nl80211: Send STA flags to kernel on station addition
[mech_eap.git] / src / drivers / driver_nl80211.c
index a06fa84..1da5092 100644 (file)
 
 #include "includes.h"
 #include <sys/ioctl.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
 #include <net/if.h>
 #include <netlink/genl/genl.h>
 #include <netlink/genl/family.h>
 #include <netlink/genl/ctrl.h>
+#include <linux/rtnetlink.h>
 #include <netpacket/packet.h>
 #include <linux/filter.h>
 #include "nl80211_copy.h"
 
 #include "common.h"
 #include "eloop.h"
+#include "utils/list.h"
 #include "common/ieee802_11_defs.h"
 #include "netlink.h"
 #include "linux_ioctl.h"
 #include "radiotap.h"
 #include "radiotap_iter.h"
+#include "rfkill.h"
 #include "driver.h"
 
 #ifdef CONFIG_LIBNL20
 /* libnl 2.0 compatibility code */
 #define nl_handle nl_sock
-#define nl_handle_alloc_cb nl_socket_alloc_cb
-#define nl_handle_destroy nl_socket_free
+#define nl80211_handle_alloc nl_socket_alloc_cb
+#define nl80211_handle_destroy nl_socket_free
+#else
+/*
+ * libnl 1.1 has a bug, it tries to allocate socket numbers densely
+ * but when you free a socket again it will mess up its bitmap and
+ * and use the wrong number the next time it needs a socket ID.
+ * Therefore, we wrap the handle alloc/destroy and add our own pid
+ * accounting.
+ */
+static uint32_t port_bitmap[32] = { 0 };
+
+static struct nl_handle *nl80211_handle_alloc(void *cb)
+{
+       struct nl_handle *handle;
+       uint32_t pid = getpid() & 0x3FFFFF;
+       int i;
+
+       handle = nl_handle_alloc_cb(cb);
+
+       for (i = 0; i < 1024; i++) {
+               if (port_bitmap[i / 32] & (1 << (i % 32)))
+                       continue;
+               port_bitmap[i / 32] |= 1 << (i % 32);
+               pid += i << 22;
+               break;
+       }
+
+       nl_socket_set_local_port(handle, pid);
+
+       return handle;
+}
+
+static void nl80211_handle_destroy(struct nl_handle *handle)
+{
+       uint32_t port = nl_socket_get_local_port(handle);
+
+       port >>= 22;
+       port_bitmap[port / 32] &= ~(1 << (port % 32));
+
+       nl_handle_destroy(handle);
+}
 #endif /* CONFIG_LIBNL20 */
 
 
 #define IF_OPER_UP 6
 #endif
 
+struct nl80211_global {
+       struct dl_list interfaces;
+};
+
 struct i802_bss {
        struct wpa_driver_nl80211_data *drv;
        struct i802_bss *next;
        int ifindex;
        char ifname[IFNAMSIZ + 1];
+       char brname[IFNAMSIZ];
        unsigned int beacon_set:1;
+       unsigned int added_if_into_bridge:1;
+       unsigned int added_bridge:1;
 };
 
 struct wpa_driver_nl80211_data {
+       struct nl80211_global *global;
+       struct dl_list list;
+       u8 addr[ETH_ALEN];
+       char phyname[32];
        void *ctx;
        struct netlink_data *netlink;
        int ioctl_sock; /* socket for ioctl() use */
-       char brname[IFNAMSIZ];
        int ifindex;
        int if_removed;
+       int if_disabled;
+       struct rfkill_data *rfkill;
        struct wpa_driver_capa capa;
        int has_capability;
 
@@ -81,8 +139,10 @@ struct wpa_driver_nl80211_data {
 
        struct nl_handle *nl_handle;
        struct nl_handle *nl_handle_event;
+       struct nl_handle *nl_handle_preq;
        struct nl_cache *nl_cache;
        struct nl_cache *nl_cache_event;
+       struct nl_cache *nl_cache_preq;
        struct nl_cb *nl_cb;
        struct genl_family *nl80211;
 
@@ -97,17 +157,16 @@ struct wpa_driver_nl80211_data {
 
        int monitor_sock;
        int monitor_ifidx;
-       int probe_req_report;
+       int no_monitor_iface_capab;
        int disable_11b_rates;
 
        unsigned int pending_remain_on_chan:1;
-       unsigned int pending_send_action:1;
-       unsigned int added_bridge:1;
-       unsigned int added_if_into_bridge:1;
 
        u64 remain_on_chan_cookie;
        u64 send_action_cookie;
 
+       unsigned int last_mgmt_freq;
+
        struct wpa_driver_scan_filter *filter_ssids;
        size_t num_filter_ssids;
 
@@ -136,21 +195,40 @@ static int wpa_driver_nl80211_mlme(struct wpa_driver_nl80211_data *drv,
                                   int local_state_change);
 static void nl80211_remove_monitor_interface(
        struct wpa_driver_nl80211_data *drv);
+static int nl80211_send_frame_cmd(struct wpa_driver_nl80211_data *drv,
+                                 unsigned int freq, unsigned int wait,
+                                 const u8 *buf, size_t buf_len, u64 *cookie);
+static int wpa_driver_nl80211_probe_req_report(void *priv, int report);
 
 #ifdef HOSTAPD
 static void add_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx);
 static void del_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx);
-static int i802_set_freq(void *priv, struct hostapd_freq_params *freq);
+static int have_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx);
 static int wpa_driver_nl80211_if_remove(void *priv,
                                        enum wpa_driver_if_type type,
                                        const char *ifname);
+#else /* HOSTAPD */
+static int have_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
+{
+       return 0;
+}
 #endif /* HOSTAPD */
 
-static void wpa_driver_nl80211_probe_req_report_timeout(void *eloop_ctx,
-                                                       void *timeout_ctx);
+static int i802_set_freq(void *priv, struct hostapd_freq_params *freq);
 static int nl80211_disable_11b_rates(struct wpa_driver_nl80211_data *drv,
                                     int ifindex, int disabled);
 
+static int nl80211_leave_ibss(struct wpa_driver_nl80211_data *drv);
+
+
+struct nl80211_bss_info_arg {
+       struct wpa_driver_nl80211_data *drv;
+       struct wpa_scan_results *res;
+       unsigned int assoc_freq;
+};
+
+static int bss_info_handler(struct nl_msg *msg, void *arg);
+
 
 /* nl80211 code */
 static int ack_handler(struct nl_msg *msg, void *arg)
@@ -389,10 +467,12 @@ static void wpa_driver_nl80211_event_rtm_newlink(void *ctx,
        struct wpa_driver_nl80211_data *drv = ctx;
        int attrlen, rta_len;
        struct rtattr *attr;
+       u32 brid = 0;
 
-       if (!wpa_driver_nl80211_own_ifindex(drv, ifi->ifi_index, buf, len)) {
-               wpa_printf(MSG_DEBUG, "Ignore event for foreign ifindex %d",
-                          ifi->ifi_index);
+       if (!wpa_driver_nl80211_own_ifindex(drv, ifi->ifi_index, buf, len) &&
+           !have_ifidx(drv, ifi->ifi_index)) {
+               wpa_printf(MSG_DEBUG, "nl80211: Ignore event for foreign "
+                          "ifindex %d", ifi->ifi_index);
                return;
        }
 
@@ -403,6 +483,19 @@ static void wpa_driver_nl80211_event_rtm_newlink(void *ctx,
                   (ifi->ifi_flags & IFF_RUNNING) ? "[RUNNING]" : "",
                   (ifi->ifi_flags & IFF_LOWER_UP) ? "[LOWER_UP]" : "",
                   (ifi->ifi_flags & IFF_DORMANT) ? "[DORMANT]" : "");
+
+       if (!drv->if_disabled && !(ifi->ifi_flags & IFF_UP)) {
+               wpa_printf(MSG_DEBUG, "nl80211: Interface down");
+               drv->if_disabled = 1;
+               wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_DISABLED, NULL);
+       }
+
+       if (drv->if_disabled && (ifi->ifi_flags & IFF_UP)) {
+               wpa_printf(MSG_DEBUG, "nl80211: Interface up");
+               drv->if_disabled = 0;
+               wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_ENABLED, NULL);
+       }
+
        /*
         * Some drivers send the association event before the operup event--in
         * this case, lifting operstate in wpa_driver_nl80211_set_operstate()
@@ -424,9 +517,21 @@ static void wpa_driver_nl80211_event_rtm_newlink(void *ctx,
                                drv,
                                ((char *) attr) + rta_len,
                                attr->rta_len - rta_len, 0);
-               }
+               } else if (attr->rta_type == IFLA_MASTER)
+                       brid = nla_get_u32((struct nlattr *) attr);
                attr = RTA_NEXT(attr, attrlen);
        }
+
+#ifdef HOSTAPD
+       if (ifi->ifi_family == AF_BRIDGE && brid) {
+               /* device has been added to bridge */
+               char namebuf[IFNAMSIZ];
+               if_indextoname(brid, namebuf);
+               wpa_printf(MSG_DEBUG, "nl80211: Add ifindex %u for bridge %s",
+                          brid, namebuf);
+               add_ifidx(drv, brid);
+       }
+#endif /* HOSTAPD */
 }
 
 
@@ -437,6 +542,7 @@ static void wpa_driver_nl80211_event_rtm_dellink(void *ctx,
        struct wpa_driver_nl80211_data *drv = ctx;
        int attrlen, rta_len;
        struct rtattr *attr;
+       u32 brid = 0;
 
        attrlen = len;
        attr = (struct rtattr *) buf;
@@ -448,9 +554,21 @@ static void wpa_driver_nl80211_event_rtm_dellink(void *ctx,
                                drv,
                                ((char *) attr) + rta_len,
                                attr->rta_len - rta_len, 1);
-               }
+               } else if (attr->rta_type == IFLA_MASTER)
+                       brid = nla_get_u32((struct nlattr *) attr);
                attr = RTA_NEXT(attr, attrlen);
        }
+
+#ifdef HOSTAPD
+       if (ifi->ifi_family == AF_BRIDGE && brid) {
+               /* device has been removed from bridge */
+               char namebuf[IFNAMSIZ];
+               if_indextoname(brid, namebuf);
+               wpa_printf(MSG_DEBUG, "nl80211: Remove ifindex %u for bridge "
+                          "%s", brid, namebuf);
+               del_ifidx(drv, brid);
+       }
+#endif /* HOSTAPD */
 }
 
 
@@ -481,6 +599,38 @@ static void mlme_event_auth(struct wpa_driver_nl80211_data *drv,
 }
 
 
+static unsigned int nl80211_get_assoc_freq(struct wpa_driver_nl80211_data *drv)
+{
+       struct nl_msg *msg;
+       int ret;
+       struct nl80211_bss_info_arg arg;
+
+       os_memset(&arg, 0, sizeof(arg));
+       msg = nlmsg_alloc();
+       if (!msg)
+               goto nla_put_failure;
+
+       genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, NLM_F_DUMP,
+                   NL80211_CMD_GET_SCAN, 0);
+       NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
+
+       arg.drv = drv;
+       ret = send_and_recv_msgs(drv, msg, bss_info_handler, &arg);
+       msg = NULL;
+       if (ret == 0) {
+               wpa_printf(MSG_DEBUG, "nl80211: Operating frequency for the "
+                          "associated BSS from scan results: %u MHz",
+                          arg.assoc_freq);
+               return arg.assoc_freq ? arg.assoc_freq : drv->assoc_freq;
+       }
+       wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d "
+                  "(%s)", ret, strerror(-ret));
+nla_put_failure:
+       nlmsg_free(msg);
+       return drv->assoc_freq;
+}
+
+
 static void mlme_event_assoc(struct wpa_driver_nl80211_data *drv,
                            const u8 *frame, size_t len)
 {
@@ -498,6 +648,7 @@ static void mlme_event_assoc(struct wpa_driver_nl80211_data *drv,
        status = le_to_host16(mgmt->u.assoc_resp.status_code);
        if (status != WLAN_STATUS_SUCCESS) {
                os_memset(&event, 0, sizeof(event));
+               event.assoc_reject.bssid = mgmt->bssid;
                if (len > 24 + sizeof(mgmt->u.assoc_resp)) {
                        event.assoc_reject.resp_ies =
                                (u8 *) mgmt->u.assoc_resp.variable;
@@ -546,6 +697,8 @@ static void mlme_event_connect(struct wpa_driver_nl80211_data *drv,
        os_memset(&event, 0, sizeof(event));
        if (cmd == NL80211_CMD_CONNECT &&
            nla_get_u16(status) != WLAN_STATUS_SUCCESS) {
+               if (addr)
+                       event.assoc_reject.bssid = nla_data(addr);
                if (resp_ie) {
                        event.assoc_reject.resp_ies = nla_data(resp_ie);
                        event.assoc_reject.resp_ies_len = nla_len(resp_ie);
@@ -568,6 +721,8 @@ static void mlme_event_connect(struct wpa_driver_nl80211_data *drv,
                event.assoc_info.resp_ies_len = nla_len(resp_ie);
        }
 
+       event.assoc_info.freq = nl80211_get_assoc_freq(drv);
+
        wpa_supplicant_event(drv->ctx, EVENT_ASSOC, &event);
 }
 
@@ -597,8 +752,8 @@ static void mlme_timeout_event(struct wpa_driver_nl80211_data *drv,
 }
 
 
-static void mlme_event_action(struct wpa_driver_nl80211_data *drv,
-                             struct nlattr *freq, const u8 *frame, size_t len)
+static void mlme_event_mgmt(struct wpa_driver_nl80211_data *drv,
+                           struct nlattr *freq, const u8 *frame, size_t len)
 {
        const struct ieee80211_mgmt *mgmt;
        union wpa_event_data event;
@@ -614,15 +769,23 @@ static void mlme_event_action(struct wpa_driver_nl80211_data *drv,
        stype = WLAN_FC_GET_STYPE(fc);
 
        os_memset(&event, 0, sizeof(event));
-       event.rx_action.da = mgmt->da;
-       event.rx_action.sa = mgmt->sa;
-       event.rx_action.bssid = mgmt->bssid;
-       event.rx_action.category = mgmt->u.action.category;
-       event.rx_action.data = &mgmt->u.action.category + 1;
-       event.rx_action.len = frame + len - event.rx_action.data;
-       if (freq)
+       if (freq) {
                event.rx_action.freq = nla_get_u32(freq);
-       wpa_supplicant_event(drv->ctx, EVENT_RX_ACTION, &event);
+               drv->last_mgmt_freq = event.rx_action.freq;
+       }
+       if (stype == WLAN_FC_STYPE_ACTION) {
+               event.rx_action.da = mgmt->da;
+               event.rx_action.sa = mgmt->sa;
+               event.rx_action.bssid = mgmt->bssid;
+               event.rx_action.category = mgmt->u.action.category;
+               event.rx_action.data = &mgmt->u.action.category + 1;
+               event.rx_action.len = frame + len - event.rx_action.data;
+               wpa_supplicant_event(drv->ctx, EVENT_RX_ACTION, &event);
+       } else {
+               event.rx_mgmt.frame = frame;
+               event.rx_mgmt.frame_len = len;
+               wpa_supplicant_event(drv->ctx, EVENT_RX_MGMT, &event);
+       }
 }
 
 
@@ -639,10 +802,11 @@ static void mlme_event_action_tx_status(struct wpa_driver_nl80211_data *drv,
                return;
 
        cookie_val = nla_get_u64(cookie);
-       wpa_printf(MSG_DEBUG, "nl80211: Action TX status: cookie=0%llx%s",
+       wpa_printf(MSG_DEBUG, "nl80211: Action TX status: cookie=0%llx%s "
+                  "(ack=%d)",
                   (long long unsigned int) cookie_val,
                   cookie_val == drv->send_action_cookie ?
-                  " (match)" : " (unknown)");
+                  " (match)" : " (unknown)", ack != NULL);
        if (cookie_val != drv->send_action_cookie)
                return;
 
@@ -660,6 +824,95 @@ static void mlme_event_action_tx_status(struct wpa_driver_nl80211_data *drv,
 }
 
