_U32(msg, NL80211_KEY_CIPHER,
4340                                     WLAN_CIPHER_SUITE_WEP104);
4341                 break;
4342         case WPA_ALG_TKIP:
4343                 NLA_PUT_U32(msg, NL80211_KEY_CIPHER, WLAN_CIPHER_SUITE_TKIP);
4344                 break;
4345         case WPA_ALG_CCMP:
4346                 NLA_PUT_U32(msg, NL80211_KEY_CIPHER, WLAN_CIPHER_SUITE_CCMP);
4347                 break;
4348         case WPA_ALG_GCMP:
4349                 NLA_PUT_U32(msg, NL80211_KEY_CIPHER, WLAN_CIPHER_SUITE_GCMP);
4350                 break;
4351         case WPA_ALG_IGTK:
4352                 NLA_PUT_U32(msg, NL80211_KEY_CIPHER,
4353                             WLAN_CIPHER_SUITE_AES_CMAC);
4354                 break;
4355         default:
4356                 wpa_printf(MSG_ERROR, "%s: Unsupported encryption "
4357                            "algorithm %d", __func__, alg);
4358                 return -1;
4359         }
4360
4361         if (seq && seq_len)
4362                 NLA_PUT(msg, NL80211_KEY_SEQ, seq_len, seq);
4363
4364         NLA_PUT(msg, NL80211_KEY_DATA, key_len, key);
4365
4366         nla_nest_end(msg, key_attr);
4367
4368         return 0;
4369  nla_put_failure:
4370         return -1;
4371 }
4372
4373
4374 static int nl80211_set_conn_keys(struct wpa_driver_associate_params *params,
4375                                  struct nl_msg *msg)
4376 {
4377         int i, privacy = 0;
4378         struct nlattr *nl_keys, *nl_key;
4379
4380         for (i = 0; i < 4; i++) {
4381                 if (!params->wep_key[i])
4382                         continue;
4383                 privacy = 1;
4384                 break;
4385         }
4386         if (params->wps == WPS_MODE_PRIVACY)
4387                 privacy = 1;
4388         if (params->pairwise_suite &&
4389             params->pairwise_suite != WPA_CIPHER_NONE)
4390                 privacy = 1;
4391
4392         if (!privacy)
4393                 return 0;
4394
4395         NLA_PUT_FLAG(msg, NL80211_ATTR_PRIVACY);
4396
4397         nl_keys = nla_nest_start(msg, NL80211_ATTR_KEYS);
4398         if (!nl_keys)
4399                 goto nla_put_failure;
4400
4401         for (i = 0; i < 4; i++) {
4402                 if (!params->wep_key[i])
4403                         continue;
4404
4405                 nl_key = nla_nest_start(msg, i);
4406                 if (!nl_key)
4407                         goto nla_put_failure;
4408
4409                 NLA_PUT(msg, NL80211_KEY_DATA, params->wep_key_len[i],
4410                         params->wep_key[i]);
4411                 if (params->wep_key_len[i] == 5)
4412                         NLA_PUT_U32(msg, NL80211_KEY_CIPHER,
4413                                     WLAN_CIPHER_SUITE_WEP40);
4414                 else
4415                         NLA_PUT_U32(msg, NL80211_KEY_CIPHER,
4416                                     WLAN_CIPHER_SUITE_WEP104);
4417
4418                 NLA_PUT_U8(msg, NL80211_KEY_IDX, i);
4419
4420                 if (i == params->wep_tx_keyidx)
4421                         NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT);
4422
4423                 nla_nest_end(msg, nl_key);
4424         }
4425         nla_nest_end(msg, nl_keys);
4426
4427         return 0;
4428
4429 nla_put_failure:
4430         return -ENOBUFS;
4431 }
4432
4433
4434 static int wpa_driver_nl80211_mlme(struct wpa_driver_nl80211_data *drv,
4435                                    const u8 *addr, int cmd, u16 reason_code,
4436                                    int local_state_change)
4437 {
4438         int ret = -1;
4439         struct nl_msg *msg;
4440
4441         msg = nlmsg_alloc();
4442         if (!msg)
4443                 return -1;
4444
4445         nl80211_cmd(drv, msg, 0, cmd);
4446
4447         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
4448         NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason_code);
4449         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
4450         if (local_state_change)
4451                 NLA_PUT_FLAG(msg, NL80211_ATTR_LOCAL_STATE_CHANGE);
4452
4453         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4454         msg = NULL;
4455         if (ret) {
4456                 wpa_dbg(drv->ctx, MSG_DEBUG,
4457                         "nl80211: MLME command failed: reason=%u ret=%d (%s)",
4458                         reason_code, ret, strerror(-ret));
4459                 goto nla_put_failure;
4460         }
4461         ret = 0;
4462
4463 nla_put_failure:
4464         nlmsg_free(msg);
4465         return ret;
4466 }
4467
4468
4469 static int wpa_driver_nl80211_disconnect(struct wpa_driver_nl80211_data *drv,
4470                                          const u8 *addr, int reason_code)
4471 {
4472         wpa_printf(MSG_DEBUG, "%s(addr=" MACSTR " reason_code=%d)",
4473                    __func__, MAC2STR(addr), reason_code);
4474         drv->associated = 0;
4475         return wpa_driver_nl80211_mlme(drv, addr, NL80211_CMD_DISCONNECT,
4476                                        reason_code, 0);
4477 }
4478
4479
4480 static int wpa_driver_nl80211_deauthenticate(void *priv, const u8 *addr,
4481                                              int reason_code)
4482 {
4483         struct i802_bss *bss = priv;
4484         struct wpa_driver_nl80211_data *drv = bss->drv;
4485         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME))
4486                 return wpa_driver_nl80211_disconnect(drv, addr, reason_code);
4487         wpa_printf(MSG_DEBUG, "%s(addr=" MACSTR " reason_code=%d)",
4488                    __func__, MAC2STR(addr), reason_code);
4489         drv->associated = 0;
4490         if (drv->nlmode == NL80211_IFTYPE_ADHOC)
4491                 return nl80211_leave_ibss(drv);
4492         return wpa_driver_nl80211_mlme(drv, addr, NL80211_CMD_DEAUTHENTICATE,
4493                                        reason_code, 0);
4494 }
4495
4496
4497 static int wpa_driver_nl80211_disassociate(void *priv, const u8 *addr,
4498                                            int reason_code)
4499 {
4500         struct i802_bss *bss = priv;
4501         struct wpa_driver_nl80211_data *drv = bss->drv;
4502         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME))
4503                 return wpa_driver_nl80211_disconnect(drv, addr, reason_code);
4504         wpa_printf(MSG_DEBUG, "%s", __func__);
4505         drv->associated = 0;
4506         return wpa_driver_nl80211_mlme(drv, addr, NL80211_CMD_DISASSOCIATE,
4507                                        reason_code, 0);
4508 }
4509
4510
4511 static void nl80211_copy_auth_params(struct wpa_driver_nl80211_data *drv,
4512                                      struct wpa_driver_auth_params *params)
4513 {
4514         int i;
4515
4516         drv->auth_freq = params->freq;
4517         drv->auth_alg = params->auth_alg;
4518         drv->auth_wep_tx_keyidx = params->wep_tx_keyidx;
4519         drv->auth_local_state_change = params->local_state_change;
4520         drv->auth_p2p = params->p2p;
4521
4522         if (params->bssid)
4523                 os_memcpy(drv->auth_bssid_, params->bssid, ETH_ALEN);
4524         else
4525                 os_memset(drv->auth_bssid_, 0, ETH_ALEN);
4526
4527         if (params->ssid) {
4528                 os_memcpy(drv->auth_ssid, params->ssid, params->ssid_len);
4529                 drv->auth_ssid_len = params->ssid_len;
4530         } else
4531                 drv->auth_ssid_len = 0;
4532
4533
4534         os_free(drv->auth_ie);
4535         drv->auth_ie = NULL;
4536         drv->auth_ie_len = 0;
4537         if (params->ie) {
4538                 drv->auth_ie = os_malloc(params->ie_len);
4539                 if (drv->auth_ie) {
4540                         os_memcpy(drv->auth_ie, params->ie, params->ie_len);
4541                         drv->auth_ie_len = params->ie_len;
4542                 }
4543         }
4544
4545         for (i = 0; i < 4; i++) {
4546                 if (params->wep_key[i] && params->wep_key_len[i] &&
4547                     params->wep_key_len[i] <= 16) {
4548                         os_memcpy(drv->auth_wep_key[i], params->wep_key[i],
4549                                   params->wep_key_len[i]);
4550                         drv->auth_wep_key_len[i] = params->wep_key_len[i];
4551                 } else
4552                         drv->auth_wep_key_len[i] = 0;
4553         }
4554 }
4555
4556
4557 static int wpa_driver_nl80211_authenticate(
4558         void *priv, struct wpa_driver_auth_params *params)
4559 {
4560         struct i802_bss *bss = priv;
4561         struct wpa_driver_nl80211_data *drv = bss->drv;
4562         int ret = -1, i;
4563         struct nl_msg *msg;
4564         enum nl80211_auth_type type;
4565         enum nl80211_iftype nlmode;
4566         int count = 0;
4567         int is_retry;
4568
4569         is_retry = drv->retry_auth;
4570         drv->retry_auth = 0;
4571
4572         drv->associated = 0;
4573         os_memset(drv->auth_bssid, 0, ETH_ALEN);
4574         /* FIX: IBSS mode */
4575         nlmode = params->p2p ?
4576                 NL80211_IFTYPE_P2P_CLIENT : NL80211_IFTYPE_STATION;
4577         if (drv->nlmode != nlmode &&
4578             wpa_driver_nl80211_set_mode(priv, nlmode) < 0)
4579                 return -1;
4580
4581 retry:
4582         msg = nlmsg_alloc();
4583         if (!msg)
4584                 return -1;
4585
4586         wpa_printf(MSG_DEBUG, "nl80211: Authenticate (ifindex=%d)",
4587                    drv->ifindex);
4588
4589         nl80211_cmd(drv, msg, 0, NL80211_CMD_AUTHENTICATE);
4590
4591         for (i = 0; i < 4; i++) {
4592                 if (!params->wep_key[i])
4593                         continue;
4594                 wpa_driver_nl80211_set_key(bss->ifname, priv, WPA_ALG_WEP,
4595                                            NULL, i,
4596                                            i == params->wep_tx_keyidx, NULL, 0,
4597                                            params->wep_key[i],
4598                                            params->wep_key_len[i]);
4599                 if (params->wep_tx_keyidx != i)
4600                         continue;
4601                 if (nl_add_key(msg, WPA_ALG_WEP, i, 1, NULL, 0,
4602                                params->wep_key[i], params->wep_key_len[i])) {
4603                         nlmsg_free(msg);
4604                         return -1;
4605                 }
4606         }
4607
4608         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
4609         if (params->bssid) {
4610                 wpa_printf(MSG_DEBUG, "  * bssid=" MACSTR,
4611                            MAC2STR(params->bssid));
4612                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid);
4613         }
4614         if (params->freq) {
4615                 wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq);
4616                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq);
4617         }
4618         if (params->ssid) {
4619                 wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
4620                                   params->ssid, params->ssid_len);
4621                 NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
4622                         params->ssid);
4623         }
4624         wpa_hexdump(MSG_DEBUG, "  * IEs", params->ie, params->ie_len);
4625         if (params->ie)
4626                 NLA_PUT(msg, NL80211_ATTR_IE, params->ie_len, params->ie);
4627         if (params->auth_alg & WPA_AUTH_ALG_OPEN)
4628                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
4629         else if (params->auth_alg & WPA_AUTH_ALG_SHARED)
4630                 type = NL80211_AUTHTYPE_SHARED_KEY;
4631         else if (params->auth_alg & WPA_AUTH_ALG_LEAP)
4632                 type = NL80211_AUTHTYPE_NETWORK_EAP;
4633         else if (params->auth_alg & WPA_AUTH_ALG_FT)
4634                 type = NL80211_AUTHTYPE_FT;
4635         else
4636                 goto nla_put_failure;
4637         wpa_printf(MSG_DEBUG, "  * Auth Type %d", type);
4638         NLA_PUT_U32(msg, NL80211_ATTR_AUTH_TYPE, type);
4639         if (params->local_state_change) {
4640                 wpa_printf(MSG_DEBUG, "  * Local state change only");
4641                 NLA_PUT_FLAG(msg, NL80211_ATTR_LOCAL_STATE_CHANGE);
4642         }
4643
4644         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4645         msg = NULL;
4646         if (ret) {
4647                 wpa_dbg(drv->ctx, MSG_DEBUG,
4648                         "nl80211: MLME command failed (auth): ret=%d (%s)",
4649                         ret, strerror(-ret));
4650                 count++;
4651                 if (ret == -EALREADY && count == 1 && params->bssid &&
4652                     !params->local_state_change) {
4653                         /*
4654                          * mac80211 does not currently accept new
4655                          * authentication if we are already authenticated. As a
4656                          * workaround, force deauthentication and try again.
4657                          */
4658                         wpa_printf(MSG_DEBUG, "nl80211: Retry authentication "
4659                                    "after forced deauthentication");
4660                         wpa_driver_nl80211_deauthenticate(
4661                                 bss, params->bssid,
4662                                 WLAN_REASON_PREV_AUTH_NOT_VALID);
4663                         nlmsg_free(msg);
4664                         goto retry;
4665                 }
4666
4667                 if (ret == -ENOENT && params->freq && !is_retry) {
4668                         /*
4669                          * cfg80211 has likely expired the BSS entry even
4670                          * though it was previously available in our internal
4671                          * BSS table. To recover quickly, start a single
4672                          * channel scan on the specified channel.
4673                          */
4674                         struct wpa_driver_scan_params scan;
4675                         int freqs[2];
4676
4677                         os_memset(&scan, 0, sizeof(scan));
4678                         scan.num_ssids = 1;
4679                         if (params->ssid) {
4680                                 scan.ssids[0].ssid = params->ssid;
4681                                 scan.ssids[0].ssid_len = params->ssid_len;
4682                         }
4683                         freqs[0] = params->freq;
4684                         freqs[1] = 0;
4685                         scan.freqs = freqs;
4686                         wpa_printf(MSG_DEBUG, "nl80211: Trigger single "
4687                                    "channel scan to refresh cfg80211 BSS "
4688                                    "entry");
4689                         ret = wpa_driver_nl80211_scan(bss, &scan);
4690                         if (ret == 0) {
4691                                 nl80211_copy_auth_params(drv, params);
4692                                 drv->scan_for_auth = 1;
4693                         }
4694                 } else if (is_retry) {
4695                         /*
4696                          * Need to indicate this with an event since the return
4697                          * value from the retry is not delivered to core code.
4698                          */
4699                         union wpa_event_data event;
4700                         wpa_printf(MSG_DEBUG, "nl80211: Authentication retry "
4701                                    "failed");
4702                         os_memset(&event, 0, sizeof(event));
4703                         os_memcpy(event.timeout_event.addr, drv->auth_bssid_,
4704                                   ETH_ALEN);
4705                         wpa_supplicant_event(drv->ctx, EVENT_AUTH_TIMED_OUT,
4706                                              &event);
4707                 }
4708
4709                 goto nla_put_failure;
4710         }
4711         ret = 0;
4712         wpa_printf(MSG_DEBUG, "nl80211: Authentication request send "
4713                    "successfully");
4714
4715 nla_put_failure:
4716         nlmsg_free(msg);
4717         return ret;
4718 }
4719
4720
4721 static int wpa_driver_nl80211_authenticate_retry(
4722         struct wpa_driver_nl80211_data *drv)
4723 {
4724         struct wpa_driver_auth_params params;
4725         struct i802_bss *bss = &drv->first_bss;
4726         int i;
4727
4728         wpa_printf(MSG_DEBUG, "nl80211: Try to authenticate again");
4729
4730         os_memset(&params, 0, sizeof(params));
4731         params.freq = drv->auth_freq;
4732         params.auth_alg = drv->auth_alg;
4733         params.wep_tx_keyidx = drv->auth_wep_tx_keyidx;
4734         params.local_state_change = drv->auth_local_state_change;
4735         params.p2p = drv->auth_p2p;
4736
4737         if (!is_zero_ether_addr(drv->auth_bssid_))
4738                 params.bssid = drv->auth_bssid_;
4739
4740         if (drv->auth_ssid_len) {
4741                 params.ssid = drv->auth_ssid;
4742                 params.ssid_len = drv->auth_ssid_len;
4743         }
4744
4745         params.ie = drv->auth_ie;
4746         params.ie_len = drv->auth_ie_len;
4747
4748         for (i = 0; i < 4; i++) {
4749                 if (drv->auth_wep_key_len[i]) {
4750                         params.wep_key[i] = drv->auth_wep_key[i];
4751                         params.wep_key_len[i] = drv->auth_wep_key_len[i];
4752                 }
4753         }
4754
4755         drv->retry_auth = 1;
4756         return wpa_driver_nl80211_authenticate(bss, &params);
4757 }
4758
4759
4760 struct phy_info_arg {
4761         u16 *num_modes;
4762         struct hostapd_hw_modes *modes;
4763 };
4764
4765 static int phy_info_handler(struct nl_msg *msg, void *arg)
4766 {
4767         struct nlattr *tb_msg[NL80211_ATTR_MAX + 1];
4768         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
4769         struct phy_info_arg *phy_info = arg;
4770
4771         struct nlattr *tb_band[NL80211_BAND_ATTR_MAX + 1];
4772
4773         struct nlattr *tb_freq[NL80211_FREQUENCY_ATTR_MAX + 1];
4774         static struct nla_policy freq_policy[NL80211_FREQUENCY_ATTR_MAX + 1] = {
4775                 [NL80211_FREQUENCY_ATTR_FREQ] = { .type = NLA_U32 },
4776                 [NL80211_FREQUENCY_ATTR_DISABLED] = { .type = NLA_FLAG },
4777                 [NL80211_FREQUENCY_ATTR_PASSIVE_SCAN] = { .type = NLA_FLAG },
4778                 [NL80211_FREQUENCY_ATTR_NO_IBSS] = { .type = NLA_FLAG },
4779                 [NL80211_FREQUENCY_ATTR_RADAR] = { .type = NLA_FLAG },
4780                 [NL80211_FREQUENCY_ATTR_MAX_TX_POWER] = { .type = NLA_U32 },
4781         };
4782
4783         struct nlattr *tb_rate[NL80211_BITRATE_ATTR_MAX + 1];
4784         static struct nla_policy rate_policy[NL80211_BITRATE_ATTR_MAX + 1] = {
4785                 [NL80211_BITRATE_ATTR_RATE] = { .type = NLA_U32 },
4786                 [NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE] = { .type = NLA_FLAG },
4787         };
4788
4789         struct nlattr *nl_band;
4790         struct nlattr *nl_freq;
4791         struct nlattr *nl_rate;
4792         int rem_band, rem_freq, rem_rate;
4793         struct hostapd_hw_modes *mode;
4794         int idx, mode_is_set;
4795
4796         nla_parse(tb_msg, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
4797                   genlmsg_attrlen(gnlh, 0), NULL);
4798
4799         if (!tb_msg[NL80211_ATTR_WIPHY_BANDS])
4800                 return NL_SKIP;
4801
4802         nla_for_each_nested(nl_band, tb_msg[NL80211_ATTR_WIPHY_BANDS], rem_band) {
4803                 mode = os_realloc_array(phy_info->modes,
4804                                         *phy_info->num_modes + 1,
4805                                         sizeof(*mode));
4806                 if (!mode)
4807                         return NL_SKIP;
4808                 phy_info->modes = mode;
4809
4810                 mode_is_set = 0;
4811
4812                 mode = &phy_info->modes[*(phy_info->num_modes)];
4813                 memset(mode, 0, sizeof(*mode));
4814                 mode->flags = HOSTAPD_MODE_FLAG_HT_INFO_KNOWN;
4815                 *(phy_info->num_modes) += 1;
4816
4817                 nla_parse(tb_band, NL80211_BAND_ATTR_MAX, nla_data(nl_band),
4818                           nla_len(nl_band), NULL);
4819
4820                 if (tb_band[NL80211_BAND_ATTR_HT_CAPA]) {
4821                         mode->ht_capab = nla_get_u16(
4822                                 tb_band[NL80211_BAND_ATTR_HT_CAPA]);
4823                 }
4824
4825                 if (tb_band[NL80211_BAND_ATTR_HT_AMPDU_FACTOR]) {
4826                         mode->a_mpdu_params |= nla_get_u8(
4827                                 tb_band[NL80211_BAND_ATTR_HT_AMPDU_FACTOR]) &
4828                                 0x03;
4829                 }
4830
4831                 if (tb_band[NL80211_BAND_ATTR_HT_AMPDU_DENSITY]) {
4832                         mode->a_mpdu_params |= nla_get_u8(
4833                                 tb_band[NL80211_BAND_ATTR_HT_AMPDU_DENSITY]) <<
4834                                 2;
4835                 }
4836
4837                 if (tb_band[NL80211_BAND_ATTR_HT_MCS_SET] &&
4838                     nla_len(tb_band[NL80211_BAND_ATTR_HT_MCS_SET])) {
4839                         u8 *mcs;
4840                         mcs = nla_data(tb_band[NL80211_BAND_ATTR_HT_MCS_SET]);
4841                         os_memcpy(mode->mcs_set, mcs, 16);
4842                 }
