src/drivers/driver_nl80211.c

   1 /*
   2  * Driver interaction with Linux nl80211/cfg80211
   3  * Copyright (c) 2002-2014, Jouni Malinen <j@w1.fi>
   4  * Copyright (c) 2003-2004, Instant802 Networks, Inc.
   5  * Copyright (c) 2005-2006, Devicescape Software, Inc.
   6  * Copyright (c) 2007, Johannes Berg <johannes@sipsolutions.net>
   7  * Copyright (c) 2009-2010, Atheros Communications
   8  *
   9  * This software may be distributed under the terms of the BSD license.
  10  * See README for more details.
  11  */
  12
  13 #include "includes.h"
  14 #include <sys/types.h>
  15 #include <fcntl.h>
  16 #include <net/if.h>
  17 #include <netlink/genl/genl.h>
  18 #include <netlink/genl/ctrl.h>
  19 #ifdef CONFIG_LIBNL3_ROUTE
  20 #include <netlink/route/neighbour.h>
  21 #endif /* CONFIG_LIBNL3_ROUTE */
  22 #include <linux/rtnetlink.h>
  23 #include <netpacket/packet.h>
  24 #include <linux/errqueue.h>
  25
  26 #include "common.h"
  27 #include "eloop.h"
  28 #include "common/qca-vendor.h"
  29 #include "common/qca-vendor-attr.h"
  30 #include "common/ieee802_11_defs.h"
  31 #include "common/ieee802_11_common.h"
  32 #include "l2_packet/l2_packet.h"
  33 #include "netlink.h"
  34 #include "linux_defines.h"
  35 #include "linux_ioctl.h"
  36 #include "radiotap.h"
  37 #include "radiotap_iter.h"
  38 #include "rfkill.h"
  39 #include "driver_nl80211.h"
  40
  41
  42 #ifndef CONFIG_LIBNL20
  43 /*
  44  * libnl 1.1 has a bug, it tries to allocate socket numbers densely
  45  * but when you free a socket again it will mess up its bitmap and
  46  * and use the wrong number the next time it needs a socket ID.
  47  * Therefore, we wrap the handle alloc/destroy and add our own pid
  48  * accounting.
  49  */
  50 static uint32_t port_bitmap[32] = { 0 };
  51
  52 static struct nl_handle *nl80211_handle_alloc(void *cb)
  53 {
  54         struct nl_handle *handle;
  55         uint32_t pid = getpid() & 0x3FFFFF;
  56         int i;
  57
  58         handle = nl_handle_alloc_cb(cb);
  59
  60         for (i = 0; i < 1024; i++) {
  61                 if (port_bitmap[i / 32] & (1 << (i % 32)))
  62                         continue;
  63                 port_bitmap[i / 32] |= 1 << (i % 32);
  64                 pid += i << 22;
  65                 break;
  66         }
  67
  68         nl_socket_set_local_port(handle, pid);
  69
  70         return handle;
  71 }
  72
  73 static void nl80211_handle_destroy(struct nl_handle *handle)
  74 {
  75         uint32_t port = nl_socket_get_local_port(handle);
  76
  77         port >>= 22;
  78         port_bitmap[port / 32] &= ~(1 << (port % 32));
  79
  80         nl_handle_destroy(handle);
  81 }
  82 #endif /* CONFIG_LIBNL20 */
  83
  84
  85 #ifdef ANDROID
  86 /* system/core/libnl_2 does not include nl_socket_set_nonblocking() */
  87 #undef nl_socket_set_nonblocking
  88 #define nl_socket_set_nonblocking(h) android_nl_socket_set_nonblocking(h)
  89
  90 #define genl_ctrl_resolve android_genl_ctrl_resolve
  91 #endif /* ANDROID */
  92
  93
  94 static struct nl_handle * nl_create_handle(struct nl_cb *cb, const char *dbg)
  95 {
  96         struct nl_handle *handle;
  97
  98         handle = nl80211_handle_alloc(cb);
  99         if (handle == NULL) {
 100                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate netlink "
 101                            "callbacks (%s)", dbg);
 102                 return NULL;
 103         }
 104
 105         if (genl_connect(handle)) {
 106                 wpa_printf(MSG_ERROR, "nl80211: Failed to connect to generic "
 107                            "netlink (%s)", dbg);
 108                 nl80211_handle_destroy(handle);
 109                 return NULL;
 110         }
 111
 112         return handle;
 113 }
 114
 115
 116 static void nl_destroy_handles(struct nl_handle **handle)
 117 {
 118         if (*handle == NULL)
 119                 return;
 120         nl80211_handle_destroy(*handle);
 121         *handle = NULL;
 122 }
 123
 124
 125 #if __WORDSIZE == 64
 126 #define ELOOP_SOCKET_INVALID    (intptr_t) 0x8888888888888889ULL
 127 #else
 128 #define ELOOP_SOCKET_INVALID    (intptr_t) 0x88888889ULL
 129 #endif
 130
 131 static void nl80211_register_eloop_read(struct nl_handle **handle,
 132                                         eloop_sock_handler handler,
 133                                         void *eloop_data)
 134 {
 135         nl_socket_set_nonblocking(*handle);
 136         eloop_register_read_sock(nl_socket_get_fd(*handle), handler,
 137                                  eloop_data, *handle);
 138         *handle = (void *) (((intptr_t) *handle) ^ ELOOP_SOCKET_INVALID);
 139 }
 140
 141
 142 static void nl80211_destroy_eloop_handle(struct nl_handle **handle)
 143 {
 144         *handle = (void *) (((intptr_t) *handle) ^ ELOOP_SOCKET_INVALID);
 145         eloop_unregister_read_sock(nl_socket_get_fd(*handle));
 146         nl_destroy_handles(handle);
 147 }
 148
 149
 150 static void nl80211_global_deinit(void *priv);
 151
 152 static void wpa_driver_nl80211_deinit(struct i802_bss *bss);
 153 static int wpa_driver_nl80211_set_mode_ibss(struct i802_bss *bss,
 154                                             struct hostapd_freq_params *freq);
 155
 156 static int
 157 wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv,
 158                                    const u8 *set_addr, int first,
 159                                    const char *driver_params);
 160 static int wpa_driver_nl80211_mlme(struct wpa_driver_nl80211_data *drv,
 161                                    const u8 *addr, int cmd, u16 reason_code,
 162                                    int local_state_change);
 163 static int nl80211_send_frame_cmd(struct i802_bss *bss,
 164                                   unsigned int freq, unsigned int wait,
 165                                   const u8 *buf, size_t buf_len, u64 *cookie,
 166                                   int no_cck, int no_ack, int offchanok);
 167 static int nl80211_register_frame(struct i802_bss *bss,
 168                                   struct nl_handle *hl_handle,
 169                                   u16 type, const u8 *match, size_t match_len);
 170 static int wpa_driver_nl80211_probe_req_report(struct i802_bss *bss,
 171                                                int report);
 172
 173 static void add_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx);
 174 static void del_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx);
 175 static int have_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx);
 176 static int wpa_driver_nl80211_if_remove(struct i802_bss *bss,
 177                                         enum wpa_driver_if_type type,
 178                                         const char *ifname);
 179
 180 static int nl80211_set_channel(struct i802_bss *bss,
 181                                struct hostapd_freq_params *freq, int set_chan);
 182 static int nl80211_disable_11b_rates(struct wpa_driver_nl80211_data *drv,
 183                                      int ifindex, int disabled);
 184
 185 static int nl80211_leave_ibss(struct wpa_driver_nl80211_data *drv);
 186
 187 static int i802_set_freq(void *priv, struct hostapd_freq_params *freq);
 188 static int i802_set_iface_flags(struct i802_bss *bss, int up);
 189 static int nl80211_set_param(void *priv, const char *param);
 190
 191
 192 /* Converts nl80211_chan_width to a common format */
 193 enum chan_width convert2width(int width)
 194 {
 195         switch (width) {
 196         case NL80211_CHAN_WIDTH_20_NOHT:
 197                 return CHAN_WIDTH_20_NOHT;
 198         case NL80211_CHAN_WIDTH_20:
 199                 return CHAN_WIDTH_20;
 200         case NL80211_CHAN_WIDTH_40:
 201                 return CHAN_WIDTH_40;
 202         case NL80211_CHAN_WIDTH_80:
 203                 return CHAN_WIDTH_80;
 204         case NL80211_CHAN_WIDTH_80P80:
 205                 return CHAN_WIDTH_80P80;
 206         case NL80211_CHAN_WIDTH_160:
 207                 return CHAN_WIDTH_160;
 208         }
 209         return CHAN_WIDTH_UNKNOWN;
 210 }
 211
 212
 213 int is_ap_interface(enum nl80211_iftype nlmode)
 214 {
 215         return nlmode == NL80211_IFTYPE_AP ||
 216                 nlmode == NL80211_IFTYPE_P2P_GO;
 217 }
 218
 219
 220 static int is_sta_interface(enum nl80211_iftype nlmode)
 221 {
 222         return nlmode == NL80211_IFTYPE_STATION ||
 223                 nlmode == NL80211_IFTYPE_P2P_CLIENT;
 224 }
 225
 226
 227 static int is_p2p_net_interface(enum nl80211_iftype nlmode)
 228 {
 229         return nlmode == NL80211_IFTYPE_P2P_CLIENT ||
 230                 nlmode == NL80211_IFTYPE_P2P_GO;
 231 }
 232
 233
 234 struct i802_bss * get_bss_ifindex(struct wpa_driver_nl80211_data *drv,
 235                                   int ifindex)
 236 {
 237         struct i802_bss *bss;
 238
 239         for (bss = drv->first_bss; bss; bss = bss->next) {
 240                 if (bss->ifindex == ifindex)
 241                         return bss;
 242         }
 243
 244         return NULL;
 245 }
 246
 247
 248 static int is_mesh_interface(enum nl80211_iftype nlmode)
 249 {
 250         return nlmode == NL80211_IFTYPE_MESH_POINT;
 251 }
 252
 253
 254 void nl80211_mark_disconnected(struct wpa_driver_nl80211_data *drv)
 255 {
 256         if (drv->associated)
 257                 os_memcpy(drv->prev_bssid, drv->bssid, ETH_ALEN);
 258         drv->associated = 0;
 259         os_memset(drv->bssid, 0, ETH_ALEN);
 260 }
 261
 262
 263 struct nl80211_bss_info_arg {
 264         struct wpa_driver_nl80211_data *drv;
 265         struct wpa_scan_results *res;
 266         unsigned int assoc_freq;
 267         unsigned int ibss_freq;
 268         u8 assoc_bssid[ETH_ALEN];
 269 };
 270
 271 static int bss_info_handler(struct nl_msg *msg, void *arg);
 272
 273
 274 /* nl80211 code */
 275 static int ack_handler(struct nl_msg *msg, void *arg)
 276 {
 277         int *err = arg;
 278         *err = 0;
 279         return NL_STOP;
 280 }
 281
 282 static int finish_handler(struct nl_msg *msg, void *arg)
 283 {
 284         int *ret = arg;
 285         *ret = 0;
 286         return NL_SKIP;
 287 }
 288
 289 static int error_handler(struct sockaddr_nl *nla, struct nlmsgerr *err,
 290                          void *arg)
 291 {
 292         int *ret = arg;
 293         *ret = err->error;
 294         return NL_SKIP;
 295 }
 296
 297
 298 static int no_seq_check(struct nl_msg *msg, void *arg)
 299 {
 300         return NL_OK;
 301 }
 302
 303
 304 static int send_and_recv(struct nl80211_global *global,
 305                          struct nl_handle *nl_handle, struct nl_msg *msg,
 306                          int (*valid_handler)(struct nl_msg *, void *),
 307                          void *valid_data)
 308 {
 309         struct nl_cb *cb;
 310         int err = -ENOMEM;
 311
 312         if (!msg)
 313                 return -ENOMEM;
 314
 315         cb = nl_cb_clone(global->nl_cb);
 316         if (!cb)
 317                 goto out;
 318
 319         err = nl_send_auto_complete(nl_handle, msg);
 320         if (err < 0)
 321                 goto out;
 322
 323         err = 1;
 324
 325         nl_cb_err(cb, NL_CB_CUSTOM, error_handler, &err);
 326         nl_cb_set(cb, NL_CB_FINISH, NL_CB_CUSTOM, finish_handler, &err);
 327         nl_cb_set(cb, NL_CB_ACK, NL_CB_CUSTOM, ack_handler, &err);
 328
 329         if (valid_handler)
 330                 nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM,
 331                           valid_handler, valid_data);
 332
 333         while (err > 0) {
 334                 int res = nl_recvmsgs(nl_handle, cb);
 335                 if (res < 0) {
 336                         wpa_printf(MSG_INFO,
 337                                    "nl80211: %s->nl_recvmsgs failed: %d",
 338                                    __func__, res);
 339                 }
 340         }
 341  out:
 342         nl_cb_put(cb);
 343         nlmsg_free(msg);
 344         return err;
 345 }
 346
 347
 348 static int send_and_recv_msgs_global(struct nl80211_global *global,
 349                                      struct nl_msg *msg,
 350                                      int (*valid_handler)(struct nl_msg *, void *),
 351                                      void *valid_data)
 352 {
 353         return send_and_recv(global, global->nl, msg, valid_handler,
 354                              valid_data);
 355 }
 356
 357
 358 int send_and_recv_msgs(struct wpa_driver_nl80211_data *drv,
 359                        struct nl_msg *msg,
 360                        int (*valid_handler)(struct nl_msg *, void *),
 361                        void *valid_data)
 362 {
 363         return send_and_recv(drv->global, drv->global->nl, msg,
 364                              valid_handler, valid_data);
 365 }
 366
 367
 368 struct family_data {
 369         const char *group;
 370         int id;
 371 };
 372
 373
 374 static int family_handler(struct nl_msg *msg, void *arg)
 375 {
 376         struct family_data *res = arg;
 377         struct nlattr *tb[CTRL_ATTR_MAX + 1];
 378         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 379         struct nlattr *mcgrp;
 380         int i;
 381
 382         nla_parse(tb, CTRL_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 383                   genlmsg_attrlen(gnlh, 0), NULL);
 384         if (!tb[CTRL_ATTR_MCAST_GROUPS])
 385                 return NL_SKIP;
 386
 387         nla_for_each_nested(mcgrp, tb[CTRL_ATTR_MCAST_GROUPS], i) {
 388                 struct nlattr *tb2[CTRL_ATTR_MCAST_GRP_MAX + 1];
 389                 nla_parse(tb2, CTRL_ATTR_MCAST_GRP_MAX, nla_data(mcgrp),
 390                           nla_len(mcgrp), NULL);
 391                 if (!tb2[CTRL_ATTR_MCAST_GRP_NAME] ||
 392                     !tb2[CTRL_ATTR_MCAST_GRP_ID] ||
 393                     os_strncmp(nla_data(tb2[CTRL_ATTR_MCAST_GRP_NAME]),
 394                                res->group,
 395                                nla_len(tb2[CTRL_ATTR_MCAST_GRP_NAME])) != 0)
 396                         continue;
 397                 res->id = nla_get_u32(tb2[CTRL_ATTR_MCAST_GRP_ID]);
 398                 break;
 399         };
 400
 401         return NL_SKIP;
 402 }
 403
 404
 405 static int nl_get_multicast_id(struct nl80211_global *global,
 406                                const char *family, const char *group)
 407 {
 408         struct nl_msg *msg;
 409         int ret;
 410         struct family_data res = { group, -ENOENT };
 411
 412         msg = nlmsg_alloc();
 413         if (!msg)
 414                 return -ENOMEM;
 415         if (!genlmsg_put(msg, 0, 0, genl_ctrl_resolve(global->nl, "nlctrl"),
 416                          0, 0, CTRL_CMD_GETFAMILY, 0) ||
 417             nla_put_string(msg, CTRL_ATTR_FAMILY_NAME, family)) {
 418                 nlmsg_free(msg);
 419                 return -1;
 420         }
 421
 422         ret = send_and_recv_msgs_global(global, msg, family_handler, &res);
 423         if (ret == 0)
 424                 ret = res.id;
 425         return ret;
 426 }
 427
 428
 429 void * nl80211_cmd(struct wpa_driver_nl80211_data *drv,
 430                    struct nl_msg *msg, int flags, uint8_t cmd)
 431 {
 432         return genlmsg_put(msg, 0, 0, drv->global->nl80211_id,
 433                            0, flags, cmd, 0);
 434 }
 435
 436
 437 static int nl80211_set_iface_id(struct nl_msg *msg, struct i802_bss *bss)
 438 {
 439         if (bss->wdev_id_set)
 440                 return nla_put_u64(msg, NL80211_ATTR_WDEV, bss->wdev_id);
 441         return nla_put_u32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
 442 }
 443
 444
 445 struct nl_msg * nl80211_cmd_msg(struct i802_bss *bss, int flags, uint8_t cmd)
 446 {
 447         struct nl_msg *msg;
 448
 449         msg = nlmsg_alloc();
 450         if (!msg)
 451                 return NULL;
 452
 453         if (!nl80211_cmd(bss->drv, msg, flags, cmd) ||
 454             nl80211_set_iface_id(msg, bss) < 0) {
 455                 nlmsg_free(msg);
 456                 return NULL;
 457         }
 458
 459         return msg;
 460 }
 461
 462
 463 static struct nl_msg *
 464 nl80211_ifindex_msg(struct wpa_driver_nl80211_data *drv, int ifindex,
 465                     int flags, uint8_t cmd)
 466 {
 467         struct nl_msg *msg;
 468
 469         msg = nlmsg_alloc();
 470         if (!msg)
 471                 return NULL;
 472
 473         if (!nl80211_cmd(drv, msg, flags, cmd) ||
 474             nla_put_u32(msg, NL80211_ATTR_IFINDEX, ifindex)) {
 475                 nlmsg_free(msg);
 476                 return NULL;
 477         }
 478
 479         return msg;
 480 }
 481
 482
 483 struct nl_msg * nl80211_drv_msg(struct wpa_driver_nl80211_data *drv, int flags,
 484                                 uint8_t cmd)
 485 {
 486         return nl80211_ifindex_msg(drv, drv->ifindex, flags, cmd);
 487 }
 488
 489
 490 struct nl_msg * nl80211_bss_msg(struct i802_bss *bss, int flags, uint8_t cmd)
 491 {
 492         return nl80211_ifindex_msg(bss->drv, bss->ifindex, flags, cmd);
 493 }
 494
 495
 496 struct wiphy_idx_data {
 497         int wiphy_idx;
 498         enum nl80211_iftype nlmode;
 499         u8 *macaddr;
 500 };
 501
 502
 503 static int netdev_info_handler(struct nl_msg *msg, void *arg)
 504 {
 505         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 506         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 507         struct wiphy_idx_data *info = arg;
 508
 509         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 510                   genlmsg_attrlen(gnlh, 0), NULL);
 511
 512         if (tb[NL80211_ATTR_WIPHY])
 513                 info->wiphy_idx = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
 514
 515         if (tb[NL80211_ATTR_IFTYPE])
 516                 info->nlmode = nla_get_u32(tb[NL80211_ATTR_IFTYPE]);
 517
 518         if (tb[NL80211_ATTR_MAC] && info->macaddr)
 519                 os_memcpy(info->macaddr, nla_data(tb[NL80211_ATTR_MAC]),
 520                           ETH_ALEN);
 521
 522         return NL_SKIP;
 523 }
 524
 525
 526 int nl80211_get_wiphy_index(struct i802_bss *bss)
 527 {
 528         struct nl_msg *msg;
 529         struct wiphy_idx_data data = {
 530                 .wiphy_idx = -1,
 531                 .macaddr = NULL,
 532         };
 533
 534         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_GET_INTERFACE)))
 535                 return -1;
 536
 537         if (send_and_recv_msgs(bss->drv, msg, netdev_info_handler, &data) == 0)
 538                 return data.wiphy_idx;
 539         return -1;
 540 }
 541
 542
 543 static enum nl80211_iftype nl80211_get_ifmode(struct i802_bss *bss)
 544 {
 545         struct nl_msg *msg;
 546         struct wiphy_idx_data data = {
 547                 .nlmode = NL80211_IFTYPE_UNSPECIFIED,
 548                 .macaddr = NULL,
 549         };
 550
 551         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_GET_INTERFACE)))
 552                 return NL80211_IFTYPE_UNSPECIFIED;
 553
 554         if (send_and_recv_msgs(bss->drv, msg, netdev_info_handler, &data) == 0)
 555                 return data.nlmode;
 556         return NL80211_IFTYPE_UNSPECIFIED;
 557 }
 558
 559
 560 static int nl80211_get_macaddr(struct i802_bss *bss)
 561 {
 562         struct nl_msg *msg;
 563         struct wiphy_idx_data data = {
 564                 .macaddr = bss->addr,
 565         };
 566
 567         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_GET_INTERFACE)))
 568                 return -1;
 569
 570         return send_and_recv_msgs(bss->drv, msg, netdev_info_handler, &data);
 571 }
 572
 573
 574 static int nl80211_register_beacons(struct wpa_driver_nl80211_data *drv,
 575                                     struct nl80211_wiphy_data *w)
 576 {
 577         struct nl_msg *msg;
 578         int ret;
 579
 580         msg = nlmsg_alloc();
 581         if (!msg)
 582                 return -1;
 583
 584         if (!nl80211_cmd(drv, msg, 0, NL80211_CMD_REGISTER_BEACONS) ||
 585             nla_put_u32(msg, NL80211_ATTR_WIPHY, w->wiphy_idx)) {
 586                 nlmsg_free(msg);
 587                 return -1;
 588         }
 589
 590         ret = send_and_recv(drv->global, w->nl_beacons, msg, NULL, NULL);
 591         if (ret) {
 592                 wpa_printf(MSG_DEBUG, "nl80211: Register beacons command "
 593                            "failed: ret=%d (%s)",
 594                            ret, strerror(-ret));
 595         }
 596         return ret;
 597 }
 598
 599
 600 static void nl80211_recv_beacons(int sock, void *eloop_ctx, void *handle)
 601 {
 602         struct nl80211_wiphy_data *w = eloop_ctx;
 603         int res;
 604
 605         wpa_printf(MSG_EXCESSIVE, "nl80211: Beacon event message available");
 606
 607         res = nl_recvmsgs(handle, w->nl_cb);
 608         if (res < 0) {
 609                 wpa_printf(MSG_INFO, "nl80211: %s->nl_recvmsgs failed: %d",
 610                            __func__, res);
 611         }
 612 }
 613
 614
 615 static int process_beacon_event(struct nl_msg *msg, void *arg)
 616 {
 617         struct nl80211_wiphy_data *w = arg;
 618         struct wpa_driver_nl80211_data *drv;
 619         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 620         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 621         union wpa_event_data event;
 622
 623         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 624                   genlmsg_attrlen(gnlh, 0), NULL);
 625
 626         if (gnlh->cmd != NL80211_CMD_FRAME) {
 627                 wpa_printf(MSG_DEBUG, "nl80211: Unexpected beacon event? (%d)",
 628                            gnlh->cmd);
 629                 return NL_SKIP;
 630         }
 631
 632         if (!tb[NL80211_ATTR_FRAME])
 633                 return NL_SKIP;
 634
 635         dl_list_for_each(drv, &w->drvs, struct wpa_driver_nl80211_data,
 636                          wiphy_list) {
 637                 os_memset(&event, 0, sizeof(event));
 638                 event.rx_mgmt.frame = nla_data(tb[NL80211_ATTR_FRAME]);
 639                 event.rx_mgmt.frame_len = nla_len(tb[NL80211_ATTR_FRAME]);
 640                 wpa_supplicant_event(drv->ctx, EVENT_RX_MGMT, &event);
 641         }
 642
 643         return NL_SKIP;
 644 }
 645
 646
 647 static struct nl80211_wiphy_data *
 648 nl80211_get_wiphy_data_ap(struct i802_bss *bss)
 649 {
 650         static DEFINE_DL_LIST(nl80211_wiphys);
 651         struct nl80211_wiphy_data *w;
 652         int wiphy_idx, found = 0;
 653         struct i802_bss *tmp_bss;
 654
 655         if (bss->wiphy_data != NULL)
 656                 return bss->wiphy_data;
 657
 658         wiphy_idx = nl80211_get_wiphy_index(bss);
 659
 660         dl_list_for_each(w, &nl80211_wiphys, struct nl80211_wiphy_data, list) {
 661                 if (w->wiphy_idx == wiphy_idx)
 662                         goto add;
 663         }
 664
 665         /* alloc new one */
 666         w = os_zalloc(sizeof(*w));
 667         if (w == NULL)
 668                 return NULL;
 669         w->wiphy_idx = wiphy_idx;
 670         dl_list_init(&w->bsss);
 671         dl_list_init(&w->drvs);
 672
 673         w->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
 674         if (!w->nl_cb) {
 675                 os_free(w);
 676                 return NULL;
 677         }
 678         nl_cb_set(w->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM, no_seq_check, NULL);
 679         nl_cb_set(w->nl_cb, NL_CB_VALID, NL_CB_CUSTOM, process_beacon_event,
 680                   w);
 681
 682         w->nl_beacons = nl_create_handle(bss->drv->global->nl_cb,
 683                                          "wiphy beacons");
 684         if (w->nl_beacons == NULL) {
 685                 os_free(w);
 686                 return NULL;
 687         }
 688
 689         if (nl80211_register_beacons(bss->drv, w)) {
 690                 nl_destroy_handles(&w->nl_beacons);
 691                 os_free(w);
 692                 return NULL;
 693         }
 694
 695         nl80211_register_eloop_read(&w->nl_beacons, nl80211_recv_beacons, w);
 696
 697         dl_list_add(&nl80211_wiphys, &w->list);
 698
 699 add:
 700         /* drv entry for this bss already there? */
 701         dl_list_for_each(tmp_bss, &w->bsss, struct i802_bss, wiphy_list) {
 702                 if (tmp_bss->drv == bss->drv) {
 703                         found = 1;
 704                         break;
 705                 }
 706         }
 707         /* if not add it */
 708         if (!found)
 709                 dl_list_add(&w->drvs, &bss->drv->wiphy_list);
 710
 711         dl_list_add(&w->bsss, &bss->wiphy_list);
 712         bss->wiphy_data = w;
 713         return w;
 714 }
 715
 716
 717 static void nl80211_put_wiphy_data_ap(struct i802_bss *bss)
 718 {
 719         struct nl80211_wiphy_data *w = bss->wiphy_data;
 720         struct i802_bss *tmp_bss;
 721         int found = 0;
 722
 723         if (w == NULL)
 724                 return;
 725         bss->wiphy_data = NULL;
 726         dl_list_del(&bss->wiphy_list);
 727
 728         /* still any for this drv present? */
 729         dl_list_for_each(tmp_bss, &w->bsss, struct i802_bss, wiphy_list) {
 730                 if (tmp_bss->drv == bss->drv) {
 731                         found = 1;
 732                         break;
 733                 }
 734         }
 735         /* if not remove it */
 736         if (!found)
 737                 dl_list_del(&bss->drv->wiphy_list);
 738
 739         if (!dl_list_empty(&w->bsss))
 740                 return;
 741
 742         nl80211_destroy_eloop_handle(&w->nl_beacons);
 743
 744         nl_cb_put(w->nl_cb);
 745         dl_list_del(&w->list);
 746         os_free(w);
 747 }
 748
 749
 750 static int wpa_driver_nl80211_get_bssid(void *priv, u8 *bssid)
 751 {
 752         struct i802_bss *bss = priv;
 753         struct wpa_driver_nl80211_data *drv = bss->drv;
 754         if (!drv->associated)
 755                 return -1;
 756         os_memcpy(bssid, drv->bssid, ETH_ALEN);
 757         return 0;
 758 }
 759
 760
 761 static int wpa_driver_nl80211_get_ssid(void *priv, u8 *ssid)
 762 {
 763         struct i802_bss *bss = priv;
 764         struct wpa_driver_nl80211_data *drv = bss->drv;
 765         if (!drv->associated)
 766                 return -1;
 767         os_memcpy(ssid, drv->ssid, drv->ssid_len);
 768         return drv->ssid_len;
 769 }
 770
 771
 772 static void wpa_driver_nl80211_event_newlink(
 773         struct wpa_driver_nl80211_data *drv, char *ifname)
 774 {
 775         union wpa_event_data event;
 776
 777         if (os_strcmp(drv->first_bss->ifname, ifname) == 0) {
 778                 if (if_nametoindex(drv->first_bss->ifname) == 0) {
 779                         wpa_printf(MSG_DEBUG, "nl80211: Interface %s does not exist - ignore RTM_NEWLINK",
 780                                    drv->first_bss->ifname);
 781                         return;
 782                 }
 783                 if (!drv->if_removed)
 784                         return;
 785                 wpa_printf(MSG_DEBUG, "nl80211: Mark if_removed=0 for %s based on RTM_NEWLINK event",
 786                            drv->first_bss->ifname);
 787                 drv->if_removed = 0;
 788         }
 789
 790         os_memset(&event, 0, sizeof(event));
 791         os_strlcpy(event.interface_status.ifname, ifname,
 792                    sizeof(event.interface_status.ifname));
 793         event.interface_status.ievent = EVENT_INTERFACE_ADDED;
 794         wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_STATUS, &event);
 795 }
 796
 797
 798 static void wpa_driver_nl80211_event_dellink(
 799         struct wpa_driver_nl80211_data *drv, char *ifname)
 800 {
 801         union wpa_event_data event;
 802
 803         if (os_strcmp(drv->first_bss->ifname, ifname) == 0) {
 804                 if (drv->if_removed) {
 805                         wpa_printf(MSG_DEBUG, "nl80211: if_removed already set - ignore RTM_DELLINK event for %s",
 806                                    ifname);
 807                         return;
 808                 }
 809                 wpa_printf(MSG_DEBUG, "RTM_DELLINK: Interface '%s' removed - mark if_removed=1",
 810                            ifname);
 811                 drv->if_removed = 1;
 812         } else {
 813                 wpa_printf(MSG_DEBUG, "RTM_DELLINK: Interface '%s' removed",
 814                            ifname);
 815         }
 816
 817         os_memset(&event, 0, sizeof(event));
 818         os_strlcpy(event.interface_status.ifname, ifname,
 819                    sizeof(event.interface_status.ifname));
 820         event.interface_status.ievent = EVENT_INTERFACE_REMOVED;
 821         wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_STATUS, &event);
 822 }
 823
 824
 825 static int wpa_driver_nl80211_own_ifname(struct wpa_driver_nl80211_data *drv,
 826                                          u8 *buf, size_t len)
 827 {
 828         int attrlen, rta_len;
 829         struct rtattr *attr;
 830
 831         attrlen = len;
 832         attr = (struct rtattr *) buf;
 833
 834         rta_len = RTA_ALIGN(sizeof(struct rtattr));
 835         while (RTA_OK(attr, attrlen)) {
 836                 if (attr->rta_type == IFLA_IFNAME) {
 837                         if (os_strcmp(((char *) attr) + rta_len,
 838                                       drv->first_bss->ifname) == 0)
 839                                 return 1;
 840                         else
 841                                 break;
 842                 }
 843                 attr = RTA_NEXT(attr, attrlen);
 844         }
 845
 846         return 0;
 847 }
 848
 849
 850 static int wpa_driver_nl80211_own_ifindex(struct wpa_driver_nl80211_data *drv,
 851                                           int ifindex, u8 *buf, size_t len)
 852 {
 853         if (drv->ifindex == ifindex)
 854                 return 1;
 855
 856         if (drv->if_removed && wpa_driver_nl80211_own_ifname(drv, buf, len)) {
 857                 wpa_printf(MSG_DEBUG, "nl80211: Update ifindex for a removed "
 858                            "interface");
 859                 wpa_driver_nl80211_finish_drv_init(drv, NULL, 0, NULL);
 860                 return 1;
 861         }
 862
 863         return 0;
 864 }
 865
 866
 867 static struct wpa_driver_nl80211_data *
 868 nl80211_find_drv(struct nl80211_global *global, int idx, u8 *buf, size_t len)
 869 {
 870         struct wpa_driver_nl80211_data *drv;
 871         dl_list_for_each(drv, &global->interfaces,
 872                          struct wpa_driver_nl80211_data, list) {
 873                 if (wpa_driver_nl80211_own_ifindex(drv, idx, buf, len) ||
 874                     have_ifidx(drv, idx))
 875                         return drv;
 876         }
 877         return NULL;
 878 }
 879
 880
 881 static void wpa_driver_nl80211_event_rtm_newlink(void *ctx,
 882                                                  struct ifinfomsg *ifi,
 883                                                  u8 *buf, size_t len)
 884 {
 885         struct nl80211_global *global = ctx;
 886         struct wpa_driver_nl80211_data *drv;
 887         int attrlen;
 888         struct rtattr *attr;
 889         u32 brid = 0;
 890         char namebuf[IFNAMSIZ];
 891         char ifname[IFNAMSIZ + 1];
 892         char extra[100], *pos, *end;
 893
 894         drv = nl80211_find_drv(global, ifi->ifi_index, buf, len);
 895         if (!drv) {
 896                 wpa_printf(MSG_DEBUG, "nl80211: Ignore RTM_NEWLINK event for foreign ifindex %d",
 897                            ifi->ifi_index);
 898                 return;
 899         }
 900
 901         extra[0] = '\0';
 902         pos = extra;
 903         end = pos + sizeof(extra);
 904         ifname[0] = '\0';
 905
 906         attrlen = len;
 907         attr = (struct rtattr *) buf;
 908         while (RTA_OK(attr, attrlen)) {
 909                 switch (attr->rta_type) {
 910                 case IFLA_IFNAME:
 911                         if (RTA_PAYLOAD(attr) >= IFNAMSIZ)
 912                                 break;
 913                         os_memcpy(ifname, RTA_DATA(attr), RTA_PAYLOAD(attr));
 914                         ifname[RTA_PAYLOAD(attr)] = '\0';
 915                         break;
 916                 case IFLA_MASTER:
 917                         brid = nla_get_u32((struct nlattr *) attr);
 918                         pos += os_snprintf(pos, end - pos, " master=%u", brid);
 919                         break;
 920                 case IFLA_WIRELESS:
 921                         pos += os_snprintf(pos, end - pos, " wext");
 922                         break;
 923                 case IFLA_OPERSTATE:
 924                         pos += os_snprintf(pos, end - pos, " operstate=%u",
 925                                            nla_get_u32((struct nlattr *) attr));
 926                         break;
 927                 case IFLA_LINKMODE:
 928                         pos += os_snprintf(pos, end - pos, " linkmode=%u",
 929                                            nla_get_u32((struct nlattr *) attr));
 930                         break;
 931                 }
 932                 attr = RTA_NEXT(attr, attrlen);
 933         }
 934         extra[sizeof(extra) - 1] = '\0';
 935
 936         wpa_printf(MSG_DEBUG, "RTM_NEWLINK: ifi_index=%d ifname=%s%s ifi_family=%d ifi_flags=0x%x (%s%s%s%s)",
 937                    ifi->ifi_index, ifname, extra, ifi->ifi_family,
 938                    ifi->ifi_flags,
 939                    (ifi->ifi_flags & IFF_UP) ? "[UP]" : "",
 940                    (ifi->ifi_flags & IFF_RUNNING) ? "[RUNNING]" : "",
 941                    (ifi->ifi_flags & IFF_LOWER_UP) ? "[LOWER_UP]" : "",
 942                    (ifi->ifi_flags & IFF_DORMANT) ? "[DORMANT]" : "");
 943
 944         if (!drv->if_disabled && !(ifi->ifi_flags & IFF_UP)) {
 945                 if (if_indextoname(ifi->ifi_index, namebuf) &&
 946                     linux_iface_up(drv->global->ioctl_sock,
 947                                    drv->first_bss->ifname) > 0) {
 948                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface down "
 949                                    "event since interface %s is up", namebuf);
 950                         drv->ignore_if_down_event = 0;
 951                         return;
 952                 }
 953                 wpa_printf(MSG_DEBUG, "nl80211: Interface down");
 954                 if (drv->ignore_if_down_event) {
 955                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface down "
 956                                    "event generated by mode change");
 957                         drv->ignore_if_down_event = 0;
 958                 } else {
 959                         drv->if_disabled = 1;
 960                         wpa_supplicant_event(drv->ctx,
 961                                              EVENT_INTERFACE_DISABLED, NULL);
 962
 963                         /*
 964                          * Try to get drv again, since it may be removed as
 965                          * part of the EVENT_INTERFACE_DISABLED handling for
 966                          * dynamic interfaces
 967                          */
 968                         drv = nl80211_find_drv(global, ifi->ifi_index,
 969                                                buf, len);
 970                         if (!drv)
 971                                 return;
 972                 }
 973         }
 974
 975         if (drv->if_disabled && (ifi->ifi_flags & IFF_UP)) {
 976                 if (if_indextoname(ifi->ifi_index, namebuf) &&
 977                     linux_iface_up(drv->global->ioctl_sock,
 978                                    drv->first_bss->ifname) == 0) {
 979                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface up "
 980                                    "event since interface %s is down",
 981                                    namebuf);
 982                 } else if (if_nametoindex(drv->first_bss->ifname) == 0) {
 983                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface up "
 984                                    "event since interface %s does not exist",
 985                                    drv->first_bss->ifname);
 986                 } else if (drv->if_removed) {
 987                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface up "
 988                                    "event since interface %s is marked "
 989                                    "removed", drv->first_bss->ifname);
 990                 } else {
 991                         struct i802_bss *bss;
 992                         u8 addr[ETH_ALEN];
 993
 994                         /* Re-read MAC address as it may have changed */
 995                         bss = get_bss_ifindex(drv, ifi->ifi_index);
 996                         if (bss &&
 997                             linux_get_ifhwaddr(drv->global->ioctl_sock,
 998                                                bss->ifname, addr) < 0) {
 999                                 wpa_printf(MSG_DEBUG,
1000                                            "nl80211: %s: failed to re-read MAC address",
1001                                            bss->ifname);
1002                         } else if (bss &&
1003                                    os_memcmp(addr, bss->addr, ETH_ALEN) != 0) {
1004                                 wpa_printf(MSG_DEBUG,
1005                                            "nl80211: Own MAC address on ifindex %d (%s) changed from "
1006                                            MACSTR " to " MACSTR,
1007                                            ifi->ifi_index, bss->ifname,
1008                                            MAC2STR(bss->addr),
1009                                            MAC2STR(addr));
1010                                 os_memcpy(bss->addr, addr, ETH_ALEN);
1011                         }
1012
1013                         wpa_printf(MSG_DEBUG, "nl80211: Interface up");
1014                         drv->if_disabled = 0;
1015                         wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_ENABLED,
1016                                              NULL);
1017                 }
1018         }
1019
1020         /*
1021          * Some drivers send the association event before the operup event--in
1022          * this case, lifting operstate in wpa_driver_nl80211_set_operstate()
1023          * fails. This will hit us when wpa_supplicant does not need to do
1024          * IEEE 802.1X authentication
1025          */
1026         if (drv->operstate == 1 &&
1027             (ifi->ifi_flags & (IFF_LOWER_UP | IFF_DORMANT)) == IFF_LOWER_UP &&
1028             !(ifi->ifi_flags & IFF_RUNNING)) {
1029                 wpa_printf(MSG_DEBUG, "nl80211: Set IF_OPER_UP again based on ifi_flags and expected operstate");
1030                 netlink_send_oper_ifla(drv->global->netlink, drv->ifindex,
1031                                        -1, IF_OPER_UP);
1032         }
1033
1034         if (ifname[0])
1035                 wpa_driver_nl80211_event_newlink(drv, ifname);
1036
1037         if (ifi->ifi_family == AF_BRIDGE && brid) {
1038                 struct i802_bss *bss;
1039
1040                 /* device has been added to bridge */
1041                 if_indextoname(brid, namebuf);
1042                 wpa_printf(MSG_DEBUG, "nl80211: Add ifindex %u for bridge %s",
1043                            brid, namebuf);
1044                 add_ifidx(drv, brid);
1045
1046                 for (bss = drv->first_bss; bss; bss = bss->next) {
1047                         if (os_strcmp(ifname, bss->ifname) == 0) {
1048                                 os_strlcpy(bss->brname, namebuf, IFNAMSIZ);
1049                                 break;
1050                         }
1051                 }
1052         }
1053 }
1054
1055
1056 static void wpa_driver_nl80211_event_rtm_dellink(void *ctx,
1057                                                  struct ifinfomsg *ifi,
1058                                                  u8 *buf, size_t len)
1059 {
1060         struct nl80211_global *global = ctx;
1061         struct wpa_driver_nl80211_data *drv;
1062         int attrlen;
1063         struct rtattr *attr;
1064         u32 brid = 0;
1065         char ifname[IFNAMSIZ + 1];
1066         char extra[100], *pos, *end;
1067
1068         drv = nl80211_find_drv(global, ifi->ifi_index, buf, len);
1069         if (!drv) {
1070                 wpa_printf(MSG_DEBUG, "nl80211: Ignore RTM_DELLINK event for foreign ifindex %d",
1071                            ifi->ifi_index);
1072                 return;
1073         }
1074
1075         extra[0] = '\0';
1076         pos = extra;
1077         end = pos + sizeof(extra);
1078         ifname[0] = '\0';
1079
1080         attrlen = len;
1081         attr = (struct rtattr *) buf;
1082         while (RTA_OK(attr, attrlen)) {
1083                 switch (attr->rta_type) {
1084                 case IFLA_IFNAME:
1085                         if (RTA_PAYLOAD(attr) >= IFNAMSIZ)
1086                                 break;
1087                         os_memcpy(ifname, RTA_DATA(attr), RTA_PAYLOAD(attr));
1088                         ifname[RTA_PAYLOAD(attr)] = '\0';
1089                         break;
1090                 case IFLA_MASTER:
1091                         brid = nla_get_u32((struct nlattr *) attr);
1092                         pos += os_snprintf(pos, end - pos, " master=%u", brid);
1093                         break;
1094                 case IFLA_OPERSTATE:
1095                         pos += os_snprintf(pos, end - pos, " operstate=%u",
1096                                            nla_get_u32((struct nlattr *) attr));
1097                         break;
1098                 case IFLA_LINKMODE:
1099                         pos += os_snprintf(pos, end - pos, " linkmode=%u",
1100                                            nla_get_u32((struct nlattr *) attr));
1101                         break;
1102                 }
1103                 attr = RTA_NEXT(attr, attrlen);
1104         }
1105         extra[sizeof(extra) - 1] = '\0';
1106
1107         wpa_printf(MSG_DEBUG, "RTM_DELLINK: ifi_index=%d ifname=%s%s ifi_family=%d ifi_flags=0x%x (%s%s%s%s)",
1108                    ifi->ifi_index, ifname, extra, ifi->ifi_family,
1109                    ifi->ifi_flags,
1110                    (ifi->ifi_flags & IFF_UP) ? "[UP]" : "",
1111                    (ifi->ifi_flags & IFF_RUNNING) ? "[RUNNING]" : "",
1112                    (ifi->ifi_flags & IFF_LOWER_UP) ? "[LOWER_UP]" : "",
1113                    (ifi->ifi_flags & IFF_DORMANT) ? "[DORMANT]" : "");
1114
1115         if (ifname[0] && (ifi->ifi_family != AF_BRIDGE || !brid))
1116                 wpa_driver_nl80211_event_dellink(drv, ifname);
1117
1118         if (ifi->ifi_family == AF_BRIDGE && brid) {
1119                 /* device has been removed from bridge */
1120                 char namebuf[IFNAMSIZ];
1121                 if_indextoname(brid, namebuf);
1122                 wpa_printf(MSG_DEBUG, "nl80211: Remove ifindex %u for bridge "
1123                            "%s", brid, namebuf);
1124                 del_ifidx(drv, brid);
1125         }
1126 }
1127
1128
1129 unsigned int nl80211_get_assoc_freq(struct wpa_driver_nl80211_data *drv)
1130 {
1131         struct nl_msg *msg;
1132         int ret;
1133         struct nl80211_bss_info_arg arg;
1134
1135         msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_GET_SCAN);
1136         os_memset(&arg, 0, sizeof(arg));
1137         arg.drv = drv;
1138         ret = send_and_recv_msgs(drv, msg, bss_info_handler, &arg);
1139         if (ret == 0) {
1140                 unsigned int freq = drv->nlmode == NL80211_IFTYPE_ADHOC ?
