libeap/src/drivers/driver_nl80211.c

   1 /*
   2  * Driver interaction with Linux nl80211/cfg80211
   3  * Copyright (c) 2002-2015, Jouni Malinen <j@w1.fi>
   4  * Copyright (c) 2003-2004, Instant802 Networks, Inc.
   5  * Copyright (c) 2005-2006, Devicescape Software, Inc.
   6  * Copyright (c) 2007, Johannes Berg <johannes@sipsolutions.net>
   7  * Copyright (c) 2009-2010, Atheros Communications
   8  *
   9  * This software may be distributed under the terms of the BSD license.
  10  * See README for more details.
  11  */
  12
  13 #include "includes.h"
  14 #include <sys/types.h>
  15 #include <fcntl.h>
  16 #include <net/if.h>
  17 #include <netlink/genl/genl.h>
  18 #include <netlink/genl/ctrl.h>
  19 #ifdef CONFIG_LIBNL3_ROUTE
  20 #include <netlink/route/neighbour.h>
  21 #endif /* CONFIG_LIBNL3_ROUTE */
  22 #include <linux/rtnetlink.h>
  23 #include <netpacket/packet.h>
  24 #include <linux/errqueue.h>
  25
  26 #include "common.h"
  27 #include "eloop.h"
  28 #include "common/qca-vendor.h"
  29 #include "common/qca-vendor-attr.h"
  30 #include "common/ieee802_11_defs.h"
  31 #include "common/ieee802_11_common.h"
  32 #include "l2_packet/l2_packet.h"
  33 #include "netlink.h"
  34 #include "linux_defines.h"
  35 #include "linux_ioctl.h"
  36 #include "radiotap.h"
  37 #include "radiotap_iter.h"
  38 #include "rfkill.h"
  39 #include "driver_nl80211.h"
  40
  41
  42 #ifndef CONFIG_LIBNL20
  43 /*
  44  * libnl 1.1 has a bug, it tries to allocate socket numbers densely
  45  * but when you free a socket again it will mess up its bitmap and
  46  * and use the wrong number the next time it needs a socket ID.
  47  * Therefore, we wrap the handle alloc/destroy and add our own pid
  48  * accounting.
  49  */
  50 static uint32_t port_bitmap[32] = { 0 };
  51
  52 static struct nl_handle *nl80211_handle_alloc(void *cb)
  53 {
  54         struct nl_handle *handle;
  55         uint32_t pid = getpid() & 0x3FFFFF;
  56         int i;
  57
  58         handle = nl_handle_alloc_cb(cb);
  59
  60         for (i = 0; i < 1024; i++) {
  61                 if (port_bitmap[i / 32] & (1 << (i % 32)))
  62                         continue;
  63                 port_bitmap[i / 32] |= 1 << (i % 32);
  64                 pid += i << 22;
  65                 break;
  66         }
  67
  68         nl_socket_set_local_port(handle, pid);
  69
  70         return handle;
  71 }
  72
  73 static void nl80211_handle_destroy(struct nl_handle *handle)
  74 {
  75         uint32_t port = nl_socket_get_local_port(handle);
  76
  77         port >>= 22;
  78         port_bitmap[port / 32] &= ~(1 << (port % 32));
  79
  80         nl_handle_destroy(handle);
  81 }
  82 #endif /* CONFIG_LIBNL20 */
  83
  84
  85 #ifdef ANDROID
  86 /* system/core/libnl_2 does not include nl_socket_set_nonblocking() */
  87 #undef nl_socket_set_nonblocking
  88 #define nl_socket_set_nonblocking(h) android_nl_socket_set_nonblocking(h)
  89
  90 #endif /* ANDROID */
  91
  92
  93 static struct nl_handle * nl_create_handle(struct nl_cb *cb, const char *dbg)
  94 {
  95         struct nl_handle *handle;
  96
  97         handle = nl80211_handle_alloc(cb);
  98         if (handle == NULL) {
  99                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate netlink "
 100                            "callbacks (%s)", dbg);
 101                 return NULL;
 102         }
 103
 104         if (genl_connect(handle)) {
 105                 wpa_printf(MSG_ERROR, "nl80211: Failed to connect to generic "
 106                            "netlink (%s)", dbg);
 107                 nl80211_handle_destroy(handle);
 108                 return NULL;
 109         }
 110
 111         return handle;
 112 }
 113
 114
 115 static void nl_destroy_handles(struct nl_handle **handle)
 116 {
 117         if (*handle == NULL)
 118                 return;
 119         nl80211_handle_destroy(*handle);
 120         *handle = NULL;
 121 }
 122
 123
 124 #if __WORDSIZE == 64
 125 #define ELOOP_SOCKET_INVALID    (intptr_t) 0x8888888888888889ULL
 126 #else
 127 #define ELOOP_SOCKET_INVALID    (intptr_t) 0x88888889ULL
 128 #endif
 129
 130 static void nl80211_register_eloop_read(struct nl_handle **handle,
 131                                         eloop_sock_handler handler,
 132                                         void *eloop_data)
 133 {
 134 #ifdef CONFIG_LIBNL20
 135         /*
 136          * libnl uses a pretty small buffer (32 kB that gets converted to 64 kB)
 137          * by default. It is possible to hit that limit in some cases where
 138          * operations are blocked, e.g., with a burst of Deauthentication frames
 139          * to hostapd and STA entry deletion. Try to increase the buffer to make
 140          * this less likely to occur.
 141          */
 142         if (nl_socket_set_buffer_size(*handle, 262144, 0) < 0) {
 143                 wpa_printf(MSG_DEBUG,
 144                            "nl80211: Could not set nl_socket RX buffer size: %s",
 145                            strerror(errno));
 146                 /* continue anyway with the default (smaller) buffer */
 147         }
 148 #endif /* CONFIG_LIBNL20 */
 149
 150         nl_socket_set_nonblocking(*handle);
 151         eloop_register_read_sock(nl_socket_get_fd(*handle), handler,
 152                                  eloop_data, *handle);
 153         *handle = (void *) (((intptr_t) *handle) ^ ELOOP_SOCKET_INVALID);
 154 }
 155
 156
 157 static void nl80211_destroy_eloop_handle(struct nl_handle **handle)
 158 {
 159         *handle = (void *) (((intptr_t) *handle) ^ ELOOP_SOCKET_INVALID);
 160         eloop_unregister_read_sock(nl_socket_get_fd(*handle));
 161         nl_destroy_handles(handle);
 162 }
 163
 164
 165 static void nl80211_global_deinit(void *priv);
 166 static void nl80211_check_global(struct nl80211_global *global);
 167
 168 static void wpa_driver_nl80211_deinit(struct i802_bss *bss);
 169 static int wpa_driver_nl80211_set_mode_ibss(struct i802_bss *bss,
 170                                             struct hostapd_freq_params *freq);
 171
 172 static int
 173 wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv,
 174                                    const u8 *set_addr, int first,
 175                                    const char *driver_params);
 176 static int nl80211_send_frame_cmd(struct i802_bss *bss,
 177                                   unsigned int freq, unsigned int wait,
 178                                   const u8 *buf, size_t buf_len, u64 *cookie,
 179                                   int no_cck, int no_ack, int offchanok);
 180 static int wpa_driver_nl80211_probe_req_report(struct i802_bss *bss,
 181                                                int report);
 182
 183 static void add_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx);
 184 static void del_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx);
 185 static int have_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx);
 186
 187 static int nl80211_set_channel(struct i802_bss *bss,
 188                                struct hostapd_freq_params *freq, int set_chan);
 189 static int nl80211_disable_11b_rates(struct wpa_driver_nl80211_data *drv,
 190                                      int ifindex, int disabled);
 191
 192 static int nl80211_leave_ibss(struct wpa_driver_nl80211_data *drv,
 193                               int reset_mode);
 194
 195 static int i802_set_iface_flags(struct i802_bss *bss, int up);
 196 static int nl80211_set_param(void *priv, const char *param);
 197
 198
 199 /* Converts nl80211_chan_width to a common format */
 200 enum chan_width convert2width(int width)
 201 {
 202         switch (width) {
 203         case NL80211_CHAN_WIDTH_20_NOHT:
 204                 return CHAN_WIDTH_20_NOHT;
 205         case NL80211_CHAN_WIDTH_20:
 206                 return CHAN_WIDTH_20;
 207         case NL80211_CHAN_WIDTH_40:
 208                 return CHAN_WIDTH_40;
 209         case NL80211_CHAN_WIDTH_80:
 210                 return CHAN_WIDTH_80;
 211         case NL80211_CHAN_WIDTH_80P80:
 212                 return CHAN_WIDTH_80P80;
 213         case NL80211_CHAN_WIDTH_160:
 214                 return CHAN_WIDTH_160;
 215         }
 216         return CHAN_WIDTH_UNKNOWN;
 217 }
 218
 219
 220 int is_ap_interface(enum nl80211_iftype nlmode)
 221 {
 222         return nlmode == NL80211_IFTYPE_AP ||
 223                 nlmode == NL80211_IFTYPE_P2P_GO;
 224 }
 225
 226
 227 int is_sta_interface(enum nl80211_iftype nlmode)
 228 {
 229         return nlmode == NL80211_IFTYPE_STATION ||
 230                 nlmode == NL80211_IFTYPE_P2P_CLIENT;
 231 }
 232
 233
 234 static int is_p2p_net_interface(enum nl80211_iftype nlmode)
 235 {
 236         return nlmode == NL80211_IFTYPE_P2P_CLIENT ||
 237                 nlmode == NL80211_IFTYPE_P2P_GO;
 238 }
 239
 240
 241 struct i802_bss * get_bss_ifindex(struct wpa_driver_nl80211_data *drv,
 242                                   int ifindex)
 243 {
 244         struct i802_bss *bss;
 245
 246         for (bss = drv->first_bss; bss; bss = bss->next) {
 247                 if (bss->ifindex == ifindex)
 248                         return bss;
 249         }
 250
 251         return NULL;
 252 }
 253
 254
 255 static int is_mesh_interface(enum nl80211_iftype nlmode)
 256 {
 257         return nlmode == NL80211_IFTYPE_MESH_POINT;
 258 }
 259
 260
 261 void nl80211_mark_disconnected(struct wpa_driver_nl80211_data *drv)
 262 {
 263         if (drv->associated)
 264                 os_memcpy(drv->prev_bssid, drv->bssid, ETH_ALEN);
 265         drv->associated = 0;
 266         os_memset(drv->bssid, 0, ETH_ALEN);
 267 }
 268
 269
 270 /* nl80211 code */
 271 static int ack_handler(struct nl_msg *msg, void *arg)
 272 {
 273         int *err = arg;
 274         *err = 0;
 275         return NL_STOP;
 276 }
 277
 278 static int finish_handler(struct nl_msg *msg, void *arg)
 279 {
 280         int *ret = arg;
 281         *ret = 0;
 282         return NL_SKIP;
 283 }
 284
 285 static int error_handler(struct sockaddr_nl *nla, struct nlmsgerr *err,
 286                          void *arg)
 287 {
 288         int *ret = arg;
 289         *ret = err->error;
 290         return NL_SKIP;
 291 }
 292
 293
 294 static int no_seq_check(struct nl_msg *msg, void *arg)
 295 {
 296         return NL_OK;
 297 }
 298
 299
 300 static void nl80211_nlmsg_clear(struct nl_msg *msg)
 301 {
 302         /*
 303          * Clear nlmsg data, e.g., to make sure key material is not left in
 304          * heap memory for unnecessarily long time.
 305          */
 306         if (msg) {
 307                 struct nlmsghdr *hdr = nlmsg_hdr(msg);
 308                 void *data = nlmsg_data(hdr);
 309                 /*
 310                  * This would use nlmsg_datalen() or the older nlmsg_len() if
 311                  * only libnl were to maintain a stable API.. Neither will work
 312                  * with all released versions, so just calculate the length
 313                  * here.
 314                  */
 315                 int len = hdr->nlmsg_len - NLMSG_HDRLEN;
 316
 317                 os_memset(data, 0, len);
 318         }
 319 }
 320
 321
 322 static int send_and_recv(struct nl80211_global *global,
 323                          struct nl_handle *nl_handle, struct nl_msg *msg,
 324                          int (*valid_handler)(struct nl_msg *, void *),
 325                          void *valid_data)
 326 {
 327         struct nl_cb *cb;
 328         int err = -ENOMEM;
 329
 330         if (!msg)
 331                 return -ENOMEM;
 332
 333         cb = nl_cb_clone(global->nl_cb);
 334         if (!cb)
 335                 goto out;
 336
 337         err = nl_send_auto_complete(nl_handle, msg);
 338         if (err < 0)
 339                 goto out;
 340
 341         err = 1;
 342
 343         nl_cb_err(cb, NL_CB_CUSTOM, error_handler, &err);
 344         nl_cb_set(cb, NL_CB_FINISH, NL_CB_CUSTOM, finish_handler, &err);
 345         nl_cb_set(cb, NL_CB_ACK, NL_CB_CUSTOM, ack_handler, &err);
 346
 347         if (valid_handler)
 348                 nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM,
 349                           valid_handler, valid_data);
 350
 351         while (err > 0) {
 352                 int res = nl_recvmsgs(nl_handle, cb);
 353                 if (res < 0) {
 354                         wpa_printf(MSG_INFO,
 355                                    "nl80211: %s->nl_recvmsgs failed: %d",
 356                                    __func__, res);
 357                 }
 358         }
 359  out:
 360         nl_cb_put(cb);
 361         if (!valid_handler && valid_data == (void *) -1)
 362                 nl80211_nlmsg_clear(msg);
 363         nlmsg_free(msg);
 364         return err;
 365 }
 366
 367
 368 int send_and_recv_msgs(struct wpa_driver_nl80211_data *drv,
 369                        struct nl_msg *msg,
 370                        int (*valid_handler)(struct nl_msg *, void *),
 371                        void *valid_data)
 372 {
 373         return send_and_recv(drv->global, drv->global->nl, msg,
 374                              valid_handler, valid_data);
 375 }
 376
 377
 378 struct family_data {
 379         const char *group;
 380         int id;
 381 };
 382
 383
 384 static int family_handler(struct nl_msg *msg, void *arg)
 385 {
 386         struct family_data *res = arg;
 387         struct nlattr *tb[CTRL_ATTR_MAX + 1];
 388         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 389         struct nlattr *mcgrp;
 390         int i;
 391
 392         nla_parse(tb, CTRL_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 393                   genlmsg_attrlen(gnlh, 0), NULL);
 394         if (!tb[CTRL_ATTR_MCAST_GROUPS])
 395                 return NL_SKIP;
 396
 397         nla_for_each_nested(mcgrp, tb[CTRL_ATTR_MCAST_GROUPS], i) {
 398                 struct nlattr *tb2[CTRL_ATTR_MCAST_GRP_MAX + 1];
 399                 nla_parse(tb2, CTRL_ATTR_MCAST_GRP_MAX, nla_data(mcgrp),
 400                           nla_len(mcgrp), NULL);
 401                 if (!tb2[CTRL_ATTR_MCAST_GRP_NAME] ||
 402                     !tb2[CTRL_ATTR_MCAST_GRP_ID] ||
 403                     os_strncmp(nla_data(tb2[CTRL_ATTR_MCAST_GRP_NAME]),
 404                                res->group,
 405                                nla_len(tb2[CTRL_ATTR_MCAST_GRP_NAME])) != 0)
 406                         continue;
 407                 res->id = nla_get_u32(tb2[CTRL_ATTR_MCAST_GRP_ID]);
 408                 break;
 409         };
 410
 411         return NL_SKIP;
 412 }
 413
 414
 415 static int nl_get_multicast_id(struct nl80211_global *global,
 416                                const char *family, const char *group)
 417 {
 418         struct nl_msg *msg;
 419         int ret;
 420         struct family_data res = { group, -ENOENT };
 421
 422         msg = nlmsg_alloc();
 423         if (!msg)
 424                 return -ENOMEM;
 425         if (!genlmsg_put(msg, 0, 0, genl_ctrl_resolve(global->nl, "nlctrl"),
 426                          0, 0, CTRL_CMD_GETFAMILY, 0) ||
 427             nla_put_string(msg, CTRL_ATTR_FAMILY_NAME, family)) {
 428                 nlmsg_free(msg);
 429                 return -1;
 430         }
 431
 432         ret = send_and_recv(global, global->nl, msg, family_handler, &res);
 433         if (ret == 0)
 434                 ret = res.id;
 435         return ret;
 436 }
 437
 438
 439 void * nl80211_cmd(struct wpa_driver_nl80211_data *drv,
 440                    struct nl_msg *msg, int flags, uint8_t cmd)
 441 {
 442         return genlmsg_put(msg, 0, 0, drv->global->nl80211_id,
 443                            0, flags, cmd, 0);
 444 }
 445
 446
 447 static int nl80211_set_iface_id(struct nl_msg *msg, struct i802_bss *bss)
 448 {
 449         if (bss->wdev_id_set)
 450                 return nla_put_u64(msg, NL80211_ATTR_WDEV, bss->wdev_id);
 451         return nla_put_u32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
 452 }
 453
 454
 455 struct nl_msg * nl80211_cmd_msg(struct i802_bss *bss, int flags, uint8_t cmd)
 456 {
 457         struct nl_msg *msg;
 458
 459         msg = nlmsg_alloc();
 460         if (!msg)
 461                 return NULL;
 462
 463         if (!nl80211_cmd(bss->drv, msg, flags, cmd) ||
 464             nl80211_set_iface_id(msg, bss) < 0) {
 465                 nlmsg_free(msg);
 466                 return NULL;
 467         }
 468
 469         return msg;
 470 }
 471
 472
 473 static struct nl_msg *
 474 nl80211_ifindex_msg(struct wpa_driver_nl80211_data *drv, int ifindex,
 475                     int flags, uint8_t cmd)
 476 {
 477         struct nl_msg *msg;
 478
 479         msg = nlmsg_alloc();
 480         if (!msg)
 481                 return NULL;
 482
 483         if (!nl80211_cmd(drv, msg, flags, cmd) ||
 484             nla_put_u32(msg, NL80211_ATTR_IFINDEX, ifindex)) {
 485                 nlmsg_free(msg);
 486                 return NULL;
 487         }
 488
 489         return msg;
 490 }
 491
 492
 493 struct nl_msg * nl80211_drv_msg(struct wpa_driver_nl80211_data *drv, int flags,
 494                                 uint8_t cmd)
 495 {
 496         return nl80211_ifindex_msg(drv, drv->ifindex, flags, cmd);
 497 }
 498
 499
 500 struct nl_msg * nl80211_bss_msg(struct i802_bss *bss, int flags, uint8_t cmd)
 501 {
 502         return nl80211_ifindex_msg(bss->drv, bss->ifindex, flags, cmd);
 503 }
 504
 505
 506 struct wiphy_idx_data {
 507         int wiphy_idx;
 508         enum nl80211_iftype nlmode;
 509         u8 *macaddr;
 510 };
 511
 512
 513 static int netdev_info_handler(struct nl_msg *msg, void *arg)
 514 {
 515         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 516         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 517         struct wiphy_idx_data *info = arg;
 518
 519         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 520                   genlmsg_attrlen(gnlh, 0), NULL);
 521
 522         if (tb[NL80211_ATTR_WIPHY])
 523                 info->wiphy_idx = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
 524
 525         if (tb[NL80211_ATTR_IFTYPE])
 526                 info->nlmode = nla_get_u32(tb[NL80211_ATTR_IFTYPE]);
 527
 528         if (tb[NL80211_ATTR_MAC] && info->macaddr)
 529                 os_memcpy(info->macaddr, nla_data(tb[NL80211_ATTR_MAC]),
 530                           ETH_ALEN);
 531
 532         return NL_SKIP;
 533 }
 534
 535
 536 int nl80211_get_wiphy_index(struct i802_bss *bss)
 537 {
 538         struct nl_msg *msg;
 539         struct wiphy_idx_data data = {
 540                 .wiphy_idx = -1,
 541                 .macaddr = NULL,
 542         };
 543
 544         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_GET_INTERFACE)))
 545                 return -1;
 546
 547         if (send_and_recv_msgs(bss->drv, msg, netdev_info_handler, &data) == 0)
 548                 return data.wiphy_idx;
 549         return -1;
 550 }
 551
 552
 553 static enum nl80211_iftype nl80211_get_ifmode(struct i802_bss *bss)
 554 {
 555         struct nl_msg *msg;
 556         struct wiphy_idx_data data = {
 557                 .nlmode = NL80211_IFTYPE_UNSPECIFIED,
 558                 .macaddr = NULL,
 559         };
 560
 561         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_GET_INTERFACE)))
 562                 return NL80211_IFTYPE_UNSPECIFIED;
 563
 564         if (send_and_recv_msgs(bss->drv, msg, netdev_info_handler, &data) == 0)
 565                 return data.nlmode;
 566         return NL80211_IFTYPE_UNSPECIFIED;
 567 }
 568
 569
 570 static int nl80211_get_macaddr(struct i802_bss *bss)
 571 {
 572         struct nl_msg *msg;
 573         struct wiphy_idx_data data = {
 574                 .macaddr = bss->addr,
 575         };
 576
 577         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_GET_INTERFACE)))
 578                 return -1;
 579
 580         return send_and_recv_msgs(bss->drv, msg, netdev_info_handler, &data);
 581 }
 582
 583
 584 static int nl80211_register_beacons(struct wpa_driver_nl80211_data *drv,
 585                                     struct nl80211_wiphy_data *w)
 586 {
 587         struct nl_msg *msg;
 588         int ret;
 589
 590         msg = nlmsg_alloc();
 591         if (!msg)
 592                 return -1;
 593
 594         if (!nl80211_cmd(drv, msg, 0, NL80211_CMD_REGISTER_BEACONS) ||
 595             nla_put_u32(msg, NL80211_ATTR_WIPHY, w->wiphy_idx)) {
 596                 nlmsg_free(msg);
 597                 return -1;
 598         }
 599
 600         ret = send_and_recv(drv->global, w->nl_beacons, msg, NULL, NULL);
 601         if (ret) {
 602                 wpa_printf(MSG_DEBUG, "nl80211: Register beacons command "
 603                            "failed: ret=%d (%s)",
 604                            ret, strerror(-ret));
 605         }
 606         return ret;
 607 }
 608
 609
 610 static void nl80211_recv_beacons(int sock, void *eloop_ctx, void *handle)
 611 {
 612         struct nl80211_wiphy_data *w = eloop_ctx;
 613         int res;
 614
 615         wpa_printf(MSG_EXCESSIVE, "nl80211: Beacon event message available");
 616
 617         res = nl_recvmsgs(handle, w->nl_cb);
 618         if (res < 0) {
 619                 wpa_printf(MSG_INFO, "nl80211: %s->nl_recvmsgs failed: %d",
 620                            __func__, res);
 621         }
 622 }
 623
 624
 625 static int process_beacon_event(struct nl_msg *msg, void *arg)
 626 {
 627         struct nl80211_wiphy_data *w = arg;
 628         struct wpa_driver_nl80211_data *drv;
 629         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 630         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 631         union wpa_event_data event;
 632
 633         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 634                   genlmsg_attrlen(gnlh, 0), NULL);
 635
 636         if (gnlh->cmd != NL80211_CMD_FRAME) {
 637                 wpa_printf(MSG_DEBUG, "nl80211: Unexpected beacon event? (%d)",
 638                            gnlh->cmd);
 639                 return NL_SKIP;
 640         }
 641
 642         if (!tb[NL80211_ATTR_FRAME])
 643                 return NL_SKIP;
 644
 645         dl_list_for_each(drv, &w->drvs, struct wpa_driver_nl80211_data,
 646                          wiphy_list) {
 647                 os_memset(&event, 0, sizeof(event));
 648                 event.rx_mgmt.frame = nla_data(tb[NL80211_ATTR_FRAME]);
 649                 event.rx_mgmt.frame_len = nla_len(tb[NL80211_ATTR_FRAME]);
 650                 wpa_supplicant_event(drv->ctx, EVENT_RX_MGMT, &event);
 651         }
 652
 653         return NL_SKIP;
 654 }
 655
 656
 657 static struct nl80211_wiphy_data *
 658 nl80211_get_wiphy_data_ap(struct i802_bss *bss)
 659 {
 660         static DEFINE_DL_LIST(nl80211_wiphys);
 661         struct nl80211_wiphy_data *w;
 662         int wiphy_idx, found = 0;
 663         struct i802_bss *tmp_bss;
 664
 665         if (bss->wiphy_data != NULL)
 666                 return bss->wiphy_data;
 667
 668         wiphy_idx = nl80211_get_wiphy_index(bss);
 669
 670         dl_list_for_each(w, &nl80211_wiphys, struct nl80211_wiphy_data, list) {
 671                 if (w->wiphy_idx == wiphy_idx)
 672                         goto add;
 673         }
 674
 675         /* alloc new one */
 676         w = os_zalloc(sizeof(*w));
 677         if (w == NULL)
 678                 return NULL;
 679         w->wiphy_idx = wiphy_idx;
 680         dl_list_init(&w->bsss);
 681         dl_list_init(&w->drvs);
 682
 683         w->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
 684         if (!w->nl_cb) {
 685                 os_free(w);
 686                 return NULL;
 687         }
 688         nl_cb_set(w->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM, no_seq_check, NULL);
 689         nl_cb_set(w->nl_cb, NL_CB_VALID, NL_CB_CUSTOM, process_beacon_event,
 690                   w);
 691
 692         w->nl_beacons = nl_create_handle(bss->drv->global->nl_cb,
 693                                          "wiphy beacons");
 694         if (w->nl_beacons == NULL) {
 695                 os_free(w);
 696                 return NULL;
 697         }
 698
 699         if (nl80211_register_beacons(bss->drv, w)) {
 700                 nl_destroy_handles(&w->nl_beacons);
 701                 os_free(w);
 702                 return NULL;
 703         }
 704
 705         nl80211_register_eloop_read(&w->nl_beacons, nl80211_recv_beacons, w);
 706
 707         dl_list_add(&nl80211_wiphys, &w->list);
 708
 709 add:
 710         /* drv entry for this bss already there? */
 711         dl_list_for_each(tmp_bss, &w->bsss, struct i802_bss, wiphy_list) {
 712                 if (tmp_bss->drv == bss->drv) {
 713                         found = 1;
 714                         break;
 715                 }
 716         }
 717         /* if not add it */
 718         if (!found)
 719                 dl_list_add(&w->drvs, &bss->drv->wiphy_list);
 720
 721         dl_list_add(&w->bsss, &bss->wiphy_list);
 722         bss->wiphy_data = w;
 723         return w;
 724 }
 725
 726
 727 static void nl80211_put_wiphy_data_ap(struct i802_bss *bss)
 728 {
 729         struct nl80211_wiphy_data *w = bss->wiphy_data;
 730         struct i802_bss *tmp_bss;
 731         int found = 0;
 732
 733         if (w == NULL)
 734                 return;
 735         bss->wiphy_data = NULL;
 736         dl_list_del(&bss->wiphy_list);
 737
 738         /* still any for this drv present? */
 739         dl_list_for_each(tmp_bss, &w->bsss, struct i802_bss, wiphy_list) {
 740                 if (tmp_bss->drv == bss->drv) {
 741                         found = 1;
 742                         break;
 743                 }
 744         }
 745         /* if not remove it */
 746         if (!found)
 747                 dl_list_del(&bss->drv->wiphy_list);
 748
 749         if (!dl_list_empty(&w->bsss))
 750                 return;
 751
 752         nl80211_destroy_eloop_handle(&w->nl_beacons);
 753
 754         nl_cb_put(w->nl_cb);
 755         dl_list_del(&w->list);
 756         os_free(w);
 757 }
 758
 759
 760 static int wpa_driver_nl80211_get_bssid(void *priv, u8 *bssid)
 761 {
 762         struct i802_bss *bss = priv;
 763         struct wpa_driver_nl80211_data *drv = bss->drv;
 764         if (!drv->associated)
 765                 return -1;
 766         os_memcpy(bssid, drv->bssid, ETH_ALEN);
 767         return 0;
 768 }
 769
 770
 771 static int wpa_driver_nl80211_get_ssid(void *priv, u8 *ssid)
 772 {
 773         struct i802_bss *bss = priv;
 774         struct wpa_driver_nl80211_data *drv = bss->drv;
 775         if (!drv->associated)
 776                 return -1;
 777         os_memcpy(ssid, drv->ssid, drv->ssid_len);
 778         return drv->ssid_len;
 779 }
 780
 781
 782 static void wpa_driver_nl80211_event_newlink(
 783         struct wpa_driver_nl80211_data *drv, const char *ifname)
 784 {
 785         union wpa_event_data event;
 786
 787         if (os_strcmp(drv->first_bss->ifname, ifname) == 0) {
 788                 if (if_nametoindex(drv->first_bss->ifname) == 0) {
 789                         wpa_printf(MSG_DEBUG, "nl80211: Interface %s does not exist - ignore RTM_NEWLINK",
 790                                    drv->first_bss->ifname);
 791                         return;
 792                 }
 793                 if (!drv->if_removed)
 794                         return;
 795                 wpa_printf(MSG_DEBUG, "nl80211: Mark if_removed=0 for %s based on RTM_NEWLINK event",
 796                            drv->first_bss->ifname);
 797                 drv->if_removed = 0;
 798         }
 799
 800         os_memset(&event, 0, sizeof(event));
 801         os_strlcpy(event.interface_status.ifname, ifname,
 802                    sizeof(event.interface_status.ifname));
 803         event.interface_status.ievent = EVENT_INTERFACE_ADDED;
 804         wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_STATUS, &event);
 805 }
 806
 807
 808 static void wpa_driver_nl80211_event_dellink(
 809         struct wpa_driver_nl80211_data *drv, const char *ifname)
 810 {
 811         union wpa_event_data event;
 812
 813         if (os_strcmp(drv->first_bss->ifname, ifname) == 0) {
 814                 if (drv->if_removed) {
 815                         wpa_printf(MSG_DEBUG, "nl80211: if_removed already set - ignore RTM_DELLINK event for %s",
 816                                    ifname);
 817                         return;
 818                 }
 819                 wpa_printf(MSG_DEBUG, "RTM_DELLINK: Interface '%s' removed - mark if_removed=1",
 820                            ifname);
 821                 drv->if_removed = 1;
 822         } else {
 823                 wpa_printf(MSG_DEBUG, "RTM_DELLINK: Interface '%s' removed",
 824                            ifname);
 825         }
 826
 827         os_memset(&event, 0, sizeof(event));
 828         os_strlcpy(event.interface_status.ifname, ifname,
 829                    sizeof(event.interface_status.ifname));
 830         event.interface_status.ievent = EVENT_INTERFACE_REMOVED;
 831         wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_STATUS, &event);
 832 }
 833
 834
 835 static int wpa_driver_nl80211_own_ifname(struct wpa_driver_nl80211_data *drv,
 836                                          u8 *buf, size_t len)
 837 {
 838         int attrlen, rta_len;
 839         struct rtattr *attr;
 840
 841         attrlen = len;
 842         attr = (struct rtattr *) buf;
 843
 844         rta_len = RTA_ALIGN(sizeof(struct rtattr));
 845         while (RTA_OK(attr, attrlen)) {
 846                 if (attr->rta_type == IFLA_IFNAME) {