4843
4844                 if (tb_band[NL80211_BAND_ATTR_VHT_CAPA]) {
4845                         mode->vht_capab = nla_get_u32(
4846                                 tb_band[NL80211_BAND_ATTR_VHT_CAPA]);
4847                 }
4848
4849                 if (tb_band[NL80211_BAND_ATTR_VHT_MCS_SET] &&
4850                     nla_len(tb_band[NL80211_BAND_ATTR_VHT_MCS_SET])) {
4851                         u8 *mcs;
4852                         mcs = nla_data(tb_band[NL80211_BAND_ATTR_VHT_MCS_SET]);
4853                         os_memcpy(mode->vht_mcs_set, mcs, 8);
4854                 }
4855
4856                 nla_for_each_nested(nl_freq, tb_band[NL80211_BAND_ATTR_FREQS], rem_freq) {
4857                         nla_parse(tb_freq, NL80211_FREQUENCY_ATTR_MAX, nla_data(nl_freq),
4858                                   nla_len(nl_freq), freq_policy);
4859                         if (!tb_freq[NL80211_FREQUENCY_ATTR_FREQ])
4860                                 continue;
4861                         mode->num_channels++;
4862                 }
4863
4864                 mode->channels = os_calloc(mode->num_channels,
4865                                            sizeof(struct hostapd_channel_data));
4866                 if (!mode->channels)
4867                         return NL_SKIP;
4868
4869                 idx = 0;
4870
4871                 nla_for_each_nested(nl_freq, tb_band[NL80211_BAND_ATTR_FREQS], rem_freq) {
4872                         nla_parse(tb_freq, NL80211_FREQUENCY_ATTR_MAX, nla_data(nl_freq),
4873                                   nla_len(nl_freq), freq_policy);
4874                         if (!tb_freq[NL80211_FREQUENCY_ATTR_FREQ])
4875                                 continue;
4876
4877                         mode->channels[idx].freq = nla_get_u32(tb_freq[NL80211_FREQUENCY_ATTR_FREQ]);
4878                         mode->channels[idx].flag = 0;
4879
4880                         if (!mode_is_set) {
4881                                 /* crude heuristic */
4882                                 if (mode->channels[idx].freq < 4000)
4883                                         mode->mode = HOSTAPD_MODE_IEEE80211B;
4884                                 else
4885                                         mode->mode = HOSTAPD_MODE_IEEE80211A;
4886                                 mode_is_set = 1;
4887                         }
4888
4889                         /* crude heuristic */
4890                         if (mode->channels[idx].freq < 4000)
4891                                 if (mode->channels[idx].freq == 2484)
4892                                         mode->channels[idx].chan = 14;
4893                                 else
4894                                         mode->channels[idx].chan = (mode->channels[idx].freq - 2407) / 5;
4895                         else
4896                                 mode->channels[idx].chan = mode->channels[idx].freq/5 - 1000;
4897
4898                         if (tb_freq[NL80211_FREQUENCY_ATTR_DISABLED])
4899                                 mode->channels[idx].flag |=
4900                                         HOSTAPD_CHAN_DISABLED;
4901                         if (tb_freq[NL80211_FREQUENCY_ATTR_PASSIVE_SCAN])
4902                                 mode->channels[idx].flag |=
4903                                         HOSTAPD_CHAN_PASSIVE_SCAN;
4904                         if (tb_freq[NL80211_FREQUENCY_ATTR_NO_IBSS])
4905                                 mode->channels[idx].flag |=
4906                                         HOSTAPD_CHAN_NO_IBSS;
4907                         if (tb_freq[NL80211_FREQUENCY_ATTR_RADAR])
4908                                 mode->channels[idx].flag |=
4909                                         HOSTAPD_CHAN_RADAR;
4910
4911                         if (tb_freq[NL80211_FREQUENCY_ATTR_MAX_TX_POWER] &&
4912                             !tb_freq[NL80211_FREQUENCY_ATTR_DISABLED])
4913                                 mode->channels[idx].max_tx_power =
4914                                         nla_get_u32(tb_freq[NL80211_FREQUENCY_ATTR_MAX_TX_POWER]) / 100;
4915
4916                         idx++;
4917                 }
4918
4919                 nla_for_each_nested(nl_rate, tb_band[NL80211_BAND_ATTR_RATES], rem_rate) {
4920                         nla_parse(tb_rate, NL80211_BITRATE_ATTR_MAX, nla_data(nl_rate),
4921                                   nla_len(nl_rate), rate_policy);
4922                         if (!tb_rate[NL80211_BITRATE_ATTR_RATE])
4923                                 continue;
4924                         mode->num_rates++;
4925                 }
4926
4927                 mode->rates = os_calloc(mode->num_rates, sizeof(int));
4928                 if (!mode->rates)
4929                         return NL_SKIP;
4930
4931                 idx = 0;
4932
4933                 nla_for_each_nested(nl_rate, tb_band[NL80211_BAND_ATTR_RATES], rem_rate) {
4934                         nla_parse(tb_rate, NL80211_BITRATE_ATTR_MAX, nla_data(nl_rate),
4935                                   nla_len(nl_rate), rate_policy);
4936                         if (!tb_rate[NL80211_BITRATE_ATTR_RATE])
4937                                 continue;
4938                         mode->rates[idx] = nla_get_u32(tb_rate[NL80211_BITRATE_ATTR_RATE]);
4939
4940                         /* crude heuristic */
4941                         if (mode->mode == HOSTAPD_MODE_IEEE80211B &&
4942                             mode->rates[idx] > 200)
4943                                 mode->mode = HOSTAPD_MODE_IEEE80211G;
4944
4945                         idx++;
4946                 }
4947         }
4948
4949         return NL_SKIP;
4950 }
4951
4952 static struct hostapd_hw_modes *
4953 wpa_driver_nl80211_add_11b(struct hostapd_hw_modes *modes, u16 *num_modes)
4954 {
4955         u16 m;
4956         struct hostapd_hw_modes *mode11g = NULL, *nmodes, *mode;
4957         int i, mode11g_idx = -1;
4958
4959         /* If only 802.11g mode is included, use it to construct matching
4960          * 802.11b mode data. */
4961
4962         for (m = 0; m < *num_modes; m++) {
4963                 if (modes[m].mode == HOSTAPD_MODE_IEEE80211B)
4964                         return modes; /* 802.11b already included */
4965                 if (modes[m].mode == HOSTAPD_MODE_IEEE80211G)
4966                         mode11g_idx = m;
4967         }
4968
4969         if (mode11g_idx < 0)
4970                 return modes; /* 2.4 GHz band not supported at all */
4971
4972         nmodes = os_realloc_array(modes, *num_modes + 1, sizeof(*nmodes));
4973         if (nmodes == NULL)
4974                 return modes; /* Could not add 802.11b mode */
4975
4976         mode = &nmodes[*num_modes];
4977         os_memset(mode, 0, sizeof(*mode));
4978         (*num_modes)++;
4979         modes = nmodes;
4980
4981         mode->mode = HOSTAPD_MODE_IEEE80211B;
4982
4983         mode11g = &modes[mode11g_idx];
4984         mode->num_channels = mode11g->num_channels;
4985         mode->channels = os_malloc(mode11g->num_channels *
4986                                    sizeof(struct hostapd_channel_data));
4987         if (mode->channels == NULL) {
4988                 (*num_modes)--;
4989                 return modes; /* Could not add 802.11b mode */
4990         }
4991         os_memcpy(mode->channels, mode11g->channels,
4992                   mode11g->num_channels * sizeof(struct hostapd_channel_data));
4993
4994         mode->num_rates = 0;
4995         mode->rates = os_malloc(4 * sizeof(int));
4996         if (mode->rates == NULL) {
4997                 os_free(mode->channels);
4998                 (*num_modes)--;
4999                 return modes; /* Could not add 802.11b mode */
5000         }
5001
5002         for (i = 0; i < mode11g->num_rates; i++) {
5003                 if (mode11g->rates[i] != 10 && mode11g->rates[i] != 20 &&
5004                     mode11g->rates[i] != 55 && mode11g->rates[i] != 110)
5005                         continue;
5006                 mode->rates[mode->num_rates] = mode11g->rates[i];
5007                 mode->num_rates++;
5008                 if (mode->num_rates == 4)
5009                         break;
5010         }
5011
5012         if (mode->num_rates == 0) {
5013                 os_free(mode->channels);
5014                 os_free(mode->rates);
5015                 (*num_modes)--;
5016                 return modes; /* No 802.11b rates */
5017         }
5018
5019         wpa_printf(MSG_DEBUG, "nl80211: Added 802.11b mode based on 802.11g "
5020                    "information");
5021
5022         return modes;
5023 }
5024
5025
5026 static void nl80211_set_ht40_mode(struct hostapd_hw_modes *mode, int start,
5027                                   int end)
5028 {
5029         int c;
5030
5031         for (c = 0; c < mode->num_channels; c++) {
5032                 struct hostapd_channel_data *chan = &mode->channels[c];
5033                 if (chan->freq - 10 >= start && chan->freq + 10 <= end)
5034                         chan->flag |= HOSTAPD_CHAN_HT40;
5035         }
5036 }
5037
5038
5039 static void nl80211_set_ht40_mode_sec(struct hostapd_hw_modes *mode, int start,
5040                                       int end)
5041 {
5042         int c;
5043
5044         for (c = 0; c < mode->num_channels; c++) {
5045                 struct hostapd_channel_data *chan = &mode->channels[c];
5046                 if (!(chan->flag & HOSTAPD_CHAN_HT40))
5047                         continue;
5048                 if (chan->freq - 30 >= start && chan->freq - 10 <= end)
5049                         chan->flag |= HOSTAPD_CHAN_HT40MINUS;
5050                 if (chan->freq + 10 >= start && chan->freq + 30 <= end)
5051                         chan->flag |= HOSTAPD_CHAN_HT40PLUS;
5052         }
5053 }
5054
5055
5056 static void nl80211_reg_rule_ht40(struct nlattr *tb[],
5057                                   struct phy_info_arg *results)
5058 {
5059         u32 start, end, max_bw;
5060         u16 m;
5061
5062         if (tb[NL80211_ATTR_FREQ_RANGE_START] == NULL ||
5063             tb[NL80211_ATTR_FREQ_RANGE_END] == NULL ||
5064             tb[NL80211_ATTR_FREQ_RANGE_MAX_BW] == NULL)
5065                 return;
5066
5067         start = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]) / 1000;
5068         end = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]) / 1000;
5069         max_bw = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]) / 1000;
5070
5071         wpa_printf(MSG_DEBUG, "nl80211: %u-%u @ %u MHz",
5072                    start, end, max_bw);
5073         if (max_bw < 40)
5074                 return;
5075
5076         for (m = 0; m < *results->num_modes; m++) {
5077                 if (!(results->modes[m].ht_capab &
5078                       HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET))
5079                         continue;
5080                 nl80211_set_ht40_mode(&results->modes[m], start, end);
5081         }
5082 }
5083
5084
5085 static void nl80211_reg_rule_sec(struct nlattr *tb[],
5086                                  struct phy_info_arg *results)
5087 {
5088         u32 start, end, max_bw;
5089         u16 m;
5090
5091         if (tb[NL80211_ATTR_FREQ_RANGE_START] == NULL ||
5092             tb[NL80211_ATTR_FREQ_RANGE_END] == NULL ||
5093             tb[NL80211_ATTR_FREQ_RANGE_MAX_BW] == NULL)
5094                 return;
5095
5096         start = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]) / 1000;
5097         end = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]) / 1000;
5098         max_bw = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]) / 1000;
5099
5100         if (max_bw < 20)
5101                 return;
5102
5103         for (m = 0; m < *results->num_modes; m++) {
5104                 if (!(results->modes[m].ht_capab &
5105                       HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET))
5106                         continue;
5107                 nl80211_set_ht40_mode_sec(&results->modes[m], start, end);
5108         }
5109 }
5110
5111
5112 static int nl80211_get_reg(struct nl_msg *msg, void *arg)
5113 {
5114         struct phy_info_arg *results = arg;
5115         struct nlattr *tb_msg[NL80211_ATTR_MAX + 1];
5116         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
5117         struct nlattr *nl_rule;
5118         struct nlattr *tb_rule[NL80211_FREQUENCY_ATTR_MAX + 1];
5119         int rem_rule;
5120         static struct nla_policy reg_policy[NL80211_FREQUENCY_ATTR_MAX + 1] = {
5121                 [NL80211_ATTR_REG_RULE_FLAGS] = { .type = NLA_U32 },
5122                 [NL80211_ATTR_FREQ_RANGE_START] = { .type = NLA_U32 },
5123                 [NL80211_ATTR_FREQ_RANGE_END] = { .type = NLA_U32 },
5124                 [NL80211_ATTR_FREQ_RANGE_MAX_BW] = { .type = NLA_U32 },
5125                 [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN] = { .type = NLA_U32 },
5126                 [NL80211_ATTR_POWER_RULE_MAX_EIRP] = { .type = NLA_U32 },
5127         };
5128
5129         nla_parse(tb_msg, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
5130                   genlmsg_attrlen(gnlh, 0), NULL);
5131         if (!tb_msg[NL80211_ATTR_REG_ALPHA2] ||
5132             !tb_msg[NL80211_ATTR_REG_RULES]) {
5133                 wpa_printf(MSG_DEBUG, "nl80211: No regulatory information "
5134                            "available");
5135                 return NL_SKIP;
5136         }
5137
5138         wpa_printf(MSG_DEBUG, "nl80211: Regulatory information - country=%s",
5139                    (char *) nla_data(tb_msg[NL80211_ATTR_REG_ALPHA2]));
5140
5141         nla_for_each_nested(nl_rule, tb_msg[NL80211_ATTR_REG_RULES], rem_rule)
5142         {
5143                 nla_parse(tb_rule, NL80211_FREQUENCY_ATTR_MAX,
5144                           nla_data(nl_rule), nla_len(nl_rule), reg_policy);
5145                 nl80211_reg_rule_ht40(tb_rule, results);
5146         }
5147
5148         nla_for_each_nested(nl_rule, tb_msg[NL80211_ATTR_REG_RULES], rem_rule)
5149         {
5150                 nla_parse(tb_rule, NL80211_FREQUENCY_ATTR_MAX,
5151                           nla_data(nl_rule), nla_len(nl_rule), reg_policy);
5152                 nl80211_reg_rule_sec(tb_rule, results);
5153         }
5154
5155         return NL_SKIP;
5156 }
5157
5158
5159 static int nl80211_set_ht40_flags(struct wpa_driver_nl80211_data *drv,
5160                                   struct phy_info_arg *results)
5161 {
5162         struct nl_msg *msg;
5163
5164         msg = nlmsg_alloc();
5165         if (!msg)
5166                 return -ENOMEM;
5167
5168         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_REG);
5169         return send_and_recv_msgs(drv, msg, nl80211_get_reg, results);
5170 }
5171
5172
5173 static struct hostapd_hw_modes *
5174 wpa_driver_nl80211_get_hw_feature_data(void *priv, u16 *num_modes, u16 *flags)
5175 {
5176         struct i802_bss *bss = priv;
5177         struct wpa_driver_nl80211_data *drv = bss->drv;
5178         struct nl_msg *msg;
5179         struct phy_info_arg result = {
5180                 .num_modes = num_modes,
5181                 .modes = NULL,
5182         };
5183
5184         *num_modes = 0;
5185         *flags = 0;
5186
5187         msg = nlmsg_alloc();
5188         if (!msg)
5189                 return NULL;
5190
5191         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_WIPHY);
5192
5193         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
5194
5195         if (send_and_recv_msgs(drv, msg, phy_info_handler, &result) == 0) {
5196                 nl80211_set_ht40_flags(drv, &result);
5197                 return wpa_driver_nl80211_add_11b(result.modes, num_modes);
5198         }
5199         msg = NULL;
5200  nla_put_failure:
5201         nlmsg_free(msg);
5202         return NULL;
5203 }
5204
5205
5206 static int wpa_driver_nl80211_send_mntr(struct wpa_driver_nl80211_data *drv,
5207                                         const void *data, size_t len,
5208                                         int encrypt, int noack)
5209 {
5210         __u8 rtap_hdr[] = {
5211                 0x00, 0x00, /* radiotap version */
5212                 0x0e, 0x00, /* radiotap length */
5213                 0x02, 0xc0, 0x00, 0x00, /* bmap: flags, tx and rx flags */
5214                 IEEE80211_RADIOTAP_F_FRAG, /* F_FRAG (fragment if required) */
5215                 0x00,       /* padding */
5216                 0x00, 0x00, /* RX and TX flags to indicate that */
5217                 0x00, 0x00, /* this is the injected frame directly */
5218         };
5219         struct iovec iov[2] = {
5220                 {
5221                         .iov_base = &rtap_hdr,
5222                         .iov_len = sizeof(rtap_hdr),
5223                 },
5224                 {
5225                         .iov_base = (void *) data,
5226                         .iov_len = len,
5227                 }
5228         };
5229         struct msghdr msg = {
5230                 .msg_name = NULL,
5231                 .msg_namelen = 0,
5232                 .msg_iov = iov,
5233                 .msg_iovlen = 2,
5234                 .msg_control = NULL,
5235                 .msg_controllen = 0,
5236                 .msg_flags = 0,
5237         };
5238         int res;
5239         u16 txflags = 0;
5240
5241         if (encrypt)
5242                 rtap_hdr[8] |= IEEE80211_RADIOTAP_F_WEP;
5243
5244         if (drv->monitor_sock < 0) {
5245                 wpa_printf(MSG_DEBUG, "nl80211: No monitor socket available "
5246                            "for %s", __func__);
5247                 return -1;
5248         }
5249
5250         if (noack)
5251                 txflags |= IEEE80211_RADIOTAP_F_TX_NOACK;
5252         *(le16 *) &rtap_hdr[12] = host_to_le16(txflags);
5253
5254         res = sendmsg(drv->monitor_sock, &msg, 0);
5255         if (res < 0) {
5256                 wpa_printf(MSG_INFO, "nl80211: sendmsg: %s", strerror(errno));
5257                 return -1;
5258         }
5259         return 0;
5260 }
5261
5262
5263 static int wpa_driver_nl80211_send_frame(struct i802_bss *bss,
5264                                          const void *data, size_t len,
5265                                          int encrypt, int noack,
5266                                          unsigned int freq, int no_cck,
5267                                          int offchanok, unsigned int wait_time)
5268 {
5269         struct wpa_driver_nl80211_data *drv = bss->drv;
5270         u64 cookie;
5271
5272         if (freq == 0)
5273                 freq = bss->freq;
5274
5275         if (drv->use_monitor)
5276                 return wpa_driver_nl80211_send_mntr(drv, data, len,
5277                                                     encrypt, noack);
5278
5279         return nl80211_send_frame_cmd(bss, freq, wait_time, data, len,
5280                                       &cookie, no_cck, noack, offchanok);
5281 }
5282
5283
5284 static int wpa_driver_nl80211_send_mlme_freq(struct i802_bss *bss,
5285                                              const u8 *data,
5286                                              size_t data_len, int noack,
5287                                              unsigned int freq, int no_cck,
5288                                              int offchanok,
5289                                              unsigned int wait_time)
5290 {
5291         struct wpa_driver_nl80211_data *drv = bss->drv;
5292         struct ieee80211_mgmt *mgmt;
5293         int encrypt = 1;
5294         u16 fc;
5295
5296         mgmt = (struct ieee80211_mgmt *) data;
5297         fc = le_to_host16(mgmt->frame_control);
5298
5299         if (is_sta_interface(drv->nlmode) &&
5300             WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
5301             WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_PROBE_RESP) {
5302                 /*
5303                  * The use of last_mgmt_freq is a bit of a hack,
5304                  * but it works due to the single-threaded nature
5305                  * of wpa_supplicant.
5306                  */
5307                 if (freq == 0)
5308                         freq = drv->last_mgmt_freq;
5309                 return nl80211_send_frame_cmd(bss, freq, 0,
5310                                               data, data_len, NULL, 1, noack,
5311                                               1);
5312         }
5313
5314         if (drv->device_ap_sme && is_ap_interface(drv->nlmode)) {
5315                 if (freq == 0)
5316                         freq = bss->freq;
5317                 return nl80211_send_frame_cmd(bss, freq,
5318                                               (int) freq == bss->freq ? 0 :
5319                                               wait_time,
5320                                               data, data_len,
5321                                               &drv->send_action_cookie,
5322                                               no_cck, noack, offchanok);
5323         }
5324
5325         if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
5326             WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_AUTH) {
5327                 /*
5328                  * Only one of the authentication frame types is encrypted.
5329                  * In order for static WEP encryption to work properly (i.e.,
5330                  * to not encrypt the frame), we need to tell mac80211 about
5331                  * the frames that must not be encrypted.