1141                         arg.ibss_freq : arg.assoc_freq;
1142                 wpa_printf(MSG_DEBUG, "nl80211: Operating frequency for the "
1143                            "associated BSS from scan results: %u MHz", freq);
1144                 if (freq)
1145                         drv->assoc_freq = freq;
1146                 return drv->assoc_freq;
1147         }
1148         wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d "
1149                    "(%s)", ret, strerror(-ret));
1150         return drv->assoc_freq;
1151 }
1152
1153
1154 static int get_link_signal(struct nl_msg *msg, void *arg)
1155 {
1156         struct nlattr *tb[NL80211_ATTR_MAX + 1];
1157         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1158         struct nlattr *sinfo[NL80211_STA_INFO_MAX + 1];
1159         static struct nla_policy policy[NL80211_STA_INFO_MAX + 1] = {
1160                 [NL80211_STA_INFO_SIGNAL] = { .type = NLA_U8 },
1161                 [NL80211_STA_INFO_SIGNAL_AVG] = { .type = NLA_U8 },
1162         };
1163         struct nlattr *rinfo[NL80211_RATE_INFO_MAX + 1];
1164         static struct nla_policy rate_policy[NL80211_RATE_INFO_MAX + 1] = {
1165                 [NL80211_RATE_INFO_BITRATE] = { .type = NLA_U16 },
1166                 [NL80211_RATE_INFO_MCS] = { .type = NLA_U8 },
1167                 [NL80211_RATE_INFO_40_MHZ_WIDTH] = { .type = NLA_FLAG },
1168                 [NL80211_RATE_INFO_SHORT_GI] = { .type = NLA_FLAG },
1169         };
1170         struct wpa_signal_info *sig_change = arg;
1171
1172         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1173                   genlmsg_attrlen(gnlh, 0), NULL);
1174         if (!tb[NL80211_ATTR_STA_INFO] ||
1175             nla_parse_nested(sinfo, NL80211_STA_INFO_MAX,
1176                              tb[NL80211_ATTR_STA_INFO], policy))
1177                 return NL_SKIP;
1178         if (!sinfo[NL80211_STA_INFO_SIGNAL])
1179                 return NL_SKIP;
1180
1181         sig_change->current_signal =
1182                 (s8) nla_get_u8(sinfo[NL80211_STA_INFO_SIGNAL]);
1183
1184         if (sinfo[NL80211_STA_INFO_SIGNAL_AVG])
1185                 sig_change->avg_signal =
1186                         (s8) nla_get_u8(sinfo[NL80211_STA_INFO_SIGNAL_AVG]);
1187         else
1188                 sig_change->avg_signal = 0;
1189
1190         if (sinfo[NL80211_STA_INFO_TX_BITRATE]) {
1191                 if (nla_parse_nested(rinfo, NL80211_RATE_INFO_MAX,
1192                                      sinfo[NL80211_STA_INFO_TX_BITRATE],
1193                                      rate_policy)) {
1194                         sig_change->current_txrate = 0;
1195                 } else {
1196                         if (rinfo[NL80211_RATE_INFO_BITRATE]) {
1197                                 sig_change->current_txrate =
1198                                         nla_get_u16(rinfo[
1199                                              NL80211_RATE_INFO_BITRATE]) * 100;
1200                         }
1201                 }
1202         }
1203
1204         return NL_SKIP;
1205 }
1206
1207
1208 int nl80211_get_link_signal(struct wpa_driver_nl80211_data *drv,
1209                             struct wpa_signal_info *sig)
1210 {
1211         struct nl_msg *msg;
1212
1213         sig->current_signal = -9999;
1214         sig->current_txrate = 0;
1215
1216         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_GET_STATION)) ||
1217             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, drv->bssid)) {
1218                 nlmsg_free(msg);
1219                 return -ENOBUFS;
1220         }
1221
1222         return send_and_recv_msgs(drv, msg, get_link_signal, sig);
1223 }
1224
1225
1226 static int get_link_noise(struct nl_msg *msg, void *arg)
1227 {
1228         struct nlattr *tb[NL80211_ATTR_MAX + 1];
1229         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1230         struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
1231         static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
1232                 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
1233                 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
1234         };
1235         struct wpa_signal_info *sig_change = arg;
1236
1237         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1238                   genlmsg_attrlen(gnlh, 0), NULL);
1239
1240         if (!tb[NL80211_ATTR_SURVEY_INFO]) {
1241                 wpa_printf(MSG_DEBUG, "nl80211: survey data missing!");
1242                 return NL_SKIP;
1243         }
1244
1245         if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
1246                              tb[NL80211_ATTR_SURVEY_INFO],
1247                              survey_policy)) {
1248                 wpa_printf(MSG_DEBUG, "nl80211: failed to parse nested "
1249                            "attributes!");
1250                 return NL_SKIP;
1251         }
1252
1253         if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY])
1254                 return NL_SKIP;
1255
1256         if (nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]) !=
1257             sig_change->frequency)
1258                 return NL_SKIP;
1259
1260         if (!sinfo[NL80211_SURVEY_INFO_NOISE])
1261                 return NL_SKIP;
1262
1263         sig_change->current_noise =
1264                 (s8) nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
1265
1266         return NL_SKIP;
1267 }
1268
1269
1270 int nl80211_get_link_noise(struct wpa_driver_nl80211_data *drv,
1271                            struct wpa_signal_info *sig_change)
1272 {
1273         struct nl_msg *msg;
1274
1275         sig_change->current_noise = 9999;
1276         sig_change->frequency = drv->assoc_freq;
1277
1278         msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_GET_SURVEY);
1279         return send_and_recv_msgs(drv, msg, get_link_noise, sig_change);
1280 }
1281
1282
1283 static int get_noise_for_scan_results(struct nl_msg *msg, void *arg)
1284 {
1285         struct nlattr *tb[NL80211_ATTR_MAX + 1];
1286         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1287         struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
1288         static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
1289                 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
1290                 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
1291         };
1292         struct wpa_scan_results *scan_results = arg;
1293         struct wpa_scan_res *scan_res;
1294         size_t i;
1295
1296         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1297                   genlmsg_attrlen(gnlh, 0), NULL);
1298
1299         if (!tb[NL80211_ATTR_SURVEY_INFO]) {
1300                 wpa_printf(MSG_DEBUG, "nl80211: Survey data missing");
1301                 return NL_SKIP;
1302         }
1303
1304         if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
1305                              tb[NL80211_ATTR_SURVEY_INFO],
1306                              survey_policy)) {
1307                 wpa_printf(MSG_DEBUG, "nl80211: Failed to parse nested "
1308                            "attributes");
1309                 return NL_SKIP;
1310         }
1311
1312         if (!sinfo[NL80211_SURVEY_INFO_NOISE])
1313                 return NL_SKIP;
1314
1315         if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY])
1316                 return NL_SKIP;
1317
1318         for (i = 0; i < scan_results->num; ++i) {
1319                 scan_res = scan_results->res[i];
1320                 if (!scan_res)
1321                         continue;
1322                 if ((int) nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]) !=
1323                     scan_res->freq)
1324                         continue;
1325                 if (!(scan_res->flags & WPA_SCAN_NOISE_INVALID))
1326                         continue;
1327                 scan_res->noise = (s8)
1328                         nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
1329                 scan_res->flags &= ~WPA_SCAN_NOISE_INVALID;
1330         }
1331
1332         return NL_SKIP;
1333 }
1334
1335
1336 static int nl80211_get_noise_for_scan_results(
1337         struct wpa_driver_nl80211_data *drv,
1338         struct wpa_scan_results *scan_res)
1339 {
1340         struct nl_msg *msg;
1341
1342         msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_GET_SURVEY);
1343         return send_and_recv_msgs(drv, msg, get_noise_for_scan_results,
1344                                   scan_res);
1345 }
1346
1347
1348 static void wpa_driver_nl80211_event_receive(int sock, void *eloop_ctx,
1349                                              void *handle)
1350 {
1351         struct nl_cb *cb = eloop_ctx;
1352         int res;
1353
1354         wpa_printf(MSG_MSGDUMP, "nl80211: Event message available");
1355
1356         res = nl_recvmsgs(handle, cb);
1357         if (res < 0) {
1358                 wpa_printf(MSG_INFO, "nl80211: %s->nl_recvmsgs failed: %d",
1359                            __func__, res);
1360         }
1361 }
1362
1363
1364 /**
1365  * wpa_driver_nl80211_set_country - ask nl80211 to set the regulatory domain
1366  * @priv: driver_nl80211 private data
1367  * @alpha2_arg: country to which to switch to
1368  * Returns: 0 on success, -1 on failure
1369  *
1370  * This asks nl80211 to set the regulatory domain for given
1371  * country ISO / IEC alpha2.
1372  */
1373 static int wpa_driver_nl80211_set_country(void *priv, const char *alpha2_arg)
1374 {
1375         struct i802_bss *bss = priv;
1376         struct wpa_driver_nl80211_data *drv = bss->drv;
1377         char alpha2[3];
1378         struct nl_msg *msg;
1379
1380         msg = nlmsg_alloc();
1381         if (!msg)
1382                 return -ENOMEM;
1383
1384         alpha2[0] = alpha2_arg[0];
1385         alpha2[1] = alpha2_arg[1];
1386         alpha2[2] = '\0';
1387
1388         if (!nl80211_cmd(drv, msg, 0, NL80211_CMD_REQ_SET_REG) ||
1389             nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, alpha2)) {
1390                 nlmsg_free(msg);
1391                 return -EINVAL;
1392         }
1393         if (send_and_recv_msgs(drv, msg, NULL, NULL))
1394                 return -EINVAL;
1395         return 0;
1396 }
1397
1398
1399 static int nl80211_get_country(struct nl_msg *msg, void *arg)
1400 {
1401         char *alpha2 = arg;
1402         struct nlattr *tb_msg[NL80211_ATTR_MAX + 1];
1403         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1404
1405         nla_parse(tb_msg, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1406                   genlmsg_attrlen(gnlh, 0), NULL);
1407         if (!tb_msg[NL80211_ATTR_REG_ALPHA2]) {
1408                 wpa_printf(MSG_DEBUG, "nl80211: No country information available");
1409                 return NL_SKIP;
1410         }
1411         os_strlcpy(alpha2, nla_data(tb_msg[NL80211_ATTR_REG_ALPHA2]), 3);
1412         return NL_SKIP;
1413 }
1414
1415
1416 static int wpa_driver_nl80211_get_country(void *priv, char *alpha2)
1417 {
1418         struct i802_bss *bss = priv;
1419         struct wpa_driver_nl80211_data *drv = bss->drv;
1420         struct nl_msg *msg;
1421         int ret;
1422
1423         msg = nlmsg_alloc();
1424         if (!msg)
1425                 return -ENOMEM;
1426
1427         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_REG);
1428         alpha2[0] = '\0';
1429         ret = send_and_recv_msgs(drv, msg, nl80211_get_country, alpha2);
1430         if (!alpha2[0])
1431                 ret = -1;
1432
1433         return ret;
1434 }
1435
1436
1437 static int wpa_driver_nl80211_init_nl_global(struct nl80211_global *global)
1438 {
1439         int ret;
1440
1441         global->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
1442         if (global->nl_cb == NULL) {
1443                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate netlink "
1444                            "callbacks");
1445                 return -1;
1446         }
1447
1448         global->nl = nl_create_handle(global->nl_cb, "nl");
1449         if (global->nl == NULL)
1450                 goto err;
1451
1452         global->nl80211_id = genl_ctrl_resolve(global->nl, "nl80211");
1453         if (global->nl80211_id < 0) {
1454                 wpa_printf(MSG_ERROR, "nl80211: 'nl80211' generic netlink not "
1455                            "found");
1456                 goto err;
1457         }
1458
1459         global->nl_event = nl_create_handle(global->nl_cb, "event");
1460         if (global->nl_event == NULL)
1461                 goto err;
1462
1463         ret = nl_get_multicast_id(global, "nl80211", "scan");
1464         if (ret >= 0)
1465                 ret = nl_socket_add_membership(global->nl_event, ret);
1466         if (ret < 0) {
1467                 wpa_printf(MSG_ERROR, "nl80211: Could not add multicast "
1468                            "membership for scan events: %d (%s)",
1469                            ret, strerror(-ret));
1470                 goto err;
1471         }
1472
1473         ret = nl_get_multicast_id(global, "nl80211", "mlme");
1474         if (ret >= 0)
1475                 ret = nl_socket_add_membership(global->nl_event, ret);
1476         if (ret < 0) {
1477                 wpa_printf(MSG_ERROR, "nl80211: Could not add multicast "
1478                            "membership for mlme events: %d (%s)",
1479                            ret, strerror(-ret));
1480                 goto err;
1481         }
1482
1483         ret = nl_get_multicast_id(global, "nl80211", "regulatory");
1484         if (ret >= 0)
1485                 ret = nl_socket_add_membership(global->nl_event, ret);
1486         if (ret < 0) {
1487                 wpa_printf(MSG_DEBUG, "nl80211: Could not add multicast "
1488                            "membership for regulatory events: %d (%s)",
1489                            ret, strerror(-ret));
1490                 /* Continue without regulatory events */
1491         }
1492
1493         ret = nl_get_multicast_id(global, "nl80211", "vendor");
1494         if (ret >= 0)
1495                 ret = nl_socket_add_membership(global->nl_event, ret);
1496         if (ret < 0) {
1497                 wpa_printf(MSG_DEBUG, "nl80211: Could not add multicast "
1498                            "membership for vendor events: %d (%s)",
1499                            ret, strerror(-ret));
1500                 /* Continue without vendor events */
1501         }
1502
1503         nl_cb_set(global->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM,
1504                   no_seq_check, NULL);
1505         nl_cb_set(global->nl_cb, NL_CB_VALID, NL_CB_CUSTOM,
1506                   process_global_event, global);
1507
1508         nl80211_register_eloop_read(&global->nl_event,
1509                                     wpa_driver_nl80211_event_receive,
1510                                     global->nl_cb);
1511
1512         return 0;
1513
1514 err:
1515         nl_destroy_handles(&global->nl_event);
1516         nl_destroy_handles(&global->nl);
1517         nl_cb_put(global->nl_cb);
1518         global->nl_cb = NULL;
1519         return -1;
1520 }
1521
1522
1523 static int wpa_driver_nl80211_init_nl(struct wpa_driver_nl80211_data *drv)
1524 {
1525         drv->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
1526         if (!drv->nl_cb) {
1527                 wpa_printf(MSG_ERROR, "nl80211: Failed to alloc cb struct");
1528                 return -1;
1529         }
1530
1531         nl_cb_set(drv->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM,
1532                   no_seq_check, NULL);
1533         nl_cb_set(drv->nl_cb, NL_CB_VALID, NL_CB_CUSTOM,
1534                   process_drv_event, drv);
1535
1536         return 0;
1537 }
1538
1539
1540 static void wpa_driver_nl80211_rfkill_blocked(void *ctx)
1541 {
1542         wpa_printf(MSG_DEBUG, "nl80211: RFKILL blocked");
1543         /*
1544          * This may be for any interface; use ifdown event to disable
1545          * interface.
1546          */
1547 }
1548
1549
1550 static void wpa_driver_nl80211_rfkill_unblocked(void *ctx)
1551 {
1552         struct wpa_driver_nl80211_data *drv = ctx;
1553         wpa_printf(MSG_DEBUG, "nl80211: RFKILL unblocked");
1554         if (i802_set_iface_flags(drv->first_bss, 1)) {
1555                 wpa_printf(MSG_DEBUG, "nl80211: Could not set interface UP "
1556                            "after rfkill unblock");
1557                 return;
1558         }
1559         /* rtnetlink ifup handler will report interface as enabled */
1560 }
1561
1562
1563 static void wpa_driver_nl80211_handle_eapol_tx_status(int sock,
1564                                                       void *eloop_ctx,
1565                                                       void *handle)
1566 {
1567         struct wpa_driver_nl80211_data *drv = eloop_ctx;
1568         u8 data[2048];
1569         struct msghdr msg;
1570         struct iovec entry;
1571         u8 control[512];
1572         struct cmsghdr *cmsg;
1573         int res, found_ee = 0, found_wifi = 0, acked = 0;
1574         union wpa_event_data event;
1575
1576         memset(&msg, 0, sizeof(msg));
1577         msg.msg_iov = &entry;
1578         msg.msg_iovlen = 1;
1579         entry.iov_base = data;
1580         entry.iov_len = sizeof(data);
1581         msg.msg_control = &control;
1582         msg.msg_controllen = sizeof(control);
1583
1584         res = recvmsg(sock, &msg, MSG_ERRQUEUE);
1585         /* if error or not fitting 802.3 header, return */
1586         if (res < 14)
1587                 return;
1588
1589         for (cmsg = CMSG_FIRSTHDR(&msg); cmsg; cmsg = CMSG_NXTHDR(&msg, cmsg))
1590         {
1591                 if (cmsg->cmsg_level == SOL_SOCKET &&
1592                     cmsg->cmsg_type == SCM_WIFI_STATUS) {
1593                         int *ack;
1594
1595                         found_wifi = 1;
1596                         ack = (void *)CMSG_DATA(cmsg);
1597                         acked = *ack;
1598                 }
1599
1600                 if (cmsg->cmsg_level == SOL_PACKET &&
1601                     cmsg->cmsg_type == PACKET_TX_TIMESTAMP) {
1602                         struct sock_extended_err *err =
1603                                 (struct sock_extended_err *)CMSG_DATA(cmsg);
1604
1605                         if (err->ee_origin == SO_EE_ORIGIN_TXSTATUS)
1606                                 found_ee = 1;
1607                 }
1608         }
1609
1610         if (!found_ee || !found_wifi)
1611                 return;
1612
1613         memset(&event, 0, sizeof(event));
1614         event.eapol_tx_status.dst = data;
1615         event.eapol_tx_status.data = data + 14;
1616         event.eapol_tx_status.data_len = res - 14;
1617         event.eapol_tx_status.ack = acked;
1618         wpa_supplicant_event(drv->ctx, EVENT_EAPOL_TX_STATUS, &event);
1619 }
1620
1621
1622 static int nl80211_init_bss(struct i802_bss *bss)
1623 {
1624         bss->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
1625         if (!bss->nl_cb)
1626                 return -1;
1627
1628         nl_cb_set(bss->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM,
1629                   no_seq_check, NULL);
1630         nl_cb_set(bss->nl_cb, NL_CB_VALID, NL_CB_CUSTOM,
1631                   process_bss_event, bss);
1632
1633         return 0;
1634 }
1635
1636
1637 static void nl80211_destroy_bss(struct i802_bss *bss)
1638 {
1639         nl_cb_put(bss->nl_cb);
1640         bss->nl_cb = NULL;
1641 }
1642
1643
1644 static void * wpa_driver_nl80211_drv_init(void *ctx, const char *ifname,
1645                                           void *global_priv, int hostapd,
1646                                           const u8 *set_addr,
1647                                           const char *driver_params)
1648 {
1649         struct wpa_driver_nl80211_data *drv;
1650         struct rfkill_config *rcfg;
1651         struct i802_bss *bss;
1652
1653         if (global_priv == NULL)
1654                 return NULL;
1655         drv = os_zalloc(sizeof(*drv));
1656         if (drv == NULL)
1657                 return NULL;
1658         drv->global = global_priv;
1659         drv->ctx = ctx;
1660         drv->hostapd = !!hostapd;
1661         drv->eapol_sock = -1;
1662         drv->num_if_indices = sizeof(drv->default_if_indices) / sizeof(int);
1663         drv->if_indices = drv->default_if_indices;
1664
1665         drv->first_bss = os_zalloc(sizeof(*drv->first_bss));
1666         if (!drv->first_bss) {
1667                 os_free(drv);
1668                 return NULL;
1669         }
1670         bss = drv->first_bss;
1671         bss->drv = drv;
1672         bss->ctx = ctx;
1673
1674         os_strlcpy(bss->ifname, ifname, sizeof(bss->ifname));
1675         drv->monitor_ifidx = -1;
1676         drv->monitor_sock = -1;
1677         drv->eapol_tx_sock = -1;
1678         drv->ap_scan_as_station = NL80211_IFTYPE_UNSPECIFIED;
1679
1680         if (wpa_driver_nl80211_init_nl(drv)) {
1681                 os_free(drv);
1682                 return NULL;
1683         }
1684
1685         if (nl80211_init_bss(bss))
1686                 goto failed;
1687
1688         rcfg = os_zalloc(sizeof(*rcfg));
1689         if (rcfg == NULL)
1690                 goto failed;
1691         rcfg->ctx = drv;
1692         os_strlcpy(rcfg->ifname, ifname, sizeof(rcfg->ifname));
1693         rcfg->blocked_cb = wpa_driver_nl80211_rfkill_blocked;
1694         rcfg->unblocked_cb = wpa_driver_nl80211_rfkill_unblocked;
1695         drv->rfkill = rfkill_init(rcfg);
1696         if (drv->rfkill == NULL) {
1697                 wpa_printf(MSG_DEBUG, "nl80211: RFKILL status not available");
1698                 os_free(rcfg);
1699         }
1700
1701         if (linux_iface_up(drv->global->ioctl_sock, ifname) > 0)
1702                 drv->start_iface_up = 1;
1703
1704         if (wpa_driver_nl80211_finish_drv_init(drv, set_addr, 1, driver_params))
1705                 goto failed;
1706
1707         drv->eapol_tx_sock = socket(PF_PACKET, SOCK_DGRAM, 0);
1708         if (drv->eapol_tx_sock < 0)
1709                 goto failed;
1710
1711         if (drv->data_tx_status) {
1712                 int enabled = 1;
1713
1714                 if (setsockopt(drv->eapol_tx_sock, SOL_SOCKET, SO_WIFI_STATUS,
1715                                &enabled, sizeof(enabled)) < 0) {
1716                         wpa_printf(MSG_DEBUG,
1717                                 "nl80211: wifi status sockopt failed\n");
1718                         drv->data_tx_status = 0;
1719                         if (!drv->use_monitor)
1720                                 drv->capa.flags &=
1721                                         ~WPA_DRIVER_FLAGS_EAPOL_TX_STATUS;
1722                 } else {
1723                         eloop_register_read_sock(drv->eapol_tx_sock,
1724                                 wpa_driver_nl80211_handle_eapol_tx_status,
1725                                 drv, NULL);
1726                 }
1727         }
1728
1729         if (drv->global) {
1730                 dl_list_add(&drv->global->interfaces, &drv->list);
1731                 drv->in_interface_list = 1;
1732         }
1733
1734         return bss;
1735
1736 failed:
1737         wpa_driver_nl80211_deinit(bss);
1738         return NULL;
1739 }
1740
1741
1742 /**
1743  * wpa_driver_nl80211_init - Initialize nl80211 driver interface
1744  * @ctx: context to be used when calling wpa_supplicant functions,
1745  * e.g., wpa_supplicant_event()
1746  * @ifname: interface name, e.g., wlan0
1747  * @global_priv: private driver global data from global_init()
1748  * Returns: Pointer to private data, %NULL on failure
1749  */
1750 static void * wpa_driver_nl80211_init(void *ctx, const char *ifname,
1751                                       void *global_priv)
1752 {
1753         return wpa_driver_nl80211_drv_init(ctx, ifname, global_priv, 0, NULL,
1754                                            NULL);
1755 }
1756
1757
1758 static int nl80211_register_frame(struct i802_bss *bss,
1759                                   struct nl_handle *nl_handle,
1760                                   u16 type, const u8 *match, size_t match_len)
1761 {
1762         struct wpa_driver_nl80211_data *drv = bss->drv;
1763         struct nl_msg *msg;
1764         int ret;
1765         char buf[30];
1766
1767         buf[0] = '\0';
1768         wpa_snprintf_hex(buf, sizeof(buf), match, match_len);
1769         wpa_printf(MSG_DEBUG, "nl80211: Register frame type=0x%x (%s) nl_handle=%p match=%s",
1770                    type, fc2str(type), nl_handle, buf);
1771
1772         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_REGISTER_ACTION)) ||
1773             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE, type) ||
1774             nla_put(msg, NL80211_ATTR_FRAME_MATCH, match_len, match)) {
1775                 nlmsg_free(msg);
1776                 return -1;
1777         }
1778
1779         ret = send_and_recv(drv->global, nl_handle, msg, NULL, NULL);
1780         if (ret) {
1781                 wpa_printf(MSG_DEBUG, "nl80211: Register frame command "
1782                            "failed (type=%u): ret=%d (%s)",
1783                            type, ret, strerror(-ret));
1784                 wpa_hexdump(MSG_DEBUG, "nl80211: Register frame match",
1785                             match, match_len);
1786         }
1787         return ret;
1788 }
1789
1790
1791 static int nl80211_alloc_mgmt_handle(struct i802_bss *bss)
1792 {
1793         struct wpa_driver_nl80211_data *drv = bss->drv;
1794
1795         if (bss->nl_mgmt) {
1796                 wpa_printf(MSG_DEBUG, "nl80211: Mgmt reporting "
1797                            "already on! (nl_mgmt=%p)", bss->nl_mgmt);
1798                 return -1;
1799         }
1800
1801         bss->nl_mgmt = nl_create_handle(drv->nl_cb, "mgmt");
1802         if (bss->nl_mgmt == NULL)
1803                 return -1;
1804
1805         return 0;
1806 }
1807
1808
1809 static void nl80211_mgmt_handle_register_eloop(struct i802_bss *bss)
1810 {
1811         nl80211_register_eloop_read(&bss->nl_mgmt,
1812                                     wpa_driver_nl80211_event_receive,
1813                                     bss->nl_cb);
1814 }
1815
1816
1817 static int nl80211_register_action_frame(struct i802_bss *bss,
1818                                          const u8 *match, size_t match_len)
1819 {
1820         u16 type = (WLAN_FC_TYPE_MGMT << 2) | (WLAN_FC_STYPE_ACTION << 4);
1821         return nl80211_register_frame(bss, bss->nl_mgmt,
1822                                       type, match, match_len);
1823 }
1824
1825
1826 static int nl80211_mgmt_subscribe_non_ap(struct i802_bss *bss)
1827 {
1828         struct wpa_driver_nl80211_data *drv = bss->drv;
1829         int ret = 0;
1830
1831         if (nl80211_alloc_mgmt_handle(bss))
1832                 return -1;
1833         wpa_printf(MSG_DEBUG, "nl80211: Subscribe to mgmt frames with non-AP "
1834                    "handle %p", bss->nl_mgmt);
1835
1836         if (drv->nlmode == NL80211_IFTYPE_ADHOC) {
1837                 u16 type = (WLAN_FC_TYPE_MGMT << 2) | (WLAN_FC_STYPE_AUTH << 4);
1838
1839                 /* register for any AUTH message */
1840                 nl80211_register_frame(bss, bss->nl_mgmt, type, NULL, 0);
1841         }
1842
1843 #ifdef CONFIG_INTERWORKING
1844         /* QoS Map Configure */
1845         if (nl80211_register_action_frame(bss, (u8 *) "\x01\x04", 2) < 0)
1846                 ret = -1;
1847 #endif /* CONFIG_INTERWORKING */
1848 #if defined(CONFIG_P2P) || defined(CONFIG_INTERWORKING)
1849         /* GAS Initial Request */
1850         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0a", 2) < 0)
1851                 ret = -1;
1852         /* GAS Initial Response */
1853         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0b", 2) < 0)
1854                 ret = -1;
1855         /* GAS Comeback Request */
1856         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0c", 2) < 0)
1857                 ret = -1;
1858         /* GAS Comeback Response */
1859         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0d", 2) < 0)
1860                 ret = -1;
1861         /* Protected GAS Initial Request */
1862         if (nl80211_register_action_frame(bss, (u8 *) "\x09\x0a", 2) < 0)
1863                 ret = -1;
1864         /* Protected GAS Initial Response */
1865         if (nl80211_register_action_frame(bss, (u8 *) "\x09\x0b", 2) < 0)
1866                 ret = -1;
1867         /* Protected GAS Comeback Request */
1868         if (nl80211_register_action_frame(bss, (u8 *) "\x09\x0c", 2) < 0)
1869                 ret = -1;
1870         /* Protected GAS Comeback Response */
1871         if (nl80211_register_action_frame(bss, (u8 *) "\x09\x0d", 2) < 0)
1872                 ret = -1;
1873 #endif /* CONFIG_P2P || CONFIG_INTERWORKING */
1874 #ifdef CONFIG_P2P
1875         /* P2P Public Action */
1876         if (nl80211_register_action_frame(bss,
1877                                           (u8 *) "\x04\x09\x50\x6f\x9a\x09",
1878                                           6) < 0)
1879                 ret = -1;
1880         /* P2P Action */
1881         if (nl80211_register_action_frame(bss,
1882                                           (u8 *) "\x7f\x50\x6f\x9a\x09",
1883                                           5) < 0)
1884                 ret = -1;
1885 #endif /* CONFIG_P2P */
1886 #ifdef CONFIG_IEEE80211W
1887         /* SA Query Response */
1888         if (nl80211_register_action_frame(bss, (u8 *) "\x08\x01", 2) < 0)
1889                 ret = -1;
1890 #endif /* CONFIG_IEEE80211W */
1891 #ifdef CONFIG_TDLS
1892         if ((drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT)) {
1893                 /* TDLS Discovery Response */
1894                 if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0e", 2) <
1895                     0)
1896                         ret = -1;
1897         }
1898 #endif /* CONFIG_TDLS */
1899
1900         /* FT Action frames */
1901         if (nl80211_register_action_frame(bss, (u8 *) "\x06", 1) < 0)
1902                 ret = -1;
1903         else
1904                 drv->capa.key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_FT |
1905                         WPA_DRIVER_CAPA_KEY_MGMT_FT_PSK;
1906
1907         /* WNM - BSS Transition Management Request */
1908         if (nl80211_register_action_frame(bss, (u8 *) "\x0a\x07", 2) < 0)
1909                 ret = -1;
1910         /* WNM-Sleep Mode Response */
1911         if (nl80211_register_action_frame(bss, (u8 *) "\x0a\x11", 2) < 0)
1912                 ret = -1;
1913
1914 #ifdef CONFIG_HS20
1915         /* WNM-Notification */
1916         if (nl80211_register_action_frame(bss, (u8 *) "\x0a\x1a", 2) < 0)
1917                 ret = -1;
1918 #endif /* CONFIG_HS20 */
1919
1920         /* WMM-AC ADDTS Response */
1921         if (nl80211_register_action_frame(bss, (u8 *) "\x11\x01", 2) < 0)
1922                 return -1;
1923
1924         /* WMM-AC DELTS */
1925         if (nl80211_register_action_frame(bss, (u8 *) "\x11\x02", 2) < 0)
1926                 return -1;
1927
1928         /* Radio Measurement - Neighbor Report Response */
1929         if (nl80211_register_action_frame(bss, (u8 *) "\x05\x05", 2) < 0)
1930                 ret = -1;
1931
1932         /* Radio Measurement - Link Measurement Request */
1933         if ((drv->capa.rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION) &&
1934             (nl80211_register_action_frame(bss, (u8 *) "\x05\x02", 2) < 0))
1935                 ret = -1;
1936
1937         nl80211_mgmt_handle_register_eloop(bss);
1938
1939         return ret;
1940 }
1941
1942
1943 static int nl80211_mgmt_subscribe_mesh(struct i802_bss *bss)
1944 {
1945         int ret = 0;
1946
1947         if (nl80211_alloc_mgmt_handle(bss))
1948                 return -1;
1949
1950         wpa_printf(MSG_DEBUG,
1951                    "nl80211: Subscribe to mgmt frames with mesh handle %p",
1952                    bss->nl_mgmt);
1953
1954         /* Auth frames for mesh SAE */
1955         if (nl80211_register_frame(bss, bss->nl_mgmt,
1956                                    (WLAN_FC_TYPE_MGMT << 2) |
1957                                    (WLAN_FC_STYPE_AUTH << 4),
1958                                    NULL, 0) < 0)
1959                 ret = -1;
1960
1961         /* Mesh peering open */
1962         if (nl80211_register_action_frame(bss, (u8 *) "\x0f\x01", 2) < 0)
1963                 ret = -1;
1964         /* Mesh peering confirm */
1965         if (nl80211_register_action_frame(bss, (u8 *) "\x0f\x02", 2) < 0)
1966                 ret = -1;
1967         /* Mesh peering close */
1968         if (nl80211_register_action_frame(bss, (u8 *) "\x0f\x03", 2) < 0)
1969                 ret = -1;
1970
1971         nl80211_mgmt_handle_register_eloop(bss);
1972
1973         return ret;
1974 }
1975
1976
1977 static int nl80211_register_spurious_class3(struct i802_bss *bss)
1978 {
1979         struct wpa_driver_nl80211_data *drv = bss->drv;
1980         struct nl_msg *msg;
1981         int ret;
1982
1983         msg = nlmsg_alloc();
1984         if (!msg)
1985                 return -1;
1986
1987         if (!nl80211_cmd(drv, msg, 0, NL80211_CMD_UNEXPECTED_FRAME) ||
1988             nla_put_u32(msg, NL80211_ATTR_IFINDEX, bss->ifindex)) {
1989                 nlmsg_free(msg);
1990                 return -1;
1991         }
1992
1993         ret = send_and_recv(drv->global, bss->nl_mgmt, msg, NULL, NULL);
1994         if (ret) {
1995                 wpa_printf(MSG_DEBUG, "nl80211: Register spurious class3 "
1996                            "failed: ret=%d (%s)",
1997                            ret, strerror(-ret));
1998         }
1999         return ret;
2000 }
2001
2002
2003 static int nl80211_mgmt_subscribe_ap(struct i802_bss *bss)
2004 {
2005         static const int stypes[] = {
2006                 WLAN_FC_STYPE_AUTH,
2007                 WLAN_FC_STYPE_ASSOC_REQ,
2008                 WLAN_FC_STYPE_REASSOC_REQ,
2009                 WLAN_FC_STYPE_DISASSOC,
2010                 WLAN_FC_STYPE_DEAUTH,
2011                 WLAN_FC_STYPE_ACTION,
2012                 WLAN_FC_STYPE_PROBE_REQ,
2013 /* Beacon doesn't work as mac80211 doesn't currently allow
2014  * it, but it wouldn't really be the right thing anyway as
2015  * it isn't per interface ... maybe just dump the scan
2016  * results periodically for OLBC?
2017  */
2018                 /* WLAN_FC_STYPE_BEACON, */
2019         };
2020         unsigned int i;
2021
2022         if (nl80211_alloc_mgmt_handle(bss))
2023                 return -1;
2024         wpa_printf(MSG_DEBUG, "nl80211: Subscribe to mgmt frames with AP "
2025                    "handle %p", bss->nl_mgmt);
2026
2027         for (i = 0; i < ARRAY_SIZE(stypes); i++) {
2028                 if (nl80211_register_frame(bss, bss->nl_mgmt,
2029                                            (WLAN_FC_TYPE_MGMT << 2) |
2030                                            (stypes[i] << 4),
2031                                            NULL, 0) < 0) {
2032                         goto out_err;
2033                 }
2034         }
2035
2036         if (nl80211_register_spurious_class3(bss))
2037                 goto out_err;
2038
2039         if (nl80211_get_wiphy_data_ap(bss) == NULL)
2040                 goto out_err;
2041
2042         nl80211_mgmt_handle_register_eloop(bss);
2043         return 0;
2044
2045 out_err:
2046         nl_destroy_handles(&bss->nl_mgmt);
2047         return -1;
2048 }
2049
2050
2051 static int nl80211_mgmt_subscribe_ap_dev_sme(struct i802_bss *bss)
2052 {
2053         if (nl80211_alloc_mgmt_handle(bss))
2054                 return -1;
2055         wpa_printf(MSG_DEBUG, "nl80211: Subscribe to mgmt frames with AP "
2056                    "handle %p (device SME)", bss->nl_mgmt);
2057
2058         if (nl80211_register_frame(bss, bss->nl_mgmt,
2059                                    (WLAN_FC_TYPE_MGMT << 2) |
2060                                    (WLAN_FC_STYPE_ACTION << 4),
2061                                    NULL, 0) < 0)
2062                 goto out_err;
2063
2064         nl80211_mgmt_handle_register_eloop(bss);
2065         return 0;
2066
2067 out_err:
2068         nl_destroy_handles(&bss->nl_mgmt);
2069         return -1;
2070 }
2071
2072
2073 static void nl80211_mgmt_unsubscribe(struct i802_bss *bss, const char *reason)
2074 {
2075         if (bss->nl_mgmt == NULL)
2076                 return;
2077         wpa_printf(MSG_DEBUG, "nl80211: Unsubscribe mgmt frames handle %p "
2078                    "(%s)", bss->nl_mgmt, reason);
2079         nl80211_destroy_eloop_handle(&bss->nl_mgmt);
2080
2081         nl80211_put_wiphy_data_ap(bss);
2082 }
2083
2084
2085 static void wpa_driver_nl80211_send_rfkill(void *eloop_ctx, void *timeout_ctx)
2086 {
2087         wpa_supplicant_event(timeout_ctx, EVENT_INTERFACE_DISABLED, NULL);
2088 }
2089
2090
2091 static void nl80211_del_p2pdev(struct i802_bss *bss)
2092 {
2093         struct nl_msg *msg;
2094         int ret;
2095
2096         msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_DEL_INTERFACE);
2097         ret = send_and_recv_msgs(bss->drv, msg, NULL, NULL);
2098
2099         wpa_printf(MSG_DEBUG, "nl80211: Delete P2P Device %s (0x%llx): %s",
2100                    bss->ifname, (long long unsigned int) bss->wdev_id,
2101                    strerror(-ret));
2102 }
2103
2104
2105 static int nl80211_set_p2pdev(struct i802_bss *bss, int start)
2106 {
2107         struct nl_msg *msg;
2108         int ret;
2109
2110         msg = nl80211_cmd_msg(bss, 0, start ? NL80211_CMD_START_P2P_DEVICE :
2111                               NL80211_CMD_STOP_P2P_DEVICE);
2112         ret = send_and_recv_msgs(bss->drv, msg, NULL, NULL);
2113
2114         wpa_printf(MSG_DEBUG, "nl80211: %s P2P Device %s (0x%llx): %s",
2115                    start ? "Start" : "Stop",
2116                    bss->ifname, (long long unsigned int) bss->wdev_id,
2117                    strerror(-ret));
2118         return ret;
2119 }
2120
2121
2122 static int i802_set_iface_flags(struct i802_bss *bss, int up)
2123 {
2124         enum nl80211_iftype nlmode;
2125
2126         nlmode = nl80211_get_ifmode(bss);
2127         if (nlmode != NL80211_IFTYPE_P2P_DEVICE) {
2128                 return linux_set_iface_flags(bss->drv->global->ioctl_sock,
2129                                              bss->ifname, up);
2130         }
2131
2132         /* P2P Device has start/stop which is equivalent */
2133         return nl80211_set_p2pdev(bss, up);
2134 }
2135
2136
2137 static int
2138 wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv,
2139                                    const u8 *set_addr, int first,
2140                                    const char *driver_params)
2141 {
2142         struct i802_bss *bss = drv->first_bss;
2143         int send_rfkill_event = 0;
2144         enum nl80211_iftype nlmode;
2145
2146         drv->ifindex = if_nametoindex(bss->ifname);
2147         bss->ifindex = drv->ifindex;
2148         bss->wdev_id = drv->global->if_add_wdevid;
2149         bss->wdev_id_set = drv->global->if_add_wdevid_set;
2150
2151         bss->if_dynamic = drv->ifindex == drv->global->if_add_ifindex;
2152         bss->if_dynamic = bss->if_dynamic || drv->global->if_add_wdevid_set;
2153         drv->global->if_add_wdevid_set = 0;
2154
2155         if (!bss->if_dynamic && nl80211_get_ifmode(bss) == NL80211_IFTYPE_AP)
2156                 bss->static_ap = 1;
2157
2158         if (wpa_driver_nl80211_capa(drv))
2159                 return -1;
2160
2161         if (driver_params && nl80211_set_param(bss, driver_params) < 0)
2162                 return -1;
2163
2164         wpa_printf(MSG_DEBUG, "nl80211: interface %s in phy %s",
2165                    bss->ifname, drv->phyname);
2166
2167         if (set_addr &&
2168             (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 0) ||
2169              linux_set_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
2170                                 set_addr)))
2171                 return -1;
2172
2173         if (first && nl80211_get_ifmode(bss) == NL80211_IFTYPE_AP)
2174                 drv->start_mode_ap = 1;
2175
2176         if (drv->hostapd || bss->static_ap)
2177                 nlmode = NL80211_IFTYPE_AP;
2178         else if (bss->if_dynamic)
2179                 nlmode = nl80211_get_ifmode(bss);
2180         else
2181                 nlmode = NL80211_IFTYPE_STATION;
2182
2183         if (wpa_driver_nl80211_set_mode(bss, nlmode) < 0) {
2184                 wpa_printf(MSG_ERROR, "nl80211: Could not configure driver mode");
2185                 return -1;
2186         }
2187
2188         if (nlmode == NL80211_IFTYPE_P2P_DEVICE)
2189                 nl80211_get_macaddr(bss);
2190
2191         if (!rfkill_is_blocked(drv->rfkill)) {
2192                 int ret = i802_set_iface_flags(bss, 1);
2193                 if (ret) {
2194                         wpa_printf(MSG_ERROR, "nl80211: Could not set "
2195                                    "interface '%s' UP", bss->ifname);
2196                         return ret;
2197                 }
2198                 if (nlmode == NL80211_IFTYPE_P2P_DEVICE)
2199                         return ret;
2200         } else {
2201                 wpa_printf(MSG_DEBUG, "nl80211: Could not yet enable "
2202                            "interface '%s' due to rfkill", bss->ifname);
2203                 if (nlmode == NL80211_IFTYPE_P2P_DEVICE)
2204                         return 0;
2205                 drv->if_disabled = 1;
2206                 send_rfkill_event = 1;
2207         }
2208
2209         if (!drv->hostapd)
2210                 netlink_send_oper_ifla(drv->global->netlink, drv->ifindex,
2211                                        1, IF_OPER_DORMANT);
2212
2213         if (linux_get_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
2214                                bss->addr))
2215                 return -1;
2216         os_memcpy(drv->perm_addr, bss->addr, ETH_ALEN);
2217
2218         if (send_rfkill_event) {
2219                 eloop_register_timeout(0, 0, wpa_driver_nl80211_send_rfkill,
2220                                        drv, drv->ctx);
2221         }
2222
2223         return 0;
2224 }
2225
2226
2227 static int wpa_driver_nl80211_del_beacon(struct wpa_driver_nl80211_data *drv)
2228 {
2229         struct nl_msg *msg;
2230
2231         wpa_printf(MSG_DEBUG, "nl80211: Remove beacon (ifindex=%d)",
2232                    drv->ifindex);
2233         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_DEL_BEACON);
2234         return send_and_recv_msgs(drv, msg, NULL, NULL);
2235 }
2236
2237
2238 /**
2239  * wpa_driver_nl80211_deinit - Deinitialize nl80211 driver interface
2240  * @bss: Pointer to private nl80211 data from wpa_driver_nl80211_init()
2241  *
2242  * Shut down driver interface and processing of driver events. Free
2243  * private data buffer if one was allocated in wpa_driver_nl80211_init().
2244  */
2245 static void wpa_driver_nl80211_deinit(struct i802_bss *bss)
2246 {
2247         struct wpa_driver_nl80211_data *drv = bss->drv;
2248
2249         bss->in_deinit = 1;
2250         if (drv->data_tx_status)
2251                 eloop_unregister_read_sock(drv->eapol_tx_sock);
2252         if (drv->eapol_tx_sock >= 0)
2253                 close(drv->eapol_tx_sock);
2254
2255         if (bss->nl_preq)
2256                 wpa_driver_nl80211_probe_req_report(bss, 0);
2257         if (bss->added_if_into_bridge) {
2258                 if (linux_br_del_if(drv->global->ioctl_sock, bss->brname,
2259                                     bss->ifname) < 0)
2260                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
2261                                    "interface %s from bridge %s: %s",
2262                                    bss->ifname, bss->brname, strerror(errno));
2263                 if (drv->rtnl_sk)
2264                         nl80211_handle_destroy(drv->rtnl_sk);
2265         }
2266         if (bss->added_bridge) {
2267                 if (linux_br_del(drv->global->ioctl_sock, bss->brname) < 0)
2268                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
2269                                    "bridge %s: %s",
2270                                    bss->brname, strerror(errno));
2271         }
2272
2273         nl80211_remove_monitor_interface(drv);
2274
2275         if (is_ap_interface(drv->nlmode))
2276                 wpa_driver_nl80211_del_beacon(drv);
2277
2278         if (drv->eapol_sock >= 0) {
2279                 eloop_unregister_read_sock(drv->eapol_sock);
2280                 close(drv->eapol_sock);
2281         }
2282
2283         if (drv->if_indices != drv->default_if_indices)
2284                 os_free(drv->if_indices);
2285
2286         if (drv->disabled_11b_rates)
2287                 nl80211_disable_11b_rates(drv, drv->ifindex, 0);
2288
2289         netlink_send_oper_ifla(drv->global->netlink, drv->ifindex, 0,
2290                                IF_OPER_UP);
2291         eloop_cancel_timeout(wpa_driver_nl80211_send_rfkill, drv, drv->ctx);
2292         rfkill_deinit(drv->rfkill);
2293
2294         eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
2295
2296         if (!drv->start_iface_up)
2297                 (void) i802_set_iface_flags(bss, 0);
2298
2299         if (drv->addr_changed) {
2300                 if (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname,
2301                                           0) < 0) {
2302                         wpa_printf(MSG_DEBUG,
2303                                    "nl80211: Could not set interface down to restore permanent MAC address");
2304                 }
2305                 if (linux_set_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
2306                                        drv->perm_addr) < 0) {
2307                         wpa_printf(MSG_DEBUG,
2308                                    "nl80211: Could not restore permanent MAC address");
2309                 }
2310         }
2311
2312         if (drv->nlmode != NL80211_IFTYPE_P2P_DEVICE) {
2313                 if (!drv->hostapd || !drv->start_mode_ap)
2314                         wpa_driver_nl80211_set_mode(bss,
2315                                                     NL80211_IFTYPE_STATION);
2316                 nl80211_mgmt_unsubscribe(bss, "deinit");
2317         } else {
2318                 nl80211_mgmt_unsubscribe(bss, "deinit");
2319                 nl80211_del_p2pdev(bss);
2320         }
2321         nl_cb_put(drv->nl_cb);
2322
2323         nl80211_destroy_bss(drv->first_bss);
2324
2325         os_free(drv->filter_ssids);
2326
2327         os_free(drv->auth_ie);
2328
2329         if (drv->in_interface_list)
2330                 dl_list_del(&drv->list);
2331
2332         os_free(drv->extended_capa);
2333         os_free(drv->extended_capa_mask);
2334         os_free(drv->first_bss);
2335         os_free(drv);
2336 }
2337
2338
2339 /**
2340  * wpa_driver_nl80211_scan_timeout - Scan timeout to report scan completion
2341  * @eloop_ctx: Driver private data
2342  * @timeout_ctx: ctx argument given to wpa_driver_nl80211_init()
2343  *
2344  * This function can be used as registered timeout when starting a scan to
2345  * generate a scan completed event if the driver does not report this.