 847                         if (os_strcmp(((char *) attr) + rta_len,
 848                                       drv->first_bss->ifname) == 0)
 849                                 return 1;
 850                         else
 851                                 break;
 852                 }
 853                 attr = RTA_NEXT(attr, attrlen);
 854         }
 855
 856         return 0;
 857 }
 858
 859
 860 static int wpa_driver_nl80211_own_ifindex(struct wpa_driver_nl80211_data *drv,
 861                                           int ifindex, u8 *buf, size_t len)
 862 {
 863         if (drv->ifindex == ifindex)
 864                 return 1;
 865
 866         if (drv->if_removed && wpa_driver_nl80211_own_ifname(drv, buf, len)) {
 867                 nl80211_check_global(drv->global);
 868                 wpa_printf(MSG_DEBUG, "nl80211: Update ifindex for a removed "
 869                            "interface");
 870                 wpa_driver_nl80211_finish_drv_init(drv, NULL, 0, NULL);
 871                 return 1;
 872         }
 873
 874         return 0;
 875 }
 876
 877
 878 static struct wpa_driver_nl80211_data *
 879 nl80211_find_drv(struct nl80211_global *global, int idx, u8 *buf, size_t len)
 880 {
 881         struct wpa_driver_nl80211_data *drv;
 882         dl_list_for_each(drv, &global->interfaces,
 883                          struct wpa_driver_nl80211_data, list) {
 884                 if (wpa_driver_nl80211_own_ifindex(drv, idx, buf, len) ||
 885                     have_ifidx(drv, idx))
 886                         return drv;
 887         }
 888         return NULL;
 889 }
 890
 891
 892 static void wpa_driver_nl80211_event_rtm_newlink(void *ctx,
 893                                                  struct ifinfomsg *ifi,
 894                                                  u8 *buf, size_t len)
 895 {
 896         struct nl80211_global *global = ctx;
 897         struct wpa_driver_nl80211_data *drv;
 898         int attrlen;
 899         struct rtattr *attr;
 900         u32 brid = 0;
 901         char namebuf[IFNAMSIZ];
 902         char ifname[IFNAMSIZ + 1];
 903         char extra[100], *pos, *end;
 904
 905         drv = nl80211_find_drv(global, ifi->ifi_index, buf, len);
 906         if (!drv) {
 907                 wpa_printf(MSG_DEBUG, "nl80211: Ignore RTM_NEWLINK event for foreign ifindex %d",
 908                            ifi->ifi_index);
 909                 return;
 910         }
 911
 912         extra[0] = '\0';
 913         pos = extra;
 914         end = pos + sizeof(extra);
 915         ifname[0] = '\0';
 916
 917         attrlen = len;
 918         attr = (struct rtattr *) buf;
 919         while (RTA_OK(attr, attrlen)) {
 920                 switch (attr->rta_type) {
 921                 case IFLA_IFNAME:
 922                         if (RTA_PAYLOAD(attr) >= IFNAMSIZ)
 923                                 break;
 924                         os_memcpy(ifname, RTA_DATA(attr), RTA_PAYLOAD(attr));
 925                         ifname[RTA_PAYLOAD(attr)] = '\0';
 926                         break;
 927                 case IFLA_MASTER:
 928                         brid = nla_get_u32((struct nlattr *) attr);
 929                         pos += os_snprintf(pos, end - pos, " master=%u", brid);
 930                         break;
 931                 case IFLA_WIRELESS:
 932                         pos += os_snprintf(pos, end - pos, " wext");
 933                         break;
 934                 case IFLA_OPERSTATE:
 935                         pos += os_snprintf(pos, end - pos, " operstate=%u",
 936                                            nla_get_u32((struct nlattr *) attr));
 937                         break;
 938                 case IFLA_LINKMODE:
 939                         pos += os_snprintf(pos, end - pos, " linkmode=%u",
 940                                            nla_get_u32((struct nlattr *) attr));
 941                         break;
 942                 }
 943                 attr = RTA_NEXT(attr, attrlen);
 944         }
 945         extra[sizeof(extra) - 1] = '\0';
 946
 947         wpa_printf(MSG_DEBUG, "RTM_NEWLINK: ifi_index=%d ifname=%s%s ifi_family=%d ifi_flags=0x%x (%s%s%s%s)",
 948                    ifi->ifi_index, ifname, extra, ifi->ifi_family,
 949                    ifi->ifi_flags,
 950                    (ifi->ifi_flags & IFF_UP) ? "[UP]" : "",
 951                    (ifi->ifi_flags & IFF_RUNNING) ? "[RUNNING]" : "",
 952                    (ifi->ifi_flags & IFF_LOWER_UP) ? "[LOWER_UP]" : "",
 953                    (ifi->ifi_flags & IFF_DORMANT) ? "[DORMANT]" : "");
 954
 955         if (!drv->if_disabled && !(ifi->ifi_flags & IFF_UP)) {
 956                 namebuf[0] = '\0';
 957                 if (if_indextoname(ifi->ifi_index, namebuf) &&
 958                     linux_iface_up(drv->global->ioctl_sock, namebuf) > 0) {
 959                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface down "
 960                                    "event since interface %s is up", namebuf);
 961                         drv->ignore_if_down_event = 0;
 962                         return;
 963                 }
 964                 wpa_printf(MSG_DEBUG, "nl80211: Interface down (%s/%s)",
 965                            namebuf, ifname);
 966                 if (os_strcmp(drv->first_bss->ifname, ifname) != 0) {
 967                         wpa_printf(MSG_DEBUG,
 968                                    "nl80211: Not the main interface (%s) - do not indicate interface down",
 969                                    drv->first_bss->ifname);
 970                 } else if (drv->ignore_if_down_event) {
 971                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface down "
 972                                    "event generated by mode change");
 973                         drv->ignore_if_down_event = 0;
 974                 } else {
 975                         drv->if_disabled = 1;
 976                         wpa_supplicant_event(drv->ctx,
 977                                              EVENT_INTERFACE_DISABLED, NULL);
 978
 979                         /*
 980                          * Try to get drv again, since it may be removed as
 981                          * part of the EVENT_INTERFACE_DISABLED handling for
 982                          * dynamic interfaces
 983                          */
 984                         drv = nl80211_find_drv(global, ifi->ifi_index,
 985                                                buf, len);
 986                         if (!drv)
 987                                 return;
 988                 }
 989         }
 990
 991         if (drv->if_disabled && (ifi->ifi_flags & IFF_UP)) {
 992                 if (if_indextoname(ifi->ifi_index, namebuf) &&
 993                     linux_iface_up(drv->global->ioctl_sock, namebuf) == 0) {
 994                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface up "
 995                                    "event since interface %s is down",
 996                                    namebuf);
 997                 } else if (if_nametoindex(drv->first_bss->ifname) == 0) {
 998                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface up "
 999                                    "event since interface %s does not exist",
1000                                    drv->first_bss->ifname);
1001                 } else if (drv->if_removed) {
1002                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface up "
1003                                    "event since interface %s is marked "
1004                                    "removed", drv->first_bss->ifname);
1005                 } else {
1006                         struct i802_bss *bss;
1007                         u8 addr[ETH_ALEN];
1008
1009                         /* Re-read MAC address as it may have changed */
1010                         bss = get_bss_ifindex(drv, ifi->ifi_index);
1011                         if (bss &&
1012                             linux_get_ifhwaddr(drv->global->ioctl_sock,
1013                                                bss->ifname, addr) < 0) {
1014                                 wpa_printf(MSG_DEBUG,
1015                                            "nl80211: %s: failed to re-read MAC address",
1016                                            bss->ifname);
1017                         } else if (bss &&
1018                                    os_memcmp(addr, bss->addr, ETH_ALEN) != 0) {
1019                                 wpa_printf(MSG_DEBUG,
1020                                            "nl80211: Own MAC address on ifindex %d (%s) changed from "
1021                                            MACSTR " to " MACSTR,
1022                                            ifi->ifi_index, bss->ifname,
1023                                            MAC2STR(bss->addr),
1024                                            MAC2STR(addr));
1025                                 os_memcpy(bss->addr, addr, ETH_ALEN);
1026                         }
1027
1028                         wpa_printf(MSG_DEBUG, "nl80211: Interface up");
1029                         drv->if_disabled = 0;
1030                         wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_ENABLED,
1031                                              NULL);
1032                 }
1033         }
1034
1035         /*
1036          * Some drivers send the association event before the operup event--in
1037          * this case, lifting operstate in wpa_driver_nl80211_set_operstate()
1038          * fails. This will hit us when wpa_supplicant does not need to do
1039          * IEEE 802.1X authentication
1040          */
1041         if (drv->operstate == 1 &&
1042             (ifi->ifi_flags & (IFF_LOWER_UP | IFF_DORMANT)) == IFF_LOWER_UP &&
1043             !(ifi->ifi_flags & IFF_RUNNING)) {
1044                 wpa_printf(MSG_DEBUG, "nl80211: Set IF_OPER_UP again based on ifi_flags and expected operstate");
1045                 netlink_send_oper_ifla(drv->global->netlink, drv->ifindex,
1046                                        -1, IF_OPER_UP);
1047         }
1048
1049         if (ifname[0])
1050                 wpa_driver_nl80211_event_newlink(drv, ifname);
1051
1052         if (ifi->ifi_family == AF_BRIDGE && brid) {
1053                 struct i802_bss *bss;
1054
1055                 /* device has been added to bridge */
1056                 if (!if_indextoname(brid, namebuf)) {
1057                         wpa_printf(MSG_DEBUG,
1058                                    "nl80211: Could not find bridge ifname for ifindex %u",
1059                                    brid);
1060                         return;
1061                 }
1062                 wpa_printf(MSG_DEBUG, "nl80211: Add ifindex %u for bridge %s",
1063                            brid, namebuf);
1064                 add_ifidx(drv, brid);
1065
1066                 for (bss = drv->first_bss; bss; bss = bss->next) {
1067                         if (os_strcmp(ifname, bss->ifname) == 0) {
1068                                 os_strlcpy(bss->brname, namebuf, IFNAMSIZ);
1069                                 break;
1070                         }
1071                 }
1072         }
1073 }
1074
1075
1076 static void wpa_driver_nl80211_event_rtm_dellink(void *ctx,
1077                                                  struct ifinfomsg *ifi,
1078                                                  u8 *buf, size_t len)
1079 {
1080         struct nl80211_global *global = ctx;
1081         struct wpa_driver_nl80211_data *drv;
1082         int attrlen;
1083         struct rtattr *attr;
1084         u32 brid = 0;
1085         char ifname[IFNAMSIZ + 1];
1086         char extra[100], *pos, *end;
1087
1088         drv = nl80211_find_drv(global, ifi->ifi_index, buf, len);
1089         if (!drv) {
1090                 wpa_printf(MSG_DEBUG, "nl80211: Ignore RTM_DELLINK event for foreign ifindex %d",
1091                            ifi->ifi_index);
1092                 return;
1093         }
1094
1095         extra[0] = '\0';
1096         pos = extra;
1097         end = pos + sizeof(extra);
1098         ifname[0] = '\0';
1099
1100         attrlen = len;
1101         attr = (struct rtattr *) buf;
1102         while (RTA_OK(attr, attrlen)) {
1103                 switch (attr->rta_type) {
1104                 case IFLA_IFNAME:
1105                         if (RTA_PAYLOAD(attr) >= IFNAMSIZ)
1106                                 break;
1107                         os_memcpy(ifname, RTA_DATA(attr), RTA_PAYLOAD(attr));
1108                         ifname[RTA_PAYLOAD(attr)] = '\0';
1109                         break;
1110                 case IFLA_MASTER:
1111                         brid = nla_get_u32((struct nlattr *) attr);
1112                         pos += os_snprintf(pos, end - pos, " master=%u", brid);
1113                         break;
1114                 case IFLA_OPERSTATE:
1115                         pos += os_snprintf(pos, end - pos, " operstate=%u",
1116                                            nla_get_u32((struct nlattr *) attr));
1117                         break;
1118                 case IFLA_LINKMODE:
1119                         pos += os_snprintf(pos, end - pos, " linkmode=%u",
1120                                            nla_get_u32((struct nlattr *) attr));
1121                         break;
1122                 }
1123                 attr = RTA_NEXT(attr, attrlen);
1124         }
1125         extra[sizeof(extra) - 1] = '\0';
1126
1127         wpa_printf(MSG_DEBUG, "RTM_DELLINK: ifi_index=%d ifname=%s%s ifi_family=%d ifi_flags=0x%x (%s%s%s%s)",
1128                    ifi->ifi_index, ifname, extra, ifi->ifi_family,
1129                    ifi->ifi_flags,
1130                    (ifi->ifi_flags & IFF_UP) ? "[UP]" : "",
1131                    (ifi->ifi_flags & IFF_RUNNING) ? "[RUNNING]" : "",
1132                    (ifi->ifi_flags & IFF_LOWER_UP) ? "[LOWER_UP]" : "",
1133                    (ifi->ifi_flags & IFF_DORMANT) ? "[DORMANT]" : "");
1134
1135         if (ifname[0] && (ifi->ifi_family != AF_BRIDGE || !brid))
1136                 wpa_driver_nl80211_event_dellink(drv, ifname);
1137
1138         if (ifi->ifi_family == AF_BRIDGE && brid) {
1139                 /* device has been removed from bridge */
1140                 char namebuf[IFNAMSIZ];
1141
1142                 if (!if_indextoname(brid, namebuf)) {
1143                         wpa_printf(MSG_DEBUG,
1144                                    "nl80211: Could not find bridge ifname for ifindex %u",
1145                                    brid);
1146                 } else {
1147                         wpa_printf(MSG_DEBUG,
1148                                    "nl80211: Remove ifindex %u for bridge %s",
1149                                    brid, namebuf);
1150                 }
1151                 del_ifidx(drv, brid);
1152         }
1153 }
1154
1155
1156 unsigned int nl80211_get_assoc_freq(struct wpa_driver_nl80211_data *drv)
1157 {
1158         struct nl_msg *msg;
1159         int ret;
1160         struct nl80211_bss_info_arg arg;
1161
1162         msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_GET_SCAN);
1163         os_memset(&arg, 0, sizeof(arg));
1164         arg.drv = drv;
1165         ret = send_and_recv_msgs(drv, msg, bss_info_handler, &arg);
1166         if (ret == 0) {
1167                 unsigned int freq = drv->nlmode == NL80211_IFTYPE_ADHOC ?
1168                         arg.ibss_freq : arg.assoc_freq;
1169                 wpa_printf(MSG_DEBUG, "nl80211: Operating frequency for the "
1170                            "associated BSS from scan results: %u MHz", freq);
1171                 if (freq)
1172                         drv->assoc_freq = freq;
1173                 return drv->assoc_freq;
1174         }
1175         wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d "
1176                    "(%s)", ret, strerror(-ret));
1177         return drv->assoc_freq;
1178 }
1179
1180
1181 static int get_link_signal(struct nl_msg *msg, void *arg)
1182 {
1183         struct nlattr *tb[NL80211_ATTR_MAX + 1];
1184         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1185         struct nlattr *sinfo[NL80211_STA_INFO_MAX + 1];
1186         static struct nla_policy policy[NL80211_STA_INFO_MAX + 1] = {
1187                 [NL80211_STA_INFO_SIGNAL] = { .type = NLA_U8 },
1188                 [NL80211_STA_INFO_SIGNAL_AVG] = { .type = NLA_U8 },
1189                 [NL80211_STA_INFO_BEACON_SIGNAL_AVG] = { .type = NLA_U8 },
1190         };
1191         struct nlattr *rinfo[NL80211_RATE_INFO_MAX + 1];
1192         static struct nla_policy rate_policy[NL80211_RATE_INFO_MAX + 1] = {
1193                 [NL80211_RATE_INFO_BITRATE] = { .type = NLA_U16 },
1194                 [NL80211_RATE_INFO_MCS] = { .type = NLA_U8 },
1195                 [NL80211_RATE_INFO_40_MHZ_WIDTH] = { .type = NLA_FLAG },
1196                 [NL80211_RATE_INFO_SHORT_GI] = { .type = NLA_FLAG },
1197         };
1198         struct wpa_signal_info *sig_change = arg;
1199
1200         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1201                   genlmsg_attrlen(gnlh, 0), NULL);
1202         if (!tb[NL80211_ATTR_STA_INFO] ||
1203             nla_parse_nested(sinfo, NL80211_STA_INFO_MAX,
1204                              tb[NL80211_ATTR_STA_INFO], policy))
1205                 return NL_SKIP;
1206         if (!sinfo[NL80211_STA_INFO_SIGNAL])
1207                 return NL_SKIP;
1208
1209         sig_change->current_signal =
1210                 (s8) nla_get_u8(sinfo[NL80211_STA_INFO_SIGNAL]);
1211
1212         if (sinfo[NL80211_STA_INFO_SIGNAL_AVG])
1213                 sig_change->avg_signal =
1214                         (s8) nla_get_u8(sinfo[NL80211_STA_INFO_SIGNAL_AVG]);
1215         else
1216                 sig_change->avg_signal = 0;
1217
1218         if (sinfo[NL80211_STA_INFO_BEACON_SIGNAL_AVG])
1219                 sig_change->avg_beacon_signal =
1220                         (s8)
1221                         nla_get_u8(sinfo[NL80211_STA_INFO_BEACON_SIGNAL_AVG]);
1222         else
1223                 sig_change->avg_beacon_signal = 0;
1224
1225         if (sinfo[NL80211_STA_INFO_TX_BITRATE]) {
1226                 if (nla_parse_nested(rinfo, NL80211_RATE_INFO_MAX,
1227                                      sinfo[NL80211_STA_INFO_TX_BITRATE],
1228                                      rate_policy)) {
1229                         sig_change->current_txrate = 0;
1230                 } else {
1231                         if (rinfo[NL80211_RATE_INFO_BITRATE]) {
1232                                 sig_change->current_txrate =
1233                                         nla_get_u16(rinfo[
1234                                              NL80211_RATE_INFO_BITRATE]) * 100;
1235                         }
1236                 }
1237         }
1238
1239         return NL_SKIP;
1240 }
1241
1242
1243 int nl80211_get_link_signal(struct wpa_driver_nl80211_data *drv,
1244                             struct wpa_signal_info *sig)
1245 {
1246         struct nl_msg *msg;
1247
1248         sig->current_signal = -9999;
1249         sig->current_txrate = 0;
1250
1251         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_GET_STATION)) ||
1252             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, drv->bssid)) {
1253                 nlmsg_free(msg);
1254                 return -ENOBUFS;
1255         }
1256
1257         return send_and_recv_msgs(drv, msg, get_link_signal, sig);
1258 }
1259
1260
1261 static int get_link_noise(struct nl_msg *msg, void *arg)
1262 {
1263         struct nlattr *tb[NL80211_ATTR_MAX + 1];
1264         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1265         struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
1266         static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
1267                 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
1268                 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
1269         };
1270         struct wpa_signal_info *sig_change = arg;
1271
1272         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1273                   genlmsg_attrlen(gnlh, 0), NULL);
1274
1275         if (!tb[NL80211_ATTR_SURVEY_INFO]) {
1276                 wpa_printf(MSG_DEBUG, "nl80211: survey data missing!");
1277                 return NL_SKIP;
1278         }
1279
1280         if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
1281                              tb[NL80211_ATTR_SURVEY_INFO],
1282                              survey_policy)) {
1283                 wpa_printf(MSG_DEBUG, "nl80211: failed to parse nested "
1284                            "attributes!");
1285                 return NL_SKIP;
1286         }
1287
1288         if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY])
1289                 return NL_SKIP;
1290
1291         if (nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]) !=
1292             sig_change->frequency)
1293                 return NL_SKIP;
1294
1295         if (!sinfo[NL80211_SURVEY_INFO_NOISE])
1296                 return NL_SKIP;
1297
1298         sig_change->current_noise =
1299                 (s8) nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
1300
1301         return NL_SKIP;
1302 }
1303
1304
1305 int nl80211_get_link_noise(struct wpa_driver_nl80211_data *drv,
1306                            struct wpa_signal_info *sig_change)
1307 {
1308         struct nl_msg *msg;
1309
1310         sig_change->current_noise = 9999;
1311         sig_change->frequency = drv->assoc_freq;
1312
1313         msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_GET_SURVEY);
1314         return send_and_recv_msgs(drv, msg, get_link_noise, sig_change);
1315 }
1316
1317
1318 static void wpa_driver_nl80211_event_receive(int sock, void *eloop_ctx,
1319                                              void *handle)
1320 {
1321         struct nl_cb *cb = eloop_ctx;
1322         int res;
1323
1324         wpa_printf(MSG_MSGDUMP, "nl80211: Event message available");
1325
1326         res = nl_recvmsgs(handle, cb);
1327         if (res < 0) {
1328                 wpa_printf(MSG_INFO, "nl80211: %s->nl_recvmsgs failed: %d",
1329                            __func__, res);
1330         }
1331 }
1332
1333
1334 /**
1335  * wpa_driver_nl80211_set_country - ask nl80211 to set the regulatory domain
1336  * @priv: driver_nl80211 private data
1337  * @alpha2_arg: country to which to switch to
1338  * Returns: 0 on success, -1 on failure
1339  *
1340  * This asks nl80211 to set the regulatory domain for given
1341  * country ISO / IEC alpha2.
1342  */
1343 static int wpa_driver_nl80211_set_country(void *priv, const char *alpha2_arg)
1344 {
1345         struct i802_bss *bss = priv;
1346         struct wpa_driver_nl80211_data *drv = bss->drv;
1347         char alpha2[3];
1348         struct nl_msg *msg;
1349
1350         msg = nlmsg_alloc();
1351         if (!msg)
1352                 return -ENOMEM;
1353
1354         alpha2[0] = alpha2_arg[0];
1355         alpha2[1] = alpha2_arg[1];
1356         alpha2[2] = '\0';
1357
1358         if (!nl80211_cmd(drv, msg, 0, NL80211_CMD_REQ_SET_REG) ||
1359             nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, alpha2)) {
1360                 nlmsg_free(msg);
1361                 return -EINVAL;
1362         }
1363         if (send_and_recv_msgs(drv, msg, NULL, NULL))
1364                 return -EINVAL;
1365         return 0;
1366 }
1367
1368
1369 static int nl80211_get_country(struct nl_msg *msg, void *arg)
1370 {
1371         char *alpha2 = arg;
1372         struct nlattr *tb_msg[NL80211_ATTR_MAX + 1];
1373         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1374
1375         nla_parse(tb_msg, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1376                   genlmsg_attrlen(gnlh, 0), NULL);
1377         if (!tb_msg[NL80211_ATTR_REG_ALPHA2]) {
1378                 wpa_printf(MSG_DEBUG, "nl80211: No country information available");
1379                 return NL_SKIP;
1380         }
1381         os_strlcpy(alpha2, nla_data(tb_msg[NL80211_ATTR_REG_ALPHA2]), 3);
1382         return NL_SKIP;
1383 }
1384
1385
1386 static int wpa_driver_nl80211_get_country(void *priv, char *alpha2)
1387 {
1388         struct i802_bss *bss = priv;
1389         struct wpa_driver_nl80211_data *drv = bss->drv;
1390         struct nl_msg *msg;
1391         int ret;
1392
1393         msg = nlmsg_alloc();
1394         if (!msg)
1395                 return -ENOMEM;
1396
1397         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_REG);
1398         alpha2[0] = '\0';
1399         ret = send_and_recv_msgs(drv, msg, nl80211_get_country, alpha2);
1400         if (!alpha2[0])
1401                 ret = -1;
1402
1403         return ret;
1404 }
1405
1406
1407 static int wpa_driver_nl80211_init_nl_global(struct nl80211_global *global)
1408 {
1409         int ret;
1410
1411         global->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
1412         if (global->nl_cb == NULL) {
1413                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate netlink "
1414                            "callbacks");
1415                 return -1;
1416         }
1417
1418         global->nl = nl_create_handle(global->nl_cb, "nl");
1419         if (global->nl == NULL)
1420                 goto err;
1421
1422         global->nl80211_id = genl_ctrl_resolve(global->nl, "nl80211");
1423         if (global->nl80211_id < 0) {
1424                 wpa_printf(MSG_ERROR, "nl80211: 'nl80211' generic netlink not "
1425                            "found");
1426                 goto err;
1427         }
1428
1429         global->nl_event = nl_create_handle(global->nl_cb, "event");
1430         if (global->nl_event == NULL)
1431                 goto err;
1432
1433         ret = nl_get_multicast_id(global, "nl80211", "scan");
1434         if (ret >= 0)
1435                 ret = nl_socket_add_membership(global->nl_event, ret);
1436         if (ret < 0) {
1437                 wpa_printf(MSG_ERROR, "nl80211: Could not add multicast "
1438                            "membership for scan events: %d (%s)",
1439                            ret, strerror(-ret));
1440                 goto err;
1441         }
1442
1443         ret = nl_get_multicast_id(global, "nl80211", "mlme");
1444         if (ret >= 0)
1445                 ret = nl_socket_add_membership(global->nl_event, ret);
1446         if (ret < 0) {
1447                 wpa_printf(MSG_ERROR, "nl80211: Could not add multicast "
1448                            "membership for mlme events: %d (%s)",
1449                            ret, strerror(-ret));
1450                 goto err;
1451         }
1452
1453         ret = nl_get_multicast_id(global, "nl80211", "regulatory");
1454         if (ret >= 0)
1455                 ret = nl_socket_add_membership(global->nl_event, ret);
1456         if (ret < 0) {
1457                 wpa_printf(MSG_DEBUG, "nl80211: Could not add multicast "
1458                            "membership for regulatory events: %d (%s)",
1459                            ret, strerror(-ret));
1460                 /* Continue without regulatory events */
1461         }
1462
1463         ret = nl_get_multicast_id(global, "nl80211", "vendor");
1464         if (ret >= 0)
1465                 ret = nl_socket_add_membership(global->nl_event, ret);
1466         if (ret < 0) {
1467                 wpa_printf(MSG_DEBUG, "nl80211: Could not add multicast "
1468                            "membership for vendor events: %d (%s)",
1469                            ret, strerror(-ret));
1470                 /* Continue without vendor events */
1471         }
1472
1473         nl_cb_set(global->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM,
1474                   no_seq_check, NULL);
1475         nl_cb_set(global->nl_cb, NL_CB_VALID, NL_CB_CUSTOM,
1476                   process_global_event, global);
1477
1478         nl80211_register_eloop_read(&global->nl_event,
1479                                     wpa_driver_nl80211_event_receive,
1480                                     global->nl_cb);
1481
1482         return 0;
1483
1484 err:
1485         nl_destroy_handles(&global->nl_event);
1486         nl_destroy_handles(&global->nl);
1487         nl_cb_put(global->nl_cb);
1488         global->nl_cb = NULL;
1489         return -1;
1490 }
1491
1492
1493 static void nl80211_check_global(struct nl80211_global *global)
1494 {
1495         struct nl_handle *handle;
1496         const char *groups[] = { "scan", "mlme", "regulatory", "vendor", NULL };
1497         int ret;
1498         unsigned int i;
1499
1500         /*
1501          * Try to re-add memberships to handle case of cfg80211 getting reloaded
1502          * and all registration having been cleared.
1503          */
1504         handle = (void *) (((intptr_t) global->nl_event) ^
1505                            ELOOP_SOCKET_INVALID);
1506
1507         for (i = 0; groups[i]; i++) {
1508                 ret = nl_get_multicast_id(global, "nl80211", groups[i]);
1509                 if (ret >= 0)
1510                         ret = nl_socket_add_membership(handle, ret);
1511                 if (ret < 0) {
1512                         wpa_printf(MSG_INFO,
1513                                    "nl80211: Could not re-add multicast membership for %s events: %d (%s)",
1514                                    groups[i], ret, strerror(-ret));
1515                 }
1516         }
1517 }
1518
1519
1520 static void wpa_driver_nl80211_rfkill_blocked(void *ctx)
1521 {
1522         wpa_printf(MSG_DEBUG, "nl80211: RFKILL blocked");
1523         /*
1524          * This may be for any interface; use ifdown event to disable
1525          * interface.