5332                  */
5333                 u16 auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
5334                 u16 auth_trans = le_to_host16(mgmt->u.auth.auth_transaction);
5335                 if (auth_alg != WLAN_AUTH_SHARED_KEY || auth_trans != 3)
5336                         encrypt = 0;
5337         }
5338
5339         return wpa_driver_nl80211_send_frame(bss, data, data_len, encrypt,
5340                                              noack, freq, no_cck, offchanok,
5341                                              wait_time);
5342 }
5343
5344
5345 static int wpa_driver_nl80211_send_mlme(void *priv, const u8 *data,
5346                                         size_t data_len, int noack)
5347 {
5348         struct i802_bss *bss = priv;
5349         return wpa_driver_nl80211_send_mlme_freq(bss, data, data_len, noack,
5350                                                  0, 0, 0, 0);
5351 }
5352
5353
5354 static int nl80211_set_bss(struct i802_bss *bss, int cts, int preamble,
5355                            int slot, int ht_opmode, int ap_isolate,
5356                            int *basic_rates)
5357 {
5358         struct wpa_driver_nl80211_data *drv = bss->drv;
5359         struct nl_msg *msg;
5360
5361         msg = nlmsg_alloc();
5362         if (!msg)
5363                 return -ENOMEM;
5364
5365         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_BSS);
5366
5367         if (cts >= 0)
5368                 NLA_PUT_U8(msg, NL80211_ATTR_BSS_CTS_PROT, cts);
5369         if (preamble >= 0)
5370                 NLA_PUT_U8(msg, NL80211_ATTR_BSS_SHORT_PREAMBLE, preamble);
5371         if (slot >= 0)
5372                 NLA_PUT_U8(msg, NL80211_ATTR_BSS_SHORT_SLOT_TIME, slot);
5373         if (ht_opmode >= 0)
5374                 NLA_PUT_U16(msg, NL80211_ATTR_BSS_HT_OPMODE, ht_opmode);
5375         if (ap_isolate >= 0)
5376                 NLA_PUT_U8(msg, NL80211_ATTR_AP_ISOLATE, ap_isolate);
5377
5378         if (basic_rates) {
5379                 u8 rates[NL80211_MAX_SUPP_RATES];
5380                 u8 rates_len = 0;
5381                 int i;
5382
5383                 for (i = 0; i < NL80211_MAX_SUPP_RATES && basic_rates[i] >= 0;
5384                      i++)
5385                         rates[rates_len++] = basic_rates[i] / 5;
5386
5387                 NLA_PUT(msg, NL80211_ATTR_BSS_BASIC_RATES, rates_len, rates);
5388         }
5389
5390         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
5391
5392         return send_and_recv_msgs(drv, msg, NULL, NULL);
5393  nla_put_failure:
5394         nlmsg_free(msg);
5395         return -ENOBUFS;
5396 }
5397
5398
5399 static int wpa_driver_nl80211_set_ap(void *priv,
5400                                      struct wpa_driver_ap_params *params)
5401 {
5402         struct i802_bss *bss = priv;
5403         struct wpa_driver_nl80211_data *drv = bss->drv;
5404         struct nl_msg *msg;
5405         u8 cmd = NL80211_CMD_NEW_BEACON;
5406         int ret;
5407         int beacon_set;
5408         int ifindex = if_nametoindex(bss->ifname);
5409         int num_suites;
5410         u32 suites[10];
5411         u32 ver;
5412
5413         beacon_set = bss->beacon_set;
5414
5415         msg = nlmsg_alloc();
5416         if (!msg)
5417                 return -ENOMEM;
5418
5419         wpa_printf(MSG_DEBUG, "nl80211: Set beacon (beacon_set=%d)",
5420                    beacon_set);
5421         if (beacon_set)
5422                 cmd = NL80211_CMD_SET_BEACON;
5423
5424         nl80211_cmd(drv, msg, 0, cmd);
5425         NLA_PUT(msg, NL80211_ATTR_BEACON_HEAD, params->head_len, params->head);
5426         NLA_PUT(msg, NL80211_ATTR_BEACON_TAIL, params->tail_len, params->tail);
5427         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
5428         NLA_PUT_U32(msg, NL80211_ATTR_BEACON_INTERVAL, params->beacon_int);
5429         NLA_PUT_U32(msg, NL80211_ATTR_DTIM_PERIOD, params->dtim_period);
5430         NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
5431                 params->ssid);
5432         if (params->proberesp && params->proberesp_len)
5433                 NLA_PUT(msg, NL80211_ATTR_PROBE_RESP, params->proberesp_len,
5434                         params->proberesp);
5435         switch (params->hide_ssid) {
5436         case NO_SSID_HIDING:
5437                 NLA_PUT_U32(msg, NL80211_ATTR_HIDDEN_SSID,
5438                             NL80211_HIDDEN_SSID_NOT_IN_USE);
5439                 break;
5440         case HIDDEN_SSID_ZERO_LEN:
5441                 NLA_PUT_U32(msg, NL80211_ATTR_HIDDEN_SSID,
5442                             NL80211_HIDDEN_SSID_ZERO_LEN);
5443                 break;
5444         case HIDDEN_SSID_ZERO_CONTENTS:
5445                 NLA_PUT_U32(msg, NL80211_ATTR_HIDDEN_SSID,
5446                             NL80211_HIDDEN_SSID_ZERO_CONTENTS);
5447                 break;
5448         }
5449         if (params->privacy)
5450                 NLA_PUT_FLAG(msg, NL80211_ATTR_PRIVACY);
5451         if ((params->auth_algs & (WPA_AUTH_ALG_OPEN | WPA_AUTH_ALG_SHARED)) ==
5452             (WPA_AUTH_ALG_OPEN | WPA_AUTH_ALG_SHARED)) {
5453                 /* Leave out the attribute */
5454         } else if (params->auth_algs & WPA_AUTH_ALG_SHARED)
5455                 NLA_PUT_U32(msg, NL80211_ATTR_AUTH_TYPE,
5456                             NL80211_AUTHTYPE_SHARED_KEY);
5457         else
5458                 NLA_PUT_U32(msg, NL80211_ATTR_AUTH_TYPE,
5459                             NL80211_AUTHTYPE_OPEN_SYSTEM);
5460
5461         ver = 0;
5462         if (params->wpa_version & WPA_PROTO_WPA)
5463                 ver |= NL80211_WPA_VERSION_1;
5464         if (params->wpa_version & WPA_PROTO_RSN)
5465                 ver |= NL80211_WPA_VERSION_2;
5466         if (ver)
5467                 NLA_PUT_U32(msg, NL80211_ATTR_WPA_VERSIONS, ver);
5468
5469         num_suites = 0;
5470         if (params->key_mgmt_suites & WPA_KEY_MGMT_IEEE8021X)
5471                 suites[num_suites++] = WLAN_AKM_SUITE_8021X;
5472         if (params->key_mgmt_suites & WPA_KEY_MGMT_PSK)
5473                 suites[num_suites++] = WLAN_AKM_SUITE_PSK;
5474         if (num_suites) {
5475                 NLA_PUT(msg, NL80211_ATTR_AKM_SUITES,
5476                         num_suites * sizeof(u32), suites);
5477         }
5478
5479         if (params->key_mgmt_suites & WPA_KEY_MGMT_IEEE8021X &&
5480             params->pairwise_ciphers & (WPA_CIPHER_WEP104 | WPA_CIPHER_WEP40))
5481                 NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT);
5482
5483         num_suites = 0;
5484         if (params->pairwise_ciphers & WPA_CIPHER_CCMP)
5485                 suites[num_suites++] = WLAN_CIPHER_SUITE_CCMP;
5486         if (params->pairwise_ciphers & WPA_CIPHER_GCMP)
5487                 suites[num_suites++] = WLAN_CIPHER_SUITE_GCMP;
5488         if (params->pairwise_ciphers & WPA_CIPHER_TKIP)
5489                 suites[num_suites++] = WLAN_CIPHER_SUITE_TKIP;
5490         if (params->pairwise_ciphers & WPA_CIPHER_WEP104)
5491                 suites[num_suites++] = WLAN_CIPHER_SUITE_WEP104;
5492         if (params->pairwise_ciphers & WPA_CIPHER_WEP40)
5493                 suites[num_suites++] = WLAN_CIPHER_SUITE_WEP40;
5494         if (num_suites) {
5495                 NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES_PAIRWISE,
5496                         num_suites * sizeof(u32), suites);
5497         }
5498
5499         switch (params->group_cipher) {
5500         case WPA_CIPHER_CCMP:
5501                 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP,
5502                             WLAN_CIPHER_SUITE_CCMP);
5503                 break;
5504         case WPA_CIPHER_GCMP:
5505                 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP,
5506                             WLAN_CIPHER_SUITE_GCMP);
5507                 break;
5508         case WPA_CIPHER_TKIP:
5509                 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP,
5510                             WLAN_CIPHER_SUITE_TKIP);
5511                 break;
5512         case WPA_CIPHER_WEP104:
5513                 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP,
5514                             WLAN_CIPHER_SUITE_WEP104);
5515                 break;
5516         case WPA_CIPHER_WEP40:
5517                 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP,
5518                             WLAN_CIPHER_SUITE_WEP40);
5519                 break;
5520         }
5521
5522         if (params->beacon_ies) {
5523                 NLA_PUT(msg, NL80211_ATTR_IE, wpabuf_len(params->beacon_ies),
5524                         wpabuf_head(params->beacon_ies));
5525         }
5526         if (params->proberesp_ies) {
5527                 NLA_PUT(msg, NL80211_ATTR_IE_PROBE_RESP,
5528                         wpabuf_len(params->proberesp_ies),
5529                         wpabuf_head(params->proberesp_ies));
5530         }
5531         if (params->assocresp_ies) {
5532                 NLA_PUT(msg, NL80211_ATTR_IE_ASSOC_RESP,
5533                         wpabuf_len(params->assocresp_ies),
5534                         wpabuf_head(params->assocresp_ies));
5535         }
5536
5537         if (drv->capa.flags & WPA_DRIVER_FLAGS_INACTIVITY_TIMER)  {
5538                 NLA_PUT_U16(msg, NL80211_ATTR_INACTIVITY_TIMEOUT,
5539                             params->ap_max_inactivity);
5540         }
5541
5542         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5543         if (ret) {
5544                 wpa_printf(MSG_DEBUG, "nl80211: Beacon set failed: %d (%s)",
5545                            ret, strerror(-ret));
5546         } else {
5547                 bss->beacon_set = 1;
5548                 nl80211_set_bss(bss, params->cts_protect, params->preamble,
5549                                 params->short_slot_time, params->ht_opmode,
5550                                 params->isolate, params->basic_rates);
5551         }
5552         return ret;
5553  nla_put_failure:
5554         nlmsg_free(msg);
5555         return -ENOBUFS;
5556 }
5557
5558
5559 static int wpa_driver_nl80211_set_freq(struct i802_bss *bss,
5560                                        int freq, int ht_enabled,
5561                                        int sec_channel_offset)
5562 {
5563         struct wpa_driver_nl80211_data *drv = bss->drv;
5564         struct nl_msg *msg;
5565         int ret;
5566
5567         wpa_printf(MSG_DEBUG, "nl80211: Set freq %d (ht_enabled=%d "
5568                    "sec_channel_offset=%d)",
5569                    freq, ht_enabled, sec_channel_offset);
5570         msg = nlmsg_alloc();
5571         if (!msg)
5572                 return -1;
5573
5574         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_WIPHY);
5575
5576         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
5577         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
5578         if (ht_enabled) {
5579                 switch (sec_channel_offset) {
5580                 case -1:
5581                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
5582                                     NL80211_CHAN_HT40MINUS);
5583                         break;
5584                 case 1:
5585                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
5586                                     NL80211_CHAN_HT40PLUS);
5587                         break;
5588                 default:
5589                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
5590                                     NL80211_CHAN_HT20);
5591                         break;
5592                 }
5593         }
5594
5595         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5596         msg = NULL;
5597         if (ret == 0) {
5598                 bss->freq = freq;
5599                 return 0;
5600         }
5601         wpa_printf(MSG_DEBUG, "nl80211: Failed to set channel (freq=%d): "
5602                    "%d (%s)", freq, ret, strerror(-ret));
5603 nla_put_failure:
5604         nlmsg_free(msg);
5605         return -1;
5606 }
5607
5608
5609 static u32 sta_flags_nl80211(int flags)
5610 {
5611         u32 f = 0;
5612
5613         if (flags & WPA_STA_AUTHORIZED)
5614                 f |= BIT(NL80211_STA_FLAG_AUTHORIZED);
5615         if (flags & WPA_STA_WMM)
5616                 f |= BIT(NL80211_STA_FLAG_WME);
5617         if (flags & WPA_STA_SHORT_PREAMBLE)
5618                 f |= BIT(NL80211_STA_FLAG_SHORT_PREAMBLE);
5619         if (flags & WPA_STA_MFP)
5620                 f |= BIT(NL80211_STA_FLAG_MFP);
5621         if (flags & WPA_STA_TDLS_PEER)
5622                 f |= BIT(NL80211_STA_FLAG_TDLS_PEER);
5623
5624         return f;
5625 }
5626
5627
5628 static int wpa_driver_nl80211_sta_add(void *priv,
5629                                       struct hostapd_sta_add_params *params)
5630 {
5631         struct i802_bss *bss = priv;
5632         struct wpa_driver_nl80211_data *drv = bss->drv;
5633         struct nl_msg *msg, *wme = NULL;
5634         struct nl80211_sta_flag_update upd;
5635         int ret = -ENOBUFS;
5636
5637         if ((params->flags & WPA_STA_TDLS_PEER) &&
5638             !(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT))
5639                 return -EOPNOTSUPP;
5640
5641         msg = nlmsg_alloc();
5642         if (!msg)
5643                 return -ENOMEM;
5644
5645         nl80211_cmd(drv, msg, 0, params->set ? NL80211_CMD_SET_STATION :
5646                     NL80211_CMD_NEW_STATION);
5647
5648         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
5649         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->addr);
5650         NLA_PUT(msg, NL80211_ATTR_STA_SUPPORTED_RATES, params->supp_rates_len,
5651                 params->supp_rates);
5652         if (!params->set) {
5653                 NLA_PUT_U16(msg, NL80211_ATTR_STA_AID, params->aid);
5654                 NLA_PUT_U16(msg, NL80211_ATTR_STA_LISTEN_INTERVAL,
5655                             params->listen_interval);
5656         }
5657         if (params->ht_capabilities) {
5658                 NLA_PUT(msg, NL80211_ATTR_HT_CAPABILITY,
5659                         sizeof(*params->ht_capabilities),
5660                         params->ht_capabilities);
5661         }
5662
5663         os_memset(&upd, 0, sizeof(upd));
5664         upd.mask = sta_flags_nl80211(params->flags);
5665         upd.set = upd.mask;
5666         NLA_PUT(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd);
5667
5668         if (params->flags & WPA_STA_WMM) {
5669                 wme = nlmsg_alloc();
5670                 if (!wme)
5671                         goto nla_put_failure;
5672
5673                 NLA_PUT_U8(wme, NL80211_STA_WME_UAPSD_QUEUES,
5674                                 params->qosinfo & WMM_QOSINFO_STA_AC_MASK);
5675                 NLA_PUT_U8(wme, NL80211_STA_WME_MAX_SP,
5676                                 (params->qosinfo > WMM_QOSINFO_STA_SP_SHIFT) &
5677                                 WMM_QOSINFO_STA_SP_MASK);
5678                 if (nla_put_nested(msg, NL80211_ATTR_STA_WME, wme) < 0)
5679                         goto nla_put_failure;
5680         }
5681
5682         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5683         msg = NULL;
5684         if (ret)
5685                 wpa_printf(MSG_DEBUG, "nl80211: NL80211_CMD_%s_STATION "
5686                            "result: %d (%s)", params->set ? "SET" : "NEW", ret,
5687                            strerror(-ret));
5688         if (ret == -EEXIST)
5689                 ret = 0;
5690  nla_put_failure:
5691         nlmsg_free(wme);
5692         nlmsg_free(msg);
5693         return ret;
5694 }
5695
5696
5697 static int wpa_driver_nl80211_sta_remove(void *priv, const u8 *addr)
5698 {
5699         struct i802_bss *bss = priv;
5700         struct wpa_driver_nl80211_data *drv = bss->drv;
5701         struct nl_msg *msg;
5702         int ret;
5703
5704         msg = nlmsg_alloc();
5705         if (!msg)
5706                 return -ENOMEM;
5707
5708         nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_STATION);
5709
5710         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
5711                     if_nametoindex(bss->ifname));
5712         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
5713
5714         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5715         if (ret == -ENOENT)
5716                 return 0;
5717         return ret;
5718  nla_put_failure:
5719         nlmsg_free(msg);
5720         return -ENOBUFS;
5721 }
5722
5723
5724 static void nl80211_remove_iface(struct wpa_driver_nl80211_data *drv,
5725                                  int ifidx)
5726 {
5727         struct nl_msg *msg;
5728
5729         wpa_printf(MSG_DEBUG, "nl80211: Remove interface ifindex=%d", ifidx);
5730
5731         /* stop listening for EAPOL on this interface */
5732         del_ifidx(drv, ifidx);
5733
5734         msg = nlmsg_alloc();
5735         if (!msg)
5736                 goto nla_put_failure;
5737
5738         nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_INTERFACE);
5739         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifidx);
5740
5741         if (send_and_recv_msgs(drv, msg, NULL, NULL) == 0)
5742                 return;
5743         msg = NULL;
5744  nla_put_failure:
5745         nlmsg_free(msg);
5746         wpa_printf(MSG_ERROR, "Failed to remove interface (ifidx=%d)", ifidx);
5747 }
5748
5749
5750 static const char * nl80211_iftype_str(enum nl80211_iftype mode)
5751 {
5752         switch (mode) {
5753         case NL80211_IFTYPE_ADHOC:
5754                 return "ADHOC";
5755         case NL80211_IFTYPE_STATION:
5756                 return "STATION";
5757         case NL80211_IFTYPE_AP:
5758                 return "AP";
5759         case NL80211_IFTYPE_MONITOR:
5760                 return "MONITOR";
5761         case NL80211_IFTYPE_P2P_CLIENT:
5762                 return "P2P_CLIENT";
5763         case NL80211_IFTYPE_P2P_GO:
5764                 return "P2P_GO";
5765         default:
5766                 return "unknown";
5767         }
5768 }
5769
5770
5771 static int nl80211_create_iface_once(struct wpa_driver_nl80211_data *drv,
5772                                      const char *ifname,
5773                                      enum nl80211_iftype iftype,
5774                                      const u8 *addr, int wds)
5775 {
5776         struct nl_msg *msg, *flags = NULL;
5777         int ifidx;
5778         int ret = -ENOBUFS;
5779
5780         wpa_printf(MSG_DEBUG, "nl80211: Create interface iftype %d (%s)",
5781                    iftype, nl80211_iftype_str(iftype));
5782
5783         msg = nlmsg_alloc();
5784         if (!msg)
5785                 return -1;
5786
5787         nl80211_cmd(drv, msg, 0, NL80211_CMD_NEW_INTERFACE);
5788         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
5789         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, ifname);
5790         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, iftype);
5791
5792         if (iftype == NL80211_IFTYPE_MONITOR) {
5793                 int err;
5794
5795                 flags = nlmsg_alloc();
5796                 if (!flags)
5797                         goto nla_put_failure;
5798
5799                 NLA_PUT_FLAG(flags, NL80211_MNTR_FLAG_COOK_FRAMES);
5800
5801                 err = nla_put_nested(msg, NL80211_ATTR_MNTR_FLAGS, flags);
5802
5803                 nlmsg_free(flags);
5804
5805                 if (err)
5806                         goto nla_put_failure;
5807         } else if (wds) {
5808                 NLA_PUT_U8(msg, NL80211_ATTR_4ADDR, wds);
5809         }
5810
5811         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5812         msg = NULL;
5813         if (ret) {
5814  nla_put_failure:
5815                 nlmsg_free(msg);
5816                 wpa_printf(MSG_ERROR, "Failed to create interface %s: %d (%s)",
5817                            ifname, ret, strerror(-ret));
5818                 return ret;
5819         }
5820
5821         ifidx = if_nametoindex(ifname);
5822         wpa_printf(MSG_DEBUG, "nl80211: New interface %s created: ifindex=%d",
5823                    ifname, ifidx);
5824
5825         if (ifidx <= 0)
5826                 return -1;
5827
5828         /* start listening for EAPOL on this interface */
5829         add_ifidx(drv, ifidx);
5830
5831         if (addr && iftype != NL80211_IFTYPE_MONITOR &&
5832             linux_set_ifhwaddr(drv->global->ioctl_sock, ifname, addr)) {
5833                 nl80211_remove_iface(drv, ifidx);
5834                 return -1;
5835         }
5836
5837         return ifidx;
5838 }
5839
5840
5841 static int nl80211_create_iface(struct wpa_driver_nl80211_data *drv,
5842                                 const char *ifname, enum nl80211_iftype iftype,
5843                                 const u8 *addr, int wds)
5844 {
5845         int ret;
5846
5847         ret = nl80211_create_iface_once(drv, ifname, iftype, addr, wds);
5848
5849         /* if error occurred and interface exists already */
5850         if (ret == -ENFILE && if_nametoindex(ifname)) {
5851                 wpa_printf(MSG_INFO, "Try to remove and re-create %s", ifname);
5852
5853                 /* Try to remove the interface that was already there. */
5854                 nl80211_remove_iface(drv, if_nametoindex(ifname));
5855
5856                 /* Try to create the interface again */
5857                 ret = nl80211_create_iface_once(drv, ifname, iftype, addr,
5858                                                 wds);
5859         }
5860
5861         if (ret >= 0 && is_p2p_interface(iftype))
5862                 nl80211_disable_11b_rates(drv, ret, 1);
5863
5864         return ret;
5865 }
5866
5867
5868 static void handle_tx_callback(void *ctx, u8 *buf, size_t len, int ok)
5869 {
5870         struct ieee80211_hdr *hdr;
5871         u16 fc;
5872         union wpa_event_data event;
5873
5874         hdr = (struct ieee80211_hdr *) buf;
5875         fc = le_to_host16(hdr->frame_control);
5876
5877         os_memset(&event, 0, sizeof(event));
5878         event.tx_status.type = WLAN_FC_GET_TYPE(fc);
5879         event.tx_status.stype = WLAN_FC_GET_STYPE(fc);
5880         event.tx_status.dst = hdr->addr1;
5881         event.tx_status.data = buf;
5882         event.tx_status.data_len = len;
5883         event.tx_status.ack = ok;
5884         wpa_supplicant_event(ctx, EVENT_TX_STATUS, &event);
5885 }
5886
5887
5888 static void from_unknown_sta(struct wpa_driver_nl80211_data *drv,
5889                              u8 *buf, size_t len)
5890 {
5891         struct ieee80211_hdr *hdr = (void *)buf;
5892         u16 fc;
5893         union wpa_event_data event;
5894
5895         if (len < sizeof(*hdr))
5896                 return;
5897
5898         fc = le_to_host16(hdr->frame_control);
5899
5900         os_memset(&event, 0, sizeof(event));
5901         event.rx_from_unknown.bssid = get_hdr_bssid(hdr, len);
5902         event.rx_from_unknown.addr = hdr->addr2;
5903         event.rx_from_unknown.wds = (fc & (WLAN_FC_FROMDS | WLAN_FC_TODS)) ==
5904                 (WLAN_FC_FROMDS | WLAN_FC_TODS);
5905         wpa_supplicant_event(drv->ctx, EVENT_RX_FROM_UNKNOWN, &event);
5906 }
5907
5908
5909 static void handle_frame(struct wpa_driver_nl80211_data *drv,
5910                          u8 *buf, size_t len, int datarate, int ssi_signal)
5911 {
5912         struct ieee80211_hdr *hdr;
5913         u16 fc;
5914         union wpa_event_data event;
5915
5916         hdr = (struct ieee80211_hdr *) buf;
5917         fc = le_to_host16(hdr->frame_control);
5918
5919         switch (WLAN_FC_GET_TYPE(fc)) {
5920         case WLAN_FC_TYPE_MGMT:
5921                 os_memset(&event, 0, sizeof(event));
5922                 event.rx_mgmt.frame = buf;
5923                 event.rx_mgmt.frame_len = len;
5924                 event.rx_mgmt.datarate = datarate;
5925                 event.rx_mgmt.ssi_signal = ssi_signal;
5926                 wpa_supplicant_event(drv->ctx, EVENT_RX_MGMT, &event);
5927                 break;
5928         case WLAN_FC_TYPE_CTRL:
5929                 /* can only get here with PS-Poll frames */
5930                 wpa_printf(MSG_DEBUG, "CTRL");
5931                 from_unknown_sta(drv, buf, len);
5932                 break;
5933         case WLAN_FC_TYPE_DATA:
5934                 from_unknown_sta(drv, buf, len);
5935                 break;
5936         }
5937 }
5938
5939
5940 static void handle_monitor_read(int sock, void *eloop_ctx, void *sock_ctx)
5941 {
5942         struct wpa_driver_nl80211_data *drv = eloop_ctx;
5943         int len;
5944         unsigned char buf[3000];
5945         struct ieee80211_radiotap_iterator iter;
5946         int ret;
5947         int datarate = 0, ssi_signal = 0;
5948         int injected = 0, failed = 0, rxflags = 0;
5949
5950         len = recv(sock, buf, sizeof(buf), 0);
5951         if (len < 0) {
5952                 perror("recv");
5953                 return;
5954         }
5955
5956         if (ieee80211_radiotap_iterator_init(&iter, (void*)buf, len)) {
5957                 printf("received invalid radiotap frame\n");
5958                 return;
5959         }
5960
5961         while (1) {
5962                 ret = ieee80211_radiotap_iterator_next(&iter);
5963                 if (ret == -ENOENT)
5964                         break;
5965                 if (ret) {
5966                         printf("received invalid radiotap frame (%d)\n", ret);
5967                         return;
5968                 }
5969                 switch (iter.this_arg_index) {
5970                 case IEEE80211_RADIOTAP_FLAGS:
5971                         if (*iter.this_arg & IEEE80211_RADIOTAP_F_FCS)
5972                                 len -= 4;
5973                         break;
5974                 case IEEE80211_RADIOTAP_RX_FLAGS:
5975                         rxflags = 1;
5976                         break;
5977                 case IEEE80211_RADIOTAP_TX_FLAGS:
5978                         injected = 1;
5979                         failed = le_to_host16((*(uint16_t *) iter.this_arg)) &
5980                                         IEEE80211_RADIOTAP_F_TX_FAIL;
5981                         break;
5982                 case IEEE80211_RADIOTAP_DATA_RETRIES:
5983                         break;
5984                 case IEEE80211_RADIOTAP_CHANNEL:
5985                         /* TODO: convert from freq/flags to channel number */
5986                         break;
5987                 case IEEE80211_RADIOTAP_RATE:
5988                         datarate = *iter.this_arg * 5;
5989                         break;
5990                 case IEEE80211_RADIOTAP_DBM_ANTSIGNAL:
5991                         ssi_signal = (s8) *iter.this_arg;
5992                         break;
5993                 }
5994         }
5995
5996         if (rxflags && injected)
5997                 return;
5998
5999         if (!injected)
6000                 handle_frame(drv, buf + iter.max_length,
6001                              len - iter.max_length, datarate, ssi_signal);
6002         else
6003                 handle_tx_callback(drv->ctx, buf + iter.max_length,
6004                                    len - iter.max_length, !failed);
6005 }
6006
6007
6008 /*
6009  * we post-process the filter code later and rewrite
6010  * this to the offset to the last instruction
6011  */
6012 #define PASS    0xFF
6013 #define FAIL    0xFE
6014
6015 static struct sock_filter msock_filter_insns[] = {
6016         /*
6017          * do a little-endian load of the radiotap length field
6018          */
6019         /* load lower byte into A */
6020         BPF_STMT(BPF_LD  | BPF_B | BPF_ABS, 2),
6021         /* put it into X (== index register) */
6022         BPF_STMT(BPF_MISC| BPF_TAX, 0),
6023         /* load upper byte into A */
6024         BPF_STMT(BPF_LD  | BPF_B | BPF_ABS, 3),
6025         /* left-shift it by 8 */
6026         BPF_STMT(BPF_ALU | BPF_LSH | BPF_K, 8),
6027         /* or with X */
6028         BPF_STMT(BPF_ALU | BPF_OR | BPF_X, 0),
6029         /* put result into X */
6030         BPF_STMT(BPF_MISC| BPF_TAX, 0),
6031
6032         /*
6033          * Allow management frames through, this also gives us those
6034          * management frames that we sent ourselves with status
6035          */
6036         /* load the lower byte of the IEEE 802.11 frame control field */
6037         BPF_STMT(BPF_LD  | BPF_B | BPF_IND, 0),
6038         /* mask off frame type and version */
6039         BPF_STMT(BPF_ALU | BPF_AND | BPF_K, 0xF),
6040         /* accept frame if it's both 0, fall through otherwise */
6041         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0, PASS, 0),
6042
6043         /*
6044          * TODO: add a bit to radiotap RX flags that indicates
6045          * that the sending station is not associated, then
6046          * add a filter here that filters on our DA and that flag
6047          * to allow us to deauth frames to that bad station.
6048          *
6049          * For now allow all To DS data frames through.
6050          */
6051         /* load the IEEE 802.11 frame control field */
6052         BPF_STMT(BPF_LD  | BPF_H | BPF_IND, 0),
6053         /* mask off frame type, version and DS status */
6054         BPF_STMT(BPF_ALU | BPF_AND | BPF_K, 0x0F03),
6055         /* accept frame if version 0, type 2 and To DS, fall through otherwise
6056          */
6057         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x0801, PASS, 0),
6058
6059 #if 0
6060         /*
6061          * drop non-data frames
6062          */
6063         /* load the lower byte of the frame control field */
6064         BPF_STMT(BPF_LD   | BPF_B | BPF_IND, 0),
6065         /* mask off QoS bit */
6066         BPF_STMT(BPF_ALU  | BPF_AND | BPF_K, 0x0c),
6067         /* drop non-data frames */
6068         BPF_JUMP(BPF_JMP  | BPF_JEQ | BPF_K, 8, 0, FAIL),
6069 #endif
6070         /* load the upper byte of the frame control field */
6071         BPF_STMT(BPF_LD   | BPF_B | BPF_IND, 1),
6072         /* mask off toDS/fromDS */
6073         BPF_STMT(BPF_ALU  | BPF_AND | BPF_K, 0x03),
6074         /* accept WDS frames */
6075         BPF_JUMP(BPF_JMP  | BPF_JEQ | BPF_K, 3, PASS, 0),
6076
6077         /*
6078          * add header length to index
6079          */
6080         /* load the lower byte of the frame control field */
6081         BPF_STMT(BPF_LD   | BPF_B | BPF_IND, 0),
6082         /* mask off QoS bit */
6083         BPF_STMT(BPF_ALU  | BPF_AND | BPF_K, 0x80),
6084         /* right shift it by 6 to give 0 or 2 */
6085         BPF_STMT(BPF_ALU  | BPF_RSH | BPF_K, 6),
6086         /* add data frame header length */
6087         BPF_STMT(BPF_ALU  | BPF_ADD | BPF_K, 24),
6088         /* add index, was start of 802.11 header */
6089         BPF_STMT(BPF_ALU  | BPF_ADD | BPF_X, 0),
6090         /* move to index, now start of LL header */
6091         BPF_STMT(BPF_MISC | BPF_TAX, 0),
6092
6093         /*
6094          * Accept empty data frames, we use those for
6095          * polling activity.