2346  */
2347 void wpa_driver_nl80211_scan_timeout(void *eloop_ctx, void *timeout_ctx)
2348 {
2349         struct wpa_driver_nl80211_data *drv = eloop_ctx;
2350         if (drv->ap_scan_as_station != NL80211_IFTYPE_UNSPECIFIED) {
2351                 wpa_driver_nl80211_set_mode(drv->first_bss,
2352                                             drv->ap_scan_as_station);
2353                 drv->ap_scan_as_station = NL80211_IFTYPE_UNSPECIFIED;
2354         }
2355         wpa_printf(MSG_DEBUG, "Scan timeout - try to get results");
2356         wpa_supplicant_event(timeout_ctx, EVENT_SCAN_RESULTS, NULL);
2357 }
2358
2359
2360 static struct nl_msg *
2361 nl80211_scan_common(struct wpa_driver_nl80211_data *drv, u8 cmd,
2362                     struct wpa_driver_scan_params *params, u64 *wdev_id)
2363 {
2364         struct nl_msg *msg;
2365         size_t i;
2366         u32 scan_flags = 0;
2367         int res;
2368
2369         msg = nlmsg_alloc();
2370         if (!msg)
2371                 return NULL;
2372
2373         nl80211_cmd(drv, msg, 0, cmd);
2374
2375         if (!wdev_id)
2376                 res = nla_put_u32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
2377         else
2378                 res = nla_put_u64(msg, NL80211_ATTR_WDEV, *wdev_id);
2379         if (res < 0)
2380                 goto fail;
2381
2382         if (params->num_ssids) {
2383                 struct nlattr *ssids;
2384
2385                 ssids = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
2386                 if (ssids == NULL)
2387                         goto fail;
2388                 for (i = 0; i < params->num_ssids; i++) {
2389                         wpa_hexdump_ascii(MSG_MSGDUMP, "nl80211: Scan SSID",
2390                                           params->ssids[i].ssid,
2391                                           params->ssids[i].ssid_len);
2392                         if (nla_put(msg, i + 1, params->ssids[i].ssid_len,
2393                                     params->ssids[i].ssid))
2394                                 goto fail;
2395                 }
2396                 nla_nest_end(msg, ssids);
2397         }
2398
2399         if (params->extra_ies) {
2400                 wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan extra IEs",
2401                             params->extra_ies, params->extra_ies_len);
2402                 if (nla_put(msg, NL80211_ATTR_IE, params->extra_ies_len,
2403                             params->extra_ies))
2404                         goto fail;
2405         }
2406
2407         if (params->freqs) {
2408                 struct nlattr *freqs;
2409                 freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
2410                 if (freqs == NULL)
2411                         goto fail;
2412                 for (i = 0; params->freqs[i]; i++) {
2413                         wpa_printf(MSG_MSGDUMP, "nl80211: Scan frequency %u "
2414                                    "MHz", params->freqs[i]);
2415                         if (nla_put_u32(msg, i + 1, params->freqs[i]))
2416                                 goto fail;
2417                 }
2418                 nla_nest_end(msg, freqs);
2419         }
2420
2421         os_free(drv->filter_ssids);
2422         drv->filter_ssids = params->filter_ssids;
2423         params->filter_ssids = NULL;
2424         drv->num_filter_ssids = params->num_filter_ssids;
2425
2426         if (params->only_new_results) {
2427                 wpa_printf(MSG_DEBUG, "nl80211: Add NL80211_SCAN_FLAG_FLUSH");
2428                 scan_flags |= NL80211_SCAN_FLAG_FLUSH;
2429         }
2430
2431         if (params->low_priority && drv->have_low_prio_scan) {
2432                 wpa_printf(MSG_DEBUG,
2433                            "nl80211: Add NL80211_SCAN_FLAG_LOW_PRIORITY");
2434                 scan_flags |= NL80211_SCAN_FLAG_LOW_PRIORITY;
2435         }
2436
2437         if (scan_flags &&
2438             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, scan_flags))
2439                 goto fail;
2440
2441         return msg;
2442
2443 fail:
2444         nlmsg_free(msg);
2445         return NULL;
2446 }
2447
2448
2449 /**
2450  * wpa_driver_nl80211_scan - Request the driver to initiate scan
2451  * @bss: Pointer to private driver data from wpa_driver_nl80211_init()
2452  * @params: Scan parameters
2453  * Returns: 0 on success, -1 on failure
2454  */
2455 static int wpa_driver_nl80211_scan(struct i802_bss *bss,
2456                                    struct wpa_driver_scan_params *params)
2457 {
2458         struct wpa_driver_nl80211_data *drv = bss->drv;
2459         int ret = -1, timeout;
2460         struct nl_msg *msg = NULL;
2461
2462         wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: scan request");
2463         drv->scan_for_auth = 0;
2464
2465         msg = nl80211_scan_common(drv, NL80211_CMD_TRIGGER_SCAN, params,
2466                                   bss->wdev_id_set ? &bss->wdev_id : NULL);
2467         if (!msg)
2468                 return -1;
2469
2470         if (params->p2p_probe) {
2471                 struct nlattr *rates;
2472
2473                 wpa_printf(MSG_DEBUG, "nl80211: P2P probe - mask SuppRates");
2474
2475                 rates = nla_nest_start(msg, NL80211_ATTR_SCAN_SUPP_RATES);
2476                 if (rates == NULL)
2477                         goto fail;
2478
2479                 /*
2480                  * Remove 2.4 GHz rates 1, 2, 5.5, 11 Mbps from supported rates
2481                  * by masking out everything else apart from the OFDM rates 6,
2482                  * 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS rates. All 5 GHz
2483                  * rates are left enabled.
2484                  */
2485                 if (nla_put(msg, NL80211_BAND_2GHZ, 8,
2486                             "\x0c\x12\x18\x24\x30\x48\x60\x6c"))
2487                         goto fail;
2488                 nla_nest_end(msg, rates);
2489
2490                 if (nla_put_flag(msg, NL80211_ATTR_TX_NO_CCK_RATE))
2491                         goto fail;
2492         }
2493
2494         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
2495         msg = NULL;
2496         if (ret) {
2497                 wpa_printf(MSG_DEBUG, "nl80211: Scan trigger failed: ret=%d "
2498                            "(%s)", ret, strerror(-ret));
2499                 if (drv->hostapd && is_ap_interface(drv->nlmode)) {
2500                         enum nl80211_iftype old_mode = drv->nlmode;
2501
2502                         /*
2503                          * mac80211 does not allow scan requests in AP mode, so
2504                          * try to do this in station mode.
2505                          */
2506                         if (wpa_driver_nl80211_set_mode(
2507                                     bss, NL80211_IFTYPE_STATION))
2508                                 goto fail;
2509
2510                         if (wpa_driver_nl80211_scan(bss, params)) {
2511                                 wpa_driver_nl80211_set_mode(bss, drv->nlmode);
2512                                 goto fail;
2513                         }
2514
2515                         /* Restore AP mode when processing scan results */
2516                         drv->ap_scan_as_station = old_mode;
2517                         ret = 0;
2518                 } else
2519                         goto fail;
2520         }
2521
2522         drv->scan_state = SCAN_REQUESTED;
2523         /* Not all drivers generate "scan completed" wireless event, so try to
2524          * read results after a timeout. */
2525         timeout = 10;
2526         if (drv->scan_complete_events) {
2527                 /*
2528                  * The driver seems to deliver events to notify when scan is
2529                  * complete, so use longer timeout to avoid race conditions
2530                  * with scanning and following association request.
2531                  */
2532                 timeout = 30;
2533         }
2534         wpa_printf(MSG_DEBUG, "Scan requested (ret=%d) - scan timeout %d "
2535                    "seconds", ret, timeout);
2536         eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
2537         eloop_register_timeout(timeout, 0, wpa_driver_nl80211_scan_timeout,
2538                                drv, drv->ctx);
2539
2540 fail:
2541         nlmsg_free(msg);
2542         return ret;
2543 }
2544
2545
2546 /**
2547  * wpa_driver_nl80211_sched_scan - Initiate a scheduled scan
2548  * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
2549  * @params: Scan parameters
2550  * @interval: Interval between scan cycles in milliseconds
2551  * Returns: 0 on success, -1 on failure or if not supported
2552  */
2553 static int wpa_driver_nl80211_sched_scan(void *priv,
2554                                          struct wpa_driver_scan_params *params,
2555                                          u32 interval)
2556 {
2557         struct i802_bss *bss = priv;
2558         struct wpa_driver_nl80211_data *drv = bss->drv;
2559         int ret = -1;
2560         struct nl_msg *msg;
2561         size_t i;
2562
2563         wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: sched_scan request");
2564
2565 #ifdef ANDROID
2566         if (!drv->capa.sched_scan_supported)
2567                 return android_pno_start(bss, params);
2568 #endif /* ANDROID */
2569
2570         msg = nl80211_scan_common(drv, NL80211_CMD_START_SCHED_SCAN, params,
2571                                   bss->wdev_id_set ? &bss->wdev_id : NULL);
2572         if (!msg ||
2573             nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL, interval))
2574                 goto fail;
2575
2576         if ((drv->num_filter_ssids &&
2577             (int) drv->num_filter_ssids <= drv->capa.max_match_sets) ||
2578             params->filter_rssi) {
2579                 struct nlattr *match_sets;
2580                 match_sets = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
2581                 if (match_sets == NULL)
2582                         goto fail;
2583
2584                 for (i = 0; i < drv->num_filter_ssids; i++) {
2585                         struct nlattr *match_set_ssid;
2586                         wpa_hexdump_ascii(MSG_MSGDUMP,
2587                                           "nl80211: Sched scan filter SSID",
2588                                           drv->filter_ssids[i].ssid,
2589                                           drv->filter_ssids[i].ssid_len);
2590
2591                         match_set_ssid = nla_nest_start(msg, i + 1);
2592                         if (match_set_ssid == NULL ||
2593                             nla_put(msg, NL80211_ATTR_SCHED_SCAN_MATCH_SSID,
2594                                     drv->filter_ssids[i].ssid_len,
2595                                     drv->filter_ssids[i].ssid) ||
2596                             (params->filter_rssi &&
2597                              nla_put_u32(msg,
2598                                          NL80211_SCHED_SCAN_MATCH_ATTR_RSSI,
2599                                          params->filter_rssi)))
2600                                 goto fail;
2601
2602                         nla_nest_end(msg, match_set_ssid);
2603                 }
2604
2605                 /*
2606                  * Due to backward compatibility code, newer kernels treat this
2607                  * matchset (with only an RSSI filter) as the default for all
2608                  * other matchsets, unless it's the only one, in which case the
2609                  * matchset will actually allow all SSIDs above the RSSI.
2610                  */
2611                 if (params->filter_rssi) {
2612                         struct nlattr *match_set_rssi;
2613                         match_set_rssi = nla_nest_start(msg, 0);
2614                         if (match_set_rssi == NULL ||
2615                             nla_put_u32(msg, NL80211_SCHED_SCAN_MATCH_ATTR_RSSI,
2616                                         params->filter_rssi))
2617                                 goto fail;
2618                         wpa_printf(MSG_MSGDUMP,
2619                                    "nl80211: Sched scan RSSI filter %d dBm",
2620                                    params->filter_rssi);
2621                         nla_nest_end(msg, match_set_rssi);
2622                 }
2623
2624                 nla_nest_end(msg, match_sets);
2625         }
2626
2627         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
2628
2629         /* TODO: if we get an error here, we should fall back to normal scan */
2630
2631         msg = NULL;
2632         if (ret) {
2633                 wpa_printf(MSG_DEBUG, "nl80211: Sched scan start failed: "
2634                            "ret=%d (%s)", ret, strerror(-ret));
2635                 goto fail;
2636         }
2637
2638         wpa_printf(MSG_DEBUG, "nl80211: Sched scan requested (ret=%d) - "
2639                    "scan interval %d msec", ret, interval);
2640
2641 fail:
2642         nlmsg_free(msg);
2643         return ret;
2644 }
2645
2646
2647 /**
2648  * wpa_driver_nl80211_stop_sched_scan - Stop a scheduled scan
2649  * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
2650  * Returns: 0 on success, -1 on failure or if not supported
2651  */
2652 static int wpa_driver_nl80211_stop_sched_scan(void *priv)
2653 {
2654         struct i802_bss *bss = priv;
2655         struct wpa_driver_nl80211_data *drv = bss->drv;
2656         int ret;
2657         struct nl_msg *msg;
2658
2659 #ifdef ANDROID
2660         if (!drv->capa.sched_scan_supported)
2661                 return android_pno_stop(bss);
2662 #endif /* ANDROID */
2663
2664         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_STOP_SCHED_SCAN);
2665         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
2666         if (ret) {
2667                 wpa_printf(MSG_DEBUG,
2668                            "nl80211: Sched scan stop failed: ret=%d (%s)",
2669                            ret, strerror(-ret));
2670         } else {
2671                 wpa_printf(MSG_DEBUG,
2672                            "nl80211: Sched scan stop sent");
2673         }
2674
2675         return ret;
2676 }
2677
2678
2679 static const u8 * nl80211_get_ie(const u8 *ies, size_t ies_len, u8 ie)
2680 {
2681         const u8 *end, *pos;
2682
2683         if (ies == NULL)
2684                 return NULL;
2685
2686         pos = ies;
2687         end = ies + ies_len;
2688
2689         while (pos + 1 < end) {
2690                 if (pos + 2 + pos[1] > end)
2691                         break;
2692                 if (pos[0] == ie)
2693                         return pos;
2694                 pos += 2 + pos[1];
2695         }
2696
2697         return NULL;
2698 }
2699
2700
2701 static int nl80211_scan_filtered(struct wpa_driver_nl80211_data *drv,
2702                                  const u8 *ie, size_t ie_len)
2703 {
2704         const u8 *ssid;
2705         size_t i;
2706
2707         if (drv->filter_ssids == NULL)
2708                 return 0;
2709
2710         ssid = nl80211_get_ie(ie, ie_len, WLAN_EID_SSID);
2711         if (ssid == NULL)
2712                 return 1;
2713
2714         for (i = 0; i < drv->num_filter_ssids; i++) {
2715                 if (ssid[1] == drv->filter_ssids[i].ssid_len &&
2716                     os_memcmp(ssid + 2, drv->filter_ssids[i].ssid, ssid[1]) ==
2717                     0)
2718                         return 0;
2719         }
2720
2721         return 1;
2722 }
2723
2724
2725 static int bss_info_handler(struct nl_msg *msg, void *arg)
2726 {
2727         struct nlattr *tb[NL80211_ATTR_MAX + 1];
2728         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
2729         struct nlattr *bss[NL80211_BSS_MAX + 1];
2730         static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = {
2731                 [NL80211_BSS_BSSID] = { .type = NLA_UNSPEC },
2732                 [NL80211_BSS_FREQUENCY] = { .type = NLA_U32 },
2733                 [NL80211_BSS_TSF] = { .type = NLA_U64 },
2734                 [NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 },
2735                 [NL80211_BSS_CAPABILITY] = { .type = NLA_U16 },
2736                 [NL80211_BSS_INFORMATION_ELEMENTS] = { .type = NLA_UNSPEC },
2737                 [NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 },
2738                 [NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 },
2739                 [NL80211_BSS_STATUS] = { .type = NLA_U32 },
2740                 [NL80211_BSS_SEEN_MS_AGO] = { .type = NLA_U32 },
2741                 [NL80211_BSS_BEACON_IES] = { .type = NLA_UNSPEC },
2742         };
2743         struct nl80211_bss_info_arg *_arg = arg;
2744         struct wpa_scan_results *res = _arg->res;
2745         struct wpa_scan_res **tmp;
2746         struct wpa_scan_res *r;
2747         const u8 *ie, *beacon_ie;
2748         size_t ie_len, beacon_ie_len;
2749         u8 *pos;
2750         size_t i;
2751
2752         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
2753                   genlmsg_attrlen(gnlh, 0), NULL);
2754         if (!tb[NL80211_ATTR_BSS])
2755                 return NL_SKIP;
2756         if (nla_parse_nested(bss, NL80211_BSS_MAX, tb[NL80211_ATTR_BSS],
2757                              bss_policy))
2758                 return NL_SKIP;
2759         if (bss[NL80211_BSS_STATUS]) {
2760                 enum nl80211_bss_status status;
2761                 status = nla_get_u32(bss[NL80211_BSS_STATUS]);
2762                 if (status == NL80211_BSS_STATUS_ASSOCIATED &&
2763                     bss[NL80211_BSS_FREQUENCY]) {
2764                         _arg->assoc_freq =
2765                                 nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
2766                         wpa_printf(MSG_DEBUG, "nl80211: Associated on %u MHz",
2767                                    _arg->assoc_freq);
2768                 }
2769                 if (status == NL80211_BSS_STATUS_IBSS_JOINED &&
2770                     bss[NL80211_BSS_FREQUENCY]) {
2771                         _arg->ibss_freq =
2772                                 nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
2773                         wpa_printf(MSG_DEBUG, "nl80211: IBSS-joined on %u MHz",
2774                                    _arg->ibss_freq);
2775                 }
2776                 if (status == NL80211_BSS_STATUS_ASSOCIATED &&
2777                     bss[NL80211_BSS_BSSID]) {
2778                         os_memcpy(_arg->assoc_bssid,
2779                                   nla_data(bss[NL80211_BSS_BSSID]), ETH_ALEN);
2780                         wpa_printf(MSG_DEBUG, "nl80211: Associated with "
2781                                    MACSTR, MAC2STR(_arg->assoc_bssid));
2782                 }
2783         }
2784         if (!res)
2785                 return NL_SKIP;
2786         if (bss[NL80211_BSS_INFORMATION_ELEMENTS]) {
2787                 ie = nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
2788                 ie_len = nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
2789         } else {
2790                 ie = NULL;
2791                 ie_len = 0;
2792         }
2793         if (bss[NL80211_BSS_BEACON_IES]) {
2794                 beacon_ie = nla_data(bss[NL80211_BSS_BEACON_IES]);
2795                 beacon_ie_len = nla_len(bss[NL80211_BSS_BEACON_IES]);
2796         } else {
2797                 beacon_ie = NULL;
2798                 beacon_ie_len = 0;
2799         }
2800
2801         if (nl80211_scan_filtered(_arg->drv, ie ? ie : beacon_ie,
2802                                   ie ? ie_len : beacon_ie_len))
2803                 return NL_SKIP;
2804
2805         r = os_zalloc(sizeof(*r) + ie_len + beacon_ie_len);
2806         if (r == NULL)
2807                 return NL_SKIP;
2808         if (bss[NL80211_BSS_BSSID])
2809                 os_memcpy(r->bssid, nla_data(bss[NL80211_BSS_BSSID]),
2810                           ETH_ALEN);
2811         if (bss[NL80211_BSS_FREQUENCY])
2812                 r->freq = nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
2813         if (bss[NL80211_BSS_BEACON_INTERVAL])
2814                 r->beacon_int = nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]);
2815         if (bss[NL80211_BSS_CAPABILITY])
2816                 r->caps = nla_get_u16(bss[NL80211_BSS_CAPABILITY]);
2817         r->flags |= WPA_SCAN_NOISE_INVALID;
2818         if (bss[NL80211_BSS_SIGNAL_MBM]) {
2819                 r->level = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]);
2820                 r->level /= 100; /* mBm to dBm */
2821                 r->flags |= WPA_SCAN_LEVEL_DBM | WPA_SCAN_QUAL_INVALID;
2822         } else if (bss[NL80211_BSS_SIGNAL_UNSPEC]) {
2823                 r->level = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]);
2824                 r->flags |= WPA_SCAN_QUAL_INVALID;
2825         } else
2826                 r->flags |= WPA_SCAN_LEVEL_INVALID | WPA_SCAN_QUAL_INVALID;
2827         if (bss[NL80211_BSS_TSF])
2828                 r->tsf = nla_get_u64(bss[NL80211_BSS_TSF]);
2829         if (bss[NL80211_BSS_SEEN_MS_AGO])
2830                 r->age = nla_get_u32(bss[NL80211_BSS_SEEN_MS_AGO]);
2831         r->ie_len = ie_len;
2832         pos = (u8 *) (r + 1);
2833         if (ie) {
2834                 os_memcpy(pos, ie, ie_len);
2835                 pos += ie_len;
2836         }
2837         r->beacon_ie_len = beacon_ie_len;
2838         if (beacon_ie)
2839                 os_memcpy(pos, beacon_ie, beacon_ie_len);
2840
2841         if (bss[NL80211_BSS_STATUS]) {
2842                 enum nl80211_bss_status status;
2843                 status = nla_get_u32(bss[NL80211_BSS_STATUS]);
2844                 switch (status) {
2845                 case NL80211_BSS_STATUS_AUTHENTICATED:
2846                         r->flags |= WPA_SCAN_AUTHENTICATED;
2847                         break;
2848                 case NL80211_BSS_STATUS_ASSOCIATED:
2849                         r->flags |= WPA_SCAN_ASSOCIATED;
2850                         break;
2851                 default:
2852                         break;
2853                 }
2854         }
2855
2856         /*
2857          * cfg80211 maintains separate BSS table entries for APs if the same
2858          * BSSID,SSID pair is seen on multiple channels. wpa_supplicant does
2859          * not use frequency as a separate key in the BSS table, so filter out
2860          * duplicated entries. Prefer associated BSS entry in such a case in
2861          * order to get the correct frequency into the BSS table. Similarly,
2862          * prefer newer entries over older.
2863          */
2864         for (i = 0; i < res->num; i++) {
2865                 const u8 *s1, *s2;
2866                 if (os_memcmp(res->res[i]->bssid, r->bssid, ETH_ALEN) != 0)
2867                         continue;
2868
2869                 s1 = nl80211_get_ie((u8 *) (res->res[i] + 1),
2870                                     res->res[i]->ie_len, WLAN_EID_SSID);
2871                 s2 = nl80211_get_ie((u8 *) (r + 1), r->ie_len, WLAN_EID_SSID);
2872                 if (s1 == NULL || s2 == NULL || s1[1] != s2[1] ||
2873                     os_memcmp(s1, s2, 2 + s1[1]) != 0)
2874                         continue;
2875
2876                 /* Same BSSID,SSID was already included in scan results */
2877                 wpa_printf(MSG_DEBUG, "nl80211: Remove duplicated scan result "
2878                            "for " MACSTR, MAC2STR(r->bssid));
2879
2880                 if (((r->flags & WPA_SCAN_ASSOCIATED) &&
2881                      !(res->res[i]->flags & WPA_SCAN_ASSOCIATED)) ||
2882                     r->age < res->res[i]->age) {
2883                         os_free(res->res[i]);
2884                         res->res[i] = r;
2885                 } else
2886                         os_free(r);
2887                 return NL_SKIP;
2888         }
2889
2890         tmp = os_realloc_array(res->res, res->num + 1,
2891                                sizeof(struct wpa_scan_res *));
2892         if (tmp == NULL) {
2893                 os_free(r);
2894                 return NL_SKIP;
2895         }
2896         tmp[res->num++] = r;
2897         res->res = tmp;
2898
2899         return NL_SKIP;
2900 }
2901
2902
2903 static void clear_state_mismatch(struct wpa_driver_nl80211_data *drv,
2904                                  const u8 *addr)
2905 {
2906         if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) {
2907                 wpa_printf(MSG_DEBUG, "nl80211: Clear possible state "
2908                            "mismatch (" MACSTR ")", MAC2STR(addr));
2909                 wpa_driver_nl80211_mlme(drv, addr,
2910                                         NL80211_CMD_DEAUTHENTICATE,
2911                                         WLAN_REASON_PREV_AUTH_NOT_VALID, 1);
2912         }
2913 }
2914
2915
2916 static void wpa_driver_nl80211_check_bss_status(
2917         struct wpa_driver_nl80211_data *drv, struct wpa_scan_results *res)
2918 {
2919         size_t i;
2920
2921         for (i = 0; i < res->num; i++) {
2922                 struct wpa_scan_res *r = res->res[i];
2923                 if (r->flags & WPA_SCAN_AUTHENTICATED) {
2924                         wpa_printf(MSG_DEBUG, "nl80211: Scan results "
2925                                    "indicates BSS status with " MACSTR
2926                                    " as authenticated",
2927                                    MAC2STR(r->bssid));
2928                         if (is_sta_interface(drv->nlmode) &&
2929                             os_memcmp(r->bssid, drv->bssid, ETH_ALEN) != 0 &&
2930                             os_memcmp(r->bssid, drv->auth_bssid, ETH_ALEN) !=
2931                             0) {
2932                                 wpa_printf(MSG_DEBUG, "nl80211: Unknown BSSID"
2933                                            " in local state (auth=" MACSTR
2934                                            " assoc=" MACSTR ")",
2935                                            MAC2STR(drv->auth_bssid),
2936                                            MAC2STR(drv->bssid));
2937                                 clear_state_mismatch(drv, r->bssid);
2938                         }
2939                 }
2940
2941                 if (r->flags & WPA_SCAN_ASSOCIATED) {
2942                         wpa_printf(MSG_DEBUG, "nl80211: Scan results "
2943                                    "indicate BSS status with " MACSTR
2944                                    " as associated",
2945                                    MAC2STR(r->bssid));
2946                         if (is_sta_interface(drv->nlmode) &&
2947                             !drv->associated) {
2948                                 wpa_printf(MSG_DEBUG, "nl80211: Local state "
2949                                            "(not associated) does not match "
2950                                            "with BSS state");
2951                                 clear_state_mismatch(drv, r->bssid);
2952                         } else if (is_sta_interface(drv->nlmode) &&
2953                                    os_memcmp(drv->bssid, r->bssid, ETH_ALEN) !=
2954                                    0) {
2955                                 wpa_printf(MSG_DEBUG, "nl80211: Local state "
2956                                            "(associated with " MACSTR ") does "
2957                                            "not match with BSS state",
2958                                            MAC2STR(drv->bssid));
2959                                 clear_state_mismatch(drv, r->bssid);
2960                                 clear_state_mismatch(drv, drv->bssid);
2961                         }
2962                 }
2963         }
2964 }
2965
2966
2967 static struct wpa_scan_results *
2968 nl80211_get_scan_results(struct wpa_driver_nl80211_data *drv)
2969 {
2970         struct nl_msg *msg;
2971         struct wpa_scan_results *res;
2972         int ret;
2973         struct nl80211_bss_info_arg arg;
2974
2975         res = os_zalloc(sizeof(*res));
2976         if (res == NULL)
2977                 return NULL;
2978         if (!(msg = nl80211_cmd_msg(drv->first_bss, NLM_F_DUMP,
2979                                     NL80211_CMD_GET_SCAN))) {
2980                 wpa_scan_results_free(res);
2981                 return NULL;
2982         }
2983
2984         arg.drv = drv;
2985         arg.res = res;
2986         ret = send_and_recv_msgs(drv, msg, bss_info_handler, &arg);
2987         if (ret == 0) {
2988                 wpa_printf(MSG_DEBUG, "nl80211: Received scan results (%lu "
2989                            "BSSes)", (unsigned long) res->num);
2990                 nl80211_get_noise_for_scan_results(drv, res);
2991                 return res;
2992         }
2993         wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d "
2994                    "(%s)", ret, strerror(-ret));
2995         wpa_scan_results_free(res);
2996         return NULL;
2997 }
2998
2999
3000 /**
3001  * wpa_driver_nl80211_get_scan_results - Fetch the latest scan results
3002  * @priv: Pointer to private wext data from wpa_driver_nl80211_init()
3003  * Returns: Scan results on success, -1 on failure
3004  */
3005 static struct wpa_scan_results *
3006 wpa_driver_nl80211_get_scan_results(void *priv)
3007 {
3008         struct i802_bss *bss = priv;
3009         struct wpa_driver_nl80211_data *drv = bss->drv;
3010         struct wpa_scan_results *res;
3011
3012         res = nl80211_get_scan_results(drv);
3013         if (res)
3014                 wpa_driver_nl80211_check_bss_status(drv, res);
3015         return res;
3016 }
3017
3018
3019 static void nl80211_dump_scan(struct wpa_driver_nl80211_data *drv)
3020 {
3021         struct wpa_scan_results *res;
3022         size_t i;
3023
3024         res = nl80211_get_scan_results(drv);
3025         if (res == NULL) {
3026                 wpa_printf(MSG_DEBUG, "nl80211: Failed to get scan results");
3027                 return;
3028         }
3029
3030         wpa_printf(MSG_DEBUG, "nl80211: Scan result dump");
3031         for (i = 0; i < res->num; i++) {
3032                 struct wpa_scan_res *r = res->res[i];
3033                 wpa_printf(MSG_DEBUG, "nl80211: %d/%d " MACSTR "%s%s",
3034                            (int) i, (int) res->num, MAC2STR(r->bssid),
3035                            r->flags & WPA_SCAN_AUTHENTICATED ? " [auth]" : "",
3036                            r->flags & WPA_SCAN_ASSOCIATED ? " [assoc]" : "");
3037         }
3038
3039         wpa_scan_results_free(res);
3040 }
3041
3042
3043 static u32 wpa_alg_to_cipher_suite(enum wpa_alg alg, size_t key_len)
3044 {
3045         switch (alg) {
3046         case WPA_ALG_WEP:
3047                 if (key_len == 5)
3048                         return WLAN_CIPHER_SUITE_WEP40;
3049                 return WLAN_CIPHER_SUITE_WEP104;
3050         case WPA_ALG_TKIP:
3051                 return WLAN_CIPHER_SUITE_TKIP;
3052         case WPA_ALG_CCMP:
3053                 return WLAN_CIPHER_SUITE_CCMP;
3054         case WPA_ALG_GCMP:
3055                 return WLAN_CIPHER_SUITE_GCMP;
3056         case WPA_ALG_CCMP_256:
3057                 return WLAN_CIPHER_SUITE_CCMP_256;
3058         case WPA_ALG_GCMP_256:
3059                 return WLAN_CIPHER_SUITE_GCMP_256;
3060         case WPA_ALG_IGTK:
3061                 return WLAN_CIPHER_SUITE_AES_CMAC;
3062         case WPA_ALG_BIP_GMAC_128:
3063                 return WLAN_CIPHER_SUITE_BIP_GMAC_128;
3064         case WPA_ALG_BIP_GMAC_256:
3065                 return WLAN_CIPHER_SUITE_BIP_GMAC_256;
3066         case WPA_ALG_BIP_CMAC_256:
3067                 return WLAN_CIPHER_SUITE_BIP_CMAC_256;
3068         case WPA_ALG_SMS4:
3069                 return WLAN_CIPHER_SUITE_SMS4;
3070         case WPA_ALG_KRK:
3071                 return WLAN_CIPHER_SUITE_KRK;
3072         case WPA_ALG_NONE:
3073         case WPA_ALG_PMK:
3074                 wpa_printf(MSG_ERROR, "nl80211: Unexpected encryption algorithm %d",
3075                            alg);
3076                 return 0;
3077         }
3078
3079         wpa_printf(MSG_ERROR, "nl80211: Unsupported encryption algorithm %d",
3080                    alg);
3081         return 0;
3082 }
3083
3084
3085 static u32 wpa_cipher_to_cipher_suite(unsigned int cipher)
3086 {
3087         switch (cipher) {
3088         case WPA_CIPHER_CCMP_256:
3089                 return WLAN_CIPHER_SUITE_CCMP_256;
3090         case WPA_CIPHER_GCMP_256:
3091                 return WLAN_CIPHER_SUITE_GCMP_256;
3092         case WPA_CIPHER_CCMP:
3093                 return WLAN_CIPHER_SUITE_CCMP;
3094         case WPA_CIPHER_GCMP:
3095                 return WLAN_CIPHER_SUITE_GCMP;
3096         case WPA_CIPHER_TKIP:
3097                 return WLAN_CIPHER_SUITE_TKIP;
3098         case WPA_CIPHER_WEP104:
3099                 return WLAN_CIPHER_SUITE_WEP104;
3100         case WPA_CIPHER_WEP40:
3101                 return WLAN_CIPHER_SUITE_WEP40;
3102         case WPA_CIPHER_GTK_NOT_USED:
3103                 return WLAN_CIPHER_SUITE_NO_GROUP_ADDR;
3104         }
3105
3106         return 0;
3107 }
3108
3109
3110 static int wpa_cipher_to_cipher_suites(unsigned int ciphers, u32 suites[],
3111                                        int max_suites)
3112 {
3113         int num_suites = 0;
3114
3115         if (num_suites < max_suites && ciphers & WPA_CIPHER_CCMP_256)
3116                 suites[num_suites++] = WLAN_CIPHER_SUITE_CCMP_256;
3117         if (num_suites < max_suites && ciphers & WPA_CIPHER_GCMP_256)
3118                 suites[num_suites++] = WLAN_CIPHER_SUITE_GCMP_256;
3119         if (num_suites < max_suites && ciphers & WPA_CIPHER_CCMP)
3120                 suites[num_suites++] = WLAN_CIPHER_SUITE_CCMP;
3121         if (num_suites < max_suites && ciphers & WPA_CIPHER_GCMP)
3122                 suites[num_suites++] = WLAN_CIPHER_SUITE_GCMP;
3123         if (num_suites < max_suites && ciphers & WPA_CIPHER_TKIP)
3124                 suites[num_suites++] = WLAN_CIPHER_SUITE_TKIP;
3125         if (num_suites < max_suites && ciphers & WPA_CIPHER_WEP104)
3126                 suites[num_suites++] = WLAN_CIPHER_SUITE_WEP104;
3127         if (num_suites < max_suites && ciphers & WPA_CIPHER_WEP40)
3128                 suites[num_suites++] = WLAN_CIPHER_SUITE_WEP40;
3129
3130         return num_suites;
3131 }
3132
3133
3134 static int issue_key_mgmt_set_key(struct wpa_driver_nl80211_data *drv,
3135                                   const u8 *key, size_t key_len)
3136 {
3137         struct nl_msg *msg;
3138         int ret;
3139
3140         if (!drv->key_mgmt_set_key_vendor_cmd_avail)
3141                 return 0;
3142
3143         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
3144             nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
3145             nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
3146                         QCA_NL80211_VENDOR_SUBCMD_KEY_MGMT_SET_KEY) ||
3147             nla_put(msg, NL80211_ATTR_VENDOR_DATA, key_len, key)) {
3148                 nlmsg_free(msg);
3149                 return -1;
3150         }
3151         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3152         if (ret) {
3153                 wpa_printf(MSG_DEBUG,
3154                            "nl80211: Key management set key failed: ret=%d (%s)",
3155                            ret, strerror(-ret));
3156         }
3157
3158         return ret;
3159 }
3160
3161
3162 static int wpa_driver_nl80211_set_key(const char *ifname, struct i802_bss *bss,
3163                                       enum wpa_alg alg, const u8 *addr,
3164                                       int key_idx, int set_tx,
3165                                       const u8 *seq, size_t seq_len,
3166                                       const u8 *key, size_t key_len)
3167 {
3168         struct wpa_driver_nl80211_data *drv = bss->drv;
3169         int ifindex;
3170         struct nl_msg *msg;
3171         int ret;
3172         int tdls = 0;
3173
3174         /* Ignore for P2P Device */
3175         if (drv->nlmode == NL80211_IFTYPE_P2P_DEVICE)
3176                 return 0;
3177
3178         ifindex = if_nametoindex(ifname);
3179         wpa_printf(MSG_DEBUG, "%s: ifindex=%d (%s) alg=%d addr=%p key_idx=%d "
3180                    "set_tx=%d seq_len=%lu key_len=%lu",
3181                    __func__, ifindex, ifname, alg, addr, key_idx, set_tx,
3182                    (unsigned long) seq_len, (unsigned long) key_len);
3183 #ifdef CONFIG_TDLS
3184         if (key_idx == -1) {
3185                 key_idx = 0;
3186                 tdls = 1;
3187         }
3188 #endif /* CONFIG_TDLS */
3189
3190         if (alg == WPA_ALG_PMK && drv->key_mgmt_set_key_vendor_cmd_avail) {
3191                 wpa_printf(MSG_DEBUG, "%s: calling issue_key_mgmt_set_key",
3192                            __func__);
3193                 ret = issue_key_mgmt_set_key(drv, key, key_len);
3194                 return ret;
3195         }
3196
3197         msg = nlmsg_alloc();
3198         if (!msg)
3199                 return -ENOMEM;
3200
3201         if (alg == WPA_ALG_NONE) {
3202                 if (!nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_KEY))
3203                         goto fail;
3204         } else {
3205                 if (!nl80211_cmd(drv, msg, 0, NL80211_CMD_NEW_KEY) ||
3206                     nla_put(msg, NL80211_ATTR_KEY_DATA, key_len, key) ||
3207                     nla_put_u32(msg, NL80211_ATTR_KEY_CIPHER,
3208                                 wpa_alg_to_cipher_suite(alg, key_len)))
3209                         goto fail;
3210                 wpa_hexdump_key(MSG_DEBUG, "nl80211: KEY_DATA", key, key_len);
3211         }
3212
3213         if (seq && seq_len) {
3214                 if (nla_put(msg, NL80211_ATTR_KEY_SEQ, seq_len, seq))
3215                         goto fail;
3216                 wpa_hexdump(MSG_DEBUG, "nl80211: KEY_SEQ", seq, seq_len);
3217         }
3218
3219         if (addr && !is_broadcast_ether_addr(addr)) {
3220                 wpa_printf(MSG_DEBUG, "   addr=" MACSTR, MAC2STR(addr));
3221                 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
3222                         goto fail;
3223
3224                 if (alg != WPA_ALG_WEP && key_idx && !set_tx) {
3225                         wpa_printf(MSG_DEBUG, "   RSN IBSS RX GTK");
3226                         if (nla_put_u32(msg, NL80211_ATTR_KEY_TYPE,
3227                                         NL80211_KEYTYPE_GROUP))
3228                                 goto fail;
3229                 }
3230         } else if (addr && is_broadcast_ether_addr(addr)) {
3231                 struct nlattr *types;
3232
3233                 wpa_printf(MSG_DEBUG, "   broadcast key");
3234
3235                 types = nla_nest_start(msg, NL80211_ATTR_KEY_DEFAULT_TYPES);
3236                 if (!types ||
3237                     nla_put_flag(msg, NL80211_KEY_DEFAULT_TYPE_MULTICAST))
3238                         goto fail;
3239                 nla_nest_end(msg, types);
3240         }
3241         if (nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx) ||
3242             nla_put_u32(msg, NL80211_ATTR_IFINDEX, ifindex))
3243                 goto fail;
3244
3245         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3246         if ((ret == -ENOENT || ret == -ENOLINK) && alg == WPA_ALG_NONE)
3247                 ret = 0;
3248         if (ret)
3249                 wpa_printf(MSG_DEBUG, "nl80211: set_key failed; err=%d %s)",
3250                            ret, strerror(-ret));
3251
3252         /*
3253          * If we failed or don't need to set the default TX key (below),
3254          * we're done here.
3255          */
3256         if (ret || !set_tx || alg == WPA_ALG_NONE || tdls)
3257                 return ret;
3258         if (is_ap_interface(drv->nlmode) && addr &&
3259             !is_broadcast_ether_addr(addr))
3260                 return ret;
3261
3262         msg = nlmsg_alloc();
3263         if (!msg)
3264                 return -ENOMEM;
3265
3266         if (!nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_KEY) ||
3267             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx) ||
3268             nla_put_u32(msg, NL80211_ATTR_IFINDEX, ifindex) ||
3269             nla_put_flag(msg, alg == WPA_ALG_IGTK ?
3270                          NL80211_ATTR_KEY_DEFAULT_MGMT :
3271                          NL80211_ATTR_KEY_DEFAULT))
3272                 goto fail;
3273         if (addr && is_broadcast_ether_addr(addr)) {
3274                 struct nlattr *types;
3275
3276                 types = nla_nest_start(msg, NL80211_ATTR_KEY_DEFAULT_TYPES);
3277                 if (!types ||
3278                     nla_put_flag(msg, NL80211_KEY_DEFAULT_TYPE_MULTICAST))
3279                         goto fail;
3280                 nla_nest_end(msg, types);
3281         } else if (addr) {
3282                 struct nlattr *types;
3283
3284                 types = nla_nest_start(msg, NL80211_ATTR_KEY_DEFAULT_TYPES);
3285                 if (!types ||
3286                     nla_put_flag(msg, NL80211_KEY_DEFAULT_TYPE_UNICAST))
3287                         goto fail;
3288                 nla_nest_end(msg, types);
3289         }
3290
3291         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3292         if (ret == -ENOENT)
3293                 ret = 0;
3294         if (ret)
3295                 wpa_printf(MSG_DEBUG, "nl80211: set_key default failed; "
3296                            "err=%d %s)", ret, strerror(-ret));
3297         return ret;
3298
3299 fail:
3300         nlmsg_free(msg);
3301         return -ENOBUFS;
3302 }
3303
3304
3305 static int nl_add_key(struct nl_msg *msg, enum wpa_alg alg,
3306                       int key_idx, int defkey,
3307                       const u8 *seq, size_t seq_len,
3308                       const u8 *key, size_t key_len)
3309 {
3310         struct nlattr *key_attr = nla_nest_start(msg, NL80211_ATTR_KEY);
3311         if (!key_attr)
3312                 return -1;
3313
3314         if (defkey && alg == WPA_ALG_IGTK) {
3315                 if (nla_put_flag(msg, NL80211_KEY_DEFAULT_MGMT))
3316                         return -1;
3317         } else if (defkey) {
3318                 if (nla_put_flag(msg, NL80211_KEY_DEFAULT))
3319                         return -1;
3320         }
3321
3322         if (nla_put_u8(msg, NL80211_KEY_IDX, key_idx) ||
3323             nla_put_u32(msg, NL80211_KEY_CIPHER,
3324                         wpa_alg_to_cipher_suite(alg, key_len)) ||
3325             (seq && seq_len &&
3326              nla_put(msg, NL80211_KEY_SEQ, seq_len, seq)) ||
3327             nla_put(msg, NL80211_KEY_DATA, key_len, key))
3328                 return -1;
3329
3330         nla_nest_end(msg, key_attr);
3331
3332         return 0;
3333 }
3334
3335
3336 static int nl80211_set_conn_keys(struct wpa_driver_associate_params *params,
3337                                  struct nl_msg *msg)
3338 {
3339         int i, privacy = 0;
3340         struct nlattr *nl_keys, *nl_key;
3341
3342         for (i = 0; i < 4; i++) {
3343                 if (!params->wep_key[i])
3344                         continue;
3345                 privacy = 1;
3346                 break;
3347         }
3348         if (params->wps == WPS_MODE_PRIVACY)
3349                 privacy = 1;
3350         if (params->pairwise_suite &&
3351             params->pairwise_suite != WPA_CIPHER_NONE)
3352                 privacy = 1;
3353
3354         if (!privacy)
3355                 return 0;
3356
3357         if (nla_put_flag(msg, NL80211_ATTR_PRIVACY))
3358                 return -ENOBUFS;
3359
3360         nl_keys = nla_nest_start(msg, NL80211_ATTR_KEYS);
3361         if (!nl_keys)
3362                 return -ENOBUFS;
3363
3364         for (i = 0; i < 4; i++) {
3365                 if (!params->wep_key[i])
3366                         continue;
3367
3368                 nl_key = nla_nest_start(msg, i);
3369                 if (!nl_key ||
3370                     nla_put(msg, NL80211_KEY_DATA, params->wep_key_len[i],
3371                             params->wep_key[i]) ||
3372                     nla_put_u32(msg, NL80211_KEY_CIPHER,
3373                                 params->wep_key_len[i] == 5 ?
3374                                 WLAN_CIPHER_SUITE_WEP40 :
3375                                 WLAN_CIPHER_SUITE_WEP104) ||
3376                     nla_put_u8(msg, NL80211_KEY_IDX, i) ||
3377                     (i == params->wep_tx_keyidx &&
3378                      nla_put_flag(msg, NL80211_KEY_DEFAULT)))
3379                         return -ENOBUFS;
3380
3381                 nla_nest_end(msg, nl_key);
3382         }
3383         nla_nest_end(msg, nl_keys);
3384
3385         return 0;
3386 }
3387
3388
3389 static int wpa_driver_nl80211_mlme(struct wpa_driver_nl80211_data *drv,
3390                                    const u8 *addr, int cmd, u16 reason_code,
3391                                    int local_state_change)
3392 {
3393         int ret;
3394         struct nl_msg *msg;
3395
3396         if (!(msg = nl80211_drv_msg(drv, 0, cmd)) ||
3397             nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code) ||
3398             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
3399             (local_state_change &&
3400              nla_put_flag(msg, NL80211_ATTR_LOCAL_STATE_CHANGE))) {
3401                 nlmsg_free(msg);
3402                 return -1;
3403         }
3404
3405         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3406         if (ret) {
3407                 wpa_dbg(drv->ctx, MSG_DEBUG,
3408                         "nl80211: MLME command failed: reason=%u ret=%d (%s)",
3409                         reason_code, ret, strerror(-ret));
3410         }
3411         return ret;
3412 }
3413
3414
3415 static int wpa_driver_nl80211_disconnect(struct wpa_driver_nl80211_data *drv,
3416                                          int reason_code)
3417 {
3418         int ret;
3419
3420         wpa_printf(MSG_DEBUG, "%s(reason_code=%d)", __func__, reason_code);
3421         nl80211_mark_disconnected(drv);
3422         /* Disconnect command doesn't need BSSID - it uses cached value */
3423         ret = wpa_driver_nl80211_mlme(drv, NULL, NL80211_CMD_DISCONNECT,
3424                                       reason_code, 0);
3425         /*
3426          * For locally generated disconnect, supplicant already generates a
3427          * DEAUTH event, so ignore the event from NL80211.
3428          */
3429         drv->ignore_next_local_disconnect = ret == 0;
3430
3431         return ret;
3432 }
3433
3434
3435 static int wpa_driver_nl80211_deauthenticate(struct i802_bss *bss,
3436                                              const u8 *addr, int reason_code)
3437 {
3438         struct wpa_driver_nl80211_data *drv = bss->drv;
3439         int ret;
3440
3441         if (drv->nlmode == NL80211_IFTYPE_ADHOC) {
3442                 nl80211_mark_disconnected(drv);
3443                 return nl80211_leave_ibss(drv);
3444         }
3445         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME))
3446                 return wpa_driver_nl80211_disconnect(drv, reason_code);
3447         wpa_printf(MSG_DEBUG, "%s(addr=" MACSTR " reason_code=%d)",
3448                    __func__, MAC2STR(addr), reason_code);
3449         nl80211_mark_disconnected(drv);
3450         ret = wpa_driver_nl80211_mlme(drv, addr, NL80211_CMD_DEAUTHENTICATE,
3451                                       reason_code, 0);
3452         /*
3453          * For locally generated deauthenticate, supplicant already generates a
3454          * DEAUTH event, so ignore the event from NL80211.