1526          */
1527 }
1528
1529
1530 static void wpa_driver_nl80211_rfkill_unblocked(void *ctx)
1531 {
1532         struct wpa_driver_nl80211_data *drv = ctx;
1533         wpa_printf(MSG_DEBUG, "nl80211: RFKILL unblocked");
1534         if (i802_set_iface_flags(drv->first_bss, 1)) {
1535                 wpa_printf(MSG_DEBUG, "nl80211: Could not set interface UP "
1536                            "after rfkill unblock");
1537                 return;
1538         }
1539         /* rtnetlink ifup handler will report interface as enabled */
1540 }
1541
1542
1543 static void wpa_driver_nl80211_handle_eapol_tx_status(int sock,
1544                                                       void *eloop_ctx,
1545                                                       void *handle)
1546 {
1547         struct wpa_driver_nl80211_data *drv = eloop_ctx;
1548         u8 data[2048];
1549         struct msghdr msg;
1550         struct iovec entry;
1551         u8 control[512];
1552         struct cmsghdr *cmsg;
1553         int res, found_ee = 0, found_wifi = 0, acked = 0;
1554         union wpa_event_data event;
1555
1556         memset(&msg, 0, sizeof(msg));
1557         msg.msg_iov = &entry;
1558         msg.msg_iovlen = 1;
1559         entry.iov_base = data;
1560         entry.iov_len = sizeof(data);
1561         msg.msg_control = &control;
1562         msg.msg_controllen = sizeof(control);
1563
1564         res = recvmsg(sock, &msg, MSG_ERRQUEUE);
1565         /* if error or not fitting 802.3 header, return */
1566         if (res < 14)
1567                 return;
1568
1569         for (cmsg = CMSG_FIRSTHDR(&msg); cmsg; cmsg = CMSG_NXTHDR(&msg, cmsg))
1570         {
1571                 if (cmsg->cmsg_level == SOL_SOCKET &&
1572                     cmsg->cmsg_type == SCM_WIFI_STATUS) {
1573                         int *ack;
1574
1575                         found_wifi = 1;
1576                         ack = (void *)CMSG_DATA(cmsg);
1577                         acked = *ack;
1578                 }
1579
1580                 if (cmsg->cmsg_level == SOL_PACKET &&
1581                     cmsg->cmsg_type == PACKET_TX_TIMESTAMP) {
1582                         struct sock_extended_err *err =
1583                                 (struct sock_extended_err *)CMSG_DATA(cmsg);
1584
1585                         if (err->ee_origin == SO_EE_ORIGIN_TXSTATUS)
1586                                 found_ee = 1;
1587                 }
1588         }
1589
1590         if (!found_ee || !found_wifi)
1591                 return;
1592
1593         memset(&event, 0, sizeof(event));
1594         event.eapol_tx_status.dst = data;
1595         event.eapol_tx_status.data = data + 14;
1596         event.eapol_tx_status.data_len = res - 14;
1597         event.eapol_tx_status.ack = acked;
1598         wpa_supplicant_event(drv->ctx, EVENT_EAPOL_TX_STATUS, &event);
1599 }
1600
1601
1602 static int nl80211_init_bss(struct i802_bss *bss)
1603 {
1604         bss->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
1605         if (!bss->nl_cb)
1606                 return -1;
1607
1608         nl_cb_set(bss->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM,
1609                   no_seq_check, NULL);
1610         nl_cb_set(bss->nl_cb, NL_CB_VALID, NL_CB_CUSTOM,
1611                   process_bss_event, bss);
1612
1613         return 0;
1614 }
1615
1616
1617 static void nl80211_destroy_bss(struct i802_bss *bss)
1618 {
1619         nl_cb_put(bss->nl_cb);
1620         bss->nl_cb = NULL;
1621 }
1622
1623
1624 static void * wpa_driver_nl80211_drv_init(void *ctx, const char *ifname,
1625                                           void *global_priv, int hostapd,
1626                                           const u8 *set_addr,
1627                                           const char *driver_params)
1628 {
1629         struct wpa_driver_nl80211_data *drv;
1630         struct rfkill_config *rcfg;
1631         struct i802_bss *bss;
1632
1633         if (global_priv == NULL)
1634                 return NULL;
1635         drv = os_zalloc(sizeof(*drv));
1636         if (drv == NULL)
1637                 return NULL;
1638         drv->global = global_priv;
1639         drv->ctx = ctx;
1640         drv->hostapd = !!hostapd;
1641         drv->eapol_sock = -1;
1642
1643         /*
1644          * There is no driver capability flag for this, so assume it is
1645          * supported and disable this on first attempt to use if the driver
1646          * rejects the command due to missing support.
1647          */
1648         drv->set_rekey_offload = 1;
1649
1650         drv->num_if_indices = sizeof(drv->default_if_indices) / sizeof(int);
1651         drv->if_indices = drv->default_if_indices;
1652
1653         drv->first_bss = os_zalloc(sizeof(*drv->first_bss));
1654         if (!drv->first_bss) {
1655                 os_free(drv);
1656                 return NULL;
1657         }
1658         bss = drv->first_bss;
1659         bss->drv = drv;
1660         bss->ctx = ctx;
1661
1662         os_strlcpy(bss->ifname, ifname, sizeof(bss->ifname));
1663         drv->monitor_ifidx = -1;
1664         drv->monitor_sock = -1;
1665         drv->eapol_tx_sock = -1;
1666         drv->ap_scan_as_station = NL80211_IFTYPE_UNSPECIFIED;
1667
1668         if (nl80211_init_bss(bss))
1669                 goto failed;
1670
1671         rcfg = os_zalloc(sizeof(*rcfg));
1672         if (rcfg == NULL)
1673                 goto failed;
1674         rcfg->ctx = drv;
1675         os_strlcpy(rcfg->ifname, ifname, sizeof(rcfg->ifname));
1676         rcfg->blocked_cb = wpa_driver_nl80211_rfkill_blocked;
1677         rcfg->unblocked_cb = wpa_driver_nl80211_rfkill_unblocked;
1678         drv->rfkill = rfkill_init(rcfg);
1679         if (drv->rfkill == NULL) {
1680                 wpa_printf(MSG_DEBUG, "nl80211: RFKILL status not available");
1681                 os_free(rcfg);
1682         }
1683
1684         if (linux_iface_up(drv->global->ioctl_sock, ifname) > 0)
1685                 drv->start_iface_up = 1;
1686
1687         if (wpa_driver_nl80211_finish_drv_init(drv, set_addr, 1, driver_params))
1688                 goto failed;
1689
1690         drv->eapol_tx_sock = socket(PF_PACKET, SOCK_DGRAM, 0);
1691         if (drv->eapol_tx_sock < 0)
1692                 goto failed;
1693
1694         if (drv->data_tx_status) {
1695                 int enabled = 1;
1696
1697                 if (setsockopt(drv->eapol_tx_sock, SOL_SOCKET, SO_WIFI_STATUS,
1698                                &enabled, sizeof(enabled)) < 0) {
1699                         wpa_printf(MSG_DEBUG,
1700                                 "nl80211: wifi status sockopt failed\n");
1701                         drv->data_tx_status = 0;
1702                         if (!drv->use_monitor)
1703                                 drv->capa.flags &=
1704                                         ~WPA_DRIVER_FLAGS_EAPOL_TX_STATUS;
1705                 } else {
1706                         eloop_register_read_sock(drv->eapol_tx_sock,
1707                                 wpa_driver_nl80211_handle_eapol_tx_status,
1708                                 drv, NULL);
1709                 }
1710         }
1711
1712         if (drv->global) {
1713                 nl80211_check_global(drv->global);
1714                 dl_list_add(&drv->global->interfaces, &drv->list);
1715                 drv->in_interface_list = 1;
1716         }
1717
1718         return bss;
1719
1720 failed:
1721         wpa_driver_nl80211_deinit(bss);
1722         return NULL;
1723 }
1724
1725
1726 /**
1727  * wpa_driver_nl80211_init - Initialize nl80211 driver interface
1728  * @ctx: context to be used when calling wpa_supplicant functions,
1729  * e.g., wpa_supplicant_event()
1730  * @ifname: interface name, e.g., wlan0
1731  * @global_priv: private driver global data from global_init()
1732  * Returns: Pointer to private data, %NULL on failure
1733  */
1734 static void * wpa_driver_nl80211_init(void *ctx, const char *ifname,
1735                                       void *global_priv)
1736 {
1737         return wpa_driver_nl80211_drv_init(ctx, ifname, global_priv, 0, NULL,
1738                                            NULL);
1739 }
1740
1741
1742 static int nl80211_register_frame(struct i802_bss *bss,
1743                                   struct nl_handle *nl_handle,
1744                                   u16 type, const u8 *match, size_t match_len)
1745 {
1746         struct wpa_driver_nl80211_data *drv = bss->drv;
1747         struct nl_msg *msg;
1748         int ret;
1749         char buf[30];
1750
1751         buf[0] = '\0';
1752         wpa_snprintf_hex(buf, sizeof(buf), match, match_len);
1753         wpa_printf(MSG_DEBUG, "nl80211: Register frame type=0x%x (%s) nl_handle=%p match=%s",
1754                    type, fc2str(type), nl_handle, buf);
1755
1756         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_REGISTER_ACTION)) ||
1757             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE, type) ||
1758             nla_put(msg, NL80211_ATTR_FRAME_MATCH, match_len, match)) {
1759                 nlmsg_free(msg);
1760                 return -1;
1761         }
1762
1763         ret = send_and_recv(drv->global, nl_handle, msg, NULL, NULL);
1764         if (ret) {
1765                 wpa_printf(MSG_DEBUG, "nl80211: Register frame command "
1766                            "failed (type=%u): ret=%d (%s)",
1767                            type, ret, strerror(-ret));
1768                 wpa_hexdump(MSG_DEBUG, "nl80211: Register frame match",
1769                             match, match_len);
1770         }
1771         return ret;
1772 }
1773
1774
1775 static int nl80211_alloc_mgmt_handle(struct i802_bss *bss)
1776 {
1777         if (bss->nl_mgmt) {
1778                 wpa_printf(MSG_DEBUG, "nl80211: Mgmt reporting "
1779                            "already on! (nl_mgmt=%p)", bss->nl_mgmt);
1780                 return -1;
1781         }
1782
1783         bss->nl_mgmt = nl_create_handle(bss->nl_cb, "mgmt");
1784         if (bss->nl_mgmt == NULL)
1785                 return -1;
1786
1787         return 0;
1788 }
1789
1790
1791 static void nl80211_mgmt_handle_register_eloop(struct i802_bss *bss)
1792 {
1793         nl80211_register_eloop_read(&bss->nl_mgmt,
1794                                     wpa_driver_nl80211_event_receive,
1795                                     bss->nl_cb);
1796 }
1797
1798
1799 static int nl80211_register_action_frame(struct i802_bss *bss,
1800                                          const u8 *match, size_t match_len)
1801 {
1802         u16 type = (WLAN_FC_TYPE_MGMT << 2) | (WLAN_FC_STYPE_ACTION << 4);
1803         return nl80211_register_frame(bss, bss->nl_mgmt,
1804                                       type, match, match_len);
1805 }
1806
1807
1808 static int nl80211_mgmt_subscribe_non_ap(struct i802_bss *bss)
1809 {
1810         struct wpa_driver_nl80211_data *drv = bss->drv;
1811         int ret = 0;
1812
1813         if (nl80211_alloc_mgmt_handle(bss))
1814                 return -1;
1815         wpa_printf(MSG_DEBUG, "nl80211: Subscribe to mgmt frames with non-AP "
1816                    "handle %p", bss->nl_mgmt);
1817
1818         if (drv->nlmode == NL80211_IFTYPE_ADHOC) {
1819                 u16 type = (WLAN_FC_TYPE_MGMT << 2) | (WLAN_FC_STYPE_AUTH << 4);
1820
1821                 /* register for any AUTH message */
1822                 nl80211_register_frame(bss, bss->nl_mgmt, type, NULL, 0);
1823         }
1824
1825 #ifdef CONFIG_INTERWORKING
1826         /* QoS Map Configure */
1827         if (nl80211_register_action_frame(bss, (u8 *) "\x01\x04", 2) < 0)
1828                 ret = -1;
1829 #endif /* CONFIG_INTERWORKING */
1830 #if defined(CONFIG_P2P) || defined(CONFIG_INTERWORKING)
1831         /* GAS Initial Request */
1832         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0a", 2) < 0)
1833                 ret = -1;
1834         /* GAS Initial Response */
1835         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0b", 2) < 0)
1836                 ret = -1;
1837         /* GAS Comeback Request */
1838         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0c", 2) < 0)
1839                 ret = -1;
1840         /* GAS Comeback Response */
1841         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0d", 2) < 0)
1842                 ret = -1;
1843         /* Protected GAS Initial Request */
1844         if (nl80211_register_action_frame(bss, (u8 *) "\x09\x0a", 2) < 0)
1845                 ret = -1;
1846         /* Protected GAS Initial Response */
1847         if (nl80211_register_action_frame(bss, (u8 *) "\x09\x0b", 2) < 0)
1848                 ret = -1;
1849         /* Protected GAS Comeback Request */
1850         if (nl80211_register_action_frame(bss, (u8 *) "\x09\x0c", 2) < 0)
1851                 ret = -1;
1852         /* Protected GAS Comeback Response */
1853         if (nl80211_register_action_frame(bss, (u8 *) "\x09\x0d", 2) < 0)
1854                 ret = -1;
1855 #endif /* CONFIG_P2P || CONFIG_INTERWORKING */
1856 #ifdef CONFIG_P2P
1857         /* P2P Public Action */
1858         if (nl80211_register_action_frame(bss,
1859                                           (u8 *) "\x04\x09\x50\x6f\x9a\x09",
1860                                           6) < 0)
1861                 ret = -1;
1862         /* P2P Action */
1863         if (nl80211_register_action_frame(bss,
1864                                           (u8 *) "\x7f\x50\x6f\x9a\x09",
1865                                           5) < 0)
1866                 ret = -1;
1867 #endif /* CONFIG_P2P */
1868 #ifdef CONFIG_IEEE80211W
1869         /* SA Query Response */
1870         if (nl80211_register_action_frame(bss, (u8 *) "\x08\x01", 2) < 0)
1871                 ret = -1;
1872 #endif /* CONFIG_IEEE80211W */
1873 #ifdef CONFIG_TDLS
1874         if ((drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT)) {
1875                 /* TDLS Discovery Response */
1876                 if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0e", 2) <
1877                     0)
1878                         ret = -1;
1879         }
1880 #endif /* CONFIG_TDLS */
1881 #ifdef CONFIG_FST
1882         /* FST Action frames */
1883         if (nl80211_register_action_frame(bss, (u8 *) "\x12", 1) < 0)
1884                 ret = -1;
1885 #endif /* CONFIG_FST */
1886
1887         /* FT Action frames */
1888         if (nl80211_register_action_frame(bss, (u8 *) "\x06", 1) < 0)
1889                 ret = -1;
1890         else
1891                 drv->capa.key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_FT |
1892                         WPA_DRIVER_CAPA_KEY_MGMT_FT_PSK;
1893
1894         /* WNM - BSS Transition Management Request */
1895         if (nl80211_register_action_frame(bss, (u8 *) "\x0a\x07", 2) < 0)
1896                 ret = -1;
1897         /* WNM-Sleep Mode Response */
1898         if (nl80211_register_action_frame(bss, (u8 *) "\x0a\x11", 2) < 0)
1899                 ret = -1;
1900
1901 #ifdef CONFIG_HS20
1902         /* WNM-Notification */
1903         if (nl80211_register_action_frame(bss, (u8 *) "\x0a\x1a", 2) < 0)
1904                 ret = -1;
1905 #endif /* CONFIG_HS20 */
1906
1907         /* WMM-AC ADDTS Response */
1908         if (nl80211_register_action_frame(bss, (u8 *) "\x11\x01", 2) < 0)
1909                 ret = -1;
1910
1911         /* WMM-AC DELTS */
1912         if (nl80211_register_action_frame(bss, (u8 *) "\x11\x02", 2) < 0)
1913                 ret = -1;
1914
1915         /* Radio Measurement - Neighbor Report Response */
1916         if (nl80211_register_action_frame(bss, (u8 *) "\x05\x05", 2) < 0)
1917                 ret = -1;
1918
1919         /* Radio Measurement - Link Measurement Request */
1920         if ((drv->capa.rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION) &&
1921             (nl80211_register_action_frame(bss, (u8 *) "\x05\x02", 2) < 0))
1922                 ret = -1;
1923
1924         nl80211_mgmt_handle_register_eloop(bss);
1925
1926         return ret;
1927 }
1928
1929
1930 static int nl80211_mgmt_subscribe_mesh(struct i802_bss *bss)
1931 {
1932         int ret = 0;
1933
1934         if (nl80211_alloc_mgmt_handle(bss))
1935                 return -1;
1936
1937         wpa_printf(MSG_DEBUG,
1938                    "nl80211: Subscribe to mgmt frames with mesh handle %p",
1939                    bss->nl_mgmt);
1940
1941         /* Auth frames for mesh SAE */
1942         if (nl80211_register_frame(bss, bss->nl_mgmt,
1943                                    (WLAN_FC_TYPE_MGMT << 2) |
1944                                    (WLAN_FC_STYPE_AUTH << 4),
1945                                    NULL, 0) < 0)
1946                 ret = -1;
1947
1948         /* Mesh peering open */
1949         if (nl80211_register_action_frame(bss, (u8 *) "\x0f\x01", 2) < 0)
1950                 ret = -1;
1951         /* Mesh peering confirm */
1952         if (nl80211_register_action_frame(bss, (u8 *) "\x0f\x02", 2) < 0)
1953                 ret = -1;
1954         /* Mesh peering close */
1955         if (nl80211_register_action_frame(bss, (u8 *) "\x0f\x03", 2) < 0)
1956                 ret = -1;
1957
1958         nl80211_mgmt_handle_register_eloop(bss);
1959
1960         return ret;
1961 }
1962
1963
1964 static int nl80211_register_spurious_class3(struct i802_bss *bss)
1965 {
1966         struct nl_msg *msg;
1967         int ret;
1968
1969         msg = nl80211_bss_msg(bss, 0, NL80211_CMD_UNEXPECTED_FRAME);
1970         ret = send_and_recv(bss->drv->global, bss->nl_mgmt, msg, NULL, NULL);
1971         if (ret) {
1972                 wpa_printf(MSG_DEBUG, "nl80211: Register spurious class3 "
1973                            "failed: ret=%d (%s)",
1974                            ret, strerror(-ret));
1975         }
1976         return ret;
1977 }
1978
1979
1980 static int nl80211_mgmt_subscribe_ap(struct i802_bss *bss)
1981 {
1982         static const int stypes[] = {
1983                 WLAN_FC_STYPE_AUTH,
1984                 WLAN_FC_STYPE_ASSOC_REQ,
1985                 WLAN_FC_STYPE_REASSOC_REQ,
1986                 WLAN_FC_STYPE_DISASSOC,
1987                 WLAN_FC_STYPE_DEAUTH,
1988                 WLAN_FC_STYPE_ACTION,
1989                 WLAN_FC_STYPE_PROBE_REQ,
1990 /* Beacon doesn't work as mac80211 doesn't currently allow
1991  * it, but it wouldn't really be the right thing anyway as
1992  * it isn't per interface ... maybe just dump the scan
1993  * results periodically for OLBC?
1994  */
1995                 /* WLAN_FC_STYPE_BEACON, */
1996         };
1997         unsigned int i;
1998
1999         if (nl80211_alloc_mgmt_handle(bss))
2000                 return -1;
2001         wpa_printf(MSG_DEBUG, "nl80211: Subscribe to mgmt frames with AP "
2002                    "handle %p", bss->nl_mgmt);
2003
2004         for (i = 0; i < ARRAY_SIZE(stypes); i++) {
2005                 if (nl80211_register_frame(bss, bss->nl_mgmt,
2006                                            (WLAN_FC_TYPE_MGMT << 2) |
2007                                            (stypes[i] << 4),
2008                                            NULL, 0) < 0) {
2009                         goto out_err;
2010                 }
2011         }
2012
2013         if (nl80211_register_spurious_class3(bss))
2014                 goto out_err;
2015
2016         if (nl80211_get_wiphy_data_ap(bss) == NULL)
2017                 goto out_err;
2018
2019         nl80211_mgmt_handle_register_eloop(bss);
2020         return 0;
2021
2022 out_err:
2023         nl_destroy_handles(&bss->nl_mgmt);
2024         return -1;
2025 }
2026
2027
2028 static int nl80211_mgmt_subscribe_ap_dev_sme(struct i802_bss *bss)
2029 {
2030         if (nl80211_alloc_mgmt_handle(bss))
2031                 return -1;
2032         wpa_printf(MSG_DEBUG, "nl80211: Subscribe to mgmt frames with AP "
2033                    "handle %p (device SME)", bss->nl_mgmt);
2034
2035         if (nl80211_register_frame(bss, bss->nl_mgmt,
2036                                    (WLAN_FC_TYPE_MGMT << 2) |
2037                                    (WLAN_FC_STYPE_ACTION << 4),
2038                                    NULL, 0) < 0)
2039                 goto out_err;
2040
2041         nl80211_mgmt_handle_register_eloop(bss);
2042         return 0;
2043
2044 out_err:
2045         nl_destroy_handles(&bss->nl_mgmt);
2046         return -1;
2047 }
2048
2049
2050 static void nl80211_mgmt_unsubscribe(struct i802_bss *bss, const char *reason)
2051 {
2052         if (bss->nl_mgmt == NULL)
2053                 return;
2054         wpa_printf(MSG_DEBUG, "nl80211: Unsubscribe mgmt frames handle %p "
2055                    "(%s)", bss->nl_mgmt, reason);
2056         nl80211_destroy_eloop_handle(&bss->nl_mgmt);
2057
2058         nl80211_put_wiphy_data_ap(bss);
2059 }
2060
2061
2062 static void wpa_driver_nl80211_send_rfkill(void *eloop_ctx, void *timeout_ctx)
2063 {
2064         wpa_supplicant_event(timeout_ctx, EVENT_INTERFACE_DISABLED, NULL);
2065 }
2066
2067
2068 static void nl80211_del_p2pdev(struct i802_bss *bss)
2069 {
2070         struct nl_msg *msg;
2071         int ret;
2072
2073         msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_DEL_INTERFACE);
2074         ret = send_and_recv_msgs(bss->drv, msg, NULL, NULL);
2075
2076         wpa_printf(MSG_DEBUG, "nl80211: Delete P2P Device %s (0x%llx): %s",
2077                    bss->ifname, (long long unsigned int) bss->wdev_id,
2078                    strerror(-ret));
2079 }
2080
2081
2082 static int nl80211_set_p2pdev(struct i802_bss *bss, int start)
2083 {
2084         struct nl_msg *msg;
2085         int ret;
2086
2087         msg = nl80211_cmd_msg(bss, 0, start ? NL80211_CMD_START_P2P_DEVICE :
2088                               NL80211_CMD_STOP_P2P_DEVICE);
2089         ret = send_and_recv_msgs(bss->drv, msg, NULL, NULL);
2090
2091         wpa_printf(MSG_DEBUG, "nl80211: %s P2P Device %s (0x%llx): %s",
2092                    start ? "Start" : "Stop",
2093                    bss->ifname, (long long unsigned int) bss->wdev_id,
2094                    strerror(-ret));
2095         return ret;
2096 }
2097
2098
2099 static int i802_set_iface_flags(struct i802_bss *bss, int up)
2100 {
2101         enum nl80211_iftype nlmode;
2102
2103         nlmode = nl80211_get_ifmode(bss);
2104         if (nlmode != NL80211_IFTYPE_P2P_DEVICE) {
2105                 return linux_set_iface_flags(bss->drv->global->ioctl_sock,
2106                                              bss->ifname, up);
2107         }
2108
2109         /* P2P Device has start/stop which is equivalent */
2110         return nl80211_set_p2pdev(bss, up);
2111 }
2112
2113
2114 #ifdef CONFIG_TESTING_OPTIONS
2115 static int qca_vendor_test_cmd_handler(struct nl_msg *msg, void *arg)
2116 {
2117         /* struct wpa_driver_nl80211_data *drv = arg; */
2118         struct nlattr *tb[NL80211_ATTR_MAX + 1];
2119         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
2120
2121
2122         wpa_printf(MSG_DEBUG,
2123                    "nl80211: QCA vendor test command response received");
2124
2125         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
2126                   genlmsg_attrlen(gnlh, 0), NULL);
2127         if (!tb[NL80211_ATTR_VENDOR_DATA]) {
2128                 wpa_printf(MSG_DEBUG, "nl80211: No vendor data attribute");
2129                 return NL_SKIP;
2130         }
2131
2132         wpa_hexdump(MSG_DEBUG,
2133                     "nl80211: Received QCA vendor test command response",
2134                     nla_data(tb[NL80211_ATTR_VENDOR_DATA]),
2135                     nla_len(tb[NL80211_ATTR_VENDOR_DATA]));
2136
2137         return NL_SKIP;
2138 }
2139 #endif /* CONFIG_TESTING_OPTIONS */
2140
2141
2142 static void qca_vendor_test(struct wpa_driver_nl80211_data *drv)
2143 {
2144 #ifdef CONFIG_TESTING_OPTIONS
2145         struct nl_msg *msg;
2146         struct nlattr *params;
2147         int ret;
2148
2149         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
2150             nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
2151             nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
2152                         QCA_NL80211_VENDOR_SUBCMD_TEST) ||
2153             !(params = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
2154             nla_put_u32(msg, QCA_WLAN_VENDOR_ATTR_TEST, 123)) {
2155                 nlmsg_free(msg);
2156                 return;
2157         }
2158         nla_nest_end(msg, params);
2159
2160         ret = send_and_recv_msgs(drv, msg, qca_vendor_test_cmd_handler, drv);
2161         wpa_printf(MSG_DEBUG,
2162                    "nl80211: QCA vendor test command returned %d (%s)",
2163                    ret, strerror(-ret));
2164 #endif /* CONFIG_TESTING_OPTIONS */
2165 }
2166
2167
2168 static int
2169 wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv,
2170                                    const u8 *set_addr, int first,
2171                                    const char *driver_params)
2172 {
2173         struct i802_bss *bss = drv->first_bss;
2174         int send_rfkill_event = 0;
2175         enum nl80211_iftype nlmode;
2176
2177         drv->ifindex = if_nametoindex(bss->ifname);
2178         bss->ifindex = drv->ifindex;
2179         bss->wdev_id = drv->global->if_add_wdevid;
2180         bss->wdev_id_set = drv->global->if_add_wdevid_set;
2181
2182         bss->if_dynamic = drv->ifindex == drv->global->if_add_ifindex;
2183         bss->if_dynamic = bss->if_dynamic || drv->global->if_add_wdevid_set;
2184         drv->global->if_add_wdevid_set = 0;
2185
2186         if (!bss->if_dynamic && nl80211_get_ifmode(bss) == NL80211_IFTYPE_AP)
2187                 bss->static_ap = 1;
2188
2189         if (wpa_driver_nl80211_capa(drv))
2190                 return -1;
2191
2192         if (driver_params && nl80211_set_param(bss, driver_params) < 0)
2193                 return -1;
2194
2195         wpa_printf(MSG_DEBUG, "nl80211: interface %s in phy %s",
2196                    bss->ifname, drv->phyname);
2197
2198         if (set_addr &&
2199             (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 0) ||
2200              linux_set_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
2201                                 set_addr)))
2202                 return -1;
2203
2204         if (first && nl80211_get_ifmode(bss) == NL80211_IFTYPE_AP)
2205                 drv->start_mode_ap = 1;
2206
2207         if (drv->hostapd || bss->static_ap)
2208                 nlmode = NL80211_IFTYPE_AP;
2209         else if (bss->if_dynamic)
2210                 nlmode = nl80211_get_ifmode(bss);
2211         else
2212                 nlmode = NL80211_IFTYPE_STATION;
2213
2214         if (wpa_driver_nl80211_set_mode(bss, nlmode) < 0) {
2215                 wpa_printf(MSG_ERROR, "nl80211: Could not configure driver mode");
2216                 return -1;
2217         }
2218
2219         if (nlmode == NL80211_IFTYPE_P2P_DEVICE)
2220                 nl80211_get_macaddr(bss);
2221
2222         if (!rfkill_is_blocked(drv->rfkill)) {
2223                 int ret = i802_set_iface_flags(bss, 1);
2224                 if (ret) {
2225                         wpa_printf(MSG_ERROR, "nl80211: Could not set "
2226                                    "interface '%s' UP", bss->ifname);
2227                         return ret;
2228                 }
2229                 if (nlmode == NL80211_IFTYPE_P2P_DEVICE)
2230                         return ret;
2231         } else {
2232                 wpa_printf(MSG_DEBUG, "nl80211: Could not yet enable "
2233                            "interface '%s' due to rfkill", bss->ifname);
2234                 if (nlmode == NL80211_IFTYPE_P2P_DEVICE)
2235                         return 0;
2236                 drv->if_disabled = 1;
2237                 send_rfkill_event = 1;
2238         }
2239
2240         if (!drv->hostapd)
2241                 netlink_send_oper_ifla(drv->global->netlink, drv->ifindex,
2242                                        1, IF_OPER_DORMANT);
2243
2244         if (linux_get_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
2245                                bss->addr))
2246                 return -1;
2247         os_memcpy(drv->perm_addr, bss->addr, ETH_ALEN);
2248
2249         if (send_rfkill_event) {
2250                 eloop_register_timeout(0, 0, wpa_driver_nl80211_send_rfkill,
2251                                        drv, drv->ctx);
2252         }
2253
2254         if (drv->vendor_cmd_test_avail)
2255                 qca_vendor_test(drv);
2256
2257         return 0;
2258 }
2259
2260
2261 static int wpa_driver_nl80211_del_beacon(struct wpa_driver_nl80211_data *drv)
2262 {
2263         struct nl_msg *msg;
2264
2265         wpa_printf(MSG_DEBUG, "nl80211: Remove beacon (ifindex=%d)",
2266                    drv->ifindex);
2267         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_DEL_BEACON);
2268         return send_and_recv_msgs(drv, msg, NULL, NULL);
2269 }
2270
2271
2272 /**
2273  * wpa_driver_nl80211_deinit - Deinitialize nl80211 driver interface
2274  * @bss: Pointer to private nl80211 data from wpa_driver_nl80211_init()
2275  *
2276  * Shut down driver interface and processing of driver events. Free
2277  * private data buffer if one was allocated in wpa_driver_nl80211_init().