6096          */
6097         BPF_STMT(BPF_LD  | BPF_W | BPF_LEN, 0),
6098         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_X, 0, PASS, 0),
6099
6100         /*
6101          * Accept EAPOL frames
6102          */
6103         BPF_STMT(BPF_LD  | BPF_W | BPF_IND, 0),
6104         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0xAAAA0300, 0, FAIL),
6105         BPF_STMT(BPF_LD  | BPF_W | BPF_IND, 4),
6106         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x0000888E, PASS, FAIL),
6107
6108         /* keep these last two statements or change the code below */
6109         /* return 0 == "DROP" */
6110         BPF_STMT(BPF_RET | BPF_K, 0),
6111         /* return ~0 == "keep all" */
6112         BPF_STMT(BPF_RET | BPF_K, ~0),
6113 };
6114
6115 static struct sock_fprog msock_filter = {
6116         .len = sizeof(msock_filter_insns)/sizeof(msock_filter_insns[0]),
6117         .filter = msock_filter_insns,
6118 };
6119
6120
6121 static int add_monitor_filter(int s)
6122 {
6123         int idx;
6124
6125         /* rewrite all PASS/FAIL jump offsets */
6126         for (idx = 0; idx < msock_filter.len; idx++) {
6127                 struct sock_filter *insn = &msock_filter_insns[idx];
6128
6129                 if (BPF_CLASS(insn->code) == BPF_JMP) {
6130                         if (insn->code == (BPF_JMP|BPF_JA)) {
6131                                 if (insn->k == PASS)
6132                                         insn->k = msock_filter.len - idx - 2;
6133                                 else if (insn->k == FAIL)
6134                                         insn->k = msock_filter.len - idx - 3;
6135                         }
6136
6137                         if (insn->jt == PASS)
6138                                 insn->jt = msock_filter.len - idx - 2;
6139                         else if (insn->jt == FAIL)
6140                                 insn->jt = msock_filter.len - idx - 3;
6141
6142                         if (insn->jf == PASS)
6143                                 insn->jf = msock_filter.len - idx - 2;
6144                         else if (insn->jf == FAIL)
6145                                 insn->jf = msock_filter.len - idx - 3;
6146                 }
6147         }
6148
6149         if (setsockopt(s, SOL_SOCKET, SO_ATTACH_FILTER,
6150                        &msock_filter, sizeof(msock_filter))) {
6151                 perror("SO_ATTACH_FILTER");
6152                 return -1;
6153         }
6154
6155         return 0;
6156 }
6157
6158
6159 static void nl80211_remove_monitor_interface(
6160         struct wpa_driver_nl80211_data *drv)
6161 {
6162         drv->monitor_refcount--;
6163         if (drv->monitor_refcount > 0)
6164                 return;
6165
6166         if (drv->monitor_ifidx >= 0) {
6167                 nl80211_remove_iface(drv, drv->monitor_ifidx);
6168                 drv->monitor_ifidx = -1;
6169         }
6170         if (drv->monitor_sock >= 0) {
6171                 eloop_unregister_read_sock(drv->monitor_sock);
6172                 close(drv->monitor_sock);
6173                 drv->monitor_sock = -1;
6174         }
6175 }
6176
6177
6178 static int
6179 nl80211_create_monitor_interface(struct wpa_driver_nl80211_data *drv)
6180 {
6181         char buf[IFNAMSIZ];
6182         struct sockaddr_ll ll;
6183         int optval;
6184         socklen_t optlen;
6185
6186         if (drv->monitor_ifidx >= 0) {
6187                 drv->monitor_refcount++;
6188                 return 0;
6189         }
6190
6191         if (os_strncmp(drv->first_bss.ifname, "p2p-", 4) == 0) {
6192                 /*
6193                  * P2P interface name is of the format p2p-%s-%d. For monitor
6194                  * interface name corresponding to P2P GO, replace "p2p-" with
6195                  * "mon-" to retain the same interface name length and to
6196                  * indicate that it is a monitor interface.
6197                  */
6198                 snprintf(buf, IFNAMSIZ, "mon-%s", drv->first_bss.ifname + 4);
6199         } else {
6200                 /* Non-P2P interface with AP functionality. */
6201                 snprintf(buf, IFNAMSIZ, "mon.%s", drv->first_bss.ifname);
6202         }
6203
6204         buf[IFNAMSIZ - 1] = '\0';
6205
6206         drv->monitor_ifidx =
6207                 nl80211_create_iface(drv, buf, NL80211_IFTYPE_MONITOR, NULL,
6208                                      0);
6209
6210         if (drv->monitor_ifidx == -EOPNOTSUPP) {
6211                 /*
6212                  * This is backward compatibility for a few versions of
6213                  * the kernel only that didn't advertise the right
6214                  * attributes for the only driver that then supported
6215                  * AP mode w/o monitor -- ath6kl.
6216                  */
6217                 wpa_printf(MSG_DEBUG, "nl80211: Driver does not support "
6218                            "monitor interface type - try to run without it");
6219                 drv->device_ap_sme = 1;
6220         }
6221
6222         if (drv->monitor_ifidx < 0)
6223                 return -1;
6224
6225         if (linux_set_iface_flags(drv->global->ioctl_sock, buf, 1))
6226                 goto error;
6227
6228         memset(&ll, 0, sizeof(ll));
6229         ll.sll_family = AF_PACKET;
6230         ll.sll_ifindex = drv->monitor_ifidx;
6231         drv->monitor_sock = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
6232         if (drv->monitor_sock < 0) {
6233                 perror("socket[PF_PACKET,SOCK_RAW]");
6234                 goto error;
6235         }
6236
6237         if (add_monitor_filter(drv->monitor_sock)) {
6238                 wpa_printf(MSG_INFO, "Failed to set socket filter for monitor "
6239                            "interface; do filtering in user space");
6240                 /* This works, but will cost in performance. */
6241         }
6242
6243         if (bind(drv->monitor_sock, (struct sockaddr *) &ll, sizeof(ll)) < 0) {
6244                 perror("monitor socket bind");
6245                 goto error;
6246         }
6247
6248         optlen = sizeof(optval);
6249         optval = 20;
6250         if (setsockopt
6251             (drv->monitor_sock, SOL_SOCKET, SO_PRIORITY, &optval, optlen)) {
6252                 perror("Failed to set socket priority");
6253                 goto error;
6254         }
6255
6256         if (eloop_register_read_sock(drv->monitor_sock, handle_monitor_read,
6257                                      drv, NULL)) {
6258                 printf("Could not register monitor read socket\n");
6259                 goto error;
6260         }
6261
6262         return 0;
6263  error:
6264         nl80211_remove_monitor_interface(drv);
6265         return -1;
6266 }
6267
6268
6269 static int nl80211_setup_ap(struct i802_bss *bss)
6270 {
6271         struct wpa_driver_nl80211_data *drv = bss->drv;
6272
6273         wpa_printf(MSG_DEBUG, "nl80211: Setup AP - device_ap_sme=%d "
6274                    "use_monitor=%d", drv->device_ap_sme, drv->use_monitor);
6275
6276         /*
6277          * Disable Probe Request reporting unless we need it in this way for
6278          * devices that include the AP SME, in the other case (unless using
6279          * monitor iface) we'll get it through the nl_mgmt socket instead.
6280          */
6281         if (!drv->device_ap_sme)
6282                 wpa_driver_nl80211_probe_req_report(bss, 0);
6283
6284         if (!drv->device_ap_sme && !drv->use_monitor)
6285                 if (nl80211_mgmt_subscribe_ap(bss))
6286                         return -1;
6287
6288         if (drv->device_ap_sme && !drv->use_monitor)
6289                 if (nl80211_mgmt_subscribe_ap_dev_sme(bss))
6290                         return -1;
6291
6292         if (!drv->device_ap_sme && drv->use_monitor &&
6293             nl80211_create_monitor_interface(drv) &&
6294             !drv->device_ap_sme)
6295                 return -1;
6296
6297         if (drv->device_ap_sme &&
6298             wpa_driver_nl80211_probe_req_report(bss, 1) < 0) {
6299                 wpa_printf(MSG_DEBUG, "nl80211: Failed to enable "
6300                            "Probe Request frame reporting in AP mode");
6301                 /* Try to survive without this */
6302         }
6303
6304         return 0;
6305 }
6306
6307
6308 static void nl80211_teardown_ap(struct i802_bss *bss)
6309 {
6310         struct wpa_driver_nl80211_data *drv = bss->drv;
6311
6312         if (drv->device_ap_sme) {
6313                 wpa_driver_nl80211_probe_req_report(bss, 0);
6314                 if (!drv->use_monitor)
6315                         nl80211_mgmt_unsubscribe(bss, "AP teardown (dev SME)");
6316         } else if (drv->use_monitor)
6317                 nl80211_remove_monitor_interface(drv);
6318         else
6319                 nl80211_mgmt_unsubscribe(bss, "AP teardown");
6320
6321         bss->beacon_set = 0;
6322 }
6323
6324
6325 static int nl80211_send_eapol_data(struct i802_bss *bss,
6326                                    const u8 *addr, const u8 *data,
6327                                    size_t data_len)
6328 {
6329         struct sockaddr_ll ll;
6330         int ret;
6331
6332         if (bss->drv->eapol_tx_sock < 0) {
6333                 wpa_printf(MSG_DEBUG, "nl80211: No socket to send EAPOL");
6334                 return -1;
6335         }
6336
6337         os_memset(&ll, 0, sizeof(ll));
6338         ll.sll_family = AF_PACKET;
6339         ll.sll_ifindex = bss->ifindex;
6340         ll.sll_protocol = htons(ETH_P_PAE);
6341         ll.sll_halen = ETH_ALEN;
6342         os_memcpy(ll.sll_addr, addr, ETH_ALEN);
6343         ret = sendto(bss->drv->eapol_tx_sock, data, data_len, 0,
6344                      (struct sockaddr *) &ll, sizeof(ll));
6345         if (ret < 0)
6346                 wpa_printf(MSG_ERROR, "nl80211: EAPOL TX: %s",
6347                            strerror(errno));
6348
6349         return ret;
6350 }
6351
6352
6353 static const u8 rfc1042_header[6] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
6354
6355 static int wpa_driver_nl80211_hapd_send_eapol(
6356         void *priv, const u8 *addr, const u8 *data,
6357         size_t data_len, int encrypt, const u8 *own_addr, u32 flags)
6358 {
6359         struct i802_bss *bss = priv;
6360         struct wpa_driver_nl80211_data *drv = bss->drv;
6361         struct ieee80211_hdr *hdr;
6362         size_t len;
6363         u8 *pos;
6364         int res;
6365         int qos = flags & WPA_STA_WMM;
6366
6367         if (drv->device_ap_sme || !drv->use_monitor)
6368                 return nl80211_send_eapol_data(bss, addr, data, data_len);
6369
6370         len = sizeof(*hdr) + (qos ? 2 : 0) + sizeof(rfc1042_header) + 2 +
6371                 data_len;
6372         hdr = os_zalloc(len);
6373         if (hdr == NULL) {
6374                 printf("malloc() failed for i802_send_data(len=%lu)\n",
6375                        (unsigned long) len);
6376                 return -1;
6377         }
6378
6379         hdr->frame_control =
6380                 IEEE80211_FC(WLAN_FC_TYPE_DATA, WLAN_FC_STYPE_DATA);
6381         hdr->frame_control |= host_to_le16(WLAN_FC_FROMDS);
6382         if (encrypt)
6383                 hdr->frame_control |= host_to_le16(WLAN_FC_ISWEP);
6384         if (qos) {
6385                 hdr->frame_control |=
6386                         host_to_le16(WLAN_FC_STYPE_QOS_DATA << 4);
6387         }
6388
6389         memcpy(hdr->IEEE80211_DA_FROMDS, addr, ETH_ALEN);
6390         memcpy(hdr->IEEE80211_BSSID_FROMDS, own_addr, ETH_ALEN);
6391         memcpy(hdr->IEEE80211_SA_FROMDS, own_addr, ETH_ALEN);
6392         pos = (u8 *) (hdr + 1);
6393
6394         if (qos) {
6395                 /* Set highest priority in QoS header */
6396                 pos[0] = 7;
6397                 pos[1] = 0;
6398                 pos += 2;
6399         }
6400
6401         memcpy(pos, rfc1042_header, sizeof(rfc1042_header));
6402         pos += sizeof(rfc1042_header);
6403         WPA_PUT_BE16(pos, ETH_P_PAE);
6404         pos += 2;
6405         memcpy(pos, data, data_len);
6406
6407         res = wpa_driver_nl80211_send_frame(bss, (u8 *) hdr, len, encrypt, 0,
6408                                             0, 0, 0, 0);
6409         if (res < 0) {
6410                 wpa_printf(MSG_ERROR, "i802_send_eapol - packet len: %lu - "
6411                            "failed: %d (%s)",
6412                            (unsigned long) len, errno, strerror(errno));
6413         }
6414         os_free(hdr);
6415
6416         return res;
6417 }
6418
6419
6420 static int wpa_driver_nl80211_sta_set_flags(void *priv, const u8 *addr,
6421                                             int total_flags,
6422                                             int flags_or, int flags_and)
6423 {
6424         struct i802_bss *bss = priv;
6425         struct wpa_driver_nl80211_data *drv = bss->drv;
6426         struct nl_msg *msg, *flags = NULL;
6427         struct nl80211_sta_flag_update upd;
6428
6429         msg = nlmsg_alloc();
6430         if (!msg)
6431                 return -ENOMEM;
6432
6433         flags = nlmsg_alloc();
6434         if (!flags) {
6435                 nlmsg_free(msg);
6436                 return -ENOMEM;
6437         }
6438
6439         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_STATION);
6440
6441         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
6442                     if_nametoindex(bss->ifname));
6443         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
6444
6445         /*
6446          * Backwards compatibility version using NL80211_ATTR_STA_FLAGS. This
6447          * can be removed eventually.
6448          */
6449         if (total_flags & WPA_STA_AUTHORIZED)
6450                 NLA_PUT_FLAG(flags, NL80211_STA_FLAG_AUTHORIZED);
6451
6452         if (total_flags & WPA_STA_WMM)
6453                 NLA_PUT_FLAG(flags, NL80211_STA_FLAG_WME);
6454
6455         if (total_flags & WPA_STA_SHORT_PREAMBLE)
6456                 NLA_PUT_FLAG(flags, NL80211_STA_FLAG_SHORT_PREAMBLE);
6457
6458         if (total_flags & WPA_STA_MFP)
6459                 NLA_PUT_FLAG(flags, NL80211_STA_FLAG_MFP);
6460
6461         if (total_flags & WPA_STA_TDLS_PEER)
6462                 NLA_PUT_FLAG(flags, NL80211_STA_FLAG_TDLS_PEER);
6463
6464         if (nla_put_nested(msg, NL80211_ATTR_STA_FLAGS, flags))
6465                 goto nla_put_failure;
6466
6467         os_memset(&upd, 0, sizeof(upd));
6468         upd.mask = sta_flags_nl80211(flags_or | ~flags_and);
6469         upd.set = sta_flags_nl80211(flags_or);
6470         NLA_PUT(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd);
6471
6472         nlmsg_free(flags);
6473
6474         return send_and_recv_msgs(drv, msg, NULL, NULL);
6475  nla_put_failure:
6476         nlmsg_free(msg);
6477         nlmsg_free(flags);
6478         return -ENOBUFS;
6479 }
6480
6481
6482 static int wpa_driver_nl80211_ap(struct wpa_driver_nl80211_data *drv,
6483                                  struct wpa_driver_associate_params *params)
6484 {
6485         enum nl80211_iftype nlmode;
6486
6487         if (params->p2p) {
6488                 wpa_printf(MSG_DEBUG, "nl80211: Setup AP operations for P2P "
6489                            "group (GO)");
6490                 nlmode = NL80211_IFTYPE_P2P_GO;
6491         } else
6492                 nlmode = NL80211_IFTYPE_AP;
6493
6494         if (wpa_driver_nl80211_set_mode(&drv->first_bss, nlmode) ||
6495             wpa_driver_nl80211_set_freq(&drv->first_bss, params->freq, 0, 0)) {
6496                 nl80211_remove_monitor_interface(drv);
6497                 return -1;
6498         }
6499
6500         return 0;
6501 }
6502
6503
6504 static int nl80211_leave_ibss(struct wpa_driver_nl80211_data *drv)
6505 {
6506         struct nl_msg *msg;
6507         int ret = -1;
6508
6509         msg = nlmsg_alloc();
6510         if (!msg)
6511                 return -1;
6512
6513         nl80211_cmd(drv, msg, 0, NL80211_CMD_LEAVE_IBSS);
6514         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
6515         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
6516         msg = NULL;
6517         if (ret) {
6518                 wpa_printf(MSG_DEBUG, "nl80211: Leave IBSS failed: ret=%d "
6519                            "(%s)", ret, strerror(-ret));
6520                 goto nla_put_failure;
6521         }
6522
6523         ret = 0;
6524         wpa_printf(MSG_DEBUG, "nl80211: Leave IBSS request sent successfully");
6525
6526 nla_put_failure:
6527         nlmsg_free(msg);
6528         return ret;
6529 }
6530
6531
6532 static int wpa_driver_nl80211_ibss(struct wpa_driver_nl80211_data *drv,
6533                                    struct wpa_driver_associate_params *params)
6534 {
6535         struct nl_msg *msg;
6536         int ret = -1;
6537         int count = 0;
6538
6539         wpa_printf(MSG_DEBUG, "nl80211: Join IBSS (ifindex=%d)", drv->ifindex);
6540
6541         if (wpa_driver_nl80211_set_mode(&drv->first_bss,
6542                                         NL80211_IFTYPE_ADHOC)) {
6543                 wpa_printf(MSG_INFO, "nl80211: Failed to set interface into "
6544                            "IBSS mode");
6545                 return -1;
6546         }
6547
6548 retry:
6549         msg = nlmsg_alloc();
6550         if (!msg)
6551                 return -1;
6552
6553         nl80211_cmd(drv, msg, 0, NL80211_CMD_JOIN_IBSS);
6554         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
6555
6556         if (params->ssid == NULL || params->ssid_len > sizeof(drv->ssid))
6557                 goto nla_put_failure;
6558
6559         wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
6560                           params->ssid, params->ssid_len);
6561         NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
6562                 params->ssid);
6563         os_memcpy(drv->ssid, params->ssid, params->ssid_len);
6564         drv->ssid_len = params->ssid_len;
6565
6566         wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq);
6567         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq);
6568
6569         ret = nl80211_set_conn_keys(params, msg);
6570         if (ret)
6571                 goto nla_put_failure;
6572
6573         if (params->bssid && params->fixed_bssid) {
6574                 wpa_printf(MSG_DEBUG, "  * BSSID=" MACSTR,
6575                            MAC2STR(params->bssid));
6576                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid);
6577         }
6578
6579         if (params->key_mgmt_suite == KEY_MGMT_802_1X ||
6580             params->key_mgmt_suite == KEY_MGMT_PSK ||
6581             params->key_mgmt_suite == KEY_MGMT_802_1X_SHA256 ||
6582             params->key_mgmt_suite == KEY_MGMT_PSK_SHA256) {
6583                 wpa_printf(MSG_DEBUG, "  * control port");
6584                 NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT);
6585         }
6586
6587         if (params->wpa_ie) {
6588                 wpa_hexdump(MSG_DEBUG,
6589                             "  * Extra IEs for Beacon/Probe Response frames",
6590                             params->wpa_ie, params->wpa_ie_len);
6591                 NLA_PUT(msg, NL80211_ATTR_IE, params->wpa_ie_len,
6592                         params->wpa_ie);
6593         }
6594
6595         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
6596         msg = NULL;
6597         if (ret) {
6598                 wpa_printf(MSG_DEBUG, "nl80211: Join IBSS failed: ret=%d (%s)",
6599                            ret, strerror(-ret));
6600                 count++;
6601                 if (ret == -EALREADY && count == 1) {
6602                         wpa_printf(MSG_DEBUG, "nl80211: Retry IBSS join after "
6603                                    "forced leave");
6604                         nl80211_leave_ibss(drv);
6605                         nlmsg_free(msg);
6606                         goto retry;
6607                 }
6608
6609                 goto nla_put_failure;
6610         }
6611         ret = 0;
6612         wpa_printf(MSG_DEBUG, "nl80211: Join IBSS request sent successfully");
6613
6614 nla_put_failure:
6615         nlmsg_free(msg);
6616         return ret;
6617 }
6618
6619
6620 static unsigned int nl80211_get_assoc_bssid(struct wpa_driver_nl80211_data *drv,
6621                                             u8 *bssid)
6622 {
6623         struct nl_msg *msg;
6624         int ret;
6625         struct nl80211_bss_info_arg arg;
6626
6627         os_memset(&arg, 0, sizeof(arg));
6628         msg = nlmsg_alloc();
6629         if (!msg)
6630                 goto nla_put_failure;
6631
6632         nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_SCAN);
6633         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
6634
6635         arg.drv = drv;
6636         ret = send_and_recv_msgs(drv, msg, bss_info_handler, &arg);
6637         msg = NULL;
6638         if (ret == 0) {
6639                 if (is_zero_ether_addr(arg.assoc_bssid))
6640                         return -ENOTCONN;
6641                 os_memcpy(bssid, arg.assoc_bssid, ETH_ALEN);
6642                 return 0;
6643         }
6644         wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d "
6645                    "(%s)", ret, strerror(-ret));
6646 nla_put_failure:
6647         nlmsg_free(msg);
6648         return drv->assoc_freq;
6649 }
6650
6651
6652 static int nl80211_disconnect(struct wpa_driver_nl80211_data *drv,
6653                               const u8 *bssid)
6654 {
6655         u8 addr[ETH_ALEN];
6656
6657         if (bssid == NULL) {
6658                 int res = nl80211_get_assoc_bssid(drv, addr);
6659                 if (res)
6660                         return res;
6661                 bssid = addr;
6662         }
6663
6664         return wpa_driver_nl80211_disconnect(drv, bssid,
6665                                              WLAN_REASON_PREV_AUTH_NOT_VALID);
6666 }
6667
6668
6669 static int wpa_driver_nl80211_connect(
6670         struct wpa_driver_nl80211_data *drv,
6671         struct wpa_driver_associate_params *params)
6672 {
6673         struct nl_msg *msg;
6674         enum nl80211_auth_type type;
6675         int ret = 0;
6676         int algs;
6677
6678         msg = nlmsg_alloc();
6679         if (!msg)
6680                 return -1;
6681
6682         wpa_printf(MSG_DEBUG, "nl80211: Connect (ifindex=%d)", drv->ifindex);
6683         nl80211_cmd(drv, msg, 0, NL80211_CMD_CONNECT);
6684
6685         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
6686         if (params->bssid) {
6687                 wpa_printf(MSG_DEBUG, "  * bssid=" MACSTR,
6688                            MAC2STR(params->bssid));
6689                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid);
6690         }
6691         if (params->freq) {
6692                 wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq);
6693                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq);
6694         }
6695         if (params->bg_scan_period >= 0) {
6696                 wpa_printf(MSG_DEBUG, "  * bg scan period=%d",
6697                            params->bg_scan_period);
6698                 NLA_PUT_U16(msg, NL80211_ATTR_BG_SCAN_PERIOD,
6699                             params->bg_scan_period);
6700         }
6701         if (params->ssid) {
6702                 wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
6703                                   params->ssid, params->ssid_len);
6704                 NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
6705                         params->ssid);
6706                 if (params->ssid_len > sizeof(drv->ssid))
6707                         goto nla_put_failure;
6708                 os_memcpy(drv->ssid, params->ssid, params->ssid_len);
6709                 drv->ssid_len = params->ssid_len;
6710         }
6711         wpa_hexdump(MSG_DEBUG, "  * IEs", params->wpa_ie, params->wpa_ie_len);
6712         if (params->wpa_ie)
6713                 NLA_PUT(msg, NL80211_ATTR_IE, params->wpa_ie_len,
6714                         params->wpa_ie);
6715
6716         algs = 0;
6717         if (params->auth_alg & WPA_AUTH_ALG_OPEN)
6718                 algs++;
6719         if (params->auth_alg & WPA_AUTH_ALG_SHARED)
6720                 algs++;
6721         if (params->auth_alg & WPA_AUTH_ALG_LEAP)
6722                 algs++;
6723         if (algs > 1) {
6724                 wpa_printf(MSG_DEBUG, "  * Leave out Auth Type for automatic "
6725                            "selection");
6726                 goto skip_auth_type;
6727         }
6728
6729         if (params->auth_alg & WPA_AUTH_ALG_OPEN)
6730                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
6731         else if (params->auth_alg & WPA_AUTH_ALG_SHARED)
6732                 type = NL80211_AUTHTYPE_SHARED_KEY;
6733         else if (params->auth_alg & WPA_AUTH_ALG_LEAP)
6734                 type = NL80211_AUTHTYPE_NETWORK_EAP;
6735         else if (params->auth_alg & WPA_AUTH_ALG_FT)
6736                 type = NL80211_AUTHTYPE_FT;
6737         else
6738                 goto nla_put_failure;
6739
6740         wpa_printf(MSG_DEBUG, "  * Auth Type %d", type);
6741         NLA_PUT_U32(msg, NL80211_ATTR_AUTH_TYPE, type);
6742
6743 skip_auth_type:
6744         if (params->wpa_proto) {
6745                 enum nl80211_wpa_versions ver = 0;
6746
6747                 if (params->wpa_proto & WPA_PROTO_WPA)
6748                         ver |= NL80211_WPA_VERSION_1;
6749                 if (params->wpa_proto & WPA_PROTO_RSN)
6750                         ver |= NL80211_WPA_VERSION_2;
6751
6752                 wpa_printf(MSG_DEBUG, "  * WPA Versions 0x%x", ver);
6753                 NLA_PUT_U32(msg, NL80211_ATTR_WPA_VERSIONS, ver);
6754         }
6755
6756         if (params->pairwise_suite != CIPHER_NONE) {
6757                 int cipher;
6758
6759                 switch (params->pairwise_suite) {
6760                 case CIPHER_WEP40:
6761                         cipher = WLAN_CIPHER_SUITE_WEP40;
6762                         break;
6763                 case CIPHER_WEP104:
6764                         cipher = WLAN_CIPHER_SUITE_WEP104;
6765                         break;
6766                 case CIPHER_CCMP:
6767                         cipher = WLAN_CIPHER_SUITE_CCMP;
6768                         break;
6769                 case CIPHER_GCMP:
6770                         cipher = WLAN_CIPHER_SUITE_GCMP;
6771                         break;
6772                 case CIPHER_TKIP:
6773                 default:
6774                         cipher = WLAN_CIPHER_SUITE_TKIP;
6775                         break;
6776                 }
6777                 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITES_PAIRWISE, cipher);
6778         }
6779
6780         if (params->group_suite != CIPHER_NONE) {
6781                 int cipher;
6782
6783                 switch (params->group_suite) {
6784                 case CIPHER_WEP40:
6785                         cipher = WLAN_CIPHER_SUITE_WEP40;
6786                         break;
6787                 case CIPHER_WEP104:
6788                         cipher = WLAN_CIPHER_SUITE_WEP104;
6789                         break;
6790                 case CIPHER_CCMP:
6791                         cipher = WLAN_CIPHER_SUITE_CCMP;
6792                         break;
6793                 case CIPHER_GCMP:
6794                         cipher = WLAN_CIPHER_SUITE_GCMP;
6795                         break;
6796                 case CIPHER_TKIP:
6797                 default:
6798                         cipher = WLAN_CIPHER_SUITE_TKIP;
6799                         break;
6800                 }
6801                 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP, cipher);
6802         }
6803
6804         if (params->key_mgmt_suite == KEY_MGMT_802_1X ||
6805             params->key_mgmt_suite == KEY_MGMT_PSK) {
6806                 int mgmt = WLAN_AKM_SUITE_PSK;
6807
6808                 switch (params->key_mgmt_suite) {
6809                 case KEY_MGMT_802_1X:
6810                         mgmt = WLAN_AKM_SUITE_8021X;
6811                         break;
6812                 case KEY_MGMT_PSK:
6813                 default:
6814                         mgmt = WLAN_AKM_SUITE_PSK;
6815                         break;
6816                 }
6817                 NLA_PUT_U32(msg, NL80211_ATTR_AKM_SUITES, mgmt);
6818         }
6819
6820         if (params->disable_ht)
6821                 NLA_PUT_FLAG(msg, NL80211_ATTR_DISABLE_HT);
6822
6823         if (params->htcaps && params->htcaps_mask) {
6824                 int sz = sizeof(struct ieee80211_ht_capabilities);
6825                 NLA_PUT(msg, NL80211_ATTR_HT_CAPABILITY, sz, params->htcaps);
6826                 NLA_PUT(msg, NL80211_ATTR_HT_CAPABILITY_MASK, sz,
6827                         params->htcaps_mask);
6828         }
6829
6830         ret = nl80211_set_conn_keys(params, msg);
6831         if (ret)
6832                 goto nla_put_failure;
6833
6834         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
6835         msg = NULL;
6836         if (ret) {
6837                 wpa_printf(MSG_DEBUG, "nl80211: MLME connect failed: ret=%d "
6838                            "(%s)", ret, strerror(-ret));
6839                 /*
6840                  * cfg80211 does not currently accept new connection if we are
6841                  * already connected. As a workaround, force disconnection and
6842                  * try again once the driver indicates it completed
6843                  * disconnection.