3455          */
3456         drv->ignore_next_local_deauth = ret == 0;
3457         return ret;
3458 }
3459
3460
3461 static void nl80211_copy_auth_params(struct wpa_driver_nl80211_data *drv,
3462                                      struct wpa_driver_auth_params *params)
3463 {
3464         int i;
3465
3466         drv->auth_freq = params->freq;
3467         drv->auth_alg = params->auth_alg;
3468         drv->auth_wep_tx_keyidx = params->wep_tx_keyidx;
3469         drv->auth_local_state_change = params->local_state_change;
3470         drv->auth_p2p = params->p2p;
3471
3472         if (params->bssid)
3473                 os_memcpy(drv->auth_bssid_, params->bssid, ETH_ALEN);
3474         else
3475                 os_memset(drv->auth_bssid_, 0, ETH_ALEN);
3476
3477         if (params->ssid) {
3478                 os_memcpy(drv->auth_ssid, params->ssid, params->ssid_len);
3479                 drv->auth_ssid_len = params->ssid_len;
3480         } else
3481                 drv->auth_ssid_len = 0;
3482
3483
3484         os_free(drv->auth_ie);
3485         drv->auth_ie = NULL;
3486         drv->auth_ie_len = 0;
3487         if (params->ie) {
3488                 drv->auth_ie = os_malloc(params->ie_len);
3489                 if (drv->auth_ie) {
3490                         os_memcpy(drv->auth_ie, params->ie, params->ie_len);
3491                         drv->auth_ie_len = params->ie_len;
3492                 }
3493         }
3494
3495         for (i = 0; i < 4; i++) {
3496                 if (params->wep_key[i] && params->wep_key_len[i] &&
3497                     params->wep_key_len[i] <= 16) {
3498                         os_memcpy(drv->auth_wep_key[i], params->wep_key[i],
3499                                   params->wep_key_len[i]);
3500                         drv->auth_wep_key_len[i] = params->wep_key_len[i];
3501                 } else
3502                         drv->auth_wep_key_len[i] = 0;
3503         }
3504 }
3505
3506
3507 static int wpa_driver_nl80211_authenticate(
3508         struct i802_bss *bss, struct wpa_driver_auth_params *params)
3509 {
3510         struct wpa_driver_nl80211_data *drv = bss->drv;
3511         int ret = -1, i;
3512         struct nl_msg *msg;
3513         enum nl80211_auth_type type;
3514         enum nl80211_iftype nlmode;
3515         int count = 0;
3516         int is_retry;
3517
3518         is_retry = drv->retry_auth;
3519         drv->retry_auth = 0;
3520         drv->ignore_deauth_event = 0;
3521
3522         nl80211_mark_disconnected(drv);
3523         os_memset(drv->auth_bssid, 0, ETH_ALEN);
3524         if (params->bssid)
3525                 os_memcpy(drv->auth_attempt_bssid, params->bssid, ETH_ALEN);
3526         else
3527                 os_memset(drv->auth_attempt_bssid, 0, ETH_ALEN);
3528         /* FIX: IBSS mode */
3529         nlmode = params->p2p ?
3530                 NL80211_IFTYPE_P2P_CLIENT : NL80211_IFTYPE_STATION;
3531         if (drv->nlmode != nlmode &&
3532             wpa_driver_nl80211_set_mode(bss, nlmode) < 0)
3533                 return -1;
3534
3535 retry:
3536         wpa_printf(MSG_DEBUG, "nl80211: Authenticate (ifindex=%d)",
3537                    drv->ifindex);
3538
3539         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_AUTHENTICATE);
3540         if (!msg)
3541                 goto fail;
3542
3543         for (i = 0; i < 4; i++) {
3544                 if (!params->wep_key[i])
3545                         continue;
3546                 wpa_driver_nl80211_set_key(bss->ifname, bss, WPA_ALG_WEP,
3547                                            NULL, i,
3548                                            i == params->wep_tx_keyidx, NULL, 0,
3549                                            params->wep_key[i],
3550                                            params->wep_key_len[i]);
3551                 if (params->wep_tx_keyidx != i)
3552                         continue;
3553                 if (nl_add_key(msg, WPA_ALG_WEP, i, 1, NULL, 0,
3554                                params->wep_key[i], params->wep_key_len[i]))
3555                         goto fail;
3556         }
3557
3558         if (params->bssid) {
3559                 wpa_printf(MSG_DEBUG, "  * bssid=" MACSTR,
3560                            MAC2STR(params->bssid));
3561                 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid))
3562                         goto fail;
3563         }
3564         if (params->freq) {
3565                 wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq);
3566                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq))
3567                         goto fail;
3568         }
3569         if (params->ssid) {
3570                 wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
3571                                   params->ssid, params->ssid_len);
3572                 if (nla_put(msg, NL80211_ATTR_SSID, params->ssid_len,
3573                             params->ssid))
3574                         goto fail;
3575         }
3576         wpa_hexdump(MSG_DEBUG, "  * IEs", params->ie, params->ie_len);
3577         if (params->ie &&
3578             nla_put(msg, NL80211_ATTR_IE, params->ie_len, params->ie))
3579                 goto fail;
3580         if (params->sae_data) {
3581                 wpa_hexdump(MSG_DEBUG, "  * SAE data", params->sae_data,
3582                             params->sae_data_len);
3583                 if (nla_put(msg, NL80211_ATTR_SAE_DATA, params->sae_data_len,
3584                             params->sae_data))
3585                         goto fail;
3586         }
3587         if (params->auth_alg & WPA_AUTH_ALG_OPEN)
3588                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
3589         else if (params->auth_alg & WPA_AUTH_ALG_SHARED)
3590                 type = NL80211_AUTHTYPE_SHARED_KEY;
3591         else if (params->auth_alg & WPA_AUTH_ALG_LEAP)
3592                 type = NL80211_AUTHTYPE_NETWORK_EAP;
3593         else if (params->auth_alg & WPA_AUTH_ALG_FT)
3594                 type = NL80211_AUTHTYPE_FT;
3595         else if (params->auth_alg & WPA_AUTH_ALG_SAE)
3596                 type = NL80211_AUTHTYPE_SAE;
3597         else
3598                 goto fail;
3599         wpa_printf(MSG_DEBUG, "  * Auth Type %d", type);
3600         if (nla_put_u32(msg, NL80211_ATTR_AUTH_TYPE, type))
3601                 goto fail;
3602         if (params->local_state_change) {
3603                 wpa_printf(MSG_DEBUG, "  * Local state change only");
3604                 if (nla_put_flag(msg, NL80211_ATTR_LOCAL_STATE_CHANGE))
3605                         goto fail;
3606         }
3607
3608         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3609         msg = NULL;
3610         if (ret) {
3611                 wpa_dbg(drv->ctx, MSG_DEBUG,
3612                         "nl80211: MLME command failed (auth): ret=%d (%s)",
3613                         ret, strerror(-ret));
3614                 count++;
3615                 if (ret == -EALREADY && count == 1 && params->bssid &&
3616                     !params->local_state_change) {
3617                         /*
3618                          * mac80211 does not currently accept new
3619                          * authentication if we are already authenticated. As a
3620                          * workaround, force deauthentication and try again.
3621                          */
3622                         wpa_printf(MSG_DEBUG, "nl80211: Retry authentication "
3623                                    "after forced deauthentication");
3624                         drv->ignore_deauth_event = 1;
3625                         wpa_driver_nl80211_deauthenticate(
3626                                 bss, params->bssid,
3627                                 WLAN_REASON_PREV_AUTH_NOT_VALID);
3628                         nlmsg_free(msg);
3629                         goto retry;
3630                 }
3631
3632                 if (ret == -ENOENT && params->freq && !is_retry) {
3633                         /*
3634                          * cfg80211 has likely expired the BSS entry even
3635                          * though it was previously available in our internal
3636                          * BSS table. To recover quickly, start a single
3637                          * channel scan on the specified channel.
3638                          */
3639                         struct wpa_driver_scan_params scan;
3640                         int freqs[2];
3641
3642                         os_memset(&scan, 0, sizeof(scan));
3643                         scan.num_ssids = 1;
3644                         if (params->ssid) {
3645                                 scan.ssids[0].ssid = params->ssid;
3646                                 scan.ssids[0].ssid_len = params->ssid_len;
3647                         }
3648                         freqs[0] = params->freq;
3649                         freqs[1] = 0;
3650                         scan.freqs = freqs;
3651                         wpa_printf(MSG_DEBUG, "nl80211: Trigger single "
3652                                    "channel scan to refresh cfg80211 BSS "
3653                                    "entry");
3654                         ret = wpa_driver_nl80211_scan(bss, &scan);
3655                         if (ret == 0) {
3656                                 nl80211_copy_auth_params(drv, params);
3657                                 drv->scan_for_auth = 1;
3658                         }
3659                 } else if (is_retry) {
3660                         /*
3661                          * Need to indicate this with an event since the return
3662                          * value from the retry is not delivered to core code.
3663                          */
3664                         union wpa_event_data event;
3665                         wpa_printf(MSG_DEBUG, "nl80211: Authentication retry "
3666                                    "failed");
3667                         os_memset(&event, 0, sizeof(event));
3668                         os_memcpy(event.timeout_event.addr, drv->auth_bssid_,
3669                                   ETH_ALEN);
3670                         wpa_supplicant_event(drv->ctx, EVENT_AUTH_TIMED_OUT,
3671                                              &event);
3672                 }
3673         } else {
3674                 wpa_printf(MSG_DEBUG,
3675                            "nl80211: Authentication request send successfully");
3676         }
3677
3678 fail:
3679         nlmsg_free(msg);
3680         return ret;
3681 }
3682
3683
3684 int wpa_driver_nl80211_authenticate_retry(struct wpa_driver_nl80211_data *drv)
3685 {
3686         struct wpa_driver_auth_params params;
3687         struct i802_bss *bss = drv->first_bss;
3688         int i;
3689
3690         wpa_printf(MSG_DEBUG, "nl80211: Try to authenticate again");
3691
3692         os_memset(&params, 0, sizeof(params));
3693         params.freq = drv->auth_freq;
3694         params.auth_alg = drv->auth_alg;
3695         params.wep_tx_keyidx = drv->auth_wep_tx_keyidx;
3696         params.local_state_change = drv->auth_local_state_change;
3697         params.p2p = drv->auth_p2p;
3698
3699         if (!is_zero_ether_addr(drv->auth_bssid_))
3700                 params.bssid = drv->auth_bssid_;
3701
3702         if (drv->auth_ssid_len) {
3703                 params.ssid = drv->auth_ssid;
3704                 params.ssid_len = drv->auth_ssid_len;
3705         }
3706
3707         params.ie = drv->auth_ie;
3708         params.ie_len = drv->auth_ie_len;
3709
3710         for (i = 0; i < 4; i++) {
3711                 if (drv->auth_wep_key_len[i]) {
3712                         params.wep_key[i] = drv->auth_wep_key[i];
3713                         params.wep_key_len[i] = drv->auth_wep_key_len[i];
3714                 }
3715         }
3716
3717         drv->retry_auth = 1;
3718         return wpa_driver_nl80211_authenticate(bss, &params);
3719 }
3720
3721
3722 static int wpa_driver_nl80211_send_frame(struct i802_bss *bss,
3723                                          const void *data, size_t len,
3724                                          int encrypt, int noack,
3725                                          unsigned int freq, int no_cck,
3726                                          int offchanok, unsigned int wait_time)
3727 {
3728         struct wpa_driver_nl80211_data *drv = bss->drv;
3729         u64 cookie;
3730         int res;
3731
3732         if (freq == 0 && drv->nlmode == NL80211_IFTYPE_ADHOC) {
3733                 freq = nl80211_get_assoc_freq(drv);
3734                 wpa_printf(MSG_DEBUG,
3735                            "nl80211: send_frame - Use assoc_freq=%u for IBSS",
3736                            freq);
3737         }
3738         if (freq == 0) {
3739                 wpa_printf(MSG_DEBUG, "nl80211: send_frame - Use bss->freq=%u",
3740                            bss->freq);
3741                 freq = bss->freq;
3742         }
3743
3744         if (drv->use_monitor) {
3745                 wpa_printf(MSG_DEBUG, "nl80211: send_frame(freq=%u bss->freq=%u) -> send_monitor",
3746                            freq, bss->freq);
3747                 return nl80211_send_monitor(drv, data, len, encrypt, noack);
3748         }
3749
3750         wpa_printf(MSG_DEBUG, "nl80211: send_frame -> send_frame_cmd");
3751         res = nl80211_send_frame_cmd(bss, freq, wait_time, data, len,
3752                                      &cookie, no_cck, noack, offchanok);
3753         if (res == 0 && !noack) {
3754                 const struct ieee80211_mgmt *mgmt;
3755                 u16 fc;
3756
3757                 mgmt = (const struct ieee80211_mgmt *) data;
3758                 fc = le_to_host16(mgmt->frame_control);
3759                 if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
3760                     WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_ACTION) {
3761                         wpa_printf(MSG_MSGDUMP,
3762                                    "nl80211: Update send_action_cookie from 0x%llx to 0x%llx",
3763                                    (long long unsigned int)
3764                                    drv->send_action_cookie,
3765                                    (long long unsigned int) cookie);
3766                         drv->send_action_cookie = cookie;
3767                 }
3768         }
3769
3770         return res;
3771 }
3772
3773
3774 static int wpa_driver_nl80211_send_mlme(struct i802_bss *bss, const u8 *data,
3775                                         size_t data_len, int noack,
3776                                         unsigned int freq, int no_cck,
3777                                         int offchanok,
3778                                         unsigned int wait_time)
3779 {
3780         struct wpa_driver_nl80211_data *drv = bss->drv;
3781         struct ieee80211_mgmt *mgmt;
3782         int encrypt = 1;
3783         u16 fc;
3784
3785         mgmt = (struct ieee80211_mgmt *) data;
3786         fc = le_to_host16(mgmt->frame_control);
3787         wpa_printf(MSG_DEBUG, "nl80211: send_mlme - da= " MACSTR
3788                    " noack=%d freq=%u no_cck=%d offchanok=%d wait_time=%u fc=0x%x (%s) nlmode=%d",
3789                    MAC2STR(mgmt->da), noack, freq, no_cck, offchanok, wait_time,
3790                    fc, fc2str(fc), drv->nlmode);
3791
3792         if ((is_sta_interface(drv->nlmode) ||
3793              drv->nlmode == NL80211_IFTYPE_P2P_DEVICE) &&
3794             WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
3795             WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_PROBE_RESP) {
3796                 /*
3797                  * The use of last_mgmt_freq is a bit of a hack,
3798                  * but it works due to the single-threaded nature
3799                  * of wpa_supplicant.
3800                  */
3801                 if (freq == 0) {
3802                         wpa_printf(MSG_DEBUG, "nl80211: Use last_mgmt_freq=%d",
3803                                    drv->last_mgmt_freq);
3804                         freq = drv->last_mgmt_freq;
3805                 }
3806                 return nl80211_send_frame_cmd(bss, freq, 0,
3807                                               data, data_len, NULL, 1, noack,
3808                                               1);
3809         }
3810
3811         if (drv->device_ap_sme && is_ap_interface(drv->nlmode)) {
3812                 if (freq == 0) {
3813                         wpa_printf(MSG_DEBUG, "nl80211: Use bss->freq=%d",
3814                                    bss->freq);
3815                         freq = bss->freq;
3816                 }
3817                 return nl80211_send_frame_cmd(bss, freq,
3818                                               (int) freq == bss->freq ? 0 :
3819                                               wait_time,
3820                                               data, data_len,
3821                                               &drv->send_action_cookie,
3822                                               no_cck, noack, offchanok);
3823         }
3824
3825         if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
3826             WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_AUTH) {
3827                 /*
3828                  * Only one of the authentication frame types is encrypted.
3829                  * In order for static WEP encryption to work properly (i.e.,
3830                  * to not encrypt the frame), we need to tell mac80211 about
3831                  * the frames that must not be encrypted.
3832                  */
3833                 u16 auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
3834                 u16 auth_trans = le_to_host16(mgmt->u.auth.auth_transaction);
3835                 if (auth_alg != WLAN_AUTH_SHARED_KEY || auth_trans != 3)
3836                         encrypt = 0;
3837         }
3838
3839         wpa_printf(MSG_DEBUG, "nl80211: send_mlme -> send_frame");
3840         return wpa_driver_nl80211_send_frame(bss, data, data_len, encrypt,
3841                                              noack, freq, no_cck, offchanok,
3842                                              wait_time);
3843 }
3844
3845
3846 static int nl80211_set_bss(struct i802_bss *bss, int cts, int preamble,
3847                            int slot, int ht_opmode, int ap_isolate,
3848                            int *basic_rates)
3849 {
3850         struct wpa_driver_nl80211_data *drv = bss->drv;
3851         struct nl_msg *msg;
3852
3853         msg = nlmsg_alloc();
3854         if (!msg)
3855                 return -ENOMEM;
3856
3857         if (!nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_BSS) ||
3858             (cts >= 0 &&
3859              nla_put_u8(msg, NL80211_ATTR_BSS_CTS_PROT, cts)) ||
3860             (preamble >= 0 &&
3861              nla_put_u8(msg, NL80211_ATTR_BSS_SHORT_PREAMBLE, preamble)) ||
3862             (slot >= 0 &&
3863              nla_put_u8(msg, NL80211_ATTR_BSS_SHORT_SLOT_TIME, slot)) ||
3864             (ht_opmode >= 0 &&
3865              nla_put_u16(msg, NL80211_ATTR_BSS_HT_OPMODE, ht_opmode)) ||
3866             (ap_isolate >= 0 &&
3867              nla_put_u8(msg, NL80211_ATTR_AP_ISOLATE, ap_isolate)))
3868                 goto fail;
3869
3870         if (basic_rates) {
3871                 u8 rates[NL80211_MAX_SUPP_RATES];
3872                 u8 rates_len = 0;
3873                 int i;
3874
3875                 for (i = 0; i < NL80211_MAX_SUPP_RATES && basic_rates[i] >= 0;
3876                      i++)
3877                         rates[rates_len++] = basic_rates[i] / 5;
3878
3879                 if (nla_put(msg, NL80211_ATTR_BSS_BASIC_RATES, rates_len,
3880                             rates))
3881                         goto fail;
3882         }
3883
3884         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname)))
3885                 goto fail;
3886
3887         return send_and_recv_msgs(drv, msg, NULL, NULL);
3888 fail:
3889         nlmsg_free(msg);
3890         return -ENOBUFS;
3891 }
3892
3893
3894 static int wpa_driver_nl80211_set_acl(void *priv,
3895                                       struct hostapd_acl_params *params)
3896 {
3897         struct i802_bss *bss = priv;
3898         struct wpa_driver_nl80211_data *drv = bss->drv;
3899         struct nl_msg *msg;
3900         struct nlattr *acl;
3901         unsigned int i;
3902         int ret;
3903
3904         if (!(drv->capa.max_acl_mac_addrs))
3905                 return -ENOTSUP;
3906
3907         if (params->num_mac_acl > drv->capa.max_acl_mac_addrs)
3908                 return -ENOTSUP;
3909
3910         wpa_printf(MSG_DEBUG, "nl80211: Set %s ACL (num_mac_acl=%u)",
3911                    params->acl_policy ? "Accept" : "Deny", params->num_mac_acl);
3912
3913         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_SET_MAC_ACL)) ||
3914             nla_put_u32(msg, NL80211_ATTR_ACL_POLICY, params->acl_policy ?
3915                         NL80211_ACL_POLICY_DENY_UNLESS_LISTED :
3916                         NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED) ||
3917             (acl = nla_nest_start(msg, NL80211_ATTR_MAC_ADDRS)) == NULL) {
3918                 nlmsg_free(msg);
3919                 return -ENOMEM;
3920         }
3921
3922         for (i = 0; i < params->num_mac_acl; i++) {
3923                 if (nla_put(msg, i + 1, ETH_ALEN, params->mac_acl[i].addr)) {
3924                         nlmsg_free(msg);
3925                         return -ENOMEM;
3926                 }
3927         }
3928
3929         nla_nest_end(msg, acl);
3930
3931         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3932         if (ret) {
3933                 wpa_printf(MSG_DEBUG, "nl80211: Failed to set MAC ACL: %d (%s)",
3934                            ret, strerror(-ret));
3935         }
3936
3937         return ret;
3938 }
3939
3940
3941 static int wpa_driver_nl80211_set_ap(void *priv,
3942                                      struct wpa_driver_ap_params *params)
3943 {
3944         struct i802_bss *bss = priv;
3945         struct wpa_driver_nl80211_data *drv = bss->drv;
3946         struct nl_msg *msg;
3947         u8 cmd = NL80211_CMD_NEW_BEACON;
3948         int ret;
3949         int beacon_set;
3950         int ifindex = if_nametoindex(bss->ifname);
3951         int num_suites;
3952         int smps_mode;
3953         u32 suites[10], suite;
3954         u32 ver;
3955
3956         beacon_set = bss->beacon_set;
3957
3958         msg = nlmsg_alloc();
3959         if (!msg)
3960                 return -ENOMEM;
3961
3962         wpa_printf(MSG_DEBUG, "nl80211: Set beacon (beacon_set=%d)",
3963                    beacon_set);
3964         if (beacon_set)
3965                 cmd = NL80211_CMD_SET_BEACON;
3966
3967         wpa_hexdump(MSG_DEBUG, "nl80211: Beacon head",
3968                     params->head, params->head_len);
3969         wpa_hexdump(MSG_DEBUG, "nl80211: Beacon tail",
3970                     params->tail, params->tail_len);
3971         wpa_printf(MSG_DEBUG, "nl80211: ifindex=%d", ifindex);
3972         wpa_printf(MSG_DEBUG, "nl80211: beacon_int=%d", params->beacon_int);
3973         wpa_printf(MSG_DEBUG, "nl80211: dtim_period=%d", params->dtim_period);
3974         wpa_hexdump_ascii(MSG_DEBUG, "nl80211: ssid",
3975                           params->ssid, params->ssid_len);
3976         if (!nl80211_cmd(drv, msg, 0, cmd) ||
3977             nla_put(msg, NL80211_ATTR_BEACON_HEAD, params->head_len,
3978                     params->head) ||
3979             nla_put(msg, NL80211_ATTR_BEACON_TAIL, params->tail_len,
3980                     params->tail) ||
3981             nla_put_u32(msg, NL80211_ATTR_IFINDEX, ifindex) ||
3982             nla_put_u32(msg, NL80211_ATTR_BEACON_INTERVAL,
3983                         params->beacon_int) ||
3984             nla_put_u32(msg, NL80211_ATTR_DTIM_PERIOD, params->dtim_period) ||
3985             nla_put(msg, NL80211_ATTR_SSID, params->ssid_len, params->ssid))
3986                 goto fail;
3987         if (params->proberesp && params->proberesp_len) {
3988                 wpa_hexdump(MSG_DEBUG, "nl80211: proberesp (offload)",
3989                             params->proberesp, params->proberesp_len);
3990                 if (nla_put(msg, NL80211_ATTR_PROBE_RESP, params->proberesp_len,
3991                             params->proberesp))
3992                         goto fail;
3993         }
3994         switch (params->hide_ssid) {
3995         case NO_SSID_HIDING:
3996                 wpa_printf(MSG_DEBUG, "nl80211: hidden SSID not in use");
3997                 if (nla_put_u32(msg, NL80211_ATTR_HIDDEN_SSID,
3998                                 NL80211_HIDDEN_SSID_NOT_IN_USE))
3999                         goto fail;
4000                 break;
4001         case HIDDEN_SSID_ZERO_LEN:
4002                 wpa_printf(MSG_DEBUG, "nl80211: hidden SSID zero len");
4003                 if (nla_put_u32(msg, NL80211_ATTR_HIDDEN_SSID,
4004                                 NL80211_HIDDEN_SSID_ZERO_LEN))
4005                         goto fail;
4006                 break;
4007         case HIDDEN_SSID_ZERO_CONTENTS:
4008                 wpa_printf(MSG_DEBUG, "nl80211: hidden SSID zero contents");
4009                 if (nla_put_u32(msg, NL80211_ATTR_HIDDEN_SSID,
4010                                 NL80211_HIDDEN_SSID_ZERO_CONTENTS))
4011                         goto fail;
4012                 break;
4013         }
4014         wpa_printf(MSG_DEBUG, "nl80211: privacy=%d", params->privacy);
4015         if (params->privacy &&
4016             nla_put_flag(msg, NL80211_ATTR_PRIVACY))
4017                 goto fail;
4018         wpa_printf(MSG_DEBUG, "nl80211: auth_algs=0x%x", params->auth_algs);
4019         if ((params->auth_algs & (WPA_AUTH_ALG_OPEN | WPA_AUTH_ALG_SHARED)) ==
4020             (WPA_AUTH_ALG_OPEN | WPA_AUTH_ALG_SHARED)) {
4021                 /* Leave out the attribute */
4022         } else if (params->auth_algs & WPA_AUTH_ALG_SHARED) {
4023                 if (nla_put_u32(msg, NL80211_ATTR_AUTH_TYPE,
4024                                 NL80211_AUTHTYPE_SHARED_KEY))
4025                         goto fail;
4026         } else {
4027                 if (nla_put_u32(msg, NL80211_ATTR_AUTH_TYPE,
4028                                 NL80211_AUTHTYPE_OPEN_SYSTEM))
4029                         goto fail;
4030         }
4031
4032         wpa_printf(MSG_DEBUG, "nl80211: wpa_version=0x%x", params->wpa_version);
4033         ver = 0;
4034         if (params->wpa_version & WPA_PROTO_WPA)
4035                 ver |= NL80211_WPA_VERSION_1;
4036         if (params->wpa_version & WPA_PROTO_RSN)
4037                 ver |= NL80211_WPA_VERSION_2;
4038         if (ver &&
4039             nla_put_u32(msg, NL80211_ATTR_WPA_VERSIONS, ver))
4040                 goto fail;
4041
4042         wpa_printf(MSG_DEBUG, "nl80211: key_mgmt_suites=0x%x",
4043                    params->key_mgmt_suites);
4044         num_suites = 0;
4045         if (params->key_mgmt_suites & WPA_KEY_MGMT_IEEE8021X)
4046                 suites[num_suites++] = WLAN_AKM_SUITE_8021X;
4047         if (params->key_mgmt_suites & WPA_KEY_MGMT_PSK)
4048                 suites[num_suites++] = WLAN_AKM_SUITE_PSK;
4049         if (num_suites &&
4050             nla_put(msg, NL80211_ATTR_AKM_SUITES, num_suites * sizeof(u32),
4051                     suites))
4052                 goto fail;
4053
4054         if (params->key_mgmt_suites & WPA_KEY_MGMT_IEEE8021X &&
4055             params->pairwise_ciphers & (WPA_CIPHER_WEP104 | WPA_CIPHER_WEP40) &&
4056             nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT))
4057                 goto fail;
4058
4059         wpa_printf(MSG_DEBUG, "nl80211: pairwise_ciphers=0x%x",
4060                    params->pairwise_ciphers);
4061         num_suites = wpa_cipher_to_cipher_suites(params->pairwise_ciphers,
4062                                                  suites, ARRAY_SIZE(suites));
4063         if (num_suites &&
4064             nla_put(msg, NL80211_ATTR_CIPHER_SUITES_PAIRWISE,
4065                     num_suites * sizeof(u32), suites))
4066                 goto fail;
4067
4068         wpa_printf(MSG_DEBUG, "nl80211: group_cipher=0x%x",
4069                    params->group_cipher);
4070         suite = wpa_cipher_to_cipher_suite(params->group_cipher);
4071         if (suite &&
4072             nla_put_u32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP, suite))
4073                 goto fail;
4074
4075         switch (params->smps_mode) {
4076         case HT_CAP_INFO_SMPS_DYNAMIC:
4077                 wpa_printf(MSG_DEBUG, "nl80211: SMPS mode - dynamic");
4078                 smps_mode = NL80211_SMPS_DYNAMIC;
4079                 break;
4080         case HT_CAP_INFO_SMPS_STATIC:
4081                 wpa_printf(MSG_DEBUG, "nl80211: SMPS mode - static");
4082                 smps_mode = NL80211_SMPS_STATIC;
4083                 break;
4084         default:
4085                 /* invalid - fallback to smps off */
4086         case HT_CAP_INFO_SMPS_DISABLED:
4087                 wpa_printf(MSG_DEBUG, "nl80211: SMPS mode - off");
4088                 smps_mode = NL80211_SMPS_OFF;
4089                 break;
4090         }
4091         if (nla_put_u32(msg, NL80211_ATTR_SMPS_MODE, smps_mode))
4092                 goto fail;
4093
4094         if (params->beacon_ies) {
4095                 wpa_hexdump_buf(MSG_DEBUG, "nl80211: beacon_ies",
4096                                 params->beacon_ies);
4097                 if (nla_put(msg, NL80211_ATTR_IE,
4098                             wpabuf_len(params->beacon_ies),
4099                             wpabuf_head(params->beacon_ies)))
4100                         goto fail;
4101         }
4102         if (params->proberesp_ies) {
4103                 wpa_hexdump_buf(MSG_DEBUG, "nl80211: proberesp_ies",
4104                                 params->proberesp_ies);
4105                 if (nla_put(msg, NL80211_ATTR_IE_PROBE_RESP,
4106                             wpabuf_len(params->proberesp_ies),
4107                             wpabuf_head(params->proberesp_ies)))
4108                         goto fail;
4109         }
4110         if (params->assocresp_ies) {
4111                 wpa_hexdump_buf(MSG_DEBUG, "nl80211: assocresp_ies",
4112                                 params->assocresp_ies);
4113                 if (nla_put(msg, NL80211_ATTR_IE_ASSOC_RESP,
4114                             wpabuf_len(params->assocresp_ies),
4115                             wpabuf_head(params->assocresp_ies)))
4116                         goto fail;
4117         }
4118
4119         if (drv->capa.flags & WPA_DRIVER_FLAGS_INACTIVITY_TIMER)  {
4120                 wpa_printf(MSG_DEBUG, "nl80211: ap_max_inactivity=%d",
4121                            params->ap_max_inactivity);
4122                 if (nla_put_u16(msg, NL80211_ATTR_INACTIVITY_TIMEOUT,
4123                                 params->ap_max_inactivity))
4124                         goto fail;
4125         }
4126
4127         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4128         if (ret) {
4129                 wpa_printf(MSG_DEBUG, "nl80211: Beacon set failed: %d (%s)",
4130                            ret, strerror(-ret));
4131         } else {
4132                 bss->beacon_set = 1;
4133                 nl80211_set_bss(bss, params->cts_protect, params->preamble,
4134                                 params->short_slot_time, params->ht_opmode,
4135                                 params->isolate, params->basic_rates);
4136                 if (beacon_set && params->freq &&
4137                     params->freq->bandwidth != bss->bandwidth) {
4138                         wpa_printf(MSG_DEBUG,
4139                                    "nl80211: Update BSS %s bandwidth: %d -> %d",
4140                                    bss->ifname, bss->bandwidth,
4141                                    params->freq->bandwidth);
4142                         ret = nl80211_set_channel(bss, params->freq, 1);
4143                         if (ret) {
4144                                 wpa_printf(MSG_DEBUG,
4145                                            "nl80211: Frequency set failed: %d (%s)",
4146                                            ret, strerror(-ret));
4147                         } else {
4148                                 wpa_printf(MSG_DEBUG,
4149                                            "nl80211: Frequency set succeeded for ht2040 coex");
4150                                 bss->bandwidth = params->freq->bandwidth;
4151                         }
4152                 } else if (!beacon_set) {
4153                         /*
4154                          * cfg80211 updates the driver on frequence change in AP
4155                          * mode only at the point when beaconing is started, so
4156                          * set the initial value here.
4157                          */
4158                         bss->bandwidth = params->freq->bandwidth;
4159                 }
4160         }
4161         return ret;
4162 fail:
4163         nlmsg_free(msg);
4164         return -ENOBUFS;
4165 }
4166
4167
4168 static int nl80211_put_freq_params(struct nl_msg *msg,
4169                                    struct hostapd_freq_params *freq)
4170 {
4171         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq->freq))
4172                 return -ENOBUFS;
4173
4174         if (freq->vht_enabled) {
4175                 enum nl80211_chan_width cw;
4176
4177                 switch (freq->bandwidth) {
4178                 case 20:
4179                         cw = NL80211_CHAN_WIDTH_20;
4180                         break;
4181                 case 40:
4182                         cw = NL80211_CHAN_WIDTH_40;
4183                         break;
4184                 case 80:
4185                         if (freq->center_freq2)
4186                                 cw = NL80211_CHAN_WIDTH_80P80;
4187                         else
4188                                 cw = NL80211_CHAN_WIDTH_80;
4189                         break;
4190                 case 160:
4191                         cw = NL80211_CHAN_WIDTH_160;
4192                         break;
4193                 default:
4194                         return -EINVAL;
4195                 }
4196
4197                 if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, cw) ||
4198                     nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1,
4199                                 freq->center_freq1) ||
4200                     (freq->center_freq2 &&
4201                      nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2,
4202                                  freq->center_freq2)))
4203                         return -ENOBUFS;
4204         } else if (freq->ht_enabled) {
4205                 enum nl80211_channel_type ct;
4206
4207                 switch (freq->sec_channel_offset) {
4208                 case -1:
4209                         ct = NL80211_CHAN_HT40MINUS;
4210                         break;
4211                 case 1:
4212                         ct = NL80211_CHAN_HT40PLUS;
4213                         break;
4214                 default:
4215                         ct = NL80211_CHAN_HT20;
4216                         break;
4217                 }
4218
4219                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, ct))
4220                         return -ENOBUFS;
4221         }
4222         return 0;
4223 }
4224
4225
4226 static int nl80211_set_channel(struct i802_bss *bss,
4227                                struct hostapd_freq_params *freq, int set_chan)
4228 {
4229         struct wpa_driver_nl80211_data *drv = bss->drv;
4230         struct nl_msg *msg;
4231         int ret;
4232
4233         wpa_printf(MSG_DEBUG,
4234                    "nl80211: Set freq %d (ht_enabled=%d, vht_enabled=%d, bandwidth=%d MHz, cf1=%d MHz, cf2=%d MHz)",
4235                    freq->freq, freq->ht_enabled, freq->vht_enabled,
4236                    freq->bandwidth, freq->center_freq1, freq->center_freq2);
4237
4238         msg = nl80211_drv_msg(drv, 0, set_chan ? NL80211_CMD_SET_CHANNEL :
4239                               NL80211_CMD_SET_WIPHY);
4240         if (!msg || nl80211_put_freq_params(msg, freq) < 0) {
4241                 nlmsg_free(msg);
4242                 return -1;
4243         }
4244
4245         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4246         if (ret == 0) {
4247                 bss->freq = freq->freq;
4248                 return 0;
4249         }
4250         wpa_printf(MSG_DEBUG, "nl80211: Failed to set channel (freq=%d): "
4251                    "%d (%s)", freq->freq, ret, strerror(-ret));
4252         return -1;
4253 }
4254
4255
4256 static u32 sta_flags_nl80211(int flags)
4257 {
4258         u32 f = 0;
4259
4260         if (flags & WPA_STA_AUTHORIZED)
4261                 f |= BIT(NL80211_STA_FLAG_AUTHORIZED);
4262         if (flags & WPA_STA_WMM)
4263                 f |= BIT(NL80211_STA_FLAG_WME);
4264         if (flags & WPA_STA_SHORT_PREAMBLE)
4265                 f |= BIT(NL80211_STA_FLAG_SHORT_PREAMBLE);
4266         if (flags & WPA_STA_MFP)
4267                 f |= BIT(NL80211_STA_FLAG_MFP);
4268         if (flags & WPA_STA_TDLS_PEER)
4269                 f |= BIT(NL80211_STA_FLAG_TDLS_PEER);
4270         if (flags & WPA_STA_AUTHENTICATED)
4271                 f |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
4272
4273         return f;
4274 }
4275
4276
4277 #ifdef CONFIG_MESH
4278 static u32 sta_plink_state_nl80211(enum mesh_plink_state state)
4279 {
4280         switch (state) {
4281         case PLINK_LISTEN:
4282                 return NL80211_PLINK_LISTEN;
4283         case PLINK_OPEN_SENT:
4284                 return NL80211_PLINK_OPN_SNT;
4285         case PLINK_OPEN_RCVD:
4286                 return NL80211_PLINK_OPN_RCVD;
4287         case PLINK_CNF_RCVD:
4288                 return NL80211_PLINK_CNF_RCVD;
4289         case PLINK_ESTAB:
4290                 return NL80211_PLINK_ESTAB;
4291         case PLINK_HOLDING:
4292                 return NL80211_PLINK_HOLDING;
4293         case PLINK_BLOCKED:
4294                 return NL80211_PLINK_BLOCKED;
4295         default:
4296                 wpa_printf(MSG_ERROR, "nl80211: Invalid mesh plink state %d",
4297                            state);
4298         }
4299         return -1;
4300 }
4301 #endif /* CONFIG_MESH */
4302
4303
4304 static int wpa_driver_nl80211_sta_add(void *priv,
4305                                       struct hostapd_sta_add_params *params)
4306 {
4307         struct i802_bss *bss = priv;
4308         struct wpa_driver_nl80211_data *drv = bss->drv;
4309         struct nl_msg *msg;
4310         struct nl80211_sta_flag_update upd;
4311         int ret = -ENOBUFS;
4312
4313         if ((params->flags & WPA_STA_TDLS_PEER) &&
4314             !(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT))
4315                 return -EOPNOTSUPP;
4316
4317         msg = nlmsg_alloc();
4318         if (!msg)
4319                 return -ENOMEM;
4320
4321         wpa_printf(MSG_DEBUG, "nl80211: %s STA " MACSTR,
4322                    params->set ? "Set" : "Add", MAC2STR(params->addr));
4323         if (!nl80211_cmd(drv, msg, 0, params->set ? NL80211_CMD_SET_STATION :
4324                          NL80211_CMD_NEW_STATION) ||
4325             nla_put_u32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname)) ||
4326             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, params->addr))
4327                 goto fail;
4328
4329         if (!params->set || (params->flags & WPA_STA_TDLS_PEER)) {
4330                 wpa_hexdump(MSG_DEBUG, "  * supported rates",
4331                             params->supp_rates, params->supp_rates_len);
4332                 wpa_printf(MSG_DEBUG, "  * capability=0x%x",
4333                            params->capability);
4334                 if (nla_put(msg, NL80211_ATTR_STA_SUPPORTED_RATES,
4335                             params->supp_rates_len, params->supp_rates) ||
4336                     nla_put_u16(msg, NL80211_ATTR_STA_CAPABILITY,
4337                                 params->capability))
4338                         goto fail;
4339
4340                 if (params->ht_capabilities) {
4341                         wpa_hexdump(MSG_DEBUG, "  * ht_capabilities",
4342                                     (u8 *) params->ht_capabilities,
4343                                     sizeof(*params->ht_capabilities));
4344                         if (nla_put(msg, NL80211_ATTR_HT_CAPABILITY,
4345                                     sizeof(*params->ht_capabilities),
4346                                     params->ht_capabilities))
4347                                 goto fail;
4348                 }
4349
4350                 if (params->vht_capabilities) {
4351                         wpa_hexdump(MSG_DEBUG, "  * vht_capabilities",
4352                                     (u8 *) params->vht_capabilities,
4353                                     sizeof(*params->vht_capabilities));
4354                         if (nla_put(msg, NL80211_ATTR_VHT_CAPABILITY,
4355                                     sizeof(*params->vht_capabilities),
4356                                     params->vht_capabilities))
4357                                 goto fail;
4358                 }
4359
4360                 if (params->ext_capab) {
4361                         wpa_hexdump(MSG_DEBUG, "  * ext_capab",
4362                                     params->ext_capab, params->ext_capab_len);
4363                         if (nla_put(msg, NL80211_ATTR_STA_EXT_CAPABILITY,
4364                                     params->ext_capab_len, params->ext_capab))
4365                                 goto fail;
4366                 }
4367         }
4368         if (!params->set) {
4369                 if (params->aid) {
4370                         wpa_printf(MSG_DEBUG, "  * aid=%u", params->aid);
4371                         if (nla_put_u16(msg, NL80211_ATTR_STA_AID, params->aid))
4372                                 goto fail;
4373                 } else {
4374                         /*
4375                          * cfg80211 validates that AID is non-zero, so we have
4376                          * to make this a non-zero value for the TDLS case where
4377                          * a dummy STA entry is used for now.
4378                          */
4379                         wpa_printf(MSG_DEBUG, "  * aid=1 (TDLS workaround)");
4380                         if (nla_put_u16(msg, NL80211_ATTR_STA_AID, 1))
4381                                 goto fail;
4382                 }
4383                 wpa_printf(MSG_DEBUG, "  * listen_interval=%u",
4384                            params->listen_interval);
4385                 if (nla_put_u16(msg, NL80211_ATTR_STA_LISTEN_INTERVAL,
4386                                 params->listen_interval))
4387                         goto fail;
4388         } else if (params->aid && (params->flags & WPA_STA_TDLS_PEER)) {
4389                 wpa_printf(MSG_DEBUG, "  * peer_aid=%u", params->aid);
4390                 if (nla_put_u16(msg, NL80211_ATTR_PEER_AID, params->aid))
4391                         goto fail;
4392         }
4393
4394         if (params->vht_opmode_enabled) {
4395                 wpa_printf(MSG_DEBUG, "  * opmode=%u", params->vht_opmode);
4396                 if (nla_put_u8(msg, NL80211_ATTR_OPMODE_NOTIF,
4397                                params->vht_opmode))
4398                         goto fail;
4399         }
4400
4401         if (params->supp_channels) {
4402                 wpa_hexdump(MSG_DEBUG, "  * supported channels",
4403                             params->supp_channels, params->supp_channels_len);
4404                 if (nla_put(msg, NL80211_ATTR_STA_SUPPORTED_CHANNELS,
4405                             params->supp_channels_len, params->supp_channels))
4406                         goto fail;
4407         }
4408
4409         if (params->supp_oper_classes) {
4410                 wpa_hexdump(MSG_DEBUG, "  * supported operating classes",
4411                             params->supp_oper_classes,
4412                             params->supp_oper_classes_len);
4413                 if (nla_put(msg, NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES,
4414                             params->supp_oper_classes_len,
4415                             params->supp_oper_classes))
4416                         goto fail;
4417         }
4418
4419         os_memset(&upd, 0, sizeof(upd));
4420         upd.set = sta_flags_nl80211(params->flags);
4421         upd.mask = upd.set | sta_flags_nl80211(params->flags_mask);
4422         wpa_printf(MSG_DEBUG, "  * flags set=0x%x mask=0x%x",
4423                    upd.set, upd.mask);
4424         if (nla_put(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd))
4425                 goto fail;
4426
4427 #ifdef CONFIG_MESH
4428         if (params->plink_state &&
4429             nla_put_u8(msg, NL80211_ATTR_STA_PLINK_STATE,
4430                        sta_plink_state_nl80211(params->plink_state)))
4431                 goto fail;
4432 #endif /* CONFIG_MESH */
4433
4434         if (params->flags & WPA_STA_WMM) {
4435                 struct nlattr *wme = nla_nest_start(msg, NL80211_ATTR_STA_WME);
4436
4437                 wpa_printf(MSG_DEBUG, "  * qosinfo=0x%x", params->qosinfo);
4438                 if (!wme ||
4439                     nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
4440                                params->qosinfo & WMM_QOSINFO_STA_AC_MASK) ||
4441                     nla_put_u8(msg, NL80211_STA_WME_MAX_SP,
4442                                (params->qosinfo >> WMM_QOSINFO_STA_SP_SHIFT) &
4443                                WMM_QOSINFO_STA_SP_MASK))
4444                         goto fail;
4445                 nla_nest_end(msg, wme);
4446         }
4447
4448         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4449         msg = NULL;
4450         if (ret)
4451                 wpa_printf(MSG_DEBUG, "nl80211: NL80211_CMD_%s_STATION "
4452                            "result: %d (%s)", params->set ? "SET" : "NEW", ret,
4453                            strerror(-ret));
4454         if (ret == -EEXIST)
4455                 ret = 0;
4456 fail:
4457         nlmsg_free(msg);
4458         return ret;
4459 }
4460
4461
4462 static void rtnl_neigh_delete_fdb_entry(struct i802_bss *bss, const u8 *addr)
4463 {
4464 #ifdef CONFIG_LIBNL3_ROUTE
4465         struct wpa_driver_nl80211_data *drv = bss->drv;
4466         struct rtnl_neigh *rn;
4467         struct nl_addr *nl_addr;
4468         int err;
4469
4470         rn = rtnl_neigh_alloc();
4471         if (!rn)
4472                 return;
4473
4474         rtnl_neigh_set_family(rn, AF_BRIDGE);
4475         rtnl_neigh_set_ifindex(rn, bss->ifindex);
4476         nl_addr = nl_addr_build(AF_BRIDGE, (void *) addr, ETH_ALEN);
4477         if (!nl_addr) {
4478                 rtnl_neigh_put(rn);
4479                 return;
4480         }
4481         rtnl_neigh_set_lladdr(rn, nl_addr);
4482
4483         err = rtnl_neigh_delete(drv->rtnl_sk, rn, 0);
4484         if (err < 0) {
4485                 wpa_printf(MSG_DEBUG, "nl80211: bridge FDB entry delete for "
4486                            MACSTR " ifindex=%d failed: %s", MAC2STR(addr),
4487                            bss->ifindex, nl_geterror(err));
4488         } else {
4489                 wpa_printf(MSG_DEBUG, "nl80211: deleted bridge FDB entry for "
4490                            MACSTR, MAC2STR(addr));
4491         }
4492
4493         nl_addr_put(nl_addr);
4494         rtnl_neigh_put(rn);
4495 #endif /* CONFIG_LIBNL3_ROUTE */
4496 }
4497
4498
4499 static int wpa_driver_nl80211_sta_remove(struct i802_bss *bss, const u8 *addr,
4500                                          int deauth, u16 reason_code)
4501 {
4502         struct wpa_driver_nl80211_data *drv = bss->drv;
4503         struct nl_msg *msg;
4504         int ret;
4505
4506         msg = nlmsg_alloc();
4507         if (!msg)
4508                 return -ENOMEM;
4509
4510         if (!nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_STATION) ||
4511             nla_put_u32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname)) ||
4512             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
4513             (deauth == 0 &&
4514              nla_put_u8(msg, NL80211_ATTR_MGMT_SUBTYPE,
4515                         WLAN_FC_STYPE_DISASSOC)) ||
4516             (deauth == 1 &&
4517              nla_put_u8(msg, NL80211_ATTR_MGMT_SUBTYPE,
4518                         WLAN_FC_STYPE_DEAUTH)) ||
4519             (reason_code &&
4520              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code))) {
4521                 nlmsg_free(msg);
4522                 return -ENOBUFS;
4523         }
4524
4525         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4526         wpa_printf(MSG_DEBUG, "nl80211: sta_remove -> DEL_STATION %s " MACSTR
4527                    " --> %d (%s)",
4528                    bss->ifname, MAC2STR(addr), ret, strerror(-ret));
4529
4530         if (drv->rtnl_sk)
4531                 rtnl_neigh_delete_fdb_entry(bss, addr);
4532
4533         if (ret == -ENOENT)
4534                 return 0;
4535         return ret;
4536 }
4537
4538
4539 void nl80211_remove_iface(struct wpa_driver_nl80211_data *drv, int ifidx)
4540 {
4541         struct nl_msg *msg;
4542         struct wpa_driver_nl80211_data *drv2;
4543
4544         wpa_printf(MSG_DEBUG, "nl80211: Remove interface ifindex=%d", ifidx);
4545
4546         /* stop listening for EAPOL on this interface */
4547         dl_list_for_each(drv2, &drv->global->interfaces,
4548                          struct wpa_driver_nl80211_data, list)
4549                 del_ifidx(drv2, ifidx);
4550
4551         msg = nlmsg_alloc();
4552         if (!msg)
4553                 return;
4554
4555         if (!nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_INTERFACE) ||
4556             nla_put_u32(msg, NL80211_ATTR_IFINDEX, ifidx)) {
4557                 nlmsg_free(msg);
4558                 goto fail;
4559         }
4560
4561         if (send_and_recv_msgs(drv, msg, NULL, NULL) == 0)
4562                 return;
4563 fail:
4564         wpa_printf(MSG_ERROR, "Failed to remove interface (ifidx=%d)", ifidx);
4565 }
4566
4567
4568 static const char * nl80211_iftype_str(enum nl80211_iftype mode)
4569 {
4570         switch (mode) {
4571         case NL80211_IFTYPE_ADHOC:
4572                 return "ADHOC";
4573         case NL80211_IFTYPE_STATION:
4574                 return "STATION";
4575         case NL80211_IFTYPE_AP:
4576                 return "AP";
4577         case NL80211_IFTYPE_AP_VLAN:
4578                 return "AP_VLAN";
4579         case NL80211_IFTYPE_WDS:
4580                 return "WDS";
4581         case NL80211_IFTYPE_MONITOR:
4582                 return "MONITOR";
4583         case NL80211_IFTYPE_MESH_POINT:
4584                 return "MESH_POINT";
4585         case NL80211_IFTYPE_P2P_CLIENT:
4586                 return "P2P_CLIENT";
4587         case NL80211_IFTYPE_P2P_GO:
4588                 return "P2P_GO";
4589         case NL80211_IFTYPE_P2P_DEVICE:
4590                 return "P2P_DEVICE";
4591         default:
4592                 return "unknown";
4593         }
4594 }
4595
4596
4597 static int nl80211_create_iface_once(struct wpa_driver_nl80211_data *drv,
4598                                      const char *ifname,
4599                                      enum nl80211_iftype iftype,
4600                                      const u8 *addr, int wds,
4601                                      int (*handler)(struct nl_msg *, void *),
4602                                      void *arg)
4603 {
4604         struct nl_msg *msg;
4605         int ifidx;
4606         int ret = -ENOBUFS;
4607
4608         wpa_printf(MSG_DEBUG, "nl80211: Create interface iftype %d (%s)",
4609                    iftype, nl80211_iftype_str(iftype));
4610
4611         msg = nl80211_cmd_msg(drv->first_bss, 0, NL80211_CMD_NEW_INTERFACE);
4612         if (!msg ||
4613             nla_put_string(msg, NL80211_ATTR_IFNAME, ifname) ||
4614             nla_put_u32(msg, NL80211_ATTR_IFTYPE, iftype))
4615                 goto fail;
4616
4617         if (iftype == NL80211_IFTYPE_MONITOR) {
4618                 struct nlattr *flags;
4619
4620                 flags = nla_nest_start(msg, NL80211_ATTR_MNTR_FLAGS);
4621                 if (!flags ||
4622                     nla_put_flag(msg, NL80211_MNTR_FLAG_COOK_FRAMES))
4623                         goto fail;
4624
4625                 nla_nest_end(msg, flags);
4626         } else if (wds) {
4627                 if (nla_put_u8(msg, NL80211_ATTR_4ADDR, wds))
4628                         goto fail;
4629         }
4630
4631         /*
4632          * Tell cfg80211 that the interface belongs to the socket that created
4633          * it, and the interface should be deleted when the socket is closed.