 
+static void mlme_event_deauth_disassoc(struct wpa_driver_nl80211_data *drv,
+                                      enum wpa_event_type type,
+                                      const u8 *frame, size_t len)
+{
+       const struct ieee80211_mgmt *mgmt;
+       union wpa_event_data event;
+       const u8 *bssid = NULL;
+       u16 reason_code = 0;
+
+       mgmt = (const struct ieee80211_mgmt *) frame;
+       if (len >= 24) {
+               bssid = mgmt->bssid;
+
+               if (drv->associated != 0 &&
+                   os_memcmp(bssid, drv->bssid, ETH_ALEN) != 0 &&
+                   os_memcmp(bssid, drv->auth_bssid, ETH_ALEN) != 0) {
+                       /*
+                        * We have presumably received this deauth as a
+                        * response to a clear_state_mismatch() outgoing
+                        * deauth.  Don't let it take us offline!
+                        */
+                       wpa_printf(MSG_DEBUG, "nl80211: Deauth received "
+                                  "from Unknown BSSID " MACSTR " -- ignoring",
+                                  MAC2STR(bssid));
+                       return;
+               }
+       }
+
+       drv->associated = 0;
+       os_memset(&event, 0, sizeof(event));
+
+       /* Note: Same offset for Reason Code in both frame subtypes */
+       if (len >= 24 + sizeof(mgmt->u.deauth))
+               reason_code = le_to_host16(mgmt->u.deauth.reason_code);
+
+       if (type == EVENT_DISASSOC) {
+               event.disassoc_info.addr = bssid;
+               event.disassoc_info.reason_code = reason_code;
+               if (frame + len > mgmt->u.disassoc.variable) {
+                       event.disassoc_info.ie = mgmt->u.disassoc.variable;
+                       event.disassoc_info.ie_len = frame + len -
+                               mgmt->u.disassoc.variable;
+               }
+       } else {
+               event.deauth_info.addr = bssid;
+               event.deauth_info.reason_code = reason_code;
+               if (frame + len > mgmt->u.deauth.variable) {
+                       event.deauth_info.ie = mgmt->u.deauth.variable;
+                       event.deauth_info.ie_len = frame + len -
+                               mgmt->u.deauth.variable;
+               }
+       }
+
+       wpa_supplicant_event(drv->ctx, type, &event);
+}
+
+
+static void mlme_event_unprot_disconnect(struct wpa_driver_nl80211_data *drv,
+                                        enum wpa_event_type type,
+                                        const u8 *frame, size_t len)
+{
+       const struct ieee80211_mgmt *mgmt;
+       union wpa_event_data event;
+       u16 reason_code = 0;
+
+       if (len < 24)
+               return;
+
+       mgmt = (const struct ieee80211_mgmt *) frame;
+
+       os_memset(&event, 0, sizeof(event));
+       /* Note: Same offset for Reason Code in both frame subtypes */
+       if (len >= 24 + sizeof(mgmt->u.deauth))
+               reason_code = le_to_host16(mgmt->u.deauth.reason_code);
+
+       if (type == EVENT_UNPROT_DISASSOC) {
+               event.unprot_disassoc.sa = mgmt->sa;
+               event.unprot_disassoc.da = mgmt->da;
+               event.unprot_disassoc.reason_code = reason_code;
+       } else {
+               event.unprot_deauth.sa = mgmt->sa;
+               event.unprot_deauth.da = mgmt->da;
+               event.unprot_deauth.reason_code = reason_code;
+       }
+
+       wpa_supplicant_event(drv->ctx, type, &event);
+}
+
+
 static void mlme_event(struct wpa_driver_nl80211_data *drv,
                       enum nl80211_commands cmd, struct nlattr *frame,
                       struct nlattr *addr, struct nlattr *timed_out,
@@ -689,20 +942,28 @@ static void mlme_event(struct wpa_driver_nl80211_data *drv,
                mlme_event_assoc(drv, nla_data(frame), nla_len(frame));
                break;
        case NL80211_CMD_DEAUTHENTICATE:
-               drv->associated = 0;
-               wpa_supplicant_event(drv->ctx, EVENT_DEAUTH, NULL);
+               mlme_event_deauth_disassoc(drv, EVENT_DEAUTH,
+                                          nla_data(frame), nla_len(frame));
                break;
        case NL80211_CMD_DISASSOCIATE:
-               drv->associated = 0;
-               wpa_supplicant_event(drv->ctx, EVENT_DISASSOC, NULL);
+               mlme_event_deauth_disassoc(drv, EVENT_DISASSOC,
+                                          nla_data(frame), nla_len(frame));
                break;
-       case NL80211_CMD_ACTION:
-               mlme_event_action(drv, freq, nla_data(frame), nla_len(frame));
+       case NL80211_CMD_FRAME:
+               mlme_event_mgmt(drv, freq, nla_data(frame), nla_len(frame));
                break;
-       case NL80211_CMD_ACTION_TX_STATUS:
+       case NL80211_CMD_FRAME_TX_STATUS:
                mlme_event_action_tx_status(drv, cookie, nla_data(frame),
                                            nla_len(frame), ack);
                break;
+       case NL80211_CMD_UNPROT_DEAUTHENTICATE:
+               mlme_event_unprot_disconnect(drv, EVENT_UNPROT_DEAUTH,
+                                            nla_data(frame), nla_len(frame));
+               break;
+       case NL80211_CMD_UNPROT_DISASSOCIATE:
+               mlme_event_unprot_disconnect(drv, EVENT_UNPROT_DISASSOC,
+                                            nla_data(frame), nla_len(frame));
+               break;
        default:
                break;
        }
@@ -850,6 +1111,144 @@ static void send_scan_event(struct wpa_driver_nl80211_data *drv, int aborted,
 }
 
 
+static int get_link_signal(struct nl_msg *msg, void *arg)
+{
+       struct nlattr *tb[NL80211_ATTR_MAX + 1];
+       struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
+       struct nlattr *sinfo[NL80211_STA_INFO_MAX + 1];
+       static struct nla_policy policy[NL80211_STA_INFO_MAX + 1] = {
+               [NL80211_STA_INFO_SIGNAL] = { .type = NLA_U8 },
+       };
+       struct nlattr *rinfo[NL80211_RATE_INFO_MAX + 1];
+       static struct nla_policy rate_policy[NL80211_RATE_INFO_MAX + 1] = {
+               [NL80211_RATE_INFO_BITRATE] = { .type = NLA_U16 },
+               [NL80211_RATE_INFO_MCS] = { .type = NLA_U8 },
+               [NL80211_RATE_INFO_40_MHZ_WIDTH] = { .type = NLA_FLAG },
+               [NL80211_RATE_INFO_SHORT_GI] = { .type = NLA_FLAG },
+       };
+       struct wpa_signal_info *sig_change = arg;
+
+       nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
+                 genlmsg_attrlen(gnlh, 0), NULL);
+       if (!tb[NL80211_ATTR_STA_INFO] ||
+           nla_parse_nested(sinfo, NL80211_STA_INFO_MAX,
+                            tb[NL80211_ATTR_STA_INFO], policy))
+               return NL_SKIP;
+       if (!sinfo[NL80211_STA_INFO_SIGNAL])
+               return NL_SKIP;
+
+       sig_change->current_signal =
+               (s8) nla_get_u8(sinfo[NL80211_STA_INFO_SIGNAL]);
+
+       if (sinfo[NL80211_STA_INFO_TX_BITRATE]) {
+               if (nla_parse_nested(rinfo, NL80211_RATE_INFO_MAX,
+                                    sinfo[NL80211_STA_INFO_TX_BITRATE],
+                                    rate_policy)) {
+                       sig_change->current_txrate = 0;
+               } else {
+                       if (rinfo[NL80211_RATE_INFO_BITRATE]) {
+                               sig_change->current_txrate =
+                                       nla_get_u16(rinfo[
+                                            NL80211_RATE_INFO_BITRATE]) * 100;
+                       }
+               }
+       }
+
+       return NL_SKIP;
+}
+
+
+static int nl80211_get_link_signal(struct wpa_driver_nl80211_data *drv,
+                                  struct wpa_signal_info *sig)
+{
+       struct nl_msg *msg;
+
+       sig->current_signal = -9999;
+       sig->current_txrate = 0;
+
+       msg = nlmsg_alloc();
+       if (!msg)
+               return -ENOMEM;
+
+       genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
+                   0, NL80211_CMD_GET_STATION, 0);
+
+       NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
+       NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, drv->bssid);
+
+       return send_and_recv_msgs(drv, msg, get_link_signal, sig);
+ nla_put_failure:
+       return -ENOBUFS;
+}
+
+
+static int get_link_noise(struct nl_msg *msg, void *arg)
+{
+       struct nlattr *tb[NL80211_ATTR_MAX + 1];
+       struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
+       struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
+       static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
+               [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
+               [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
+       };
+       struct wpa_signal_info *sig_change = arg;
+
+       nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
+                 genlmsg_attrlen(gnlh, 0), NULL);
+
+       if (!tb[NL80211_ATTR_SURVEY_INFO]) {
+               wpa_printf(MSG_DEBUG, "nl80211: survey data missing!");
+               return NL_SKIP;
+       }
+
+       if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
+                            tb[NL80211_ATTR_SURVEY_INFO],
+                            survey_policy)) {
+               wpa_printf(MSG_DEBUG, "nl80211: failed to parse nested "
+                          "attributes!");
+               return NL_SKIP;
+       }
+
+       if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY])
+               return NL_SKIP;
+
+       if (nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]) !=
+           sig_change->frequency)
+               return NL_SKIP;
+
+       if (!sinfo[NL80211_SURVEY_INFO_NOISE])
+               return NL_SKIP;
+
+       sig_change->current_noise =
+               (s8) nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
+
+       return NL_SKIP;
+}
+
+
+static int nl80211_get_link_noise(struct wpa_driver_nl80211_data *drv,
+                                 struct wpa_signal_info *sig_change)
+{
+       struct nl_msg *msg;
+
+       sig_change->current_noise = 9999;
+       sig_change->frequency = drv->assoc_freq;
+
+       msg = nlmsg_alloc();
+       if (!msg)
+               return -ENOMEM;
+
+       genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
+                   NLM_F_DUMP, NL80211_CMD_GET_SURVEY, 0);
+
+       NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
+
+       return send_and_recv_msgs(drv, msg, get_link_noise, sig_change);
+ nla_put_failure:
+       return -ENOBUFS;
+}
+
+
 static void nl80211_cqm_event(struct wpa_driver_nl80211_data *drv,
                              struct nlattr *tb[])
 {
@@ -857,10 +1256,13 @@ static void nl80211_cqm_event(struct wpa_driver_nl80211_data *drv,
                [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
                [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U8 },
                [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
+               [NL80211_ATTR_CQM_PKT_LOSS_EVENT] = { .type = NLA_U32 },
        };
        struct nlattr *cqm[NL80211_ATTR_CQM_MAX + 1];
        enum nl80211_cqm_rssi_threshold_event event;
        union wpa_event_data ed;
+       struct wpa_signal_info sig;
+       int res;
 
        if (tb[NL80211_ATTR_CQM] == NULL ||
            nla_parse_nested(cqm, NL80211_ATTR_CQM_MAX, tb[NL80211_ATTR_CQM],
@@ -869,12 +1271,21 @@ static void nl80211_cqm_event(struct wpa_driver_nl80211_data *drv,
                return;
        }
 
+       os_memset(&ed, 0, sizeof(ed));
+
+       if (cqm[NL80211_ATTR_CQM_PKT_LOSS_EVENT]) {
+               if (!tb[NL80211_ATTR_MAC])
+                       return;
+               os_memcpy(ed.low_ack.addr, nla_data(tb[NL80211_ATTR_MAC]),
+                         ETH_ALEN);
+               wpa_supplicant_event(drv->ctx, EVENT_STATION_LOW_ACK, &ed);
+               return;
+       }
+
        if (cqm[NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] == NULL)
                return;
        event = nla_get_u32(cqm[NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT]);
 
-       os_memset(&ed, 0, sizeof(ed));
-
        if (event == NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH) {
                wpa_printf(MSG_DEBUG, "nl80211: Connection quality monitor "
                           "event: RSSI high");
@@ -886,22 +1297,98 @@ static void nl80211_cqm_event(struct wpa_driver_nl80211_data *drv,
        } else
                return;
 
+       res = nl80211_get_link_signal(drv, &sig);
+       if (res == 0) {
+               ed.signal_change.current_signal = sig.current_signal;
+               ed.signal_change.current_txrate = sig.current_txrate;
+               wpa_printf(MSG_DEBUG, "nl80211: Signal: %d dBm  txrate: %d",
+                          sig.current_signal, sig.current_txrate);
+       }
+
+       res = nl80211_get_link_noise(drv, &sig);
+       if (res == 0) {
+               ed.signal_change.current_noise = sig.current_noise;
+               wpa_printf(MSG_DEBUG, "nl80211: Noise: %d dBm",
+                          sig.current_noise);
+       }
+
        wpa_supplicant_event(drv->ctx, EVENT_SIGNAL_CHANGE, &ed);
 }
 
 
+static void nl80211_new_station_event(struct wpa_driver_nl80211_data *drv,
+                                     struct nlattr **tb)
+{
+       u8 *addr;
+       union wpa_event_data data;
+
+       if (tb[NL80211_ATTR_MAC] == NULL)
+               return;
+       addr = nla_data(tb[NL80211_ATTR_MAC]);
+       wpa_printf(MSG_DEBUG, "nl80211: New station " MACSTR, MAC2STR(addr));
+
+       if (drv->nlmode == NL80211_IFTYPE_AP &&
+           drv->no_monitor_iface_capab) {
+               u8 *ies = NULL;
+               size_t ies_len = 0;
+               if (tb[NL80211_ATTR_IE]) {
+                       ies = nla_data(tb[NL80211_ATTR_IE]);
+                       ies_len = nla_len(tb[NL80211_ATTR_IE]);
+               }
+               wpa_hexdump(MSG_DEBUG, "nl80211: Assoc Req IEs", ies, ies_len);
+               drv_event_assoc(drv->ctx, addr, ies, ies_len, 0);
+               return;
+       }
+
+       if (drv->nlmode != NL80211_IFTYPE_ADHOC)
+               return;
+
+       os_memset(&data, 0, sizeof(data));
+       os_memcpy(data.ibss_rsn_start.peer, addr, ETH_ALEN);
+       wpa_supplicant_event(drv->ctx, EVENT_IBSS_RSN_START, &data);
+}
+
+
+static void nl80211_del_station_event(struct wpa_driver_nl80211_data *drv,
+                                     struct nlattr **tb)
+{
+       u8 *addr;
+       union wpa_event_data data;
+
+       if (tb[NL80211_ATTR_MAC] == NULL)
+               return;
+       addr = nla_data(tb[NL80211_ATTR_MAC]);
+       wpa_printf(MSG_DEBUG, "nl80211: Delete station " MACSTR,
+                  MAC2STR(addr));
+
+       if (drv->nlmode == NL80211_IFTYPE_AP &&
+           drv->no_monitor_iface_capab) {
+               drv_event_disassoc(drv->ctx, addr);
+               return;
+       }
+
+       if (drv->nlmode != NL80211_IFTYPE_ADHOC)
+               return;
+
+       os_memset(&data, 0, sizeof(data));
+       os_memcpy(data.ibss_peer_lost.peer, addr, ETH_ALEN);
+       wpa_supplicant_event(drv->ctx, EVENT_IBSS_PEER_LOST, &data);
+}
+
+
 static int process_event(struct nl_msg *msg, void *arg)
 {
        struct wpa_driver_nl80211_data *drv = arg;
        struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
        struct nlattr *tb[NL80211_ATTR_MAX + 1];
+       union wpa_event_data data;
 
        nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
                  genlmsg_attrlen(gnlh, 0), NULL);
 