6844                  */
6845                 if (ret == -EALREADY)
6846                         nl80211_disconnect(drv, params->bssid);
6847                 goto nla_put_failure;
6848         }
6849         ret = 0;
6850         wpa_printf(MSG_DEBUG, "nl80211: Connect request send successfully");
6851
6852 nla_put_failure:
6853         nlmsg_free(msg);
6854         return ret;
6855
6856 }
6857
6858
6859 static int wpa_driver_nl80211_associate(
6860         void *priv, struct wpa_driver_associate_params *params)
6861 {
6862         struct i802_bss *bss = priv;
6863         struct wpa_driver_nl80211_data *drv = bss->drv;
6864         int ret = -1;
6865         struct nl_msg *msg;
6866
6867         if (params->mode == IEEE80211_MODE_AP)
6868                 return wpa_driver_nl80211_ap(drv, params);
6869
6870         if (params->mode == IEEE80211_MODE_IBSS)
6871                 return wpa_driver_nl80211_ibss(drv, params);
6872
6873         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME)) {
6874                 enum nl80211_iftype nlmode = params->p2p ?
6875                         NL80211_IFTYPE_P2P_CLIENT : NL80211_IFTYPE_STATION;
6876
6877                 if (wpa_driver_nl80211_set_mode(priv, nlmode) < 0)
6878                         return -1;
6879                 return wpa_driver_nl80211_connect(drv, params);
6880         }
6881
6882         drv->associated = 0;
6883
6884         msg = nlmsg_alloc();
6885         if (!msg)
6886                 return -1;
6887
6888         wpa_printf(MSG_DEBUG, "nl80211: Associate (ifindex=%d)",
6889                    drv->ifindex);
6890         nl80211_cmd(drv, msg, 0, NL80211_CMD_ASSOCIATE);
6891
6892         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
6893         if (params->bssid) {
6894                 wpa_printf(MSG_DEBUG, "  * bssid=" MACSTR,
6895                            MAC2STR(params->bssid));
6896                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid);
6897         }
6898         if (params->freq) {
6899                 wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq);
6900                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq);
6901                 drv->assoc_freq = params->freq;
6902         } else
6903                 drv->assoc_freq = 0;
6904         if (params->bg_scan_period >= 0) {
6905                 wpa_printf(MSG_DEBUG, "  * bg scan period=%d",
6906                            params->bg_scan_period);
6907                 NLA_PUT_U16(msg, NL80211_ATTR_BG_SCAN_PERIOD,
6908                             params->bg_scan_period);
6909         }
6910         if (params->ssid) {
6911                 wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
6912                                   params->ssid, params->ssid_len);
6913                 NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
6914                         params->ssid);
6915                 if (params->ssid_len > sizeof(drv->ssid))
6916                         goto nla_put_failure;
6917                 os_memcpy(drv->ssid, params->ssid, params->ssid_len);
6918                 drv->ssid_len = params->ssid_len;
6919         }
6920         wpa_hexdump(MSG_DEBUG, "  * IEs", params->wpa_ie, params->wpa_ie_len);
6921         if (params->wpa_ie)
6922                 NLA_PUT(msg, NL80211_ATTR_IE, params->wpa_ie_len,
6923                         params->wpa_ie);
6924
6925         if (params->pairwise_suite != CIPHER_NONE) {
6926                 int cipher;
6927
6928                 switch (params->pairwise_suite) {
6929                 case CIPHER_WEP40:
6930                         cipher = WLAN_CIPHER_SUITE_WEP40;
6931                         break;
6932                 case CIPHER_WEP104:
6933                         cipher = WLAN_CIPHER_SUITE_WEP104;
6934                         break;
6935                 case CIPHER_CCMP:
6936                         cipher = WLAN_CIPHER_SUITE_CCMP;
6937                         break;
6938                 case CIPHER_GCMP:
6939                         cipher = WLAN_CIPHER_SUITE_GCMP;
6940                         break;
6941                 case CIPHER_TKIP:
6942                 default:
6943                         cipher = WLAN_CIPHER_SUITE_TKIP;
6944                         break;
6945                 }
6946                 wpa_printf(MSG_DEBUG, "  * pairwise=0x%x", cipher);
6947                 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITES_PAIRWISE, cipher);
6948         }
6949
6950         if (params->group_suite != CIPHER_NONE) {
6951                 int cipher;
6952
6953                 switch (params->group_suite) {
6954                 case CIPHER_WEP40:
6955                         cipher = WLAN_CIPHER_SUITE_WEP40;
6956                         break;
6957                 case CIPHER_WEP104:
6958                         cipher = WLAN_CIPHER_SUITE_WEP104;
6959                         break;
6960                 case CIPHER_CCMP:
6961                         cipher = WLAN_CIPHER_SUITE_CCMP;
6962                         break;
6963                 case CIPHER_GCMP:
6964                         cipher = WLAN_CIPHER_SUITE_GCMP;
6965                         break;
6966                 case CIPHER_TKIP:
6967                 default:
6968                         cipher = WLAN_CIPHER_SUITE_TKIP;
6969                         break;
6970                 }
6971                 wpa_printf(MSG_DEBUG, "  * group=0x%x", cipher);
6972                 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP, cipher);
6973         }
6974
6975 #ifdef CONFIG_IEEE80211W
6976         if (params->mgmt_frame_protection == MGMT_FRAME_PROTECTION_REQUIRED)
6977                 NLA_PUT_U32(msg, NL80211_ATTR_USE_MFP, NL80211_MFP_REQUIRED);
6978 #endif /* CONFIG_IEEE80211W */
6979
6980         NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT);
6981
6982         if (params->prev_bssid) {
6983                 wpa_printf(MSG_DEBUG, "  * prev_bssid=" MACSTR,
6984                            MAC2STR(params->prev_bssid));
6985                 NLA_PUT(msg, NL80211_ATTR_PREV_BSSID, ETH_ALEN,
6986                         params->prev_bssid);
6987         }
6988
6989         if (params->disable_ht)
6990                 NLA_PUT_FLAG(msg, NL80211_ATTR_DISABLE_HT);
6991
6992         if (params->htcaps && params->htcaps_mask) {
6993                 int sz = sizeof(struct ieee80211_ht_capabilities);
6994                 NLA_PUT(msg, NL80211_ATTR_HT_CAPABILITY, sz, params->htcaps);
6995                 NLA_PUT(msg, NL80211_ATTR_HT_CAPABILITY_MASK, sz,
6996                         params->htcaps_mask);
6997         }
6998
6999         if (params->p2p)
7000                 wpa_printf(MSG_DEBUG, "  * P2P group");
7001
7002         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7003         msg = NULL;
7004         if (ret) {
7005                 wpa_dbg(drv->ctx, MSG_DEBUG,
7006                         "nl80211: MLME command failed (assoc): ret=%d (%s)",
7007                         ret, strerror(-ret));
7008                 nl80211_dump_scan(drv);
7009                 goto nla_put_failure;
7010         }
7011         ret = 0;
7012         wpa_printf(MSG_DEBUG, "nl80211: Association request send "
7013                    "successfully");
7014
7015 nla_put_failure:
7016         nlmsg_free(msg);
7017         return ret;
7018 }
7019
7020
7021 static int nl80211_set_mode(struct wpa_driver_nl80211_data *drv,
7022                             int ifindex, enum nl80211_iftype mode)
7023 {
7024         struct nl_msg *msg;
7025         int ret = -ENOBUFS;
7026
7027         wpa_printf(MSG_DEBUG, "nl80211: Set mode ifindex %d iftype %d (%s)",
7028                    ifindex, mode, nl80211_iftype_str(mode));
7029
7030         msg = nlmsg_alloc();
7031         if (!msg)
7032                 return -ENOMEM;
7033
7034         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_INTERFACE);
7035         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
7036         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, mode);
7037
7038         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7039         msg = NULL;
7040         if (!ret)
7041                 return 0;
7042 nla_put_failure:
7043         nlmsg_free(msg);
7044         wpa_printf(MSG_DEBUG, "nl80211: Failed to set interface %d to mode %d:"
7045                    " %d (%s)", ifindex, mode, ret, strerror(-ret));
7046         return ret;
7047 }
7048
7049
7050 static int wpa_driver_nl80211_set_mode(struct i802_bss *bss,
7051                                        enum nl80211_iftype nlmode)
7052 {
7053         struct wpa_driver_nl80211_data *drv = bss->drv;
7054         int ret = -1;
7055         int i;
7056         int was_ap = is_ap_interface(drv->nlmode);
7057         int res;
7058
7059         res = nl80211_set_mode(drv, drv->ifindex, nlmode);
7060         if (res == 0) {
7061                 drv->nlmode = nlmode;
7062                 ret = 0;
7063                 goto done;
7064         }
7065
7066         if (res == -ENODEV)
7067                 return -1;
7068
7069         if (nlmode == drv->nlmode) {
7070                 wpa_printf(MSG_DEBUG, "nl80211: Interface already in "
7071                            "requested mode - ignore error");
7072                 ret = 0;
7073                 goto done; /* Already in the requested mode */
7074         }
7075
7076         /* mac80211 doesn't allow mode changes while the device is up, so
7077          * take the device down, try to set the mode again, and bring the
7078          * device back up.
7079          */
7080         wpa_printf(MSG_DEBUG, "nl80211: Try mode change after setting "
7081                    "interface down");
7082         for (i = 0; i < 10; i++) {
7083                 res = linux_set_iface_flags(drv->global->ioctl_sock,
7084                                             bss->ifname, 0);
7085                 if (res == -EACCES || res == -ENODEV)
7086                         break;
7087                 if (res == 0) {
7088                         /* Try to set the mode again while the interface is
7089                          * down */
7090                         ret = nl80211_set_mode(drv, drv->ifindex, nlmode);
7091                         if (ret == -EACCES)
7092                                 break;
7093                         res = linux_set_iface_flags(drv->global->ioctl_sock,
7094                                                     bss->ifname, 1);
7095                         if (res && !ret)
7096                                 ret = -1;
7097                         else if (ret != -EBUSY)
7098                                 break;
7099                 } else
7100                         wpa_printf(MSG_DEBUG, "nl80211: Failed to set "
7101                                    "interface down");
7102                 os_sleep(0, 100000);
7103         }
7104
7105         if (!ret) {
7106                 wpa_printf(MSG_DEBUG, "nl80211: Mode change succeeded while "
7107                            "interface is down");
7108                 drv->nlmode = nlmode;
7109                 drv->ignore_if_down_event = 1;
7110         }
7111
7112 done:
7113         if (ret) {
7114                 wpa_printf(MSG_DEBUG, "nl80211: Interface mode change to %d "
7115                            "from %d failed", nlmode, drv->nlmode);
7116                 return ret;
7117         }
7118
7119         if (is_p2p_interface(nlmode))
7120                 nl80211_disable_11b_rates(drv, drv->ifindex, 1);
7121         else if (drv->disabled_11b_rates)
7122                 nl80211_disable_11b_rates(drv, drv->ifindex, 0);
7123
7124         if (is_ap_interface(nlmode)) {
7125                 nl80211_mgmt_unsubscribe(bss, "start AP");
7126                 /* Setup additional AP mode functionality if needed */
7127                 if (nl80211_setup_ap(bss))
7128                         return -1;
7129         } else if (was_ap) {
7130                 /* Remove additional AP mode functionality */
7131                 nl80211_teardown_ap(bss);
7132         } else {
7133                 nl80211_mgmt_unsubscribe(bss, "mode change");
7134         }
7135
7136         if (!bss->in_deinit && !is_ap_interface(nlmode) &&
7137             nl80211_mgmt_subscribe_non_ap(bss) < 0)
7138                 wpa_printf(MSG_DEBUG, "nl80211: Failed to register Action "
7139                            "frame processing - ignore for now");
7140
7141         return 0;
7142 }
7143
7144
7145 static int wpa_driver_nl80211_get_capa(void *priv,
7146                                        struct wpa_driver_capa *capa)
7147 {
7148         struct i802_bss *bss = priv;
7149         struct wpa_driver_nl80211_data *drv = bss->drv;
7150         if (!drv->has_capability)
7151                 return -1;
7152         os_memcpy(capa, &drv->capa, sizeof(*capa));
7153         return 0;
7154 }
7155
7156
7157 static int wpa_driver_nl80211_set_operstate(void *priv, int state)
7158 {
7159         struct i802_bss *bss = priv;
7160         struct wpa_driver_nl80211_data *drv = bss->drv;
7161
7162         wpa_printf(MSG_DEBUG, "%s: operstate %d->%d (%s)",
7163                    __func__, drv->operstate, state, state ? "UP" : "DORMANT");
7164         drv->operstate = state;
7165         return netlink_send_oper_ifla(drv->global->netlink, drv->ifindex, -1,
7166                                       state ? IF_OPER_UP : IF_OPER_DORMANT);
7167 }
7168
7169
7170 static int wpa_driver_nl80211_set_supp_port(void *priv, int authorized)
7171 {
7172         struct i802_bss *bss = priv;
7173         struct wpa_driver_nl80211_data *drv = bss->drv;
7174         struct nl_msg *msg;
7175         struct nl80211_sta_flag_update upd;
7176
7177         msg = nlmsg_alloc();
7178         if (!msg)
7179                 return -ENOMEM;
7180
7181         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_STATION);
7182
7183         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
7184                     if_nametoindex(bss->ifname));
7185         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, drv->bssid);
7186
7187         os_memset(&upd, 0, sizeof(upd));
7188         upd.mask = BIT(NL80211_STA_FLAG_AUTHORIZED);
7189         if (authorized)
7190                 upd.set = BIT(NL80211_STA_FLAG_AUTHORIZED);
7191         NLA_PUT(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd);
7192
7193         return send_and_recv_msgs(drv, msg, NULL, NULL);
7194  nla_put_failure:
7195         nlmsg_free(msg);
7196         return -ENOBUFS;
7197 }
7198
7199
7200 /* Set kernel driver on given frequency (MHz) */
7201 static int i802_set_freq(void *priv, struct hostapd_freq_params *freq)
7202 {
7203         struct i802_bss *bss = priv;
7204         return wpa_driver_nl80211_set_freq(bss, freq->freq, freq->ht_enabled,
7205                                            freq->sec_channel_offset);
7206 }
7207
7208
7209 #if defined(HOSTAPD) || defined(CONFIG_AP)
7210
7211 static inline int min_int(int a, int b)
7212 {
7213         if (a < b)
7214                 return a;
7215         return b;
7216 }
7217
7218
7219 static int get_key_handler(struct nl_msg *msg, void *arg)
7220 {
7221         struct nlattr *tb[NL80211_ATTR_MAX + 1];
7222         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
7223
7224         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
7225                   genlmsg_attrlen(gnlh, 0), NULL);
7226
7227         /*
7228          * TODO: validate the key index and mac address!
7229          * Otherwise, there's a race condition as soon as
7230          * the kernel starts sending key notifications.
7231          */
7232
7233         if (tb[NL80211_ATTR_KEY_SEQ])
7234                 memcpy(arg, nla_data(tb[NL80211_ATTR_KEY_SEQ]),
7235                        min_int(nla_len(tb[NL80211_ATTR_KEY_SEQ]), 6));
7236         return NL_SKIP;
7237 }
7238
7239
7240 static int i802_get_seqnum(const char *iface, void *priv, const u8 *addr,
7241                            int idx, u8 *seq)
7242 {
7243         struct i802_bss *bss = priv;
7244         struct wpa_driver_nl80211_data *drv = bss->drv;
7245         struct nl_msg *msg;
7246
7247         msg = nlmsg_alloc();
7248         if (!msg)
7249                 return -ENOMEM;
7250
7251         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_KEY);
7252
7253         if (addr)
7254                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
7255         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, idx);
7256         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(iface));
7257
7258         memset(seq, 0, 6);
7259
7260         return send_and_recv_msgs(drv, msg, get_key_handler, seq);
7261  nla_put_failure:
7262         nlmsg_free(msg);
7263         return -ENOBUFS;
7264 }
7265
7266
7267 static int i802_set_rts(void *priv, int rts)
7268 {
7269         struct i802_bss *bss = priv;
7270         struct wpa_driver_nl80211_data *drv = bss->drv;
7271         struct nl_msg *msg;
7272         int ret = -ENOBUFS;
7273         u32 val;
7274
7275         msg = nlmsg_alloc();
7276         if (!msg)
7277                 return -ENOMEM;
7278
7279         if (rts >= 2347)
7280                 val = (u32) -1;
7281         else
7282                 val = rts;
7283
7284         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_WIPHY);
7285         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
7286         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD, val);
7287
7288         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7289         msg = NULL;
7290         if (!ret)
7291                 return 0;
7292 nla_put_failure:
7293         nlmsg_free(msg);
7294         wpa_printf(MSG_DEBUG, "nl80211: Failed to set RTS threshold %d: "
7295                    "%d (%s)", rts, ret, strerror(-ret));
7296         return ret;
7297 }
7298
7299
7300 static int i802_set_frag(void *priv, int frag)
7301 {
7302         struct i802_bss *bss = priv;
7303         struct wpa_driver_nl80211_data *drv = bss->drv;
7304         struct nl_msg *msg;
7305         int ret = -ENOBUFS;
7306         u32 val;
7307
7308         msg = nlmsg_alloc();
7309         if (!msg)
7310                 return -ENOMEM;
7311
7312         if (frag >= 2346)
7313                 val = (u32) -1;
7314         else
7315                 val = frag;
7316
7317         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_WIPHY);
7318         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
7319         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD, val);
7320
7321         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7322         msg = NULL;
7323         if (!ret)
7324                 return 0;
7325 nla_put_failure:
7326         nlmsg_free(msg);
7327         wpa_printf(MSG_DEBUG, "nl80211: Failed to set fragmentation threshold "
7328                    "%d: %d (%s)", frag, ret, strerror(-ret));
7329         return ret;
7330 }
7331
7332
7333 static int i802_flush(void *priv)
7334 {
7335         struct i802_bss *bss = priv;
7336         struct wpa_driver_nl80211_data *drv = bss->drv;
7337         struct nl_msg *msg;
7338         int res;
7339
7340         msg = nlmsg_alloc();
7341         if (!msg)
7342                 return -1;
7343
7344         nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_STATION);
7345
7346         /*
7347          * XXX: FIX! this needs to flush all VLANs too
7348          */
7349         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
7350                     if_nametoindex(bss->ifname));
7351
7352         res = send_and_recv_msgs(drv, msg, NULL, NULL);
7353         if (res) {
7354                 wpa_printf(MSG_DEBUG, "nl80211: Station flush failed: ret=%d "
7355                            "(%s)", res, strerror(-res));
7356         }
7357         return res;
7358  nla_put_failure:
7359         nlmsg_free(msg);
7360         return -ENOBUFS;
7361 }
7362
7363 #endif /* HOSTAPD || CONFIG_AP */
7364
7365
7366 static int get_sta_handler(struct nl_msg *msg, void *arg)
7367 {
7368         struct nlattr *tb[NL80211_ATTR_MAX + 1];
7369         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
7370         struct hostap_sta_driver_data *data = arg;
7371         struct nlattr *stats[NL80211_STA_INFO_MAX + 1];
7372         static struct nla_policy stats_policy[NL80211_STA_INFO_MAX + 1] = {
7373                 [NL80211_STA_INFO_INACTIVE_TIME] = { .type = NLA_U32 },
7374                 [NL80211_STA_INFO_RX_BYTES] = { .type = NLA_U32 },
7375                 [NL80211_STA_INFO_TX_BYTES] = { .type = NLA_U32 },
7376                 [NL80211_STA_INFO_RX_PACKETS] = { .type = NLA_U32 },
7377                 [NL80211_STA_INFO_TX_PACKETS] = { .type = NLA_U32 },
7378                 [NL80211_STA_INFO_TX_FAILED] = { .type = NLA_U32 },
7379         };
7380
7381         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
7382                   genlmsg_attrlen(gnlh, 0), NULL);
7383
7384         /*
7385          * TODO: validate the interface and mac address!