4634          */
4635         if (nla_put_flag(msg, NL80211_ATTR_IFACE_SOCKET_OWNER))
4636                 goto fail;
4637
4638         ret = send_and_recv_msgs(drv, msg, handler, arg);
4639         msg = NULL;
4640         if (ret) {
4641         fail:
4642                 nlmsg_free(msg);
4643                 wpa_printf(MSG_ERROR, "Failed to create interface %s: %d (%s)",
4644                            ifname, ret, strerror(-ret));
4645                 return ret;
4646         }
4647
4648         if (iftype == NL80211_IFTYPE_P2P_DEVICE)
4649                 return 0;
4650
4651         ifidx = if_nametoindex(ifname);
4652         wpa_printf(MSG_DEBUG, "nl80211: New interface %s created: ifindex=%d",
4653                    ifname, ifidx);
4654
4655         if (ifidx <= 0)
4656                 return -1;
4657
4658         /*
4659          * Some virtual interfaces need to process EAPOL packets and events on
4660          * the parent interface. This is used mainly with hostapd.
4661          */
4662         if (drv->hostapd ||
4663             iftype == NL80211_IFTYPE_AP_VLAN ||
4664             iftype == NL80211_IFTYPE_WDS ||
4665             iftype == NL80211_IFTYPE_MONITOR) {
4666                 /* start listening for EAPOL on this interface */
4667                 add_ifidx(drv, ifidx);
4668         }
4669
4670         if (addr && iftype != NL80211_IFTYPE_MONITOR &&
4671             linux_set_ifhwaddr(drv->global->ioctl_sock, ifname, addr)) {
4672                 nl80211_remove_iface(drv, ifidx);
4673                 return -1;
4674         }
4675
4676         return ifidx;
4677 }
4678
4679
4680 int nl80211_create_iface(struct wpa_driver_nl80211_data *drv,
4681                          const char *ifname, enum nl80211_iftype iftype,
4682                          const u8 *addr, int wds,
4683                          int (*handler)(struct nl_msg *, void *),
4684                          void *arg, int use_existing)
4685 {
4686         int ret;
4687
4688         ret = nl80211_create_iface_once(drv, ifname, iftype, addr, wds, handler,
4689                                         arg);
4690
4691         /* if error occurred and interface exists already */
4692         if (ret == -ENFILE && if_nametoindex(ifname)) {
4693                 if (use_existing) {
4694                         wpa_printf(MSG_DEBUG, "nl80211: Continue using existing interface %s",
4695                                    ifname);
4696                         if (addr && iftype != NL80211_IFTYPE_MONITOR &&
4697                             linux_set_ifhwaddr(drv->global->ioctl_sock, ifname,
4698                                                addr) < 0 &&
4699                             (linux_set_iface_flags(drv->global->ioctl_sock,
4700                                                    ifname, 0) < 0 ||
4701                              linux_set_ifhwaddr(drv->global->ioctl_sock, ifname,
4702                                                 addr) < 0 ||
4703                              linux_set_iface_flags(drv->global->ioctl_sock,
4704                                                    ifname, 1) < 0))
4705                                         return -1;
4706                         return -ENFILE;
4707                 }
4708                 wpa_printf(MSG_INFO, "Try to remove and re-create %s", ifname);
4709
4710                 /* Try to remove the interface that was already there. */
4711                 nl80211_remove_iface(drv, if_nametoindex(ifname));
4712
4713                 /* Try to create the interface again */
4714                 ret = nl80211_create_iface_once(drv, ifname, iftype, addr,
4715                                                 wds, handler, arg);
4716         }
4717
4718         if (ret >= 0 && is_p2p_net_interface(iftype))
4719                 nl80211_disable_11b_rates(drv, ret, 1);
4720
4721         return ret;
4722 }
4723
4724
4725 static int nl80211_setup_ap(struct i802_bss *bss)
4726 {
4727         struct wpa_driver_nl80211_data *drv = bss->drv;
4728
4729         wpa_printf(MSG_DEBUG, "nl80211: Setup AP(%s) - device_ap_sme=%d use_monitor=%d",
4730                    bss->ifname, drv->device_ap_sme, drv->use_monitor);
4731
4732         /*
4733          * Disable Probe Request reporting unless we need it in this way for
4734          * devices that include the AP SME, in the other case (unless using
4735          * monitor iface) we'll get it through the nl_mgmt socket instead.
4736          */
4737         if (!drv->device_ap_sme)
4738                 wpa_driver_nl80211_probe_req_report(bss, 0);
4739
4740         if (!drv->device_ap_sme && !drv->use_monitor)
4741                 if (nl80211_mgmt_subscribe_ap(bss))
4742                         return -1;
4743
4744         if (drv->device_ap_sme && !drv->use_monitor)
4745                 if (nl80211_mgmt_subscribe_ap_dev_sme(bss))
4746                         return -1;
4747
4748         if (!drv->device_ap_sme && drv->use_monitor &&
4749             nl80211_create_monitor_interface(drv) &&
4750             !drv->device_ap_sme)
4751                 return -1;
4752
4753         if (drv->device_ap_sme &&
4754             wpa_driver_nl80211_probe_req_report(bss, 1) < 0) {
4755                 wpa_printf(MSG_DEBUG, "nl80211: Failed to enable "
4756                            "Probe Request frame reporting in AP mode");
4757                 /* Try to survive without this */
4758         }
4759
4760         return 0;
4761 }
4762
4763
4764 static void nl80211_teardown_ap(struct i802_bss *bss)
4765 {
4766         struct wpa_driver_nl80211_data *drv = bss->drv;
4767
4768         wpa_printf(MSG_DEBUG, "nl80211: Teardown AP(%s) - device_ap_sme=%d use_monitor=%d",
4769                    bss->ifname, drv->device_ap_sme, drv->use_monitor);
4770         if (drv->device_ap_sme) {
4771                 wpa_driver_nl80211_probe_req_report(bss, 0);
4772                 if (!drv->use_monitor)
4773                         nl80211_mgmt_unsubscribe(bss, "AP teardown (dev SME)");
4774         } else if (drv->use_monitor)
4775                 nl80211_remove_monitor_interface(drv);
4776         else
4777                 nl80211_mgmt_unsubscribe(bss, "AP teardown");
4778
4779         bss->beacon_set = 0;
4780 }
4781
4782
4783 static int nl80211_send_eapol_data(struct i802_bss *bss,
4784                                    const u8 *addr, const u8 *data,
4785                                    size_t data_len)
4786 {
4787         struct sockaddr_ll ll;
4788         int ret;
4789
4790         if (bss->drv->eapol_tx_sock < 0) {
4791                 wpa_printf(MSG_DEBUG, "nl80211: No socket to send EAPOL");
4792                 return -1;
4793         }
4794
4795         os_memset(&ll, 0, sizeof(ll));
4796         ll.sll_family = AF_PACKET;
4797         ll.sll_ifindex = bss->ifindex;
4798         ll.sll_protocol = htons(ETH_P_PAE);
4799         ll.sll_halen = ETH_ALEN;
4800         os_memcpy(ll.sll_addr, addr, ETH_ALEN);
4801         ret = sendto(bss->drv->eapol_tx_sock, data, data_len, 0,
4802                      (struct sockaddr *) &ll, sizeof(ll));
4803         if (ret < 0)
4804                 wpa_printf(MSG_ERROR, "nl80211: EAPOL TX: %s",
4805                            strerror(errno));
4806
4807         return ret;
4808 }
4809
4810
4811 static const u8 rfc1042_header[6] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
4812
4813 static int wpa_driver_nl80211_hapd_send_eapol(
4814         void *priv, const u8 *addr, const u8 *data,
4815         size_t data_len, int encrypt, const u8 *own_addr, u32 flags)
4816 {
4817         struct i802_bss *bss = priv;
4818         struct wpa_driver_nl80211_data *drv = bss->drv;
4819         struct ieee80211_hdr *hdr;
4820         size_t len;
4821         u8 *pos;
4822         int res;
4823         int qos = flags & WPA_STA_WMM;
4824
4825         if (drv->device_ap_sme || !drv->use_monitor)
4826                 return nl80211_send_eapol_data(bss, addr, data, data_len);
4827
4828         len = sizeof(*hdr) + (qos ? 2 : 0) + sizeof(rfc1042_header) + 2 +
4829                 data_len;
4830         hdr = os_zalloc(len);
4831         if (hdr == NULL) {
4832                 wpa_printf(MSG_INFO, "nl80211: Failed to allocate EAPOL buffer(len=%lu)",
4833                            (unsigned long) len);
4834                 return -1;
4835         }
4836
4837         hdr->frame_control =
4838                 IEEE80211_FC(WLAN_FC_TYPE_DATA, WLAN_FC_STYPE_DATA);
4839         hdr->frame_control |= host_to_le16(WLAN_FC_FROMDS);
4840         if (encrypt)
4841                 hdr->frame_control |= host_to_le16(WLAN_FC_ISWEP);
4842         if (qos) {
4843                 hdr->frame_control |=
4844                         host_to_le16(WLAN_FC_STYPE_QOS_DATA << 4);
4845         }
4846
4847         memcpy(hdr->IEEE80211_DA_FROMDS, addr, ETH_ALEN);
4848         memcpy(hdr->IEEE80211_BSSID_FROMDS, own_addr, ETH_ALEN);
4849         memcpy(hdr->IEEE80211_SA_FROMDS, own_addr, ETH_ALEN);
4850         pos = (u8 *) (hdr + 1);
4851
4852         if (qos) {
4853                 /* Set highest priority in QoS header */
4854                 pos[0] = 7;
4855                 pos[1] = 0;
4856                 pos += 2;
4857         }
4858
4859         memcpy(pos, rfc1042_header, sizeof(rfc1042_header));
4860         pos += sizeof(rfc1042_header);
4861         WPA_PUT_BE16(pos, ETH_P_PAE);
4862         pos += 2;
4863         memcpy(pos, data, data_len);
4864
4865         res = wpa_driver_nl80211_send_frame(bss, (u8 *) hdr, len, encrypt, 0,
4866                                             0, 0, 0, 0);
4867         if (res < 0) {
4868                 wpa_printf(MSG_ERROR, "i802_send_eapol - packet len: %lu - "
4869                            "failed: %d (%s)",
4870                            (unsigned long) len, errno, strerror(errno));
4871         }
4872         os_free(hdr);
4873
4874         return res;
4875 }
4876
4877
4878 static int wpa_driver_nl80211_sta_set_flags(void *priv, const u8 *addr,
4879                                             int total_flags,
4880                                             int flags_or, int flags_and)
4881 {
4882         struct i802_bss *bss = priv;
4883         struct wpa_driver_nl80211_data *drv = bss->drv;
4884         struct nl_msg *msg;
4885         struct nlattr *flags;
4886         struct nl80211_sta_flag_update upd;
4887
4888         wpa_printf(MSG_DEBUG, "nl80211: Set STA flags - ifname=%s addr=" MACSTR
4889                    " total_flags=0x%x flags_or=0x%x flags_and=0x%x authorized=%d",
4890                    bss->ifname, MAC2STR(addr), total_flags, flags_or, flags_and,
4891                    !!(total_flags & WPA_STA_AUTHORIZED));
4892
4893         msg = nlmsg_alloc();
4894         if (!msg)
4895                 return -ENOMEM;
4896
4897         if (!nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_STATION) ||
4898             nla_put_u32(msg, NL80211_ATTR_IFINDEX,
4899                         if_nametoindex(bss->ifname)) ||
4900             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
4901                 goto fail;
4902
4903         /*
4904          * Backwards compatibility version using NL80211_ATTR_STA_FLAGS. This
4905          * can be removed eventually.
4906          */
4907         flags = nla_nest_start(msg, NL80211_ATTR_STA_FLAGS);
4908         if (!flags ||
4909             ((total_flags & WPA_STA_AUTHORIZED) &&
4910              nla_put_flag(msg, NL80211_STA_FLAG_AUTHORIZED)) ||
4911             ((total_flags & WPA_STA_WMM) &&
4912              nla_put_flag(msg, NL80211_STA_FLAG_WME)) ||
4913             ((total_flags & WPA_STA_SHORT_PREAMBLE) &&
4914              nla_put_flag(msg, NL80211_STA_FLAG_SHORT_PREAMBLE)) ||
4915             ((total_flags & WPA_STA_MFP) &&
4916              nla_put_flag(msg, NL80211_STA_FLAG_MFP)) ||
4917             ((total_flags & WPA_STA_TDLS_PEER) &&
4918              nla_put_flag(msg, NL80211_STA_FLAG_TDLS_PEER)))
4919                 goto fail;
4920
4921         nla_nest_end(msg, flags);
4922
4923         os_memset(&upd, 0, sizeof(upd));
4924         upd.mask = sta_flags_nl80211(flags_or | ~flags_and);
4925         upd.set = sta_flags_nl80211(flags_or);
4926         if (nla_put(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd))
4927                 goto fail;
4928
4929         return send_and_recv_msgs(drv, msg, NULL, NULL);
4930 fail:
4931         nlmsg_free(msg);
4932         return -ENOBUFS;
4933 }
4934
4935
4936 static int wpa_driver_nl80211_ap(struct wpa_driver_nl80211_data *drv,
4937                                  struct wpa_driver_associate_params *params)
4938 {
4939         enum nl80211_iftype nlmode, old_mode;
4940
4941         if (params->p2p) {
4942                 wpa_printf(MSG_DEBUG, "nl80211: Setup AP operations for P2P "
4943                            "group (GO)");
4944                 nlmode = NL80211_IFTYPE_P2P_GO;
4945         } else
4946                 nlmode = NL80211_IFTYPE_AP;
4947
4948         old_mode = drv->nlmode;
4949         if (wpa_driver_nl80211_set_mode(drv->first_bss, nlmode)) {
4950                 nl80211_remove_monitor_interface(drv);
4951                 return -1;
4952         }
4953
4954         if (nl80211_set_channel(drv->first_bss, &params->freq, 0)) {
4955                 if (old_mode != nlmode)
4956                         wpa_driver_nl80211_set_mode(drv->first_bss, old_mode);
4957                 nl80211_remove_monitor_interface(drv);
4958                 return -1;
4959         }
4960
4961         return 0;
4962 }
4963
4964
4965 static int nl80211_leave_ibss(struct wpa_driver_nl80211_data *drv)
4966 {
4967         struct nl_msg *msg;
4968         int ret;
4969
4970         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_LEAVE_IBSS);
4971         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4972         if (ret) {
4973                 wpa_printf(MSG_DEBUG, "nl80211: Leave IBSS failed: ret=%d "
4974                            "(%s)", ret, strerror(-ret));
4975         } else {
4976                 wpa_printf(MSG_DEBUG,
4977                            "nl80211: Leave IBSS request sent successfully");
4978         }
4979
4980         if (wpa_driver_nl80211_set_mode(drv->first_bss,
4981                                         NL80211_IFTYPE_STATION)) {
4982                 wpa_printf(MSG_INFO, "nl80211: Failed to set interface into "
4983                            "station mode");
4984         }
4985
4986         return ret;
4987 }
4988
4989
4990 static int wpa_driver_nl80211_ibss(struct wpa_driver_nl80211_data *drv,
4991                                    struct wpa_driver_associate_params *params)
4992 {
4993         struct nl_msg *msg;
4994         int ret = -1;
4995         int count = 0;
4996
4997         wpa_printf(MSG_DEBUG, "nl80211: Join IBSS (ifindex=%d)", drv->ifindex);
4998
4999         if (wpa_driver_nl80211_set_mode_ibss(drv->first_bss, &params->freq)) {
5000                 wpa_printf(MSG_INFO, "nl80211: Failed to set interface into "
5001                            "IBSS mode");
5002                 return -1;
5003         }
5004
5005 retry:
5006         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_JOIN_IBSS)) ||
5007             params->ssid == NULL || params->ssid_len > sizeof(drv->ssid))
5008                 goto fail;
5009
5010         wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
5011                           params->ssid, params->ssid_len);
5012         if (nla_put(msg, NL80211_ATTR_SSID, params->ssid_len, params->ssid))
5013                 goto fail;
5014         os_memcpy(drv->ssid, params->ssid, params->ssid_len);
5015         drv->ssid_len = params->ssid_len;
5016
5017         wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq.freq);
5018         wpa_printf(MSG_DEBUG, "  * ht_enabled=%d", params->freq.ht_enabled);
5019         wpa_printf(MSG_DEBUG, "  * sec_channel_offset=%d",
5020                    params->freq.sec_channel_offset);
5021         wpa_printf(MSG_DEBUG, "  * vht_enabled=%d", params->freq.vht_enabled);
5022         wpa_printf(MSG_DEBUG, "  * center_freq1=%d", params->freq.center_freq1);
5023         wpa_printf(MSG_DEBUG, "  * center_freq2=%d", params->freq.center_freq2);
5024         wpa_printf(MSG_DEBUG, "  * bandwidth=%d", params->freq.bandwidth);
5025         if (nl80211_put_freq_params(msg, &params->freq) < 0)
5026                 goto fail;
5027
5028         if (params->beacon_int > 0) {
5029                 wpa_printf(MSG_DEBUG, "  * beacon_int=%d", params->beacon_int);
5030                 if (nla_put_u32(msg, NL80211_ATTR_BEACON_INTERVAL,
5031                                 params->beacon_int))
5032                         goto fail;
5033         }
5034
5035         ret = nl80211_set_conn_keys(params, msg);
5036         if (ret)
5037                 goto fail;
5038
5039         if (params->bssid && params->fixed_bssid) {
5040                 wpa_printf(MSG_DEBUG, "  * BSSID=" MACSTR,
5041                            MAC2STR(params->bssid));
5042                 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid))
5043                         goto fail;
5044         }
5045
5046         if (params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
5047             params->key_mgmt_suite == WPA_KEY_MGMT_PSK ||
5048             params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
5049             params->key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256) {
5050                 wpa_printf(MSG_DEBUG, "  * control port");
5051                 if (nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT))
5052                         goto fail;
5053         }
5054
5055         if (params->wpa_ie) {
5056                 wpa_hexdump(MSG_DEBUG,
5057                             "  * Extra IEs for Beacon/Probe Response frames",
5058                             params->wpa_ie, params->wpa_ie_len);
5059                 if (nla_put(msg, NL80211_ATTR_IE, params->wpa_ie_len,
5060                             params->wpa_ie))
5061                         goto fail;
5062         }
5063
5064         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5065         msg = NULL;
5066         if (ret) {
5067                 wpa_printf(MSG_DEBUG, "nl80211: Join IBSS failed: ret=%d (%s)",
5068                            ret, strerror(-ret));
5069                 count++;
5070                 if (ret == -EALREADY && count == 1) {
5071                         wpa_printf(MSG_DEBUG, "nl80211: Retry IBSS join after "
5072                                    "forced leave");
5073                         nl80211_leave_ibss(drv);
5074                         nlmsg_free(msg);
5075                         goto retry;
5076                 }
5077         } else {
5078                 wpa_printf(MSG_DEBUG,
5079                            "nl80211: Join IBSS request sent successfully");
5080         }
5081
5082 fail:
5083         nlmsg_free(msg);
5084         return ret;
5085 }
5086
5087
5088 static int nl80211_connect_common(struct wpa_driver_nl80211_data *drv,
5089                                   struct wpa_driver_associate_params *params,
5090                                   struct nl_msg *msg)
5091 {
5092         if (params->bssid) {
5093                 wpa_printf(MSG_DEBUG, "  * bssid=" MACSTR,
5094                            MAC2STR(params->bssid));
5095                 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid))
5096                         return -1;
5097         }
5098
5099         if (params->bssid_hint) {
5100                 wpa_printf(MSG_DEBUG, "  * bssid_hint=" MACSTR,
5101                            MAC2STR(params->bssid_hint));
5102                 if (nla_put(msg, NL80211_ATTR_MAC_HINT, ETH_ALEN,
5103                             params->bssid_hint))
5104                         return -1;
5105         }
5106
5107         if (params->freq.freq) {
5108                 wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq.freq);
5109                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
5110                                 params->freq.freq))
5111                         return -1;
5112                 drv->assoc_freq = params->freq.freq;
5113         } else
5114                 drv->assoc_freq = 0;
5115
5116         if (params->freq_hint) {
5117                 wpa_printf(MSG_DEBUG, "  * freq_hint=%d", params->freq_hint);
5118                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_HINT,
5119                                 params->freq_hint))
5120                         return -1;
5121         }
5122
5123         if (params->bg_scan_period >= 0) {
5124                 wpa_printf(MSG_DEBUG, "  * bg scan period=%d",
5125                            params->bg_scan_period);
5126                 if (nla_put_u16(msg, NL80211_ATTR_BG_SCAN_PERIOD,
5127                                 params->bg_scan_period))
5128                         return -1;
5129         }
5130
5131         if (params->ssid) {
5132                 wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
5133                                   params->ssid, params->ssid_len);
5134                 if (nla_put(msg, NL80211_ATTR_SSID, params->ssid_len,
5135                             params->ssid))
5136                         return -1;
5137                 if (params->ssid_len > sizeof(drv->ssid))
5138                         return -1;
5139                 os_memcpy(drv->ssid, params->ssid, params->ssid_len);
5140                 drv->ssid_len = params->ssid_len;
5141         }
5142
5143         wpa_hexdump(MSG_DEBUG, "  * IEs", params->wpa_ie, params->wpa_ie_len);
5144         if (params->wpa_ie &&
5145             nla_put(msg, NL80211_ATTR_IE, params->wpa_ie_len, params->wpa_ie))
5146                 return -1;
5147
5148         if (params->wpa_proto) {
5149                 enum nl80211_wpa_versions ver = 0;
5150
5151                 if (params->wpa_proto & WPA_PROTO_WPA)
5152                         ver |= NL80211_WPA_VERSION_1;
5153                 if (params->wpa_proto & WPA_PROTO_RSN)
5154                         ver |= NL80211_WPA_VERSION_2;
5155
5156                 wpa_printf(MSG_DEBUG, "  * WPA Versions 0x%x", ver);
5157                 if (nla_put_u32(msg, NL80211_ATTR_WPA_VERSIONS, ver))
5158                         return -1;
5159         }
5160
5161         if (params->pairwise_suite != WPA_CIPHER_NONE) {
5162                 u32 cipher = wpa_cipher_to_cipher_suite(params->pairwise_suite);
5163                 wpa_printf(MSG_DEBUG, "  * pairwise=0x%x", cipher);
5164                 if (nla_put_u32(msg, NL80211_ATTR_CIPHER_SUITES_PAIRWISE,
5165                                 cipher))
5166                         return -1;
5167         }
5168
5169         if (params->group_suite == WPA_CIPHER_GTK_NOT_USED &&
5170             !(drv->capa.enc & WPA_DRIVER_CAPA_ENC_GTK_NOT_USED)) {
5171                 /*
5172                  * This is likely to work even though many drivers do not
5173                  * advertise support for operations without GTK.
5174                  */
5175                 wpa_printf(MSG_DEBUG, "  * skip group cipher configuration for GTK_NOT_USED due to missing driver support advertisement");
5176         } else if (params->group_suite != WPA_CIPHER_NONE) {
5177                 u32 cipher = wpa_cipher_to_cipher_suite(params->group_suite);
5178                 wpa_printf(MSG_DEBUG, "  * group=0x%x", cipher);
5179                 if (nla_put_u32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP, cipher))
5180                         return -1;
5181         }
5182
5183         if (params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
5184             params->key_mgmt_suite == WPA_KEY_MGMT_PSK ||
5185             params->key_mgmt_suite == WPA_KEY_MGMT_FT_IEEE8021X ||
5186             params->key_mgmt_suite == WPA_KEY_MGMT_FT_PSK ||
5187             params->key_mgmt_suite == WPA_KEY_MGMT_CCKM ||
5188             params->key_mgmt_suite == WPA_KEY_MGMT_OSEN ||
5189             params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
5190             params->key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256 ||
5191             params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B) {
5192                 int mgmt = WLAN_AKM_SUITE_PSK;
5193
5194                 switch (params->key_mgmt_suite) {
5195                 case WPA_KEY_MGMT_CCKM:
5196                         mgmt = WLAN_AKM_SUITE_CCKM;
5197                         break;
5198                 case WPA_KEY_MGMT_IEEE8021X:
5199                         mgmt = WLAN_AKM_SUITE_8021X;
5200                         break;
5201                 case WPA_KEY_MGMT_FT_IEEE8021X:
5202                         mgmt = WLAN_AKM_SUITE_FT_8021X;
5203                         break;
5204                 case WPA_KEY_MGMT_FT_PSK:
5205                         mgmt = WLAN_AKM_SUITE_FT_PSK;
5206                         break;
5207                 case WPA_KEY_MGMT_IEEE8021X_SHA256:
5208                         mgmt = WLAN_AKM_SUITE_8021X_SHA256;
5209                         break;
5210                 case WPA_KEY_MGMT_PSK_SHA256:
5211                         mgmt = WLAN_AKM_SUITE_PSK_SHA256;
5212                         break;
5213                 case WPA_KEY_MGMT_OSEN:
5214                         mgmt = WLAN_AKM_SUITE_OSEN;
5215                         break;
5216                 case WPA_KEY_MGMT_IEEE8021X_SUITE_B:
5217                         mgmt = WLAN_AKM_SUITE_8021X_SUITE_B;
5218                         break;
5219                 case WPA_KEY_MGMT_PSK:
5220                 default:
5221                         mgmt = WLAN_AKM_SUITE_PSK;
5222                         break;
5223                 }
5224                 wpa_printf(MSG_DEBUG, "  * akm=0x%x", mgmt);
5225                 if (nla_put_u32(msg, NL80211_ATTR_AKM_SUITES, mgmt))
5226                         return -1;
5227         }
5228
5229         if (nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT))
5230                 return -1;
5231
5232         if (params->mgmt_frame_protection == MGMT_FRAME_PROTECTION_REQUIRED &&
5233             nla_put_u32(msg, NL80211_ATTR_USE_MFP, NL80211_MFP_REQUIRED))
5234                 return -1;
5235
5236         if (params->rrm_used) {
5237                 u32 drv_rrm_flags = drv->capa.rrm_flags;
5238                 if (!(drv_rrm_flags &
5239                       WPA_DRIVER_FLAGS_DS_PARAM_SET_IE_IN_PROBES) ||
5240                     !(drv_rrm_flags & WPA_DRIVER_FLAGS_QUIET) ||
5241                     nla_put_flag(msg, NL80211_ATTR_USE_RRM))
5242                         return -1;
5243         }
5244
5245         if (params->disable_ht && nla_put_flag(msg, NL80211_ATTR_DISABLE_HT))
5246                 return -1;
5247
5248         if (params->htcaps && params->htcaps_mask) {
5249                 int sz = sizeof(struct ieee80211_ht_capabilities);
5250                 wpa_hexdump(MSG_DEBUG, "  * htcaps", params->htcaps, sz);
5251                 wpa_hexdump(MSG_DEBUG, "  * htcaps_mask",
5252                             params->htcaps_mask, sz);
5253                 if (nla_put(msg, NL80211_ATTR_HT_CAPABILITY, sz,
5254                             params->htcaps) ||
5255                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK, sz,
5256                             params->htcaps_mask))
5257                         return -1;
5258         }
5259
5260 #ifdef CONFIG_VHT_OVERRIDES
5261         if (params->disable_vht) {
5262                 wpa_printf(MSG_DEBUG, "  * VHT disabled");
5263                 if (nla_put_flag(msg, NL80211_ATTR_DISABLE_VHT))
5264                         return -1;
5265         }
5266
5267         if (params->vhtcaps && params->vhtcaps_mask) {
5268                 int sz = sizeof(struct ieee80211_vht_capabilities);
5269                 wpa_hexdump(MSG_DEBUG, "  * vhtcaps", params->vhtcaps, sz);
5270                 wpa_hexdump(MSG_DEBUG, "  * vhtcaps_mask",
5271                             params->vhtcaps_mask, sz);
5272                 if (nla_put(msg, NL80211_ATTR_VHT_CAPABILITY, sz,
5273                             params->vhtcaps) ||
5274                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK, sz,
5275                             params->vhtcaps_mask))
5276                         return -1;
5277         }
5278 #endif /* CONFIG_VHT_OVERRIDES */
5279
5280         if (params->p2p)
5281                 wpa_printf(MSG_DEBUG, "  * P2P group");
5282
5283         return 0;
5284 }
5285
5286
5287 static int wpa_driver_nl80211_try_connect(
5288         struct wpa_driver_nl80211_data *drv,
5289         struct wpa_driver_associate_params *params)
5290 {
5291         struct nl_msg *msg;
5292         enum nl80211_auth_type type;
5293         int ret;
5294         int algs;
5295
5296         if (params->req_key_mgmt_offload && params->psk &&
5297             (params->key_mgmt_suite == WPA_KEY_MGMT_PSK ||
5298              params->key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256 ||
5299              params->key_mgmt_suite == WPA_KEY_MGMT_FT_PSK)) {
5300                 wpa_printf(MSG_DEBUG, "nl80211: Key management set PSK");
5301                 ret = issue_key_mgmt_set_key(drv, params->psk, 32);
5302                 if (ret)
5303                         return ret;
5304         }
5305
5306         wpa_printf(MSG_DEBUG, "nl80211: Connect (ifindex=%d)", drv->ifindex);
5307         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_CONNECT);
5308         if (!msg)
5309                 return -1;
5310
5311         ret = nl80211_connect_common(drv, params, msg);
5312         if (ret)
5313                 goto fail;
5314
5315         algs = 0;
5316         if (params->auth_alg & WPA_AUTH_ALG_OPEN)
5317                 algs++;
5318         if (params->auth_alg & WPA_AUTH_ALG_SHARED)
5319                 algs++;
5320         if (params->auth_alg & WPA_AUTH_ALG_LEAP)
5321                 algs++;
5322         if (algs > 1) {
5323                 wpa_printf(MSG_DEBUG, "  * Leave out Auth Type for automatic "
5324                            "selection");
5325                 goto skip_auth_type;
5326         }
5327
5328         if (params->auth_alg & WPA_AUTH_ALG_OPEN)
5329                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
5330         else if (params->auth_alg & WPA_AUTH_ALG_SHARED)
5331                 type = NL80211_AUTHTYPE_SHARED_KEY;
5332         else if (params->auth_alg & WPA_AUTH_ALG_LEAP)
5333                 type = NL80211_AUTHTYPE_NETWORK_EAP;
5334         else if (params->auth_alg & WPA_AUTH_ALG_FT)
5335                 type = NL80211_AUTHTYPE_FT;
5336         else
5337                 goto fail;
5338
5339         wpa_printf(MSG_DEBUG, "  * Auth Type %d", type);
5340         if (nla_put_u32(msg, NL80211_ATTR_AUTH_TYPE, type))
5341                 goto fail;
5342
5343 skip_auth_type:
5344         ret = nl80211_set_conn_keys(params, msg);
5345         if (ret)
5346                 goto fail;
5347
5348         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5349         msg = NULL;
5350         if (ret) {
5351                 wpa_printf(MSG_DEBUG, "nl80211: MLME connect failed: ret=%d "
5352                            "(%s)", ret, strerror(-ret));
5353         } else {
5354                 wpa_printf(MSG_DEBUG,
5355                            "nl80211: Connect request send successfully");
5356         }
5357
5358 fail:
5359         nlmsg_free(msg);
5360         return ret;
5361
5362 }
5363
5364
5365 static int wpa_driver_nl80211_connect(
5366         struct wpa_driver_nl80211_data *drv,
5367         struct wpa_driver_associate_params *params)
5368 {
5369         int ret;
5370
5371         /* Store the connection attempted bssid for future use */
5372         if (params->bssid)
5373                 os_memcpy(drv->auth_attempt_bssid, params->bssid, ETH_ALEN);
5374         else
5375                 os_memset(drv->auth_attempt_bssid, 0, ETH_ALEN);
5376
5377         ret = wpa_driver_nl80211_try_connect(drv, params);
5378         if (ret == -EALREADY) {
5379                 /*
5380                  * cfg80211 does not currently accept new connections if
5381                  * we are already connected. As a workaround, force
5382                  * disconnection and try again.
5383                  */
5384                 wpa_printf(MSG_DEBUG, "nl80211: Explicitly "
5385                            "disconnecting before reassociation "
5386                            "attempt");
5387                 if (wpa_driver_nl80211_disconnect(
5388                             drv, WLAN_REASON_PREV_AUTH_NOT_VALID))
5389                         return -1;
5390                 ret = wpa_driver_nl80211_try_connect(drv, params);
5391         }
5392         return ret;
5393 }
5394
5395
5396 static int wpa_driver_nl80211_associate(
5397         void *priv, struct wpa_driver_associate_params *params)
5398 {
5399         struct i802_bss *bss = priv;
5400         struct wpa_driver_nl80211_data *drv = bss->drv;
5401         int ret = -1;
5402         struct nl_msg *msg;
5403
5404         if (params->mode == IEEE80211_MODE_AP)
5405                 return wpa_driver_nl80211_ap(drv, params);
5406
5407         if (params->mode == IEEE80211_MODE_IBSS)
5408                 return wpa_driver_nl80211_ibss(drv, params);
5409
5410         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME)) {
5411                 enum nl80211_iftype nlmode = params->p2p ?
5412                         NL80211_IFTYPE_P2P_CLIENT : NL80211_IFTYPE_STATION;
5413
5414                 if (wpa_driver_nl80211_set_mode(priv, nlmode) < 0)
5415                         return -1;
5416                 return wpa_driver_nl80211_connect(drv, params);
5417         }
5418
5419         nl80211_mark_disconnected(drv);
5420
5421         wpa_printf(MSG_DEBUG, "nl80211: Associate (ifindex=%d)",
5422                    drv->ifindex);
5423         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_ASSOCIATE);
5424         if (!msg)
5425                 return -1;
5426
5427         ret = nl80211_connect_common(drv, params, msg);
5428         if (ret)
5429                 goto fail;
5430
5431         if (params->prev_bssid) {
5432                 wpa_printf(MSG_DEBUG, "  * prev_bssid=" MACSTR,
5433                            MAC2STR(params->prev_bssid));
5434                 if (nla_put(msg, NL80211_ATTR_PREV_BSSID, ETH_ALEN,
5435                             params->prev_bssid))
5436                         goto fail;
5437         }
5438
5439         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5440         msg = NULL;
5441         if (ret) {
5442                 wpa_dbg(drv->ctx, MSG_DEBUG,
5443                         "nl80211: MLME command failed (assoc): ret=%d (%s)",
5444                         ret, strerror(-ret));
5445                 nl80211_dump_scan(drv);
5446         } else {
5447                 wpa_printf(MSG_DEBUG,
5448                            "nl80211: Association request send successfully");
5449         }
5450
5451 fail:
5452         nlmsg_free(msg);
5453         return ret;
5454 }
5455
5456
5457 static int nl80211_set_mode(struct wpa_driver_nl80211_data *drv,
5458                             int ifindex, enum nl80211_iftype mode)
5459 {
5460         struct nl_msg *msg;
5461         int ret = -ENOBUFS;
5462
5463         wpa_printf(MSG_DEBUG, "nl80211: Set mode ifindex %d iftype %d (%s)",
5464                    ifindex, mode, nl80211_iftype_str(mode));
5465
5466         msg = nl80211_cmd_msg(drv->first_bss, 0, NL80211_CMD_SET_INTERFACE);
5467         if (!msg || nla_put_u32(msg, NL80211_ATTR_IFTYPE, mode))
5468                 goto fail;
5469
5470         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5471         msg = NULL;
5472         if (!ret)
5473                 return 0;
5474 fail:
5475         nlmsg_free(msg);
5476         wpa_printf(MSG_DEBUG, "nl80211: Failed to set interface %d to mode %d:"
5477                    " %d (%s)", ifindex, mode, ret, strerror(-ret));
5478         return ret;
5479 }
5480
5481
5482 static int wpa_driver_nl80211_set_mode_impl(
5483                 struct i802_bss *bss,
5484                 enum nl80211_iftype nlmode,
5485                 struct hostapd_freq_params *desired_freq_params)
5486 {
5487         struct wpa_driver_nl80211_data *drv = bss->drv;
5488         int ret = -1;
5489         int i;
5490         int was_ap = is_ap_interface(drv->nlmode);
5491         int res;
5492         int mode_switch_res;
5493
5494         mode_switch_res = nl80211_set_mode(drv, drv->ifindex, nlmode);
5495         if (mode_switch_res && nlmode == nl80211_get_ifmode(bss))
5496                 mode_switch_res = 0;
5497
5498         if (mode_switch_res == 0) {
5499                 drv->nlmode = nlmode;
5500                 ret = 0;
5501                 goto done;
5502         }
5503
5504         if (mode_switch_res == -ENODEV)
5505                 return -1;
5506
5507         if (nlmode == drv->nlmode) {
5508                 wpa_printf(MSG_DEBUG, "nl80211: Interface already in "
5509                            "requested mode - ignore error");
5510                 ret = 0;
5511                 goto done; /* Already in the requested mode */
5512         }
5513
5514         /* mac80211 doesn't allow mode changes while the device is up, so
5515          * take the device down, try to set the mode again, and bring the
5516          * device back up.
5517          */
5518         wpa_printf(MSG_DEBUG, "nl80211: Try mode change after setting "
5519                    "interface down");
5520         for (i = 0; i < 10; i++) {
5521                 res = i802_set_iface_flags(bss, 0);
5522                 if (res == -EACCES || res == -ENODEV)
5523                         break;
5524                 if (res != 0) {
5525                         wpa_printf(MSG_DEBUG, "nl80211: Failed to set "
5526                                    "interface down");
5527                         os_sleep(0, 100000);
5528                         continue;
5529                 }
5530
5531                 /*
5532                  * Setting the mode will fail for some drivers if the phy is
5533                  * on a frequency that the mode is disallowed in.
5534                  */
5535                 if (desired_freq_params) {
5536                         res = i802_set_freq(bss, desired_freq_params);
5537                         if (res) {
5538                                 wpa_printf(MSG_DEBUG,
5539                                            "nl80211: Failed to set frequency on interface");
5540                         }
5541                 }
5542
5543                 /* Try to set the mode again while the interface is down */
5544                 mode_switch_res = nl80211_set_mode(drv, drv->ifindex, nlmode);
5545                 if (mode_switch_res == -EBUSY) {
5546                         wpa_printf(MSG_DEBUG,
5547                                    "nl80211: Delaying mode set while interface going down");
5548                         os_sleep(0, 100000);
5549                         continue;
5550                 }
5551                 ret = mode_switch_res;
5552                 break;
5553         }
5554
5555         if (!ret) {
5556                 wpa_printf(MSG_DEBUG, "nl80211: Mode change succeeded while "
5557                            "interface is down");
5558                 drv->nlmode = nlmode;
5559                 drv->ignore_if_down_event = 1;
5560         }
5561
5562         /* Bring the interface back up */
5563         res = linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 1);
5564         if (res != 0) {
5565                 wpa_printf(MSG_DEBUG,
5566                            "nl80211: Failed to set interface up after switching mode");
5567                 ret = -1;
5568         }
5569
5570 done:
5571         if (ret) {
5572                 wpa_printf(MSG_DEBUG, "nl80211: Interface mode change to %d "
5573                            "from %d failed", nlmode, drv->nlmode);
5574                 return ret;
5575         }
5576
5577         if (is_p2p_net_interface(nlmode))
5578                 nl80211_disable_11b_rates(drv, drv->ifindex, 1);
5579         else if (drv->disabled_11b_rates)
5580                 nl80211_disable_11b_rates(drv, drv->ifindex, 0);
5581
5582         if (is_ap_interface(nlmode)) {
5583                 nl80211_mgmt_unsubscribe(bss, "start AP");
5584                 /* Setup additional AP mode functionality if needed */
5585                 if (nl80211_setup_ap(bss))
5586                         return -1;
5587         } else if (was_ap) {
5588                 /* Remove additional AP mode functionality */
5589                 nl80211_teardown_ap(bss);
5590         } else {
5591                 nl80211_mgmt_unsubscribe(bss, "mode change");
5592         }
5593
5594         if (is_mesh_interface(nlmode) &&
5595             nl80211_mgmt_subscribe_mesh(bss))
5596                 return -1;
5597
5598         if (!bss->in_deinit && !is_ap_interface(nlmode) &&
5599             !is_mesh_interface(nlmode) &&
5600             nl80211_mgmt_subscribe_non_ap(bss) < 0)
5601                 wpa_printf(MSG_DEBUG, "nl80211: Failed to register Action "
5602                            "frame processing - ignore for now");
5603
5604         return 0;
5605 }
5606
5607
5608 int wpa_driver_nl80211_set_mode(struct i802_bss *bss,
5609                                 enum nl80211_iftype nlmode)
5610 {
5611         return wpa_driver_nl80211_set_mode_impl(bss, nlmode, NULL);
5612 }
5613
5614
5615 static int wpa_driver_nl80211_set_mode_ibss(struct i802_bss *bss,
5616                                             struct hostapd_freq_params *freq)
5617 {
5618         return wpa_driver_nl80211_set_mode_impl(bss, NL80211_IFTYPE_ADHOC,
5619                                                 freq);
5620 }
5621
5622
5623 static int wpa_driver_nl80211_get_capa(void *priv,
5624                                        struct wpa_driver_capa *capa)
5625 {
5626         struct i802_bss *bss = priv;
5627         struct wpa_driver_nl80211_data *drv = bss->drv;
5628
5629         if (!drv->has_capability)
5630                 return -1;
5631         os_memcpy(capa, &drv->capa, sizeof(*capa));
5632         if (drv->extended_capa && drv->extended_capa_mask) {
5633                 capa->extended_capa = drv->extended_capa;
5634                 capa->extended_capa_mask = drv->extended_capa_mask;
5635                 capa->extended_capa_len = drv->extended_capa_len;
5636         }
5637
5638         return 0;
5639 }
5640
5641
5642 static int wpa_driver_nl80211_set_operstate(void *priv, int state)
5643 {
5644         struct i802_bss *bss = priv;
5645         struct wpa_driver_nl80211_data *drv = bss->drv;
5646
5647         wpa_printf(MSG_DEBUG, "nl80211: Set %s operstate %d->%d (%s)",
5648                    bss->ifname, drv->operstate, state,
5649                    state ? "UP" : "DORMANT");
5650         drv->operstate = state;
5651         return netlink_send_oper_ifla(drv->global->netlink, drv->ifindex, -1,
5652                                       state ? IF_OPER_UP : IF_OPER_DORMANT);
5653 }
5654
5655
5656 static int wpa_driver_nl80211_set_supp_port(void *priv, int authorized)
5657 {
5658         struct i802_bss *bss = priv;
5659         struct wpa_driver_nl80211_data *drv = bss->drv;
5660         struct nl_msg *msg;
5661         struct nl80211_sta_flag_update upd;
5662         int ret;
5663
5664         if (!drv->associated && is_zero_ether_addr(drv->bssid) && !authorized) {
5665                 wpa_printf(MSG_DEBUG, "nl80211: Skip set_supp_port(unauthorized) while not associated");
5666                 return 0;
5667         }
5668
5669         wpa_printf(MSG_DEBUG, "nl80211: Set supplicant port %sauthorized for "
5670                    MACSTR, authorized ? "" : "un", MAC2STR(drv->bssid));
5671
5672         msg = nlmsg_alloc();
5673         if (!msg)
5674                 return -ENOMEM;
5675
5676         os_memset(&upd, 0, sizeof(upd));
5677         upd.mask = BIT(NL80211_STA_FLAG_AUTHORIZED);
5678         if (authorized)
5679                 upd.set = BIT(NL80211_STA_FLAG_AUTHORIZED);
5680
5681         if (!nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_STATION) ||
5682             nla_put_u32(msg, NL80211_ATTR_IFINDEX,
5683                         if_nametoindex(bss->ifname)) ||
5684             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, drv->bssid) ||
5685             nla_put(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd)) {
5686                 nlmsg_free(msg);
5687                 return -ENOBUFS;
5688         }
5689
5690         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5691         if (!ret)
5692                 return 0;
5693         wpa_printf(MSG_DEBUG, "nl80211: Failed to set STA flag: %d (%s)",
5694                    ret, strerror(-ret));
5695         return ret;
5696 }
5697
5698
5699 /* Set kernel driver on given frequency (MHz) */
5700 static int i802_set_freq(void *priv, struct hostapd_freq_params *freq)
5701 {
5702         struct i802_bss *bss = priv;
5703         return nl80211_set_channel(bss, freq, 0);
5704 }
5705
5706
5707 static inline int min_int(int a, int b)
5708 {
5709         if (a < b)
5710                 return a;
5711         return b;
5712 }
5713
5714
5715 static int get_key_handler(struct nl_msg *msg, void *arg)
5716 {
5717         struct nlattr *tb[NL80211_ATTR_MAX + 1];
5718         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
5719
5720         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
5721                   genlmsg_attrlen(gnlh, 0), NULL);
5722
5723         /*
5724          * TODO: validate the key index and mac address!