        if (tb[NL80211_ATTR_IFINDEX]) {
                int ifindex = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
-               if (ifindex != drv->ifindex) {
+               if (ifindex != drv->ifindex && !have_ifidx(drv, ifindex)) {
                        wpa_printf(MSG_DEBUG, "nl80211: Ignored event (cmd=%d)"
                                   " for foreign interface (ifindex %d)",
                                   gnlh->cmd, ifindex);
@@ -942,8 +1429,10 @@ static int process_event(struct nl_msg *msg, void *arg)
        case NL80211_CMD_ASSOCIATE:
        case NL80211_CMD_DEAUTHENTICATE:
        case NL80211_CMD_DISASSOCIATE:
-       case NL80211_CMD_ACTION:
-       case NL80211_CMD_ACTION_TX_STATUS:
+       case NL80211_CMD_FRAME:
+       case NL80211_CMD_FRAME_TX_STATUS:
+       case NL80211_CMD_UNPROT_DEAUTHENTICATE:
+       case NL80211_CMD_UNPROT_DISASSOCIATE:
                mlme_event(drv, gnlh->cmd, tb[NL80211_ATTR_FRAME],
                           tb[NL80211_ATTR_MAC], tb[NL80211_ATTR_TIMED_OUT],
                           tb[NL80211_ATTR_WIPHY_FREQ], tb[NL80211_ATTR_ACK],
@@ -968,7 +1457,11 @@ static int process_event(struct nl_msg *msg, void *arg)
                        break;
                }
                drv->associated = 0;
-               wpa_supplicant_event(drv->ctx, EVENT_DISASSOC, NULL);
+               os_memset(&data, 0, sizeof(data));
+               if (tb[NL80211_ATTR_REASON_CODE])
+                       data.disassoc_info.reason_code =
+                               nla_get_u16(tb[NL80211_ATTR_REASON_CODE]);
+               wpa_supplicant_event(drv->ctx, EVENT_DISASSOC, &data);
                break;
        case NL80211_CMD_MICHAEL_MIC_FAILURE:
                mlme_event_michael_mic_failure(drv, tb);
@@ -985,8 +1478,24 @@ static int process_event(struct nl_msg *msg, void *arg)
        case NL80211_CMD_NOTIFY_CQM:
                nl80211_cqm_event(drv, tb);
                break;
-       default:
-               wpa_printf(MSG_DEBUG, "nl80211: Ignored unknown event "
+       case NL80211_CMD_REG_CHANGE:
+               wpa_printf(MSG_DEBUG, "nl80211: Regulatory domain change");
+               wpa_supplicant_event(drv->ctx, EVENT_CHANNEL_LIST_CHANGED,
+                                    NULL);
+               break;
+       case NL80211_CMD_REG_BEACON_HINT:
+               wpa_printf(MSG_DEBUG, "nl80211: Regulatory beacon hint");
+               wpa_supplicant_event(drv->ctx, EVENT_CHANNEL_LIST_CHANGED,
+                                    NULL);
+               break;
+       case NL80211_CMD_NEW_STATION:
+               nl80211_new_station_event(drv, tb);
+               break;
+       case NL80211_CMD_DEL_STATION:
+               nl80211_del_station_event(drv, tb);
+               break;
+       default:
+               wpa_printf(MSG_DEBUG, "nl80211: Ignored unknown event "
                           "(cmd=%d)", gnlh->cmd);
                break;
        }
@@ -996,7 +1505,7 @@ static int process_event(struct nl_msg *msg, void *arg)
 
 
 static void wpa_driver_nl80211_event_receive(int sock, void *eloop_ctx,
-                                            void *sock_ctx)
+                                            void *handle)
 {
        struct nl_cb *cb;
        struct wpa_driver_nl80211_data *drv = eloop_ctx;
@@ -1008,7 +1517,7 @@ static void wpa_driver_nl80211_event_receive(int sock, void *eloop_ctx,
                return;
        nl_cb_set(cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM, no_seq_check, NULL);
        nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM, process_event, drv);
-       nl_recvmsgs(drv->nl_handle_event, cb);
+       nl_recvmsgs(handle, cb);
        nl_cb_put(cb);
 }
 
@@ -1049,12 +1558,14 @@ nla_put_failure:
 }
 
 
-#ifndef HOSTAPD
 struct wiphy_info_data {
        int max_scan_ssids;
        int ap_supported;
+       int p2p_supported;
        int auth_supported;
        int connect_supported;
+       int offchan_tx_supported;
+       int max_remain_on_chan;
 };
 
 
@@ -1063,6 +1574,7 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
        struct nlattr *tb[NL80211_ATTR_MAX + 1];
        struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
        struct wiphy_info_data *info = arg;
+       int p2p_go_supported = 0, p2p_client_supported = 0;
 
        nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
                  genlmsg_attrlen(gnlh, 0), NULL);
@@ -1076,13 +1588,22 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
                int i;
                nla_for_each_nested(nl_mode,
                                    tb[NL80211_ATTR_SUPPORTED_IFTYPES], i) {
-                       if (nl_mode->nla_type == NL80211_IFTYPE_AP) {
+                       switch (nla_type(nl_mode)) {
+                       case NL80211_IFTYPE_AP:
                                info->ap_supported = 1;
                                break;
+                       case NL80211_IFTYPE_P2P_GO:
+                               p2p_go_supported = 1;
+                               break;
+                       case NL80211_IFTYPE_P2P_CLIENT:
+                               p2p_client_supported = 1;
+                               break;
                        }
                }
        }
 
+       info->p2p_supported = p2p_go_supported && p2p_client_supported;
+
        if (tb[NL80211_ATTR_SUPPORTED_COMMANDS]) {
                struct nlattr *nl_cmd;
                int i;
@@ -1097,6 +1618,13 @@ static int wiphy_info_handler(struct nl_msg *msg, void *arg)
                }
        }
 
+       if (tb[NL80211_ATTR_OFFCHANNEL_TX_OK])
+               info->offchan_tx_supported = 1;
+
+       if (tb[NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION])
+               info->max_remain_on_chan =
+                       nla_get_u32(tb[NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION]);
+
        return NL_SKIP;
 }
 
@@ -1107,6 +1635,10 @@ static int wpa_driver_nl80211_get_info(struct wpa_driver_nl80211_data *drv,
        struct nl_msg *msg;
 
        os_memset(info, 0, sizeof(*info));
+
+       /* default to 5000 since early versions of mac80211 don't set it */
+       info->max_remain_on_chan = 5000;
+
        msg = nlmsg_alloc();
        if (!msg)
                return -1;
@@ -1156,15 +1688,24 @@ static int wpa_driver_nl80211_capa(struct wpa_driver_nl80211_data *drv)
                return -1;
        }
 
+       if (info.offchan_tx_supported) {
+               wpa_printf(MSG_DEBUG, "nl80211: Using driver-based "
+                          "off-channel TX");
+               drv->capa.flags |= WPA_DRIVER_FLAGS_OFFCHANNEL_TX;
+       }
+
+       drv->capa.flags |= WPA_DRIVER_FLAGS_SANE_ERROR_CODES;
        drv->capa.flags |= WPA_DRIVER_FLAGS_SET_KEYS_AFTER_ASSOC_DONE;
+       if (info.p2p_supported)
+               drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_CAPABLE;
+       drv->capa.flags |= WPA_DRIVER_FLAGS_EAPOL_TX_STATUS;
+       drv->capa.max_remain_on_chan = info.max_remain_on_chan;
 
        return 0;
 }
-#endif /* HOSTAPD */
 
 
-static int wpa_driver_nl80211_init_nl(struct wpa_driver_nl80211_data *drv,
-                                     void *ctx)
+static int wpa_driver_nl80211_init_nl(struct wpa_driver_nl80211_data *drv)
 {
        int ret;
 
@@ -1177,14 +1718,14 @@ static int wpa_driver_nl80211_init_nl(struct wpa_driver_nl80211_data *drv,
                goto err1;
        }
 
-       drv->nl_handle = nl_handle_alloc_cb(drv->nl_cb);
+       drv->nl_handle = nl80211_handle_alloc(drv->nl_cb);
        if (drv->nl_handle == NULL) {
                wpa_printf(MSG_ERROR, "nl80211: Failed to allocate netlink "
                           "callbacks");
                goto err2;
        }
 
-       drv->nl_handle_event = nl_handle_alloc_cb(drv->nl_cb);
+       drv->nl_handle_event = nl80211_handle_alloc(drv->nl_cb);
        if (drv->nl_handle_event == NULL) {
                wpa_printf(MSG_ERROR, "nl80211: Failed to allocate netlink "
                           "callbacks (event)");
@@ -1257,8 +1798,19 @@ static int wpa_driver_nl80211_init_nl(struct wpa_driver_nl80211_data *drv,
                goto err4;
        }
 
+       ret = nl_get_multicast_id(drv, "nl80211", "regulatory");
+       if (ret >= 0)
+               ret = nl_socket_add_membership(drv->nl_handle_event, ret);
+       if (ret < 0) {
+               wpa_printf(MSG_DEBUG, "nl80211: Could not add multicast "
+                          "membership for regulatory events: %d (%s)",
+                          ret, strerror(-ret));
+               /* Continue without regulatory events */
+       }
+
        eloop_register_read_sock(nl_socket_get_fd(drv->nl_handle_event),
-                                wpa_driver_nl80211_event_receive, drv, ctx);
+                                wpa_driver_nl80211_event_receive, drv,
+                                drv->nl_handle_event);
 
        return 0;
 
@@ -1267,9 +1819,9 @@ err4:
 err3b:
        nl_cache_free(drv->nl_cache);
 err3:
-       nl_handle_destroy(drv->nl_handle_event);
+       nl80211_handle_destroy(drv->nl_handle_event);
 err2b:
-       nl_handle_destroy(drv->nl_handle);
+       nl80211_handle_destroy(drv->nl_handle);
 err2:
        nl_cb_put(drv->nl_cb);
 err1:
@@ -1277,22 +1829,82 @@ err1:
 }
 
 
+static void wpa_driver_nl80211_rfkill_blocked(void *ctx)
+{
+       wpa_printf(MSG_DEBUG, "nl80211: RFKILL blocked");
+       /*
+        * This may be for any interface; use ifdown event to disable
+        * interface.
+        */
+}
+
+
+static void wpa_driver_nl80211_rfkill_unblocked(void *ctx)
+{
+       struct wpa_driver_nl80211_data *drv = ctx;
+       wpa_printf(MSG_DEBUG, "nl80211: RFKILL unblocked");
+       if (linux_set_iface_flags(drv->ioctl_sock, drv->first_bss.ifname, 1)) {
+               wpa_printf(MSG_DEBUG, "nl80211: Could not set interface UP "
+                          "after rfkill unblock");
+               return;
+       }
+       /* rtnetlink ifup handler will report interface as enabled */
+}
+
+
+static void nl80211_get_phy_name(struct wpa_driver_nl80211_data *drv)
+{
+       /* Find phy (radio) to which this interface belongs */
+       char buf[90], *pos;
+       int f, rv;
+
+       drv->phyname[0] = '\0';
+       snprintf(buf, sizeof(buf) - 1, "/sys/class/net/%s/phy80211/name",
+                drv->first_bss.ifname);
+       f = open(buf, O_RDONLY);
+       if (f < 0) {
+               wpa_printf(MSG_DEBUG, "Could not open file %s: %s",
+                          buf, strerror(errno));
+               return;
+       }
+
+       rv = read(f, drv->phyname, sizeof(drv->phyname) - 1);
+       close(f);
+       if (rv < 0) {
+               wpa_printf(MSG_DEBUG, "Could not read file %s: %s",
+                          buf, strerror(errno));
+               return;
+       }
+
+       drv->phyname[rv] = '\0';
+       pos = os_strchr(drv->phyname, '\n');
+       if (pos)
+               *pos = '\0';
+       wpa_printf(MSG_DEBUG, "nl80211: interface %s in phy %s",
+                  drv->first_bss.ifname, drv->phyname);
+}
+
+
 /**
  * wpa_driver_nl80211_init - Initialize nl80211 driver interface
  * @ctx: context to be used when calling wpa_supplicant functions,
  * e.g., wpa_supplicant_event()
  * @ifname: interface name, e.g., wlan0
+ * @global_priv: private driver global data from global_init()
  * Returns: Pointer to private data, %NULL on failure
  */
-static void * wpa_driver_nl80211_init(void *ctx, const char *ifname)
+static void * wpa_driver_nl80211_init(void *ctx, const char *ifname,
+                                     void *global_priv)
 {
        struct wpa_driver_nl80211_data *drv;
        struct netlink_config *cfg;
+       struct rfkill_config *rcfg;
        struct i802_bss *bss;
 
        drv = os_zalloc(sizeof(*drv));
        if (drv == NULL)
                return NULL;
+       drv->global = global_priv;
        drv->ctx = ctx;
        bss = &drv->first_bss;
        bss->drv = drv;
@@ -1301,11 +1913,13 @@ static void * wpa_driver_nl80211_init(void *ctx, const char *ifname)
        drv->monitor_sock = -1;
        drv->ioctl_sock = -1;
 
-       if (wpa_driver_nl80211_init_nl(drv, ctx)) {
+       if (wpa_driver_nl80211_init_nl(drv)) {
                os_free(drv);
                return NULL;
        }
 
+       nl80211_get_phy_name(drv);
+
        drv->ioctl_sock = socket(PF_INET, SOCK_DGRAM, 0);
        if (drv->ioctl_sock < 0) {
                perror("socket(PF_INET,SOCK_DGRAM)");
@@ -1323,19 +1937,37 @@ static void * wpa_driver_nl80211_init(void *ctx, const char *ifname)
                os_free(cfg);
                goto failed;
        }
+
+       rcfg = os_zalloc(sizeof(*rcfg));
+       if (rcfg == NULL)
+               goto failed;
+       rcfg->ctx = drv;
+       os_strlcpy(rcfg->ifname, ifname, sizeof(rcfg->ifname));
+       rcfg->blocked_cb = wpa_driver_nl80211_rfkill_blocked;
+       rcfg->unblocked_cb = wpa_driver_nl80211_rfkill_unblocked;
+       drv->rfkill = rfkill_init(rcfg);
+       if (drv->rfkill == NULL) {
+               wpa_printf(MSG_DEBUG, "nl80211: RFKILL status not available");
+               os_free(rcfg);
+       }
+
        if (wpa_driver_nl80211_finish_drv_init(drv))
                goto failed;
 
+       if (drv->global)
+               dl_list_add(&drv->global->interfaces, &drv->list);
+
        return bss;
 
 failed:
+       rfkill_deinit(drv->rfkill);
        netlink_deinit(drv->netlink);
        if (drv->ioctl_sock >= 0)
                close(drv->ioctl_sock);
 
        genl_family_put(drv->nl80211);
        nl_cache_free(drv->nl_cache);
-       nl_handle_destroy(drv->nl_handle);
+       nl80211_handle_destroy(drv->nl_handle);
        nl_cb_put(drv->nl_cb);
        eloop_unregister_read_sock(nl_socket_get_fd(drv->nl_handle_event));
 
@@ -1344,8 +1976,9 @@ failed:
 }
 
 
-static int nl80211_register_action_frame(struct wpa_driver_nl80211_data *drv,
-                                        const u8 *match, size_t match_len)
+static int nl80211_register_frame(struct wpa_driver_nl80211_data *drv,
+                                 struct nl_handle *nl_handle,
+                                 u16 type, const u8 *match, size_t match_len)
 {
        struct nl_msg *msg;
        int ret = -1;
@@ -1358,14 +1991,16 @@ static int nl80211_register_action_frame(struct wpa_driver_nl80211_data *drv,
                    NL80211_CMD_REGISTER_ACTION, 0);
 
        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
+       NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE, type);
        NLA_PUT(msg, NL80211_ATTR_FRAME_MATCH, match_len, match);
 
-       ret = send_and_recv(drv, drv->nl_handle_event, msg, NULL, NULL);
+       ret = send_and_recv(drv, nl_handle, msg, NULL, NULL);
        msg = NULL;
        if (ret) {
-               wpa_printf(MSG_DEBUG, "nl80211: Register Action command "
-                          "failed: ret=%d (%s)", ret, strerror(-ret));
-               wpa_hexdump(MSG_DEBUG, "nl80211: Register Action match",
+               wpa_printf(MSG_DEBUG, "nl80211: Register frame command "
+                          "failed (type=%u): ret=%d (%s)",
+                          type, ret, strerror(-ret));
+               wpa_hexdump(MSG_DEBUG, "nl80211: Register frame match",
                            match, match_len);
                goto nla_put_failure;
        }
@@ -1376,8 +2011,47 @@ nla_put_failure:
 }
 