7386          * Otherwise, there's a race condition as soon as
7387          * the kernel starts sending station notifications.
7388          */
7389
7390         if (!tb[NL80211_ATTR_STA_INFO]) {
7391                 wpa_printf(MSG_DEBUG, "sta stats missing!");
7392                 return NL_SKIP;
7393         }
7394         if (nla_parse_nested(stats, NL80211_STA_INFO_MAX,
7395                              tb[NL80211_ATTR_STA_INFO],
7396                              stats_policy)) {
7397                 wpa_printf(MSG_DEBUG, "failed to parse nested attributes!");
7398                 return NL_SKIP;
7399         }
7400
7401         if (stats[NL80211_STA_INFO_INACTIVE_TIME])
7402                 data->inactive_msec =
7403                         nla_get_u32(stats[NL80211_STA_INFO_INACTIVE_TIME]);
7404         if (stats[NL80211_STA_INFO_RX_BYTES])
7405                 data->rx_bytes = nla_get_u32(stats[NL80211_STA_INFO_RX_BYTES]);
7406         if (stats[NL80211_STA_INFO_TX_BYTES])
7407                 data->tx_bytes = nla_get_u32(stats[NL80211_STA_INFO_TX_BYTES]);
7408         if (stats[NL80211_STA_INFO_RX_PACKETS])
7409                 data->rx_packets =
7410                         nla_get_u32(stats[NL80211_STA_INFO_RX_PACKETS]);
7411         if (stats[NL80211_STA_INFO_TX_PACKETS])
7412                 data->tx_packets =
7413                         nla_get_u32(stats[NL80211_STA_INFO_TX_PACKETS]);
7414         if (stats[NL80211_STA_INFO_TX_FAILED])
7415                 data->tx_retry_failed =
7416                         nla_get_u32(stats[NL80211_STA_INFO_TX_FAILED]);
7417
7418         return NL_SKIP;
7419 }
7420
7421 static int i802_read_sta_data(void *priv, struct hostap_sta_driver_data *data,
7422                               const u8 *addr)
7423 {
7424         struct i802_bss *bss = priv;
7425         struct wpa_driver_nl80211_data *drv = bss->drv;
7426         struct nl_msg *msg;
7427
7428         os_memset(data, 0, sizeof(*data));
7429         msg = nlmsg_alloc();
7430         if (!msg)
7431                 return -ENOMEM;
7432
7433         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_STATION);
7434
7435         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
7436         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
7437
7438         return send_and_recv_msgs(drv, msg, get_sta_handler, data);
7439  nla_put_failure:
7440         nlmsg_free(msg);
7441         return -ENOBUFS;
7442 }
7443
7444
7445 #if defined(HOSTAPD) || defined(CONFIG_AP)
7446
7447 static int i802_set_tx_queue_params(void *priv, int queue, int aifs,
7448                                     int cw_min, int cw_max, int burst_time)
7449 {
7450         struct i802_bss *bss = priv;
7451         struct wpa_driver_nl80211_data *drv = bss->drv;
7452         struct nl_msg *msg;
7453         struct nlattr *txq, *params;
7454
7455         msg = nlmsg_alloc();
7456         if (!msg)
7457                 return -1;
7458
7459         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_WIPHY);
7460
7461         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
7462
7463         txq = nla_nest_start(msg, NL80211_ATTR_WIPHY_TXQ_PARAMS);
7464         if (!txq)
7465                 goto nla_put_failure;
7466
7467         /* We are only sending parameters for a single TXQ at a time */
7468         params = nla_nest_start(msg, 1);
7469         if (!params)
7470                 goto nla_put_failure;
7471
7472         switch (queue) {
7473         case 0:
7474                 NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_VO);
7475                 break;
7476         case 1:
7477                 NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_VI);
7478                 break;
7479         case 2:
7480                 NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_BE);
7481                 break;
7482         case 3:
7483                 NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_BK);
7484                 break;
7485         }
7486         /* Burst time is configured in units of 0.1 msec and TXOP parameter in
7487          * 32 usec, so need to convert the value here. */
7488         NLA_PUT_U16(msg, NL80211_TXQ_ATTR_TXOP, (burst_time * 100 + 16) / 32);
7489         NLA_PUT_U16(msg, NL80211_TXQ_ATTR_CWMIN, cw_min);
7490         NLA_PUT_U16(msg, NL80211_TXQ_ATTR_CWMAX, cw_max);
7491         NLA_PUT_U8(msg, NL80211_TXQ_ATTR_AIFS, aifs);
7492
7493         nla_nest_end(msg, params);
7494
7495         nla_nest_end(msg, txq);
7496
7497         if (send_and_recv_msgs(drv, msg, NULL, NULL) == 0)
7498                 return 0;
7499         msg = NULL;
7500  nla_put_failure:
7501         nlmsg_free(msg);
7502         return -1;
7503 }
7504
7505
7506 static int i802_set_sta_vlan(void *priv, const u8 *addr,
7507                              const char *ifname, int vlan_id)
7508 {
7509         struct i802_bss *bss = priv;
7510         struct wpa_driver_nl80211_data *drv = bss->drv;
7511         struct nl_msg *msg;
7512         int ret = -ENOBUFS;
7513
7514         msg = nlmsg_alloc();
7515         if (!msg)
7516                 return -ENOMEM;
7517
7518         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_STATION);
7519
7520         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
7521                     if_nametoindex(bss->ifname));
7522         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
7523         NLA_PUT_U32(msg, NL80211_ATTR_STA_VLAN,
7524                     if_nametoindex(ifname));
7525
7526         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7527         msg = NULL;
7528         if (ret < 0) {
7529                 wpa_printf(MSG_ERROR, "nl80211: NL80211_ATTR_STA_VLAN (addr="
7530                            MACSTR " ifname=%s vlan_id=%d) failed: %d (%s)",
7531                            MAC2STR(addr), ifname, vlan_id, ret,
7532                            strerror(-ret));
7533         }
7534  nla_put_failure:
7535         nlmsg_free(msg);
7536         return ret;
7537 }
7538
7539
7540 static int i802_get_inact_sec(void *priv, const u8 *addr)
7541 {
7542         struct hostap_sta_driver_data data;
7543         int ret;
7544
7545         data.inactive_msec = (unsigned long) -1;
7546         ret = i802_read_sta_data(priv, &data, addr);
7547         if (ret || data.inactive_msec == (unsigned long) -1)
7548                 return -1;
7549         return data.inactive_msec / 1000;
7550 }
7551
7552
7553 static int i802_sta_clear_stats(void *priv, const u8 *addr)
7554 {
7555 #if 0
7556         /* TODO */
7557 #endif
7558         return 0;
7559 }
7560
7561
7562 static int i802_sta_deauth(void *priv, const u8 *own_addr, const u8 *addr,
7563                            int reason)
7564 {
7565         struct i802_bss *bss = priv;
7566         struct wpa_driver_nl80211_data *drv = bss->drv;
7567         struct ieee80211_mgmt mgmt;
7568
7569         if (drv->device_ap_sme)
7570                 return wpa_driver_nl80211_sta_remove(bss, addr);
7571
7572         memset(&mgmt, 0, sizeof(mgmt));
7573         mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
7574                                           WLAN_FC_STYPE_DEAUTH);
7575         memcpy(mgmt.da, addr, ETH_ALEN);
7576         memcpy(mgmt.sa, own_addr, ETH_ALEN);
7577         memcpy(mgmt.bssid, own_addr, ETH_ALEN);
7578         mgmt.u.deauth.reason_code = host_to_le16(reason);
7579         return wpa_driver_nl80211_send_mlme(bss, (u8 *) &mgmt,
7580                                             IEEE80211_HDRLEN +
7581                                             sizeof(mgmt.u.deauth), 0);
7582 }
7583
7584
7585 static int i802_sta_disassoc(void *priv, const u8 *own_addr, const u8 *addr,
7586                              int reason)
7587 {
7588         struct i802_bss *bss = priv;
7589         struct wpa_driver_nl80211_data *drv = bss->drv;
7590         struct ieee80211_mgmt mgmt;
7591
7592         if (drv->device_ap_sme)
7593                 return wpa_driver_nl80211_sta_remove(bss, addr);
7594
7595         memset(&mgmt, 0, sizeof(mgmt));
7596         mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
7597                                           WLAN_FC_STYPE_DISASSOC);
7598         memcpy(mgmt.da, addr, ETH_ALEN);
7599         memcpy(mgmt.sa, own_addr, ETH_ALEN);
7600         memcpy(mgmt.bssid, own_addr, ETH_ALEN);
7601         mgmt.u.disassoc.reason_code = host_to_le16(reason);
7602         return wpa_driver_nl80211_send_mlme(bss, (u8 *) &mgmt,
7603                                             IEEE80211_HDRLEN +
7604                                             sizeof(mgmt.u.disassoc), 0);
7605 }
7606
7607 #endif /* HOSTAPD || CONFIG_AP */
7608
7609 #ifdef HOSTAPD
7610
7611 static void add_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
7612 {
7613         int i;
7614         int *old;
7615
7616         wpa_printf(MSG_DEBUG, "nl80211: Add own interface ifindex %d",
7617                    ifidx);
7618         for (i = 0; i < drv->num_if_indices; i++) {
7619                 if (drv->if_indices[i] == 0) {
7620                         drv->if_indices[i] = ifidx;
7621                         return;
7622                 }
7623         }
7624
7625         if (drv->if_indices != drv->default_if_indices)
7626                 old = drv->if_indices;
7627         else
7628                 old = NULL;
7629
7630         drv->if_indices = os_realloc_array(old, drv->num_if_indices + 1,
7631                                            sizeof(int));
7632         if (!drv->if_indices) {
7633                 if (!old)
7634                         drv->if_indices = drv->default_if_indices;
7635                 else
7636                         drv->if_indices = old;
7637                 wpa_printf(MSG_ERROR, "Failed to reallocate memory for "
7638                            "interfaces");
7639                 wpa_printf(MSG_ERROR, "Ignoring EAPOL on interface %d", ifidx);
7640                 return;
7641         } else if (!old)
7642                 os_memcpy(drv->if_indices, drv->default_if_indices,
7643                           sizeof(drv->default_if_indices));
7644         drv->if_indices[drv->num_if_indices] = ifidx;
7645         drv->num_if_indices++;
7646 }
7647
7648
7649 static void del_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
7650 {
7651         int i;
7652
7653         for (i = 0; i < drv->num_if_indices; i++) {
7654                 if (drv->if_indices[i] == ifidx) {
7655                         drv->if_indices[i] = 0;
7656                         break;
7657                 }
7658         }
7659 }
7660
7661
7662 static int have_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
7663 {
7664         int i;
7665
7666         for (i = 0; i < drv->num_if_indices; i++)
7667                 if (drv->if_indices[i] == ifidx)
7668                         return 1;
7669
7670         return 0;
7671 }
7672
7673
7674 static int i802_set_wds_sta(void *priv, const u8 *addr, int aid, int val,
7675                             const char *bridge_ifname)
7676 {
7677         struct i802_bss *bss = priv;
7678         struct wpa_driver_nl80211_data *drv = bss->drv;
7679         char name[IFNAMSIZ + 1];
7680
7681         os_snprintf(name, sizeof(name), "%s.sta%d", bss->ifname, aid);
7682         wpa_printf(MSG_DEBUG, "nl80211: Set WDS STA addr=" MACSTR
7683                    " aid=%d val=%d name=%s", MAC2STR(addr), aid, val, name);
7684         if (val) {
7685                 if (!if_nametoindex(name)) {
7686                         if (nl80211_create_iface(drv, name,
7687                                                  NL80211_IFTYPE_AP_VLAN,
7688                                                  NULL, 1) < 0)
7689                                 return -1;
7690                         if (bridge_ifname &&
7691                             linux_br_add_if(drv->global->ioctl_sock,
7692                                             bridge_ifname, name) < 0)
7693                                 return -1;
7694                 }
7695                 if (linux_set_iface_flags(drv->global->ioctl_sock, name, 1)) {
7696                         wpa_printf(MSG_ERROR, "nl80211: Failed to set WDS STA "
7697                                    "interface %s up", name);
7698                 }
7699                 return i802_set_sta_vlan(priv, addr, name, 0);
7700         } else {
7701                 if (bridge_ifname)
7702                         linux_br_del_if(drv->global->ioctl_sock, bridge_ifname,
7703                                         name);
7704
7705                 i802_set_sta_vlan(priv, addr, bss->ifname, 0);
7706                 return wpa_driver_nl80211_if_remove(priv, WPA_IF_AP_VLAN,
7707                                                     name);
7708         }
7709 }
7710
7711
7712 static void handle_eapol(int sock, void *eloop_ctx, void *sock_ctx)
7713 {
7714         struct wpa_driver_nl80211_data *drv = eloop_ctx;
7715         struct sockaddr_ll lladdr;
7716         unsigned char buf[3000];
7717         int len;
7718         socklen_t fromlen = sizeof(lladdr);
7719
7720         len = recvfrom(sock, buf, sizeof(buf), 0,
7721                        (struct sockaddr *)&lladdr, &fromlen);
7722         if (len < 0) {
7723                 perror("recv");
7724                 return;
7725         }
7726
7727         if (have_ifidx(drv, lladdr.sll_ifindex))
7728                 drv_event_eapol_rx(drv->ctx, lladdr.sll_addr, buf, len);
7729 }
7730
7731
7732 static int i802_check_bridge(struct wpa_driver_nl80211_data *drv,
7733                              struct i802_bss *bss,
7734                              const char *brname, const char *ifname)
7735 {
7736         int ifindex;
7737         char in_br[IFNAMSIZ];
7738
7739         os_strlcpy(bss->brname, brname, IFNAMSIZ);
7740         ifindex = if_nametoindex(brname);
7741         if (ifindex == 0) {
7742                 /*
7743                  * Bridge was configured, but the bridge device does
7744                  * not exist. Try to add it now.
7745                  */
7746                 if (linux_br_add(drv->global->ioctl_sock, brname) < 0) {
7747                         wpa_printf(MSG_ERROR, "nl80211: Failed to add the "
7748                                    "bridge interface %s: %s",
7749                                    brname, strerror(errno));
7750                         return -1;
7751                 }
7752                 bss->added_bridge = 1;
7753                 add_ifidx(drv, if_nametoindex(brname));
7754         }
7755
7756         if (linux_br_get(in_br, ifname) == 0) {
7757                 if (os_strcmp(in_br, brname) == 0)
7758                         return 0; /* already in the bridge */
7759
7760                 wpa_printf(MSG_DEBUG, "nl80211: Removing interface %s from "
7761                            "bridge %s", ifname, in_br);
7762                 if (linux_br_del_if(drv->global->ioctl_sock, in_br, ifname) <
7763                     0) {
7764                         wpa_printf(MSG_ERROR, "nl80211: Failed to "
7765                                    "remove interface %s from bridge "
7766                                    "%s: %s",
7767                                    ifname, brname, strerror(errno));
7768                         return -1;
7769                 }
7770         }
7771
7772         wpa_printf(MSG_DEBUG, "nl80211: Adding interface %s into bridge %s",
7773                    ifname, brname);
7774         if (linux_br_add_if(drv->global->ioctl_sock, brname, ifname) < 0) {
7775                 wpa_printf(MSG_ERROR, "nl80211: Failed to add interface %s "
7776                            "into bridge %s: %s",
7777                            ifname, brname, strerror(errno));
7778                 return -1;
7779         }
7780         bss->added_if_into_bridge = 1;
7781
7782         return 0;
7783 }
7784
7785
7786 static void *i802_init(struct hostapd_data *hapd,
7787                        struct wpa_init_params *params)
7788 {
7789         struct wpa_driver_nl80211_data *drv;
7790         struct i802_bss *bss;
7791         size_t i;
7792         char brname[IFNAMSIZ];
7793         int ifindex, br_ifindex;
7794         int br_added = 0;
7795
7796         bss = wpa_driver_nl80211_init(hapd, params->ifname,
7797                                       params->global_priv);
7798         if (bss == NULL)
7799                 return NULL;
7800
7801         drv = bss->drv;
7802         drv->nlmode = NL80211_IFTYPE_AP;
7803         drv->eapol_sock = -1;
7804
7805         if (linux_br_get(brname, params->ifname) == 0) {
7806                 wpa_printf(MSG_DEBUG, "nl80211: Interface %s is in bridge %s",
7807                            params->ifname, brname);
7808                 br_ifindex = if_nametoindex(brname);
7809         } else {
7810                 brname[0] = '\0';
7811                 br_ifindex = 0;
7812         }
7813
7814         drv->num_if_indices = sizeof(drv->default_if_indices) / sizeof(int);
7815         drv->if_indices = drv->default_if_indices;
7816         for (i = 0; i < params->num_bridge; i++) {
7817                 if (params->bridge[i]) {
7818                         ifindex = if_nametoindex(params->bridge[i]);
7819                         if (ifindex)
7820                                 add_ifidx(drv, ifindex);
7821                         if (ifindex == br_ifindex)
7822                                 br_added = 1;
7823                 }
7824         }
7825         if (!br_added && br_ifindex &&
7826             (params->num_bridge == 0 || !params->bridge[0]))
7827                 add_ifidx(drv, br_ifindex);
7828
7829         /* start listening for EAPOL on the default AP interface */
7830         add_ifidx(drv, drv->ifindex);
7831
7832         if (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 0))
7833                 goto failed;
7834
7835         if (params->bssid) {
7836                 if (linux_set_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
7837                                        params->bssid))
7838                         goto failed;
7839         }
7840
7841         if (wpa_driver_nl80211_set_mode(bss, drv->nlmode)) {
7842                 wpa_printf(MSG_ERROR, "nl80211: Failed to set interface %s "
7843                            "into AP mode", bss->ifname);
7844                 goto failed;
7845         }
7846
7847         if (params->num_bridge && params->bridge[0] &&
7848             i802_check_bridge(drv, bss, params->bridge[0], params->ifname) < 0)
7849                 goto failed;
7850
7851         if (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 1))
7852                 goto failed;
7853
7854         drv->eapol_sock = socket(PF_PACKET, SOCK_DGRAM, htons(ETH_P_PAE));
7855         if (drv->eapol_sock < 0) {
7856                 perror("socket(PF_PACKET, SOCK_DGRAM, ETH_P_PAE)");
7857                 goto failed;
7858         }
7859
7860         if (eloop_register_read_sock(drv->eapol_sock, handle_eapol, drv, NULL))
7861         {
7862                 printf("Could not register read socket for eapol\n");
7863                 goto failed;
7864         }
7865
7866         if (linux_get_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
7867                                params->own_addr))
7868                 goto failed;
7869
7870         memcpy(bss->addr, params->own_addr, ETH_ALEN);
7871
7872         return bss;
7873
7874 failed:
7875         wpa_driver_nl80211_deinit(bss);
7876         return NULL;
7877 }
7878
7879
7880 static void i802_deinit(void *priv)
7881 {
7882         wpa_driver_nl80211_deinit(priv);
7883 }
7884
7885 #endif /* HOSTAPD */
7886
7887
7888 static enum nl80211_iftype wpa_driver_nl80211_if_type(
7889         enum wpa_driver_if_type type)
7890 {
7891         switch (type) {
7892         case WPA_IF_STATION:
7893                 return NL80211_IFTYPE_STATION;
7894         case WPA_IF_P2P_CLIENT:
7895         case WPA_IF_P2P_GROUP:
7896                 return NL80211_IFTYPE_P2P_CLIENT;
7897         case WPA_IF_AP_VLAN:
7898                 return NL80211_IFTYPE_AP_VLAN;
7899         case WPA_IF_AP_BSS:
7900                 return NL80211_IFTYPE_AP;
7901         case WPA_IF_P2P_GO:
7902                 return NL80211_IFTYPE_P2P_GO;
7903         }
7904         return -1;
7905 }
7906
7907
7908 #ifdef CONFIG_P2P
7909
7910 static int nl80211_addr_in_use(struct nl80211_global *global, const u8 *addr)
7911 {
7912         struct wpa_driver_nl80211_data *drv;
7913         dl_list_for_each(drv, &global->interfaces,
7914                          struct wpa_driver_nl80211_data, list) {
7915                 if (os_memcmp(addr, drv->first_bss.addr, ETH_ALEN) == 0)
7916                         return 1;
7917         }
7918         return 0;
7919 }
7920
7921
7922 static int nl80211_p2p_interface_addr(struct wpa_driver_nl80211_data *drv,
7923                                       u8 *new_addr)
7924 {
7925         unsigned int idx;
7926
7927         if (!drv->global)
7928                 return -1;
7929
7930         os_memcpy(new_addr, drv->first_bss.addr, ETH_ALEN);
7931         for (idx = 0; idx < 64; idx++) {
7932                 new_addr[0] = drv->first_bss.addr[0] | 0x02;
7933                 new_addr[0] ^= idx << 2;
7934                 if (!nl80211_addr_in_use(drv->global, new_addr))
7935                         break;
7936         }
7937         if (idx == 64)
7938                 return -1;
7939
7940         wpa_printf(MSG_DEBUG, "nl80211: Assigned new P2P Interface Address "
7941                    MACSTR, MAC2STR(new_addr));
7942
7943         return 0;
7944 }
7945
7946 #endif /* CONFIG_P2P */
7947
7948
7949 static int wpa_driver_nl80211_if_add(void *priv, enum wpa_driver_if_type type,
7950                                      const char *ifname, const u8 *addr,
7951                                      void *bss_ctx, void **drv_priv,
7952                                      char *force_ifname, u8 *if_addr,
7953                                      const char *bridge)
7954 {
7955         struct i802_bss *bss = priv;
7956         struct wpa_driver_nl80211_data *drv = bss->drv;
7957         int ifidx;
7958 #ifdef HOSTAPD
7959         struct i802_bss *new_bss = NULL;
7960
7961         if (type == WPA_IF_AP_BSS) {
7962                 new_bss = os_zalloc(sizeof(*new_bss));
7963                 if (new_bss == NULL)
7964                         return -1;
7965         }
7966 #endif /* HOSTAPD */
7967
7968         if (addr)
7969                 os_memcpy(if_addr, addr, ETH_ALEN);
7970         ifidx = nl80211_create_iface(drv, ifname,
7971                                      wpa_driver_nl80211_if_type(type), addr,
7972                                      0);
7973         if (ifidx < 0) {
7974 #ifdef HOSTAPD
7975                 os_free(new_bss);
7976 #endif /* HOSTAPD */
7977                 return -1;
7978         }
7979
7980         if (!addr &&
7981             linux_get_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
7982                                if_addr) < 0) {
7983                 nl80211_remove_iface(drv, ifidx);
7984                 return -1;
7985         }
7986
7987 #ifdef CONFIG_P2P
7988         if (!addr &&
7989             (type == WPA_IF_P2P_CLIENT || type == WPA_IF_P2P_GROUP ||
7990              type == WPA_IF_P2P_GO)) {