5725          * Otherwise, there's a race condition as soon as
5726          * the kernel starts sending key notifications.
5727          */
5728
5729         if (tb[NL80211_ATTR_KEY_SEQ])
5730                 memcpy(arg, nla_data(tb[NL80211_ATTR_KEY_SEQ]),
5731                        min_int(nla_len(tb[NL80211_ATTR_KEY_SEQ]), 6));
5732         return NL_SKIP;
5733 }
5734
5735
5736 static int i802_get_seqnum(const char *iface, void *priv, const u8 *addr,
5737                            int idx, u8 *seq)
5738 {
5739         struct i802_bss *bss = priv;
5740         struct wpa_driver_nl80211_data *drv = bss->drv;
5741         struct nl_msg *msg;
5742
5743         msg = nlmsg_alloc();
5744         if (!msg)
5745                 return -ENOMEM;
5746
5747         if (!nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_KEY) ||
5748             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
5749             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, idx) ||
5750             nla_put_u32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(iface))) {
5751                 nlmsg_free(msg);
5752                 return -ENOBUFS;
5753         }
5754
5755         memset(seq, 0, 6);
5756
5757         return send_and_recv_msgs(drv, msg, get_key_handler, seq);
5758 }
5759
5760
5761 static int i802_set_rts(void *priv, int rts)
5762 {
5763         struct i802_bss *bss = priv;
5764         struct wpa_driver_nl80211_data *drv = bss->drv;
5765         struct nl_msg *msg;
5766         int ret;
5767         u32 val;
5768
5769         if (rts >= 2347)
5770                 val = (u32) -1;
5771         else
5772                 val = rts;
5773
5774         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_SET_WIPHY)) ||
5775             nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD, val)) {
5776                 nlmsg_free(msg);
5777                 return -ENOBUFS;
5778         }
5779
5780         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5781         if (!ret)
5782                 return 0;
5783         wpa_printf(MSG_DEBUG, "nl80211: Failed to set RTS threshold %d: "
5784                    "%d (%s)", rts, ret, strerror(-ret));
5785         return ret;
5786 }
5787
5788
5789 static int i802_set_frag(void *priv, int frag)
5790 {
5791         struct i802_bss *bss = priv;
5792         struct wpa_driver_nl80211_data *drv = bss->drv;
5793         struct nl_msg *msg;
5794         int ret;
5795         u32 val;
5796
5797         if (frag >= 2346)
5798                 val = (u32) -1;
5799         else
5800                 val = frag;
5801
5802         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_SET_WIPHY)) ||
5803             nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD, val)) {
5804                 nlmsg_free(msg);
5805                 return -ENOBUFS;
5806         }
5807
5808         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5809         if (!ret)
5810                 return 0;
5811         wpa_printf(MSG_DEBUG, "nl80211: Failed to set fragmentation threshold "
5812                    "%d: %d (%s)", frag, ret, strerror(-ret));
5813         return ret;
5814 }
5815
5816
5817 static int i802_flush(void *priv)
5818 {
5819         struct i802_bss *bss = priv;
5820         struct wpa_driver_nl80211_data *drv = bss->drv;
5821         struct nl_msg *msg;
5822         int res;
5823
5824         msg = nlmsg_alloc();
5825         if (!msg)
5826                 return -1;
5827
5828         wpa_printf(MSG_DEBUG, "nl80211: flush -> DEL_STATION %s (all)",
5829                    bss->ifname);
5830         nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_STATION);
5831
5832         /*
5833          * XXX: FIX! this needs to flush all VLANs too
5834          */
5835         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX,
5836                         if_nametoindex(bss->ifname))) {
5837                 nlmsg_free(msg);
5838                 return -ENOBUFS;
5839         }
5840
5841         res = send_and_recv_msgs(drv, msg, NULL, NULL);
5842         if (res) {
5843                 wpa_printf(MSG_DEBUG, "nl80211: Station flush failed: ret=%d "
5844                            "(%s)", res, strerror(-res));
5845         }
5846         return res;
5847 }
5848
5849
5850 static int get_sta_handler(struct nl_msg *msg, void *arg)
5851 {
5852         struct nlattr *tb[NL80211_ATTR_MAX + 1];
5853         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
5854         struct hostap_sta_driver_data *data = arg;
5855         struct nlattr *stats[NL80211_STA_INFO_MAX + 1];
5856         static struct nla_policy stats_policy[NL80211_STA_INFO_MAX + 1] = {
5857                 [NL80211_STA_INFO_INACTIVE_TIME] = { .type = NLA_U32 },
5858                 [NL80211_STA_INFO_RX_BYTES] = { .type = NLA_U32 },
5859                 [NL80211_STA_INFO_TX_BYTES] = { .type = NLA_U32 },
5860                 [NL80211_STA_INFO_RX_PACKETS] = { .type = NLA_U32 },
5861                 [NL80211_STA_INFO_TX_PACKETS] = { .type = NLA_U32 },
5862                 [NL80211_STA_INFO_TX_FAILED] = { .type = NLA_U32 },
5863         };
5864
5865         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
5866                   genlmsg_attrlen(gnlh, 0), NULL);
5867
5868         /*
5869          * TODO: validate the interface and mac address!
5870          * Otherwise, there's a race condition as soon as
5871          * the kernel starts sending station notifications.
5872          */
5873
5874         if (!tb[NL80211_ATTR_STA_INFO]) {
5875                 wpa_printf(MSG_DEBUG, "sta stats missing!");
5876                 return NL_SKIP;
5877         }
5878         if (nla_parse_nested(stats, NL80211_STA_INFO_MAX,
5879                              tb[NL80211_ATTR_STA_INFO],
5880                              stats_policy)) {
5881                 wpa_printf(MSG_DEBUG, "failed to parse nested attributes!");
5882                 return NL_SKIP;
5883         }
5884
5885         if (stats[NL80211_STA_INFO_INACTIVE_TIME])
5886                 data->inactive_msec =
5887                         nla_get_u32(stats[NL80211_STA_INFO_INACTIVE_TIME]);
5888         if (stats[NL80211_STA_INFO_RX_BYTES])
5889                 data->rx_bytes = nla_get_u32(stats[NL80211_STA_INFO_RX_BYTES]);
5890         if (stats[NL80211_STA_INFO_TX_BYTES])
5891                 data->tx_bytes = nla_get_u32(stats[NL80211_STA_INFO_TX_BYTES]);
5892         if (stats[NL80211_STA_INFO_RX_PACKETS])
5893                 data->rx_packets =
5894                         nla_get_u32(stats[NL80211_STA_INFO_RX_PACKETS]);
5895         if (stats[NL80211_STA_INFO_TX_PACKETS])
5896                 data->tx_packets =
5897                         nla_get_u32(stats[NL80211_STA_INFO_TX_PACKETS]);
5898         if (stats[NL80211_STA_INFO_TX_FAILED])
5899                 data->tx_retry_failed =
5900                         nla_get_u32(stats[NL80211_STA_INFO_TX_FAILED]);
5901
5902         return NL_SKIP;
5903 }
5904
5905 static int i802_read_sta_data(struct i802_bss *bss,
5906                               struct hostap_sta_driver_data *data,
5907                               const u8 *addr)
5908 {
5909         struct wpa_driver_nl80211_data *drv = bss->drv;
5910         struct nl_msg *msg;
5911
5912         os_memset(data, 0, sizeof(*data));
5913         msg = nlmsg_alloc();
5914         if (!msg)
5915                 return -ENOMEM;
5916
5917         if (!nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_STATION) ||
5918             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
5919             nla_put_u32(msg, NL80211_ATTR_IFINDEX,
5920                         if_nametoindex(bss->ifname))) {
5921                 nlmsg_free(msg);
5922                 return -ENOBUFS;
5923         }
5924
5925         return send_and_recv_msgs(drv, msg, get_sta_handler, data);
5926 }
5927
5928
5929 static int i802_set_tx_queue_params(void *priv, int queue, int aifs,
5930                                     int cw_min, int cw_max, int burst_time)
5931 {
5932         struct i802_bss *bss = priv;
5933         struct wpa_driver_nl80211_data *drv = bss->drv;
5934         struct nl_msg *msg;
5935         struct nlattr *txq, *params;
5936
5937         msg = nlmsg_alloc();
5938         if (!msg)
5939                 return -1;
5940
5941         if (!nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_WIPHY) ||
5942             nla_put_u32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname)))
5943                 goto fail;
5944
5945         txq = nla_nest_start(msg, NL80211_ATTR_WIPHY_TXQ_PARAMS);
5946         if (!txq)
5947                 goto fail;
5948
5949         /* We are only sending parameters for a single TXQ at a time */
5950         params = nla_nest_start(msg, 1);
5951         if (!params)
5952                 goto fail;
5953
5954         switch (queue) {
5955         case 0:
5956                 if (nla_put_u8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_VO))
5957                         goto fail;
5958                 break;
5959         case 1:
5960                 if (nla_put_u8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_VI))
5961                         goto fail;
5962                 break;
5963         case 2:
5964                 if (nla_put_u8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_BE))
5965                         goto fail;
5966                 break;
5967         case 3:
5968                 if (nla_put_u8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_BK))
5969                         goto fail;
5970                 break;
5971         }
5972         /* Burst time is configured in units of 0.1 msec and TXOP parameter in
5973          * 32 usec, so need to convert the value here. */
5974         if (nla_put_u16(msg, NL80211_TXQ_ATTR_TXOP,
5975                         (burst_time * 100 + 16) / 32) ||
5976             nla_put_u16(msg, NL80211_TXQ_ATTR_CWMIN, cw_min) ||
5977             nla_put_u16(msg, NL80211_TXQ_ATTR_CWMAX, cw_max) ||
5978             nla_put_u8(msg, NL80211_TXQ_ATTR_AIFS, aifs))
5979                 goto fail;
5980
5981         nla_nest_end(msg, params);
5982
5983         nla_nest_end(msg, txq);
5984
5985         if (send_and_recv_msgs(drv, msg, NULL, NULL) == 0)
5986                 return 0;
5987         msg = NULL;
5988 fail:
5989         nlmsg_free(msg);
5990         return -1;
5991 }
5992
5993
5994 static int i802_set_sta_vlan(struct i802_bss *bss, const u8 *addr,
5995                              const char *ifname, int vlan_id)
5996 {
5997         struct wpa_driver_nl80211_data *drv = bss->drv;
5998         struct nl_msg *msg;
5999         int ret;
6000
6001         msg = nlmsg_alloc();
6002         if (!msg)
6003                 return -ENOMEM;
6004
6005         wpa_printf(MSG_DEBUG, "nl80211: %s[%d]: set_sta_vlan(" MACSTR
6006                    ", ifname=%s[%d], vlan_id=%d)",
6007                    bss->ifname, if_nametoindex(bss->ifname),
6008                    MAC2STR(addr), ifname, if_nametoindex(ifname), vlan_id);
6009         if (!nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_STATION) ||
6010             nla_put_u32(msg, NL80211_ATTR_IFINDEX,
6011                         if_nametoindex(bss->ifname)) ||
6012             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
6013             nla_put_u32(msg, NL80211_ATTR_STA_VLAN, if_nametoindex(ifname))) {
6014                 nlmsg_free(msg);
6015                 return -ENOBUFS;
6016         }
6017
6018         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
6019         if (ret < 0) {
6020                 wpa_printf(MSG_ERROR, "nl80211: NL80211_ATTR_STA_VLAN (addr="
6021                            MACSTR " ifname=%s vlan_id=%d) failed: %d (%s)",
6022                            MAC2STR(addr), ifname, vlan_id, ret,
6023                            strerror(-ret));
6024         }
6025         return ret;
6026 }
6027
6028
6029 static int i802_get_inact_sec(void *priv, const u8 *addr)
6030 {
6031         struct hostap_sta_driver_data data;
6032         int ret;
6033
6034         data.inactive_msec = (unsigned long) -1;
6035         ret = i802_read_sta_data(priv, &data, addr);
6036         if (ret || data.inactive_msec == (unsigned long) -1)
6037                 return -1;
6038         return data.inactive_msec / 1000;
6039 }
6040
6041
6042 static int i802_sta_clear_stats(void *priv, const u8 *addr)
6043 {
6044 #if 0
6045         /* TODO */
6046 #endif
6047         return 0;
6048 }
6049
6050
6051 static int i802_sta_deauth(void *priv, const u8 *own_addr, const u8 *addr,
6052                            int reason)
6053 {
6054         struct i802_bss *bss = priv;
6055         struct wpa_driver_nl80211_data *drv = bss->drv;
6056         struct ieee80211_mgmt mgmt;
6057
6058         if (is_mesh_interface(drv->nlmode))
6059                 return -1;
6060
6061         if (drv->device_ap_sme)
6062                 return wpa_driver_nl80211_sta_remove(bss, addr, 1, reason);
6063
6064         memset(&mgmt, 0, sizeof(mgmt));
6065         mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
6066                                           WLAN_FC_STYPE_DEAUTH);
6067         memcpy(mgmt.da, addr, ETH_ALEN);
6068         memcpy(mgmt.sa, own_addr, ETH_ALEN);
6069         memcpy(mgmt.bssid, own_addr, ETH_ALEN);
6070         mgmt.u.deauth.reason_code = host_to_le16(reason);
6071         return wpa_driver_nl80211_send_mlme(bss, (u8 *) &mgmt,
6072                                             IEEE80211_HDRLEN +
6073                                             sizeof(mgmt.u.deauth), 0, 0, 0, 0,
6074                                             0);
6075 }
6076
6077
6078 static int i802_sta_disassoc(void *priv, const u8 *own_addr, const u8 *addr,
6079                              int reason)
6080 {
6081         struct i802_bss *bss = priv;
6082         struct wpa_driver_nl80211_data *drv = bss->drv;
6083         struct ieee80211_mgmt mgmt;
6084
6085         if (is_mesh_interface(drv->nlmode))
6086                 return -1;
6087
6088         if (drv->device_ap_sme)
6089                 return wpa_driver_nl80211_sta_remove(bss, addr, 0, reason);
6090
6091         memset(&mgmt, 0, sizeof(mgmt));
6092         mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
6093                                           WLAN_FC_STYPE_DISASSOC);
6094         memcpy(mgmt.da, addr, ETH_ALEN);
6095         memcpy(mgmt.sa, own_addr, ETH_ALEN);
6096         memcpy(mgmt.bssid, own_addr, ETH_ALEN);
6097         mgmt.u.disassoc.reason_code = host_to_le16(reason);
6098         return wpa_driver_nl80211_send_mlme(bss, (u8 *) &mgmt,
6099                                             IEEE80211_HDRLEN +
6100                                             sizeof(mgmt.u.disassoc), 0, 0, 0, 0,
6101                                             0);
6102 }
6103
6104
6105 static void dump_ifidx(struct wpa_driver_nl80211_data *drv)
6106 {
6107         char buf[200], *pos, *end;
6108         int i, res;
6109
6110         pos = buf;
6111         end = pos + sizeof(buf);
6112
6113         for (i = 0; i < drv->num_if_indices; i++) {
6114                 if (!drv->if_indices[i])
6115                         continue;
6116                 res = os_snprintf(pos, end - pos, " %d", drv->if_indices[i]);
6117                 if (res < 0 || res >= end - pos)
6118                         break;
6119                 pos += res;
6120         }
6121         *pos = '\0';
6122
6123         wpa_printf(MSG_DEBUG, "nl80211: if_indices[%d]:%s",
6124                    drv->num_if_indices, buf);
6125 }
6126
6127
6128 static void add_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
6129 {
6130         int i;
6131         int *old;
6132
6133         wpa_printf(MSG_DEBUG, "nl80211: Add own interface ifindex %d",
6134                    ifidx);
6135         if (have_ifidx(drv, ifidx)) {
6136                 wpa_printf(MSG_DEBUG, "nl80211: ifindex %d already in the list",
6137                            ifidx);
6138                 return;
6139         }
6140         for (i = 0; i < drv->num_if_indices; i++) {
6141                 if (drv->if_indices[i] == 0) {
6142                         drv->if_indices[i] = ifidx;
6143                         dump_ifidx(drv);
6144                         return;
6145                 }
6146         }
6147
6148         if (drv->if_indices != drv->default_if_indices)
6149                 old = drv->if_indices;
6150         else
6151                 old = NULL;
6152
6153         drv->if_indices = os_realloc_array(old, drv->num_if_indices + 1,
6154                                            sizeof(int));
6155         if (!drv->if_indices) {
6156                 if (!old)
6157                         drv->if_indices = drv->default_if_indices;
6158                 else
6159                         drv->if_indices = old;
6160                 wpa_printf(MSG_ERROR, "Failed to reallocate memory for "
6161                            "interfaces");
6162                 wpa_printf(MSG_ERROR, "Ignoring EAPOL on interface %d", ifidx);
6163                 return;
6164         } else if (!old)
6165                 os_memcpy(drv->if_indices, drv->default_if_indices,
6166                           sizeof(drv->default_if_indices));
6167         drv->if_indices[drv->num_if_indices] = ifidx;
6168         drv->num_if_indices++;
6169         dump_ifidx(drv);
6170 }
6171
6172
6173 static void del_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
6174 {
6175         int i;
6176
6177         for (i = 0; i < drv->num_if_indices; i++) {
6178                 if (drv->if_indices[i] == ifidx) {
6179                         drv->if_indices[i] = 0;
6180                         break;
6181                 }
6182         }
6183         dump_ifidx(drv);
6184 }
6185
6186
6187 static int have_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
6188 {
6189         int i;
6190
6191         for (i = 0; i < drv->num_if_indices; i++)
6192                 if (drv->if_indices[i] == ifidx)
6193                         return 1;
6194
6195         return 0;
6196 }
6197
6198
6199 static int i802_set_wds_sta(void *priv, const u8 *addr, int aid, int val,
6200                             const char *bridge_ifname, char *ifname_wds)
6201 {
6202         struct i802_bss *bss = priv;
6203         struct wpa_driver_nl80211_data *drv = bss->drv;
6204         char name[IFNAMSIZ + 1];
6205
6206         os_snprintf(name, sizeof(name), "%s.sta%d", bss->ifname, aid);
6207         if (ifname_wds)
6208                 os_strlcpy(ifname_wds, name, IFNAMSIZ + 1);
6209
6210         wpa_printf(MSG_DEBUG, "nl80211: Set WDS STA addr=" MACSTR
6211                    " aid=%d val=%d name=%s", MAC2STR(addr), aid, val, name);
6212         if (val) {
6213                 if (!if_nametoindex(name)) {
6214                         if (nl80211_create_iface(drv, name,
6215                                                  NL80211_IFTYPE_AP_VLAN,
6216                                                  bss->addr, 1, NULL, NULL, 0) <
6217                             0)
6218                                 return -1;
6219                         if (bridge_ifname &&
6220                             linux_br_add_if(drv->global->ioctl_sock,
6221                                             bridge_ifname, name) < 0)
6222                                 return -1;
6223                 }
6224                 if (linux_set_iface_flags(drv->global->ioctl_sock, name, 1)) {
6225                         wpa_printf(MSG_ERROR, "nl80211: Failed to set WDS STA "
6226                                    "interface %s up", name);
6227                 }
6228                 return i802_set_sta_vlan(priv, addr, name, 0);
6229         } else {
6230                 if (bridge_ifname)
6231                         linux_br_del_if(drv->global->ioctl_sock, bridge_ifname,
6232                                         name);
6233
6234                 i802_set_sta_vlan(priv, addr, bss->ifname, 0);
6235                 nl80211_remove_iface(drv, if_nametoindex(name));
6236                 return 0;
6237         }
6238 }
6239
6240
6241 static void handle_eapol(int sock, void *eloop_ctx, void *sock_ctx)
6242 {
6243         struct wpa_driver_nl80211_data *drv = eloop_ctx;
6244         struct sockaddr_ll lladdr;
6245         unsigned char buf[3000];
6246         int len;
6247         socklen_t fromlen = sizeof(lladdr);
6248
6249         len = recvfrom(sock, buf, sizeof(buf), 0,
6250                        (struct sockaddr *)&lladdr, &fromlen);
6251         if (len < 0) {
6252                 wpa_printf(MSG_ERROR, "nl80211: EAPOL recv failed: %s",
6253                            strerror(errno));
6254                 return;
6255         }
6256
6257         if (have_ifidx(drv, lladdr.sll_ifindex))
6258                 drv_event_eapol_rx(drv->ctx, lladdr.sll_addr, buf, len);
6259 }
6260
6261
6262 static int i802_check_bridge(struct wpa_driver_nl80211_data *drv,
6263                              struct i802_bss *bss,
6264                              const char *brname, const char *ifname)
6265 {
6266         int br_ifindex;
6267         char in_br[IFNAMSIZ];
6268
6269         os_strlcpy(bss->brname, brname, IFNAMSIZ);
6270         br_ifindex = if_nametoindex(brname);
6271         if (br_ifindex == 0) {
6272                 /*
6273                  * Bridge was configured, but the bridge device does
6274                  * not exist. Try to add it now.
6275                  */
6276                 if (linux_br_add(drv->global->ioctl_sock, brname) < 0) {
6277                         wpa_printf(MSG_ERROR, "nl80211: Failed to add the "
6278                                    "bridge interface %s: %s",
6279                                    brname, strerror(errno));
6280                         return -1;
6281                 }
6282                 bss->added_bridge = 1;
6283                 br_ifindex = if_nametoindex(brname);
6284                 add_ifidx(drv, br_ifindex);
6285         }
6286         bss->br_ifindex = br_ifindex;
6287
6288         if (linux_br_get(in_br, ifname) == 0) {
6289                 if (os_strcmp(in_br, brname) == 0)
6290                         return 0; /* already in the bridge */
6291
6292                 wpa_printf(MSG_DEBUG, "nl80211: Removing interface %s from "
6293                            "bridge %s", ifname, in_br);
6294                 if (linux_br_del_if(drv->global->ioctl_sock, in_br, ifname) <
6295                     0) {
6296                         wpa_printf(MSG_ERROR, "nl80211: Failed to "
6297                                    "remove interface %s from bridge "
6298                                    "%s: %s",
6299                                    ifname, brname, strerror(errno));
6300                         return -1;
6301                 }
6302         }
6303
6304         wpa_printf(MSG_DEBUG, "nl80211: Adding interface %s into bridge %s",
6305                    ifname, brname);
6306         if (linux_br_add_if(drv->global->ioctl_sock, brname, ifname) < 0) {
6307                 wpa_printf(MSG_ERROR, "nl80211: Failed to add interface %s "
6308                            "into bridge %s: %s",
6309                            ifname, brname, strerror(errno));
6310                 return -1;
6311         }
6312         bss->added_if_into_bridge = 1;
6313
6314         return 0;
6315 }
6316
6317
6318 static void *i802_init(struct hostapd_data *hapd,
6319                        struct wpa_init_params *params)
6320 {
6321         struct wpa_driver_nl80211_data *drv;
6322         struct i802_bss *bss;
6323         size_t i;
6324         char brname[IFNAMSIZ];
6325         int ifindex, br_ifindex;
6326         int br_added = 0;
6327
6328         bss = wpa_driver_nl80211_drv_init(hapd, params->ifname,
6329                                           params->global_priv, 1,
6330                                           params->bssid, params->driver_params);
6331         if (bss == NULL)
6332                 return NULL;
6333
6334         drv = bss->drv;
6335
6336         if (linux_br_get(brname, params->ifname) == 0) {
6337                 wpa_printf(MSG_DEBUG, "nl80211: Interface %s is in bridge %s",
6338                            params->ifname, brname);
6339                 br_ifindex = if_nametoindex(brname);
6340                 os_strlcpy(bss->brname, brname, IFNAMSIZ);
6341         } else {
6342                 brname[0] = '\0';
6343                 br_ifindex = 0;
6344         }
6345         bss->br_ifindex = br_ifindex;
6346
6347         for (i = 0; i < params->num_bridge; i++) {
6348                 if (params->bridge[i]) {
6349                         ifindex = if_nametoindex(params->bridge[i]);
6350                         if (ifindex)
6351                                 add_ifidx(drv, ifindex);
6352                         if (ifindex == br_ifindex)
6353                                 br_added = 1;
6354                 }
6355         }
6356         if (!br_added && br_ifindex &&
6357             (params->num_bridge == 0 || !params->bridge[0]))
6358                 add_ifidx(drv, br_ifindex);
6359
6360         /* start listening for EAPOL on the default AP interface */
6361         add_ifidx(drv, drv->ifindex);
6362
6363         if (params->num_bridge && params->bridge[0] &&
6364             i802_check_bridge(drv, bss, params->bridge[0], params->ifname) < 0)
6365                 goto failed;
6366
6367 #ifdef CONFIG_LIBNL3_ROUTE
6368         if (bss->added_if_into_bridge) {
6369                 drv->rtnl_sk = nl_socket_alloc();
6370                 if (drv->rtnl_sk == NULL) {
6371                         wpa_printf(MSG_ERROR, "nl80211: Failed to allocate nl_sock");
6372                         goto failed;
6373                 }
6374
6375                 if (nl_connect(drv->rtnl_sk, NETLINK_ROUTE)) {
6376                         wpa_printf(MSG_ERROR, "nl80211: Failed to connect nl_sock to NETLINK_ROUTE: %s",
6377                                    strerror(errno));
6378                         goto failed;
6379                 }
6380         }
6381 #endif /* CONFIG_LIBNL3_ROUTE */
6382
6383         drv->eapol_sock = socket(PF_PACKET, SOCK_DGRAM, htons(ETH_P_PAE));
6384         if (drv->eapol_sock < 0) {
6385                 wpa_printf(MSG_ERROR, "nl80211: socket(PF_PACKET, SOCK_DGRAM, ETH_P_PAE) failed: %s",
6386                            strerror(errno));
6387                 goto failed;
6388         }
6389
6390         if (eloop_register_read_sock(drv->eapol_sock, handle_eapol, drv, NULL))
6391         {
6392                 wpa_printf(MSG_INFO, "nl80211: Could not register read socket for eapol");
6393                 goto failed;
6394         }
6395
6396         if (linux_get_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
6397                                params->own_addr))
6398                 goto failed;
6399         os_memcpy(drv->perm_addr, params->own_addr, ETH_ALEN);
6400
6401         memcpy(bss->addr, params->own_addr, ETH_ALEN);
6402
6403         return bss;
6404
6405 failed:
6406         wpa_driver_nl80211_deinit(bss);
6407         return NULL;
6408 }
6409
6410
6411 static void i802_deinit(void *priv)
6412 {
6413         struct i802_bss *bss = priv;
6414         wpa_driver_nl80211_deinit(bss);
6415 }
6416
6417
6418 static enum nl80211_iftype wpa_driver_nl80211_if_type(
6419         enum wpa_driver_if_type type)
6420 {
6421         switch (type) {
6422         case WPA_IF_STATION:
6423                 return NL80211_IFTYPE_STATION;
6424         case WPA_IF_P2P_CLIENT:
6425         case WPA_IF_P2P_GROUP:
6426                 return NL80211_IFTYPE_P2P_CLIENT;
6427         case WPA_IF_AP_VLAN:
6428                 return NL80211_IFTYPE_AP_VLAN;
6429         case WPA_IF_AP_BSS:
6430                 return NL80211_IFTYPE_AP;
6431         case WPA_IF_P2P_GO:
6432                 return NL80211_IFTYPE_P2P_GO;
6433         case WPA_IF_P2P_DEVICE:
6434                 return NL80211_IFTYPE_P2P_DEVICE;
6435         }
6436         return -1;
6437 }
6438
6439
6440 #ifdef CONFIG_P2P
6441
6442 static int nl80211_addr_in_use(struct nl80211_global *global, const u8 *addr)
6443 {
6444         struct wpa_driver_nl80211_data *drv;
6445         dl_list_for_each(drv, &global->interfaces,
6446                          struct wpa_driver_nl80211_data, list) {
6447                 if (os_memcmp(addr, drv->first_bss->addr, ETH_ALEN) == 0)
6448                         return 1;
6449         }
6450         return 0;
6451 }
6452
6453
6454 static int nl80211_p2p_interface_addr(struct wpa_driver_nl80211_data *drv,
6455                                       u8 *new_addr)
6456 {
6457         unsigned int idx;
6458
6459         if (!drv->global)
6460                 return -1;
6461
6462         os_memcpy(new_addr, drv->first_bss->addr, ETH_ALEN);
6463         for (idx = 0; idx < 64; idx++) {
6464                 new_addr[0] = drv->first_bss->addr[0] | 0x02;
6465                 new_addr[0] ^= idx << 2;
6466                 if (!nl80211_addr_in_use(drv->global, new_addr))
6467                         break;
6468         }
6469         if (idx == 64)
6470                 return -1;
6471
6472         wpa_printf(MSG_DEBUG, "nl80211: Assigned new P2P Interface Address "
6473                    MACSTR, MAC2STR(new_addr));
6474
6475         return 0;
6476 }
6477
6478 #endif /* CONFIG_P2P */
6479
6480
6481 struct wdev_info {
6482         u64 wdev_id;
6483         int wdev_id_set;
6484         u8 macaddr[ETH_ALEN];
6485 };
6486
6487 static int nl80211_wdev_handler(struct nl_msg *msg, void *arg)
6488 {
6489         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
6490         struct nlattr *tb[NL80211_ATTR_MAX + 1];
6491         struct wdev_info *wi = arg;
6492
6493         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
6494                   genlmsg_attrlen(gnlh, 0), NULL);
6495         if (tb[NL80211_ATTR_WDEV]) {
6496                 wi->wdev_id = nla_get_u64(tb[NL80211_ATTR_WDEV]);
6497                 wi->wdev_id_set = 1;
6498         }
6499
6500         if (tb[NL80211_ATTR_MAC])
6501                 os_memcpy(wi->macaddr, nla_data(tb[NL80211_ATTR_MAC]),
6502                           ETH_ALEN);
6503
6504         return NL_SKIP;
6505 }
6506
6507
6508 static int wpa_driver_nl80211_if_add(void *priv, enum wpa_driver_if_type type,
6509                                      const char *ifname, const u8 *addr,
6510                                      void *bss_ctx, void **drv_priv,
6511                                      char *force_ifname, u8 *if_addr,
6512                                      const char *bridge, int use_existing)
6513 {
6514         enum nl80211_iftype nlmode;
6515         struct i802_bss *bss = priv;
6516         struct wpa_driver_nl80211_data *drv = bss->drv;
6517         int ifidx;
6518         int added = 1;
6519
6520         if (addr)
6521                 os_memcpy(if_addr, addr, ETH_ALEN);
6522         nlmode = wpa_driver_nl80211_if_type(type);
6523         if (nlmode == NL80211_IFTYPE_P2P_DEVICE) {
6524                 struct wdev_info p2pdev_info;
6525
6526                 os_memset(&p2pdev_info, 0, sizeof(p2pdev_info));
6527                 ifidx = nl80211_create_iface(drv, ifname, nlmode, addr,
6528                                              0, nl80211_wdev_handler,
6529                                              &p2pdev_info, use_existing);
6530                 if (!p2pdev_info.wdev_id_set || ifidx != 0) {
6531                         wpa_printf(MSG_ERROR, "nl80211: Failed to create a P2P Device interface %s",
6532                                    ifname);
6533                         return -1;
6534                 }
6535
6536                 drv->global->if_add_wdevid = p2pdev_info.wdev_id;
6537                 drv->global->if_add_wdevid_set = p2pdev_info.wdev_id_set;
6538                 if (!is_zero_ether_addr(p2pdev_info.macaddr))
6539                         os_memcpy(if_addr, p2pdev_info.macaddr, ETH_ALEN);
6540                 wpa_printf(MSG_DEBUG, "nl80211: New P2P Device interface %s (0x%llx) created",
6541                            ifname,
6542                            (long long unsigned int) p2pdev_info.wdev_id);
6543         } else {
6544                 ifidx = nl80211_create_iface(drv, ifname, nlmode, addr,
6545                                              0, NULL, NULL, use_existing);
6546                 if (use_existing && ifidx == -ENFILE) {
6547                         added = 0;
6548                         ifidx = if_nametoindex(ifname);
6549                 } else if (ifidx < 0) {
6550                         return -1;
6551                 }
6552         }
6553
6554         if (!addr) {
6555                 if (drv->nlmode == NL80211_IFTYPE_P2P_DEVICE)
6556                         os_memcpy(if_addr, bss->addr, ETH_ALEN);
6557                 else if (linux_get_ifhwaddr(drv->global->ioctl_sock,
6558                                             bss->ifname, if_addr) < 0) {
6559                         if (added)
6560                                 nl80211_remove_iface(drv, ifidx);
6561                         return -1;
6562                 }
6563         }
6564
6565 #ifdef CONFIG_P2P
6566         if (!addr &&
6567             (type == WPA_IF_P2P_CLIENT || type == WPA_IF_P2P_GROUP ||
6568              type == WPA_IF_P2P_GO)) {
6569                 /* Enforce unique P2P Interface Address */
6570                 u8 new_addr[ETH_ALEN];
6571
6572                 if (linux_get_ifhwaddr(drv->global->ioctl_sock, ifname,
6573                                        new_addr) < 0) {
6574                         if (added)
6575                                 nl80211_remove_iface(drv, ifidx);
6576                         return -1;
6577                 }
6578                 if (nl80211_addr_in_use(drv->global, new_addr)) {
6579                         wpa_printf(MSG_DEBUG, "nl80211: Allocate new address "
6580                                    "for P2P group interface");
6581                         if (nl80211_p2p_interface_addr(drv, new_addr) < 0) {
6582                                 if (added)
6583                                         nl80211_remove_iface(drv, ifidx);
6584                                 return -1;
6585                         }
6586                         if (linux_set_ifhwaddr(drv->global->ioctl_sock, ifname,
6587                                                new_addr) < 0) {
6588                                 if (added)
6589                                         nl80211_remove_iface(drv, ifidx);
6590                                 return -1;
6591                         }
6592                 }
6593                 os_memcpy(if_addr, new_addr, ETH_ALEN);
6594         }
6595 #endif /* CONFIG_P2P */
6596
6597         if (type == WPA_IF_AP_BSS) {
6598                 struct i802_bss *new_bss = os_zalloc(sizeof(*new_bss));
6599                 if (new_bss == NULL) {
6600                         if (added)
6601                                 nl80211_remove_iface(drv, ifidx);
6602                         return -1;
6603                 }
6604
6605                 if (bridge &&
6606                     i802_check_bridge(drv, new_bss, bridge, ifname) < 0) {
6607                         wpa_printf(MSG_ERROR, "nl80211: Failed to add the new "
6608                                    "interface %s to a bridge %s",
6609                                    ifname, bridge);
6610                         if (added)
6611                                 nl80211_remove_iface(drv, ifidx);
6612                         os_free(new_bss);
6613                         return -1;
6614                 }
6615
6616                 if (linux_set_iface_flags(drv->global->ioctl_sock, ifname, 1))
6617                 {
6618                         if (added)
6619                                 nl80211_remove_iface(drv, ifidx);
6620                         os_free(new_bss);
6621                         return -1;
6622                 }
6623                 os_strlcpy(new_bss->ifname, ifname, IFNAMSIZ);
6624                 os_memcpy(new_bss->addr, if_addr, ETH_ALEN);
6625                 new_bss->ifindex = ifidx;
6626                 new_bss->drv = drv;
6627                 new_bss->next = drv->first_bss->next;
6628                 new_bss->freq = drv->first_bss->freq;
6629                 new_bss->ctx = bss_ctx;
6630                 new_bss->added_if = added;
6631                 drv->first_bss->next = new_bss;
6632                 if (drv_priv)
6633                         *drv_priv = new_bss;
6634                 nl80211_init_bss(new_bss);
6635
6636                 /* Subscribe management frames for this WPA_IF_AP_BSS */
6637                 if (nl80211_setup_ap(new_bss))
6638                         return -1;
6639         }
6640
6641         if (drv->global)
6642                 drv->global->if_add_ifindex = ifidx;
6643
6644         /*
6645          * Some virtual interfaces need to process EAPOL packets and events on
6646          * the parent interface. This is used mainly with hostapd.
6647          */
6648         if (ifidx > 0 &&
6649             (drv->hostapd ||
6650              nlmode == NL80211_IFTYPE_AP_VLAN ||
6651              nlmode == NL80211_IFTYPE_WDS ||
6652              nlmode == NL80211_IFTYPE_MONITOR))
6653                 add_ifidx(drv, ifidx);
6654
6655         return 0;
6656 }
6657
6658
6659 static int wpa_driver_nl80211_if_remove(struct i802_bss *bss,
6660                                         enum wpa_driver_if_type type,
6661                                         const char *ifname)
6662 {
6663         struct wpa_driver_nl80211_data *drv = bss->drv;
6664         int ifindex = if_nametoindex(ifname);
6665
6666         wpa_printf(MSG_DEBUG, "nl80211: %s(type=%d ifname=%s) ifindex=%d added_if=%d",
6667                    __func__, type, ifname, ifindex, bss->added_if);
6668         if (ifindex > 0 && (bss->added_if || bss->ifindex != ifindex))
6669                 nl80211_remove_iface(drv, ifindex);
6670         else if (ifindex > 0 && !bss->added_if) {
6671                 struct wpa_driver_nl80211_data *drv2;
6672                 dl_list_for_each(drv2, &drv->global->interfaces,
6673                                  struct wpa_driver_nl80211_data, list)
6674                         del_ifidx(drv2, ifindex);
6675         }
6676
6677         if (type != WPA_IF_AP_BSS)
6678                 return 0;
6679
6680         if (bss->added_if_into_bridge) {
6681                 if (linux_br_del_if(drv->global->ioctl_sock, bss->brname,
6682                                     bss->ifname) < 0)
6683                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
6684                                    "interface %s from bridge %s: %s",
6685                                    bss->ifname, bss->brname, strerror(errno));
6686         }
6687         if (bss->added_bridge) {
6688                 if (linux_br_del(drv->global->ioctl_sock, bss->brname) < 0)
6689                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
6690                                    "bridge %s: %s",
6691                                    bss->brname, strerror(errno));
6692         }
6693
6694         if (bss != drv->first_bss) {
6695                 struct i802_bss *tbss;
6696
6697                 wpa_printf(MSG_DEBUG, "nl80211: Not the first BSS - remove it");
6698                 for (tbss = drv->first_bss; tbss; tbss = tbss->next) {
6699                         if (tbss->next == bss) {
6700                                 tbss->next = bss->next;
6701                                 /* Unsubscribe management frames */
6702                                 nl80211_teardown_ap(bss);
6703                                 nl80211_destroy_bss(bss);
6704                                 if (!bss->added_if)
6705                                         i802_set_iface_flags(bss, 0);
6706                                 os_free(bss);
6707                                 bss = NULL;
6708                                 break;
6709                         }
6710                 }
6711                 if (bss)
6712                         wpa_printf(MSG_INFO, "nl80211: %s - could not find "
6713                                    "BSS %p in the list", __func__, bss);
6714         } else {
6715                 wpa_printf(MSG_DEBUG, "nl80211: First BSS - reassign context");
6716                 nl80211_teardown_ap(bss);
6717                 if (!bss->added_if && !drv->first_bss->next)
6718                         wpa_driver_nl80211_del_beacon(drv);
6719                 nl80211_destroy_bss(bss);
6720                 if (!bss->added_if)
6721                         i802_set_iface_flags(bss, 0);
6722                 if (drv->first_bss->next) {
6723                         drv->first_bss = drv->first_bss->next;
6724                         drv->ctx = drv->first_bss->ctx;
6725                         os_free(bss);
6726                 } else {
6727                         wpa_printf(MSG_DEBUG, "nl80211: No second BSS to reassign context to");
6728                 }
6729         }
6730
6731         return 0;
6732 }
6733
6734
6735 static int cookie_handler(struct nl_msg *msg, void *arg)
6736 {
6737         struct nlattr *tb[NL80211_ATTR_MAX + 1];
6738         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
6739         u64 *cookie = arg;
6740         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
6741                   genlmsg_attrlen(gnlh, 0), NULL);
6742         if (tb[NL80211_ATTR_COOKIE])
6743                 *cookie = nla_get_u64(tb[NL80211_ATTR_COOKIE]);
6744         return NL_SKIP;
6745 }
6746
6747
6748 static int nl80211_send_frame_cmd(struct i802_bss *bss,
6749                                   unsigned int freq, unsigned int wait,
6750                                   const u8 *buf, size_t buf_len,
6751                                   u64 *cookie_out, int no_cck, int no_ack,
6752                                   int offchanok)
6753 {
6754         struct wpa_driver_nl80211_data *drv = bss->drv;
6755         struct nl_msg *msg;
6756         u64 cookie;
6757         int ret = -1;
6758
6759         wpa_printf(MSG_MSGDUMP, "nl80211: CMD_FRAME freq=%u wait=%u no_cck=%d "
6760                    "no_ack=%d offchanok=%d",
6761                    freq, wait, no_cck, no_ack, offchanok);
6762         wpa_hexdump(MSG_MSGDUMP, "CMD_FRAME", buf, buf_len);
6763
6764         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_FRAME)) ||
6765             (freq && nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
6766             (wait && nla_put_u32(msg, NL80211_ATTR_DURATION, wait)) ||
6767             (offchanok && ((drv->capa.flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX) ||
6768                            drv->test_use_roc_tx) &&
6769              nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK)) ||
6770             (no_cck && nla_put_flag(msg, NL80211_ATTR_TX_NO_CCK_RATE)) ||
6771             (no_ack && nla_put_flag(msg, NL80211_ATTR_DONT_WAIT_FOR_ACK)) ||
6772             nla_put(msg, NL80211_ATTR_FRAME, buf_len, buf))
6773                 goto fail;
6774
6775         cookie = 0;
6776         ret = send_and_recv_msgs(drv, msg, cookie_handler, &cookie);
6777         msg = NULL;
6778         if (ret) {
6779                 wpa_printf(MSG_DEBUG, "nl80211: Frame command failed: ret=%d "
6780                            "(%s) (freq=%u wait=%u)", ret, strerror(-ret),
6781                            freq, wait);
6782         } else {
6783                 wpa_printf(MSG_MSGDUMP, "nl80211: Frame TX command accepted%s; "
6784                            "cookie 0x%llx", no_ack ? " (no ACK)" : "",
6785                            (long long unsigned int) cookie);
6786
6787                 if (cookie_out)
6788                         *cookie_out = no_ack ? (u64) -1 : cookie;
6789         }
6790
6791 fail:
6792         nlmsg_free(msg);
6793         return ret;
6794 }
6795
6796
6797 static int wpa_driver_nl80211_send_action(struct i802_bss *bss,
6798                                           unsigned int freq,
6799                                           unsigned int wait_time,
6800                                           const u8 *dst, const u8 *src,
6801                                           const u8 *bssid,
6802                                           const u8 *data, size_t data_len,
6803                                           int no_cck)
6804 {
6805         struct wpa_driver_nl80211_data *drv = bss->drv;
6806         int ret = -1;
6807         u8 *buf;
6808         struct ieee80211_hdr *hdr;
6809
6810         wpa_printf(MSG_DEBUG, "nl80211: Send Action frame (ifindex=%d, "
6811                    "freq=%u MHz wait=%d ms no_cck=%d)",
6812                    drv->ifindex, freq, wait_time, no_cck);
6813
6814         buf = os_zalloc(24 + data_len);
6815         if (buf == NULL)
6816                 return ret;
6817         os_memcpy(buf + 24, data, data_len);
6818         hdr = (struct ieee80211_hdr *) buf;
6819         hdr->frame_control =
6820                 IEEE80211_FC(WLAN_FC_TYPE_MGMT, WLAN_FC_STYPE_ACTION);
6821         os_memcpy(hdr->addr1, dst, ETH_ALEN);
6822         os_memcpy(hdr->addr2, src, ETH_ALEN);
6823         os_memcpy(hdr->addr3, bssid, ETH_ALEN);
6824
6825         if (is_ap_interface(drv->nlmode) &&
6826             (!(drv->capa.flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX) ||
6827              (int) freq == bss->freq || drv->device_ap_sme ||
6828              !drv->use_monitor))
6829                 ret = wpa_driver_nl80211_send_mlme(bss, buf, 24 + data_len,
6830                                                    0, freq, no_cck, 1,
6831                                                    wait_time);
6832         else
6833                 ret = nl80211_send_frame_cmd(bss, freq, wait_time, buf,
6834                                              24 + data_len,
6835                                              &drv->send_action_cookie,
6836                                              no_cck, 0, 1);
6837
6838         os_free(buf);
6839         return ret;
6840 }
6841
6842
6843 static void wpa_driver_nl80211_send_action_cancel_wait(void *priv)
6844 {
6845         struct i802_bss *bss = priv;
6846         struct wpa_driver_nl80211_data *drv = bss->drv;
6847         struct nl_msg *msg;
6848         int ret;
6849
6850         wpa_printf(MSG_DEBUG, "nl80211: Cancel TX frame wait: cookie=0x%llx",
6851                    (long long unsigned int) drv->send_action_cookie);
6852         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_FRAME_WAIT_CANCEL)) ||
6853             nla_put_u64(msg, NL80211_ATTR_COOKIE, drv->send_action_cookie)) {
6854                 nlmsg_free(msg);
6855                 return;
6856         }
6857
6858         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
6859         if (ret)
6860                 wpa_printf(MSG_DEBUG, "nl80211: wait cancel failed: ret=%d "
6861                            "(%s)", ret, strerror(-ret));
6862 }
6863
6864
6865 static int wpa_driver_nl80211_remain_on_channel(void *priv, unsigned int freq,
6866                                                 unsigned int duration)
6867 {
6868         struct i802_bss *bss = priv;
6869         struct wpa_driver_nl80211_data *drv = bss->drv;
6870         struct nl_msg *msg;
6871         int ret;
6872         u64 cookie;
6873
6874         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_REMAIN_ON_CHANNEL)) ||
6875             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
6876             nla_put_u32(msg, NL80211_ATTR_DURATION, duration)) {
6877                 nlmsg_free(msg);
6878                 return -1;
6879         }
6880
6881         cookie = 0;
6882         ret = send_and_recv_msgs(drv, msg, cookie_handler, &cookie);
6883         if (ret == 0) {
6884                 wpa_printf(MSG_DEBUG, "nl80211: Remain-on-channel cookie "
6885                            "0x%llx for freq=%u MHz duration=%u",
6886                            (long long unsigned int) cookie, freq, duration);
6887                 drv->remain_on_chan_cookie = cookie;
6888                 drv->pending_remain_on_chan = 1;
6889                 return 0;
6890         }
6891         wpa_printf(MSG_DEBUG, "nl80211: Failed to request remain-on-channel "
6892                    "(freq=%d duration=%u): %d (%s)",
6893                    freq, duration, ret, strerror(-ret));
6894         return -1;
6895 }
6896
6897
6898 static int wpa_driver_nl80211_cancel_remain_on_channel(void *priv)
6899 {
6900         struct i802_bss *bss = priv;
6901         struct wpa_driver_nl80211_data *drv = bss->drv;
6902         struct nl_msg *msg;
6903         int ret;
6904
6905         if (!drv->pending_remain_on_chan) {
6906                 wpa_printf(MSG_DEBUG, "nl80211: No pending remain-on-channel "
6907                            "to cancel");
6908                 return -1;
6909         }
6910
6911         wpa_printf(MSG_DEBUG, "nl80211: Cancel remain-on-channel with cookie "
6912                    "0x%llx",
6913                    (long long unsigned int) drv->remain_on_chan_cookie);
6914
6915         msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL);
6916         if (!msg ||
6917             nla_put_u64(msg, NL80211_ATTR_COOKIE, drv->remain_on_chan_cookie)) {
6918                 nlmsg_free(msg);
6919                 return -1;
6920         }
6921
6922         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
6923         if (ret == 0)
6924                 return 0;
6925         wpa_printf(MSG_DEBUG, "nl80211: Failed to cancel remain-on-channel: "
6926                    "%d (%s)", ret, strerror(-ret));
6927         return -1;
6928 }
6929
6930
6931 static int wpa_driver_nl80211_probe_req_report(struct i802_bss *bss, int report)
6932 {
6933         struct wpa_driver_nl80211_data *drv = bss->drv;
6934
6935         if (!report) {
6936                 if (bss->nl_preq && drv->device_ap_sme &&
6937                     is_ap_interface(drv->nlmode) && !bss->in_deinit &&
6938                     !bss->static_ap) {
6939                         /*
6940                          * Do not disable Probe Request reporting that was
6941                          * enabled in nl80211_setup_ap().