 
+static int nl80211_register_action_frame(struct wpa_driver_nl80211_data *drv,
+                                        const u8 *match, size_t match_len)
+{
+       u16 type = (WLAN_FC_TYPE_MGMT << 2) | (WLAN_FC_STYPE_ACTION << 4);
+       return nl80211_register_frame(drv, drv->nl_handle_event,
+                                     type, match, match_len);
+}
+
+
 static int nl80211_register_action_frames(struct wpa_driver_nl80211_data *drv)
 {
+#ifdef CONFIG_P2P
+       /* GAS Initial Request */
+       if (nl80211_register_action_frame(drv, (u8 *) "\x04\x0a", 2) < 0)
+               return -1;
+       /* GAS Initial Response */
+       if (nl80211_register_action_frame(drv, (u8 *) "\x04\x0b", 2) < 0)
+               return -1;
+       /* GAS Comeback Request */
+       if (nl80211_register_action_frame(drv, (u8 *) "\x04\x0c", 2) < 0)
+               return -1;
+       /* GAS Comeback Response */
+       if (nl80211_register_action_frame(drv, (u8 *) "\x04\x0d", 2) < 0)
+               return -1;
+       /* P2P Public Action */
+       if (nl80211_register_action_frame(drv,
+                                         (u8 *) "\x04\x09\x50\x6f\x9a\x09",
+                                         6) < 0)
+               return -1;
+       /* P2P Action */
+       if (nl80211_register_action_frame(drv,
+                                         (u8 *) "\x7f\x50\x6f\x9a\x09",
+                                         5) < 0)
+               return -1;
+#endif /* CONFIG_P2P */
+#ifdef CONFIG_IEEE80211W
+       /* SA Query Response */
+       if (nl80211_register_action_frame(drv, (u8 *) "\x08\x01", 2) < 0)
+               return -1;
+#endif /* CONFIG_IEEE80211W */
+
        /* FT Action frames */
        if (nl80211_register_action_frame(drv, (u8 *) "\x06", 1) < 0)
                return -1;
@@ -1389,10 +2063,17 @@ static int nl80211_register_action_frames(struct wpa_driver_nl80211_data *drv)
 }
 
 
+static void wpa_driver_nl80211_send_rfkill(void *eloop_ctx, void *timeout_ctx)
+{
+       wpa_supplicant_event(timeout_ctx, EVENT_INTERFACE_DISABLED, NULL);
+}
+
+
 static int
 wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv)
 {
        struct i802_bss *bss = &drv->first_bss;
+       int send_rfkill_event = 0;
 
        drv->ifindex = if_nametoindex(bss->ifname);
        drv->first_bss.ifindex = drv->ifindex;
@@ -1404,18 +2085,29 @@ wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv)
        }
 
        if (linux_set_iface_flags(drv->ioctl_sock, bss->ifname, 1)) {
-               wpa_printf(MSG_ERROR, "Could not set interface '%s' UP",
-                          bss->ifname);
-               return -1;
+               if (rfkill_is_blocked(drv->rfkill)) {
+                       wpa_printf(MSG_DEBUG, "nl80211: Could not yet enable "
+                                  "interface '%s' due to rfkill",
+                                  bss->ifname);
+                       drv->if_disabled = 1;
+                       send_rfkill_event = 1;
+               } else {
+                       wpa_printf(MSG_ERROR, "nl80211: Could not set "
+                                  "interface '%s' UP", bss->ifname);
+                       return -1;
+               }
        }
 
-       if (wpa_driver_nl80211_capa(drv))
-               return -1;
-
        netlink_send_oper_ifla(drv->netlink, drv->ifindex,
                               1, IF_OPER_DORMANT);
 #endif /* HOSTAPD */
 
+       if (wpa_driver_nl80211_capa(drv))
+               return -1;
+
+       if (linux_get_ifhwaddr(drv->ioctl_sock, bss->ifname, drv->addr))
+               return -1;
+
        if (nl80211_register_action_frames(drv) < 0) {
                wpa_printf(MSG_DEBUG, "nl80211: Failed to register Action "
                           "frame processing - ignore for now");
@@ -1426,6 +2118,11 @@ wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv)
                 */
        }
 
+       if (send_rfkill_event) {
+               eloop_register_timeout(0, 0, wpa_driver_nl80211_send_rfkill,
+                                      drv, drv->ctx);
+       }
+
        return 0;
 }
 
@@ -1460,18 +2157,20 @@ static void wpa_driver_nl80211_deinit(void *priv)
        struct i802_bss *bss = priv;
        struct wpa_driver_nl80211_data *drv = bss->drv;
 
-       if (drv->added_if_into_bridge) {
-               if (linux_br_del_if(drv->ioctl_sock, drv->brname, bss->ifname)
+       if (drv->nl_handle_preq)
+               wpa_driver_nl80211_probe_req_report(bss, 0);
+       if (bss->added_if_into_bridge) {
+               if (linux_br_del_if(drv->ioctl_sock, bss->brname, bss->ifname)
                    < 0)
                        wpa_printf(MSG_INFO, "nl80211: Failed to remove "
                                   "interface %s from bridge %s: %s",
-                                  bss->ifname, drv->brname, strerror(errno));
+                                  bss->ifname, bss->brname, strerror(errno));
        }
-       if (drv->added_bridge) {
-               if (linux_br_del(drv->ioctl_sock, drv->brname) < 0)
+       if (bss->added_bridge) {
+               if (linux_br_del(drv->ioctl_sock, bss->brname) < 0)
                        wpa_printf(MSG_INFO, "nl80211: Failed to remove "
                                   "bridge %s: %s",
-                                  drv->brname, strerror(errno));
+                                  bss->brname, strerror(errno));
        }
 
        nl80211_remove_monitor_interface(drv);
@@ -1502,6 +2201,7 @@ static void wpa_driver_nl80211_deinit(void *priv)
 
        netlink_send_oper_ifla(drv->netlink, drv->ifindex, 0, IF_OPER_UP);
        netlink_deinit(drv->netlink);
+       rfkill_deinit(drv->rfkill);
 
        eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
 
@@ -1515,15 +2215,15 @@ static void wpa_driver_nl80211_deinit(void *priv)
        genl_family_put(drv->nl80211);
        nl_cache_free(drv->nl_cache);
        nl_cache_free(drv->nl_cache_event);
-       nl_handle_destroy(drv->nl_handle);
-       nl_handle_destroy(drv->nl_handle_event);
+       nl80211_handle_destroy(drv->nl_handle);
+       nl80211_handle_destroy(drv->nl_handle_event);
        nl_cb_put(drv->nl_cb);
 
-       eloop_cancel_timeout(wpa_driver_nl80211_probe_req_report_timeout,
-                            drv, NULL);
-
        os_free(drv->filter_ssids);
 
+       if (drv->global)
+               dl_list_del(&drv->list);
+
        os_free(drv);
 }
 
@@ -1712,11 +2412,6 @@ static int nl80211_scan_filtered(struct wpa_driver_nl80211_data *drv,
 }
 
 
-struct nl80211_bss_info_arg {
-       struct wpa_driver_nl80211_data *drv;
-       struct wpa_scan_results *res;
-};
-
 static int bss_info_handler(struct nl_msg *msg, void *arg)
 {
        struct nlattr *tb[NL80211_ATTR_MAX + 1];
@@ -1742,6 +2437,7 @@ static int bss_info_handler(struct nl_msg *msg, void *arg)
        const u8 *ie, *beacon_ie;
        size_t ie_len, beacon_ie_len;
        u8 *pos;
+       size_t i;
 
        nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
                  genlmsg_attrlen(gnlh, 0), NULL);
@@ -1750,6 +2446,19 @@ static int bss_info_handler(struct nl_msg *msg, void *arg)
        if (nla_parse_nested(bss, NL80211_BSS_MAX, tb[NL80211_ATTR_BSS],
                             bss_policy))
                return NL_SKIP;
+       if (bss[NL80211_BSS_STATUS]) {
+               enum nl80211_bss_status status;
+               status = nla_get_u32(bss[NL80211_BSS_STATUS]);
+               if (status == NL80211_BSS_STATUS_ASSOCIATED &&
+                   bss[NL80211_BSS_FREQUENCY]) {
+                       _arg->assoc_freq =
+                               nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
+                       wpa_printf(MSG_DEBUG, "nl80211: Associated on %u MHz",
+                                  _arg->assoc_freq);
+               }
+       }
+       if (!res)
+               return NL_SKIP;
        if (bss[NL80211_BSS_INFORMATION_ELEMENTS]) {
                ie = nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
                ie_len = nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
@@ -1820,6 +2529,38 @@ static int bss_info_handler(struct nl_msg *msg, void *arg)
                }
        }
 
+       /*
+        * cfg80211 maintains separate BSS table entries for APs if the same
+        * BSSID,SSID pair is seen on multiple channels. wpa_supplicant does
+        * not use frequency as a separate key in the BSS table, so filter out
+        * duplicated entries. Prefer associated BSS entry in such a case in
+        * order to get the correct frequency into the BSS table.
+        */
+       for (i = 0; i < res->num; i++) {
+               const u8 *s1, *s2;
+               if (os_memcmp(res->res[i]->bssid, r->bssid, ETH_ALEN) != 0)
+                       continue;
+
+               s1 = nl80211_get_ie((u8 *) (res->res[i] + 1),
+                                   res->res[i]->ie_len, WLAN_EID_SSID);
+               s2 = nl80211_get_ie((u8 *) (r + 1), r->ie_len, WLAN_EID_SSID);
+               if (s1 == NULL || s2 == NULL || s1[1] != s2[1] ||
+                   os_memcmp(s1, s2, 2 + s1[1]) != 0)
+                       continue;
+
+               /* Same BSSID,SSID was already included in scan results */
+               wpa_printf(MSG_DEBUG, "nl80211: Remove duplicated scan result "
+                          "for " MACSTR, MAC2STR(r->bssid));
+
+               if ((r->flags & WPA_SCAN_ASSOCIATED) &&
+                   !(res->res[i]->flags & WPA_SCAN_ASSOCIATED)) {
+                       os_free(res->res[i]);
+                       res->res[i] = r;
+               } else
+                       os_free(r);
+               return NL_SKIP;
+       }
+
        tmp = os_realloc(res->res,
                         (res->num + 1) * sizeof(struct wpa_scan_res *));
        if (tmp == NULL) {
@@ -2051,10 +2792,28 @@ static int wpa_driver_nl80211_set_key(const char *ifname, void *priv,
        if (seq && seq_len)
                NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, seq_len, seq);
 
-       if (addr && os_memcmp(addr, "\xff\xff\xff\xff\xff\xff", ETH_ALEN) != 0)
-       {
+       if (addr && !is_broadcast_ether_addr(addr)) {
                wpa_printf(MSG_DEBUG, "   addr=" MACSTR, MAC2STR(addr));
                NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
+
+               if (alg != WPA_ALG_WEP && key_idx && !set_tx) {
+                       wpa_printf(MSG_DEBUG, "   RSN IBSS RX GTK");
+                       NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE,
+                                   NL80211_KEYTYPE_GROUP);
+               }
+       } else if (addr && is_broadcast_ether_addr(addr)) {
+               struct nl_msg *types;
+               int err;
+               wpa_printf(MSG_DEBUG, "   broadcast key");
+               types = nlmsg_alloc();
+               if (!types)
+                       goto nla_put_failure;
+               NLA_PUT_FLAG(types, NL80211_KEY_DEFAULT_TYPE_MULTICAST);
+               err = nla_put_nested(msg, NL80211_ATTR_KEY_DEFAULT_TYPES,
+                                    types);
+               nlmsg_free(types);
+               if (err)
+                       goto nla_put_failure;
        }
        NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
@@ -2072,13 +2831,9 @@ static int wpa_driver_nl80211_set_key(const char *ifname, void *priv,
         */
        if (ret || !set_tx || alg == WPA_ALG_NONE)
                return ret;
-#ifdef HOSTAPD
-       if (addr)
-               return ret;
-#else /* HOSTAPD */
-       if (drv->nlmode == NL80211_IFTYPE_AP && addr)
+       if (drv->nlmode == NL80211_IFTYPE_AP && addr &&
+           !is_broadcast_ether_addr(addr))
                return ret;
-#endif /* HOSTAPD */
 
        msg = nlmsg_alloc();
        if (!msg)
@@ -2092,6 +2847,31 @@ static int wpa_driver_nl80211_set_key(const char *ifname, void *priv,
                NLA_PUT_FLAG(msg, NL80211_ATTR_KEY_DEFAULT_MGMT);
        else
                NLA_PUT_FLAG(msg, NL80211_ATTR_KEY_DEFAULT);
+       if (addr && is_broadcast_ether_addr(addr)) {
+               struct nl_msg *types;
+               int err;
+               types = nlmsg_alloc();
+               if (!types)
+                       goto nla_put_failure;
+               NLA_PUT_FLAG(types, NL80211_KEY_DEFAULT_TYPE_MULTICAST);
+               err = nla_put_nested(msg, NL80211_ATTR_KEY_DEFAULT_TYPES,
+                                    types);
+               nlmsg_free(types);
+               if (err)
+                       goto nla_put_failure;
+       } else if (addr) {
+               struct nl_msg *types;
+               int err;
+               types = nlmsg_alloc();
+               if (!types)
+                       goto nla_put_failure;
+               NLA_PUT_FLAG(types, NL80211_KEY_DEFAULT_TYPE_UNICAST);
+               err = nla_put_nested(msg, NL80211_ATTR_KEY_DEFAULT_TYPES,
+                                    types);
+               nlmsg_free(types);
+               if (err)
+                       goto nla_put_failure;
+       }
 
        ret = send_and_recv_msgs(drv, msg, NULL, NULL);
        if (ret == -ENOENT)
@@ -2172,6 +2952,12 @@ static int nl80211_set_conn_keys(struct wpa_driver_associate_params *params,
                privacy = 1;
                break;
        }
+       if (params->wps == WPS_MODE_PRIVACY)
+               privacy = 1;
+       if (params->pairwise_suite &&
+           params->pairwise_suite != WPA_CIPHER_NONE)
+               privacy = 1;
+
        if (!privacy)
                return 0;
 
@@ -2251,7 +3037,8 @@ nla_put_failure:
 static int wpa_driver_nl80211_disconnect(struct wpa_driver_nl80211_data *drv,
                                         const u8 *addr, int reason_code)
 {
-       wpa_printf(MSG_DEBUG, "%s", __func__);
+       wpa_printf(MSG_DEBUG, "%s(addr=" MACSTR " reason_code=%d)",
+                  __func__, MAC2STR(addr), reason_code);
        drv->associated = 0;
        return wpa_driver_nl80211_mlme(drv, addr, NL80211_CMD_DISCONNECT,
                                       reason_code, 0);
@@ -2265,8 +3052,11 @@ static int wpa_driver_nl80211_deauthenticate(void *priv, const u8 *addr,
        struct wpa_driver_nl80211_data *drv = bss->drv;
        if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME))
                return wpa_driver_nl80211_disconnect(drv, addr, reason_code);
-       wpa_printf(MSG_DEBUG, "%s", __func__);
+       wpa_printf(MSG_DEBUG, "%s(addr=" MACSTR " reason_code=%d)",
+                  __func__, MAC2STR(addr), reason_code);
        drv->associated = 0;
+       if (drv->nlmode == NL80211_IFTYPE_ADHOC)
+               return nl80211_leave_ibss(drv);
        return wpa_driver_nl80211_mlme(drv, addr, NL80211_CMD_DEAUTHENTICATE,
                                       reason_code, 0);
 }
@@ -2299,10 +3089,8 @@ static int wpa_driver_nl80211_authenticate(
        drv->associated = 0;
        os_memset(drv->auth_bssid, 0, ETH_ALEN);
        /* FIX: IBSS mode */
-       if (drv->nlmode != NL80211_IFTYPE_STATION)
-               wpa_driver_nl80211_set_mode(priv, IEEE80211_MODE_INFRA);
-
-       if (wpa_driver_nl80211_set_mode(priv, IEEE80211_MODE_INFRA) < 0)
+       if (drv->nlmode != NL80211_IFTYPE_STATION &&
+           wpa_driver_nl80211_set_mode(priv, IEEE80211_MODE_INFRA) < 0)
                return -1;
 
 retry:
@@ -2352,10 +3140,6 @@ retry:
        wpa_hexdump(MSG_DEBUG, "  * IEs", params->ie, params->ie_len);
        if (params->ie)
                NLA_PUT(msg, NL80211_ATTR_IE, params->ie_len, params->ie);
-       /*
-        * TODO: if multiple auth_alg options enabled, try them one by one if
-        * the AP rejects authentication due to unknown auth alg
-        */
        if (params->auth_alg & WPA_AUTH_ALG_OPEN)
                type = NL80211_AUTHTYPE_OPEN_SYSTEM;
        else if (params->auth_alg & WPA_AUTH_ALG_SHARED)
@@ -2656,6 +3440,154 @@ wpa_driver_nl80211_add_11b(struct hostapd_hw_modes *modes, u16 *num_modes)
 }
 