7991                 /* Enforce unique P2P Interface Address */
7992                 u8 new_addr[ETH_ALEN], own_addr[ETH_ALEN];
7993
7994                 if (linux_get_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
7995                                        own_addr) < 0 ||
7996                     linux_get_ifhwaddr(drv->global->ioctl_sock, ifname,
7997                                        new_addr) < 0) {
7998                         nl80211_remove_iface(drv, ifidx);
7999                         return -1;
8000                 }
8001                 if (os_memcmp(own_addr, new_addr, ETH_ALEN) == 0) {
8002                         wpa_printf(MSG_DEBUG, "nl80211: Allocate new address "
8003                                    "for P2P group interface");
8004                         if (nl80211_p2p_interface_addr(drv, new_addr) < 0) {
8005                                 nl80211_remove_iface(drv, ifidx);
8006                                 return -1;
8007                         }
8008                         if (linux_set_ifhwaddr(drv->global->ioctl_sock, ifname,
8009                                                new_addr) < 0) {
8010                                 nl80211_remove_iface(drv, ifidx);
8011                                 return -1;
8012                         }
8013                 }
8014                 os_memcpy(if_addr, new_addr, ETH_ALEN);
8015         }
8016 #endif /* CONFIG_P2P */
8017
8018 #ifdef HOSTAPD
8019         if (bridge &&
8020             i802_check_bridge(drv, new_bss, bridge, ifname) < 0) {
8021                 wpa_printf(MSG_ERROR, "nl80211: Failed to add the new "
8022                            "interface %s to a bridge %s", ifname, bridge);
8023                 nl80211_remove_iface(drv, ifidx);
8024                 os_free(new_bss);
8025                 return -1;
8026         }
8027
8028         if (type == WPA_IF_AP_BSS) {
8029                 if (linux_set_iface_flags(drv->global->ioctl_sock, ifname, 1))
8030                 {
8031                         nl80211_remove_iface(drv, ifidx);
8032                         os_free(new_bss);
8033                         return -1;
8034                 }
8035                 os_strlcpy(new_bss->ifname, ifname, IFNAMSIZ);
8036                 os_memcpy(new_bss->addr, if_addr, ETH_ALEN);
8037                 new_bss->ifindex = ifidx;
8038                 new_bss->drv = drv;
8039                 new_bss->next = drv->first_bss.next;
8040                 new_bss->freq = drv->first_bss.freq;
8041                 drv->first_bss.next = new_bss;
8042                 if (drv_priv)
8043                         *drv_priv = new_bss;
8044                 nl80211_init_bss(new_bss);
8045
8046                 /* Subscribe management frames for this WPA_IF_AP_BSS */
8047                 if (nl80211_setup_ap(new_bss))
8048                         return -1;
8049         }
8050 #endif /* HOSTAPD */
8051
8052         if (drv->global)
8053                 drv->global->if_add_ifindex = ifidx;
8054
8055         return 0;
8056 }
8057
8058
8059 static int wpa_driver_nl80211_if_remove(void *priv,
8060                                         enum wpa_driver_if_type type,
8061                                         const char *ifname)
8062 {
8063         struct i802_bss *bss = priv;
8064         struct wpa_driver_nl80211_data *drv = bss->drv;
8065         int ifindex = if_nametoindex(ifname);
8066
8067         wpa_printf(MSG_DEBUG, "nl80211: %s(type=%d ifname=%s) ifindex=%d",
8068                    __func__, type, ifname, ifindex);
8069         if (ifindex <= 0)
8070                 return -1;
8071
8072         nl80211_remove_iface(drv, ifindex);
8073
8074 #ifdef HOSTAPD
8075         if (type != WPA_IF_AP_BSS)
8076                 return 0;
8077
8078         if (bss->added_if_into_bridge) {
8079                 if (linux_br_del_if(drv->global->ioctl_sock, bss->brname,
8080                                     bss->ifname) < 0)
8081                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
8082                                    "interface %s from bridge %s: %s",
8083                                    bss->ifname, bss->brname, strerror(errno));
8084         }
8085         if (bss->added_bridge) {
8086                 if (linux_br_del(drv->global->ioctl_sock, bss->brname) < 0)
8087                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
8088                                    "bridge %s: %s",
8089                                    bss->brname, strerror(errno));
8090         }
8091
8092         if (bss != &drv->first_bss) {
8093                 struct i802_bss *tbss;
8094
8095                 for (tbss = &drv->first_bss; tbss; tbss = tbss->next) {
8096                         if (tbss->next == bss) {
8097                                 tbss->next = bss->next;
8098                                 /* Unsubscribe management frames */
8099                                 nl80211_teardown_ap(bss);
8100                                 nl80211_destroy_bss(bss);
8101                                 os_free(bss);
8102                                 bss = NULL;
8103                                 break;
8104                         }
8105                 }
8106                 if (bss)
8107                         wpa_printf(MSG_INFO, "nl80211: %s - could not find "
8108                                    "BSS %p in the list", __func__, bss);
8109         }
8110 #endif /* HOSTAPD */
8111
8112         return 0;
8113 }
8114
8115
8116 static int cookie_handler(struct nl_msg *msg, void *arg)
8117 {
8118         struct nlattr *tb[NL80211_ATTR_MAX + 1];
8119         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
8120         u64 *cookie = arg;
8121         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
8122                   genlmsg_attrlen(gnlh, 0), NULL);
8123         if (tb[NL80211_ATTR_COOKIE])
8124                 *cookie = nla_get_u64(tb[NL80211_ATTR_COOKIE]);
8125         return NL_SKIP;
8126 }
8127
8128
8129 static int nl80211_send_frame_cmd(struct i802_bss *bss,
8130                                   unsigned int freq, unsigned int wait,
8131                                   const u8 *buf, size_t buf_len,
8132                                   u64 *cookie_out, int no_cck, int no_ack,
8133                                   int offchanok)
8134 {
8135         struct wpa_driver_nl80211_data *drv = bss->drv;
8136         struct nl_msg *msg;
8137         u64 cookie;
8138         int ret = -1;
8139
8140         msg = nlmsg_alloc();
8141         if (!msg)
8142                 return -1;
8143
8144         wpa_printf(MSG_DEBUG, "nl80211: CMD_FRAME freq=%u wait=%u no_cck=%d "
8145                    "no_ack=%d offchanok=%d",
8146                    freq, wait, no_cck, no_ack, offchanok);
8147         nl80211_cmd(drv, msg, 0, NL80211_CMD_FRAME);
8148
8149         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
8150         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
8151         if (wait)
8152                 NLA_PUT_U32(msg, NL80211_ATTR_DURATION, wait);
8153         if (offchanok && (drv->capa.flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX))
8154                 NLA_PUT_FLAG(msg, NL80211_ATTR_OFFCHANNEL_TX_OK);
8155         if (no_cck)
8156                 NLA_PUT_FLAG(msg, NL80211_ATTR_TX_NO_CCK_RATE);
8157         if (no_ack)
8158                 NLA_PUT_FLAG(msg, NL80211_ATTR_DONT_WAIT_FOR_ACK);
8159
8160         NLA_PUT(msg, NL80211_ATTR_FRAME, buf_len, buf);
8161
8162         cookie = 0;
8163         ret = send_and_recv_msgs(drv, msg, cookie_handler, &cookie);
8164         msg = NULL;
8165         if (ret) {
8166                 wpa_printf(MSG_DEBUG, "nl80211: Frame command failed: ret=%d "
8167                            "(%s) (freq=%u wait=%u)", ret, strerror(-ret),
8168                            freq, wait);
8169                 goto nla_put_failure;
8170         }
8171         wpa_printf(MSG_DEBUG, "nl80211: Frame TX command accepted%s; "
8172                    "cookie 0x%llx", no_ack ? " (no ACK)" : "",
8173                    (long long unsigned int) cookie);
8174
8175         if (cookie_out)
8176                 *cookie_out = no_ack ? (u64) -1 : cookie;
8177
8178 nla_put_failure:
8179         nlmsg_free(msg);
8180         return ret;
8181 }
8182
8183
8184 static int wpa_driver_nl80211_send_action(void *priv, unsigned int freq,
8185                                           unsigned int wait_time,
8186                                           const u8 *dst, const u8 *src,
8187                                           const u8 *bssid,
8188                                           const u8 *data, size_t data_len,
8189                                           int no_cck)
8190 {
8191         struct i802_bss *bss = priv;
8192         struct wpa_driver_nl80211_data *drv = bss->drv;
8193         int ret = -1;
8194         u8 *buf;
8195         struct ieee80211_hdr *hdr;
8196
8197         wpa_printf(MSG_DEBUG, "nl80211: Send Action frame (ifindex=%d, "
8198                    "freq=%u MHz wait=%d ms no_cck=%d)",
8199                    drv->ifindex, freq, wait_time, no_cck);
8200
8201         buf = os_zalloc(24 + data_len);
8202         if (buf == NULL)
8203                 return ret;
8204         os_memcpy(buf + 24, data, data_len);
8205         hdr = (struct ieee80211_hdr *) buf;
8206         hdr->frame_control =
8207                 IEEE80211_FC(WLAN_FC_TYPE_MGMT, WLAN_FC_STYPE_ACTION);
8208         os_memcpy(hdr->addr1, dst, ETH_ALEN);
8209         os_memcpy(hdr->addr2, src, ETH_ALEN);
8210         os_memcpy(hdr->addr3, bssid, ETH_ALEN);
8211
8212         if (is_ap_interface(drv->nlmode))
8213                 ret = wpa_driver_nl80211_send_mlme_freq(priv, buf,
8214                                                         24 + data_len,
8215                                                         0, freq, no_cck, 1,
8216                                                         wait_time);
8217         else
8218                 ret = nl80211_send_frame_cmd(bss, freq, wait_time, buf,
8219                                              24 + data_len,
8220                                              &drv->send_action_cookie,
8221                                              no_cck, 0, 1);
8222
8223         os_free(buf);
8224         return ret;
8225 }
8226
8227
8228 static void wpa_driver_nl80211_send_action_cancel_wait(void *priv)
8229 {
8230         struct i802_bss *bss = priv;
8231         struct wpa_driver_nl80211_data *drv = bss->drv;
8232         struct nl_msg *msg;
8233         int ret;
8234
8235         msg = nlmsg_alloc();
8236         if (!msg)
8237                 return;
8238
8239         nl80211_cmd(drv, msg, 0, NL80211_CMD_FRAME_WAIT_CANCEL);
8240
8241         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
8242         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, drv->send_action_cookie);
8243
8244         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8245         msg = NULL;
8246         if (ret)
8247                 wpa_printf(MSG_DEBUG, "nl80211: wait cancel failed: ret=%d "
8248                            "(%s)", ret, strerror(-ret));
8249
8250  nla_put_failure:
8251         nlmsg_free(msg);
8252 }
8253
8254
8255 static int wpa_driver_nl80211_remain_on_channel(void *priv, unsigned int freq,
8256                                                 unsigned int duration)
8257 {
8258         struct i802_bss *bss = priv;
8259         struct wpa_driver_nl80211_data *drv = bss->drv;
8260         struct nl_msg *msg;
8261         int ret;
8262         u64 cookie;
8263
8264         msg = nlmsg_alloc();
8265         if (!msg)
8266                 return -1;
8267
8268         nl80211_cmd(drv, msg, 0, NL80211_CMD_REMAIN_ON_CHANNEL);
8269
8270         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
8271         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
8272         NLA_PUT_U32(msg, NL80211_ATTR_DURATION, duration);
8273
8274         cookie = 0;
8275         ret = send_and_recv_msgs(drv, msg, cookie_handler, &cookie);
8276         msg = NULL;
8277         if (ret == 0) {
8278                 wpa_printf(MSG_DEBUG, "nl80211: Remain-on-channel cookie "
8279                            "0x%llx for freq=%u MHz duration=%u",
8280                            (long long unsigned int) cookie, freq, duration);
8281                 drv->remain_on_chan_cookie = cookie;
8282                 drv->pending_remain_on_chan = 1;
8283                 return 0;
8284         }
8285         wpa_printf(MSG_DEBUG, "nl80211: Failed to request remain-on-channel "
8286                    "(freq=%d duration=%u): %d (%s)",
8287                    freq, duration, ret, strerror(-ret));
8288 nla_put_failure:
8289         nlmsg_free(msg);
8290         return -1;
8291 }
8292
8293
8294 static int wpa_driver_nl80211_cancel_remain_on_channel(void *priv)
8295 {
8296         struct i802_bss *bss = priv;
8297         struct wpa_driver_nl80211_data *drv = bss->drv;
8298         struct nl_msg *msg;
8299         int ret;
8300
8301         if (!drv->pending_remain_on_chan) {
8302                 wpa_printf(MSG_DEBUG, "nl80211: No pending remain-on-channel "
8303                            "to cancel");
8304                 return -1;
8305         }
8306
8307         wpa_printf(MSG_DEBUG, "nl80211: Cancel remain-on-channel with cookie "
8308                    "0x%llx",
8309                    (long long unsigned int) drv->remain_on_chan_cookie);
8310
8311         msg = nlmsg_alloc();
8312         if (!msg)
8313                 return -1;
8314
8315         nl80211_cmd(drv, msg, 0, NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL);
8316
8317         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
8318         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, drv->remain_on_chan_cookie);
8319
8320         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8321         msg = NULL;
8322         if (ret == 0)
8323                 return 0;
8324         wpa_printf(MSG_DEBUG, "nl80211: Failed to cancel remain-on-channel: "
8325                    "%d (%s)", ret, strerror(-ret));
8326 nla_put_failure:
8327         nlmsg_free(msg);
8328         return -1;
8329 }
8330
8331
8332 static int wpa_driver_nl80211_probe_req_report(void *priv, int report)
8333 {
8334         struct i802_bss *bss = priv;
8335         struct wpa_driver_nl80211_data *drv = bss->drv;
8336
8337         if (!report) {
8338                 if (bss->nl_preq && drv->device_ap_sme &&
8339                     is_ap_interface(drv->nlmode)) {
8340                         /*
8341                          * Do not disable Probe Request reporting that was
8342                          * enabled in nl80211_setup_ap().
8343                          */
8344                         wpa_printf(MSG_DEBUG, "nl80211: Skip disabling of "
8345                                    "Probe Request reporting nl_preq=%p while "
8346                                    "in AP mode", bss->nl_preq);
8347                 } else if (bss->nl_preq) {
8348                         wpa_printf(MSG_DEBUG, "nl80211: Disable Probe Request "
8349                                    "reporting nl_preq=%p", bss->nl_preq);
8350                         eloop_unregister_read_sock(
8351                                 nl_socket_get_fd(bss->nl_preq));
8352                         nl_destroy_handles(&bss->nl_preq);
8353                 }
8354                 return 0;
8355         }
8356
8357         if (bss->nl_preq) {
8358                 wpa_printf(MSG_DEBUG, "nl80211: Probe Request reporting "
8359                            "already on! nl_preq=%p", bss->nl_preq);
8360                 return 0;
8361         }
8362
8363         bss->nl_preq = nl_create_handle(drv->global->nl_cb, "preq");
8364         if (bss->nl_preq == NULL)
8365                 return -1;
8366         wpa_printf(MSG_DEBUG, "nl80211: Enable Probe Request "
8367                    "reporting nl_preq=%p", bss->nl_preq);
8368
8369         if (nl80211_register_frame(bss, bss->nl_preq,
8370                                    (WLAN_FC_TYPE_MGMT << 2) |
8371                                    (WLAN_FC_STYPE_PROBE_REQ << 4),
8372                                    NULL, 0) < 0)
8373                 goto out_err;
8374
8375         eloop_register_read_sock(nl_socket_get_fd(bss->nl_preq),
8376                                  wpa_driver_nl80211_event_receive, bss->nl_cb,
8377                                  bss->nl_preq);
8378
8379         return 0;
8380
8381  out_err:
8382         nl_destroy_handles(&bss->nl_preq);
8383         return -1;
8384 }
8385
8386
8387 static int nl80211_disable_11b_rates(struct wpa_driver_nl80211_data *drv,
8388                                      int ifindex, int disabled)
8389 {
8390         struct nl_msg *msg;
8391         struct nlattr *bands, *band;
8392         int ret;
8393
8394         msg = nlmsg_alloc();
8395         if (!msg)
8396                 return -1;
8397
8398         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_TX_BITRATE_MASK);
8399         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
8400
8401         bands = nla_nest_start(msg, NL80211_ATTR_TX_RATES);
8402         if (!bands)
8403                 goto nla_put_failure;
8404
8405         /*
8406          * Disable 2 GHz rates 1, 2, 5.5, 11 Mbps by masking out everything
8407          * else apart from 6, 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS
8408          * rates. All 5 GHz rates are left enabled.
8409          */
8410         band = nla_nest_start(msg, NL80211_BAND_2GHZ);
8411         if (!band)
8412                 goto nla_put_failure;
8413         if (disabled) {
8414                 NLA_PUT(msg, NL80211_TXRATE_LEGACY, 8,
8415                         "\x0c\x12\x18\x24\x30\x48\x60\x6c");
8416         }
8417         nla_nest_end(msg, band);
8418
8419         nla_nest_end(msg, bands);
8420
8421         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8422         msg = NULL;
8423         if (ret) {
8424                 wpa_printf(MSG_DEBUG, "nl80211: Set TX rates failed: ret=%d "
8425                            "(%s)", ret, strerror(-ret));
8426         } else
8427                 drv->disabled_11b_rates = disabled;
8428
8429         return ret;
8430
8431 nla_put_failure:
8432         nlmsg_free(msg);
8433         return -1;
8434 }
8435
8436
8437 static int wpa_driver_nl80211_deinit_ap(void *priv)
8438 {
8439         struct i802_bss *bss = priv;
8440         struct wpa_driver_nl80211_data *drv = bss->drv;
8441         if (!is_ap_interface(drv->nlmode))
8442                 return -1;
8443         wpa_driver_nl80211_del_beacon(drv);
8444         return wpa_driver_nl80211_set_mode(priv, NL80211_IFTYPE_STATION);
8445 }
8446
8447
8448 static int wpa_driver_nl80211_deinit_p2p_cli(void *priv)
8449 {
8450         struct i802_bss *bss = priv;
8451         struct wpa_driver_nl80211_data *drv = bss->drv;
8452         if (drv->nlmode != NL80211_IFTYPE_P2P_CLIENT)
8453                 return -1;
8454         return wpa_driver_nl80211_set_mode(priv, NL80211_IFTYPE_STATION);
8455 }
8456
8457
8458 static void wpa_driver_nl80211_resume(void *priv)
8459 {
8460         struct i802_bss *bss = priv;
8461         struct wpa_driver_nl80211_data *drv = bss->drv;
8462         if (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 1)) {
8463                 wpa_printf(MSG_DEBUG, "nl80211: Failed to set interface up on "
8464                            "resume event");
8465         }
8466 }
8467
8468
8469 static int nl80211_send_ft_action(void *priv, u8 action, const u8 *target_ap,
8470                                   const u8 *ies, size_t ies_len)
8471 {
8472         struct i802_bss *bss = priv;
8473         struct wpa_driver_nl80211_data *drv = bss->drv;
8474         int ret;
8475         u8 *data, *pos;
8476         size_t data_len;
8477         const u8 *own_addr = bss->addr;
8478
8479         if (action != 1) {
8480                 wpa_printf(MSG_ERROR, "nl80211: Unsupported send_ft_action "
8481                            "action %d", action);
8482                 return -1;
8483         }
8484
8485         /*
8486          * Action frame payload:
8487          * Category[1] = 6 (Fast BSS Transition)
8488          * Action[1] = 1 (Fast BSS Transition Request)
8489          * STA Address
8490          * Target AP Address
8491          * FT IEs
8492          */
8493
8494         data_len = 2 + 2 * ETH_ALEN + ies_len;
8495         data = os_malloc(data_len);
8496         if (data == NULL)
8497                 return -1;
8498         pos = data;
8499         *pos++ = 0x06; /* FT Action category */
8500         *pos++ = action;
8501         os_memcpy(pos, own_addr, ETH_ALEN);
8502         pos += ETH_ALEN;
8503         os_memcpy(pos, target_ap, ETH_ALEN);
8504         pos += ETH_ALEN;
8505         os_memcpy(pos, ies, ies_len);
8506
8507         ret = wpa_driver_nl80211_send_action(bss, drv->assoc_freq, 0,
8508                                              drv->bssid, own_addr, drv->bssid,
8509                                              data, data_len, 0);
8510         os_free(data);
8511
8512         return ret;
8513 }
8514
8515
8516 static int nl80211_signal_monitor(void *priv, int threshold, int hysteresis)
8517 {
8518         struct i802_bss *bss = priv;
8519         struct wpa_driver_nl80211_data *drv = bss->drv;
8520         struct nl_msg *msg, *cqm = NULL;
8521         int ret = -1;
8522
8523         wpa_printf(MSG_DEBUG, "nl80211: Signal monitor threshold=%d "
8524                    "hysteresis=%d", threshold, hysteresis);
8525
8526         msg = nlmsg_alloc();
8527         if (!msg)
8528                 return -1;
8529
8530         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_CQM);
8531
8532         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
8533
8534         cqm = nlmsg_alloc();
8535         if (cqm == NULL)
8536                 goto nla_put_failure;
8537
8538         NLA_PUT_U32(cqm, NL80211_ATTR_CQM_RSSI_THOLD, threshold);
8539         NLA_PUT_U32(cqm, NL80211_ATTR_CQM_RSSI_HYST, hysteresis);
8540         if (nla_put_nested(msg, NL80211_ATTR_CQM, cqm) < 0)
8541                 goto nla_put_failure;
8542
8543         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8544         msg = NULL;
8545
8546 nla_put_failure:
8547         nlmsg_free(cqm);
8548         nlmsg_free(msg);
8549         return ret;
8550 }
8551
8552
8553 static int nl80211_signal_poll(void *priv, struct wpa_signal_info *si)
8554 {
8555         struct i802_bss *bss = priv;
8556         struct wpa_driver_nl80211_data *drv = bss->drv;
8557         int res;
8558
8559         os_memset(si, 0, sizeof(*si));
8560         res = nl80211_get_link_signal(drv, si);
8561         if (res != 0)
8562                 return res;
8563
8564         return nl80211_get_link_noise(drv, si);
8565 }
8566
8567
8568 static int wpa_driver_nl80211_shared_freq(void *priv)
8569 {
8570         struct i802_bss *bss = priv;
8571         struct wpa_driver_nl80211_data *drv = bss->drv;
8572         struct wpa_driver_nl80211_data *driver;
8573         int freq = 0;
8574
8575         /*
8576          * If the same PHY is in connected state with some other interface,
8577          * then retrieve the assoc freq.