2278  */
2279 static void wpa_driver_nl80211_deinit(struct i802_bss *bss)
2280 {
2281         struct wpa_driver_nl80211_data *drv = bss->drv;
2282
2283         wpa_printf(MSG_INFO, "nl80211: deinit ifname=%s disabled_11b_rates=%d",
2284                    bss->ifname, drv->disabled_11b_rates);
2285
2286         bss->in_deinit = 1;
2287         if (drv->data_tx_status)
2288                 eloop_unregister_read_sock(drv->eapol_tx_sock);
2289         if (drv->eapol_tx_sock >= 0)
2290                 close(drv->eapol_tx_sock);
2291
2292         if (bss->nl_preq)
2293                 wpa_driver_nl80211_probe_req_report(bss, 0);
2294         if (bss->added_if_into_bridge) {
2295                 if (linux_br_del_if(drv->global->ioctl_sock, bss->brname,
2296                                     bss->ifname) < 0)
2297                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
2298                                    "interface %s from bridge %s: %s",
2299                                    bss->ifname, bss->brname, strerror(errno));
2300                 if (drv->rtnl_sk)
2301                         nl80211_handle_destroy(drv->rtnl_sk);
2302         }
2303         if (bss->added_bridge) {
2304                 if (linux_set_iface_flags(drv->global->ioctl_sock, bss->brname,
2305                                           0) < 0)
2306                         wpa_printf(MSG_INFO,
2307                                    "nl80211: Could not set bridge %s down",
2308                                    bss->brname);
2309                 if (linux_br_del(drv->global->ioctl_sock, bss->brname) < 0)
2310                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
2311                                    "bridge %s: %s",
2312                                    bss->brname, strerror(errno));
2313         }
2314
2315         nl80211_remove_monitor_interface(drv);
2316
2317         if (is_ap_interface(drv->nlmode))
2318                 wpa_driver_nl80211_del_beacon(drv);
2319
2320         if (drv->eapol_sock >= 0) {
2321                 eloop_unregister_read_sock(drv->eapol_sock);
2322                 close(drv->eapol_sock);
2323         }
2324
2325         if (drv->if_indices != drv->default_if_indices)
2326                 os_free(drv->if_indices);
2327
2328         if (drv->disabled_11b_rates)
2329                 nl80211_disable_11b_rates(drv, drv->ifindex, 0);
2330
2331         netlink_send_oper_ifla(drv->global->netlink, drv->ifindex, 0,
2332                                IF_OPER_UP);
2333         eloop_cancel_timeout(wpa_driver_nl80211_send_rfkill, drv, drv->ctx);
2334         rfkill_deinit(drv->rfkill);
2335
2336         eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
2337
2338         if (!drv->start_iface_up)
2339                 (void) i802_set_iface_flags(bss, 0);
2340
2341         if (drv->addr_changed) {
2342                 if (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname,
2343                                           0) < 0) {
2344                         wpa_printf(MSG_DEBUG,
2345                                    "nl80211: Could not set interface down to restore permanent MAC address");
2346                 }
2347                 if (linux_set_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
2348                                        drv->perm_addr) < 0) {
2349                         wpa_printf(MSG_DEBUG,
2350                                    "nl80211: Could not restore permanent MAC address");
2351                 }
2352         }
2353
2354         if (drv->nlmode != NL80211_IFTYPE_P2P_DEVICE) {
2355                 if (!drv->hostapd || !drv->start_mode_ap)
2356                         wpa_driver_nl80211_set_mode(bss,
2357                                                     NL80211_IFTYPE_STATION);
2358                 nl80211_mgmt_unsubscribe(bss, "deinit");
2359         } else {
2360                 nl80211_mgmt_unsubscribe(bss, "deinit");
2361                 nl80211_del_p2pdev(bss);
2362         }
2363
2364         nl80211_destroy_bss(drv->first_bss);
2365
2366         os_free(drv->filter_ssids);
2367
2368         os_free(drv->auth_ie);
2369
2370         if (drv->in_interface_list)
2371                 dl_list_del(&drv->list);
2372
2373         os_free(drv->extended_capa);
2374         os_free(drv->extended_capa_mask);
2375         os_free(drv->first_bss);
2376         os_free(drv);
2377 }
2378
2379
2380 static u32 wpa_alg_to_cipher_suite(enum wpa_alg alg, size_t key_len)
2381 {
2382         switch (alg) {
2383         case WPA_ALG_WEP:
2384                 if (key_len == 5)
2385                         return WLAN_CIPHER_SUITE_WEP40;
2386                 return WLAN_CIPHER_SUITE_WEP104;
2387         case WPA_ALG_TKIP:
2388                 return WLAN_CIPHER_SUITE_TKIP;
2389         case WPA_ALG_CCMP:
2390                 return WLAN_CIPHER_SUITE_CCMP;
2391         case WPA_ALG_GCMP:
2392                 return WLAN_CIPHER_SUITE_GCMP;
2393         case WPA_ALG_CCMP_256:
2394                 return WLAN_CIPHER_SUITE_CCMP_256;
2395         case WPA_ALG_GCMP_256:
2396                 return WLAN_CIPHER_SUITE_GCMP_256;
2397         case WPA_ALG_IGTK:
2398                 return WLAN_CIPHER_SUITE_AES_CMAC;
2399         case WPA_ALG_BIP_GMAC_128:
2400                 return WLAN_CIPHER_SUITE_BIP_GMAC_128;
2401         case WPA_ALG_BIP_GMAC_256:
2402                 return WLAN_CIPHER_SUITE_BIP_GMAC_256;
2403         case WPA_ALG_BIP_CMAC_256:
2404                 return WLAN_CIPHER_SUITE_BIP_CMAC_256;
2405         case WPA_ALG_SMS4:
2406                 return WLAN_CIPHER_SUITE_SMS4;
2407         case WPA_ALG_KRK:
2408                 return WLAN_CIPHER_SUITE_KRK;
2409         case WPA_ALG_NONE:
2410         case WPA_ALG_PMK:
2411                 wpa_printf(MSG_ERROR, "nl80211: Unexpected encryption algorithm %d",
2412                            alg);
2413                 return 0;
2414         }
2415
2416         wpa_printf(MSG_ERROR, "nl80211: Unsupported encryption algorithm %d",
2417                    alg);
2418         return 0;
2419 }
2420
2421
2422 static u32 wpa_cipher_to_cipher_suite(unsigned int cipher)
2423 {
2424         switch (cipher) {
2425         case WPA_CIPHER_CCMP_256:
2426                 return WLAN_CIPHER_SUITE_CCMP_256;
2427         case WPA_CIPHER_GCMP_256:
2428                 return WLAN_CIPHER_SUITE_GCMP_256;
2429         case WPA_CIPHER_CCMP:
2430                 return WLAN_CIPHER_SUITE_CCMP;
2431         case WPA_CIPHER_GCMP:
2432                 return WLAN_CIPHER_SUITE_GCMP;
2433         case WPA_CIPHER_TKIP:
2434                 return WLAN_CIPHER_SUITE_TKIP;
2435         case WPA_CIPHER_WEP104:
2436                 return WLAN_CIPHER_SUITE_WEP104;
2437         case WPA_CIPHER_WEP40:
2438                 return WLAN_CIPHER_SUITE_WEP40;
2439         case WPA_CIPHER_GTK_NOT_USED:
2440                 return WLAN_CIPHER_SUITE_NO_GROUP_ADDR;
2441         }
2442
2443         return 0;
2444 }
2445
2446
2447 static int wpa_cipher_to_cipher_suites(unsigned int ciphers, u32 suites[],
2448                                        int max_suites)
2449 {
2450         int num_suites = 0;
2451
2452         if (num_suites < max_suites && ciphers & WPA_CIPHER_CCMP_256)
2453                 suites[num_suites++] = WLAN_CIPHER_SUITE_CCMP_256;
2454         if (num_suites < max_suites && ciphers & WPA_CIPHER_GCMP_256)
2455                 suites[num_suites++] = WLAN_CIPHER_SUITE_GCMP_256;
2456         if (num_suites < max_suites && ciphers & WPA_CIPHER_CCMP)
2457                 suites[num_suites++] = WLAN_CIPHER_SUITE_CCMP;
2458         if (num_suites < max_suites && ciphers & WPA_CIPHER_GCMP)
2459                 suites[num_suites++] = WLAN_CIPHER_SUITE_GCMP;
2460         if (num_suites < max_suites && ciphers & WPA_CIPHER_TKIP)
2461                 suites[num_suites++] = WLAN_CIPHER_SUITE_TKIP;
2462         if (num_suites < max_suites && ciphers & WPA_CIPHER_WEP104)
2463                 suites[num_suites++] = WLAN_CIPHER_SUITE_WEP104;
2464         if (num_suites < max_suites && ciphers & WPA_CIPHER_WEP40)
2465                 suites[num_suites++] = WLAN_CIPHER_SUITE_WEP40;
2466
2467         return num_suites;
2468 }
2469
2470
2471 static int issue_key_mgmt_set_key(struct wpa_driver_nl80211_data *drv,
2472                                   const u8 *key, size_t key_len)
2473 {
2474         struct nl_msg *msg;
2475         int ret;
2476
2477         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_KEY_MGMT_OFFLOAD))
2478                 return 0;
2479
2480         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
2481             nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
2482             nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
2483                         QCA_NL80211_VENDOR_SUBCMD_KEY_MGMT_SET_KEY) ||
2484             nla_put(msg, NL80211_ATTR_VENDOR_DATA, key_len, key)) {
2485                 nl80211_nlmsg_clear(msg);
2486                 nlmsg_free(msg);
2487                 return -1;
2488         }
2489         ret = send_and_recv_msgs(drv, msg, NULL, (void *) -1);
2490         if (ret) {
2491                 wpa_printf(MSG_DEBUG,
2492                            "nl80211: Key management set key failed: ret=%d (%s)",
2493                            ret, strerror(-ret));
2494         }
2495
2496         return ret;
2497 }
2498
2499
2500 static int wpa_driver_nl80211_set_key(const char *ifname, struct i802_bss *bss,
2501                                       enum wpa_alg alg, const u8 *addr,
2502                                       int key_idx, int set_tx,
2503                                       const u8 *seq, size_t seq_len,
2504                                       const u8 *key, size_t key_len)
2505 {
2506         struct wpa_driver_nl80211_data *drv = bss->drv;
2507         int ifindex;
2508         struct nl_msg *msg = NULL;
2509         int ret;
2510         int tdls = 0;
2511
2512         /* Ignore for P2P Device */
2513         if (drv->nlmode == NL80211_IFTYPE_P2P_DEVICE)
2514                 return 0;
2515
2516         ifindex = if_nametoindex(ifname);
2517         wpa_printf(MSG_DEBUG, "%s: ifindex=%d (%s) alg=%d addr=%p key_idx=%d "
2518                    "set_tx=%d seq_len=%lu key_len=%lu",
2519                    __func__, ifindex, ifname, alg, addr, key_idx, set_tx,
2520                    (unsigned long) seq_len, (unsigned long) key_len);
2521 #ifdef CONFIG_TDLS
2522         if (key_idx == -1) {
2523                 key_idx = 0;
2524                 tdls = 1;
2525         }
2526 #endif /* CONFIG_TDLS */
2527
2528         if (alg == WPA_ALG_PMK &&
2529             (drv->capa.flags & WPA_DRIVER_FLAGS_KEY_MGMT_OFFLOAD)) {
2530                 wpa_printf(MSG_DEBUG, "%s: calling issue_key_mgmt_set_key",
2531                            __func__);
2532                 ret = issue_key_mgmt_set_key(drv, key, key_len);
2533                 return ret;
2534         }
2535
2536         if (alg == WPA_ALG_NONE) {
2537                 msg = nl80211_ifindex_msg(drv, ifindex, 0, NL80211_CMD_DEL_KEY);
2538                 if (!msg)
2539                         return -ENOBUFS;
2540         } else {
2541                 u32 suite;
2542
2543                 suite = wpa_alg_to_cipher_suite(alg, key_len);
2544                 if (!suite)
2545                         goto fail;
2546                 msg = nl80211_ifindex_msg(drv, ifindex, 0, NL80211_CMD_NEW_KEY);
2547                 if (!msg ||
2548                     nla_put(msg, NL80211_ATTR_KEY_DATA, key_len, key) ||
2549                     nla_put_u32(msg, NL80211_ATTR_KEY_CIPHER, suite))
2550                         goto fail;
2551                 wpa_hexdump_key(MSG_DEBUG, "nl80211: KEY_DATA", key, key_len);
2552         }
2553
2554         if (seq && seq_len) {
2555                 if (nla_put(msg, NL80211_ATTR_KEY_SEQ, seq_len, seq))
2556                         goto fail;
2557                 wpa_hexdump(MSG_DEBUG, "nl80211: KEY_SEQ", seq, seq_len);
2558         }
2559
2560         if (addr && !is_broadcast_ether_addr(addr)) {
2561                 wpa_printf(MSG_DEBUG, "   addr=" MACSTR, MAC2STR(addr));
2562                 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
2563                         goto fail;
2564
2565                 if (alg != WPA_ALG_WEP && key_idx && !set_tx) {
2566                         wpa_printf(MSG_DEBUG, "   RSN IBSS RX GTK");
2567                         if (nla_put_u32(msg, NL80211_ATTR_KEY_TYPE,
2568                                         NL80211_KEYTYPE_GROUP))
2569                                 goto fail;
2570                 }
2571         } else if (addr && is_broadcast_ether_addr(addr)) {
2572                 struct nlattr *types;
2573
2574                 wpa_printf(MSG_DEBUG, "   broadcast key");
2575
2576                 types = nla_nest_start(msg, NL80211_ATTR_KEY_DEFAULT_TYPES);
2577                 if (!types ||
2578                     nla_put_flag(msg, NL80211_KEY_DEFAULT_TYPE_MULTICAST))
2579                         goto fail;
2580                 nla_nest_end(msg, types);
2581         }
2582         if (nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2583                 goto fail;
2584
2585         ret = send_and_recv_msgs(drv, msg, NULL, key ? (void *) -1 : NULL);
2586         if ((ret == -ENOENT || ret == -ENOLINK) && alg == WPA_ALG_NONE)
2587                 ret = 0;
2588         if (ret)
2589                 wpa_printf(MSG_DEBUG, "nl80211: set_key failed; err=%d %s)",
2590                            ret, strerror(-ret));
2591
2592         /*
2593          * If we failed or don't need to set the default TX key (below),
2594          * we're done here.
2595          */
2596         if (ret || !set_tx || alg == WPA_ALG_NONE || tdls)
2597                 return ret;
2598         if (is_ap_interface(drv->nlmode) && addr &&
2599             !is_broadcast_ether_addr(addr))
2600                 return ret;
2601
2602         msg = nl80211_ifindex_msg(drv, ifindex, 0, NL80211_CMD_SET_KEY);
2603         if (!msg ||
2604             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx) ||
2605             nla_put_flag(msg, (alg == WPA_ALG_IGTK ||
2606                                alg == WPA_ALG_BIP_GMAC_128 ||
2607                                alg == WPA_ALG_BIP_GMAC_256 ||
2608                                alg == WPA_ALG_BIP_CMAC_256) ?
2609                          NL80211_ATTR_KEY_DEFAULT_MGMT :
2610                          NL80211_ATTR_KEY_DEFAULT))
2611                 goto fail;
2612         if (addr && is_broadcast_ether_addr(addr)) {
2613                 struct nlattr *types;
2614
2615                 types = nla_nest_start(msg, NL80211_ATTR_KEY_DEFAULT_TYPES);
2616                 if (!types ||
2617                     nla_put_flag(msg, NL80211_KEY_DEFAULT_TYPE_MULTICAST))
2618                         goto fail;
2619                 nla_nest_end(msg, types);
2620         } else if (addr) {
2621                 struct nlattr *types;
2622
2623                 types = nla_nest_start(msg, NL80211_ATTR_KEY_DEFAULT_TYPES);
2624                 if (!types ||
2625                     nla_put_flag(msg, NL80211_KEY_DEFAULT_TYPE_UNICAST))
2626                         goto fail;
2627                 nla_nest_end(msg, types);
2628         }
2629
2630         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
2631         if (ret == -ENOENT)
2632                 ret = 0;
2633         if (ret)
2634                 wpa_printf(MSG_DEBUG, "nl80211: set_key default failed; "
2635                            "err=%d %s)", ret, strerror(-ret));
2636         return ret;
2637
2638 fail:
2639         nl80211_nlmsg_clear(msg);
2640         nlmsg_free(msg);
2641         return -ENOBUFS;
2642 }
2643
2644
2645 static int nl_add_key(struct nl_msg *msg, enum wpa_alg alg,
2646                       int key_idx, int defkey,
2647                       const u8 *seq, size_t seq_len,
2648                       const u8 *key, size_t key_len)
2649 {
2650         struct nlattr *key_attr = nla_nest_start(msg, NL80211_ATTR_KEY);
2651         u32 suite;
2652
2653         if (!key_attr)
2654                 return -1;
2655
2656         suite = wpa_alg_to_cipher_suite(alg, key_len);
2657         if (!suite)
2658                 return -1;
2659
2660         if (defkey && alg == WPA_ALG_IGTK) {
2661                 if (nla_put_flag(msg, NL80211_KEY_DEFAULT_MGMT))
2662                         return -1;
2663         } else if (defkey) {
2664                 if (nla_put_flag(msg, NL80211_KEY_DEFAULT))
2665                         return -1;
2666         }
2667
2668         if (nla_put_u8(msg, NL80211_KEY_IDX, key_idx) ||
2669             nla_put_u32(msg, NL80211_KEY_CIPHER, suite) ||
2670             (seq && seq_len &&
2671              nla_put(msg, NL80211_KEY_SEQ, seq_len, seq)) ||
2672             nla_put(msg, NL80211_KEY_DATA, key_len, key))
2673                 return -1;
2674
2675         nla_nest_end(msg, key_attr);
2676
2677         return 0;
2678 }
2679
2680
2681 static int nl80211_set_conn_keys(struct wpa_driver_associate_params *params,
2682                                  struct nl_msg *msg)
2683 {
2684         int i, privacy = 0;
2685         struct nlattr *nl_keys, *nl_key;
2686
2687         for (i = 0; i < 4; i++) {
2688                 if (!params->wep_key[i])
2689                         continue;
2690                 privacy = 1;
2691                 break;
2692         }
2693         if (params->wps == WPS_MODE_PRIVACY)
2694                 privacy = 1;
2695         if (params->pairwise_suite &&
2696             params->pairwise_suite != WPA_CIPHER_NONE)
2697                 privacy = 1;
2698
2699         if (!privacy)
2700                 return 0;
2701
2702         if (nla_put_flag(msg, NL80211_ATTR_PRIVACY))
2703                 return -ENOBUFS;
2704
2705         nl_keys = nla_nest_start(msg, NL80211_ATTR_KEYS);
2706         if (!nl_keys)
2707                 return -ENOBUFS;
2708
2709         for (i = 0; i < 4; i++) {
2710                 if (!params->wep_key[i])
2711                         continue;
2712
2713                 nl_key = nla_nest_start(msg, i);
2714                 if (!nl_key ||
2715                     nla_put(msg, NL80211_KEY_DATA, params->wep_key_len[i],
2716                             params->wep_key[i]) ||
2717                     nla_put_u32(msg, NL80211_KEY_CIPHER,
2718                                 params->wep_key_len[i] == 5 ?
2719                                 WLAN_CIPHER_SUITE_WEP40 :
2720                                 WLAN_CIPHER_SUITE_WEP104) ||
2721                     nla_put_u8(msg, NL80211_KEY_IDX, i) ||
2722                     (i == params->wep_tx_keyidx &&
2723                      nla_put_flag(msg, NL80211_KEY_DEFAULT)))
2724                         return -ENOBUFS;
2725
2726                 nla_nest_end(msg, nl_key);
2727         }
2728         nla_nest_end(msg, nl_keys);
2729
2730         return 0;
2731 }
2732
2733
2734 int wpa_driver_nl80211_mlme(struct wpa_driver_nl80211_data *drv,
2735                             const u8 *addr, int cmd, u16 reason_code,
2736                             int local_state_change)
2737 {
2738         int ret;
2739         struct nl_msg *msg;
2740
2741         if (!(msg = nl80211_drv_msg(drv, 0, cmd)) ||
2742             nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code) ||
2743             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
2744             (local_state_change &&
2745              nla_put_flag(msg, NL80211_ATTR_LOCAL_STATE_CHANGE))) {
2746                 nlmsg_free(msg);
2747                 return -1;
2748         }
2749
2750         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
2751         if (ret) {
2752                 wpa_dbg(drv->ctx, MSG_DEBUG,
2753                         "nl80211: MLME command failed: reason=%u ret=%d (%s)",
2754                         reason_code, ret, strerror(-ret));
2755         }
2756         return ret;
2757 }
2758
2759
2760 static int wpa_driver_nl80211_disconnect(struct wpa_driver_nl80211_data *drv,
2761                                          int reason_code)
2762 {
2763         int ret;
2764
2765         wpa_printf(MSG_DEBUG, "%s(reason_code=%d)", __func__, reason_code);
2766         nl80211_mark_disconnected(drv);
2767         /* Disconnect command doesn't need BSSID - it uses cached value */
2768         ret = wpa_driver_nl80211_mlme(drv, NULL, NL80211_CMD_DISCONNECT,
2769                                       reason_code, 0);
2770         /*
2771          * For locally generated disconnect, supplicant already generates a
2772          * DEAUTH event, so ignore the event from NL80211.
2773          */
2774         drv->ignore_next_local_disconnect = ret == 0;
2775
2776         return ret;
2777 }
2778
2779
2780 static int wpa_driver_nl80211_deauthenticate(struct i802_bss *bss,
2781                                              const u8 *addr, int reason_code)
2782 {
2783         struct wpa_driver_nl80211_data *drv = bss->drv;
2784         int ret;
2785
2786         if (drv->nlmode == NL80211_IFTYPE_ADHOC) {
2787                 nl80211_mark_disconnected(drv);
2788                 return nl80211_leave_ibss(drv, 1);
2789         }
2790         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME))
2791                 return wpa_driver_nl80211_disconnect(drv, reason_code);
2792         wpa_printf(MSG_DEBUG, "%s(addr=" MACSTR " reason_code=%d)",
2793                    __func__, MAC2STR(addr), reason_code);
2794         nl80211_mark_disconnected(drv);
2795         ret = wpa_driver_nl80211_mlme(drv, addr, NL80211_CMD_DEAUTHENTICATE,
2796                                       reason_code, 0);
2797         /*
2798          * For locally generated deauthenticate, supplicant already generates a
2799          * DEAUTH event, so ignore the event from NL80211.
2800          */
2801         drv->ignore_next_local_deauth = ret == 0;
2802         return ret;
2803 }
2804
2805
2806 static void nl80211_copy_auth_params(struct wpa_driver_nl80211_data *drv,
2807                                      struct wpa_driver_auth_params *params)
2808 {
2809         int i;
2810
2811         drv->auth_freq = params->freq;
2812         drv->auth_alg = params->auth_alg;
2813         drv->auth_wep_tx_keyidx = params->wep_tx_keyidx;
2814         drv->auth_local_state_change = params->local_state_change;
2815         drv->auth_p2p = params->p2p;
2816
2817         if (params->bssid)
2818                 os_memcpy(drv->auth_bssid_, params->bssid, ETH_ALEN);
2819         else
2820                 os_memset(drv->auth_bssid_, 0, ETH_ALEN);
2821
2822         if (params->ssid) {
2823                 os_memcpy(drv->auth_ssid, params->ssid, params->ssid_len);
2824                 drv->auth_ssid_len = params->ssid_len;
2825         } else
2826                 drv->auth_ssid_len = 0;
2827
2828
2829         os_free(drv->auth_ie);
2830         drv->auth_ie = NULL;
2831         drv->auth_ie_len = 0;
2832         if (params->ie) {
2833                 drv->auth_ie = os_malloc(params->ie_len);
2834                 if (drv->auth_ie) {
2835                         os_memcpy(drv->auth_ie, params->ie, params->ie_len);
2836                         drv->auth_ie_len = params->ie_len;
2837                 }
2838         }
2839
2840         for (i = 0; i < 4; i++) {
2841                 if (params->wep_key[i] && params->wep_key_len[i] &&
2842                     params->wep_key_len[i] <= 16) {
2843                         os_memcpy(drv->auth_wep_key[i], params->wep_key[i],
2844                                   params->wep_key_len[i]);
2845                         drv->auth_wep_key_len[i] = params->wep_key_len[i];
2846                 } else
2847                         drv->auth_wep_key_len[i] = 0;
2848         }
2849 }
2850
2851
2852 static void nl80211_unmask_11b_rates(struct i802_bss *bss)
2853 {
2854         struct wpa_driver_nl80211_data *drv = bss->drv;
2855
2856         if (is_p2p_net_interface(drv->nlmode) || !drv->disabled_11b_rates)
2857                 return;
2858
2859         /*
2860          * Looks like we failed to unmask 11b rates previously. This could
2861          * happen, e.g., if the interface was down at the point in time when a
2862          * P2P group was terminated.
2863          */
2864         wpa_printf(MSG_DEBUG,
2865                    "nl80211: Interface %s mode is for non-P2P, but 11b rates were disabled - re-enable them",
2866                    bss->ifname);
2867         nl80211_disable_11b_rates(drv, drv->ifindex, 0);
2868 }
2869
2870
2871 static int wpa_driver_nl80211_authenticate(
2872         struct i802_bss *bss, struct wpa_driver_auth_params *params)
2873 {
2874         struct wpa_driver_nl80211_data *drv = bss->drv;
2875         int ret = -1, i;
2876         struct nl_msg *msg;
2877         enum nl80211_auth_type type;
2878         enum nl80211_iftype nlmode;
2879         int count = 0;
2880         int is_retry;
2881
2882         nl80211_unmask_11b_rates(bss);
2883
2884         is_retry = drv->retry_auth;
2885         drv->retry_auth = 0;
2886         drv->ignore_deauth_event = 0;
2887
2888         nl80211_mark_disconnected(drv);
2889         os_memset(drv->auth_bssid, 0, ETH_ALEN);
2890         if (params->bssid)
2891                 os_memcpy(drv->auth_attempt_bssid, params->bssid, ETH_ALEN);
2892         else
2893                 os_memset(drv->auth_attempt_bssid, 0, ETH_ALEN);
2894         /* FIX: IBSS mode */
2895         nlmode = params->p2p ?
2896                 NL80211_IFTYPE_P2P_CLIENT : NL80211_IFTYPE_STATION;
2897         if (drv->nlmode != nlmode &&
2898             wpa_driver_nl80211_set_mode(bss, nlmode) < 0)
2899                 return -1;
2900
2901 retry:
2902         wpa_printf(MSG_DEBUG, "nl80211: Authenticate (ifindex=%d)",
2903                    drv->ifindex);
2904
2905         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_AUTHENTICATE);
2906         if (!msg)
2907                 goto fail;
2908
2909         for (i = 0; i < 4; i++) {
2910                 if (!params->wep_key[i])
2911                         continue;
2912                 wpa_driver_nl80211_set_key(bss->ifname, bss, WPA_ALG_WEP,
2913                                            NULL, i,
2914                                            i == params->wep_tx_keyidx, NULL, 0,
2915                                            params->wep_key[i],
2916                                            params->wep_key_len[i]);
2917                 if (params->wep_tx_keyidx != i)
2918                         continue;
2919                 if (nl_add_key(msg, WPA_ALG_WEP, i, 1, NULL, 0,
2920                                params->wep_key[i], params->wep_key_len[i]))
2921                         goto fail;
2922         }
2923
2924         if (params->bssid) {
2925                 wpa_printf(MSG_DEBUG, "  * bssid=" MACSTR,
2926                            MAC2STR(params->bssid));
2927                 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid))
2928                         goto fail;
2929         }
2930         if (params->freq) {
2931                 wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq);
2932                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq))
2933                         goto fail;
2934         }
2935         if (params->ssid) {
2936                 wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
2937                                   params->ssid, params->ssid_len);
2938                 if (nla_put(msg, NL80211_ATTR_SSID, params->ssid_len,
2939                             params->ssid))
2940                         goto fail;
2941         }
2942         wpa_hexdump(MSG_DEBUG, "  * IEs", params->ie, params->ie_len);
2943         if (params->ie &&
2944             nla_put(msg, NL80211_ATTR_IE, params->ie_len, params->ie))
2945                 goto fail;
2946         if (params->sae_data) {
2947                 wpa_hexdump(MSG_DEBUG, "  * SAE data", params->sae_data,
2948                             params->sae_data_len);
2949                 if (nla_put(msg, NL80211_ATTR_SAE_DATA, params->sae_data_len,
2950                             params->sae_data))
2951                         goto fail;
2952         }
2953         if (params->auth_alg & WPA_AUTH_ALG_OPEN)
2954                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
2955         else if (params->auth_alg & WPA_AUTH_ALG_SHARED)
2956                 type = NL80211_AUTHTYPE_SHARED_KEY;
2957         else if (params->auth_alg & WPA_AUTH_ALG_LEAP)
2958                 type = NL80211_AUTHTYPE_NETWORK_EAP;
2959         else if (params->auth_alg & WPA_AUTH_ALG_FT)
2960                 type = NL80211_AUTHTYPE_FT;
2961         else if (params->auth_alg & WPA_AUTH_ALG_SAE)
2962                 type = NL80211_AUTHTYPE_SAE;
2963         else
2964                 goto fail;
2965         wpa_printf(MSG_DEBUG, "  * Auth Type %d", type);
2966         if (nla_put_u32(msg, NL80211_ATTR_AUTH_TYPE, type))
2967                 goto fail;
2968         if (params->local_state_change) {
2969                 wpa_printf(MSG_DEBUG, "  * Local state change only");
2970                 if (nla_put_flag(msg, NL80211_ATTR_LOCAL_STATE_CHANGE))
2971                         goto fail;
2972         }
2973
2974         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
2975         msg = NULL;
2976         if (ret) {
2977                 wpa_dbg(drv->ctx, MSG_DEBUG,
2978                         "nl80211: MLME command failed (auth): ret=%d (%s)",
2979                         ret, strerror(-ret));
2980                 count++;
2981                 if (ret == -EALREADY && count == 1 && params->bssid &&
2982                     !params->local_state_change) {
2983                         /*
2984                          * mac80211 does not currently accept new
2985                          * authentication if we are already authenticated. As a
2986                          * workaround, force deauthentication and try again.
2987                          */
2988                         wpa_printf(MSG_DEBUG, "nl80211: Retry authentication "
2989                                    "after forced deauthentication");
2990                         drv->ignore_deauth_event = 1;
2991                         wpa_driver_nl80211_deauthenticate(
2992                                 bss, params->bssid,
2993                                 WLAN_REASON_PREV_AUTH_NOT_VALID);
2994                         nlmsg_free(msg);
2995                         goto retry;
2996                 }
2997
2998                 if (ret == -ENOENT && params->freq && !is_retry) {
2999                         /*
3000                          * cfg80211 has likely expired the BSS entry even
3001                          * though it was previously available in our internal
3002                          * BSS table. To recover quickly, start a single
3003                          * channel scan on the specified channel.
3004                          */
3005                         struct wpa_driver_scan_params scan;
3006                         int freqs[2];
3007
3008                         os_memset(&scan, 0, sizeof(scan));
3009                         scan.num_ssids = 1;
3010                         if (params->ssid) {
3011                                 scan.ssids[0].ssid = params->ssid;
3012                                 scan.ssids[0].ssid_len = params->ssid_len;
3013                         }
3014                         freqs[0] = params->freq;
3015                         freqs[1] = 0;
3016                         scan.freqs = freqs;
3017                         wpa_printf(MSG_DEBUG, "nl80211: Trigger single "
3018                                    "channel scan to refresh cfg80211 BSS "
3019                                    "entry");
3020                         ret = wpa_driver_nl80211_scan(bss, &scan);
3021                         if (ret == 0) {
3022                                 nl80211_copy_auth_params(drv, params);
3023                                 drv->scan_for_auth = 1;
3024                         }
3025                 } else if (is_retry) {
3026                         /*
3027                          * Need to indicate this with an event since the return
3028                          * value from the retry is not delivered to core code.