 
+static void nl80211_set_ht40_mode(struct hostapd_hw_modes *mode, int start,
+                                 int end)
+{
+       int c;
+
+       for (c = 0; c < mode->num_channels; c++) {
+               struct hostapd_channel_data *chan = &mode->channels[c];
+               if (chan->freq - 10 >= start && chan->freq + 10 <= end)
+                       chan->flag |= HOSTAPD_CHAN_HT40;
+       }
+}
+
+
+static void nl80211_set_ht40_mode_sec(struct hostapd_hw_modes *mode, int start,
+                                     int end)
+{
+       int c;
+
+       for (c = 0; c < mode->num_channels; c++) {
+               struct hostapd_channel_data *chan = &mode->channels[c];
+               if (!(chan->flag & HOSTAPD_CHAN_HT40))
+                       continue;
+               if (chan->freq - 30 >= start && chan->freq - 10 <= end)
+                       chan->flag |= HOSTAPD_CHAN_HT40MINUS;
+               if (chan->freq + 10 >= start && chan->freq + 30 <= end)
+                       chan->flag |= HOSTAPD_CHAN_HT40PLUS;
+       }
+}
+
+
+static void nl80211_reg_rule_ht40(struct nlattr *tb[],
+                                 struct phy_info_arg *results)
+{
+       u32 start, end, max_bw;
+       u16 m;
+
+       if (tb[NL80211_ATTR_FREQ_RANGE_START] == NULL ||
+           tb[NL80211_ATTR_FREQ_RANGE_END] == NULL ||
+           tb[NL80211_ATTR_FREQ_RANGE_MAX_BW] == NULL)
+               return;
+
+       start = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]) / 1000;
+       end = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]) / 1000;
+       max_bw = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]) / 1000;
+
+       wpa_printf(MSG_DEBUG, "nl80211: %u-%u @ %u MHz",
+                  start, end, max_bw);
+       if (max_bw < 40)
+               return;
+
+       for (m = 0; m < *results->num_modes; m++) {
+               if (!(results->modes[m].ht_capab &
+                     HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET))
+                       continue;
+               nl80211_set_ht40_mode(&results->modes[m], start, end);
+       }
+}
+
+
+static void nl80211_reg_rule_sec(struct nlattr *tb[],
+                                struct phy_info_arg *results)
+{
+       u32 start, end, max_bw;
+       u16 m;
+
+       if (tb[NL80211_ATTR_FREQ_RANGE_START] == NULL ||
+           tb[NL80211_ATTR_FREQ_RANGE_END] == NULL ||
+           tb[NL80211_ATTR_FREQ_RANGE_MAX_BW] == NULL)
+               return;
+
+       start = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]) / 1000;
+       end = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]) / 1000;
+       max_bw = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]) / 1000;
+
+       if (max_bw < 20)
+               return;
+
+       for (m = 0; m < *results->num_modes; m++) {
+               if (!(results->modes[m].ht_capab &
+                     HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET))
+                       continue;
+               nl80211_set_ht40_mode_sec(&results->modes[m], start, end);
+       }
+}
+
+
+static int nl80211_get_reg(struct nl_msg *msg, void *arg)
+{
+       struct phy_info_arg *results = arg;
+       struct nlattr *tb_msg[NL80211_ATTR_MAX + 1];
+       struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
+       struct nlattr *nl_rule;
+       struct nlattr *tb_rule[NL80211_FREQUENCY_ATTR_MAX + 1];
+       int rem_rule;
+       static struct nla_policy reg_policy[NL80211_FREQUENCY_ATTR_MAX + 1] = {
+               [NL80211_ATTR_REG_RULE_FLAGS] = { .type = NLA_U32 },
+               [NL80211_ATTR_FREQ_RANGE_START] = { .type = NLA_U32 },
+               [NL80211_ATTR_FREQ_RANGE_END] = { .type = NLA_U32 },
+               [NL80211_ATTR_FREQ_RANGE_MAX_BW] = { .type = NLA_U32 },
+               [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN] = { .type = NLA_U32 },
+               [NL80211_ATTR_POWER_RULE_MAX_EIRP] = { .type = NLA_U32 },
+       };
+
+       nla_parse(tb_msg, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
+                 genlmsg_attrlen(gnlh, 0), NULL);
+       if (!tb_msg[NL80211_ATTR_REG_ALPHA2] ||
+           !tb_msg[NL80211_ATTR_REG_RULES]) {
+               wpa_printf(MSG_DEBUG, "nl80211: No regulatory information "
+                          "available");
+               return NL_SKIP;
+       }
+
+       wpa_printf(MSG_DEBUG, "nl80211: Regulatory information - country=%s",
+                  (char *) nla_data(tb_msg[NL80211_ATTR_REG_ALPHA2]));
+
+       nla_for_each_nested(nl_rule, tb_msg[NL80211_ATTR_REG_RULES], rem_rule)
+       {
+               nla_parse(tb_rule, NL80211_FREQUENCY_ATTR_MAX,
+                         nla_data(nl_rule), nla_len(nl_rule), reg_policy);
+               nl80211_reg_rule_ht40(tb_rule, results);
+       }
+
+       nla_for_each_nested(nl_rule, tb_msg[NL80211_ATTR_REG_RULES], rem_rule)
+       {
+               nla_parse(tb_rule, NL80211_FREQUENCY_ATTR_MAX,
+                         nla_data(nl_rule), nla_len(nl_rule), reg_policy);
+               nl80211_reg_rule_sec(tb_rule, results);
+       }
+
+       return NL_SKIP;
+}
+
+
+static int nl80211_set_ht40_flags(struct wpa_driver_nl80211_data *drv,
+                                 struct phy_info_arg *results)
+{
+       struct nl_msg *msg;
+
+       msg = nlmsg_alloc();
+       if (!msg)
+               return -ENOMEM;
+
+       genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
+                   0, NL80211_CMD_GET_REG, 0);
+       return send_and_recv_msgs(drv, msg, nl80211_get_reg, results);
+}
+
+
 static struct hostapd_hw_modes *
 wpa_driver_nl80211_get_hw_feature_data(void *priv, u16 *num_modes, u16 *flags)
 {
@@ -2679,8 +3611,10 @@ wpa_driver_nl80211_get_hw_feature_data(void *priv, u16 *num_modes, u16 *flags)
 
        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
 
-       if (send_and_recv_msgs(drv, msg, phy_info_handler, &result) == 0)
+       if (send_and_recv_msgs(drv, msg, phy_info_handler, &result) == 0) {
+               nl80211_set_ht40_flags(drv, &result);
                return wpa_driver_nl80211_add_11b(result.modes, num_modes);
+       }
  nla_put_failure:
        return NULL;
 }
@@ -2718,11 +3652,23 @@ static int wpa_driver_nl80211_send_frame(struct wpa_driver_nl80211_data *drv,
                .msg_controllen = 0,
                .msg_flags = 0,
        };
+       int res;
 
        if (encrypt)
                rtap_hdr[8] |= IEEE80211_RADIOTAP_F_WEP;
 
-       return sendmsg(drv->monitor_sock, &msg, 0);
+       if (drv->monitor_sock < 0) {
+               wpa_printf(MSG_DEBUG, "nl80211: No monitor socket available "
+                          "for %s", __func__);
+               return -1;
+       }
+
+       res = sendmsg(drv->monitor_sock, &msg, 0);
+       if (res < 0) {
+               wpa_printf(MSG_INFO, "nl80211: sendmsg: %s", strerror(errno));
+               return -1;
+       }
+       return 0;
 }
 
 
@@ -2738,6 +3684,18 @@ static int wpa_driver_nl80211_send_mlme(void *priv, const u8 *data,
        mgmt = (struct ieee80211_mgmt *) data;
        fc = le_to_host16(mgmt->frame_control);
 
+       if (drv->nlmode == NL80211_IFTYPE_STATION &&
+           WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
+           WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_PROBE_RESP) {
+               /*
+                * The use of last_mgmt_freq is a bit of a hack,
+                * but it works due to the single-threaded nature
+                * of wpa_supplicant.
+                */
+               return nl80211_send_frame_cmd(drv, drv->last_mgmt_freq, 0,
+                                             data, data_len, NULL);
+       }
+
        if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
            WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_AUTH) {
                /*
@@ -2844,12 +3802,30 @@ nla_put_failure:
 }
 
 
+static u32 sta_flags_nl80211(int flags)
+{
+       u32 f = 0;
+
+       if (flags & WPA_STA_AUTHORIZED)
+               f |= BIT(NL80211_STA_FLAG_AUTHORIZED);
+       if (flags & WPA_STA_WMM)
+               f |= BIT(NL80211_STA_FLAG_WME);
+       if (flags & WPA_STA_SHORT_PREAMBLE)
+               f |= BIT(NL80211_STA_FLAG_SHORT_PREAMBLE);
+       if (flags & WPA_STA_MFP)
+               f |= BIT(NL80211_STA_FLAG_MFP);
+
+       return f;
+}
+
+
 static int wpa_driver_nl80211_sta_add(void *priv,
                                      struct hostapd_sta_add_params *params)
 {
        struct i802_bss *bss = priv;
        struct wpa_driver_nl80211_data *drv = bss->drv;
        struct nl_msg *msg;
+       struct nl80211_sta_flag_update upd;
        int ret = -ENOBUFS;
 
        msg = nlmsg_alloc();
@@ -2872,6 +3848,11 @@ static int wpa_driver_nl80211_sta_add(void *priv,
                        params->ht_capabilities);
        }
 
+       os_memset(&upd, 0, sizeof(upd));
+       upd.mask = sta_flags_nl80211(params->flags);
+       upd.set = upd.mask;
+       NLA_PUT(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd);
+
        ret = send_and_recv_msgs(drv, msg, NULL, NULL);
        if (ret)
                wpa_printf(MSG_DEBUG, "nl80211: NL80211_CMD_NEW_STATION "
@@ -3110,12 +4091,6 @@ static void handle_monitor_read(int sock, void *eloop_ctx, void *sock_ctx)
                return;
        }
 
-       if (drv->nlmode == NL80211_IFTYPE_STATION && !drv->probe_req_report) {
-               wpa_printf(MSG_DEBUG, "nl80211: Ignore monitor interface "
-                          "frame since Probe Request reporting is disabled");
-               return;
-       }
-
        if (ieee80211_radiotap_iterator_init(&iter, (void*)buf, len)) {
                printf("received invalid radiotap frame\n");
                return;
@@ -3209,8 +4184,15 @@ static struct sock_filter msock_filter_insns[] = {
         * add a filter here that filters on our DA and that flag
         * to allow us to deauth frames to that bad station.
         *
-        * Not a regression -- we didn't do it before either.
+        * For now allow all To DS data frames through.
         */
+       /* load the IEEE 802.11 frame control field */
+       BPF_STMT(BPF_LD  | BPF_H | BPF_IND, 0),
+       /* mask off frame type, version and DS status */
+       BPF_STMT(BPF_ALU | BPF_AND | BPF_K, 0x0F03),
+       /* accept frame if version 0, type 2 and To DS, fall through otherwise
+        */
+       BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x0801, PASS, 0),
 
 #if 0
        /*
@@ -3342,6 +4324,12 @@ nl80211_create_monitor_interface(struct wpa_driver_nl80211_data *drv)
                nl80211_create_iface(drv, buf, NL80211_IFTYPE_MONITOR, NULL,
                                     0);
 
+       if (drv->monitor_ifidx == -EOPNOTSUPP) {
+               wpa_printf(MSG_DEBUG, "nl80211: Driver does not support "
+                          "monitor interface type - try to run without it");
+               drv->no_monitor_iface_capab = 1;
+       }
+
        if (drv->monitor_ifidx < 0)
                return -1;
 
@@ -3393,7 +4381,7 @@ static const u8 rfc1042_header[6] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
 
 static int wpa_driver_nl80211_hapd_send_eapol(
        void *priv, const u8 *addr, const u8 *data,
-       size_t data_len, int encrypt, const u8 *own_addr)
+       size_t data_len, int encrypt, const u8 *own_addr, u32 flags)
 {
        struct i802_bss *bss = priv;
        struct wpa_driver_nl80211_data *drv = bss->drv;
@@ -3401,11 +4389,7 @@ static int wpa_driver_nl80211_hapd_send_eapol(
        size_t len;
        u8 *pos;
        int res;
-#if 0 /* FIX */
-       int qos = sta->flags & WPA_STA_WMM;
-#else
-       int qos = 0;
-#endif
+       int qos = flags & WPA_STA_WMM;
 
        len = sizeof(*hdr) + (qos ? 2 : 0) + sizeof(rfc1042_header) + 2 +
                data_len;
@@ -3421,26 +4405,22 @@ static int wpa_driver_nl80211_hapd_send_eapol(
        hdr->frame_control |= host_to_le16(WLAN_FC_FROMDS);
        if (encrypt)
                hdr->frame_control |= host_to_le16(WLAN_FC_ISWEP);
-#if 0 /* To be enabled if qos determination is added above */
        if (qos) {
                hdr->frame_control |=
                        host_to_le16(WLAN_FC_STYPE_QOS_DATA << 4);
        }
-#endif
 
        memcpy(hdr->IEEE80211_DA_FROMDS, addr, ETH_ALEN);
        memcpy(hdr->IEEE80211_BSSID_FROMDS, own_addr, ETH_ALEN);
        memcpy(hdr->IEEE80211_SA_FROMDS, own_addr, ETH_ALEN);
        pos = (u8 *) (hdr + 1);
 
-#if 0 /* To be enabled if qos determination is added above */
        if (qos) {
                /* add an empty QoS header if needed */
                pos[0] = 0;
                pos[1] = 0;
                pos += 2;
        }
-#endif
 
        memcpy(pos, rfc1042_header, sizeof(rfc1042_header));
        pos += sizeof(rfc1042_header);
@@ -3460,23 +4440,6 @@ static int wpa_driver_nl80211_hapd_send_eapol(
 }
 
 
-static u32 sta_flags_nl80211(int flags)
-{
-       u32 f = 0;
-
-       if (flags & WPA_STA_AUTHORIZED)
-               f |= BIT(NL80211_STA_FLAG_AUTHORIZED);
-       if (flags & WPA_STA_WMM)
-               f |= BIT(NL80211_STA_FLAG_WME);
-       if (flags & WPA_STA_SHORT_PREAMBLE)
-               f |= BIT(NL80211_STA_FLAG_SHORT_PREAMBLE);
-       if (flags & WPA_STA_MFP)
-               f |= BIT(NL80211_STA_FLAG_MFP);
-
-       return f;
-}
-
-
 static int wpa_driver_nl80211_sta_set_flags(void *priv, const u8 *addr,
                                            int total_flags,
                                            int flags_or, int flags_and)
@@ -3539,6 +4502,9 @@ static int wpa_driver_nl80211_sta_set_flags(void *priv, const u8 *addr,
 static int wpa_driver_nl80211_ap(struct wpa_driver_nl80211_data *drv,
                                 struct wpa_driver_associate_params *params)
 {
+       if (params->p2p)
+               wpa_printf(MSG_DEBUG, "nl80211: Setup AP operations for P2P "
+                          "group (GO)");
        if (wpa_driver_nl80211_set_mode(&drv->first_bss, params->mode) ||
            wpa_driver_nl80211_set_freq(drv, params->freq, 0, 0)) {
                nl80211_remove_monitor_interface(drv);
@@ -3662,6 +4628,7 @@ static int wpa_driver_nl80211_connect(
        struct nl_msg *msg;
        enum nl80211_auth_type type;
        int ret = 0;
+       int algs;
 
        msg = nlmsg_alloc();
        if (!msg)
@@ -3696,6 +4663,19 @@ static int wpa_driver_nl80211_connect(
                NLA_PUT(msg, NL80211_ATTR_IE, params->wpa_ie_len,
                        params->wpa_ie);
 