8578          */
8579         wpa_printf(MSG_DEBUG, "nl80211: Get shared freq for PHY %s",
8580                    drv->phyname);
8581
8582         dl_list_for_each(driver, &drv->global->interfaces,
8583                          struct wpa_driver_nl80211_data, list) {
8584                 if (drv == driver ||
8585                     os_strcmp(drv->phyname, driver->phyname) != 0 ||
8586                     !driver->associated)
8587                         continue;
8588
8589                 wpa_printf(MSG_DEBUG, "nl80211: Found a match for PHY %s - %s "
8590                            MACSTR,
8591                            driver->phyname, driver->first_bss.ifname,
8592                            MAC2STR(driver->first_bss.addr));
8593                 if (is_ap_interface(driver->nlmode))
8594                         freq = driver->first_bss.freq;
8595                 else
8596                         freq = nl80211_get_assoc_freq(driver);
8597                 wpa_printf(MSG_DEBUG, "nl80211: Shared freq for PHY %s: %d",
8598                            drv->phyname, freq);
8599         }
8600
8601         if (!freq)
8602                 wpa_printf(MSG_DEBUG, "nl80211: No shared interface for "
8603                            "PHY (%s) in associated state", drv->phyname);
8604
8605         return freq;
8606 }
8607
8608
8609 static int nl80211_send_frame(void *priv, const u8 *data, size_t data_len,
8610                               int encrypt)
8611 {
8612         struct i802_bss *bss = priv;
8613         return wpa_driver_nl80211_send_frame(bss, data, data_len, encrypt, 0,
8614                                              0, 0, 0, 0);
8615 }
8616
8617
8618 static int nl80211_set_param(void *priv, const char *param)
8619 {
8620         wpa_printf(MSG_DEBUG, "nl80211: driver param='%s'", param);
8621         if (param == NULL)
8622                 return 0;
8623
8624 #ifdef CONFIG_P2P
8625         if (os_strstr(param, "use_p2p_group_interface=1")) {
8626                 struct i802_bss *bss = priv;
8627                 struct wpa_driver_nl80211_data *drv = bss->drv;
8628
8629                 wpa_printf(MSG_DEBUG, "nl80211: Use separate P2P group "
8630                            "interface");
8631                 drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_CONCURRENT;
8632                 drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_MGMT_AND_NON_P2P;
8633         }
8634 #endif /* CONFIG_P2P */
8635
8636         return 0;
8637 }
8638
8639
8640 static void * nl80211_global_init(void)
8641 {
8642         struct nl80211_global *global;
8643         struct netlink_config *cfg;
8644
8645         global = os_zalloc(sizeof(*global));
8646         if (global == NULL)
8647                 return NULL;
8648         global->ioctl_sock = -1;
8649         dl_list_init(&global->interfaces);
8650         global->if_add_ifindex = -1;
8651
8652         cfg = os_zalloc(sizeof(*cfg));
8653         if (cfg == NULL)
8654                 goto err;
8655
8656         cfg->ctx = global;
8657         cfg->newlink_cb = wpa_driver_nl80211_event_rtm_newlink;
8658         cfg->dellink_cb = wpa_driver_nl80211_event_rtm_dellink;
8659         global->netlink = netlink_init(cfg);
8660         if (global->netlink == NULL) {
8661                 os_free(cfg);
8662                 goto err;
8663         }
8664
8665         if (wpa_driver_nl80211_init_nl_global(global) < 0)
8666                 goto err;
8667
8668         global->ioctl_sock = socket(PF_INET, SOCK_DGRAM, 0);
8669         if (global->ioctl_sock < 0) {
8670                 perror("socket(PF_INET,SOCK_DGRAM)");
8671                 goto err;
8672         }
8673
8674         return global;
8675
8676 err:
8677         nl80211_global_deinit(global);
8678         return NULL;
8679 }
8680
8681
8682 static void nl80211_global_deinit(void *priv)
8683 {
8684         struct nl80211_global *global = priv;
8685         if (global == NULL)
8686                 return;
8687         if (!dl_list_empty(&global->interfaces)) {
8688                 wpa_printf(MSG_ERROR, "nl80211: %u interface(s) remain at "
8689                            "nl80211_global_deinit",
8690                            dl_list_len(&global->interfaces));
8691         }
8692
8693         if (global->netlink)
8694                 netlink_deinit(global->netlink);
8695
8696         nl_destroy_handles(&global->nl);
8697
8698         if (global->nl_event) {
8699                 eloop_unregister_read_sock(
8700                         nl_socket_get_fd(global->nl_event));
8701                 nl_destroy_handles(&global->nl_event);
8702         }
8703
8704         nl_cb_put(global->nl_cb);
8705
8706         if (global->ioctl_sock >= 0)
8707                 close(global->ioctl_sock);
8708
8709         os_free(global);
8710 }
8711
8712
8713 static const char * nl80211_get_radio_name(void *priv)
8714 {
8715         struct i802_bss *bss = priv;
8716         struct wpa_driver_nl80211_data *drv = bss->drv;
8717         return drv->phyname;
8718 }
8719
8720
8721 static int nl80211_pmkid(struct i802_bss *bss, int cmd, const u8 *bssid,
8722                          const u8 *pmkid)
8723 {
8724         struct nl_msg *msg;
8725
8726         msg = nlmsg_alloc();
8727         if (!msg)
8728                 return -ENOMEM;
8729
8730         nl80211_cmd(bss->drv, msg, 0, cmd);
8731
8732         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
8733         if (pmkid)
8734                 NLA_PUT(msg, NL80211_ATTR_PMKID, 16, pmkid);
8735         if (bssid)
8736                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
8737
8738         return send_and_recv_msgs(bss->drv, msg, NULL, NULL);
8739  nla_put_failure:
8740         nlmsg_free(msg);
8741         return -ENOBUFS;
8742 }
8743
8744
8745 static int nl80211_add_pmkid(void *priv, const u8 *bssid, const u8 *pmkid)
8746 {
8747         struct i802_bss *bss = priv;
8748         wpa_printf(MSG_DEBUG, "nl80211: Add PMKID for " MACSTR, MAC2STR(bssid));
8749         return nl80211_pmkid(bss, NL80211_CMD_SET_PMKSA, bssid, pmkid);
8750 }
8751
8752
8753 static int nl80211_remove_pmkid(void *priv, const u8 *bssid, const u8 *pmkid)
8754 {
8755         struct i802_bss *bss = priv;
8756         wpa_printf(MSG_DEBUG, "nl80211: Delete PMKID for " MACSTR,
8757                    MAC2STR(bssid));
8758         return nl80211_pmkid(bss, NL80211_CMD_DEL_PMKSA, bssid, pmkid);
8759 }
8760
8761
8762 static int nl80211_flush_pmkid(void *priv)
8763 {
8764         struct i802_bss *bss = priv;
8765         wpa_printf(MSG_DEBUG, "nl80211: Flush PMKIDs");
8766         return nl80211_pmkid(bss, NL80211_CMD_FLUSH_PMKSA, NULL, NULL);
8767 }
8768
8769
8770 static void nl80211_set_rekey_info(void *priv, const u8 *kek, const u8 *kck,
8771                                    const u8 *replay_ctr)
8772 {
8773         struct i802_bss *bss = priv;
8774         struct wpa_driver_nl80211_data *drv = bss->drv;
8775         struct nlattr *replay_nested;
8776         struct nl_msg *msg;
8777
8778         msg = nlmsg_alloc();
8779         if (!msg)
8780                 return;
8781
8782         nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
8783
8784         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
8785
8786         replay_nested = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
8787         if (!replay_nested)
8788                 goto nla_put_failure;
8789
8790         NLA_PUT(msg, NL80211_REKEY_DATA_KEK, NL80211_KEK_LEN, kek);
8791         NLA_PUT(msg, NL80211_REKEY_DATA_KCK, NL80211_KCK_LEN, kck);
8792         NLA_PUT(msg, NL80211_REKEY_DATA_REPLAY_CTR, NL80211_REPLAY_CTR_LEN,
8793                 replay_ctr);
8794
8795         nla_nest_end(msg, replay_nested);
8796
8797         send_and_recv_msgs(drv, msg, NULL, NULL);
8798         return;
8799  nla_put_failure:
8800         nlmsg_free(msg);
8801 }
8802
8803
8804 static void nl80211_send_null_frame(struct i802_bss *bss, const u8 *own_addr,
8805                                     const u8 *addr, int qos)
8806 {
8807         /* send data frame to poll STA and check whether
8808          * this frame is ACKed */
8809         struct {
8810                 struct ieee80211_hdr hdr;
8811                 u16 qos_ctl;
8812         } STRUCT_PACKED nulldata;
8813         size_t size;
8814
8815         /* Send data frame to poll STA and check whether this frame is ACKed */
8816
8817         os_memset(&nulldata, 0, sizeof(nulldata));
8818
8819         if (qos) {
8820                 nulldata.hdr.frame_control =
8821                         IEEE80211_FC(WLAN_FC_TYPE_DATA,
8822                                      WLAN_FC_STYPE_QOS_NULL);
8823                 size = sizeof(nulldata);
8824         } else {
8825                 nulldata.hdr.frame_control =
8826                         IEEE80211_FC(WLAN_FC_TYPE_DATA,
8827                                      WLAN_FC_STYPE_NULLFUNC);
8828                 size = sizeof(struct ieee80211_hdr);
8829         }
8830
8831         nulldata.hdr.frame_control |= host_to_le16(WLAN_FC_FROMDS);
8832         os_memcpy(nulldata.hdr.IEEE80211_DA_FROMDS, addr, ETH_ALEN);
8833         os_memcpy(nulldata.hdr.IEEE80211_BSSID_FROMDS, own_addr, ETH_ALEN);
8834         os_memcpy(nulldata.hdr.IEEE80211_SA_FROMDS, own_addr, ETH_ALEN);
8835
8836         if (wpa_driver_nl80211_send_mlme(bss, (u8 *) &nulldata, size, 0) < 0)
8837                 wpa_printf(MSG_DEBUG, "nl80211_send_null_frame: Failed to "
8838                            "send poll frame");
8839 }
8840
8841 static void nl80211_poll_client(void *priv, const u8 *own_addr, const u8 *addr,
8842                                 int qos)
8843 {
8844         struct i802_bss *bss = priv;
8845         struct wpa_driver_nl80211_data *drv = bss->drv;
8846         struct nl_msg *msg;
8847
8848         if (!drv->poll_command_supported) {
8849                 nl80211_send_null_frame(bss, own_addr, addr, qos);
8850                 return;
8851         }
8852
8853         msg = nlmsg_alloc();
8854         if (!msg)
8855                 return;
8856
8857         nl80211_cmd(drv, msg, 0, NL80211_CMD_PROBE_CLIENT);
8858
8859         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
8860         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
8861
8862         send_and_recv_msgs(drv, msg, NULL, NULL);
8863         return;
8864  nla_put_failure:
8865         nlmsg_free(msg);
8866 }
8867
8868
8869 static int nl80211_set_power_save(struct i802_bss *bss, int enabled)
8870 {
8871         struct nl_msg *msg;
8872
8873         msg = nlmsg_alloc();
8874         if (!msg)
8875                 return -ENOMEM;
8876
8877         nl80211_cmd(bss->drv, msg, 0, NL80211_CMD_SET_POWER_SAVE);
8878         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
8879         NLA_PUT_U32(msg, NL80211_ATTR_PS_STATE,
8880                     enabled ? NL80211_PS_ENABLED : NL80211_PS_DISABLED);
8881         return send_and_recv_msgs(bss->drv, msg, NULL, NULL);
8882 nla_put_failure:
8883         nlmsg_free(msg);
8884         return -ENOBUFS;
8885 }
8886
8887
8888 static int nl80211_set_p2p_powersave(void *priv, int legacy_ps, int opp_ps,
8889                                      int ctwindow)
8890 {
8891         struct i802_bss *bss = priv;
8892
8893         wpa_printf(MSG_DEBUG, "nl80211: set_p2p_powersave (legacy_ps=%d "
8894                    "opp_ps=%d ctwindow=%d)", legacy_ps, opp_ps, ctwindow);
8895
8896         if (opp_ps != -1 || ctwindow != -1)
8897                 return -1; /* Not yet supported */
8898
8899         if (legacy_ps == -1)
8900                 return 0;
8901         if (legacy_ps != 0 && legacy_ps != 1)
8902                 return -1; /* Not yet supported */
8903
8904         return nl80211_set_power_save(bss, legacy_ps);
8905 }
8906
8907
8908 #ifdef CONFIG_TDLS
8909
8910 static int nl80211_send_tdls_mgmt(void *priv, const u8 *dst, u8 action_code,
8911                                   u8 dialog_token, u16 status_code,
8912                                   const u8 *buf, size_t len)
8913 {
8914         struct i802_bss *bss = priv;
8915         struct wpa_driver_nl80211_data *drv = bss->drv;
8916         struct nl_msg *msg;
8917
8918         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT))
8919                 return -EOPNOTSUPP;
8920
8921         if (!dst)
8922                 return -EINVAL;
8923
8924         msg = nlmsg_alloc();
8925         if (!msg)
8926                 return -ENOMEM;
8927
8928         nl80211_cmd(drv, msg, 0, NL80211_CMD_TDLS_MGMT);
8929         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
8930         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
8931         NLA_PUT_U8(msg, NL80211_ATTR_TDLS_ACTION, action_code);
8932         NLA_PUT_U8(msg, NL80211_ATTR_TDLS_DIALOG_TOKEN, dialog_token);
8933         NLA_PUT_U16(msg, NL80211_ATTR_STATUS_CODE, status_code);
8934         NLA_PUT(msg, NL80211_ATTR_IE, len, buf);
8935
8936         return send_and_recv_msgs(drv, msg, NULL, NULL);
8937
8938 nla_put_failure:
8939         nlmsg_free(msg);
8940         return -ENOBUFS;
8941 }
8942
8943
8944 static int nl80211_tdls_oper(void *priv, enum tdls_oper oper, const u8 *peer)
8945 {
8946         struct i802_bss *bss = priv;
8947         struct wpa_driver_nl80211_data *drv = bss->drv;
8948         struct nl_msg *msg;
8949         enum nl80211_tdls_operation nl80211_oper;
8950
8951         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT))
8952                 return -EOPNOTSUPP;
8953
8954         switch (oper) {
8955         case TDLS_DISCOVERY_REQ:
8956                 nl80211_oper = NL80211_TDLS_DISCOVERY_REQ;
8957                 break;
8958         case TDLS_SETUP:
8959                 nl80211_oper = NL80211_TDLS_SETUP;
8960                 break;
8961         case TDLS_TEARDOWN:
8962                 nl80211_oper = NL80211_TDLS_TEARDOWN;
8963                 break;
8964         case TDLS_ENABLE_LINK:
8965                 nl80211_oper = NL80211_TDLS_ENABLE_LINK;
8966                 break;
8967         case TDLS_DISABLE_LINK:
8968                 nl80211_oper = NL80211_TDLS_DISABLE_LINK;
8969                 break;
8970         case TDLS_ENABLE:
8971                 return 0;
8972         case TDLS_DISABLE:
8973                 return 0;
8974         default:
8975                 return -EINVAL;
8976         }
8977
8978         msg = nlmsg_alloc();
8979         if (!msg)
8980                 return -ENOMEM;
8981
8982         nl80211_cmd(drv, msg, 0, NL80211_CMD_TDLS_OPER);
8983         NLA_PUT_U8(msg, NL80211_ATTR_TDLS_OPERATION, nl80211_oper);
8984         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
8985         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, peer);
8986
8987         return send_and_recv_msgs(drv, msg, NULL, NULL);
8988
8989 nla_put_failure:
8990         nlmsg_free(msg);
8991         return -ENOBUFS;
8992 }
8993
8994 #endif /* CONFIG TDLS */
8995
8996
8997 #ifdef ANDROID
8998
8999 typedef struct android_wifi_priv_cmd {
9000         char *buf;
9001         int used_len;
9002         int total_len;
9003 } android_wifi_priv_cmd;
9004
9005 static int drv_errors = 0;
9006
9007 static void wpa_driver_send_hang_msg(struct wpa_driver_nl80211_data *drv)
9008 {
9009         drv_errors++;
9010         if (drv_errors > DRV_NUMBER_SEQUENTIAL_ERRORS) {
9011                 drv_errors = 0;
9012                 wpa_msg(drv->ctx, MSG_INFO, WPA_EVENT_DRIVER_STATE "HANGED");
9013         }
9014 }
9015
9016
9017 static int android_priv_cmd(struct i802_bss *bss, const char *cmd)
9018 {
9019         struct wpa_driver_nl80211_data *drv = bss->drv;
9020         struct ifreq ifr;
9021         android_wifi_priv_cmd priv_cmd;
9022         char buf[MAX_DRV_CMD_SIZE];
9023         int ret;
9024
9025         os_memset(&ifr, 0, sizeof(ifr));
9026         os_memset(&priv_cmd, 0, sizeof(priv_cmd));
9027         os_strlcpy(ifr.ifr_name, bss->ifname, IFNAMSIZ);
9028
9029         os_memset(buf, 0, sizeof(buf));
9030         os_strlcpy(buf, cmd, sizeof(buf));
9031
9032         priv_cmd.buf = buf;
9033         priv_cmd.used_len = sizeof(buf);
9034         priv_cmd.total_len = sizeof(buf);
9035         ifr.ifr_data = &priv_cmd;
9036
9037         ret = ioctl(drv->global->ioctl_sock, SIOCDEVPRIVATE + 1, &ifr);
9038         if (ret < 0) {
9039                 wpa_printf(MSG_ERROR, "%s: failed to issue private commands",
9040                            __func__);
9041                 wpa_driver_send_hang_msg(drv);
9042                 return ret;
9043         }
9044
9045         drv_errors = 0;
9046         return 0;
9047 }
9048
9049
9050 static int android_pno_start(struct i802_bss *bss,
9051                              struct wpa_driver_scan_params *params)
9052 {
9053         struct wpa_driver_nl80211_data *drv = bss->drv;
9054         struct ifreq ifr;
9055         android_wifi_priv_cmd priv_cmd;
9056         int ret = 0, i = 0, bp;
9057         char buf[WEXT_PNO_MAX_COMMAND_SIZE];
9058
9059         bp = WEXT_PNOSETUP_HEADER_SIZE;
9060         os_memcpy(buf, WEXT_PNOSETUP_HEADER, bp);
9061         buf[bp++] = WEXT_PNO_TLV_PREFIX;
9062         buf[bp++] = WEXT_PNO_TLV_VERSION;
9063         buf[bp++] = WEXT_PNO_TLV_SUBVERSION;
9064         buf[bp++] = WEXT_PNO_TLV_RESERVED;
9065
9066         while (i < WEXT_PNO_AMOUNT && (size_t) i < params->num_ssids) {
9067                 /* Check that there is enough space needed for 1 more SSID, the
9068                  * other sections and null termination */
9069                 if ((bp + WEXT_PNO_SSID_HEADER_SIZE + MAX_SSID_LEN +
9070                      WEXT_PNO_NONSSID_SECTIONS_SIZE + 1) >= (int) sizeof(buf))
9071                         break;
9072                 wpa_hexdump_ascii(MSG_DEBUG, "For PNO Scan",
9073                                   params->ssids[i].ssid,
9074                                   params->ssids[i].ssid_len);
9075                 buf[bp++] = WEXT_PNO_SSID_SECTION;
9076                 buf[bp++] = params->ssids[i].ssid_len;
9077                 os_memcpy(&buf[bp], params->ssids[i].ssid,
9078                           params->ssids[i].ssid_len);
9079                 bp += params->ssids[i].ssid_len;
9080                 i++;
9081         }
9082
9083         buf[bp++] = WEXT_PNO_SCAN_INTERVAL_SECTION;
9084         os_snprintf(&buf[bp], WEXT_PNO_SCAN_INTERVAL_LENGTH + 1, "%x",
9085                     WEXT_PNO_SCAN_INTERVAL);
9086         bp += WEXT_PNO_SCAN_INTERVAL_LENGTH;
9087
9088         buf[bp++] = WEXT_PNO_REPEAT_SECTION;
9089         os_snprintf(&buf[bp], WEXT_PNO_REPEAT_LENGTH + 1, "%x",
9090                     WEXT_PNO_REPEAT);
9091         bp += WEXT_PNO_REPEAT_LENGTH;
9092
9093         buf[bp++] = WEXT_PNO_MAX_REPEAT_SECTION;
9094         os_snprintf(&buf[bp], WEXT_PNO_MAX_REPEAT_LENGTH + 1, "%x",
9095                     WEXT_PNO_MAX_REPEAT);
9096         bp += WEXT_PNO_MAX_REPEAT_LENGTH + 1;
9097
9098         memset(&ifr, 0, sizeof(ifr));
9099         memset(&priv_cmd, 0, sizeof(priv_cmd));
9100         os_strncpy(ifr.ifr_name, bss->ifname, IFNAMSIZ);
9101
9102         priv_cmd.buf = buf;
9103         priv_cmd.used_len = bp;
9104         priv_cmd.total_len = bp;
9105         ifr.ifr_data = &priv_cmd;
9106
9107         ret = ioctl(drv->global->ioctl_sock, SIOCDEVPRIVATE + 1, &ifr);
9108
9109         if (ret < 0) {
9110                 wpa_printf(MSG_ERROR, "ioctl[SIOCSIWPRIV] (pnosetup): %d",
9111                            ret);
9112                 wpa_driver_send_hang_msg(drv);
9113                 return ret;
9114         }
9115
9116         drv_errors = 0;
9117
9118         return android_priv_cmd(bss, "PNOFORCE 1");
9119 }
9120
9121
9122 static int android_pno_stop(struct i802_bss *bss)
9123 {
9124         return android_priv_cmd(bss, "PNOFORCE 0");
9125 }
9126
9127 #endif /* ANDROID */
9128
9129
9130 const struct wpa_driver_ops wpa_driver_nl80211_ops = {
9131         .name = "nl80211",
9132         .desc = "Linux nl80211/cfg80211",
9133         .get_bssid = wpa_driver_nl80211_get_bssid,
9134         .get_ssid = wpa_driver_nl80211_get_ssid,
9135         .set_key = wpa_driver_nl80211_set_key,
9136         .scan2 = wpa_driver_nl80211_scan,
9137         .sched_scan = wpa_driver_nl80211_sched_scan,
9138         .stop_sched_scan = wpa_driver_nl80211_stop_sched_scan,
9139         .get_scan_results2 = wpa_driver_nl80211_get_scan_results,
9140         .deauthenticate = wpa_driver_nl80211_deauthenticate,
9141         .disassociate = wpa_driver_nl80211_disassociate,
9142         .authenticate = wpa_driver_nl80211_authenticate,
9143         .associate = wpa_driver_nl80211_associate,
9144         .global_init = nl80211_global_init,
9145         .global_deinit = nl80211_global_deinit,
9146         .init2 = wpa_driver_nl80211_init,
9147         .deinit = wpa_driver_nl80211_deinit,
9148         .get_capa = wpa_driver_nl80211_get_capa,
9149         .set_operstate = wpa_driver_nl80211_set_operstate,
9150         .set_supp_port = wpa_driver_nl80211_set_supp_port,
9151         .set_country = wpa_driver_nl80211_set_country,
9152         .set_ap = wpa_driver_nl80211_set_ap,
9153         .if_add = wpa_driver_nl80211_if_add,
9154         .if_remove = wpa_driver_nl80211_if_remove,
9155         .send_mlme = wpa_driver_nl80211_send_mlme,
9156         .get_hw_feature_data = wpa_driver_nl80211_get_hw_feature_data,
9157         .sta_add = wpa_driver_nl80211_sta_add,
9158         .sta_remove = wpa_driver_nl80211_sta_remove,
9159         .hapd_send_eapol = wpa_driver_nl80211_hapd_send_eapol,
9160         .sta_set_flags = wpa_driver_nl80211_sta_set_flags,
9161 #ifdef HOSTAPD
9162         .hapd_init = i802_init,
9163         .hapd_deinit = i802_deinit,
9164         .set_wds_sta = i802_set_wds_sta,
9165 #endif /* HOSTAPD */
9166 #if defined(HOSTAPD) || defined(CONFIG_AP)
9167         .get_seqnum = i802_get_seqnum,
9168         .flush = i802_flush,
9169         .get_inact_sec = i802_get_inact_sec,
9170         .sta_clear_stats = i802_sta_clear_stats,
9171         .set_rts = i802_set_rts,
9172         .set_frag = i802_set_frag,
9173         .set_tx_queue_params = i802_set_tx_queue_params,
9174         .set_sta_vlan = i802_set_sta_vlan,
9175         .sta_deauth = i802_sta_deauth,
9176         .sta_disassoc = i802_sta_disassoc,
9177 #endif /* HOSTAPD || CONFIG_AP */
9178         .read_sta_data = i802_read_sta_data,
9179         .set_freq = i802_set_freq,
9180         .send_action = wpa_driver_nl80211_send_action,
9181         .send_action_cancel_wait = wpa_driver_nl80211_send_action_cancel_wait,
9182         .remain_on_channel = wpa_driver_nl80211_remain_on_channel,
9183         .cancel_remain_on_channel =
9184         wpa_driver_nl80211_cancel_remain_on_channel,
9185         .probe_req_report = wpa_driver_nl80211_probe_req_report,
9186         .deinit_ap = wpa_driver_nl80211_deinit_ap,
9187         .deinit_p2p_cli = wpa_driver_nl80211_deinit_p2p_cli,
9188         .resume = wpa_driver_nl80211_resume,
9189         .send_ft_action = nl80211_send_ft_action,
9190         .signal_monitor = nl80211_signal_monitor,
9191         .signal_poll = nl80211_signal_poll,
9192         .send_frame = nl80211_send_frame,
9193         .shared_freq = wpa_driver_nl80211_shared_freq,
9194         .set_param = nl80211_set_param,
9195         .get_radio_name = nl80211_get_radio_name,
9196         .add_pmkid = nl80211_add_pmkid,
9197         .remove_pmkid = nl80211_remove_pmkid,
9198         .flush_pmkid = nl80211_flush_pmkid,
9199         .set_rekey_info = nl80211_set_rekey_info,
9200         .poll_client = nl80211_poll_client,
9201         .set_p2p_powersave = nl80211_set_p2p_powersave,
9202 #ifdef CONFIG_TDLS
9203         .send_tdls_mgmt = nl80211_send_tdls_mgmt,
9204         .tdls_oper = nl80211_tdls_oper,
9205 #endif /* CONFIG_TDLS */
9206 };