6942                          */
6943                         wpa_printf(MSG_DEBUG, "nl80211: Skip disabling of "
6944                                    "Probe Request reporting nl_preq=%p while "
6945                                    "in AP mode", bss->nl_preq);
6946                 } else if (bss->nl_preq) {
6947                         wpa_printf(MSG_DEBUG, "nl80211: Disable Probe Request "
6948                                    "reporting nl_preq=%p", bss->nl_preq);
6949                         nl80211_destroy_eloop_handle(&bss->nl_preq);
6950                 }
6951                 return 0;
6952         }
6953
6954         if (bss->nl_preq) {
6955                 wpa_printf(MSG_DEBUG, "nl80211: Probe Request reporting "
6956                            "already on! nl_preq=%p", bss->nl_preq);
6957                 return 0;
6958         }
6959
6960         bss->nl_preq = nl_create_handle(drv->global->nl_cb, "preq");
6961         if (bss->nl_preq == NULL)
6962                 return -1;
6963         wpa_printf(MSG_DEBUG, "nl80211: Enable Probe Request "
6964                    "reporting nl_preq=%p", bss->nl_preq);
6965
6966         if (nl80211_register_frame(bss, bss->nl_preq,
6967                                    (WLAN_FC_TYPE_MGMT << 2) |
6968                                    (WLAN_FC_STYPE_PROBE_REQ << 4),
6969                                    NULL, 0) < 0)
6970                 goto out_err;
6971
6972         nl80211_register_eloop_read(&bss->nl_preq,
6973                                     wpa_driver_nl80211_event_receive,
6974                                     bss->nl_cb);
6975
6976         return 0;
6977
6978  out_err:
6979         nl_destroy_handles(&bss->nl_preq);
6980         return -1;
6981 }
6982
6983
6984 static int nl80211_disable_11b_rates(struct wpa_driver_nl80211_data *drv,
6985                                      int ifindex, int disabled)
6986 {
6987         struct nl_msg *msg;
6988         struct nlattr *bands, *band;
6989         int ret;
6990
6991         msg = nlmsg_alloc();
6992         if (!msg)
6993                 return -1;
6994
6995         if (!nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_TX_BITRATE_MASK) ||
6996             nla_put_u32(msg, NL80211_ATTR_IFINDEX, ifindex))
6997                 goto fail;
6998
6999         bands = nla_nest_start(msg, NL80211_ATTR_TX_RATES);
7000         if (!bands)
7001                 goto fail;
7002
7003         /*
7004          * Disable 2 GHz rates 1, 2, 5.5, 11 Mbps by masking out everything
7005          * else apart from 6, 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS
7006          * rates. All 5 GHz rates are left enabled.
7007          */
7008         band = nla_nest_start(msg, NL80211_BAND_2GHZ);
7009         if (!band ||
7010             (disabled && nla_put(msg, NL80211_TXRATE_LEGACY, 8,
7011                                  "\x0c\x12\x18\x24\x30\x48\x60\x6c")))
7012                 goto fail;
7013         nla_nest_end(msg, band);
7014
7015         nla_nest_end(msg, bands);
7016
7017         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7018         if (ret) {
7019                 wpa_printf(MSG_DEBUG, "nl80211: Set TX rates failed: ret=%d "
7020                            "(%s)", ret, strerror(-ret));
7021         } else
7022                 drv->disabled_11b_rates = disabled;
7023
7024         return ret;
7025
7026 fail:
7027         nlmsg_free(msg);
7028         return -1;
7029 }
7030
7031
7032 static int wpa_driver_nl80211_deinit_ap(void *priv)
7033 {
7034         struct i802_bss *bss = priv;
7035         struct wpa_driver_nl80211_data *drv = bss->drv;
7036         if (!is_ap_interface(drv->nlmode))
7037                 return -1;
7038         wpa_driver_nl80211_del_beacon(drv);
7039         bss->beacon_set = 0;
7040
7041         /*
7042          * If the P2P GO interface was dynamically added, then it is
7043          * possible that the interface change to station is not possible.
7044          */
7045         if (drv->nlmode == NL80211_IFTYPE_P2P_GO && bss->if_dynamic)
7046                 return 0;
7047
7048         return wpa_driver_nl80211_set_mode(priv, NL80211_IFTYPE_STATION);
7049 }
7050
7051
7052 static int wpa_driver_nl80211_stop_ap(void *priv)
7053 {
7054         struct i802_bss *bss = priv;
7055         struct wpa_driver_nl80211_data *drv = bss->drv;
7056         if (!is_ap_interface(drv->nlmode))
7057                 return -1;
7058         wpa_driver_nl80211_del_beacon(drv);
7059         bss->beacon_set = 0;
7060         return 0;
7061 }
7062
7063
7064 static int wpa_driver_nl80211_deinit_p2p_cli(void *priv)
7065 {
7066         struct i802_bss *bss = priv;
7067         struct wpa_driver_nl80211_data *drv = bss->drv;
7068         if (drv->nlmode != NL80211_IFTYPE_P2P_CLIENT)
7069                 return -1;
7070
7071         /*
7072          * If the P2P Client interface was dynamically added, then it is
7073          * possible that the interface change to station is not possible.
7074          */
7075         if (bss->if_dynamic)
7076                 return 0;
7077
7078         return wpa_driver_nl80211_set_mode(priv, NL80211_IFTYPE_STATION);
7079 }
7080
7081
7082 static void wpa_driver_nl80211_resume(void *priv)
7083 {
7084         struct i802_bss *bss = priv;
7085
7086         if (i802_set_iface_flags(bss, 1))
7087                 wpa_printf(MSG_DEBUG, "nl80211: Failed to set interface up on resume event");
7088 }
7089
7090
7091 static int nl80211_send_ft_action(void *priv, u8 action, const u8 *target_ap,
7092                                   const u8 *ies, size_t ies_len)
7093 {
7094         struct i802_bss *bss = priv;
7095         struct wpa_driver_nl80211_data *drv = bss->drv;
7096         int ret;
7097         u8 *data, *pos;
7098         size_t data_len;
7099         const u8 *own_addr = bss->addr;
7100
7101         if (action != 1) {
7102                 wpa_printf(MSG_ERROR, "nl80211: Unsupported send_ft_action "
7103                            "action %d", action);
7104                 return -1;
7105         }
7106
7107         /*
7108          * Action frame payload:
7109          * Category[1] = 6 (Fast BSS Transition)
7110          * Action[1] = 1 (Fast BSS Transition Request)
7111          * STA Address
7112          * Target AP Address
7113          * FT IEs
7114          */
7115
7116         data_len = 2 + 2 * ETH_ALEN + ies_len;
7117         data = os_malloc(data_len);
7118         if (data == NULL)
7119                 return -1;
7120         pos = data;
7121         *pos++ = 0x06; /* FT Action category */
7122         *pos++ = action;
7123         os_memcpy(pos, own_addr, ETH_ALEN);
7124         pos += ETH_ALEN;
7125         os_memcpy(pos, target_ap, ETH_ALEN);
7126         pos += ETH_ALEN;
7127         os_memcpy(pos, ies, ies_len);
7128
7129         ret = wpa_driver_nl80211_send_action(bss, drv->assoc_freq, 0,
7130                                              drv->bssid, own_addr, drv->bssid,
7131                                              data, data_len, 0);
7132         os_free(data);
7133
7134         return ret;
7135 }
7136
7137
7138 static int nl80211_signal_monitor(void *priv, int threshold, int hysteresis)
7139 {
7140         struct i802_bss *bss = priv;
7141         struct wpa_driver_nl80211_data *drv = bss->drv;
7142         struct nl_msg *msg;
7143         struct nlattr *cqm;
7144
7145         wpa_printf(MSG_DEBUG, "nl80211: Signal monitor threshold=%d "
7146                    "hysteresis=%d", threshold, hysteresis);
7147
7148         msg = nlmsg_alloc();
7149         if (!msg)
7150                 return -1;
7151
7152         if (!nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_CQM) ||
7153             nla_put_u32(msg, NL80211_ATTR_IFINDEX, bss->ifindex) ||
7154             !(cqm = nla_nest_start(msg, NL80211_ATTR_CQM)) ||
7155             nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THOLD, threshold) ||
7156             nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_HYST, hysteresis)) {
7157                 nlmsg_free(msg);
7158                 return -1;
7159         }
7160         nla_nest_end(msg, cqm);
7161
7162         return send_and_recv_msgs(drv, msg, NULL, NULL);
7163 }
7164
7165
7166 static int get_channel_width(struct nl_msg *msg, void *arg)
7167 {
7168         struct nlattr *tb[NL80211_ATTR_MAX + 1];
7169         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
7170         struct wpa_signal_info *sig_change = arg;
7171
7172         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
7173                   genlmsg_attrlen(gnlh, 0), NULL);
7174
7175         sig_change->center_frq1 = -1;
7176         sig_change->center_frq2 = -1;
7177         sig_change->chanwidth = CHAN_WIDTH_UNKNOWN;
7178
7179         if (tb[NL80211_ATTR_CHANNEL_WIDTH]) {
7180                 sig_change->chanwidth = convert2width(
7181                         nla_get_u32(tb[NL80211_ATTR_CHANNEL_WIDTH]));
7182                 if (tb[NL80211_ATTR_CENTER_FREQ1])
7183                         sig_change->center_frq1 =
7184                                 nla_get_u32(tb[NL80211_ATTR_CENTER_FREQ1]);
7185                 if (tb[NL80211_ATTR_CENTER_FREQ2])
7186                         sig_change->center_frq2 =
7187                                 nla_get_u32(tb[NL80211_ATTR_CENTER_FREQ2]);
7188         }
7189
7190         return NL_SKIP;
7191 }
7192
7193
7194 static int nl80211_get_channel_width(struct wpa_driver_nl80211_data *drv,
7195                                      struct wpa_signal_info *sig)
7196 {
7197         struct nl_msg *msg;
7198
7199         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_GET_INTERFACE);
7200         return send_and_recv_msgs(drv, msg, get_channel_width, sig);
7201 }
7202
7203
7204 static int nl80211_signal_poll(void *priv, struct wpa_signal_info *si)
7205 {
7206         struct i802_bss *bss = priv;
7207         struct wpa_driver_nl80211_data *drv = bss->drv;
7208         int res;
7209
7210         os_memset(si, 0, sizeof(*si));
7211         res = nl80211_get_link_signal(drv, si);
7212         if (res != 0)
7213                 return res;
7214
7215         res = nl80211_get_channel_width(drv, si);
7216         if (res != 0)
7217                 return res;
7218
7219         return nl80211_get_link_noise(drv, si);
7220 }
7221
7222
7223 static int wpa_driver_nl80211_shared_freq(void *priv)
7224 {
7225         struct i802_bss *bss = priv;
7226         struct wpa_driver_nl80211_data *drv = bss->drv;
7227         struct wpa_driver_nl80211_data *driver;
7228         int freq = 0;
7229
7230         /*
7231          * If the same PHY is in connected state with some other interface,
7232          * then retrieve the assoc freq.
7233          */
7234         wpa_printf(MSG_DEBUG, "nl80211: Get shared freq for PHY %s",
7235                    drv->phyname);
7236
7237         dl_list_for_each(driver, &drv->global->interfaces,
7238                          struct wpa_driver_nl80211_data, list) {
7239                 if (drv == driver ||
7240                     os_strcmp(drv->phyname, driver->phyname) != 0 ||
7241                     !driver->associated)
7242                         continue;
7243
7244                 wpa_printf(MSG_DEBUG, "nl80211: Found a match for PHY %s - %s "
7245                            MACSTR,
7246                            driver->phyname, driver->first_bss->ifname,
7247                            MAC2STR(driver->first_bss->addr));
7248                 if (is_ap_interface(driver->nlmode))
7249                         freq = driver->first_bss->freq;
7250                 else
7251                         freq = nl80211_get_assoc_freq(driver);
7252                 wpa_printf(MSG_DEBUG, "nl80211: Shared freq for PHY %s: %d",
7253                            drv->phyname, freq);
7254         }
7255
7256         if (!freq)
7257                 wpa_printf(MSG_DEBUG, "nl80211: No shared interface for "
7258                            "PHY (%s) in associated state", drv->phyname);
7259
7260         return freq;
7261 }
7262
7263
7264 static int nl80211_send_frame(void *priv, const u8 *data, size_t data_len,
7265                               int encrypt)
7266 {
7267         struct i802_bss *bss = priv;
7268         return wpa_driver_nl80211_send_frame(bss, data, data_len, encrypt, 0,
7269                                              0, 0, 0, 0);
7270 }
7271
7272
7273 static int nl80211_set_param(void *priv, const char *param)
7274 {
7275         wpa_printf(MSG_DEBUG, "nl80211: driver param='%s'", param);
7276         if (param == NULL)
7277                 return 0;
7278
7279 #ifdef CONFIG_P2P
7280         if (os_strstr(param, "use_p2p_group_interface=1")) {
7281                 struct i802_bss *bss = priv;
7282                 struct wpa_driver_nl80211_data *drv = bss->drv;
7283
7284                 wpa_printf(MSG_DEBUG, "nl80211: Use separate P2P group "
7285                            "interface");
7286                 drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_CONCURRENT;
7287                 drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_MGMT_AND_NON_P2P;
7288         }
7289 #endif /* CONFIG_P2P */
7290
7291         if (os_strstr(param, "use_monitor=1")) {
7292                 struct i802_bss *bss = priv;
7293                 struct wpa_driver_nl80211_data *drv = bss->drv;
7294                 drv->use_monitor = 1;
7295         }
7296
7297         if (os_strstr(param, "force_connect_cmd=1")) {
7298                 struct i802_bss *bss = priv;
7299                 struct wpa_driver_nl80211_data *drv = bss->drv;
7300                 drv->capa.flags &= ~WPA_DRIVER_FLAGS_SME;
7301                 drv->force_connect_cmd = 1;
7302         }
7303
7304         if (os_strstr(param, "no_offchannel_tx=1")) {
7305                 struct i802_bss *bss = priv;
7306                 struct wpa_driver_nl80211_data *drv = bss->drv;
7307                 drv->capa.flags &= ~WPA_DRIVER_FLAGS_OFFCHANNEL_TX;
7308                 drv->test_use_roc_tx = 1;
7309         }
7310
7311         return 0;
7312 }
7313
7314
7315 static void * nl80211_global_init(void)
7316 {
7317         struct nl80211_global *global;
7318         struct netlink_config *cfg;
7319
7320         global = os_zalloc(sizeof(*global));
7321         if (global == NULL)
7322                 return NULL;
7323         global->ioctl_sock = -1;
7324         dl_list_init(&global->interfaces);
7325         global->if_add_ifindex = -1;
7326
7327         cfg = os_zalloc(sizeof(*cfg));
7328         if (cfg == NULL)
7329                 goto err;
7330
7331         cfg->ctx = global;
7332         cfg->newlink_cb = wpa_driver_nl80211_event_rtm_newlink;
7333         cfg->dellink_cb = wpa_driver_nl80211_event_rtm_dellink;
7334         global->netlink = netlink_init(cfg);
7335         if (global->netlink == NULL) {
7336                 os_free(cfg);
7337                 goto err;
7338         }
7339
7340         if (wpa_driver_nl80211_init_nl_global(global) < 0)
7341                 goto err;
7342
7343         global->ioctl_sock = socket(PF_INET, SOCK_DGRAM, 0);
7344         if (global->ioctl_sock < 0) {
7345                 wpa_printf(MSG_ERROR, "nl80211: socket(PF_INET,SOCK_DGRAM) failed: %s",
7346                            strerror(errno));
7347                 goto err;
7348         }
7349
7350         return global;
7351
7352 err:
7353         nl80211_global_deinit(global);
7354         return NULL;
7355 }
7356
7357
7358 static void nl80211_global_deinit(void *priv)
7359 {
7360         struct nl80211_global *global = priv;
7361         if (global == NULL)
7362                 return;
7363         if (!dl_list_empty(&global->interfaces)) {
7364                 wpa_printf(MSG_ERROR, "nl80211: %u interface(s) remain at "
7365                            "nl80211_global_deinit",
7366                            dl_list_len(&global->interfaces));
7367         }
7368
7369         if (global->netlink)
7370                 netlink_deinit(global->netlink);
7371
7372         nl_destroy_handles(&global->nl);
7373
7374         if (global->nl_event)
7375                 nl80211_destroy_eloop_handle(&global->nl_event);
7376
7377         nl_cb_put(global->nl_cb);
7378
7379         if (global->ioctl_sock >= 0)
7380                 close(global->ioctl_sock);
7381
7382         os_free(global);
7383 }
7384
7385
7386 static const char * nl80211_get_radio_name(void *priv)
7387 {
7388         struct i802_bss *bss = priv;
7389         struct wpa_driver_nl80211_data *drv = bss->drv;
7390         return drv->phyname;
7391 }
7392
7393
7394 static int nl80211_pmkid(struct i802_bss *bss, int cmd, const u8 *bssid,
7395                          const u8 *pmkid)
7396 {
7397         struct nl_msg *msg;
7398
7399         msg = nlmsg_alloc();
7400         if (!msg)
7401                 return -ENOMEM;
7402
7403         if (!nl80211_cmd(bss->drv, msg, 0, cmd) ||
7404             nla_put_u32(msg, NL80211_ATTR_IFINDEX,
7405                         if_nametoindex(bss->ifname)) ||
7406             (pmkid && nla_put(msg, NL80211_ATTR_PMKID, 16, pmkid)) ||
7407             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))) {
7408                 nlmsg_free(msg);
7409                 return -ENOBUFS;
7410         }
7411
7412         return send_and_recv_msgs(bss->drv, msg, NULL, NULL);
7413 }
7414
7415
7416 static int nl80211_add_pmkid(void *priv, const u8 *bssid, const u8 *pmkid)
7417 {
7418         struct i802_bss *bss = priv;
7419         wpa_printf(MSG_DEBUG, "nl80211: Add PMKID for " MACSTR, MAC2STR(bssid));
7420         return nl80211_pmkid(bss, NL80211_CMD_SET_PMKSA, bssid, pmkid);
7421 }
7422
7423
7424 static int nl80211_remove_pmkid(void *priv, const u8 *bssid, const u8 *pmkid)
7425 {
7426         struct i802_bss *bss = priv;
7427         wpa_printf(MSG_DEBUG, "nl80211: Delete PMKID for " MACSTR,
7428                    MAC2STR(bssid));
7429         return nl80211_pmkid(bss, NL80211_CMD_DEL_PMKSA, bssid, pmkid);
7430 }
7431
7432
7433 static int nl80211_flush_pmkid(void *priv)
7434 {
7435         struct i802_bss *bss = priv;
7436         wpa_printf(MSG_DEBUG, "nl80211: Flush PMKIDs");
7437         return nl80211_pmkid(bss, NL80211_CMD_FLUSH_PMKSA, NULL, NULL);
7438 }
7439
7440
7441 static void clean_survey_results(struct survey_results *survey_results)
7442 {
7443         struct freq_survey *survey, *tmp;
7444
7445         if (dl_list_empty(&survey_results->survey_list))
7446                 return;
7447
7448         dl_list_for_each_safe(survey, tmp, &survey_results->survey_list,
7449                               struct freq_survey, list) {
7450                 dl_list_del(&survey->list);
7451                 os_free(survey);
7452         }
7453 }
7454
7455
7456 static void add_survey(struct nlattr **sinfo, u32 ifidx,
7457                        struct dl_list *survey_list)
7458 {
7459         struct freq_survey *survey;
7460
7461         survey = os_zalloc(sizeof(struct freq_survey));
7462         if  (!survey)
7463                 return;
7464
7465         survey->ifidx = ifidx;
7466         survey->freq = nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]);
7467         survey->filled = 0;
7468
7469         if (sinfo[NL80211_SURVEY_INFO_NOISE]) {
7470                 survey->nf = (int8_t)
7471                         nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
7472                 survey->filled |= SURVEY_HAS_NF;
7473         }
7474
7475         if (sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME]) {
7476                 survey->channel_time =
7477                         nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME]);
7478                 survey->filled |= SURVEY_HAS_CHAN_TIME;
7479         }
7480
7481         if (sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY]) {
7482                 survey->channel_time_busy =
7483                         nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY]);
7484                 survey->filled |= SURVEY_HAS_CHAN_TIME_BUSY;
7485         }
7486
7487         if (sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_RX]) {
7488                 survey->channel_time_rx =
7489                         nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_RX]);
7490                 survey->filled |= SURVEY_HAS_CHAN_TIME_RX;
7491         }
7492
7493         if (sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_TX]) {
7494                 survey->channel_time_tx =
7495                         nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_TX]);
7496                 survey->filled |= SURVEY_HAS_CHAN_TIME_TX;
7497         }
7498
7499         wpa_printf(MSG_DEBUG, "nl80211: Freq survey dump event (freq=%d MHz noise=%d channel_time=%ld busy_time=%ld tx_time=%ld rx_time=%ld filled=%04x)",
7500                    survey->freq,
7501                    survey->nf,
7502                    (unsigned long int) survey->channel_time,
7503                    (unsigned long int) survey->channel_time_busy,
7504                    (unsigned long int) survey->channel_time_tx,
7505                    (unsigned long int) survey->channel_time_rx,
7506                    survey->filled);
7507
7508         dl_list_add_tail(survey_list, &survey->list);
7509 }
7510
7511
7512 static int check_survey_ok(struct nlattr **sinfo, u32 surveyed_freq,
7513                            unsigned int freq_filter)
7514 {
7515         if (!freq_filter)
7516                 return 1;
7517
7518         return freq_filter == surveyed_freq;
7519 }
7520
7521
7522 static int survey_handler(struct nl_msg *msg, void *arg)
7523 {
7524         struct nlattr *tb[NL80211_ATTR_MAX + 1];
7525         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
7526         struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
7527         struct survey_results *survey_results;
7528         u32 surveyed_freq = 0;
7529         u32 ifidx;
7530
7531         static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
7532                 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
7533                 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
7534         };
7535
7536         survey_results = (struct survey_results *) arg;
7537
7538         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
7539                   genlmsg_attrlen(gnlh, 0), NULL);
7540
7541         if (!tb[NL80211_ATTR_IFINDEX])
7542                 return NL_SKIP;
7543
7544         ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
7545
7546         if (!tb[NL80211_ATTR_SURVEY_INFO])
7547                 return NL_SKIP;
7548
7549         if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
7550                              tb[NL80211_ATTR_SURVEY_INFO],
7551                              survey_policy))
7552                 return NL_SKIP;
7553
7554         if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY]) {
7555                 wpa_printf(MSG_ERROR, "nl80211: Invalid survey data");
7556                 return NL_SKIP;
7557         }
7558
7559         surveyed_freq = nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]);
7560
7561         if (!check_survey_ok(sinfo, surveyed_freq,
7562                              survey_results->freq_filter))
7563                 return NL_SKIP;
7564
7565         if (survey_results->freq_filter &&
7566             survey_results->freq_filter != surveyed_freq) {
7567                 wpa_printf(MSG_EXCESSIVE, "nl80211: Ignoring survey data for freq %d MHz",
7568                            surveyed_freq);
7569                 return NL_SKIP;
7570         }
7571
7572         add_survey(sinfo, ifidx, &survey_results->survey_list);
7573
7574         return NL_SKIP;
7575 }
7576
7577
7578 static int wpa_driver_nl80211_get_survey(void *priv, unsigned int freq)
7579 {
7580         struct i802_bss *bss = priv;
7581         struct wpa_driver_nl80211_data *drv = bss->drv;
7582         struct nl_msg *msg;
7583         int err;
7584         union wpa_event_data data;
7585         struct survey_results *survey_results;
7586
7587         os_memset(&data, 0, sizeof(data));
7588         survey_results = &data.survey_results;
7589
7590         dl_list_init(&survey_results->survey_list);
7591
7592         msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_GET_SURVEY);
7593         if (!msg)
7594                 return -ENOBUFS;
7595
7596         if (freq)
7597                 data.survey_results.freq_filter = freq;
7598
7599         do {
7600                 wpa_printf(MSG_DEBUG, "nl80211: Fetch survey data");
7601                 err = send_and_recv_msgs(drv, msg, survey_handler,
7602                                          survey_results);
7603         } while (err > 0);
7604
7605         if (err)
7606                 wpa_printf(MSG_ERROR, "nl80211: Failed to process survey data");
7607         else
7608                 wpa_supplicant_event(drv->ctx, EVENT_SURVEY, &data);
7609
7610         clean_survey_results(survey_results);
7611         return err;
7612 }
7613
7614
7615 static void nl80211_set_rekey_info(void *priv, const u8 *kek, const u8 *kck,
7616                                    const u8 *replay_ctr)
7617 {
7618         struct i802_bss *bss = priv;
7619         struct wpa_driver_nl80211_data *drv = bss->drv;
7620         struct nlattr *replay_nested;
7621         struct nl_msg *msg;
7622
7623         msg = nlmsg_alloc();
7624         if (!msg)
7625                 return;
7626
7627         if (!nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_REKEY_OFFLOAD) ||
7628             nla_put_u32(msg, NL80211_ATTR_IFINDEX, bss->ifindex) ||
7629             !(replay_nested = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA)) ||
7630             nla_put(msg, NL80211_REKEY_DATA_KEK, NL80211_KEK_LEN, kek) ||
7631             nla_put(msg, NL80211_REKEY_DATA_KCK, NL80211_KCK_LEN, kck) ||
7632             nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR, NL80211_REPLAY_CTR_LEN,
7633                     replay_ctr)) {
7634                 nlmsg_free(msg);
7635                 return;
7636         }
7637
7638         nla_nest_end(msg, replay_nested);
7639
7640         send_and_recv_msgs(drv, msg, NULL, NULL);
7641 }
7642
7643
7644 static void nl80211_send_null_frame(struct i802_bss *bss, const u8 *own_addr,
7645                                     const u8 *addr, int qos)
7646 {
7647         /* send data frame to poll STA and check whether
7648          * this frame is ACKed */
7649         struct {
7650                 struct ieee80211_hdr hdr;
7651                 u16 qos_ctl;
7652         } STRUCT_PACKED nulldata;
7653         size_t size;
7654
7655         /* Send data frame to poll STA and check whether this frame is ACKed */
7656
7657         os_memset(&nulldata, 0, sizeof(nulldata));
7658
7659         if (qos) {
7660                 nulldata.hdr.frame_control =
7661                         IEEE80211_FC(WLAN_FC_TYPE_DATA,
7662                                      WLAN_FC_STYPE_QOS_NULL);
7663                 size = sizeof(nulldata);
7664         } else {
7665                 nulldata.hdr.frame_control =
7666                         IEEE80211_FC(WLAN_FC_TYPE_DATA,
7667                                      WLAN_FC_STYPE_NULLFUNC);
7668                 size = sizeof(struct ieee80211_hdr);
7669         }
7670
7671         nulldata.hdr.frame_control |= host_to_le16(WLAN_FC_FROMDS);
7672         os_memcpy(nulldata.hdr.IEEE80211_DA_FROMDS, addr, ETH_ALEN);
7673         os_memcpy(nulldata.hdr.IEEE80211_BSSID_FROMDS, own_addr, ETH_ALEN);
7674         os_memcpy(nulldata.hdr.IEEE80211_SA_FROMDS, own_addr, ETH_ALEN);
7675
7676         if (wpa_driver_nl80211_send_mlme(bss, (u8 *) &nulldata, size, 0, 0, 0,
7677                                          0, 0) < 0)
7678                 wpa_printf(MSG_DEBUG, "nl80211_send_null_frame: Failed to "
7679                            "send poll frame");
7680 }
7681
7682 static void nl80211_poll_client(void *priv, const u8 *own_addr, const u8 *addr,
7683                                 int qos)
7684 {
7685         struct i802_bss *bss = priv;
7686         struct wpa_driver_nl80211_data *drv = bss->drv;
7687         struct nl_msg *msg;
7688
7689         if (!drv->poll_command_supported) {
7690                 nl80211_send_null_frame(bss, own_addr, addr, qos);
7691                 return;
7692         }
7693
7694         msg = nlmsg_alloc();
7695         if (!msg)
7696                 return;
7697
7698         if (!nl80211_cmd(drv, msg, 0, NL80211_CMD_PROBE_CLIENT) ||
7699             nla_put_u32(msg, NL80211_ATTR_IFINDEX, bss->ifindex) ||
7700             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) {
7701                 nlmsg_free(msg);
7702                 return;
7703         }
7704
7705         send_and_recv_msgs(drv, msg, NULL, NULL);
7706 }
7707
7708
7709 static int nl80211_set_power_save(struct i802_bss *bss, int enabled)
7710 {
7711         struct nl_msg *msg;
7712
7713         msg = nlmsg_alloc();
7714         if (!msg)
7715                 return -ENOMEM;
7716
7717         if (!nl80211_cmd(bss->drv, msg, 0, NL80211_CMD_SET_POWER_SAVE) ||
7718             nla_put_u32(msg, NL80211_ATTR_IFINDEX, bss->ifindex) ||
7719             nla_put_u32(msg, NL80211_ATTR_PS_STATE,
7720                         enabled ? NL80211_PS_ENABLED : NL80211_PS_DISABLED)) {
7721                 nlmsg_free(msg);
7722                 return -ENOBUFS;
7723         }
7724         return send_and_recv_msgs(bss->drv, msg, NULL, NULL);
7725 }
7726
7727
7728 static int nl80211_set_p2p_powersave(void *priv, int legacy_ps, int opp_ps,
7729                                      int ctwindow)
7730 {
7731         struct i802_bss *bss = priv;
7732
7733         wpa_printf(MSG_DEBUG, "nl80211: set_p2p_powersave (legacy_ps=%d "
7734                    "opp_ps=%d ctwindow=%d)", legacy_ps, opp_ps, ctwindow);
7735
7736         if (opp_ps != -1 || ctwindow != -1) {
7737 #ifdef ANDROID_P2P
7738                 wpa_driver_set_p2p_ps(priv, legacy_ps, opp_ps, ctwindow);
7739 #else /* ANDROID_P2P */
7740                 return -1; /* Not yet supported */
7741 #endif /* ANDROID_P2P */
7742         }
7743
7744         if (legacy_ps == -1)
7745                 return 0;
7746         if (legacy_ps != 0 && legacy_ps != 1)
7747                 return -1; /* Not yet supported */
7748
7749         return nl80211_set_power_save(bss, legacy_ps);
7750 }
7751
7752
7753 static int nl80211_start_radar_detection(void *priv,
7754                                          struct hostapd_freq_params *freq)
7755 {
7756         struct i802_bss *bss = priv;
7757         struct wpa_driver_nl80211_data *drv = bss->drv;
7758         struct nl_msg *msg;
7759         int ret;
7760
7761         wpa_printf(MSG_DEBUG, "nl80211: Start radar detection (CAC) %d MHz (ht_enabled=%d, vht_enabled=%d, bandwidth=%d MHz, cf1=%d MHz, cf2=%d MHz)",
7762                    freq->freq, freq->ht_enabled, freq->vht_enabled,
7763                    freq->bandwidth, freq->center_freq1, freq->center_freq2);
7764
7765         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_RADAR)) {
7766                 wpa_printf(MSG_DEBUG, "nl80211: Driver does not support radar "
7767                            "detection");
7768                 return -1;
7769         }
7770
7771         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_RADAR_DETECT)) ||
7772             nl80211_put_freq_params(msg, freq) < 0) {
7773                 nlmsg_free(msg);
7774                 return -1;
7775         }
7776
7777         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7778         if (ret == 0)
7779                 return 0;
7780         wpa_printf(MSG_DEBUG, "nl80211: Failed to start radar detection: "
7781                    "%d (%s)", ret, strerror(-ret));
7782         return -1;
7783 }
7784
7785 #ifdef CONFIG_TDLS
7786
7787 static int nl80211_send_tdls_mgmt(void *priv, const u8 *dst, u8 action_code,
7788                                   u8 dialog_token, u16 status_code,
7789                                   u32 peer_capab, int initiator, const u8 *buf,
7790                                   size_t len)
7791 {
7792         struct i802_bss *bss = priv;
7793         struct wpa_driver_nl80211_data *drv = bss->drv;
7794         struct nl_msg *msg;
7795
7796         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT))
7797                 return -EOPNOTSUPP;
7798
7799         if (!dst)
7800                 return -EINVAL;
7801
7802         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_TDLS_MGMT)) ||
7803             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
7804             nla_put_u8(msg, NL80211_ATTR_TDLS_ACTION, action_code) ||
7805             nla_put_u8(msg, NL80211_ATTR_TDLS_DIALOG_TOKEN, dialog_token) ||
7806             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status_code))
7807                 goto fail;
7808         if (peer_capab) {
7809                 /*
7810                  * The internal enum tdls_peer_capability definition is
7811                  * currently identical with the nl80211 enum
7812                  * nl80211_tdls_peer_capability, so no conversion is needed
7813                  * here.
7814                  */
7815                 if (nla_put_u32(msg, NL80211_ATTR_TDLS_PEER_CAPABILITY,
7816                                 peer_capab))
7817                         goto fail;
7818         }
7819         if ((initiator &&
7820              nla_put_flag(msg, NL80211_ATTR_TDLS_INITIATOR)) ||
7821             nla_put(msg, NL80211_ATTR_IE, len, buf))
7822                 goto fail;
7823
7824         return send_and_recv_msgs(drv, msg, NULL, NULL);
7825
7826 fail:
7827         nlmsg_free(msg);
7828         return -ENOBUFS;
7829 }
7830
7831
7832 static int nl80211_tdls_oper(void *priv, enum tdls_oper oper, const u8 *peer)
7833 {
7834         struct i802_bss *bss = priv;
7835         struct wpa_driver_nl80211_data *drv = bss->drv;
7836         struct nl_msg *msg;
7837         enum nl80211_tdls_operation nl80211_oper;
7838
7839         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT))
7840                 return -EOPNOTSUPP;
7841
7842         switch (oper) {
7843         case TDLS_DISCOVERY_REQ:
7844                 nl80211_oper = NL80211_TDLS_DISCOVERY_REQ;
7845                 break;
7846         case TDLS_SETUP:
7847                 nl80211_oper = NL80211_TDLS_SETUP;
7848                 break;
7849         case TDLS_TEARDOWN:
7850                 nl80211_oper = NL80211_TDLS_TEARDOWN;
7851                 break;
7852         case TDLS_ENABLE_LINK:
7853                 nl80211_oper = NL80211_TDLS_ENABLE_LINK;
7854                 break;
7855         case TDLS_DISABLE_LINK:
7856                 nl80211_oper = NL80211_TDLS_DISABLE_LINK;
7857                 break;
7858         case TDLS_ENABLE:
7859                 return 0;
7860         case TDLS_DISABLE:
7861                 return 0;
7862         default:
7863                 return -EINVAL;
7864         }
7865
7866         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_TDLS_OPER)) ||
7867             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, nl80211_oper) ||
7868             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer)) {
7869                 nlmsg_free(msg);
7870                 return -ENOBUFS;
7871         }
7872
7873         return send_and_recv_msgs(drv, msg, NULL, NULL);
7874 }
7875
7876 #endif /* CONFIG TDLS */
7877
7878
7879 static int driver_nl80211_set_key(const char *ifname, void *priv,
7880                                   enum wpa_alg alg, const u8 *addr,
7881                                   int key_idx, int set_tx,
7882                                   const u8 *seq, size_t seq_len,
7883                                   const u8 *key, size_t key_len)
7884 {
7885         struct i802_bss *bss = priv;
7886         return wpa_driver_nl80211_set_key(ifname, bss, alg, addr, key_idx,
7887                                           set_tx, seq, seq_len, key, key_len);
7888 }
7889
7890
7891 static int driver_nl80211_scan2(void *priv,
7892                                 struct wpa_driver_scan_params *params)
7893 {
7894         struct i802_bss *bss = priv;
7895         return wpa_driver_nl80211_scan(bss, params);
7896 }
7897
7898
7899 static int driver_nl80211_deauthenticate(void *priv, const u8 *addr,
7900                                          int reason_code)
7901 {
7902         struct i802_bss *bss = priv;
7903         return wpa_driver_nl80211_deauthenticate(bss, addr, reason_code);
7904 }
7905
7906
7907 static int driver_nl80211_authenticate(void *priv,
7908                                        struct wpa_driver_auth_params *params)
7909 {
7910         struct i802_bss *bss = priv;
7911         return wpa_driver_nl80211_authenticate(bss, params);
7912 }
7913
7914
7915 static void driver_nl80211_deinit(void *priv)
7916 {
7917         struct i802_bss *bss = priv;
7918         wpa_driver_nl80211_deinit(bss);
7919 }
7920
7921
7922 static int driver_nl80211_if_remove(void *priv, enum wpa_driver_if_type type,
7923                                     const char *ifname)
7924 {
7925         struct i802_bss *bss = priv;
7926         return wpa_driver_nl80211_if_remove(bss, type, ifname);
7927 }
7928
7929
7930 static int driver_nl80211_send_mlme(void *priv, const u8 *data,
7931                                     size_t data_len, int noack)
7932 {
7933         struct i802_bss *bss = priv;
7934         return wpa_driver_nl80211_send_mlme(bss, data, data_len, noack,
7935                                             0, 0, 0, 0);
7936 }
7937
7938
7939 static int driver_nl80211_sta_remove(void *priv, const u8 *addr)
7940 {
7941         struct i802_bss *bss = priv;
7942         return wpa_driver_nl80211_sta_remove(bss, addr, -1, 0);
7943 }
7944
7945
7946 static int driver_nl80211_set_sta_vlan(void *priv, const u8 *addr,
7947                                        const char *ifname, int vlan_id)
7948 {
7949         struct i802_bss *bss = priv;
7950         return i802_set_sta_vlan(bss, addr, ifname, vlan_id);
7951 }
7952
7953
7954 static int driver_nl80211_read_sta_data(void *priv,
7955                                         struct hostap_sta_driver_data *data,
7956                                         const u8 *addr)
7957 {
7958         struct i802_bss *bss = priv;
7959         return i802_read_sta_data(bss, data, addr);
7960 }
7961
7962
7963 static int driver_nl80211_send_action(void *priv, unsigned int freq,
7964                                       unsigned int wait_time,
7965                                       const u8 *dst, const u8 *src,
7966                                       const u8 *bssid,
7967                                       const u8 *data, size_t data_len,
7968                                       int no_cck)
7969 {
7970         struct i802_bss *bss = priv;
7971         return wpa_driver_nl80211_send_action(bss, freq, wait_time, dst, src,
7972                                               bssid, data, data_len, no_cck);
7973 }
7974
7975
7976 static int driver_nl80211_probe_req_report(void *priv, int report)
7977 {
7978         struct i802_bss *bss = priv;
7979         return wpa_driver_nl80211_probe_req_report(bss, report);
7980 }
7981
7982
7983 static int wpa_driver_nl80211_update_ft_ies(void *priv, const u8 *md,
7984                                             const u8 *ies, size_t ies_len)
7985 {
7986         int ret;
7987         struct nl_msg *msg;
7988         struct i802_bss *bss = priv;
7989         struct wpa_driver_nl80211_data *drv = bss->drv;
7990         u16 mdid = WPA_GET_LE16(md);
7991
7992         wpa_printf(MSG_DEBUG, "nl80211: Updating FT IEs");
7993         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_UPDATE_FT_IES)) ||
7994             nla_put(msg, NL80211_ATTR_IE, ies_len, ies) ||
7995             nla_put_u16(msg, NL80211_ATTR_MDID, mdid)) {
7996                 nlmsg_free(msg);
7997                 return -ENOBUFS;
7998         }
7999
8000         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8001         if (ret) {
8002                 wpa_printf(MSG_DEBUG, "nl80211: update_ft_ies failed "
8003                            "err=%d (%s)", ret, strerror(-ret));
8004         }
8005
8006         return ret;
8007 }
8008
8009
8010 const u8 * wpa_driver_nl80211_get_macaddr(void *priv)
8011 {
8012         struct i802_bss *bss = priv;
8013         struct wpa_driver_nl80211_data *drv = bss->drv;
8014
8015         if (drv->nlmode != NL80211_IFTYPE_P2P_DEVICE)
8016                 return NULL;
8017
8018         return bss->addr;
8019 }
8020
8021
8022 static const char * scan_state_str(enum scan_states scan_state)
8023 {
8024         switch (scan_state) {
8025         case NO_SCAN:
8026                 return "NO_SCAN";
8027         case SCAN_REQUESTED:
8028                 return "SCAN_REQUESTED";
8029         case SCAN_STARTED:
8030                 return "SCAN_STARTED";
8031         case SCAN_COMPLETED:
8032                 return "SCAN_COMPLETED";
8033         case SCAN_ABORTED:
8034                 return "SCAN_ABORTED";
8035         case SCHED_SCAN_STARTED:
8036                 return "SCHED_SCAN_STARTED";
8037         case SCHED_SCAN_STOPPED:
8038                 return "SCHED_SCAN_STOPPED";
8039         case SCHED_SCAN_RESULTS:
8040                 return "SCHED_SCAN_RESULTS";
8041         }
8042
8043         return "??";
8044 }
8045
8046
8047 static int wpa_driver_nl80211_status(void *priv, char *buf, size_t buflen)
8048 {
8049         struct i802_bss *bss = priv;
8050         struct wpa_driver_nl80211_data *drv = bss->drv;
8051         int res;
8052         char *pos, *end;
8053
8054         pos = buf;
8055         end = buf + buflen;
8056
8057         res = os_snprintf(pos, end - pos,
8058                           "ifindex=%d\n"
8059                           "ifname=%s\n"
8060                           "brname=%s\n"
8061                           "addr=" MACSTR "\n"
8062                           "freq=%d\n"
8063                           "%s%s%s%s%s",
8064                           bss->ifindex,
8065                           bss->ifname,
8066                           bss->brname,
8067                           MAC2STR(bss->addr),
8068                           bss->freq,
8069                           bss->beacon_set ? "beacon_set=1\n" : "",
8070                           bss->added_if_into_bridge ?