+       algs = 0;
+       if (params->auth_alg & WPA_AUTH_ALG_OPEN)
+               algs++;
+       if (params->auth_alg & WPA_AUTH_ALG_SHARED)
+               algs++;
+       if (params->auth_alg & WPA_AUTH_ALG_LEAP)
+               algs++;
+       if (algs > 1) {
+               wpa_printf(MSG_DEBUG, "  * Leave out Auth Type for automatic "
+                          "selection");
+               goto skip_auth_type;
+       }
+
        if (params->auth_alg & WPA_AUTH_ALG_OPEN)
                type = NL80211_AUTHTYPE_OPEN_SYSTEM;
        else if (params->auth_alg & WPA_AUTH_ALG_SHARED)
@@ -3710,6 +4690,7 @@ static int wpa_driver_nl80211_connect(
        wpa_printf(MSG_DEBUG, "  * Auth Type %d", type);
        NLA_PUT_U32(msg, NL80211_ATTR_AUTH_TYPE, type);
 
+skip_auth_type:
        if (params->wpa_ie && params->wpa_ie_len) {
                enum nl80211_wpa_versions ver;
 
@@ -3859,6 +4840,50 @@ static int wpa_driver_nl80211_associate(
                NLA_PUT(msg, NL80211_ATTR_IE, params->wpa_ie_len,
                        params->wpa_ie);
 
+       if (params->pairwise_suite != CIPHER_NONE) {
+               int cipher;
+
+               switch (params->pairwise_suite) {
+               case CIPHER_WEP40:
+                       cipher = WLAN_CIPHER_SUITE_WEP40;
+                       break;
+               case CIPHER_WEP104:
+                       cipher = WLAN_CIPHER_SUITE_WEP104;
+                       break;
+               case CIPHER_CCMP:
+                       cipher = WLAN_CIPHER_SUITE_CCMP;
+                       break;
+               case CIPHER_TKIP:
+               default:
+                       cipher = WLAN_CIPHER_SUITE_TKIP;
+                       break;
+               }
+               wpa_printf(MSG_DEBUG, "  * pairwise=0x%x", cipher);
+               NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITES_PAIRWISE, cipher);
+       }
+
+       if (params->group_suite != CIPHER_NONE) {
+               int cipher;
+
+               switch (params->group_suite) {
+               case CIPHER_WEP40:
+                       cipher = WLAN_CIPHER_SUITE_WEP40;
+                       break;
+               case CIPHER_WEP104:
+                       cipher = WLAN_CIPHER_SUITE_WEP104;
+                       break;
+               case CIPHER_CCMP:
+                       cipher = WLAN_CIPHER_SUITE_CCMP;
+                       break;
+               case CIPHER_TKIP:
+               default:
+                       cipher = WLAN_CIPHER_SUITE_TKIP;
+                       break;
+               }
+               wpa_printf(MSG_DEBUG, "  * group=0x%x", cipher);
+               NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP, cipher);
+       }
+
 #ifdef CONFIG_IEEE80211W
        if (params->mgmt_frame_protection == MGMT_FRAME_PROTECTION_REQUIRED)
                NLA_PUT_U32(msg, NL80211_ATTR_USE_MFP, NL80211_MFP_REQUIRED);
@@ -3873,6 +4898,9 @@ static int wpa_driver_nl80211_associate(
                        params->prev_bssid);
        }
 
+       if (params->p2p)
+               wpa_printf(MSG_DEBUG, "  * P2P group");
+
        ret = send_and_recv_msgs(drv, msg, NULL, NULL);
        msg = NULL;
        if (ret) {
@@ -3922,6 +4950,7 @@ static int wpa_driver_nl80211_set_mode(void *priv, int mode)
        struct wpa_driver_nl80211_data *drv = bss->drv;
        int ret = -1;
        int nlmode;
+       int i;
 
        switch (mode) {
        case 0:
@@ -3954,11 +4983,23 @@ static int wpa_driver_nl80211_set_mode(void *priv, int mode)
         * take the device down, try to set the mode again, and bring the
         * device back up.
         */
-       if (linux_set_iface_flags(drv->ioctl_sock, bss->ifname, 0) == 0) {
-               /* Try to set the mode again while the interface is down */
-               ret = nl80211_set_mode(drv, drv->ifindex, nlmode);
-               if (linux_set_iface_flags(drv->ioctl_sock, bss->ifname, 1))
-                       ret = -1;
+       wpa_printf(MSG_DEBUG, "nl80211: Try mode change after setting "
+                  "interface down");
+       for (i = 0; i < 10; i++) {
+               if (linux_set_iface_flags(drv->ioctl_sock, bss->ifname, 0) ==
+                   0) {
+                       /* Try to set the mode again while the interface is
+                        * down */
+                       ret = nl80211_set_mode(drv, drv->ifindex, nlmode);
+                       if (linux_set_iface_flags(drv->ioctl_sock, bss->ifname,
+                                                 1))
+                               ret = -1;
+                       if (!ret)
+                               break;
+               } else
+                       wpa_printf(MSG_DEBUG, "nl80211: Failed to set "
+                                  "interface down");
+               os_sleep(0, 100000);
        }
 
        if (!ret) {
@@ -3970,8 +5011,9 @@ static int wpa_driver_nl80211_set_mode(void *priv, int mode)
 done:
        if (!ret && nlmode == NL80211_IFTYPE_AP) {
                /* Setup additional AP mode functionality if needed */
-               if (drv->monitor_ifidx < 0 &&
-                   nl80211_create_monitor_interface(drv))
+               if (!drv->no_monitor_iface_capab && drv->monitor_ifidx < 0 &&
+                   nl80211_create_monitor_interface(drv) &&
+                   !drv->no_monitor_iface_capab)
                        return -1;
        } else if (!ret && nlmode != NL80211_IFTYPE_AP) {
                /* Remove additional AP mode functionality */
@@ -4042,68 +5084,17 @@ static int wpa_driver_nl80211_set_supp_port(void *priv, int authorized)
 }
 
 
-#ifdef HOSTAPD
-
-static void add_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
-{
-       int i;
-       int *old;
-
-       wpa_printf(MSG_DEBUG, "nl80211: Add own interface ifindex %d",
-                  ifidx);
-       for (i = 0; i < drv->num_if_indices; i++) {
-               if (drv->if_indices[i] == 0) {
-                       drv->if_indices[i] = ifidx;
-                       return;
-               }
-       }
-
-       if (drv->if_indices != drv->default_if_indices)
-               old = drv->if_indices;
-       else
-               old = NULL;
-
-       drv->if_indices = os_realloc(old,
-                                    sizeof(int) * (drv->num_if_indices + 1));
-       if (!drv->if_indices) {
-               if (!old)
-                       drv->if_indices = drv->default_if_indices;
-               else
-                       drv->if_indices = old;
-               wpa_printf(MSG_ERROR, "Failed to reallocate memory for "
-                          "interfaces");
-               wpa_printf(MSG_ERROR, "Ignoring EAPOL on interface %d", ifidx);
-               return;
-       }
-       drv->if_indices[drv->num_if_indices] = ifidx;
-       drv->num_if_indices++;
-}
-
-
-static void del_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
+/* Set kernel driver on given frequency (MHz) */
+static int i802_set_freq(void *priv, struct hostapd_freq_params *freq)
 {
-       int i;
-
-       for (i = 0; i < drv->num_if_indices; i++) {
-               if (drv->if_indices[i] == ifidx) {
-                       drv->if_indices[i] = 0;
-                       break;
-               }
-       }
+       struct i802_bss *bss = priv;
+       struct wpa_driver_nl80211_data *drv = bss->drv;
+       return wpa_driver_nl80211_set_freq(drv, freq->freq, freq->ht_enabled,
+                                          freq->sec_channel_offset);
 }
 
 
-static int have_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
-{
-       int i;
-
-       for (i = 0; i < drv->num_if_indices; i++)
-               if (drv->if_indices[i] == ifidx)
-                       return 1;
-
-       return 0;
-}
-
+#if defined(HOSTAPD) || defined(CONFIG_AP)
 
 static inline int min_int(int a, int b)
 {
@@ -4191,16 +5182,6 @@ static int i802_set_rate_sets(void *priv, int *supp_rates, int *basic_rates,
 }
 
 
-/* Set kernel driver on given frequency (MHz) */
-static int i802_set_freq(void *priv, struct hostapd_freq_params *freq)
-{
-       struct i802_bss *bss = priv;
-       struct wpa_driver_nl80211_data *drv = bss->drv;
-       return wpa_driver_nl80211_set_freq(drv, freq->freq, freq->ht_enabled,
-                                          freq->sec_channel_offset);
-}
-
-
 static int i802_set_rts(void *priv, int rts)
 {
        struct i802_bss *bss = priv;
@@ -4391,7 +5372,20 @@ static int i802_set_tx_queue_params(void *priv, int queue, int aifs,
        if (!params)
                goto nla_put_failure;
 
-       NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, queue);
+       switch (queue) {
+       case 0:
+               NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_VO);
+               break;
+       case 1:
+               NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_VI);
+               break;
+       case 2:
+               NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_BE);
+               break;
+       case 3:
+               NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_BK);
+               break;
+       }
        /* Burst time is configured in units of 0.1 msec and TXOP parameter in
         * 32 usec, so need to convert the value here. */
        NLA_PUT_U16(msg, NL80211_TXQ_ATTR_TXOP, (burst_time * 100 + 16) / 32);
@@ -4410,7 +5404,8 @@ static int i802_set_tx_queue_params(void *priv, int queue, int aifs,
 }
 
 
-static int i802_set_bss(void *priv, int cts, int preamble, int slot)
+static int i802_set_bss(void *priv, int cts, int preamble, int slot,
+                       int ht_opmode)
 {
        struct i802_bss *bss = priv;
        struct wpa_driver_nl80211_data *drv = bss->drv;
@@ -4429,7 +5424,8 @@ static int i802_set_bss(void *priv, int cts, int preamble, int slot)
                NLA_PUT_U8(msg, NL80211_ATTR_BSS_SHORT_PREAMBLE, preamble);
        if (slot >= 0)
                NLA_PUT_U8(msg, NL80211_ATTR_BSS_SHORT_SLOT_TIME, slot);
-
+       if (ht_opmode >= 0)
+               NLA_PUT_U16(msg, NL80211_ATTR_BSS_HT_OPMODE, ht_opmode);
        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
 
        return send_and_recv_msgs(drv, msg, NULL, NULL);
@@ -4440,19 +5436,19 @@ static int i802_set_bss(void *priv, int cts, int preamble, int slot)
 
 static int i802_set_cts_protect(void *priv, int value)
 {
-       return i802_set_bss(priv, value, -1, -1);
+       return i802_set_bss(priv, value, -1, -1, -1);
 }
 
 
 static int i802_set_preamble(void *priv, int value)
 {
-       return i802_set_bss(priv, -1, value, -1);
+       return i802_set_bss(priv, -1, value, -1, -1);
 }
 
 
 static int i802_set_short_slot_time(void *priv, int value)
 {
-       return i802_set_bss(priv, -1, -1, value);
+       return i802_set_bss(priv, -1, -1, value, -1);
 }
 
 
@@ -4462,6 +5458,7 @@ static int i802_set_sta_vlan(void *priv, const u8 *addr,
        struct i802_bss *bss = priv;
        struct wpa_driver_nl80211_data *drv = bss->drv;
        struct nl_msg *msg;
+       int ret = -ENOBUFS;
 
        msg = nlmsg_alloc();
        if (!msg)
@@ -4476,52 +5473,28 @@ static int i802_set_sta_vlan(void *priv, const u8 *addr,
        NLA_PUT_U32(msg, NL80211_ATTR_STA_VLAN,
                    if_nametoindex(ifname));
 
-       return send_and_recv_msgs(drv, msg, NULL, NULL);
- nla_put_failure:
-       return -ENOBUFS;
-}
-
-
-static int i802_set_wds_sta(void *priv, const u8 *addr, int aid, int val)
-{
-       struct i802_bss *bss = priv;
-       struct wpa_driver_nl80211_data *drv = bss->drv;
-       char name[IFNAMSIZ + 1];
-
-       os_snprintf(name, sizeof(name), "%s.sta%d", bss->ifname, aid);
-       wpa_printf(MSG_DEBUG, "nl80211: Set WDS STA addr=" MACSTR
-                  " aid=%d val=%d name=%s", MAC2STR(addr), aid, val, name);
-       if (val) {
-               if (nl80211_create_iface(drv, name, NL80211_IFTYPE_AP_VLAN,
-                                        NULL, 1) < 0)
-                       return -1;
-               linux_set_iface_flags(drv->ioctl_sock, name, 1);
-               return i802_set_sta_vlan(priv, addr, name, 0);
-       } else {
-               i802_set_sta_vlan(priv, addr, bss->ifname, 0);
-               return wpa_driver_nl80211_if_remove(priv, WPA_IF_AP_VLAN,
-                                                   name);
+       ret = send_and_recv_msgs(drv, msg, NULL, NULL);
+       if (ret < 0) {
+               wpa_printf(MSG_ERROR, "nl80211: NL80211_ATTR_STA_VLAN (addr="
+                          MACSTR " ifname=%s vlan_id=%d) failed: %d (%s)",
+                          MAC2STR(addr), ifname, vlan_id, ret,
+                          strerror(-ret));
        }
+ nla_put_failure:
+       return ret;
 }
 
 
-static void handle_eapol(int sock, void *eloop_ctx, void *sock_ctx)
+static int i802_set_ht_params(void *priv, const u8 *ht_capab,
+                             size_t ht_capab_len, const u8 *ht_oper,
+                             size_t ht_oper_len)
 {
-       struct wpa_driver_nl80211_data *drv = eloop_ctx;
-       struct sockaddr_ll lladdr;
-       unsigned char buf[3000];
-       int len;
-       socklen_t fromlen = sizeof(lladdr);
-
-       len = recvfrom(sock, buf, sizeof(buf), 0,
-                      (struct sockaddr *)&lladdr, &fromlen);
-       if (len < 0) {
-               perror("recv");
-               return;
-       }
-
-       if (have_ifidx(drv, lladdr.sll_ifindex))
-               drv_event_eapol_rx(drv->ctx, lladdr.sll_addr, buf, len);
+       if (ht_oper_len >= 6) {
+               /* ht opmode uses 16bit in octet 5 & 6 */
+               u16 ht_opmode = le_to_host16(((u16 *) ht_oper)[2]);
+               return i802_set_bss(priv, -1, -1, -1, ht_opmode);
+       } else
+               return -1;
 }
 
 
@@ -4584,46 +5557,164 @@ static int i802_sta_disassoc(void *priv, const u8 *own_addr, const u8 *addr,
                                            sizeof(mgmt.u.disassoc));
 }
 
+#endif /* HOSTAPD || CONFIG_AP */
 
-static int i802_check_bridge(struct wpa_driver_nl80211_data *drv,
-                            const char *brname, const char *ifname)
+#ifdef HOSTAPD
+
+static void add_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
 {
-       int ifindex;
-       char in_br[IFNAMSIZ];
+       int i;
+       int *old;
 
-       os_strlcpy(drv->brname, brname, IFNAMSIZ);
-       ifindex = if_nametoindex(brname);
-       if (ifindex == 0) {
-               /*
-                * Bridge was configured, but the bridge device does
-                * not exist. Try to add it now.
-                */
-               if (linux_br_add(drv->ioctl_sock, brname) < 0) {
-                       wpa_printf(MSG_ERROR, "nl80211: Failed to add the "
-                                  "bridge interface %s: %s",
-                                  brname, strerror(errno));
-                       return -1;
+       wpa_printf(MSG_DEBUG, "nl80211: Add own interface ifindex %d",
+                  ifidx);
+       for (i = 0; i < drv->num_if_indices; i++) {
+               if (drv->if_indices[i] == 0) {
+                       drv->if_indices[i] = ifidx;
+                       return;
                }
-               drv->added_bridge = 1;
-               add_ifidx(drv, if_nametoindex(brname));
        }
 
-       if (linux_br_get(in_br, ifname) == 0) {
-               if (os_strcmp(in_br, brname) == 0)
-                       return 0; /* already in the bridge */
+       if (drv->if_indices != drv->default_if_indices)
+               old = drv->if_indices;
+       else
+               old = NULL;
 