3029                          */
3030                         union wpa_event_data event;
3031                         wpa_printf(MSG_DEBUG, "nl80211: Authentication retry "
3032                                    "failed");
3033                         os_memset(&event, 0, sizeof(event));
3034                         os_memcpy(event.timeout_event.addr, drv->auth_bssid_,
3035                                   ETH_ALEN);
3036                         wpa_supplicant_event(drv->ctx, EVENT_AUTH_TIMED_OUT,
3037                                              &event);
3038                 }
3039         } else {
3040                 wpa_printf(MSG_DEBUG,
3041                            "nl80211: Authentication request send successfully");
3042         }
3043
3044 fail:
3045         nlmsg_free(msg);
3046         return ret;
3047 }
3048
3049
3050 int wpa_driver_nl80211_authenticate_retry(struct wpa_driver_nl80211_data *drv)
3051 {
3052         struct wpa_driver_auth_params params;
3053         struct i802_bss *bss = drv->first_bss;
3054         int i;
3055
3056         wpa_printf(MSG_DEBUG, "nl80211: Try to authenticate again");
3057
3058         os_memset(&params, 0, sizeof(params));
3059         params.freq = drv->auth_freq;
3060         params.auth_alg = drv->auth_alg;
3061         params.wep_tx_keyidx = drv->auth_wep_tx_keyidx;
3062         params.local_state_change = drv->auth_local_state_change;
3063         params.p2p = drv->auth_p2p;
3064
3065         if (!is_zero_ether_addr(drv->auth_bssid_))
3066                 params.bssid = drv->auth_bssid_;
3067
3068         if (drv->auth_ssid_len) {
3069                 params.ssid = drv->auth_ssid;
3070                 params.ssid_len = drv->auth_ssid_len;
3071         }
3072
3073         params.ie = drv->auth_ie;
3074         params.ie_len = drv->auth_ie_len;
3075
3076         for (i = 0; i < 4; i++) {
3077                 if (drv->auth_wep_key_len[i]) {
3078                         params.wep_key[i] = drv->auth_wep_key[i];
3079                         params.wep_key_len[i] = drv->auth_wep_key_len[i];
3080                 }
3081         }
3082
3083         drv->retry_auth = 1;
3084         return wpa_driver_nl80211_authenticate(bss, &params);
3085 }
3086
3087
3088 static int wpa_driver_nl80211_send_frame(struct i802_bss *bss,
3089                                          const void *data, size_t len,
3090                                          int encrypt, int noack,
3091                                          unsigned int freq, int no_cck,
3092                                          int offchanok, unsigned int wait_time)
3093 {
3094         struct wpa_driver_nl80211_data *drv = bss->drv;
3095         u64 cookie;
3096         int res;
3097
3098         if (freq == 0 && drv->nlmode == NL80211_IFTYPE_ADHOC) {
3099                 freq = nl80211_get_assoc_freq(drv);
3100                 wpa_printf(MSG_DEBUG,
3101                            "nl80211: send_frame - Use assoc_freq=%u for IBSS",
3102                            freq);
3103         }
3104         if (freq == 0) {
3105                 wpa_printf(MSG_DEBUG, "nl80211: send_frame - Use bss->freq=%u",
3106                            bss->freq);
3107                 freq = bss->freq;
3108         }
3109
3110         if (drv->use_monitor) {
3111                 wpa_printf(MSG_DEBUG, "nl80211: send_frame(freq=%u bss->freq=%u) -> send_monitor",
3112                            freq, bss->freq);
3113                 return nl80211_send_monitor(drv, data, len, encrypt, noack);
3114         }
3115
3116         wpa_printf(MSG_DEBUG, "nl80211: send_frame -> send_frame_cmd");
3117         res = nl80211_send_frame_cmd(bss, freq, wait_time, data, len,
3118                                      &cookie, no_cck, noack, offchanok);
3119         if (res == 0 && !noack) {
3120                 const struct ieee80211_mgmt *mgmt;
3121                 u16 fc;
3122
3123                 mgmt = (const struct ieee80211_mgmt *) data;
3124                 fc = le_to_host16(mgmt->frame_control);
3125                 if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
3126                     WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_ACTION) {
3127                         wpa_printf(MSG_MSGDUMP,
3128                                    "nl80211: Update send_action_cookie from 0x%llx to 0x%llx",
3129                                    (long long unsigned int)
3130                                    drv->send_action_cookie,
3131                                    (long long unsigned int) cookie);
3132                         drv->send_action_cookie = cookie;
3133                 }
3134         }
3135
3136         return res;
3137 }
3138
3139
3140 static int wpa_driver_nl80211_send_mlme(struct i802_bss *bss, const u8 *data,
3141                                         size_t data_len, int noack,
3142                                         unsigned int freq, int no_cck,
3143                                         int offchanok,
3144                                         unsigned int wait_time)
3145 {
3146         struct wpa_driver_nl80211_data *drv = bss->drv;
3147         struct ieee80211_mgmt *mgmt;
3148         int encrypt = 1;
3149         u16 fc;
3150
3151         mgmt = (struct ieee80211_mgmt *) data;
3152         fc = le_to_host16(mgmt->frame_control);
3153         wpa_printf(MSG_DEBUG, "nl80211: send_mlme - da= " MACSTR
3154                    " noack=%d freq=%u no_cck=%d offchanok=%d wait_time=%u fc=0x%x (%s) nlmode=%d",
3155                    MAC2STR(mgmt->da), noack, freq, no_cck, offchanok, wait_time,
3156                    fc, fc2str(fc), drv->nlmode);
3157
3158         if ((is_sta_interface(drv->nlmode) ||
3159              drv->nlmode == NL80211_IFTYPE_P2P_DEVICE) &&
3160             WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
3161             WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_PROBE_RESP) {
3162                 /*
3163                  * The use of last_mgmt_freq is a bit of a hack,
3164                  * but it works due to the single-threaded nature
3165                  * of wpa_supplicant.
3166                  */
3167                 if (freq == 0) {
3168                         wpa_printf(MSG_DEBUG, "nl80211: Use last_mgmt_freq=%d",
3169                                    drv->last_mgmt_freq);
3170                         freq = drv->last_mgmt_freq;
3171                 }
3172                 return nl80211_send_frame_cmd(bss, freq, 0,
3173                                               data, data_len, NULL, 1, noack,
3174                                               1);
3175         }
3176
3177         if (drv->device_ap_sme && is_ap_interface(drv->nlmode)) {
3178                 if (freq == 0) {
3179                         wpa_printf(MSG_DEBUG, "nl80211: Use bss->freq=%d",
3180                                    bss->freq);
3181                         freq = bss->freq;
3182                 }
3183                 return nl80211_send_frame_cmd(bss, freq,
3184                                               (int) freq == bss->freq ? 0 :
3185                                               wait_time,
3186                                               data, data_len,
3187                                               &drv->send_action_cookie,
3188                                               no_cck, noack, offchanok);
3189         }
3190
3191         if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
3192             WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_AUTH) {
3193                 /*
3194                  * Only one of the authentication frame types is encrypted.
3195                  * In order for static WEP encryption to work properly (i.e.,
3196                  * to not encrypt the frame), we need to tell mac80211 about
3197                  * the frames that must not be encrypted.
3198                  */
3199                 u16 auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
3200                 u16 auth_trans = le_to_host16(mgmt->u.auth.auth_transaction);
3201                 if (auth_alg != WLAN_AUTH_SHARED_KEY || auth_trans != 3)
3202                         encrypt = 0;
3203         }
3204
3205         wpa_printf(MSG_DEBUG, "nl80211: send_mlme -> send_frame");
3206         return wpa_driver_nl80211_send_frame(bss, data, data_len, encrypt,
3207                                              noack, freq, no_cck, offchanok,
3208                                              wait_time);
3209 }
3210
3211
3212 static int nl80211_put_basic_rates(struct nl_msg *msg, const int *basic_rates)
3213 {
3214         u8 rates[NL80211_MAX_SUPP_RATES];
3215         u8 rates_len = 0;
3216         int i;
3217
3218         if (!basic_rates)
3219                 return 0;
3220
3221         for (i = 0; i < NL80211_MAX_SUPP_RATES && basic_rates[i] >= 0; i++)
3222                 rates[rates_len++] = basic_rates[i] / 5;
3223
3224         return nla_put(msg, NL80211_ATTR_BSS_BASIC_RATES, rates_len, rates);
3225 }
3226
3227
3228 static int nl80211_set_bss(struct i802_bss *bss, int cts, int preamble,
3229                            int slot, int ht_opmode, int ap_isolate,
3230                            const int *basic_rates)
3231 {
3232         struct wpa_driver_nl80211_data *drv = bss->drv;
3233         struct nl_msg *msg;
3234
3235         if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_SET_BSS)) ||
3236             (cts >= 0 &&
3237              nla_put_u8(msg, NL80211_ATTR_BSS_CTS_PROT, cts)) ||
3238             (preamble >= 0 &&
3239              nla_put_u8(msg, NL80211_ATTR_BSS_SHORT_PREAMBLE, preamble)) ||
3240             (slot >= 0 &&
3241              nla_put_u8(msg, NL80211_ATTR_BSS_SHORT_SLOT_TIME, slot)) ||
3242             (ht_opmode >= 0 &&
3243              nla_put_u16(msg, NL80211_ATTR_BSS_HT_OPMODE, ht_opmode)) ||
3244             (ap_isolate >= 0 &&
3245              nla_put_u8(msg, NL80211_ATTR_AP_ISOLATE, ap_isolate)) ||
3246             nl80211_put_basic_rates(msg, basic_rates)) {
3247                 nlmsg_free(msg);
3248                 return -ENOBUFS;
3249         }
3250
3251         return send_and_recv_msgs(drv, msg, NULL, NULL);
3252 }
3253
3254
3255 static int wpa_driver_nl80211_set_acl(void *priv,
3256                                       struct hostapd_acl_params *params)
3257 {
3258         struct i802_bss *bss = priv;
3259         struct wpa_driver_nl80211_data *drv = bss->drv;
3260         struct nl_msg *msg;
3261         struct nl_msg *acl;
3262         unsigned int i;
3263         int ret;
3264
3265         if (!(drv->capa.max_acl_mac_addrs))
3266                 return -ENOTSUP;
3267
3268         if (params->num_mac_acl > drv->capa.max_acl_mac_addrs)
3269                 return -ENOTSUP;
3270
3271         wpa_printf(MSG_DEBUG, "nl80211: Set %s ACL (num_mac_acl=%u)",
3272                    params->acl_policy ? "Accept" : "Deny", params->num_mac_acl);
3273
3274         acl = nlmsg_alloc();
3275         if (!acl)
3276                 return -ENOMEM;
3277         for (i = 0; i < params->num_mac_acl; i++) {
3278                 if (nla_put(acl, i + 1, ETH_ALEN, params->mac_acl[i].addr)) {
3279                         nlmsg_free(acl);
3280                         return -ENOMEM;
3281                 }
3282         }
3283
3284         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_SET_MAC_ACL)) ||
3285             nla_put_u32(msg, NL80211_ATTR_ACL_POLICY, params->acl_policy ?
3286                         NL80211_ACL_POLICY_DENY_UNLESS_LISTED :
3287                         NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED) ||
3288             nla_put_nested(msg, NL80211_ATTR_MAC_ADDRS, acl)) {
3289                 nlmsg_free(msg);
3290                 nlmsg_free(acl);
3291                 return -ENOMEM;
3292         }
3293         nlmsg_free(acl);
3294
3295         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3296         if (ret) {
3297                 wpa_printf(MSG_DEBUG, "nl80211: Failed to set MAC ACL: %d (%s)",
3298                            ret, strerror(-ret));
3299         }
3300
3301         return ret;
3302 }
3303
3304
3305 static int nl80211_put_beacon_int(struct nl_msg *msg, int beacon_int)
3306 {
3307         if (beacon_int > 0) {
3308                 wpa_printf(MSG_DEBUG, "  * beacon_int=%d", beacon_int);
3309                 return nla_put_u32(msg, NL80211_ATTR_BEACON_INTERVAL,
3310                                    beacon_int);
3311         }
3312
3313         return 0;
3314 }
3315
3316
3317 static int wpa_driver_nl80211_set_ap(void *priv,
3318                                      struct wpa_driver_ap_params *params)
3319 {
3320         struct i802_bss *bss = priv;
3321         struct wpa_driver_nl80211_data *drv = bss->drv;
3322         struct nl_msg *msg;
3323         u8 cmd = NL80211_CMD_NEW_BEACON;
3324         int ret;
3325         int beacon_set;
3326         int num_suites;
3327         int smps_mode;
3328         u32 suites[10], suite;
3329         u32 ver;
3330
3331         beacon_set = params->reenable ? 0 : bss->beacon_set;
3332
3333         wpa_printf(MSG_DEBUG, "nl80211: Set beacon (beacon_set=%d)",
3334                    beacon_set);
3335         if (beacon_set)
3336                 cmd = NL80211_CMD_SET_BEACON;
3337
3338         wpa_hexdump(MSG_DEBUG, "nl80211: Beacon head",
3339                     params->head, params->head_len);
3340         wpa_hexdump(MSG_DEBUG, "nl80211: Beacon tail",
3341                     params->tail, params->tail_len);
3342         wpa_printf(MSG_DEBUG, "nl80211: ifindex=%d", bss->ifindex);
3343         wpa_printf(MSG_DEBUG, "nl80211: beacon_int=%d", params->beacon_int);
3344         wpa_printf(MSG_DEBUG, "nl80211: dtim_period=%d", params->dtim_period);
3345         wpa_hexdump_ascii(MSG_DEBUG, "nl80211: ssid",
3346                           params->ssid, params->ssid_len);
3347         if (!(msg = nl80211_bss_msg(bss, 0, cmd)) ||
3348             nla_put(msg, NL80211_ATTR_BEACON_HEAD, params->head_len,
3349                     params->head) ||
3350             nla_put(msg, NL80211_ATTR_BEACON_TAIL, params->tail_len,
3351                     params->tail) ||
3352             nl80211_put_beacon_int(msg, params->beacon_int) ||
3353             nla_put_u32(msg, NL80211_ATTR_DTIM_PERIOD, params->dtim_period) ||
3354             nla_put(msg, NL80211_ATTR_SSID, params->ssid_len, params->ssid))
3355                 goto fail;
3356         if (params->proberesp && params->proberesp_len) {
3357                 wpa_hexdump(MSG_DEBUG, "nl80211: proberesp (offload)",
3358                             params->proberesp, params->proberesp_len);
3359                 if (nla_put(msg, NL80211_ATTR_PROBE_RESP, params->proberesp_len,
3360                             params->proberesp))
3361                         goto fail;
3362         }
3363         switch (params->hide_ssid) {
3364         case NO_SSID_HIDING:
3365                 wpa_printf(MSG_DEBUG, "nl80211: hidden SSID not in use");
3366                 if (nla_put_u32(msg, NL80211_ATTR_HIDDEN_SSID,
3367                                 NL80211_HIDDEN_SSID_NOT_IN_USE))
3368                         goto fail;
3369                 break;
3370         case HIDDEN_SSID_ZERO_LEN:
3371                 wpa_printf(MSG_DEBUG, "nl80211: hidden SSID zero len");
3372                 if (nla_put_u32(msg, NL80211_ATTR_HIDDEN_SSID,
3373                                 NL80211_HIDDEN_SSID_ZERO_LEN))
3374                         goto fail;
3375                 break;
3376         case HIDDEN_SSID_ZERO_CONTENTS:
3377                 wpa_printf(MSG_DEBUG, "nl80211: hidden SSID zero contents");
3378                 if (nla_put_u32(msg, NL80211_ATTR_HIDDEN_SSID,
3379                                 NL80211_HIDDEN_SSID_ZERO_CONTENTS))
3380                         goto fail;
3381                 break;
3382         }
3383         wpa_printf(MSG_DEBUG, "nl80211: privacy=%d", params->privacy);
3384         if (params->privacy &&
3385             nla_put_flag(msg, NL80211_ATTR_PRIVACY))
3386                 goto fail;
3387         wpa_printf(MSG_DEBUG, "nl80211: auth_algs=0x%x", params->auth_algs);
3388         if ((params->auth_algs & (WPA_AUTH_ALG_OPEN | WPA_AUTH_ALG_SHARED)) ==
3389             (WPA_AUTH_ALG_OPEN | WPA_AUTH_ALG_SHARED)) {
3390                 /* Leave out the attribute */
3391         } else if (params->auth_algs & WPA_AUTH_ALG_SHARED) {
3392                 if (nla_put_u32(msg, NL80211_ATTR_AUTH_TYPE,
3393                                 NL80211_AUTHTYPE_SHARED_KEY))
3394                         goto fail;
3395         } else {
3396                 if (nla_put_u32(msg, NL80211_ATTR_AUTH_TYPE,
3397                                 NL80211_AUTHTYPE_OPEN_SYSTEM))
3398                         goto fail;
3399         }
3400
3401         wpa_printf(MSG_DEBUG, "nl80211: wpa_version=0x%x", params->wpa_version);
3402         ver = 0;
3403         if (params->wpa_version & WPA_PROTO_WPA)
3404                 ver |= NL80211_WPA_VERSION_1;
3405         if (params->wpa_version & WPA_PROTO_RSN)
3406                 ver |= NL80211_WPA_VERSION_2;
3407         if (ver &&
3408             nla_put_u32(msg, NL80211_ATTR_WPA_VERSIONS, ver))
3409                 goto fail;
3410
3411         wpa_printf(MSG_DEBUG, "nl80211: key_mgmt_suites=0x%x",
3412                    params->key_mgmt_suites);
3413         num_suites = 0;
3414         if (params->key_mgmt_suites & WPA_KEY_MGMT_IEEE8021X)
3415                 suites[num_suites++] = WLAN_AKM_SUITE_8021X;
3416         if (params->key_mgmt_suites & WPA_KEY_MGMT_PSK)
3417                 suites[num_suites++] = WLAN_AKM_SUITE_PSK;
3418         if (num_suites &&
3419             nla_put(msg, NL80211_ATTR_AKM_SUITES, num_suites * sizeof(u32),
3420                     suites))
3421                 goto fail;
3422
3423         if (params->key_mgmt_suites & WPA_KEY_MGMT_IEEE8021X_NO_WPA &&
3424             params->pairwise_ciphers & (WPA_CIPHER_WEP104 | WPA_CIPHER_WEP40) &&
3425             nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT))
3426                 goto fail;
3427
3428         wpa_printf(MSG_DEBUG, "nl80211: pairwise_ciphers=0x%x",
3429                    params->pairwise_ciphers);
3430         num_suites = wpa_cipher_to_cipher_suites(params->pairwise_ciphers,
3431                                                  suites, ARRAY_SIZE(suites));
3432         if (num_suites &&
3433             nla_put(msg, NL80211_ATTR_CIPHER_SUITES_PAIRWISE,
3434                     num_suites * sizeof(u32), suites))
3435                 goto fail;
3436
3437         wpa_printf(MSG_DEBUG, "nl80211: group_cipher=0x%x",
3438                    params->group_cipher);
3439         suite = wpa_cipher_to_cipher_suite(params->group_cipher);
3440         if (suite &&
3441             nla_put_u32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP, suite))
3442                 goto fail;
3443
3444         switch (params->smps_mode) {
3445         case HT_CAP_INFO_SMPS_DYNAMIC:
3446                 wpa_printf(MSG_DEBUG, "nl80211: SMPS mode - dynamic");
3447                 smps_mode = NL80211_SMPS_DYNAMIC;
3448                 break;
3449         case HT_CAP_INFO_SMPS_STATIC:
3450                 wpa_printf(MSG_DEBUG, "nl80211: SMPS mode - static");
3451                 smps_mode = NL80211_SMPS_STATIC;
3452                 break;
3453         default:
3454                 /* invalid - fallback to smps off */
3455         case HT_CAP_INFO_SMPS_DISABLED:
3456                 wpa_printf(MSG_DEBUG, "nl80211: SMPS mode - off");
3457                 smps_mode = NL80211_SMPS_OFF;
3458                 break;
3459         }
3460         if (nla_put_u32(msg, NL80211_ATTR_SMPS_MODE, smps_mode))
3461                 goto fail;
3462
3463         if (params->beacon_ies) {
3464                 wpa_hexdump_buf(MSG_DEBUG, "nl80211: beacon_ies",
3465                                 params->beacon_ies);
3466                 if (nla_put(msg, NL80211_ATTR_IE,
3467                             wpabuf_len(params->beacon_ies),
3468                             wpabuf_head(params->beacon_ies)))
3469                         goto fail;
3470         }
3471         if (params->proberesp_ies) {
3472                 wpa_hexdump_buf(MSG_DEBUG, "nl80211: proberesp_ies",
3473                                 params->proberesp_ies);
3474                 if (nla_put(msg, NL80211_ATTR_IE_PROBE_RESP,
3475                             wpabuf_len(params->proberesp_ies),
3476                             wpabuf_head(params->proberesp_ies)))
3477                         goto fail;
3478         }
3479         if (params->assocresp_ies) {
3480                 wpa_hexdump_buf(MSG_DEBUG, "nl80211: assocresp_ies",
3481                                 params->assocresp_ies);
3482                 if (nla_put(msg, NL80211_ATTR_IE_ASSOC_RESP,
3483                             wpabuf_len(params->assocresp_ies),
3484                             wpabuf_head(params->assocresp_ies)))
3485                         goto fail;
3486         }
3487
3488         if (drv->capa.flags & WPA_DRIVER_FLAGS_INACTIVITY_TIMER)  {
3489                 wpa_printf(MSG_DEBUG, "nl80211: ap_max_inactivity=%d",
3490                            params->ap_max_inactivity);
3491                 if (nla_put_u16(msg, NL80211_ATTR_INACTIVITY_TIMEOUT,
3492                                 params->ap_max_inactivity))
3493                         goto fail;
3494         }
3495
3496 #ifdef CONFIG_P2P
3497         if (params->p2p_go_ctwindow > 0) {
3498                 if (drv->p2p_go_ctwindow_supported) {
3499                         wpa_printf(MSG_DEBUG, "nl80211: P2P GO ctwindow=%d",
3500                                    params->p2p_go_ctwindow);
3501                         if (nla_put_u8(msg, NL80211_ATTR_P2P_CTWINDOW,
3502                                        params->p2p_go_ctwindow))
3503                                 goto fail;
3504                 } else {
3505                         wpa_printf(MSG_INFO,
3506                                    "nl80211: Driver does not support CTWindow configuration - ignore this parameter");
3507                 }
3508         }
3509 #endif /* CONFIG_P2P */
3510
3511         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3512         if (ret) {
3513                 wpa_printf(MSG_DEBUG, "nl80211: Beacon set failed: %d (%s)",
3514                            ret, strerror(-ret));
3515         } else {
3516                 bss->beacon_set = 1;
3517                 nl80211_set_bss(bss, params->cts_protect, params->preamble,
3518                                 params->short_slot_time, params->ht_opmode,
3519                                 params->isolate, params->basic_rates);
3520                 if (beacon_set && params->freq &&
3521                     params->freq->bandwidth != bss->bandwidth) {
3522                         wpa_printf(MSG_DEBUG,
3523                                    "nl80211: Update BSS %s bandwidth: %d -> %d",
3524                                    bss->ifname, bss->bandwidth,
3525                                    params->freq->bandwidth);
3526                         ret = nl80211_set_channel(bss, params->freq, 1);
3527                         if (ret) {
3528                                 wpa_printf(MSG_DEBUG,
3529                                            "nl80211: Frequency set failed: %d (%s)",
3530                                            ret, strerror(-ret));
3531                         } else {
3532                                 wpa_printf(MSG_DEBUG,
3533                                            "nl80211: Frequency set succeeded for ht2040 coex");
3534                                 bss->bandwidth = params->freq->bandwidth;
3535                         }
3536                 } else if (!beacon_set) {
3537                         /*
3538                          * cfg80211 updates the driver on frequence change in AP
3539                          * mode only at the point when beaconing is started, so
3540                          * set the initial value here.
3541                          */
3542                         bss->bandwidth = params->freq->bandwidth;
3543                 }
3544         }
3545         return ret;
3546 fail:
3547         nlmsg_free(msg);
3548         return -ENOBUFS;
3549 }
3550
3551
3552 static int nl80211_put_freq_params(struct nl_msg *msg,
3553                                    const struct hostapd_freq_params *freq)
3554 {
3555         wpa_printf(MSG_DEBUG, "  * freq=%d", freq->freq);
3556         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq->freq))
3557                 return -ENOBUFS;
3558
3559         wpa_printf(MSG_DEBUG, "  * vht_enabled=%d", freq->vht_enabled);
3560         wpa_printf(MSG_DEBUG, "  * ht_enabled=%d", freq->ht_enabled);
3561
3562         if (freq->vht_enabled) {
3563                 enum nl80211_chan_width cw;
3564
3565                 wpa_printf(MSG_DEBUG, "  * bandwidth=%d", freq->bandwidth);
3566                 switch (freq->bandwidth) {
3567                 case 20:
3568                         cw = NL80211_CHAN_WIDTH_20;
3569                         break;
3570                 case 40:
3571                         cw = NL80211_CHAN_WIDTH_40;
3572                         break;
3573                 case 80:
3574                         if (freq->center_freq2)
3575                                 cw = NL80211_CHAN_WIDTH_80P80;
3576                         else
3577                                 cw = NL80211_CHAN_WIDTH_80;
3578                         break;
3579                 case 160:
3580                         cw = NL80211_CHAN_WIDTH_160;
3581                         break;
3582                 default:
3583                         return -EINVAL;
3584                 }
3585
3586                 wpa_printf(MSG_DEBUG, "  * channel_width=%d", cw);
3587                 wpa_printf(MSG_DEBUG, "  * center_freq1=%d",
3588                            freq->center_freq1);
3589                 wpa_printf(MSG_DEBUG, "  * center_freq2=%d",
3590                            freq->center_freq2);
3591                 if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, cw) ||
3592                     nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1,
3593                                 freq->center_freq1) ||
3594                     (freq->center_freq2 &&
3595                      nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2,
3596                                  freq->center_freq2)))
3597                         return -ENOBUFS;
3598         } else if (freq->ht_enabled) {
3599                 enum nl80211_channel_type ct;
3600
3601                 wpa_printf(MSG_DEBUG, "  * sec_channel_offset=%d",
3602                            freq->sec_channel_offset);
3603                 switch (freq->sec_channel_offset) {
3604                 case -1:
3605                         ct = NL80211_CHAN_HT40MINUS;
3606                         break;
3607                 case 1:
3608                         ct = NL80211_CHAN_HT40PLUS;
3609                         break;
3610                 default:
3611                         ct = NL80211_CHAN_HT20;
3612                         break;
3613                 }
3614
3615                 wpa_printf(MSG_DEBUG, "  * channel_type=%d", ct);
3616                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, ct))
3617                         return -ENOBUFS;
3618         }
3619         return 0;
3620 }
3621
3622
3623 static int nl80211_set_channel(struct i802_bss *bss,
3624                                struct hostapd_freq_params *freq, int set_chan)
3625 {
3626         struct wpa_driver_nl80211_data *drv = bss->drv;
3627         struct nl_msg *msg;
3628         int ret;
3629
3630         wpa_printf(MSG_DEBUG,
3631                    "nl80211: Set freq %d (ht_enabled=%d, vht_enabled=%d, bandwidth=%d MHz, cf1=%d MHz, cf2=%d MHz)",
3632                    freq->freq, freq->ht_enabled, freq->vht_enabled,
3633                    freq->bandwidth, freq->center_freq1, freq->center_freq2);
3634
3635         msg = nl80211_drv_msg(drv, 0, set_chan ? NL80211_CMD_SET_CHANNEL :
3636                               NL80211_CMD_SET_WIPHY);
3637         if (!msg || nl80211_put_freq_params(msg, freq) < 0) {
3638                 nlmsg_free(msg);
3639                 return -1;
3640         }
3641
3642         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3643         if (ret == 0) {
3644                 bss->freq = freq->freq;
3645                 return 0;
3646         }
3647         wpa_printf(MSG_DEBUG, "nl80211: Failed to set channel (freq=%d): "
3648                    "%d (%s)", freq->freq, ret, strerror(-ret));
3649         return -1;
3650 }
3651
3652
3653 static u32 sta_flags_nl80211(int flags)
3654 {
3655         u32 f = 0;
3656
3657         if (flags & WPA_STA_AUTHORIZED)
3658                 f |= BIT(NL80211_STA_FLAG_AUTHORIZED);
3659         if (flags & WPA_STA_WMM)
3660                 f |= BIT(NL80211_STA_FLAG_WME);
3661         if (flags & WPA_STA_SHORT_PREAMBLE)
3662                 f |= BIT(NL80211_STA_FLAG_SHORT_PREAMBLE);
3663         if (flags & WPA_STA_MFP)
3664                 f |= BIT(NL80211_STA_FLAG_MFP);
3665         if (flags & WPA_STA_TDLS_PEER)
3666                 f |= BIT(NL80211_STA_FLAG_TDLS_PEER);
3667         if (flags & WPA_STA_AUTHENTICATED)
3668                 f |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
3669
3670         return f;
3671 }
3672
3673
3674 #ifdef CONFIG_MESH
3675 static u32 sta_plink_state_nl80211(enum mesh_plink_state state)
3676 {
3677         switch (state) {
3678         case PLINK_LISTEN:
3679                 return NL80211_PLINK_LISTEN;
3680         case PLINK_OPEN_SENT:
3681                 return NL80211_PLINK_OPN_SNT;
3682         case PLINK_OPEN_RCVD:
3683                 return NL80211_PLINK_OPN_RCVD;
3684         case PLINK_CNF_RCVD:
3685                 return NL80211_PLINK_CNF_RCVD;
3686         case PLINK_ESTAB:
3687                 return NL80211_PLINK_ESTAB;
3688         case PLINK_HOLDING:
3689                 return NL80211_PLINK_HOLDING;
3690         case PLINK_BLOCKED:
3691                 return NL80211_PLINK_BLOCKED;
3692         default:
3693                 wpa_printf(MSG_ERROR, "nl80211: Invalid mesh plink state %d",
3694                            state);
3695         }
3696         return -1;
3697 }
3698 #endif /* CONFIG_MESH */
3699
3700
3701 static int wpa_driver_nl80211_sta_add(void *priv,
3702                                       struct hostapd_sta_add_params *params)
3703 {
3704         struct i802_bss *bss = priv;
3705         struct wpa_driver_nl80211_data *drv = bss->drv;
3706         struct nl_msg *msg;
3707         struct nl80211_sta_flag_update upd;
3708         int ret = -ENOBUFS;
3709
3710         if ((params->flags & WPA_STA_TDLS_PEER) &&
3711             !(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT))
3712                 return -EOPNOTSUPP;
3713
3714         wpa_printf(MSG_DEBUG, "nl80211: %s STA " MACSTR,
3715                    params->set ? "Set" : "Add", MAC2STR(params->addr));
3716         msg = nl80211_bss_msg(bss, 0, params->set ? NL80211_CMD_SET_STATION :
3717                               NL80211_CMD_NEW_STATION);
3718         if (!msg || nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, params->addr))
3719                 goto fail;
3720
3721         if (!params->set || (params->flags & WPA_STA_TDLS_PEER)) {
3722                 wpa_hexdump(MSG_DEBUG, "  * supported rates",
3723                             params->supp_rates, params->supp_rates_len);
3724                 wpa_printf(MSG_DEBUG, "  * capability=0x%x",
3725                            params->capability);
3726                 if (nla_put(msg, NL80211_ATTR_STA_SUPPORTED_RATES,
3727                             params->supp_rates_len, params->supp_rates) ||
3728                     nla_put_u16(msg, NL80211_ATTR_STA_CAPABILITY,
3729                                 params->capability))
3730                         goto fail;
3731
3732                 if (params->ht_capabilities) {
3733                         wpa_hexdump(MSG_DEBUG, "  * ht_capabilities",
3734                                     (u8 *) params->ht_capabilities,
3735                                     sizeof(*params->ht_capabilities));
3736                         if (nla_put(msg, NL80211_ATTR_HT_CAPABILITY,
3737                                     sizeof(*params->ht_capabilities),
3738                                     params->ht_capabilities))
3739                                 goto fail;
3740                 }
3741
3742                 if (params->vht_capabilities) {
3743                         wpa_hexdump(MSG_DEBUG, "  * vht_capabilities",
3744                                     (u8 *) params->vht_capabilities,
3745                                     sizeof(*params->vht_capabilities));
3746                         if (nla_put(msg, NL80211_ATTR_VHT_CAPABILITY,
3747                                     sizeof(*params->vht_capabilities),
3748                                     params->vht_capabilities))
3749                                 goto fail;
3750                 }
3751
3752                 if (params->ext_capab) {
3753                         wpa_hexdump(MSG_DEBUG, "  * ext_capab",
3754                                     params->ext_capab, params->ext_capab_len);
3755                         if (nla_put(msg, NL80211_ATTR_STA_EXT_CAPABILITY,
3756                                     params->ext_capab_len, params->ext_capab))
3757                                 goto fail;
3758                 }
3759         }
3760         if (!params->set) {
3761                 if (params->aid) {
3762                         wpa_printf(MSG_DEBUG, "  * aid=%u", params->aid);
3763                         if (nla_put_u16(msg, NL80211_ATTR_STA_AID, params->aid))
3764                                 goto fail;
3765                 } else {
3766                         /*
3767                          * cfg80211 validates that AID is non-zero, so we have
3768                          * to make this a non-zero value for the TDLS case where
3769                          * a dummy STA entry is used for now.