8071                           "added_if_into_bridge=1\n" : "",
8072                           bss->added_bridge ? "added_bridge=1\n" : "",
8073                           bss->in_deinit ? "in_deinit=1\n" : "",
8074                           bss->if_dynamic ? "if_dynamic=1\n" : "");
8075         if (res < 0 || res >= end - pos)
8076                 return pos - buf;
8077         pos += res;
8078
8079         if (bss->wdev_id_set) {
8080                 res = os_snprintf(pos, end - pos, "wdev_id=%llu\n",
8081                                   (unsigned long long) bss->wdev_id);
8082                 if (res < 0 || res >= end - pos)
8083                         return pos - buf;
8084                 pos += res;
8085         }
8086
8087         res = os_snprintf(pos, end - pos,
8088                           "phyname=%s\n"
8089                           "perm_addr=" MACSTR "\n"
8090                           "drv_ifindex=%d\n"
8091                           "operstate=%d\n"
8092                           "scan_state=%s\n"
8093                           "auth_bssid=" MACSTR "\n"
8094                           "auth_attempt_bssid=" MACSTR "\n"
8095                           "bssid=" MACSTR "\n"
8096                           "prev_bssid=" MACSTR "\n"
8097                           "associated=%d\n"
8098                           "assoc_freq=%u\n"
8099                           "monitor_sock=%d\n"
8100                           "monitor_ifidx=%d\n"
8101                           "monitor_refcount=%d\n"
8102                           "last_mgmt_freq=%u\n"
8103                           "eapol_tx_sock=%d\n"
8104                           "%s%s%s%s%s%s%s%s%s%s%s%s%s",
8105                           drv->phyname,
8106                           MAC2STR(drv->perm_addr),
8107                           drv->ifindex,
8108                           drv->operstate,
8109                           scan_state_str(drv->scan_state),
8110                           MAC2STR(drv->auth_bssid),
8111                           MAC2STR(drv->auth_attempt_bssid),
8112                           MAC2STR(drv->bssid),
8113                           MAC2STR(drv->prev_bssid),
8114                           drv->associated,
8115                           drv->assoc_freq,
8116                           drv->monitor_sock,
8117                           drv->monitor_ifidx,
8118                           drv->monitor_refcount,
8119                           drv->last_mgmt_freq,
8120                           drv->eapol_tx_sock,
8121                           drv->ignore_if_down_event ?
8122                           "ignore_if_down_event=1\n" : "",
8123                           drv->scan_complete_events ?
8124                           "scan_complete_events=1\n" : "",
8125                           drv->disabled_11b_rates ?
8126                           "disabled_11b_rates=1\n" : "",
8127                           drv->pending_remain_on_chan ?
8128                           "pending_remain_on_chan=1\n" : "",
8129                           drv->in_interface_list ? "in_interface_list=1\n" : "",
8130                           drv->device_ap_sme ? "device_ap_sme=1\n" : "",
8131                           drv->poll_command_supported ?
8132                           "poll_command_supported=1\n" : "",
8133                           drv->data_tx_status ? "data_tx_status=1\n" : "",
8134                           drv->scan_for_auth ? "scan_for_auth=1\n" : "",
8135                           drv->retry_auth ? "retry_auth=1\n" : "",
8136                           drv->use_monitor ? "use_monitor=1\n" : "",
8137                           drv->ignore_next_local_disconnect ?
8138                           "ignore_next_local_disconnect=1\n" : "",
8139                           drv->ignore_next_local_deauth ?
8140                           "ignore_next_local_deauth=1\n" : "");
8141         if (res < 0 || res >= end - pos)
8142                 return pos - buf;
8143         pos += res;
8144
8145         if (drv->has_capability) {
8146                 res = os_snprintf(pos, end - pos,
8147                                   "capa.key_mgmt=0x%x\n"
8148                                   "capa.enc=0x%x\n"
8149                                   "capa.auth=0x%x\n"
8150                                   "capa.flags=0x%llx\n"
8151                                   "capa.max_scan_ssids=%d\n"
8152                                   "capa.max_sched_scan_ssids=%d\n"
8153                                   "capa.sched_scan_supported=%d\n"
8154                                   "capa.max_match_sets=%d\n"
8155                                   "capa.max_remain_on_chan=%u\n"
8156                                   "capa.max_stations=%u\n"
8157                                   "capa.probe_resp_offloads=0x%x\n"
8158                                   "capa.max_acl_mac_addrs=%u\n"
8159                                   "capa.num_multichan_concurrent=%u\n",
8160                                   drv->capa.key_mgmt,
8161                                   drv->capa.enc,
8162                                   drv->capa.auth,
8163                                   (unsigned long long) drv->capa.flags,
8164                                   drv->capa.max_scan_ssids,
8165                                   drv->capa.max_sched_scan_ssids,
8166                                   drv->capa.sched_scan_supported,
8167                                   drv->capa.max_match_sets,
8168                                   drv->capa.max_remain_on_chan,
8169                                   drv->capa.max_stations,
8170                                   drv->capa.probe_resp_offloads,
8171                                   drv->capa.max_acl_mac_addrs,
8172                                   drv->capa.num_multichan_concurrent);
8173                 if (res < 0 || res >= end - pos)
8174                         return pos - buf;
8175                 pos += res;
8176         }
8177
8178         return pos - buf;
8179 }
8180
8181
8182 static int set_beacon_data(struct nl_msg *msg, struct beacon_data *settings)
8183 {
8184         if ((settings->head &&
8185              nla_put(msg, NL80211_ATTR_BEACON_HEAD,
8186                      settings->head_len, settings->head)) ||
8187             (settings->tail &&
8188              nla_put(msg, NL80211_ATTR_BEACON_TAIL,
8189                      settings->tail_len, settings->tail)) ||
8190             (settings->beacon_ies &&
8191              nla_put(msg, NL80211_ATTR_IE,
8192                      settings->beacon_ies_len, settings->beacon_ies)) ||
8193             (settings->proberesp_ies &&
8194              nla_put(msg, NL80211_ATTR_IE_PROBE_RESP,
8195                      settings->proberesp_ies_len, settings->proberesp_ies)) ||
8196             (settings->assocresp_ies &&
8197              nla_put(msg, NL80211_ATTR_IE_ASSOC_RESP,
8198                      settings->assocresp_ies_len, settings->assocresp_ies)) ||
8199             (settings->probe_resp &&
8200              nla_put(msg, NL80211_ATTR_PROBE_RESP,
8201                      settings->probe_resp_len, settings->probe_resp)))
8202                 return -ENOBUFS;
8203
8204         return 0;
8205 }
8206
8207
8208 static int nl80211_switch_channel(void *priv, struct csa_settings *settings)
8209 {
8210         struct nl_msg *msg;
8211         struct i802_bss *bss = priv;
8212         struct wpa_driver_nl80211_data *drv = bss->drv;
8213         struct nlattr *beacon_csa;
8214         int ret = -ENOBUFS;
8215
8216         wpa_printf(MSG_DEBUG, "nl80211: Channel switch request (cs_count=%u block_tx=%u freq=%d width=%d cf1=%d cf2=%d)",
8217                    settings->cs_count, settings->block_tx,
8218                    settings->freq_params.freq, settings->freq_params.bandwidth,
8219                    settings->freq_params.center_freq1,
8220                    settings->freq_params.center_freq2);
8221
8222         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_AP_CSA)) {
8223                 wpa_printf(MSG_DEBUG, "nl80211: Driver does not support channel switch command");
8224                 return -EOPNOTSUPP;
8225         }
8226
8227         if ((drv->nlmode != NL80211_IFTYPE_AP) &&
8228             (drv->nlmode != NL80211_IFTYPE_P2P_GO))
8229                 return -EOPNOTSUPP;
8230
8231         /* check settings validity */
8232         if (!settings->beacon_csa.tail ||
8233             ((settings->beacon_csa.tail_len <=
8234               settings->counter_offset_beacon) ||
8235              (settings->beacon_csa.tail[settings->counter_offset_beacon] !=
8236               settings->cs_count)))
8237                 return -EINVAL;
8238
8239         if (settings->beacon_csa.probe_resp &&
8240             ((settings->beacon_csa.probe_resp_len <=
8241               settings->counter_offset_presp) ||
8242              (settings->beacon_csa.probe_resp[settings->counter_offset_presp] !=
8243               settings->cs_count)))
8244                 return -EINVAL;
8245
8246         msg = nlmsg_alloc();
8247         if (!msg)
8248                 return -ENOMEM;
8249
8250         if (!nl80211_cmd(drv, msg, 0, NL80211_CMD_CHANNEL_SWITCH) ||
8251             nla_put_u32(msg, NL80211_ATTR_IFINDEX, bss->ifindex) ||
8252             nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT,
8253                         settings->cs_count) ||
8254             (ret = nl80211_put_freq_params(msg, &settings->freq_params)) ||
8255             (settings->block_tx &&
8256              nla_put_flag(msg, NL80211_ATTR_CH_SWITCH_BLOCK_TX)))
8257                 goto error;
8258
8259         /* beacon_after params */
8260         ret = set_beacon_data(msg, &settings->beacon_after);
8261         if (ret)
8262                 goto error;
8263
8264         /* beacon_csa params */
8265         beacon_csa = nla_nest_start(msg, NL80211_ATTR_CSA_IES);
8266         if (!beacon_csa)
8267                 goto fail;
8268
8269         ret = set_beacon_data(msg, &settings->beacon_csa);
8270         if (ret)
8271                 goto error;
8272
8273         if (nla_put_u16(msg, NL80211_ATTR_CSA_C_OFF_BEACON,
8274                         settings->counter_offset_beacon) ||
8275             (settings->beacon_csa.probe_resp &&
8276              nla_put_u16(msg, NL80211_ATTR_CSA_C_OFF_PRESP,
8277                          settings->counter_offset_presp)))
8278                 goto fail;
8279
8280         nla_nest_end(msg, beacon_csa);
8281         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8282         if (ret) {
8283                 wpa_printf(MSG_DEBUG, "nl80211: switch_channel failed err=%d (%s)",
8284                            ret, strerror(-ret));
8285         }
8286         return ret;
8287
8288 fail:
8289         ret = -ENOBUFS;
8290 error:
8291         nlmsg_free(msg);
8292         wpa_printf(MSG_DEBUG, "nl80211: Could not build channel switch request");
8293         return ret;
8294 }
8295
8296
8297 static int nl80211_add_ts(void *priv, u8 tsid, const u8 *addr,
8298                           u8 user_priority, u16 admitted_time)
8299 {
8300         struct i802_bss *bss = priv;
8301         struct wpa_driver_nl80211_data *drv = bss->drv;
8302         struct nl_msg *msg;
8303         int ret;
8304
8305         wpa_printf(MSG_DEBUG,
8306                    "nl80211: add_ts request: tsid=%u admitted_time=%u up=%d",
8307                    tsid, admitted_time, user_priority);
8308
8309         if (!is_sta_interface(drv->nlmode))
8310                 return -ENOTSUP;
8311
8312         msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_ADD_TX_TS);
8313         if (!msg ||
8314             nla_put_u8(msg, NL80211_ATTR_TSID, tsid) ||
8315             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
8316             nla_put_u8(msg, NL80211_ATTR_USER_PRIO, user_priority) ||
8317             nla_put_u16(msg, NL80211_ATTR_ADMITTED_TIME, admitted_time)) {
8318                 nlmsg_free(msg);
8319                 return -ENOBUFS;
8320         }
8321
8322         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8323         if (ret)
8324                 wpa_printf(MSG_DEBUG, "nl80211: add_ts failed err=%d (%s)",
8325                            ret, strerror(-ret));
8326         return ret;
8327 }
8328
8329
8330 static int nl80211_del_ts(void *priv, u8 tsid, const u8 *addr)
8331 {
8332         struct i802_bss *bss = priv;
8333         struct wpa_driver_nl80211_data *drv = bss->drv;
8334         struct nl_msg *msg;
8335         int ret;
8336
8337         wpa_printf(MSG_DEBUG, "nl80211: del_ts request: tsid=%u", tsid);
8338
8339         if (!is_sta_interface(drv->nlmode))
8340                 return -ENOTSUP;
8341
8342         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_DEL_TX_TS)) ||
8343             nla_put_u8(msg, NL80211_ATTR_TSID, tsid) ||
8344             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) {
8345                 nlmsg_free(msg);
8346                 return -ENOBUFS;
8347         }
8348
8349         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8350         if (ret)
8351                 wpa_printf(MSG_DEBUG, "nl80211: del_ts failed err=%d (%s)",
8352                            ret, strerror(-ret));
8353         return ret;
8354 }
8355
8356
8357 #ifdef CONFIG_TESTING_OPTIONS
8358 static int cmd_reply_handler(struct nl_msg *msg, void *arg)
8359 {
8360         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
8361         struct wpabuf *buf = arg;
8362
8363         if (!buf)
8364                 return NL_SKIP;
8365
8366         if ((size_t) genlmsg_attrlen(gnlh, 0) > wpabuf_tailroom(buf)) {
8367                 wpa_printf(MSG_INFO, "nl80211: insufficient buffer space for reply");
8368                 return NL_SKIP;
8369         }
8370
8371         wpabuf_put_data(buf, genlmsg_attrdata(gnlh, 0),
8372                         genlmsg_attrlen(gnlh, 0));
8373
8374         return NL_SKIP;
8375 }
8376 #endif /* CONFIG_TESTING_OPTIONS */
8377
8378
8379 static int vendor_reply_handler(struct nl_msg *msg, void *arg)
8380 {
8381         struct nlattr *tb[NL80211_ATTR_MAX + 1];
8382         struct nlattr *nl_vendor_reply, *nl;
8383         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
8384         struct wpabuf *buf = arg;
8385         int rem;
8386
8387         if (!buf)
8388                 return NL_SKIP;
8389
8390         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
8391                   genlmsg_attrlen(gnlh, 0), NULL);
8392         nl_vendor_reply = tb[NL80211_ATTR_VENDOR_DATA];
8393
8394         if (!nl_vendor_reply)
8395                 return NL_SKIP;
8396
8397         if ((size_t) nla_len(nl_vendor_reply) > wpabuf_tailroom(buf)) {
8398                 wpa_printf(MSG_INFO, "nl80211: Vendor command: insufficient buffer space for reply");
8399                 return NL_SKIP;
8400         }
8401
8402         nla_for_each_nested(nl, nl_vendor_reply, rem) {
8403                 wpabuf_put_data(buf, nla_data(nl), nla_len(nl));
8404         }
8405
8406         return NL_SKIP;
8407 }
8408
8409
8410 static int nl80211_vendor_cmd(void *priv, unsigned int vendor_id,
8411                               unsigned int subcmd, const u8 *data,
8412                               size_t data_len, struct wpabuf *buf)
8413 {
8414         struct i802_bss *bss = priv;
8415         struct wpa_driver_nl80211_data *drv = bss->drv;
8416         struct nl_msg *msg;
8417         int ret;
8418
8419 #ifdef CONFIG_TESTING_OPTIONS
8420         if (vendor_id == 0xffffffff) {
8421                 msg = nlmsg_alloc();
8422                 if (!msg)
8423                         return -ENOMEM;
8424
8425                 nl80211_cmd(drv, msg, 0, subcmd);
8426                 if (nlmsg_append(msg, (void *) data, data_len, NLMSG_ALIGNTO) <
8427                     0)
8428                         goto fail;
8429                 ret = send_and_recv_msgs(drv, msg, cmd_reply_handler, buf);
8430                 if (ret)
8431                         wpa_printf(MSG_DEBUG, "nl80211: command failed err=%d",
8432                                    ret);
8433                 return ret;
8434         }
8435 #endif /* CONFIG_TESTING_OPTIONS */
8436
8437         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_VENDOR)) ||
8438             nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, vendor_id) ||
8439             nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, subcmd) ||
8440             (data &&
8441              nla_put(msg, NL80211_ATTR_VENDOR_DATA, data_len, data)))
8442                 goto fail;
8443
8444         ret = send_and_recv_msgs(drv, msg, vendor_reply_handler, buf);
8445         if (ret)
8446                 wpa_printf(MSG_DEBUG, "nl80211: vendor command failed err=%d",
8447                            ret);
8448         return ret;
8449
8450 fail:
8451         nlmsg_free(msg);
8452         return -ENOBUFS;
8453 }
8454
8455
8456 static int nl80211_set_qos_map(void *priv, const u8 *qos_map_set,
8457                                u8 qos_map_set_len)
8458 {
8459         struct i802_bss *bss = priv;
8460         struct wpa_driver_nl80211_data *drv = bss->drv;
8461         struct nl_msg *msg;
8462         int ret;
8463
8464         wpa_hexdump(MSG_DEBUG, "nl80211: Setting QoS Map",
8465                     qos_map_set, qos_map_set_len);
8466
8467         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_SET_QOS_MAP)) ||
8468             nla_put(msg, NL80211_ATTR_QOS_MAP, qos_map_set_len, qos_map_set)) {
8469                 nlmsg_free(msg);
8470                 return -ENOBUFS;
8471         }
8472
8473         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8474         if (ret)
8475                 wpa_printf(MSG_DEBUG, "nl80211: Setting QoS Map failed");
8476
8477         return ret;
8478 }
8479
8480
8481 static int nl80211_set_wowlan(void *priv,
8482                               const struct wowlan_triggers *triggers)
8483 {
8484         struct i802_bss *bss = priv;
8485         struct wpa_driver_nl80211_data *drv = bss->drv;
8486         struct nl_msg *msg;
8487         struct nlattr *wowlan_triggers;
8488         int ret;
8489
8490         wpa_printf(MSG_DEBUG, "nl80211: Setting wowlan");
8491
8492         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_SET_WOWLAN)) ||
8493             !(wowlan_triggers = nla_nest_start(msg,
8494                                                NL80211_ATTR_WOWLAN_TRIGGERS)) ||
8495             (triggers->any &&
8496              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
8497             (triggers->disconnect &&
8498              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
8499             (triggers->magic_pkt &&
8500              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
8501             (triggers->gtk_rekey_failure &&
8502              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
8503             (triggers->eap_identity_req &&
8504              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
8505             (triggers->four_way_handshake &&
8506              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
8507             (triggers->rfkill_release &&
8508              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))) {
8509                 nlmsg_free(msg);
8510                 return -ENOBUFS;
8511         }
8512
8513         nla_nest_end(msg, wowlan_triggers);
8514
8515         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8516         if (ret)
8517                 wpa_printf(MSG_DEBUG, "nl80211: Setting wowlan failed");
8518
8519         return ret;
8520 }
8521
8522
8523 static int nl80211_roaming(void *priv, int allowed, const u8 *bssid)
8524 {
8525         struct i802_bss *bss = priv;
8526         struct wpa_driver_nl80211_data *drv = bss->drv;
8527         struct nl_msg *msg;
8528         struct nlattr *params;
8529
8530         wpa_printf(MSG_DEBUG, "nl80211: Roaming policy: allowed=%d", allowed);
8531
8532         if (!drv->roaming_vendor_cmd_avail) {
8533                 wpa_printf(MSG_DEBUG,
8534                            "nl80211: Ignore roaming policy change since driver does not provide command for setting it");
8535                 return -1;
8536         }
8537
8538         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
8539             nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
8540             nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
8541                         QCA_NL80211_VENDOR_SUBCMD_ROAMING) ||
8542             !(params = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
8543             nla_put_u32(msg, QCA_WLAN_VENDOR_ATTR_ROAMING_POLICY,
8544                         allowed ? QCA_ROAMING_ALLOWED_WITHIN_ESS :
8545                         QCA_ROAMING_NOT_ALLOWED) ||
8546             (bssid &&
8547              nla_put(msg, QCA_WLAN_VENDOR_ATTR_MAC_ADDR, ETH_ALEN, bssid))) {
8548                 nlmsg_free(msg);
8549                 return -1;
8550         }
8551         nla_nest_end(msg, params);
8552
8553         return send_and_recv_msgs(drv, msg, NULL, NULL);
8554 }
8555
8556
8557 static int nl80211_set_mac_addr(void *priv, const u8 *addr)
8558 {
8559         struct i802_bss *bss = priv;
8560         struct wpa_driver_nl80211_data *drv = bss->drv;
8561         int new_addr = addr != NULL;
8562
8563         if (!addr)
8564                 addr = drv->perm_addr;
8565
8566         if (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 0) < 0)
8567                 return -1;
8568
8569         if (linux_set_ifhwaddr(drv->global->ioctl_sock, bss->ifname, addr) < 0)
8570         {
8571                 wpa_printf(MSG_DEBUG,
8572                            "nl80211: failed to set_mac_addr for %s to " MACSTR,
8573                            bss->ifname, MAC2STR(addr));
8574                 if (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname,
8575                                           1) < 0) {
8576                         wpa_printf(MSG_DEBUG,
8577                                    "nl80211: Could not restore interface UP after failed set_mac_addr");
8578                 }
8579                 return -1;
8580         }
8581
8582         wpa_printf(MSG_DEBUG, "nl80211: set_mac_addr for %s to " MACSTR,
8583                    bss->ifname, MAC2STR(addr));
8584         drv->addr_changed = new_addr;
8585         os_memcpy(bss->addr, addr, ETH_ALEN);
8586
8587         if (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 1) < 0)
8588         {
8589                 wpa_printf(MSG_DEBUG,
8590                            "nl80211: Could not restore interface UP after set_mac_addr");
8591         }
8592
8593         return 0;
8594 }
8595
8596
8597 #ifdef CONFIG_MESH
8598
8599 static int wpa_driver_nl80211_init_mesh(void *priv)
8600 {
8601         if (wpa_driver_nl80211_set_mode(priv, NL80211_IFTYPE_MESH_POINT)) {
8602                 wpa_printf(MSG_INFO,
8603                            "nl80211: Failed to set interface into mesh mode");
8604                 return -1;
8605         }
8606         return 0;
8607 }
8608
8609
8610 static int
8611 wpa_driver_nl80211_join_mesh(void *priv,
8612                              struct wpa_driver_mesh_join_params *params)
8613 {
8614         struct i802_bss *bss = priv;
8615         struct wpa_driver_nl80211_data *drv = bss->drv;
8616         struct nl_msg *msg;
8617         struct nlattr *container;
8618         int ret = 0;
8619
8620         wpa_printf(MSG_DEBUG, "nl80211: mesh join (ifindex=%d)", drv->ifindex);
8621         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_JOIN_MESH);
8622         if (!msg)
8623                 goto fail;
8624         if (params->freq) {
8625                 wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq);
8626                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq))
8627                         goto fail;
8628         }
8629
8630         if (params->ht_mode) {
8631                 unsigned int ht_value;
8632                 char *ht_mode = "";
8633
8634                 switch (params->ht_mode) {
8635                 default:
8636                 case CHAN_NO_HT:
8637                         ht_value = NL80211_CHAN_NO_HT;
8638                         ht_mode = "NOHT";
8639                         break;
8640                 case CHAN_HT20:
8641                         ht_value = NL80211_CHAN_HT20;
8642                         ht_mode = "HT20";
8643                         break;
8644                 case CHAN_HT40PLUS:
8645                         ht_value = NL80211_CHAN_HT40PLUS;
8646                         ht_mode = "HT40+";
8647                         break;
8648                 case CHAN_HT40MINUS:
8649                         ht_value = NL80211_CHAN_HT40MINUS;
8650                         ht_mode = "HT40-";
8651                         break;
8652                 }
8653                 wpa_printf(MSG_DEBUG, "  * ht_mode=%s", ht_mode);
8654                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, ht_value))
8655                         goto fail;
8656         }
8657
8658         if (params->basic_rates) {
8659                 u8 rates[NL80211_MAX_SUPP_RATES];
8660                 u8 rates_len = 0;
8661                 int i;
8662
8663                 for (i = 0; i < NL80211_MAX_SUPP_RATES; i++) {
8664                         if (params->basic_rates[i] < 0)
8665                                 break;
8666                         rates[rates_len++] = params->basic_rates[i] / 5;
8667                 }
8668
8669                 if (nla_put(msg, NL80211_ATTR_BSS_BASIC_RATES, rates_len,
8670                             rates))
8671                         goto fail;
8672         }
8673
8674         if (params->meshid) {
8675                 wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
8676                                   params->meshid, params->meshid_len);
8677                 if (nla_put(msg, NL80211_ATTR_MESH_ID, params->meshid_len,
8678                             params->meshid))
8679                         goto fail;
8680         }
8681
8682         wpa_printf(MSG_DEBUG, "  * flags=%08X", params->flags);
8683
8684         container = nla_nest_start(msg, NL80211_ATTR_MESH_SETUP);
8685         if (!container)
8686                 goto fail;
8687
8688         if (params->ies) {
8689                 wpa_hexdump(MSG_DEBUG, "  * IEs", params->ies, params->ie_len);
8690                 if (nla_put(msg, NL80211_MESH_SETUP_IE, params->ie_len,
8691                             params->ies))
8692                         goto fail;
8693         }
8694         /* WPA_DRIVER_MESH_FLAG_OPEN_AUTH is treated as default by nl80211 */
8695         if (params->flags & WPA_DRIVER_MESH_FLAG_SAE_AUTH) {
8696                 if (nla_put_u8(msg, NL80211_MESH_SETUP_AUTH_PROTOCOL, 0x1) ||
8697                     nla_put_flag(msg, NL80211_MESH_SETUP_USERSPACE_AUTH))
8698                         goto fail;
8699         }
8700         if ((params->flags & WPA_DRIVER_MESH_FLAG_AMPE) &&
8701             nla_put_flag(msg, NL80211_MESH_SETUP_USERSPACE_AMPE))
8702                 goto fail;
8703         if ((params->flags & WPA_DRIVER_MESH_FLAG_USER_MPM) &&
8704             nla_put_flag(msg, NL80211_MESH_SETUP_USERSPACE_MPM))
8705                 goto fail;
8706         nla_nest_end(msg, container);
8707
8708         container = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
8709         if (!container)
8710                 goto fail;
8711
8712         if (!(params->conf.flags & WPA_DRIVER_MESH_CONF_FLAG_AUTO_PLINKS) &&
8713             nla_put_u32(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS, 0))
8714                 goto fail;
8715         nla_nest_end(msg, container);
8716
8717         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8718         msg = NULL;
8719         if (ret) {
8720                 wpa_printf(MSG_DEBUG, "nl80211: mesh join failed: ret=%d (%s)",
8721                            ret, strerror(-ret));
8722                 goto fail;
8723         }
8724         ret = 0;
8725         bss->freq = params->freq;
8726         wpa_printf(MSG_DEBUG, "nl80211: mesh join request send successfully");
8727
8728 fail:
8729         nlmsg_free(msg);
8730         return ret;
8731 }
8732
8733
8734 static int wpa_driver_nl80211_leave_mesh(void *priv)
8735 {
8736         struct i802_bss *bss = priv;
8737         struct wpa_driver_nl80211_data *drv = bss->drv;
8738         struct nl_msg *msg;
8739         int ret;
8740
8741         wpa_printf(MSG_DEBUG, "nl80211: mesh leave (ifindex=%d)", drv->ifindex);
8742         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_LEAVE_MESH);
8743         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8744         if (ret) {
8745                 wpa_printf(MSG_DEBUG, "nl80211: mesh leave failed: ret=%d (%s)",
8746                            ret, strerror(-ret));
8747         } else {
8748                 wpa_printf(MSG_DEBUG,
8749                            "nl80211: mesh leave request send successfully");
8750         }
8751
8752         if (wpa_driver_nl80211_set_mode(drv->first_bss,
8753                                         NL80211_IFTYPE_STATION)) {
8754                 wpa_printf(MSG_INFO,
8755                            "nl80211: Failed to set interface into station mode");
8756         }
8757         return ret;
8758 }
8759
8760 #endif /* CONFIG_MESH */
8761
8762
8763 static int wpa_driver_br_add_ip_neigh(void *priv, u8 version,
8764                                       const u8 *ipaddr, int prefixlen,
8765                                       const u8 *addr)
8766 {
8767 #ifdef CONFIG_LIBNL3_ROUTE
8768         struct i802_bss *bss = priv;
8769         struct wpa_driver_nl80211_data *drv = bss->drv;
8770         struct rtnl_neigh *rn;
8771         struct nl_addr *nl_ipaddr = NULL;
8772         struct nl_addr *nl_lladdr = NULL;
8773         int family, addrsize;
8774         int res;
8775
8776         if (!ipaddr || prefixlen == 0 || !addr)
8777                 return -EINVAL;
8778
8779         if (bss->br_ifindex == 0) {
8780                 wpa_printf(MSG_DEBUG,
8781                            "nl80211: bridge must be set before adding an ip neigh to it");
8782                 return -1;
8783         }
8784
8785         if (!drv->rtnl_sk) {
8786                 wpa_printf(MSG_DEBUG,
8787                            "nl80211: nl_sock for NETLINK_ROUTE is not initialized");
8788                 return -1;
8789         }
8790
8791         if (version == 4) {
8792                 family = AF_INET;
8793                 addrsize = 4;
8794         } else if (version == 6) {
8795                 family = AF_INET6;
8796                 addrsize = 16;
8797         } else {
8798                 return -EINVAL;
8799         }
8800
8801         rn = rtnl_neigh_alloc();
8802         if (rn == NULL)
8803                 return -ENOMEM;
8804
8805         /* set the destination ip address for neigh */
8806         nl_ipaddr = nl_addr_build(family, (void *) ipaddr, addrsize);
8807         if (nl_ipaddr == NULL) {
8808                 wpa_printf(MSG_DEBUG, "nl80211: nl_ipaddr build failed");
8809                 res = -ENOMEM;
8810                 goto errout;
8811         }
8812         nl_addr_set_prefixlen(nl_ipaddr, prefixlen);
8813         res = rtnl_neigh_set_dst(rn, nl_ipaddr);
8814         if (res) {
8815                 wpa_printf(MSG_DEBUG,
8816                            "nl80211: neigh set destination addr failed");
8817                 goto errout;
8818         }
8819
8820         /* set the corresponding lladdr for neigh */
8821         nl_lladdr = nl_addr_build(AF_BRIDGE, (u8 *) addr, ETH_ALEN);
8822         if (nl_lladdr == NULL) {
8823                 wpa_printf(MSG_DEBUG, "nl80211: neigh set lladdr failed");
8824                 res = -ENOMEM;
8825                 goto errout;
8826         }
8827         rtnl_neigh_set_lladdr(rn, nl_lladdr);
8828
8829         rtnl_neigh_set_ifindex(rn, bss->br_ifindex);
8830         rtnl_neigh_set_state(rn, NUD_PERMANENT);
8831
8832         res = rtnl_neigh_add(drv->rtnl_sk, rn, NLM_F_CREATE);
8833         if (res) {
8834                 wpa_printf(MSG_DEBUG,
8835                            "nl80211: Adding bridge ip neigh failed: %s",
8836                            strerror(errno));
8837         }
8838 errout:
8839         if (nl_lladdr)
8840                 nl_addr_put(nl_lladdr);
8841         if (nl_ipaddr)
8842                 nl_addr_put(nl_ipaddr);
8843         if (rn)
8844                 rtnl_neigh_put(rn);
8845         return res;
8846 #else /* CONFIG_LIBNL3_ROUTE */
8847         return -1;
8848 #endif /* CONFIG_LIBNL3_ROUTE */
8849 }
8850
8851
8852 static int wpa_driver_br_delete_ip_neigh(void *priv, u8 version,
8853                                          const u8 *ipaddr)
8854 {
8855 #ifdef CONFIG_LIBNL3_ROUTE
8856         struct i802_bss *bss = priv;
8857         struct wpa_driver_nl80211_data *drv = bss->drv;
8858         struct rtnl_neigh *rn;
8859         struct nl_addr *nl_ipaddr;
8860         int family, addrsize;
8861         int res;
8862
8863         if (!ipaddr)
8864                 return -EINVAL;
8865
8866         if (version == 4) {
8867                 family = AF_INET;
8868                 addrsize = 4;
8869         } else if (version == 6) {
8870                 family = AF_INET6;
8871                 addrsize = 16;
8872         } else {
8873                 return -EINVAL;
8874         }
8875
8876         if (bss->br_ifindex == 0) {
8877                 wpa_printf(MSG_DEBUG,
8878                            "nl80211: bridge must be set to delete an ip neigh");
8879                 return -1;
8880         }
8881
8882         if (!drv->rtnl_sk) {
8883                 wpa_printf(MSG_DEBUG,
8884                            "nl80211: nl_sock for NETLINK_ROUTE is not initialized");
8885                 return -1;
8886         }
8887
8888         rn = rtnl_neigh_alloc();
8889         if (rn == NULL)
8890                 return -ENOMEM;
8891
8892         /* set the destination ip address for neigh */
8893         nl_ipaddr = nl_addr_build(family, (void *) ipaddr, addrsize);
8894         if (nl_ipaddr == NULL) {
8895                 wpa_printf(MSG_DEBUG, "nl80211: nl_ipaddr build failed");
8896                 res = -ENOMEM;
8897                 goto errout;
8898         }
8899         res = rtnl_neigh_set_dst(rn, nl_ipaddr);
8900         if (res) {
8901                 wpa_printf(MSG_DEBUG,
8902                            "nl80211: neigh set destination addr failed");
8903                 goto errout;
8904         }
8905
8906         rtnl_neigh_set_ifindex(rn, bss->br_ifindex);
8907
8908         res = rtnl_neigh_delete(drv->rtnl_sk, rn, 0);
8909         if (res) {
8910                 wpa_printf(MSG_DEBUG,
8911                            "nl80211: Deleting bridge ip neigh failed: %s",
8912                            strerror(errno));
8913         }
8914 errout:
8915         if (nl_ipaddr)
8916                 nl_addr_put(nl_ipaddr);
8917         if (rn)
8918                 rtnl_neigh_put(rn);
8919         return res;
8920 #else /* CONFIG_LIBNL3_ROUTE */
8921         return -1;
8922 #endif /* CONFIG_LIBNL3_ROUTE */
8923 }
8924
8925
8926 static int linux_write_system_file(const char *path, unsigned int val)
8927 {
8928         char buf[50];
8929         int fd, len;
8930
8931         len = os_snprintf(buf, sizeof(buf), "%u\n", val);
8932         if (len < 0)
8933                 return -1;
8934
8935         fd = open(path, O_WRONLY);
8936         if (fd < 0)
8937                 return -1;
8938
8939         if (write(fd, buf, len) < 0) {
8940                 wpa_printf(MSG_DEBUG,
8941                            "nl80211: Failed to write Linux system file: %s with the value of %d",
8942                            path, val);
8943                 close(fd);
8944                 return -1;
8945         }
8946         close(fd);
8947
8948         return 0;
8949 }
8950
8951
8952 static const char * drv_br_port_attr_str(enum drv_br_port_attr attr)
8953 {
8954         switch (attr) {
8955         case DRV_BR_PORT_ATTR_PROXYARP:
8956                 return "proxyarp";
8957         case DRV_BR_PORT_ATTR_HAIRPIN_MODE:
8958                 return "hairpin_mode";
8959         }
8960
8961         return NULL;
8962 }
8963
8964
8965 static int wpa_driver_br_port_set_attr(void *priv, enum drv_br_port_attr attr,
8966                                        unsigned int val)
8967 {
8968         struct i802_bss *bss = priv;
8969         char path[128];
8970         const char *attr_txt;
8971
8972         attr_txt = drv_br_port_attr_str(attr);
8973         if (attr_txt == NULL)
8974                 return -EINVAL;
8975
8976         os_snprintf(path, sizeof(path), "/sys/class/net/%s/brport/%s",
8977                     bss->ifname, attr_txt);
8978
8979         if (linux_write_system_file(path, val))
8980                 return -1;
8981
8982         return 0;
8983 }
8984
8985
8986 static const char * drv_br_net_param_str(enum drv_br_net_param param)
8987 {
8988         switch (param) {
8989         case DRV_BR_NET_PARAM_GARP_ACCEPT:
8990                 return "arp_accept";
8991         }
8992
8993         return NULL;
8994 }
8995
8996
8997 static int wpa_driver_br_set_net_param(void *priv, enum drv_br_net_param param,
8998                                        unsigned int val)
8999 {
9000         struct i802_bss *bss = priv;
9001         char path[128];
9002         const char *param_txt;
9003         int ip_version = 4;
9004
9005         param_txt = drv_br_net_param_str(param);
9006         if (param_txt == NULL)
9007                 return -EINVAL;
9008
9009         switch (param) {
9010                 case DRV_BR_NET_PARAM_GARP_ACCEPT:
9011                         ip_version = 4;
9012                         break;
9013                 default:
9014                         return -EINVAL;
9015         }
9016
9017         os_snprintf(path, sizeof(path), "/proc/sys/net/ipv%d/conf/%s/%s",
9018                     ip_version, bss->brname, param_txt);
9019
9020         if (linux_write_system_file(path, val))
9021                 return -1;
9022
9023         return 0;
9024 }
9025
9026
9027 static int hw_mode_to_qca_acs(enum hostapd_hw_mode hw_mode)
9028 {
9029         switch (hw_mode) {
9030         case HOSTAPD_MODE_IEEE80211B:
9031                 return QCA_ACS_MODE_IEEE80211B;
9032         case HOSTAPD_MODE_IEEE80211G:
9033                 return QCA_ACS_MODE_IEEE80211G;
9034         case HOSTAPD_MODE_IEEE80211A:
9035                 return QCA_ACS_MODE_IEEE80211A;
9036         case HOSTAPD_MODE_IEEE80211AD:
9037                 return QCA_ACS_MODE_IEEE80211AD;
9038         default:
9039                 return -1;
9040         }
9041 }
9042
9043
9044 static int wpa_driver_do_acs(void *priv, struct drv_acs_params *params)
9045 {
9046         struct i802_bss *bss = priv;
9047         struct wpa_driver_nl80211_data *drv = bss->drv;
9048         struct nl_msg *msg;
9049         struct nlattr *data;
9050         int ret;
9051         int mode;
9052
9053         mode = hw_mode_to_qca_acs(params->hw_mode);
9054         if (mode < 0)
9055                 return -1;
9056
9057         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
9058             nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
9059             nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
9060                         QCA_NL80211_VENDOR_SUBCMD_DO_ACS) ||
9061             !(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
9062             nla_put_u8(msg, QCA_WLAN_VENDOR_ATTR_ACS_HW_MODE, mode) ||
9063             (params->ht_enabled &&
9064              nla_put_flag(msg, QCA_WLAN_VENDOR_ATTR_ACS_HT_ENABLED)) ||
9065             (params->ht40_enabled &&
9066              nla_put_flag(msg, QCA_WLAN_VENDOR_ATTR_ACS_HT40_ENABLED))) {
9067                 nlmsg_free(msg);
9068                 return -ENOBUFS;
9069         }
9070         nla_nest_end(msg, data);
9071
9072         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
9073         if (ret) {
9074                 wpa_printf(MSG_DEBUG,
9075                            "nl80211: Failed to invoke driver ACS function: %s",
9076                            strerror(errno));
9077         }
9078         return ret;
9079 }
9080
9081
9082 const struct wpa_driver_ops wpa_driver_nl80211_ops = {
9083         .name = "nl80211",
9084         .desc = "Linux nl80211/cfg80211",
9085         .get_bssid = wpa_driver_nl80211_get_bssid,
9086         .get_ssid = wpa_driver_nl80211_get_ssid,
9087         .set_key = driver_nl80211_set_key,
9088         .scan2 = driver_nl80211_scan2,
9089         .sched_scan = wpa_driver_nl80211_sched_scan,
9090         .stop_sched_scan = wpa_driver_nl80211_stop_sched_scan,
9091         .get_scan_results2 = wpa_driver_nl80211_get_scan_results,
9092         .deauthenticate = driver_nl80211_deauthenticate,
9093         .authenticate = driver_nl80211_authenticate,
9094         .associate = wpa_driver_nl80211_associate,
9095         .global_init = nl80211_global_init,
9096         .global_deinit = nl80211_global_deinit,
9097         .init2 = wpa_driver_nl80211_init,
9098         .deinit = driver_nl80211_deinit,
9099         .get_capa = wpa_driver_nl80211_get_capa,
9100         .set_operstate = wpa_driver_nl80211_set_operstate,
9101         .set_supp_port = wpa_driver_nl80211_set_supp_port,
9102         .set_country = wpa_driver_nl80211_set_country,
9103         .get_country = wpa_driver_nl80211_get_country,
9104         .set_ap = wpa_driver_nl80211_set_ap,
9105         .set_acl = wpa_driver_nl80211_set_acl,
9106         .if_add = wpa_driver_nl80211_if_add,
9107         .if_remove = driver_nl80211_if_remove,
9108         .send_mlme = driver_nl80211_send_mlme,
9109         .get_hw_feature_data = nl80211_get_hw_feature_data,
9110         .sta_add = wpa_driver_nl80211_sta_add,
9111         .sta_remove = driver_nl80211_sta_remove,
9112         .hapd_send_eapol = wpa_driver_nl80211_hapd_send_eapol,
9113         .sta_set_flags = wpa_driver_nl80211_sta_set_flags,
9114         .hapd_init = i802_init,
9115         .hapd_deinit = i802_deinit,
9116         .set_wds_sta = i802_set_wds_sta,
9117         .get_seqnum = i802_get_seqnum,
9118         .flush = i802_flush,
9119         .get_inact_sec = i802_get_inact_sec,
9120         .sta_clear_stats = i802_sta_clear_stats,
9121         .set_rts = i802_set_rts,
9122         .set_frag = i802_set_frag,
9123         .set_tx_queue_params = i802_set_tx_queue_params,
9124         .set_sta_vlan = driver_nl80211_set_sta_vlan,
9125         .sta_deauth = i802_sta_deauth,
9126         .sta_disassoc = i802_sta_disassoc,
9127         .read_sta_data = driver_nl80211_read_sta_data,
9128         .set_freq = i802_set_freq,
9129         .send_action = driver_nl80211_send_action,
9130         .send_action_cancel_wait = wpa_driver_nl80211_send_action_cancel_wait,
9131         .remain_on_channel = wpa_driver_nl80211_remain_on_channel,
9132         .cancel_remain_on_channel =
9133         wpa_driver_nl80211_cancel_remain_on_channel,
9134         .probe_req_report = driver_nl80211_probe_req_report,
9135         .deinit_ap = wpa_driver_nl80211_deinit_ap,
9136         .deinit_p2p_cli = wpa_driver_nl80211_deinit_p2p_cli,
9137         .resume = wpa_driver_nl80211_resume,
9138         .send_ft_action = nl80211_send_ft_action,
9139         .signal_monitor = nl80211_signal_monitor,
9140         .signal_poll = nl80211_signal_poll,
9141         .send_frame = nl80211_send_frame,
9142         .shared_freq = wpa_driver_nl80211_shared_freq,
9143         .set_param = nl80211_set_param,
9144         .get_radio_name = nl80211_get_radio_name,
9145         .add_pmkid = nl80211_add_pmkid,
9146         .remove_pmkid = nl80211_remove_pmkid,
9147         .flush_pmkid = nl80211_flush_pmkid,
9148         .set_rekey_info = nl80211_set_rekey_info,
9149         .poll_client = nl80211_poll_client,
9150         .set_p2p_powersave = nl80211_set_p2p_powersave,
9151         .start_dfs_cac = nl80211_start_radar_detection,
9152         .stop_ap = wpa_driver_nl80211_stop_ap,
9153 #ifdef CONFIG_TDLS
9154         .send_tdls_mgmt = nl80211_send_tdls_mgmt,
9155         .tdls_oper = nl80211_tdls_oper,
9156 #endif /* CONFIG_TDLS */
9157         .update_ft_ies = wpa_driver_nl80211_update_ft_ies,
9158         .get_mac_addr = wpa_driver_nl80211_get_macaddr,
9159         .get_survey = wpa_driver_nl80211_get_survey,
9160         .status = wpa_driver_nl80211_status,
9161         .switch_channel = nl80211_switch_channel,
9162 #ifdef ANDROID_P2P
9163         .set_noa = wpa_driver_set_p2p_noa,
9164         .get_noa = wpa_driver_get_p2p_noa,
9165         .set_ap_wps_ie = wpa_driver_set_ap_wps_p2p_ie,
9166 #endif /* ANDROID_P2P */
9167 #ifdef ANDROID
9168         .driver_cmd = wpa_driver_nl80211_driver_cmd,
9169 #endif /* ANDROID */
9170         .vendor_cmd = nl80211_vendor_cmd,
9171         .set_qos_map = nl80211_set_qos_map,
9172         .set_wowlan = nl80211_set_wowlan,
9173         .roaming = nl80211_roaming,
9174         .set_mac_addr = nl80211_set_mac_addr,
9175 #ifdef CONFIG_MESH
9176         .init_mesh = wpa_driver_nl80211_init_mesh,
9177         .join_mesh = wpa_driver_nl80211_join_mesh,
9178         .leave_mesh = wpa_driver_nl80211_leave_mesh,
9179 #endif /* CONFIG_MESH */
9180         .br_add_ip_neigh = wpa_driver_br_add_ip_neigh,
9181         .br_delete_ip_neigh = wpa_driver_br_delete_ip_neigh,
9182         .br_port_set_attr = wpa_driver_br_port_set_attr,
9183         .br_set_net_param = wpa_driver_br_set_net_param,
9184         .add_tx_ts = nl80211_add_ts,
9185         .del_tx_ts = nl80211_del_ts,
9186         .do_acs = wpa_driver_do_acs,
9187 };