-               wpa_printf(MSG_DEBUG, "nl80211: Removing interface %s from "
-                          "bridge %s", ifname, in_br);
-               if (linux_br_del_if(drv->ioctl_sock, in_br, ifname) < 0) {
-                       wpa_printf(MSG_ERROR, "nl80211: Failed to "
-                                  "remove interface %s from bridge "
-                                  "%s: %s",
-                                  ifname, brname, strerror(errno));
-                       return -1;
-               }
-       }
+       drv->if_indices = os_realloc(old,
+                                    sizeof(int) * (drv->num_if_indices + 1));
+       if (!drv->if_indices) {
+               if (!old)
+                       drv->if_indices = drv->default_if_indices;
+               else
+                       drv->if_indices = old;
+               wpa_printf(MSG_ERROR, "Failed to reallocate memory for "
+                          "interfaces");
+               wpa_printf(MSG_ERROR, "Ignoring EAPOL on interface %d", ifidx);
+               return;
+       } else if (!old)
+               os_memcpy(drv->if_indices, drv->default_if_indices,
+                         sizeof(drv->default_if_indices));
+       drv->if_indices[drv->num_if_indices] = ifidx;
+       drv->num_if_indices++;
+}
 
-       wpa_printf(MSG_DEBUG, "nl80211: Adding interface %s into bridge %s",
+
+static void del_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
+{
+       int i;
+
+       for (i = 0; i < drv->num_if_indices; i++) {
+               if (drv->if_indices[i] == ifidx) {
+                       drv->if_indices[i] = 0;
+                       break;
+               }
+       }
+}
+
+
+static int have_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
+{
+       int i;
+
+       for (i = 0; i < drv->num_if_indices; i++)
+               if (drv->if_indices[i] == ifidx)
+                       return 1;
+
+       return 0;
+}
+
+
+static int i802_set_wds_sta(void *priv, const u8 *addr, int aid, int val,
+                            const char *bridge_ifname)
+{
+       struct i802_bss *bss = priv;
+       struct wpa_driver_nl80211_data *drv = bss->drv;
+       char name[IFNAMSIZ + 1];
+
+       os_snprintf(name, sizeof(name), "%s.sta%d", bss->ifname, aid);
+       wpa_printf(MSG_DEBUG, "nl80211: Set WDS STA addr=" MACSTR
+                  " aid=%d val=%d name=%s", MAC2STR(addr), aid, val, name);
+       if (val) {
+               if (!if_nametoindex(name)) {
+                       if (nl80211_create_iface(drv, name,
+                                                NL80211_IFTYPE_AP_VLAN,
+                                                NULL, 1) < 0)
+                               return -1;
+                       if (bridge_ifname &&
+                           linux_br_add_if(drv->ioctl_sock, bridge_ifname,
+                                           name) < 0)
+                               return -1;
+               }
+               linux_set_iface_flags(drv->ioctl_sock, name, 1);
+               return i802_set_sta_vlan(priv, addr, name, 0);
+       } else {
+               i802_set_sta_vlan(priv, addr, bss->ifname, 0);
+               return wpa_driver_nl80211_if_remove(priv, WPA_IF_AP_VLAN,
+                                                   name);
+       }
+}
+
+
+static void handle_eapol(int sock, void *eloop_ctx, void *sock_ctx)
+{
+       struct wpa_driver_nl80211_data *drv = eloop_ctx;
+       struct sockaddr_ll lladdr;
+       unsigned char buf[3000];
+       int len;
+       socklen_t fromlen = sizeof(lladdr);
+
+       len = recvfrom(sock, buf, sizeof(buf), 0,
+                      (struct sockaddr *)&lladdr, &fromlen);
+       if (len < 0) {
+               perror("recv");
+               return;
+       }
+
+       if (have_ifidx(drv, lladdr.sll_ifindex))
+               drv_event_eapol_rx(drv->ctx, lladdr.sll_addr, buf, len);
+}
+
+
+static int i802_check_bridge(struct wpa_driver_nl80211_data *drv,
+                            struct i802_bss *bss,
+                            const char *brname, const char *ifname)
+{
+       int ifindex;
+       char in_br[IFNAMSIZ];
+
+       os_strlcpy(bss->brname, brname, IFNAMSIZ);
+       ifindex = if_nametoindex(brname);
+       if (ifindex == 0) {
+               /*
+                * Bridge was configured, but the bridge device does
+                * not exist. Try to add it now.
+                */
+               if (linux_br_add(drv->ioctl_sock, brname) < 0) {
+                       wpa_printf(MSG_ERROR, "nl80211: Failed to add the "
+                                  "bridge interface %s: %s",
+                                  brname, strerror(errno));
+                       return -1;
+               }
+               bss->added_bridge = 1;
+               add_ifidx(drv, if_nametoindex(brname));
+       }
+
+       if (linux_br_get(in_br, ifname) == 0) {
+               if (os_strcmp(in_br, brname) == 0)
+                       return 0; /* already in the bridge */
+
+               wpa_printf(MSG_DEBUG, "nl80211: Removing interface %s from "
+                          "bridge %s", ifname, in_br);
+               if (linux_br_del_if(drv->ioctl_sock, in_br, ifname) < 0) {
+                       wpa_printf(MSG_ERROR, "nl80211: Failed to "
+                                  "remove interface %s from bridge "
+                                  "%s: %s",
+                                  ifname, brname, strerror(errno));
+                       return -1;
+               }
+       }
+
+       wpa_printf(MSG_DEBUG, "nl80211: Adding interface %s into bridge %s",
                   ifname, brname);
        if (linux_br_add_if(drv->ioctl_sock, brname, ifname) < 0) {
                wpa_printf(MSG_ERROR, "nl80211: Failed to add interface %s "
@@ -4631,7 +5722,7 @@ static int i802_check_bridge(struct wpa_driver_nl80211_data *drv,
                           ifname, brname, strerror(errno));
                return -1;
        }
-       drv->added_if_into_bridge = 1;
+       bss->added_if_into_bridge = 1;
 
        return 0;
 }
@@ -4647,11 +5738,12 @@ static void *i802_init(struct hostapd_data *hapd,
        int ifindex, br_ifindex;
        int br_added = 0;
 
-       bss = wpa_driver_nl80211_init(hapd, params->ifname);
+       bss = wpa_driver_nl80211_init(hapd, params->ifname, NULL);
        if (bss == NULL)
                return NULL;
 
        drv = bss->drv;
+       drv->nlmode = NL80211_IFTYPE_AP;
        if (linux_br_get(brname, params->ifname) == 0) {
                wpa_printf(MSG_DEBUG, "nl80211: Interface %s is in bridge %s",
                           params->ifname, brname);
@@ -4695,7 +5787,7 @@ static void *i802_init(struct hostapd_data *hapd,
        }
 
        if (params->num_bridge && params->bridge[0] &&
-           i802_check_bridge(drv, params->bridge[0], params->ifname) < 0)
+           i802_check_bridge(drv, bss, params->bridge[0], params->ifname) < 0)
                goto failed;
 
        if (linux_set_iface_flags(drv->ioctl_sock, bss->ifname, 1))
@@ -4720,13 +5812,16 @@ static void *i802_init(struct hostapd_data *hapd,
 
 failed:
        nl80211_remove_monitor_interface(drv);
+       rfkill_deinit(drv->rfkill);
+       netlink_deinit(drv->netlink);
        if (drv->ioctl_sock >= 0)
                close(drv->ioctl_sock);
 
        genl_family_put(drv->nl80211);
        nl_cache_free(drv->nl_cache);
-       nl_handle_destroy(drv->nl_handle);
+       nl80211_handle_destroy(drv->nl_handle);
        nl_cb_put(drv->nl_cb);
+       eloop_unregister_read_sock(nl_socket_get_fd(drv->nl_handle_event));
 
        os_free(drv);
        return NULL;
@@ -4747,19 +5842,66 @@ static enum nl80211_iftype wpa_driver_nl80211_if_type(
        switch (type) {
        case WPA_IF_STATION:
                return NL80211_IFTYPE_STATION;
+       case WPA_IF_P2P_CLIENT:
+       case WPA_IF_P2P_GROUP:
+               return NL80211_IFTYPE_P2P_CLIENT;
        case WPA_IF_AP_VLAN:
                return NL80211_IFTYPE_AP_VLAN;
        case WPA_IF_AP_BSS:
                return NL80211_IFTYPE_AP;
+       case WPA_IF_P2P_GO:
+               return NL80211_IFTYPE_P2P_GO;
        }
        return -1;
 }
 
 
+#ifdef CONFIG_P2P
+
+static int nl80211_addr_in_use(struct nl80211_global *global, const u8 *addr)
+{
+       struct wpa_driver_nl80211_data *drv;
+       dl_list_for_each(drv, &global->interfaces,
+                        struct wpa_driver_nl80211_data, list) {
+               if (os_memcmp(addr, drv->addr, ETH_ALEN) == 0)
+                       return 1;
+       }
+       return 0;
+}
+
+
+static int nl80211_p2p_interface_addr(struct wpa_driver_nl80211_data *drv,
+                                     u8 *new_addr)
+{
+       unsigned int idx;
+
+       if (!drv->global)
+               return -1;
+
+       os_memcpy(new_addr, drv->addr, ETH_ALEN);
+       for (idx = 0; idx < 64; idx++) {
+               new_addr[0] = drv->addr[0] | 0x02;
+               new_addr[0] ^= idx << 2;
+               if (!nl80211_addr_in_use(drv->global, new_addr))
+                       break;
+       }
+       if (idx == 64)
+               return -1;
+
+       wpa_printf(MSG_DEBUG, "nl80211: Assigned new P2P Interface Address "
+                  MACSTR, MAC2STR(new_addr));
+
+       return 0;
+}
+
+#endif /* CONFIG_P2P */
+
+
 static int wpa_driver_nl80211_if_add(void *priv, enum wpa_driver_if_type type,
                                     const char *ifname, const u8 *addr,
                                     void *bss_ctx, void **drv_priv,
-                                    char *force_ifname, u8 *if_addr)
+                                    char *force_ifname, u8 *if_addr,
+                                    const char *bridge)
 {
        struct i802_bss *bss = priv;
        struct wpa_driver_nl80211_data *drv = bss->drv;
@@ -4787,10 +5929,52 @@ static int wpa_driver_nl80211_if_add(void *priv, enum wpa_driver_if_type type,
        }
 
        if (!addr &&
-           linux_get_ifhwaddr(drv->ioctl_sock, bss->ifname, if_addr) < 0)
+           linux_get_ifhwaddr(drv->ioctl_sock, bss->ifname, if_addr) < 0) {
+               nl80211_remove_iface(drv, ifidx);
                return -1;
+       }
+
+#ifdef CONFIG_P2P
+       if (!addr &&
+           (type == WPA_IF_P2P_CLIENT || type == WPA_IF_P2P_GROUP ||
+            type == WPA_IF_P2P_GO)) {
+               /* Enforce unique P2P Interface Address */
+               u8 new_addr[ETH_ALEN], own_addr[ETH_ALEN];
+
+               if (linux_get_ifhwaddr(drv->ioctl_sock, bss->ifname, own_addr)
+                   < 0 ||
+                   linux_get_ifhwaddr(drv->ioctl_sock, ifname, new_addr) < 0)
+               {
+                       nl80211_remove_iface(drv, ifidx);
+                       return -1;
+               }
+               if (os_memcmp(own_addr, new_addr, ETH_ALEN) == 0) {
+                       wpa_printf(MSG_DEBUG, "nl80211: Allocate new address "
+                                  "for P2P group interface");
+                       if (nl80211_p2p_interface_addr(drv, new_addr) < 0) {
+                               nl80211_remove_iface(drv, ifidx);
+                               return -1;
+                       }
+                       if (linux_set_ifhwaddr(drv->ioctl_sock, ifname,
+                                              new_addr) < 0) {
+                               nl80211_remove_iface(drv, ifidx);
+                               return -1;
+                       }
+                       os_memcpy(if_addr, new_addr, ETH_ALEN);
+               }
+       }
+#endif /* CONFIG_P2P */
 
 #ifdef HOSTAPD
+       if (bridge &&
+           i802_check_bridge(drv, new_bss, bridge, ifname) < 0) {
+               wpa_printf(MSG_ERROR, "nl80211: Failed to add the new "
+                          "interface %s to a bridge %s", ifname, bridge);
+               nl80211_remove_iface(drv, ifidx);
+               os_free(new_bss);
+               return -1;
+       }
+
        if (type == WPA_IF_AP_BSS) {
                if (linux_set_iface_flags(drv->ioctl_sock, ifname, 1)) {
                        nl80211_remove_iface(drv, ifidx);
@@ -4823,6 +6007,23 @@ static int wpa_driver_nl80211_if_remove(void *priv,
                   __func__, type, ifname, ifindex);
        if (ifindex <= 0)
                return -1;
+
+#ifdef HOSTAPD
+       if (bss->added_if_into_bridge) {
+               if (linux_br_del_if(drv->ioctl_sock, bss->brname, bss->ifname)
+                   < 0)
+                       wpa_printf(MSG_INFO, "nl80211: Failed to remove "
+                                  "interface %s from bridge %s: %s",
+                                  bss->ifname, bss->brname, strerror(errno));
+       }
+       if (bss->added_bridge) {
+               if (linux_br_del(drv->ioctl_sock, bss->brname) < 0)
+                       wpa_printf(MSG_INFO, "nl80211: Failed to remove "
+                                  "bridge %s: %s",
+                                  bss->brname, strerror(errno));
+       }
+#endif /* HOSTAPD */
+
        nl80211_remove_iface(drv, ifindex);
 
 #ifdef HOSTAPD
@@ -4830,16 +6031,19 @@ static int wpa_driver_nl80211_if_remove(void *priv,
                return 0;
 
        if (bss != &drv->first_bss) {
-               struct i802_bss *tbss = &drv->first_bss;
+               struct i802_bss *tbss;
 
-               while (tbss) {
-                       if (tbss->next != bss)
-                               continue;
-
-                       tbss->next = bss->next;
-                       os_free(bss);
-                       break;
+               for (tbss = &drv->first_bss; tbss; tbss = tbss->next) {
+                       if (tbss->next == bss) {
+                               tbss->next = bss->next;
+                               os_free(bss);
+                               bss = NULL;
+                               break;
+                       }
                }
+               if (bss)
+                       wpa_printf(MSG_INFO, "nl80211: %s - could not find "
+                                  "BSS %p in the list", __func__, bss);
        }
 #endif /* HOSTAPD */
 
@@ -4860,7 +6064,50 @@ static int cookie_handler(struct nl_msg *msg, void *arg)
 }
 
 
+static int nl80211_send_frame_cmd(struct wpa_driver_nl80211_data *drv,
+                                 unsigned int freq, unsigned int wait,
+                                 const u8 *buf, size_t buf_len,
+                                 u64 *cookie_out)
+{
+       struct nl_msg *msg;
+       u64 cookie;
+       int ret = -1;
+
+       msg = nlmsg_alloc();
+       if (!msg)
+               return -1;
+
+       genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
+                   NL80211_CMD_FRAME, 0);
+
+       NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
+       NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
+       NLA_PUT_U32(msg, NL80211_ATTR_DURATION, wait);
+       NLA_PUT_FLAG(msg, NL80211_ATTR_OFFCHANNEL_TX_OK);
+       NLA_PUT(msg, NL80211_ATTR_FRAME, buf_len, buf);
+
+       cookie = 0;
+       ret = send_and_recv_msgs(drv, msg, cookie_handler, &cookie);
+       msg = NULL;
+       if (ret) {
+               wpa_printf(MSG_DEBUG, "nl80211: Frame command failed: ret=%d "
+                          "(%s)", ret, strerror(-ret));
+               goto nla_put_failure;
+       }
+       wpa_printf(MSG_DEBUG, "nl80211: Frame TX command accepted; "
+                  "cookie 0x%llx", (long long unsigned int) cookie);
+
+       if (cookie_out)
+               *cookie_out = cookie;
+
+nla_put_failure:
+       nlmsg_free(msg);
+       return ret;
+}
+
+
 static int wpa_driver_nl80211_send_action(void *priv, unsigned int freq,
+                                         unsigned int wait_time,
                                          const u8 *dst, const u8 *src,
                                          const u8 *bssid,
                                          const u8 *data, size_t data_len)
@@ -4868,13 +6115,11 @@ static int wpa_driver_nl80211_send_action(void *priv, unsigned int freq,
        struct i802_bss *bss = priv;
        struct wpa_driver_nl80211_data *drv = bss->drv;
        int ret = -1;
-       struct nl_msg *msg;
        u8 *buf;
        struct ieee80211_hdr *hdr;
-       u64 cookie;
 