3770                          */
3771                         wpa_printf(MSG_DEBUG, "  * aid=1 (TDLS workaround)");
3772                         if (nla_put_u16(msg, NL80211_ATTR_STA_AID, 1))
3773                                 goto fail;
3774                 }
3775                 wpa_printf(MSG_DEBUG, "  * listen_interval=%u",
3776                            params->listen_interval);
3777                 if (nla_put_u16(msg, NL80211_ATTR_STA_LISTEN_INTERVAL,
3778                                 params->listen_interval))
3779                         goto fail;
3780         } else if (params->aid && (params->flags & WPA_STA_TDLS_PEER)) {
3781                 wpa_printf(MSG_DEBUG, "  * peer_aid=%u", params->aid);
3782                 if (nla_put_u16(msg, NL80211_ATTR_PEER_AID, params->aid))
3783                         goto fail;
3784         }
3785
3786         if (params->vht_opmode_enabled) {
3787                 wpa_printf(MSG_DEBUG, "  * opmode=%u", params->vht_opmode);
3788                 if (nla_put_u8(msg, NL80211_ATTR_OPMODE_NOTIF,
3789                                params->vht_opmode))
3790                         goto fail;
3791         }
3792
3793         if (params->supp_channels) {
3794                 wpa_hexdump(MSG_DEBUG, "  * supported channels",
3795                             params->supp_channels, params->supp_channels_len);
3796                 if (nla_put(msg, NL80211_ATTR_STA_SUPPORTED_CHANNELS,
3797                             params->supp_channels_len, params->supp_channels))
3798                         goto fail;
3799         }
3800
3801         if (params->supp_oper_classes) {
3802                 wpa_hexdump(MSG_DEBUG, "  * supported operating classes",
3803                             params->supp_oper_classes,
3804                             params->supp_oper_classes_len);
3805                 if (nla_put(msg, NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES,
3806                             params->supp_oper_classes_len,
3807                             params->supp_oper_classes))
3808                         goto fail;
3809         }
3810
3811         os_memset(&upd, 0, sizeof(upd));
3812         upd.set = sta_flags_nl80211(params->flags);
3813         upd.mask = upd.set | sta_flags_nl80211(params->flags_mask);
3814         wpa_printf(MSG_DEBUG, "  * flags set=0x%x mask=0x%x",
3815                    upd.set, upd.mask);
3816         if (nla_put(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd))
3817                 goto fail;
3818
3819 #ifdef CONFIG_MESH
3820         if (params->plink_state &&
3821             nla_put_u8(msg, NL80211_ATTR_STA_PLINK_STATE,
3822                        sta_plink_state_nl80211(params->plink_state)))
3823                 goto fail;
3824 #endif /* CONFIG_MESH */
3825
3826         if (params->flags & WPA_STA_WMM) {
3827                 struct nlattr *wme = nla_nest_start(msg, NL80211_ATTR_STA_WME);
3828
3829                 wpa_printf(MSG_DEBUG, "  * qosinfo=0x%x", params->qosinfo);
3830                 if (!wme ||
3831                     nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
3832                                params->qosinfo & WMM_QOSINFO_STA_AC_MASK) ||
3833                     nla_put_u8(msg, NL80211_STA_WME_MAX_SP,
3834                                (params->qosinfo >> WMM_QOSINFO_STA_SP_SHIFT) &
3835                                WMM_QOSINFO_STA_SP_MASK))
3836                         goto fail;
3837                 nla_nest_end(msg, wme);
3838         }
3839
3840         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3841         msg = NULL;
3842         if (ret)
3843                 wpa_printf(MSG_DEBUG, "nl80211: NL80211_CMD_%s_STATION "
3844                            "result: %d (%s)", params->set ? "SET" : "NEW", ret,
3845                            strerror(-ret));
3846         if (ret == -EEXIST)
3847                 ret = 0;
3848 fail:
3849         nlmsg_free(msg);
3850         return ret;
3851 }
3852
3853
3854 static void rtnl_neigh_delete_fdb_entry(struct i802_bss *bss, const u8 *addr)
3855 {
3856 #ifdef CONFIG_LIBNL3_ROUTE
3857         struct wpa_driver_nl80211_data *drv = bss->drv;
3858         struct rtnl_neigh *rn;
3859         struct nl_addr *nl_addr;
3860         int err;
3861
3862         rn = rtnl_neigh_alloc();
3863         if (!rn)
3864                 return;
3865
3866         rtnl_neigh_set_family(rn, AF_BRIDGE);
3867         rtnl_neigh_set_ifindex(rn, bss->ifindex);
3868         nl_addr = nl_addr_build(AF_BRIDGE, (void *) addr, ETH_ALEN);
3869         if (!nl_addr) {
3870                 rtnl_neigh_put(rn);
3871                 return;
3872         }
3873         rtnl_neigh_set_lladdr(rn, nl_addr);
3874
3875         err = rtnl_neigh_delete(drv->rtnl_sk, rn, 0);
3876         if (err < 0) {
3877                 wpa_printf(MSG_DEBUG, "nl80211: bridge FDB entry delete for "
3878                            MACSTR " ifindex=%d failed: %s", MAC2STR(addr),
3879                            bss->ifindex, nl_geterror(err));
3880         } else {
3881                 wpa_printf(MSG_DEBUG, "nl80211: deleted bridge FDB entry for "
3882                            MACSTR, MAC2STR(addr));
3883         }
3884
3885         nl_addr_put(nl_addr);
3886         rtnl_neigh_put(rn);
3887 #endif /* CONFIG_LIBNL3_ROUTE */
3888 }
3889
3890
3891 static int wpa_driver_nl80211_sta_remove(struct i802_bss *bss, const u8 *addr,
3892                                          int deauth, u16 reason_code)
3893 {
3894         struct wpa_driver_nl80211_data *drv = bss->drv;
3895         struct nl_msg *msg;
3896         int ret;
3897
3898         if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_DEL_STATION)) ||
3899             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
3900             (deauth == 0 &&
3901              nla_put_u8(msg, NL80211_ATTR_MGMT_SUBTYPE,
3902                         WLAN_FC_STYPE_DISASSOC)) ||
3903             (deauth == 1 &&
3904              nla_put_u8(msg, NL80211_ATTR_MGMT_SUBTYPE,
3905                         WLAN_FC_STYPE_DEAUTH)) ||
3906             (reason_code &&
3907              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code))) {
3908                 nlmsg_free(msg);
3909                 return -ENOBUFS;
3910         }
3911
3912         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3913         wpa_printf(MSG_DEBUG, "nl80211: sta_remove -> DEL_STATION %s " MACSTR
3914                    " --> %d (%s)",
3915                    bss->ifname, MAC2STR(addr), ret, strerror(-ret));
3916
3917         if (drv->rtnl_sk)
3918                 rtnl_neigh_delete_fdb_entry(bss, addr);
3919
3920         if (ret == -ENOENT)
3921                 return 0;
3922         return ret;
3923 }
3924
3925
3926 void nl80211_remove_iface(struct wpa_driver_nl80211_data *drv, int ifidx)
3927 {
3928         struct nl_msg *msg;
3929         struct wpa_driver_nl80211_data *drv2;
3930
3931         wpa_printf(MSG_DEBUG, "nl80211: Remove interface ifindex=%d", ifidx);
3932
3933         /* stop listening for EAPOL on this interface */
3934         dl_list_for_each(drv2, &drv->global->interfaces,
3935                          struct wpa_driver_nl80211_data, list)
3936                 del_ifidx(drv2, ifidx);
3937
3938         msg = nl80211_ifindex_msg(drv, ifidx, 0, NL80211_CMD_DEL_INTERFACE);
3939         if (send_and_recv_msgs(drv, msg, NULL, NULL) == 0)
3940                 return;
3941         wpa_printf(MSG_ERROR, "Failed to remove interface (ifidx=%d)", ifidx);
3942 }
3943
3944
3945 static const char * nl80211_iftype_str(enum nl80211_iftype mode)
3946 {
3947         switch (mode) {
3948         case NL80211_IFTYPE_ADHOC:
3949                 return "ADHOC";
3950         case NL80211_IFTYPE_STATION:
3951                 return "STATION";
3952         case NL80211_IFTYPE_AP:
3953                 return "AP";
3954         case NL80211_IFTYPE_AP_VLAN:
3955                 return "AP_VLAN";
3956         case NL80211_IFTYPE_WDS:
3957                 return "WDS";
3958         case NL80211_IFTYPE_MONITOR:
3959                 return "MONITOR";
3960         case NL80211_IFTYPE_MESH_POINT:
3961                 return "MESH_POINT";
3962         case NL80211_IFTYPE_P2P_CLIENT:
3963                 return "P2P_CLIENT";
3964         case NL80211_IFTYPE_P2P_GO:
3965                 return "P2P_GO";
3966         case NL80211_IFTYPE_P2P_DEVICE:
3967                 return "P2P_DEVICE";
3968         default:
3969                 return "unknown";
3970         }
3971 }
3972
3973
3974 static int nl80211_create_iface_once(struct wpa_driver_nl80211_data *drv,
3975                                      const char *ifname,
3976                                      enum nl80211_iftype iftype,
3977                                      const u8 *addr, int wds,
3978                                      int (*handler)(struct nl_msg *, void *),
3979                                      void *arg)
3980 {
3981         struct nl_msg *msg;
3982         int ifidx;
3983         int ret = -ENOBUFS;
3984
3985         wpa_printf(MSG_DEBUG, "nl80211: Create interface iftype %d (%s)",
3986                    iftype, nl80211_iftype_str(iftype));
3987
3988         msg = nl80211_cmd_msg(drv->first_bss, 0, NL80211_CMD_NEW_INTERFACE);
3989         if (!msg ||
3990             nla_put_string(msg, NL80211_ATTR_IFNAME, ifname) ||
3991             nla_put_u32(msg, NL80211_ATTR_IFTYPE, iftype))
3992                 goto fail;
3993
3994         if (iftype == NL80211_IFTYPE_MONITOR) {
3995                 struct nlattr *flags;
3996
3997                 flags = nla_nest_start(msg, NL80211_ATTR_MNTR_FLAGS);
3998                 if (!flags ||
3999                     nla_put_flag(msg, NL80211_MNTR_FLAG_COOK_FRAMES))
4000                         goto fail;
4001
4002                 nla_nest_end(msg, flags);
4003         } else if (wds) {
4004                 if (nla_put_u8(msg, NL80211_ATTR_4ADDR, wds))
4005                         goto fail;
4006         }
4007
4008         /*
4009          * Tell cfg80211 that the interface belongs to the socket that created
4010          * it, and the interface should be deleted when the socket is closed.
4011          */
4012         if (nla_put_flag(msg, NL80211_ATTR_IFACE_SOCKET_OWNER))
4013                 goto fail;
4014
4015         ret = send_and_recv_msgs(drv, msg, handler, arg);
4016         msg = NULL;
4017         if (ret) {
4018         fail:
4019                 nlmsg_free(msg);
4020                 wpa_printf(MSG_ERROR, "Failed to create interface %s: %d (%s)",
4021                            ifname, ret, strerror(-ret));
4022                 return ret;
4023         }
4024
4025         if (iftype == NL80211_IFTYPE_P2P_DEVICE)
4026                 return 0;
4027
4028         ifidx = if_nametoindex(ifname);
4029         wpa_printf(MSG_DEBUG, "nl80211: New interface %s created: ifindex=%d",
4030                    ifname, ifidx);
4031
4032         if (ifidx <= 0)
4033                 return -1;
4034
4035         /*
4036          * Some virtual interfaces need to process EAPOL packets and events on
4037          * the parent interface. This is used mainly with hostapd.
4038          */
4039         if (drv->hostapd ||
4040             iftype == NL80211_IFTYPE_AP_VLAN ||
4041             iftype == NL80211_IFTYPE_WDS ||
4042             iftype == NL80211_IFTYPE_MONITOR) {
4043                 /* start listening for EAPOL on this interface */
4044                 add_ifidx(drv, ifidx);
4045         }
4046
4047         if (addr && iftype != NL80211_IFTYPE_MONITOR &&
4048             linux_set_ifhwaddr(drv->global->ioctl_sock, ifname, addr)) {
4049                 nl80211_remove_iface(drv, ifidx);
4050                 return -1;
4051         }
4052
4053         return ifidx;
4054 }
4055
4056
4057 int nl80211_create_iface(struct wpa_driver_nl80211_data *drv,
4058                          const char *ifname, enum nl80211_iftype iftype,
4059                          const u8 *addr, int wds,
4060                          int (*handler)(struct nl_msg *, void *),
4061                          void *arg, int use_existing)
4062 {
4063         int ret;
4064
4065         ret = nl80211_create_iface_once(drv, ifname, iftype, addr, wds, handler,
4066                                         arg);
4067
4068         /* if error occurred and interface exists already */
4069         if (ret == -ENFILE && if_nametoindex(ifname)) {
4070                 if (use_existing) {
4071                         wpa_printf(MSG_DEBUG, "nl80211: Continue using existing interface %s",
4072                                    ifname);
4073                         if (addr && iftype != NL80211_IFTYPE_MONITOR &&
4074                             linux_set_ifhwaddr(drv->global->ioctl_sock, ifname,
4075                                                addr) < 0 &&
4076                             (linux_set_iface_flags(drv->global->ioctl_sock,
4077                                                    ifname, 0) < 0 ||
4078                              linux_set_ifhwaddr(drv->global->ioctl_sock, ifname,
4079                                                 addr) < 0 ||
4080                              linux_set_iface_flags(drv->global->ioctl_sock,
4081                                                    ifname, 1) < 0))
4082                                         return -1;
4083                         return -ENFILE;
4084                 }
4085                 wpa_printf(MSG_INFO, "Try to remove and re-create %s", ifname);
4086
4087                 /* Try to remove the interface that was already there. */
4088                 nl80211_remove_iface(drv, if_nametoindex(ifname));
4089
4090                 /* Try to create the interface again */
4091                 ret = nl80211_create_iface_once(drv, ifname, iftype, addr,
4092                                                 wds, handler, arg);
4093         }
4094
4095         if (ret >= 0 && is_p2p_net_interface(iftype)) {
4096                 wpa_printf(MSG_DEBUG,
4097                            "nl80211: Interface %s created for P2P - disable 11b rates",
4098                            ifname);
4099                 nl80211_disable_11b_rates(drv, ret, 1);
4100         }
4101
4102         return ret;
4103 }
4104
4105
4106 static int nl80211_setup_ap(struct i802_bss *bss)
4107 {
4108         struct wpa_driver_nl80211_data *drv = bss->drv;
4109
4110         wpa_printf(MSG_DEBUG, "nl80211: Setup AP(%s) - device_ap_sme=%d use_monitor=%d",
4111                    bss->ifname, drv->device_ap_sme, drv->use_monitor);
4112
4113         /*
4114          * Disable Probe Request reporting unless we need it in this way for
4115          * devices that include the AP SME, in the other case (unless using
4116          * monitor iface) we'll get it through the nl_mgmt socket instead.
4117          */
4118         if (!drv->device_ap_sme)
4119                 wpa_driver_nl80211_probe_req_report(bss, 0);
4120
4121         if (!drv->device_ap_sme && !drv->use_monitor)
4122                 if (nl80211_mgmt_subscribe_ap(bss))
4123                         return -1;
4124
4125         if (drv->device_ap_sme && !drv->use_monitor)
4126                 if (nl80211_mgmt_subscribe_ap_dev_sme(bss))
4127                         return -1;
4128
4129         if (!drv->device_ap_sme && drv->use_monitor &&
4130             nl80211_create_monitor_interface(drv) &&
4131             !drv->device_ap_sme)
4132                 return -1;
4133
4134         if (drv->device_ap_sme &&
4135             wpa_driver_nl80211_probe_req_report(bss, 1) < 0) {
4136                 wpa_printf(MSG_DEBUG, "nl80211: Failed to enable "
4137                            "Probe Request frame reporting in AP mode");
4138                 /* Try to survive without this */
4139         }
4140
4141         return 0;
4142 }
4143
4144
4145 static void nl80211_teardown_ap(struct i802_bss *bss)
4146 {
4147         struct wpa_driver_nl80211_data *drv = bss->drv;
4148
4149         wpa_printf(MSG_DEBUG, "nl80211: Teardown AP(%s) - device_ap_sme=%d use_monitor=%d",
4150                    bss->ifname, drv->device_ap_sme, drv->use_monitor);
4151         if (drv->device_ap_sme) {
4152                 wpa_driver_nl80211_probe_req_report(bss, 0);
4153                 if (!drv->use_monitor)
4154                         nl80211_mgmt_unsubscribe(bss, "AP teardown (dev SME)");
4155         } else if (drv->use_monitor)
4156                 nl80211_remove_monitor_interface(drv);
4157         else
4158                 nl80211_mgmt_unsubscribe(bss, "AP teardown");
4159
4160         bss->beacon_set = 0;
4161 }
4162
4163
4164 static int nl80211_send_eapol_data(struct i802_bss *bss,
4165                                    const u8 *addr, const u8 *data,
4166                                    size_t data_len)
4167 {
4168         struct sockaddr_ll ll;
4169         int ret;
4170
4171         if (bss->drv->eapol_tx_sock < 0) {
4172                 wpa_printf(MSG_DEBUG, "nl80211: No socket to send EAPOL");
4173                 return -1;
4174         }
4175
4176         os_memset(&ll, 0, sizeof(ll));
4177         ll.sll_family = AF_PACKET;
4178         ll.sll_ifindex = bss->ifindex;
4179         ll.sll_protocol = htons(ETH_P_PAE);
4180         ll.sll_halen = ETH_ALEN;
4181         os_memcpy(ll.sll_addr, addr, ETH_ALEN);
4182         ret = sendto(bss->drv->eapol_tx_sock, data, data_len, 0,
4183                      (struct sockaddr *) &ll, sizeof(ll));
4184         if (ret < 0)
4185                 wpa_printf(MSG_ERROR, "nl80211: EAPOL TX: %s",
4186                            strerror(errno));
4187
4188         return ret;
4189 }
4190
4191
4192 static const u8 rfc1042_header[6] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
4193
4194 static int wpa_driver_nl80211_hapd_send_eapol(
4195         void *priv, const u8 *addr, const u8 *data,
4196         size_t data_len, int encrypt, const u8 *own_addr, u32 flags)
4197 {
4198         struct i802_bss *bss = priv;
4199         struct wpa_driver_nl80211_data *drv = bss->drv;
4200         struct ieee80211_hdr *hdr;
4201         size_t len;
4202         u8 *pos;
4203         int res;
4204         int qos = flags & WPA_STA_WMM;
4205
4206         if (drv->device_ap_sme || !drv->use_monitor)
4207                 return nl80211_send_eapol_data(bss, addr, data, data_len);
4208
4209         len = sizeof(*hdr) + (qos ? 2 : 0) + sizeof(rfc1042_header) + 2 +
4210                 data_len;
4211         hdr = os_zalloc(len);
4212         if (hdr == NULL) {
4213                 wpa_printf(MSG_INFO, "nl80211: Failed to allocate EAPOL buffer(len=%lu)",
4214                            (unsigned long) len);
4215                 return -1;
4216         }
4217
4218         hdr->frame_control =
4219                 IEEE80211_FC(WLAN_FC_TYPE_DATA, WLAN_FC_STYPE_DATA);
4220         hdr->frame_control |= host_to_le16(WLAN_FC_FROMDS);
4221         if (encrypt)
4222                 hdr->frame_control |= host_to_le16(WLAN_FC_ISWEP);
4223         if (qos) {
4224                 hdr->frame_control |=
4225                         host_to_le16(WLAN_FC_STYPE_QOS_DATA << 4);
4226         }
4227
4228         memcpy(hdr->IEEE80211_DA_FROMDS, addr, ETH_ALEN);
4229         memcpy(hdr->IEEE80211_BSSID_FROMDS, own_addr, ETH_ALEN);
4230         memcpy(hdr->IEEE80211_SA_FROMDS, own_addr, ETH_ALEN);
4231         pos = (u8 *) (hdr + 1);
4232
4233         if (qos) {
4234                 /* Set highest priority in QoS header */
4235                 pos[0] = 7;
4236                 pos[1] = 0;
4237                 pos += 2;
4238         }
4239
4240         memcpy(pos, rfc1042_header, sizeof(rfc1042_header));
4241         pos += sizeof(rfc1042_header);
4242         WPA_PUT_BE16(pos, ETH_P_PAE);
4243         pos += 2;
4244         memcpy(pos, data, data_len);
4245
4246         res = wpa_driver_nl80211_send_frame(bss, (u8 *) hdr, len, encrypt, 0,
4247                                             0, 0, 0, 0);
4248         if (res < 0) {
4249                 wpa_printf(MSG_ERROR, "i802_send_eapol - packet len: %lu - "
4250                            "failed: %d (%s)",
4251                            (unsigned long) len, errno, strerror(errno));
4252         }
4253         os_free(hdr);
4254
4255         return res;
4256 }
4257
4258
4259 static int wpa_driver_nl80211_sta_set_flags(void *priv, const u8 *addr,
4260                                             unsigned int total_flags,
4261                                             unsigned int flags_or,
4262                                             unsigned int flags_and)
4263 {
4264         struct i802_bss *bss = priv;
4265         struct nl_msg *msg;
4266         struct nlattr *flags;
4267         struct nl80211_sta_flag_update upd;
4268
4269         wpa_printf(MSG_DEBUG, "nl80211: Set STA flags - ifname=%s addr=" MACSTR
4270                    " total_flags=0x%x flags_or=0x%x flags_and=0x%x authorized=%d",
4271                    bss->ifname, MAC2STR(addr), total_flags, flags_or, flags_and,
4272                    !!(total_flags & WPA_STA_AUTHORIZED));
4273
4274         if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_SET_STATION)) ||
4275             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
4276                 goto fail;
4277
4278         /*
4279          * Backwards compatibility version using NL80211_ATTR_STA_FLAGS. This
4280          * can be removed eventually.
4281          */
4282         flags = nla_nest_start(msg, NL80211_ATTR_STA_FLAGS);
4283         if (!flags ||
4284             ((total_flags & WPA_STA_AUTHORIZED) &&
4285              nla_put_flag(msg, NL80211_STA_FLAG_AUTHORIZED)) ||
4286             ((total_flags & WPA_STA_WMM) &&
4287              nla_put_flag(msg, NL80211_STA_FLAG_WME)) ||
4288             ((total_flags & WPA_STA_SHORT_PREAMBLE) &&
4289              nla_put_flag(msg, NL80211_STA_FLAG_SHORT_PREAMBLE)) ||
4290             ((total_flags & WPA_STA_MFP) &&
4291              nla_put_flag(msg, NL80211_STA_FLAG_MFP)) ||
4292             ((total_flags & WPA_STA_TDLS_PEER) &&
4293              nla_put_flag(msg, NL80211_STA_FLAG_TDLS_PEER)))
4294                 goto fail;
4295
4296         nla_nest_end(msg, flags);
4297
4298         os_memset(&upd, 0, sizeof(upd));
4299         upd.mask = sta_flags_nl80211(flags_or | ~flags_and);
4300         upd.set = sta_flags_nl80211(flags_or);
4301         if (nla_put(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd))
4302                 goto fail;
4303
4304         return send_and_recv_msgs(bss->drv, msg, NULL, NULL);
4305 fail:
4306         nlmsg_free(msg);
4307         return -ENOBUFS;
4308 }
4309
4310
4311 static int wpa_driver_nl80211_ap(struct wpa_driver_nl80211_data *drv,
4312                                  struct wpa_driver_associate_params *params)
4313 {
4314         enum nl80211_iftype nlmode, old_mode;
4315
4316         if (params->p2p) {
4317                 wpa_printf(MSG_DEBUG, "nl80211: Setup AP operations for P2P "
4318                            "group (GO)");
4319                 nlmode = NL80211_IFTYPE_P2P_GO;
4320         } else
4321                 nlmode = NL80211_IFTYPE_AP;
4322
4323         old_mode = drv->nlmode;
4324         if (wpa_driver_nl80211_set_mode(drv->first_bss, nlmode)) {
4325                 nl80211_remove_monitor_interface(drv);
4326                 return -1;
4327         }
4328
4329         if (params->freq.freq &&
4330             nl80211_set_channel(drv->first_bss, &params->freq, 0)) {
4331                 if (old_mode != nlmode)
4332                         wpa_driver_nl80211_set_mode(drv->first_bss, old_mode);
4333                 nl80211_remove_monitor_interface(drv);
4334                 return -1;
4335         }
4336
4337         return 0;
4338 }
4339
4340
4341 static int nl80211_leave_ibss(struct wpa_driver_nl80211_data *drv,
4342                               int reset_mode)
4343 {
4344         struct nl_msg *msg;
4345         int ret;
4346
4347         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_LEAVE_IBSS);
4348         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4349         if (ret) {
4350                 wpa_printf(MSG_DEBUG, "nl80211: Leave IBSS failed: ret=%d "
4351                            "(%s)", ret, strerror(-ret));
4352         } else {
4353                 wpa_printf(MSG_DEBUG,
4354                            "nl80211: Leave IBSS request sent successfully");
4355         }
4356
4357         if (reset_mode &&
4358             wpa_driver_nl80211_set_mode(drv->first_bss,
4359                                         NL80211_IFTYPE_STATION)) {
4360                 wpa_printf(MSG_INFO, "nl80211: Failed to set interface into "
4361                            "station mode");
4362         }
4363
4364         return ret;
4365 }
4366
4367
4368 static int nl80211_ht_vht_overrides(struct nl_msg *msg,
4369                                     struct wpa_driver_associate_params *params)
4370 {
4371         if (params->disable_ht && nla_put_flag(msg, NL80211_ATTR_DISABLE_HT))
4372                 return -1;
4373
4374         if (params->htcaps && params->htcaps_mask) {
4375                 int sz = sizeof(struct ieee80211_ht_capabilities);
4376                 wpa_hexdump(MSG_DEBUG, "  * htcaps", params->htcaps, sz);
4377                 wpa_hexdump(MSG_DEBUG, "  * htcaps_mask",
4378                             params->htcaps_mask, sz);
4379                 if (nla_put(msg, NL80211_ATTR_HT_CAPABILITY, sz,
4380                             params->htcaps) ||
4381                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK, sz,
4382                             params->htcaps_mask))
4383                         return -1;
4384         }
4385
4386 #ifdef CONFIG_VHT_OVERRIDES
4387         if (params->disable_vht) {
4388                 wpa_printf(MSG_DEBUG, "  * VHT disabled");
4389                 if (nla_put_flag(msg, NL80211_ATTR_DISABLE_VHT))
4390                         return -1;
4391         }
4392
4393         if (params->vhtcaps && params->vhtcaps_mask) {
4394                 int sz = sizeof(struct ieee80211_vht_capabilities);
4395                 wpa_hexdump(MSG_DEBUG, "  * vhtcaps", params->vhtcaps, sz);
4396                 wpa_hexdump(MSG_DEBUG, "  * vhtcaps_mask",
4397                             params->vhtcaps_mask, sz);
4398                 if (nla_put(msg, NL80211_ATTR_VHT_CAPABILITY, sz,
4399                             params->vhtcaps) ||
4400                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK, sz,
4401                             params->vhtcaps_mask))
4402                         return -1;
4403         }
4404 #endif /* CONFIG_VHT_OVERRIDES */
4405
4406         return 0;
4407 }
4408
4409
4410 static int wpa_driver_nl80211_ibss(struct wpa_driver_nl80211_data *drv,
4411                                    struct wpa_driver_associate_params *params)
4412 {
4413         struct nl_msg *msg;
4414         int ret = -1;
4415         int count = 0;
4416
4417         wpa_printf(MSG_DEBUG, "nl80211: Join IBSS (ifindex=%d)", drv->ifindex);
4418
4419         if (wpa_driver_nl80211_set_mode_ibss(drv->first_bss, &params->freq)) {
4420                 wpa_printf(MSG_INFO, "nl80211: Failed to set interface into "
4421                            "IBSS mode");
4422                 return -1;
4423         }
4424
4425 retry:
4426         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_JOIN_IBSS)) ||
4427             params->ssid == NULL || params->ssid_len > sizeof(drv->ssid))
4428                 goto fail;
4429
4430         wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
4431                           params->ssid, params->ssid_len);
4432         if (nla_put(msg, NL80211_ATTR_SSID, params->ssid_len, params->ssid))
4433                 goto fail;
4434         os_memcpy(drv->ssid, params->ssid, params->ssid_len);
4435         drv->ssid_len = params->ssid_len;
4436
4437         if (nl80211_put_freq_params(msg, &params->freq) < 0 ||
4438             nl80211_put_beacon_int(msg, params->beacon_int))
4439                 goto fail;
4440
4441         ret = nl80211_set_conn_keys(params, msg);
4442         if (ret)
4443                 goto fail;
4444
4445         if (params->bssid && params->fixed_bssid) {
4446                 wpa_printf(MSG_DEBUG, "  * BSSID=" MACSTR,
4447                            MAC2STR(params->bssid));
4448                 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid))
4449                         goto fail;
4450         }
4451
4452         if (params->fixed_freq) {
4453                 wpa_printf(MSG_DEBUG, "  * fixed_freq");
4454                 if (nla_put_flag(msg, NL80211_ATTR_FREQ_FIXED))
4455                         goto fail;
4456         }
4457
4458         if (params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
4459             params->key_mgmt_suite == WPA_KEY_MGMT_PSK ||
4460             params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
4461             params->key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256) {
4462                 wpa_printf(MSG_DEBUG, "  * control port");
4463                 if (nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT))
4464                         goto fail;
4465         }
4466
4467         if (params->wpa_ie) {
4468                 wpa_hexdump(MSG_DEBUG,
4469                             "  * Extra IEs for Beacon/Probe Response frames",
4470                             params->wpa_ie, params->wpa_ie_len);
4471                 if (nla_put(msg, NL80211_ATTR_IE, params->wpa_ie_len,
4472                             params->wpa_ie))
4473                         goto fail;
4474         }
4475
4476         if (nl80211_ht_vht_overrides(msg, params) < 0)
4477                 return -1;
4478
4479         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4480         msg = NULL;
4481         if (ret) {
4482                 wpa_printf(MSG_DEBUG, "nl80211: Join IBSS failed: ret=%d (%s)",
4483                            ret, strerror(-ret));
4484                 count++;
4485                 if (ret == -EALREADY && count == 1) {
4486                         wpa_printf(MSG_DEBUG, "nl80211: Retry IBSS join after "
4487                                    "forced leave");
4488                         nl80211_leave_ibss(drv, 0);
4489                         nlmsg_free(msg);
4490                         goto retry;
4491                 }
4492         } else {
4493                 wpa_printf(MSG_DEBUG,
4494                            "nl80211: Join IBSS request sent successfully");
4495         }
4496
4497 fail:
4498         nlmsg_free(msg);
4499         return ret;
4500 }
4501
4502
4503 static int nl80211_connect_common(struct wpa_driver_nl80211_data *drv,
4504                                   struct wpa_driver_associate_params *params,
4505                                   struct nl_msg *msg)
4506 {
4507         if (params->bssid) {
4508                 wpa_printf(MSG_DEBUG, "  * bssid=" MACSTR,
4509                            MAC2STR(params->bssid));
4510                 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid))
4511                         return -1;
4512         }
4513
4514         if (params->bssid_hint) {
4515                 wpa_printf(MSG_DEBUG, "  * bssid_hint=" MACSTR,
4516                            MAC2STR(params->bssid_hint));
4517                 if (nla_put(msg, NL80211_ATTR_MAC_HINT, ETH_ALEN,
4518                             params->bssid_hint))
4519                         return -1;
4520         }
4521
4522         if (params->freq.freq) {
4523                 wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq.freq);
4524                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
4525                                 params->freq.freq))
4526                         return -1;
4527                 drv->assoc_freq = params->freq.freq;
4528         } else
4529                 drv->assoc_freq = 0;
4530
4531         if (params->freq_hint) {
4532                 wpa_printf(MSG_DEBUG, "  * freq_hint=%d", params->freq_hint);
4533                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_HINT,
4534                                 params->freq_hint))
4535                         return -1;
4536         }
4537
4538         if (params->bg_scan_period >= 0) {
4539                 wpa_printf(MSG_DEBUG, "  * bg scan period=%d",
4540                            params->bg_scan_period);
4541                 if (nla_put_u16(msg, NL80211_ATTR_BG_SCAN_PERIOD,
4542                                 params->bg_scan_period))
4543                         return -1;
4544         }
4545
4546         if (params->ssid) {
4547                 wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
4548                                   params->ssid, params->ssid_len);
4549                 if (nla_put(msg, NL80211_ATTR_SSID, params->ssid_len,
4550                             params->ssid))
4551                         return -1;
4552                 if (params->ssid_len > sizeof(drv->ssid))
4553                         return -1;
4554                 os_memcpy(drv->ssid, params->ssid, params->ssid_len);
4555                 drv->ssid_len = params->ssid_len;
4556         }
4557
4558         wpa_hexdump(MSG_DEBUG, "  * IEs", params->wpa_ie, params->wpa_ie_len);
4559         if (params->wpa_ie &&
4560             nla_put(msg, NL80211_ATTR_IE, params->wpa_ie_len, params->wpa_ie))
4561                 return -1;
4562
4563         if (params->wpa_proto) {
4564                 enum nl80211_wpa_versions ver = 0;
4565
4566                 if (params->wpa_proto & WPA_PROTO_WPA)
4567                         ver |= NL80211_WPA_VERSION_1;
4568                 if (params->wpa_proto & WPA_PROTO_RSN)
4569                         ver |= NL80211_WPA_VERSION_2;
4570
4571                 wpa_printf(MSG_DEBUG, "  * WPA Versions 0x%x", ver);
4572                 if (nla_put_u32(msg, NL80211_ATTR_WPA_VERSIONS, ver))
4573                         return -1;
4574         }
4575
4576         if (params->pairwise_suite != WPA_CIPHER_NONE) {
4577                 u32 cipher = wpa_cipher_to_cipher_suite(params->pairwise_suite);
4578                 wpa_printf(MSG_DEBUG, "  * pairwise=0x%x", cipher);
4579                 if (nla_put_u32(msg, NL80211_ATTR_CIPHER_SUITES_PAIRWISE,
4580                                 cipher))
4581                         return -1;
4582         }
4583
4584         if (params->group_suite == WPA_CIPHER_GTK_NOT_USED &&
4585             !(drv->capa.enc & WPA_DRIVER_CAPA_ENC_GTK_NOT_USED)) {
4586                 /*
4587                  * This is likely to work even though many drivers do not
4588                  * advertise support for operations without GTK.