-       wpa_printf(MSG_DEBUG, "nl80211: Send Action frame (ifindex=%d)",
-                  drv->ifindex);
+       wpa_printf(MSG_DEBUG, "nl80211: Send Action frame (ifindex=%d, "
+                  "wait=%d ms)", drv->ifindex, wait_time);
 
        buf = os_zalloc(24 + data_len);
        if (buf == NULL)
@@ -4887,45 +6132,43 @@ static int wpa_driver_nl80211_send_action(void *priv, unsigned int freq,
        os_memcpy(hdr->addr2, src, ETH_ALEN);
        os_memcpy(hdr->addr3, bssid, ETH_ALEN);
 
-       if (drv->nlmode == NL80211_IFTYPE_AP) {
+       if (drv->nlmode == NL80211_IFTYPE_AP)
                ret = wpa_driver_nl80211_send_mlme(priv, buf, 24 + data_len);
-               os_free(buf);
-               return ret;
-       }
+       else
+               ret = nl80211_send_frame_cmd(drv, freq, wait_time, buf,
+                                            24 + data_len,
+                                            &drv->send_action_cookie);
+
+       os_free(buf);
+       return ret;
+}
+
+
+static void wpa_driver_nl80211_send_action_cancel_wait(void *priv)
+{
+       struct i802_bss *bss = priv;
+       struct wpa_driver_nl80211_data *drv = bss->drv;
+       struct nl_msg *msg;
+       int ret;
 
        msg = nlmsg_alloc();
-       if (!msg) {
-               os_free(buf);
-               return -1;
-       }
+       if (!msg)
+               return;
 
        genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
-                   NL80211_CMD_ACTION, 0);
+                   NL80211_CMD_FRAME_WAIT_CANCEL, 0);
 
        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
-       NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
-       NLA_PUT(msg, NL80211_ATTR_FRAME, 24 + data_len, buf);
-       os_free(buf);
-       buf = NULL;
+       NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, drv->send_action_cookie);
 
-       cookie = 0;
-       ret = send_and_recv_msgs(drv, msg, cookie_handler, &cookie);
+       ret = send_and_recv_msgs(drv, msg, NULL, NULL);
        msg = NULL;
-       if (ret) {
-               wpa_printf(MSG_DEBUG, "nl80211: Action command failed: ret=%d "
+       if (ret)
+               wpa_printf(MSG_DEBUG, "nl80211: wait cancel failed: ret=%d "
                           "(%s)", ret, strerror(-ret));
-               goto nla_put_failure;
-       }
-       wpa_printf(MSG_DEBUG, "nl80211: Action TX command accepted; "
-                  "cookie 0x%llx", (long long unsigned int) cookie);
-       drv->send_action_cookie = cookie;
-       drv->pending_send_action = 1;
-       ret = 0;
 
-nla_put_failure:
-       os_free(buf);
+ nla_put_failure:
        nlmsg_free(msg);
-       return ret;
 }
 
 
@@ -4959,7 +6202,8 @@ static int wpa_driver_nl80211_remain_on_channel(void *priv, unsigned int freq,
                return 0;
        }
        wpa_printf(MSG_DEBUG, "nl80211: Failed to request remain-on-channel "
-                  "(freq=%d): %d (%s)", freq, ret, strerror(-ret));
+                  "(freq=%d duration=%u): %d (%s)",
+                  freq, duration, ret, strerror(-ret));
 nla_put_failure:
        return -1;
 }
@@ -5002,25 +6246,6 @@ nla_put_failure:
 }
 
 
-static void wpa_driver_nl80211_probe_req_report_timeout(void *eloop_ctx,
-                                                       void *timeout_ctx)
-{
-       struct wpa_driver_nl80211_data *drv = eloop_ctx;
-       if (drv->monitor_ifidx < 0)
-               return; /* monitor interface already removed */
-
-       if (drv->nlmode != NL80211_IFTYPE_STATION)
-               return; /* not in station mode anymore */
-
-       if (drv->probe_req_report)
-               return; /* reporting enabled */
-
-       wpa_printf(MSG_DEBUG, "nl80211: Remove monitor interface due to no "
-                  "Probe Request reporting needed anymore");
-       nl80211_remove_monitor_interface(drv);
-}
-
-
 static int wpa_driver_nl80211_probe_req_report(void *priv, int report)
 {
        struct i802_bss *bss = priv;
@@ -5032,30 +6257,74 @@ static int wpa_driver_nl80211_probe_req_report(void *priv, int report)
                           drv->nlmode);
                return -1;
        }
-       drv->probe_req_report = report;
 
-       if (report) {
-               eloop_cancel_timeout(
-                       wpa_driver_nl80211_probe_req_report_timeout,
-                       drv, NULL);
-               if (drv->monitor_ifidx < 0 &&
-                   nl80211_create_monitor_interface(drv))
-                       return -1;
-       } else {
-               /*
-                * It takes a while to remove the monitor interface, so try to
-                * avoid doing this if it is needed again shortly. Instead,
-                * schedule the interface to be removed later if no need for it
-                * is seen.
-                */
-               wpa_printf(MSG_DEBUG, "nl80211: Scheduling monitor interface "
-                          "to be removed after 10 seconds of no use");
-               eloop_register_timeout(
-                       10, 0, wpa_driver_nl80211_probe_req_report_timeout,
-                       drv, NULL);
+       if (!report) {
+               if (drv->nl_handle_preq) {
+                       eloop_unregister_read_sock(
+                               nl_socket_get_fd(drv->nl_handle_preq));
+                       nl_cache_free(drv->nl_cache_preq);
+                       nl80211_handle_destroy(drv->nl_handle_preq);
+                       drv->nl_handle_preq = NULL;
+               }
+               return 0;
+       }
+
+       if (drv->nl_handle_preq) {
+               wpa_printf(MSG_DEBUG, "nl80211: Probe Request reporting "
+                          "already on!");
+               return 0;
+       }
+
+       drv->nl_handle_preq = nl80211_handle_alloc(drv->nl_cb);
+       if (drv->nl_handle_preq == NULL) {
+               wpa_printf(MSG_ERROR, "nl80211: Failed to allocate "
+                          "netlink callbacks (preq)");
+               goto out_err1;
+       }
+
+       if (genl_connect(drv->nl_handle_preq)) {
+               wpa_printf(MSG_ERROR, "nl80211: Failed to connect to "
+                          "generic netlink (preq)");
+               goto out_err2;
+               return -1;
        }
 
+#ifdef CONFIG_LIBNL20
+       if (genl_ctrl_alloc_cache(drv->nl_handle_preq,
+                                 &drv->nl_cache_preq) < 0) {
+               wpa_printf(MSG_ERROR, "nl80211: Failed to allocate generic "
+                          "netlink cache (preq)");
+               goto out_err2;
+       }
+#else /* CONFIG_LIBNL20 */
+       drv->nl_cache_preq = genl_ctrl_alloc_cache(drv->nl_handle_preq);
+       if (drv->nl_cache_preq == NULL) {
+               wpa_printf(MSG_ERROR, "nl80211: Failed to allocate generic "
+                          "netlink cache (preq)");
+               goto out_err2;
+       }
+#endif /* CONFIG_LIBNL20 */
+
+       if (nl80211_register_frame(drv, drv->nl_handle_preq,
+                                  (WLAN_FC_TYPE_MGMT << 2) |
+                                  (WLAN_FC_STYPE_PROBE_REQ << 4),
+                                  NULL, 0) < 0) {
+               goto out_err3;
+       }
+
+       eloop_register_read_sock(nl_socket_get_fd(drv->nl_handle_preq),
+                                wpa_driver_nl80211_event_receive, drv,
+                                drv->nl_handle_preq);
+
        return 0;
+
+ out_err3:
+       nl_cache_free(drv->nl_cache_preq);
+ out_err2:
+       nl80211_handle_destroy(drv->nl_handle_preq);
+       drv->nl_handle_preq = NULL;
+ out_err1:
+       return -1;
 }
 
 
@@ -5179,8 +6448,8 @@ static int nl80211_send_ft_action(void *priv, u8 action, const u8 *target_ap,
        pos += ETH_ALEN;
        os_memcpy(pos, ies, ies_len);
 
-       ret = wpa_driver_nl80211_send_action(bss, drv->assoc_freq, drv->bssid,
-                                            own_addr, drv->bssid,
+       ret = wpa_driver_nl80211_send_action(bss, drv->assoc_freq, 0,
+                                            drv->bssid, own_addr, drv->bssid,
                                             data, data_len);
        os_free(data);
 
@@ -5226,6 +6495,21 @@ nla_put_failure:
 }
 
 
+static int nl80211_signal_poll(void *priv, struct wpa_signal_info *si)
+{
+       struct i802_bss *bss = priv;
+       struct wpa_driver_nl80211_data *drv = bss->drv;
+       int res;
+
+       os_memset(si, 0, sizeof(*si));
+       res = nl80211_get_link_signal(drv, si);
+       if (res != 0)
+               return res;
+
+       return nl80211_get_link_noise(drv, si);
+}
+
+
 static int nl80211_send_frame(void *priv, const u8 *data, size_t data_len,
                              int encrypt)
 {
@@ -5235,6 +6519,132 @@ static int nl80211_send_frame(void *priv, const u8 *data, size_t data_len,
 }
 
 
+static int nl80211_set_intra_bss(void *priv, int enabled)
+{
+       struct i802_bss *bss = priv;
+       struct wpa_driver_nl80211_data *drv = bss->drv;
+       struct nl_msg *msg;
+
+       msg = nlmsg_alloc();
+       if (!msg)
+               return -ENOMEM;
+
+       genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
+                   NL80211_CMD_SET_BSS, 0);
+
+       NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
+       NLA_PUT_U8(msg, NL80211_ATTR_AP_ISOLATE, !enabled);
+
+       return send_and_recv_msgs(drv, msg, NULL, NULL);
+ nla_put_failure:
+       return -ENOBUFS;
+}
+
+
+static int nl80211_set_param(void *priv, const char *param)
+{
+       wpa_printf(MSG_DEBUG, "nl80211: driver param='%s'", param);
+       if (param == NULL)
+               return 0;
+
+#ifdef CONFIG_P2P
+       if (os_strstr(param, "use_p2p_group_interface=1")) {
+               struct i802_bss *bss = priv;
+               struct wpa_driver_nl80211_data *drv = bss->drv;
+
+               wpa_printf(MSG_DEBUG, "nl80211: Use separate P2P group "
+                          "interface");
+               drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_CONCURRENT;
+               drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_MGMT_AND_NON_P2P;
+       }
+#endif /* CONFIG_P2P */
+
+       return 0;
+}
+
+
+static void * nl80211_global_init(void)
+{
+       struct nl80211_global *global;
+       global = os_zalloc(sizeof(*global));
+       if (global == NULL)
+               return NULL;
+       dl_list_init(&global->interfaces);
+       return global;
+}
+
+
+static void nl80211_global_deinit(void *priv)
+{
+       struct nl80211_global *global = priv;
+       if (global == NULL)
+               return;
+       if (!dl_list_empty(&global->interfaces)) {
+               wpa_printf(MSG_ERROR, "nl80211: %u interface(s) remain at "
+                          "nl80211_global_deinit",
+                          dl_list_len(&global->interfaces));
+       }
+       os_free(global);
+}
+
+
+static const char * nl80211_get_radio_name(void *priv)
+{
+       struct i802_bss *bss = priv;
+       struct wpa_driver_nl80211_data *drv = bss->drv;
+       return drv->phyname;
+}
+
+
+static int nl80211_pmkid(struct i802_bss *bss, int cmd, const u8 *bssid,
+                        const u8 *pmkid)
+{
+       struct nl_msg *msg;
+
+       msg = nlmsg_alloc();
+       if (!msg)
+               return -ENOMEM;
+
+       genlmsg_put(msg, 0, 0, genl_family_get_id(bss->drv->nl80211), 0, 0,
+                   cmd, 0);
+
+       NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
+       if (pmkid)
+               NLA_PUT(msg, NL80211_ATTR_PMKID, 16, pmkid);
+       if (bssid)
+               NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
+
+       return send_and_recv_msgs(bss->drv, msg, NULL, NULL);
+ nla_put_failure:
+       return -ENOBUFS;
+}
+
+
+static int nl80211_add_pmkid(void *priv, const u8 *bssid, const u8 *pmkid)
+{
+       struct i802_bss *bss = priv;
+       wpa_printf(MSG_DEBUG, "nl80211: Add PMKID for " MACSTR, MAC2STR(bssid));
+       return nl80211_pmkid(bss, NL80211_CMD_SET_PMKSA, bssid, pmkid);
+}
+
+
+static int nl80211_remove_pmkid(void *priv, const u8 *bssid, const u8 *pmkid)
+{
+       struct i802_bss *bss = priv;
+       wpa_printf(MSG_DEBUG, "nl80211: Delete PMKID for " MACSTR,
+                  MAC2STR(bssid));
+       return nl80211_pmkid(bss, NL80211_CMD_DEL_PMKSA, bssid, pmkid);
+}
+
+
+static int nl80211_flush_pmkid(void *priv)
+{
+       struct i802_bss *bss = priv;
+       wpa_printf(MSG_DEBUG, "nl80211: Flush PMKIDs");
+       return nl80211_pmkid(bss, NL80211_CMD_FLUSH_PMKSA, NULL, NULL);
+}
+
+
 const struct wpa_driver_ops wpa_driver_nl80211_ops = {
        .name = "nl80211",
        .desc = "Linux nl80211/cfg80211",
@@ -5247,7 +6657,9 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
        .disassociate = wpa_driver_nl80211_disassociate,
        .authenticate = wpa_driver_nl80211_authenticate,
        .associate = wpa_driver_nl80211_associate,
-       .init = wpa_driver_nl80211_init,
+       .global_init = nl80211_global_init,
+       .global_deinit = nl80211_global_deinit,
+       .init2 = wpa_driver_nl80211_init,
        .deinit = wpa_driver_nl80211_deinit,
        .get_capa = wpa_driver_nl80211_get_capa,
        .set_operstate = wpa_driver_nl80211_set_operstate,
@@ -5265,25 +6677,29 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
 #ifdef HOSTAPD
        .hapd_init = i802_init,
        .hapd_deinit = i802_deinit,
+       .set_wds_sta = i802_set_wds_sta,
+#endif /* HOSTAPD */
+#if defined(HOSTAPD) || defined(CONFIG_AP)
        .get_seqnum = i802_get_seqnum,
        .flush = i802_flush,
        .read_sta_data = i802_read_sta_data,
-       .sta_deauth = i802_sta_deauth,
-       .sta_disassoc = i802_sta_disassoc,
        .get_inact_sec = i802_get_inact_sec,
        .sta_clear_stats = i802_sta_clear_stats,
-       .set_freq = i802_set_freq,
        .set_rts = i802_set_rts,
        .set_frag = i802_set_frag,
-       .set_rate_sets = i802_set_rate_sets,
        .set_cts_protect = i802_set_cts_protect,
        .set_preamble = i802_set_preamble,
        .set_short_slot_time = i802_set_short_slot_time,
        .set_tx_queue_params = i802_set_tx_queue_params,
        .set_sta_vlan = i802_set_sta_vlan,
-       .set_wds_sta = i802_set_wds_sta,
-#endif /* HOSTAPD */
+       .set_ht_params = i802_set_ht_params,
+       .set_rate_sets = i802_set_rate_sets,
+       .sta_deauth = i802_sta_deauth,
+       .sta_disassoc = i802_sta_disassoc,
+#endif /* HOSTAPD || CONFIG_AP */
+       .set_freq = i802_set_freq,
        .send_action = wpa_driver_nl80211_send_action,
+       .send_action_cancel_wait = wpa_driver_nl80211_send_action_cancel_wait,
        .remain_on_channel = wpa_driver_nl80211_remain_on_channel,
        .cancel_remain_on_channel =
        wpa_driver_nl80211_cancel_remain_on_channel,
@@ -5293,5 +6709,12 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
        .resume = wpa_driver_nl80211_resume,
        .send_ft_action = nl80211_send_ft_action,
        .signal_monitor = nl80211_signal_monitor,
+       .signal_poll = nl80211_signal_poll,
        .send_frame = nl80211_send_frame,
+       .set_intra_bss = nl80211_set_intra_bss,
+       .set_param = nl80211_set_param,
+       .get_radio_name = nl80211_get_radio_name,
+       .add_pmkid = nl80211_add_pmkid,
+       .remove_pmkid = nl80211_remove_pmkid,
+       .flush_pmkid = nl80211_flush_pmkid,
 };