4589                  */
4590                 wpa_printf(MSG_DEBUG, "  * skip group cipher configuration for GTK_NOT_USED due to missing driver support advertisement");
4591         } else if (params->group_suite != WPA_CIPHER_NONE) {
4592                 u32 cipher = wpa_cipher_to_cipher_suite(params->group_suite);
4593                 wpa_printf(MSG_DEBUG, "  * group=0x%x", cipher);
4594                 if (nla_put_u32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP, cipher))
4595                         return -1;
4596         }
4597
4598         if (params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
4599             params->key_mgmt_suite == WPA_KEY_MGMT_PSK ||
4600             params->key_mgmt_suite == WPA_KEY_MGMT_FT_IEEE8021X ||
4601             params->key_mgmt_suite == WPA_KEY_MGMT_FT_PSK ||
4602             params->key_mgmt_suite == WPA_KEY_MGMT_CCKM ||
4603             params->key_mgmt_suite == WPA_KEY_MGMT_OSEN ||
4604             params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
4605             params->key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256 ||
4606             params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B ||
4607             params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) {
4608                 int mgmt = WLAN_AKM_SUITE_PSK;
4609
4610                 switch (params->key_mgmt_suite) {
4611                 case WPA_KEY_MGMT_CCKM:
4612                         mgmt = WLAN_AKM_SUITE_CCKM;
4613                         break;
4614                 case WPA_KEY_MGMT_IEEE8021X:
4615                         mgmt = WLAN_AKM_SUITE_8021X;
4616                         break;
4617                 case WPA_KEY_MGMT_FT_IEEE8021X:
4618                         mgmt = WLAN_AKM_SUITE_FT_8021X;
4619                         break;
4620                 case WPA_KEY_MGMT_FT_PSK:
4621                         mgmt = WLAN_AKM_SUITE_FT_PSK;
4622                         break;
4623                 case WPA_KEY_MGMT_IEEE8021X_SHA256:
4624                         mgmt = WLAN_AKM_SUITE_8021X_SHA256;
4625                         break;
4626                 case WPA_KEY_MGMT_PSK_SHA256:
4627                         mgmt = WLAN_AKM_SUITE_PSK_SHA256;
4628                         break;
4629                 case WPA_KEY_MGMT_OSEN:
4630                         mgmt = WLAN_AKM_SUITE_OSEN;
4631                         break;
4632                 case WPA_KEY_MGMT_IEEE8021X_SUITE_B:
4633                         mgmt = WLAN_AKM_SUITE_8021X_SUITE_B;
4634                         break;
4635                 case WPA_KEY_MGMT_IEEE8021X_SUITE_B_192:
4636                         mgmt = WLAN_AKM_SUITE_8021X_SUITE_B_192;
4637                         break;
4638                 case WPA_KEY_MGMT_PSK:
4639                 default:
4640                         mgmt = WLAN_AKM_SUITE_PSK;
4641                         break;
4642                 }
4643                 wpa_printf(MSG_DEBUG, "  * akm=0x%x", mgmt);
4644                 if (nla_put_u32(msg, NL80211_ATTR_AKM_SUITES, mgmt))
4645                         return -1;
4646         }
4647
4648         if (nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT))
4649                 return -1;
4650
4651         if (params->mgmt_frame_protection == MGMT_FRAME_PROTECTION_REQUIRED &&
4652             nla_put_u32(msg, NL80211_ATTR_USE_MFP, NL80211_MFP_REQUIRED))
4653                 return -1;
4654
4655         if (params->rrm_used) {
4656                 u32 drv_rrm_flags = drv->capa.rrm_flags;
4657                 if (!(drv_rrm_flags &
4658                       WPA_DRIVER_FLAGS_DS_PARAM_SET_IE_IN_PROBES) ||
4659                     !(drv_rrm_flags & WPA_DRIVER_FLAGS_QUIET) ||
4660                     nla_put_flag(msg, NL80211_ATTR_USE_RRM))
4661                         return -1;
4662         }
4663
4664         if (nl80211_ht_vht_overrides(msg, params) < 0)
4665                 return -1;
4666
4667         if (params->p2p)
4668                 wpa_printf(MSG_DEBUG, "  * P2P group");
4669
4670         return 0;
4671 }
4672
4673
4674 static int wpa_driver_nl80211_try_connect(
4675         struct wpa_driver_nl80211_data *drv,
4676         struct wpa_driver_associate_params *params)
4677 {
4678         struct nl_msg *msg;
4679         enum nl80211_auth_type type;
4680         int ret;
4681         int algs;
4682
4683         if (params->req_key_mgmt_offload && params->psk &&
4684             (params->key_mgmt_suite == WPA_KEY_MGMT_PSK ||
4685              params->key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256 ||
4686              params->key_mgmt_suite == WPA_KEY_MGMT_FT_PSK)) {
4687                 wpa_printf(MSG_DEBUG, "nl80211: Key management set PSK");
4688                 ret = issue_key_mgmt_set_key(drv, params->psk, 32);
4689                 if (ret)
4690                         return ret;
4691         }
4692
4693         wpa_printf(MSG_DEBUG, "nl80211: Connect (ifindex=%d)", drv->ifindex);
4694         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_CONNECT);
4695         if (!msg)
4696                 return -1;
4697
4698         ret = nl80211_connect_common(drv, params, msg);
4699         if (ret)
4700                 goto fail;
4701
4702         algs = 0;
4703         if (params->auth_alg & WPA_AUTH_ALG_OPEN)
4704                 algs++;
4705         if (params->auth_alg & WPA_AUTH_ALG_SHARED)
4706                 algs++;
4707         if (params->auth_alg & WPA_AUTH_ALG_LEAP)
4708                 algs++;
4709         if (algs > 1) {
4710                 wpa_printf(MSG_DEBUG, "  * Leave out Auth Type for automatic "
4711                            "selection");
4712                 goto skip_auth_type;
4713         }
4714
4715         if (params->auth_alg & WPA_AUTH_ALG_OPEN)
4716                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
4717         else if (params->auth_alg & WPA_AUTH_ALG_SHARED)
4718                 type = NL80211_AUTHTYPE_SHARED_KEY;
4719         else if (params->auth_alg & WPA_AUTH_ALG_LEAP)
4720                 type = NL80211_AUTHTYPE_NETWORK_EAP;
4721         else if (params->auth_alg & WPA_AUTH_ALG_FT)
4722                 type = NL80211_AUTHTYPE_FT;
4723         else
4724                 goto fail;
4725
4726         wpa_printf(MSG_DEBUG, "  * Auth Type %d", type);
4727         if (nla_put_u32(msg, NL80211_ATTR_AUTH_TYPE, type))
4728                 goto fail;
4729
4730 skip_auth_type:
4731         ret = nl80211_set_conn_keys(params, msg);
4732         if (ret)
4733                 goto fail;
4734
4735         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4736         msg = NULL;
4737         if (ret) {
4738                 wpa_printf(MSG_DEBUG, "nl80211: MLME connect failed: ret=%d "
4739                            "(%s)", ret, strerror(-ret));
4740         } else {
4741                 wpa_printf(MSG_DEBUG,
4742                            "nl80211: Connect request send successfully");
4743         }
4744
4745 fail:
4746         nlmsg_free(msg);
4747         return ret;
4748
4749 }
4750
4751
4752 static int wpa_driver_nl80211_connect(
4753         struct wpa_driver_nl80211_data *drv,
4754         struct wpa_driver_associate_params *params)
4755 {
4756         int ret;
4757
4758         /* Store the connection attempted bssid for future use */
4759         if (params->bssid)
4760                 os_memcpy(drv->auth_attempt_bssid, params->bssid, ETH_ALEN);
4761         else
4762                 os_memset(drv->auth_attempt_bssid, 0, ETH_ALEN);
4763
4764         ret = wpa_driver_nl80211_try_connect(drv, params);
4765         if (ret == -EALREADY) {
4766                 /*
4767                  * cfg80211 does not currently accept new connections if
4768                  * we are already connected. As a workaround, force
4769                  * disconnection and try again.
4770                  */
4771                 wpa_printf(MSG_DEBUG, "nl80211: Explicitly "
4772                            "disconnecting before reassociation "
4773                            "attempt");
4774                 if (wpa_driver_nl80211_disconnect(
4775                             drv, WLAN_REASON_PREV_AUTH_NOT_VALID))
4776                         return -1;
4777                 ret = wpa_driver_nl80211_try_connect(drv, params);
4778         }
4779         return ret;
4780 }
4781
4782
4783 static int wpa_driver_nl80211_associate(
4784         void *priv, struct wpa_driver_associate_params *params)
4785 {
4786         struct i802_bss *bss = priv;
4787         struct wpa_driver_nl80211_data *drv = bss->drv;
4788         int ret = -1;
4789         struct nl_msg *msg;
4790
4791         nl80211_unmask_11b_rates(bss);
4792
4793         if (params->mode == IEEE80211_MODE_AP)
4794                 return wpa_driver_nl80211_ap(drv, params);
4795
4796         if (params->mode == IEEE80211_MODE_IBSS)
4797                 return wpa_driver_nl80211_ibss(drv, params);
4798
4799         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME)) {
4800                 enum nl80211_iftype nlmode = params->p2p ?
4801                         NL80211_IFTYPE_P2P_CLIENT : NL80211_IFTYPE_STATION;
4802
4803                 if (wpa_driver_nl80211_set_mode(priv, nlmode) < 0)
4804                         return -1;
4805                 return wpa_driver_nl80211_connect(drv, params);
4806         }
4807
4808         nl80211_mark_disconnected(drv);
4809
4810         wpa_printf(MSG_DEBUG, "nl80211: Associate (ifindex=%d)",
4811                    drv->ifindex);
4812         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_ASSOCIATE);
4813         if (!msg)
4814                 return -1;
4815
4816         ret = nl80211_connect_common(drv, params, msg);
4817         if (ret)
4818                 goto fail;
4819
4820         if (params->prev_bssid) {
4821                 wpa_printf(MSG_DEBUG, "  * prev_bssid=" MACSTR,
4822                            MAC2STR(params->prev_bssid));
4823                 if (nla_put(msg, NL80211_ATTR_PREV_BSSID, ETH_ALEN,
4824                             params->prev_bssid))
4825                         goto fail;
4826         }
4827
4828         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4829         msg = NULL;
4830         if (ret) {
4831                 wpa_dbg(drv->ctx, MSG_DEBUG,
4832                         "nl80211: MLME command failed (assoc): ret=%d (%s)",
4833                         ret, strerror(-ret));
4834                 nl80211_dump_scan(drv);
4835         } else {
4836                 wpa_printf(MSG_DEBUG,
4837                            "nl80211: Association request send successfully");
4838         }
4839
4840 fail:
4841         nlmsg_free(msg);
4842         return ret;
4843 }
4844
4845
4846 static int nl80211_set_mode(struct wpa_driver_nl80211_data *drv,
4847                             int ifindex, enum nl80211_iftype mode)
4848 {
4849         struct nl_msg *msg;
4850         int ret = -ENOBUFS;
4851
4852         wpa_printf(MSG_DEBUG, "nl80211: Set mode ifindex %d iftype %d (%s)",
4853                    ifindex, mode, nl80211_iftype_str(mode));
4854
4855         msg = nl80211_cmd_msg(drv->first_bss, 0, NL80211_CMD_SET_INTERFACE);
4856         if (!msg || nla_put_u32(msg, NL80211_ATTR_IFTYPE, mode))
4857                 goto fail;
4858
4859         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4860         msg = NULL;
4861         if (!ret)
4862                 return 0;
4863 fail:
4864         nlmsg_free(msg);
4865         wpa_printf(MSG_DEBUG, "nl80211: Failed to set interface %d to mode %d:"
4866                    " %d (%s)", ifindex, mode, ret, strerror(-ret));
4867         return ret;
4868 }
4869
4870
4871 static int wpa_driver_nl80211_set_mode_impl(
4872                 struct i802_bss *bss,
4873                 enum nl80211_iftype nlmode,
4874                 struct hostapd_freq_params *desired_freq_params)
4875 {
4876         struct wpa_driver_nl80211_data *drv = bss->drv;
4877         int ret = -1;
4878         int i;
4879         int was_ap = is_ap_interface(drv->nlmode);
4880         int res;
4881         int mode_switch_res;
4882
4883         mode_switch_res = nl80211_set_mode(drv, drv->ifindex, nlmode);
4884         if (mode_switch_res && nlmode == nl80211_get_ifmode(bss))
4885                 mode_switch_res = 0;
4886
4887         if (mode_switch_res == 0) {
4888                 drv->nlmode = nlmode;
4889                 ret = 0;
4890                 goto done;
4891         }
4892
4893         if (mode_switch_res == -ENODEV)
4894                 return -1;
4895
4896         if (nlmode == drv->nlmode) {
4897                 wpa_printf(MSG_DEBUG, "nl80211: Interface already in "
4898                            "requested mode - ignore error");
4899                 ret = 0;
4900                 goto done; /* Already in the requested mode */
4901         }
4902
4903         /* mac80211 doesn't allow mode changes while the device is up, so
4904          * take the device down, try to set the mode again, and bring the
4905          * device back up.
4906          */
4907         wpa_printf(MSG_DEBUG, "nl80211: Try mode change after setting "
4908                    "interface down");
4909         for (i = 0; i < 10; i++) {
4910                 res = i802_set_iface_flags(bss, 0);
4911                 if (res == -EACCES || res == -ENODEV)
4912                         break;
4913                 if (res != 0) {
4914                         wpa_printf(MSG_DEBUG, "nl80211: Failed to set "
4915                                    "interface down");
4916                         os_sleep(0, 100000);
4917                         continue;
4918                 }
4919
4920                 /*
4921                  * Setting the mode will fail for some drivers if the phy is
4922                  * on a frequency that the mode is disallowed in.
4923                  */
4924                 if (desired_freq_params) {
4925                         res = nl80211_set_channel(bss, desired_freq_params, 0);
4926                         if (res) {
4927                                 wpa_printf(MSG_DEBUG,
4928                                            "nl80211: Failed to set frequency on interface");
4929                         }
4930                 }
4931
4932                 /* Try to set the mode again while the interface is down */
4933                 mode_switch_res = nl80211_set_mode(drv, drv->ifindex, nlmode);
4934                 if (mode_switch_res == -EBUSY) {
4935                         wpa_printf(MSG_DEBUG,
4936                                    "nl80211: Delaying mode set while interface going down");
4937                         os_sleep(0, 100000);
4938                         continue;
4939                 }
4940                 ret = mode_switch_res;
4941                 break;
4942         }
4943
4944         if (!ret) {
4945                 wpa_printf(MSG_DEBUG, "nl80211: Mode change succeeded while "
4946                            "interface is down");
4947                 drv->nlmode = nlmode;
4948                 drv->ignore_if_down_event = 1;
4949         }
4950
4951         /* Bring the interface back up */
4952         res = linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 1);
4953         if (res != 0) {
4954                 wpa_printf(MSG_DEBUG,
4955                            "nl80211: Failed to set interface up after switching mode");
4956                 ret = -1;
4957         }
4958
4959 done:
4960         if (ret) {
4961                 wpa_printf(MSG_DEBUG, "nl80211: Interface mode change to %d "
4962                            "from %d failed", nlmode, drv->nlmode);
4963                 return ret;
4964         }
4965
4966         if (is_p2p_net_interface(nlmode)) {
4967                 wpa_printf(MSG_DEBUG,
4968                            "nl80211: Interface %s mode change to P2P - disable 11b rates",
4969                            bss->ifname);
4970                 nl80211_disable_11b_rates(drv, drv->ifindex, 1);
4971         } else if (drv->disabled_11b_rates) {
4972                 wpa_printf(MSG_DEBUG,
4973                            "nl80211: Interface %s mode changed to non-P2P - re-enable 11b rates",
4974                            bss->ifname);
4975                 nl80211_disable_11b_rates(drv, drv->ifindex, 0);
4976         }
4977
4978         if (is_ap_interface(nlmode)) {
4979                 nl80211_mgmt_unsubscribe(bss, "start AP");
4980                 /* Setup additional AP mode functionality if needed */
4981                 if (nl80211_setup_ap(bss))
4982                         return -1;
4983         } else if (was_ap) {
4984                 /* Remove additional AP mode functionality */
4985                 nl80211_teardown_ap(bss);
4986         } else {
4987                 nl80211_mgmt_unsubscribe(bss, "mode change");
4988         }
4989
4990         if (is_mesh_interface(nlmode) &&
4991             nl80211_mgmt_subscribe_mesh(bss))
4992                 return -1;
4993
4994         if (!bss->in_deinit && !is_ap_interface(nlmode) &&
4995             !is_mesh_interface(nlmode) &&
4996             nl80211_mgmt_subscribe_non_ap(bss) < 0)
4997                 wpa_printf(MSG_DEBUG, "nl80211: Failed to register Action "
4998                            "frame processing - ignore for now");
4999
5000         return 0;
5001 }
5002
5003
5004 int wpa_driver_nl80211_set_mode(struct i802_bss *bss,
5005                                 enum nl80211_iftype nlmode)
5006 {
5007         return wpa_driver_nl80211_set_mode_impl(bss, nlmode, NULL);
5008 }
5009
5010
5011 static int wpa_driver_nl80211_set_mode_ibss(struct i802_bss *bss,
5012                                             struct hostapd_freq_params *freq)
5013 {
5014         return wpa_driver_nl80211_set_mode_impl(bss, NL80211_IFTYPE_ADHOC,
5015                                                 freq);
5016 }
5017
5018
5019 static int wpa_driver_nl80211_get_capa(void *priv,
5020                                        struct wpa_driver_capa *capa)
5021 {
5022         struct i802_bss *bss = priv;
5023         struct wpa_driver_nl80211_data *drv = bss->drv;
5024
5025         if (!drv->has_capability)
5026                 return -1;
5027         os_memcpy(capa, &drv->capa, sizeof(*capa));
5028         if (drv->extended_capa && drv->extended_capa_mask) {
5029                 capa->extended_capa = drv->extended_capa;
5030                 capa->extended_capa_mask = drv->extended_capa_mask;
5031                 capa->extended_capa_len = drv->extended_capa_len;
5032         }
5033
5034         return 0;
5035 }
5036
5037
5038 static int wpa_driver_nl80211_set_operstate(void *priv, int state)
5039 {
5040         struct i802_bss *bss = priv;
5041         struct wpa_driver_nl80211_data *drv = bss->drv;
5042
5043         wpa_printf(MSG_DEBUG, "nl80211: Set %s operstate %d->%d (%s)",
5044                    bss->ifname, drv->operstate, state,
5045                    state ? "UP" : "DORMANT");
5046         drv->operstate = state;
5047         return netlink_send_oper_ifla(drv->global->netlink, drv->ifindex, -1,
5048                                       state ? IF_OPER_UP : IF_OPER_DORMANT);
5049 }
5050
5051
5052 static int wpa_driver_nl80211_set_supp_port(void *priv, int authorized)
5053 {
5054         struct i802_bss *bss = priv;
5055         struct wpa_driver_nl80211_data *drv = bss->drv;
5056         struct nl_msg *msg;
5057         struct nl80211_sta_flag_update upd;
5058         int ret;
5059
5060         if (!drv->associated && is_zero_ether_addr(drv->bssid) && !authorized) {
5061                 wpa_printf(MSG_DEBUG, "nl80211: Skip set_supp_port(unauthorized) while not associated");
5062                 return 0;
5063         }
5064
5065         wpa_printf(MSG_DEBUG, "nl80211: Set supplicant port %sauthorized for "
5066                    MACSTR, authorized ? "" : "un", MAC2STR(drv->bssid));
5067
5068         os_memset(&upd, 0, sizeof(upd));
5069         upd.mask = BIT(NL80211_STA_FLAG_AUTHORIZED);
5070         if (authorized)
5071                 upd.set = BIT(NL80211_STA_FLAG_AUTHORIZED);
5072
5073         if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_SET_STATION)) ||
5074             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, drv->bssid) ||
5075             nla_put(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd)) {
5076                 nlmsg_free(msg);
5077                 return -ENOBUFS;
5078         }
5079
5080         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5081         if (!ret)
5082                 return 0;
5083         wpa_printf(MSG_DEBUG, "nl80211: Failed to set STA flag: %d (%s)",
5084                    ret, strerror(-ret));
5085         return ret;
5086 }
5087
5088
5089 /* Set kernel driver on given frequency (MHz) */
5090 static int i802_set_freq(void *priv, struct hostapd_freq_params *freq)
5091 {
5092         struct i802_bss *bss = priv;
5093         return nl80211_set_channel(bss, freq, 0);
5094 }
5095
5096
5097 static inline int min_int(int a, int b)
5098 {
5099         if (a < b)
5100                 return a;
5101         return b;
5102 }
5103
5104
5105 static int get_key_handler(struct nl_msg *msg, void *arg)
5106 {
5107         struct nlattr *tb[NL80211_ATTR_MAX + 1];
5108         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
5109
5110         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
5111                   genlmsg_attrlen(gnlh, 0), NULL);
5112
5113         /*
5114          * TODO: validate the key index and mac address!
5115          * Otherwise, there's a race condition as soon as
5116          * the kernel starts sending key notifications.
5117          */
5118
5119         if (tb[NL80211_ATTR_KEY_SEQ])
5120                 memcpy(arg, nla_data(tb[NL80211_ATTR_KEY_SEQ]),
5121                        min_int(nla_len(tb[NL80211_ATTR_KEY_SEQ]), 6));
5122         return NL_SKIP;
5123 }
5124
5125
5126 static int i802_get_seqnum(const char *iface, void *priv, const u8 *addr,
5127                            int idx, u8 *seq)
5128 {
5129         struct i802_bss *bss = priv;
5130         struct wpa_driver_nl80211_data *drv = bss->drv;
5131         struct nl_msg *msg;
5132
5133         msg = nl80211_ifindex_msg(drv, if_nametoindex(iface), 0,
5134                                   NL80211_CMD_GET_KEY);
5135         if (!msg ||
5136             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
5137             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, idx)) {
5138                 nlmsg_free(msg);
5139                 return -ENOBUFS;
5140         }
5141
5142         memset(seq, 0, 6);
5143
5144         return send_and_recv_msgs(drv, msg, get_key_handler, seq);
5145 }
5146
5147
5148 static int i802_set_rts(void *priv, int rts)
5149 {
5150         struct i802_bss *bss = priv;
5151         struct wpa_driver_nl80211_data *drv = bss->drv;
5152         struct nl_msg *msg;
5153         int ret;
5154         u32 val;
5155
5156         if (rts >= 2347)
5157                 val = (u32) -1;
5158         else
5159                 val = rts;
5160
5161         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_SET_WIPHY)) ||
5162             nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD, val)) {
5163                 nlmsg_free(msg);
5164                 return -ENOBUFS;
5165         }
5166
5167         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5168         if (!ret)
5169                 return 0;
5170         wpa_printf(MSG_DEBUG, "nl80211: Failed to set RTS threshold %d: "
5171                    "%d (%s)", rts, ret, strerror(-ret));
5172         return ret;
5173 }
5174
5175
5176 static int i802_set_frag(void *priv, int frag)
5177 {
5178         struct i802_bss *bss = priv;
5179         struct wpa_driver_nl80211_data *drv = bss->drv;
5180         struct nl_msg *msg;
5181         int ret;
5182         u32 val;
5183
5184         if (frag >= 2346)
5185                 val = (u32) -1;
5186         else
5187                 val = frag;
5188
5189         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_SET_WIPHY)) ||
5190             nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD, val)) {
5191                 nlmsg_free(msg);
5192                 return -ENOBUFS;
5193         }
5194
5195         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5196         if (!ret)
5197                 return 0;
5198         wpa_printf(MSG_DEBUG, "nl80211: Failed to set fragmentation threshold "
5199                    "%d: %d (%s)", frag, ret, strerror(-ret));
5200         return ret;
5201 }
5202
5203
5204 static int i802_flush(void *priv)
5205 {
5206         struct i802_bss *bss = priv;
5207         struct nl_msg *msg;
5208         int res;
5209
5210         wpa_printf(MSG_DEBUG, "nl80211: flush -> DEL_STATION %s (all)",
5211                    bss->ifname);
5212
5213         /*
5214          * XXX: FIX! this needs to flush all VLANs too
5215          */
5216         msg = nl80211_bss_msg(bss, 0, NL80211_CMD_DEL_STATION);
5217         res = send_and_recv_msgs(bss->drv, msg, NULL, NULL);
5218         if (res) {
5219                 wpa_printf(MSG_DEBUG, "nl80211: Station flush failed: ret=%d "
5220                            "(%s)", res, strerror(-res));
5221         }
5222         return res;
5223 }
5224
5225
5226 static int get_sta_handler(struct nl_msg *msg, void *arg)
5227 {
5228         struct nlattr *tb[NL80211_ATTR_MAX + 1];
5229         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
5230         struct hostap_sta_driver_data *data = arg;
5231         struct nlattr *stats[NL80211_STA_INFO_MAX + 1];
5232         static struct nla_policy stats_policy[NL80211_STA_INFO_MAX + 1] = {
5233                 [NL80211_STA_INFO_INACTIVE_TIME] = { .type = NLA_U32 },
5234                 [NL80211_STA_INFO_RX_BYTES] = { .type = NLA_U32 },
5235                 [NL80211_STA_INFO_TX_BYTES] = { .type = NLA_U32 },
5236                 [NL80211_STA_INFO_RX_PACKETS] = { .type = NLA_U32 },
5237                 [NL80211_STA_INFO_TX_PACKETS] = { .type = NLA_U32 },
5238                 [NL80211_STA_INFO_TX_FAILED] = { .type = NLA_U32 },
5239         };
5240
5241         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
5242                   genlmsg_attrlen(gnlh, 0), NULL);
5243
5244         /*
5245          * TODO: validate the interface and mac address!
5246          * Otherwise, there's a race condition as soon as
5247          * the kernel starts sending station notifications.
5248          */
5249
5250         if (!tb[NL80211_ATTR_STA_INFO]) {
5251                 wpa_printf(MSG_DEBUG, "sta stats missing!");
5252                 return NL_SKIP;
5253         }
5254         if (nla_parse_nested(stats, NL80211_STA_INFO_MAX,
5255                              tb[NL80211_ATTR_STA_INFO],
5256                              stats_policy)) {
5257                 wpa_printf(MSG_DEBUG, "failed to parse nested attributes!");
5258                 return NL_SKIP;
5259         }
5260
5261         if (stats[NL80211_STA_INFO_INACTIVE_TIME])
5262                 data->inactive_msec =
5263                         nla_get_u32(stats[NL80211_STA_INFO_INACTIVE_TIME]);
5264         if (stats[NL80211_STA_INFO_RX_BYTES])
5265                 data->rx_bytes = nla_get_u32(stats[NL80211_STA_INFO_RX_BYTES]);
5266         if (stats[NL80211_STA_INFO_TX_BYTES])
5267                 data->tx_bytes = nla_get_u32(stats[NL80211_STA_INFO_TX_BYTES]);
5268         if (stats[NL80211_STA_INFO_RX_PACKETS])
5269                 data->rx_packets =
5270                         nla_get_u32(stats[NL80211_STA_INFO_RX_PACKETS]);
5271         if (stats[NL80211_STA_INFO_TX_PACKETS])
5272                 data->tx_packets =
5273                         nla_get_u32(stats[NL80211_STA_INFO_TX_PACKETS]);
5274         if (stats[NL80211_STA_INFO_TX_FAILED])
5275                 data->tx_retry_failed =
5276                         nla_get_u32(stats[NL80211_STA_INFO_TX_FAILED]);
5277
5278         return NL_SKIP;
5279 }
5280
5281 static int i802_read_sta_data(struct i802_bss *bss,
5282                               struct hostap_sta_driver_data *data,
5283                               const u8 *addr)
5284 {
5285         struct nl_msg *msg;
5286
5287         os_memset(data, 0, sizeof(*data));
5288
5289         if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_GET_STATION)) ||
5290             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) {
5291                 nlmsg_free(msg);
5292                 return -ENOBUFS;
5293         }
5294
5295         return send_and_recv_msgs(bss->drv, msg, get_sta_handler, data);
5296 }
5297
5298
5299 static int i802_set_tx_queue_params(void *priv, int queue, int aifs,
5300                                     int cw_min, int cw_max, int burst_time)
5301 {
5302         struct i802_bss *bss = priv;
5303         struct wpa_driver_nl80211_data *drv = bss->drv;
5304         struct nl_msg *msg;
5305         struct nlattr *txq, *params;
5306
5307         msg = nl80211_bss_msg(bss, 0, NL80211_CMD_SET_WIPHY);
5308         if (!msg)
5309                 return -1;
5310
5311         txq = nla_nest_start(msg, NL80211_ATTR_WIPHY_TXQ_PARAMS);
5312         if (!txq)
5313                 goto fail;
5314
5315         /* We are only sending parameters for a single TXQ at a time */
5316         params = nla_nest_start(msg, 1);
5317         if (!params)
5318                 goto fail;
5319
5320         switch (queue) {
5321         case 0:
5322                 if (nla_put_u8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_VO))
5323                         goto fail;
5324                 break;
5325         case 1:
5326                 if (nla_put_u8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_VI))
5327                         goto fail;
5328                 break;
5329         case 2:
5330                 if (nla_put_u8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_BE))
5331                         goto fail;
5332                 break;
5333         case 3:
5334                 if (nla_put_u8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_BK))
5335                         goto fail;
5336                 break;
5337         }
5338         /* Burst time is configured in units of 0.1 msec and TXOP parameter in
5339          * 32 usec, so need to convert the value here. */
5340         if (nla_put_u16(msg, NL80211_TXQ_ATTR_TXOP,
5341                         (burst_time * 100 + 16) / 32) ||
5342             nla_put_u16(msg, NL80211_TXQ_ATTR_CWMIN, cw_min) ||
5343             nla_put_u16(msg, NL80211_TXQ_ATTR_CWMAX, cw_max) ||
5344             nla_put_u8(msg, NL80211_TXQ_ATTR_AIFS, aifs))
5345                 goto fail;
5346
5347         nla_nest_end(msg, params);
5348
5349         nla_nest_end(msg, txq);
5350
5351         if (send_and_recv_msgs(drv, msg, NULL, NULL) == 0)
5352                 return 0;
5353         msg = NULL;
5354 fail:
5355         nlmsg_free(msg);
5356         return -1;
5357 }
5358
5359
5360 static int i802_set_sta_vlan(struct i802_bss *bss, const u8 *addr,
5361                              const char *ifname, int vlan_id)
5362 {
5363         struct wpa_driver_nl80211_data *drv = bss->drv;
5364         struct nl_msg *msg;
5365         int ret;
5366
5367         wpa_printf(MSG_DEBUG, "nl80211: %s[%d]: set_sta_vlan(" MACSTR
5368                    ", ifname=%s[%d], vlan_id=%d)",
5369                    bss->ifname, if_nametoindex(bss->ifname),
5370                    MAC2STR(addr), ifname, if_nametoindex(ifname), vlan_id);
5371         if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_SET_STATION)) ||
5372             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
5373             nla_put_u32(msg, NL80211_ATTR_STA_VLAN, if_nametoindex(ifname))) {
5374                 nlmsg_free(msg);
5375                 return -ENOBUFS;
5376         }
5377
5378         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5379         if (ret < 0) {
5380                 wpa_printf(MSG_ERROR, "nl80211: NL80211_ATTR_STA_VLAN (addr="
5381                            MACSTR " ifname=%s vlan_id=%d) failed: %d (%s)",
5382                            MAC2STR(addr), ifname, vlan_id, ret,
5383                            strerror(-ret));
5384         }
5385         return ret;
5386 }
5387
5388
5389 static int i802_get_inact_sec(void *priv, const u8 *addr)
5390 {
5391         struct hostap_sta_driver_data data;
5392         int ret;
5393
5394         data.inactive_msec = (unsigned long) -1;
5395         ret = i802_read_sta_data(priv, &data, addr);
5396         if (ret == -ENOENT)
5397                 return -ENOENT;
5398         if (ret || data.inactive_msec == (unsigned long) -1)
5399                 return -1;
5400         return data.inactive_msec / 1000;
5401 }
5402
5403
5404 static int i802_sta_clear_stats(void *priv, const u8 *addr)
5405 {
5406 #if 0
5407         /* TODO */
5408 #endif
5409         return 0;
5410 }
5411
5412
5413 static int i802_sta_deauth(void *priv, const u8 *own_addr, const u8 *addr,
5414                            int reason)
5415 {
5416         struct i802_bss *bss = priv;
5417         struct wpa_driver_nl80211_data *drv = bss->drv;
5418         struct ieee80211_mgmt mgmt;
5419
5420         if (is_mesh_interface(drv->nlmode))
5421                 return -1;
5422
5423         if (drv->device_ap_sme)
5424                 return wpa_driver_nl80211_sta_remove(bss, addr, 1, reason);
5425
5426         memset(&mgmt, 0, sizeof(mgmt));
5427         mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
5428                                           WLAN_FC_STYPE_DEAUTH);
5429         memcpy(mgmt.da, addr, ETH_ALEN);
5430         memcpy(mgmt.sa, own_addr, ETH_ALEN);
5431         memcpy(mgmt.bssid, own_addr, ETH_ALEN);
5432         mgmt.u.deauth.reason_code = host_to_le16(reason);
5433         return wpa_driver_nl80211_send_mlme(bss, (u8 *) &mgmt,
5434                                             IEEE80211_HDRLEN +
5435                                             sizeof(mgmt.u.deauth), 0, 0, 0, 0,
5436                                             0);
5437 }
5438
5439
5440 static int i802_sta_disassoc(void *priv, const u8 *own_addr, const u8 *addr,
5441                              int reason)
5442 {
5443         struct i802_bss *bss = priv;
5444         struct wpa_driver_nl80211_data *drv = bss->drv;
5445         struct ieee80211_mgmt mgmt;
5446
5447         if (is_mesh_interface(drv->nlmode))
5448                 return -1;
5449
5450         if (drv->device_ap_sme)
5451                 return wpa_driver_nl80211_sta_remove(bss, addr, 0, reason);
5452
5453         memset(&mgmt, 0, sizeof(mgmt));
5454         mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
5455                                           WLAN_FC_STYPE_DISASSOC);
5456         memcpy(mgmt.da, addr, ETH_ALEN);
5457         memcpy(mgmt.sa, own_addr, ETH_ALEN);
5458         memcpy(mgmt.bssid, own_addr, ETH_ALEN);
5459         mgmt.u.disassoc.reason_code = host_to_le16(reason);
5460         return wpa_driver_nl80211_send_mlme(bss, (u8 *) &mgmt,
5461                                             IEEE80211_HDRLEN +
5462                                             sizeof(mgmt.u.disassoc), 0, 0, 0, 0,
5463                                             0);
5464 }
5465
5466
5467 static void dump_ifidx(struct wpa_driver_nl80211_data *drv)
5468 {
5469         char buf[200], *pos, *end;
5470         int i, res;
5471
5472         pos = buf;
5473         end = pos + sizeof(buf);
5474
5475         for (i = 0; i < drv->num_if_indices; i++) {
5476                 if (!drv->if_indices[i])
5477                         continue;
5478                 res = os_snprintf(pos, end - pos, " %d", drv->if_indices[i]);
5479                 if (os_snprintf_error(end - pos, res))
5480                         break;
5481                 pos += res;
5482         }
5483         *pos = '\0';
5484
5485         wpa_printf(MSG_DEBUG, "nl80211: if_indices[%d]:%s",
5486                    drv->num_if_indices, buf);
5487 }
5488
5489
5490 static void add_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
5491 {
5492         int i;
5493         int *old;
5494
5495         wpa_printf(MSG_DEBUG, "nl80211: Add own interface ifindex %d",
5496                    ifidx);
5497         if (have_ifidx(drv, ifidx)) {
5498                 wpa_printf(MSG_DEBUG, "nl80211: ifindex %d already in the list",
5499                            ifidx);
5500                 return;
5501         }
5502         for (i = 0; i < drv->num_if_indices; i++) {
5503                 if (drv->if_indices[i] == 0) {
5504                         drv->if_indices[i] = ifidx;
5505                         dump_ifidx(drv);
5506                         return;
5507                 }
5508         }
5509
5510         if (drv->if_indices != drv->default_if_indices)
5511                 old = drv->if_indices;
5512         else
5513                 old = NULL;
5514
5515         drv->if_indices = os_realloc_array(old, drv->num_if_indices + 1,
5516                                            sizeof(int));
5517         if (!drv->if_indices) {
5518                 if (!old)
5519                         drv->if_indices = drv->default_if_indices;
5520                 else
5521                         drv->if_indices = old;
5522                 wpa_printf(MSG_ERROR, "Failed to reallocate memory for "
5523                            "interfaces");
5524                 wpa_printf(MSG_ERROR, "Ignoring EAPOL on interface %d", ifidx);
5525                 return;
5526         } else if (!old)
5527                 os_memcpy(drv->if_indices, drv->default_if_indices,
5528                           sizeof(drv->default_if_indices));
5529         drv->if_indices[drv->num_if_indices] = ifidx;
5530         drv->num_if_indices++;
5531         dump_ifidx(drv);
5532 }
5533
5534
5535 static void del_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
5536 {
5537         int i;
5538
5539         for (i = 0; i < drv->num_if_indices; i++) {
5540                 if (drv->if_indices[i] == ifidx) {
5541                         drv->if_indices[i] = 0;
5542                         break;
5543                 }
5544         }
5545         dump_ifidx(drv);
5546 }
5547
5548
5549 static int have_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
5550 {
5551         int i;
5552
5553         for (i = 0; i < drv->num_if_indices; i++)
5554                 if (drv->if_indices[i] == ifidx)
5555                         return 1;
5556
5557         return 0;
5558 }
5559
5560
5561 static int i802_set_wds_sta(void *priv, const u8 *addr, int aid, int val,
5562                             const char *bridge_ifname, char *ifname_wds)
5563 {
5564         struct i802_bss *bss = priv;
5565         struct wpa_driver_nl80211_data *drv = bss->drv;
5566         char name[IFNAMSIZ + 1];
5567
5568         os_snprintf(name, sizeof(name), "%s.sta%d", bss->ifname, aid);
5569         if (ifname_wds)
5570                 os_strlcpy(ifname_wds, name, IFNAMSIZ + 1);
5571
5572         wpa_printf(MSG_DEBUG, "nl80211: Set WDS STA addr=" MACSTR
5573                    " aid=%d val=%d name=%s", MAC2STR(addr), aid, val, name);
5574         if (val) {
5575                 if (!if_nametoindex(name)) {
5576                         if (nl80211_create_iface(drv, name,
5577                                                  NL80211_IFTYPE_AP_VLAN,
5578                                                  bss->addr, 1, NULL, NULL, 0) <
5579                             0)
5580                                 return -1;
5581                         if (bridge_ifname &&
5582                             linux_br_add_if(drv->global->ioctl_sock,
5583                                             bridge_ifname, name) < 0)
5584                                 return -1;
5585                 }
5586                 if (linux_set_iface_flags(drv->global->ioctl_sock, name, 1)) {
5587                         wpa_printf(MSG_ERROR, "nl80211: Failed to set WDS STA "
5588                                    "interface %s up", name);
5589                 }
5590                 return i802_set_sta_vlan(priv, addr, name, 0);
5591         } else {
5592                 if (bridge_ifname)
5593                         linux_br_del_if(drv->global->ioctl_sock, bridge_ifname,
5594                                         name);
5595
5596                 i802_set_sta_vlan(priv, addr, bss->ifname, 0);
5597                 nl80211_remove_iface(drv, if_nametoindex(name));
5598                 return 0;
5599         }
5600 }
5601
5602
5603 static void handle_eapol(int sock, void *eloop_ctx, void *sock_ctx)
5604 {
5605         struct wpa_driver_nl80211_data *drv = eloop_ctx;
5606         struct sockaddr_ll lladdr;
5607         unsigned char buf[3000];
5608         int len;
5609         socklen_t fromlen = sizeof(lladdr);
5610
5611         len = recvfrom(sock, buf, sizeof(buf), 0,
5612                        (struct sockaddr *)&lladdr, &fromlen);
5613         if (len < 0) {
5614                 wpa_printf(MSG_ERROR, "nl80211: EAPOL recv failed: %s",
5615                            strerror(errno));
5616                 return;
5617         }
5618
5619         if (have_ifidx(drv, lladdr.sll_ifindex))
5620                 drv_event_eapol_rx(drv->ctx, lladdr.sll_addr, buf, len);
5621 }
5622
5623
5624 static int i802_check_bridge(struct wpa_driver_nl80211_data *drv,
5625                              struct i802_bss *bss,
5626                              const char *brname, const char *ifname)
5627 {
5628         int br_ifindex;
5629         char in_br[IFNAMSIZ];
5630
5631         os_strlcpy(bss->brname, brname, IFNAMSIZ);
5632         br_ifindex = if_nametoindex(brname);
5633         if (br_ifindex == 0) {
5634                 /*
5635                  * Bridge was configured, but the bridge device does
5636                  * not exist. Try to add it now.
5637                  */
5638                 if (linux_br_add(drv->global->ioctl_sock, brname) < 0) {
5639                         wpa_printf(MSG_ERROR, "nl80211: Failed to add the "
5640                                    "bridge interface %s: %s",
5641                                    brname, strerror(errno));
5642                         return -1;
5643                 }
5644                 bss->added_bridge = 1;
5645                 br_ifindex = if_nametoindex(brname);
5646                 add_ifidx(drv, br_ifindex);
5647         }
5648         bss->br_ifindex = br_ifindex;
5649
5650         if (linux_br_get(in_br, ifname) == 0) {
5651                 if (os_strcmp(in_br, brname) == 0)
5652                         return 0; /* already in the bridge */
5653
5654                 wpa_printf(MSG_DEBUG, "nl80211: Removing interface %s from "
5655                            "bridge %s", ifname, in_br);
5656                 if (linux_br_del_if(drv->global->ioctl_sock, in_br, ifname) <
5657                     0) {
5658                         wpa_printf(MSG_ERROR, "nl80211: Failed to "
5659                                    "remove interface %s from bridge "
5660                                    "%s: %s",
5661                                    ifname, brname, strerror(errno));
5662                         return -1;
5663                 }
5664         }
5665
5666         wpa_printf(MSG_DEBUG, "nl80211: Adding interface %s into bridge %s",
5667                    ifname, brname);
5668         if (linux_br_add_if(drv->global->ioctl_sock, brname, ifname) < 0) {
5669                 wpa_printf(MSG_ERROR, "nl80211: Failed to add interface %s "
5670                            "into bridge %s: %s",
5671                            ifname, brname, strerror(errno));
5672                 return -1;
5673         }
5674         bss->added_if_into_bridge = 1;
5675
5676         return 0;
5677 }
5678
5679
5680 static void *i802_init(struct hostapd_data *hapd,
5681                        struct wpa_init_params *params)
5682 {
5683         struct wpa_driver_nl80211_data *drv;
5684         struct i802_bss *bss;
5685         size_t i;
5686         char master_ifname[IFNAMSIZ];
5687         int ifindex, br_ifindex = 0;
5688         int br_added = 0;
5689
5690         bss = wpa_driver_nl80211_drv_init(hapd, params->ifname,
5691                                           params->global_priv, 1,
5692                                           params->bssid, params->driver_params);
5693         if (bss == NULL)
5694                 return NULL;
5695
5696         drv = bss->drv;
5697
5698         if (linux_br_get(master_ifname, params->ifname) == 0) {
5699                 wpa_printf(MSG_DEBUG, "nl80211: Interface %s is in bridge %s",
5700                            params->ifname, master_ifname);
5701                 br_ifindex = if_nametoindex(master_ifname);
5702                 os_strlcpy(bss->brname, master_ifname, IFNAMSIZ);
5703         } else if ((params->num_bridge == 0 || !params->bridge[0]) &&
5704                    linux_master_get(master_ifname, params->ifname) == 0) {
5705                 wpa_printf(MSG_DEBUG, "nl80211: Interface %s is in master %s",
5706                         params->ifname, master_ifname);
5707                 /* start listening for EAPOL on the master interface */
5708                 add_ifidx(drv, if_nametoindex(master_ifname));
5709         } else {
5710                 master_ifname[0] = '\0';
5711         }
5712
5713         bss->br_ifindex = br_ifindex;
5714
5715         for (i = 0; i < params->num_bridge; i++) {
5716                 if (params->bridge[i]) {
5717                         ifindex = if_nametoindex(params->bridge[i]);
5718                         if (ifindex)
5719                                 add_ifidx(drv, ifindex);
5720                         if (ifindex == br_ifindex)
5721                                 br_added = 1;
5722                 }
5723         }
5724
5725         /* start listening for EAPOL on the default AP interface */
5726         add_ifidx(drv, drv->ifindex);
5727
5728         if (params->num_bridge && params->bridge[0]) {
5729                 if (i802_check_bridge(drv, bss, params->bridge[0],
5730                                       params->ifname) < 0)
5731                         goto failed;
5732                 if (os_strcmp(params->bridge[0], master_ifname) != 0)
5733                         br_added = 1;
5734         }
5735
5736         if (!br_added && br_ifindex &&
5737             (params->num_bridge == 0 || !params->bridge[0]))
5738                 add_ifidx(drv, br_ifindex);
5739
5740 #ifdef CONFIG_LIBNL3_ROUTE
5741         if (bss->added_if_into_bridge) {
5742                 drv->rtnl_sk = nl_socket_alloc();
5743                 if (drv->rtnl_sk == NULL) {
5744                         wpa_printf(MSG_ERROR, "nl80211: Failed to allocate nl_sock");
5745                         goto failed;
5746                 }
5747
5748                 if (nl_connect(drv->rtnl_sk, NETLINK_ROUTE)) {
5749                         wpa_printf(MSG_ERROR, "nl80211: Failed to connect nl_sock to NETLINK_ROUTE: %s",
5750                                    strerror(errno));
5751                         goto failed;
5752                 }
5753         }
5754 #endif /* CONFIG_LIBNL3_ROUTE */
5755
5756         drv->eapol_sock = socket(PF_PACKET, SOCK_DGRAM, htons(ETH_P_PAE));
5757         if (drv->eapol_sock < 0) {
5758                 wpa_printf(MSG_ERROR, "nl80211: socket(PF_PACKET, SOCK_DGRAM, ETH_P_PAE) failed: %s",
5759                            strerror(errno));
5760                 goto failed;
5761         }
5762
5763         if (eloop_register_read_sock(drv->eapol_sock, handle_eapol, drv, NULL))
5764         {
5765                 wpa_printf(MSG_INFO, "nl80211: Could not register read socket for eapol");
5766                 goto failed;
5767         }
5768
5769         if (linux_get_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
5770                                params->own_addr))
5771                 goto failed;
5772         os_memcpy(drv->perm_addr, params->own_addr, ETH_ALEN);
5773
5774         memcpy(bss->addr, params->own_addr, ETH_ALEN);
5775
5776         return bss;
5777
5778 failed:
5779         wpa_driver_nl80211_deinit(bss);
5780         return NULL;
5781 }
5782
5783
5784 static void i802_deinit(void *priv)
5785 {
5786         struct i802_bss *bss = priv;
5787         wpa_driver_nl80211_deinit(bss);
5788 }
5789
5790
5791 static enum nl80211_iftype wpa_driver_nl80211_if_type(
5792         enum wpa_driver_if_type type)
5793 {
5794         switch (type) {
5795         case WPA_IF_STATION:
5796                 return NL80211_IFTYPE_STATION;
5797         case WPA_IF_P2P_CLIENT:
5798         case WPA_IF_P2P_GROUP:
5799                 return NL80211_IFTYPE_P2P_CLIENT;
5800         case WPA_IF_AP_VLAN:
5801                 return NL80211_IFTYPE_AP_VLAN;
5802         case WPA_IF_AP_BSS:
5803                 return NL80211_IFTYPE_AP;
5804         case WPA_IF_P2P_GO:
5805                 return NL80211_IFTYPE_P2P_GO;
5806         case WPA_IF_P2P_DEVICE:
5807                 return NL80211_IFTYPE_P2P_DEVICE;
5808         case WPA_IF_MESH:
5809                 return NL80211_IFTYPE_MESH_POINT;
5810         default:
5811                 return -1;
5812         }
5813 }
5814
5815
5816 static int nl80211_addr_in_use(struct nl80211_global *global, const u8 *addr)
5817 {
5818         struct wpa_driver_nl80211_data *drv;
5819         dl_list_for_each(drv, &global->interfaces,
5820                          struct wpa_driver_nl80211_data, list) {
5821                 if (os_memcmp(addr, drv->first_bss->addr, ETH_ALEN) == 0)
5822                         return 1;
5823         }
5824         return 0;
5825 }
5826
5827
5828 static int nl80211_vif_addr(struct wpa_driver_nl80211_data *drv, u8 *new_addr)
5829 {
5830         unsigned int idx;
5831
5832         if (!drv->global)
5833                 return -1;
5834
5835         os_memcpy(new_addr, drv->first_bss->addr, ETH_ALEN);
5836         for (idx = 0; idx < 64; idx++) {
5837                 new_addr[0] = drv->first_bss->addr[0] | 0x02;
5838                 new_addr[0] ^= idx << 2;
5839                 if (!nl80211_addr_in_use(drv->global, new_addr))
5840                         break;
5841         }
5842         if (idx == 64)
5843                 return -1;
5844
5845         wpa_printf(MSG_DEBUG, "nl80211: Assigned new virtual interface address "
5846                    MACSTR, MAC2STR(new_addr));
5847
5848         return 0;
5849 }
5850
5851
5852 struct wdev_info {
5853         u64 wdev_id;
5854         int wdev_id_set;
5855         u8 macaddr[ETH_ALEN];
5856 };
5857
5858 static int nl80211_wdev_handler(struct nl_msg *msg, void *arg)
5859 {
5860         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
5861         struct nlattr *tb[NL80211_ATTR_MAX + 1];
5862         struct wdev_info *wi = arg;
5863
5864         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
5865                   genlmsg_attrlen(gnlh, 0), NULL);
5866         if (tb[NL80211_ATTR_WDEV]) {
5867                 wi->wdev_id = nla_get_u64(tb[NL80211_ATTR_WDEV]);
5868                 wi->wdev_id_set = 1;
5869         }
5870
5871         if (tb[NL80211_ATTR_MAC])
5872                 os_memcpy(wi->macaddr, nla_data(tb[NL80211_ATTR_MAC]),
5873                           ETH_ALEN);
5874
5875         return NL_SKIP;
5876 }
5877
5878
5879 static int wpa_driver_nl80211_if_add(void *priv, enum wpa_driver_if_type type,
5880                                      const char *ifname, const u8 *addr,
5881                                      void *bss_ctx, void **drv_priv,
5882                                      char *force_ifname, u8 *if_addr,
5883                                      const char *bridge, int use_existing)
5884 {
5885         enum nl80211_iftype nlmode;
5886         struct i802_bss *bss = priv;
5887         struct wpa_driver_nl80211_data *drv = bss->drv;
5888         int ifidx;
5889         int added = 1;
5890
5891         if (addr)
5892                 os_memcpy(if_addr, addr, ETH_ALEN);
5893         nlmode = wpa_driver_nl80211_if_type(type);
5894         if (nlmode == NL80211_IFTYPE_P2P_DEVICE) {
5895                 struct wdev_info p2pdev_info;
5896
5897                 os_memset(&p2pdev_info, 0, sizeof(p2pdev_info));
5898                 ifidx = nl80211_create_iface(drv, ifname, nlmode, addr,
5899                                              0, nl80211_wdev_handler,
5900                                              &p2pdev_info, use_existing);
5901                 if (!p2pdev_info.wdev_id_set || ifidx != 0) {
5902                         wpa_printf(MSG_ERROR, "nl80211: Failed to create a P2P Device interface %s",
5903                                    ifname);
5904                         return -1;
5905                 }
5906
5907                 drv->global->if_add_wdevid = p2pdev_info.wdev_id;
5908                 drv->global->if_add_wdevid_set = p2pdev_info.wdev_id_set;
5909                 if (!is_zero_ether_addr(p2pdev_info.macaddr))
5910                         os_memcpy(if_addr, p2pdev_info.macaddr, ETH_ALEN);
5911                 wpa_printf(MSG_DEBUG, "nl80211: New P2P Device interface %s (0x%llx) created",
5912                            ifname,
5913                            (long long unsigned int) p2pdev_info.wdev_id);
5914         } else {
5915                 ifidx = nl80211_create_iface(drv, ifname, nlmode, addr,
5916                                              0, NULL, NULL, use_existing);
5917                 if (use_existing && ifidx == -ENFILE) {
5918                         added = 0;
5919                         ifidx = if_nametoindex(ifname);
5920                 } else if (ifidx < 0) {
5921                         return -1;
5922                 }
5923         }
5924
5925         if (!addr) {
5926                 if (nlmode == NL80211_IFTYPE_P2P_DEVICE)
5927                         os_memcpy(if_addr, bss->addr, ETH_ALEN);
5928                 else if (linux_get_ifhwaddr(drv->global->ioctl_sock,
5929                                             ifname, if_addr) < 0) {
5930                         if (added)
5931                                 nl80211_remove_iface(drv, ifidx);
5932                         return -1;
5933                 }
5934         }
5935
5936         if (!addr &&
5937             (type == WPA_IF_P2P_CLIENT || type == WPA_IF_P2P_GROUP ||
5938              type == WPA_IF_P2P_GO || type == WPA_IF_MESH ||
5939              type == WPA_IF_STATION)) {
5940                 /* Enforce unique address */
5941                 u8 new_addr[ETH_ALEN];
5942
5943                 if (linux_get_ifhwaddr(drv->global->ioctl_sock, ifname,
5944                                        new_addr) < 0) {
5945                         if (added)
5946                                 nl80211_remove_iface(drv, ifidx);
5947                         return -1;
5948                 }
5949                 if (nl80211_addr_in_use(drv->global, new_addr)) {
5950                         wpa_printf(MSG_DEBUG, "nl80211: Allocate new address "
5951                                    "for interface %s type %d", ifname, type);
5952                         if (nl80211_vif_addr(drv, new_addr) < 0) {
5953                                 if (added)
5954                                         nl80211_remove_iface(drv, ifidx);
5955                                 return -1;
5956                         }
5957                         if (linux_set_ifhwaddr(drv->global->ioctl_sock, ifname,
5958                                                new_addr) < 0) {
5959                                 if (added)
5960                                         nl80211_remove_iface(drv, ifidx);
5961                                 return -1;
5962                         }
5963                 }
5964                 os_memcpy(if_addr, new_addr, ETH_ALEN);
5965         }
5966
5967         if (type == WPA_IF_AP_BSS) {
5968                 struct i802_bss *new_bss = os_zalloc(sizeof(*new_bss));
5969                 if (new_bss == NULL) {
5970                         if (added)
5971                                 nl80211_remove_iface(drv, ifidx);
5972                         return -1;
5973                 }
5974
5975                 if (bridge &&
5976                     i802_check_bridge(drv, new_bss, bridge, ifname) < 0) {
5977                         wpa_printf(MSG_ERROR, "nl80211: Failed to add the new "
5978                                    "interface %s to a bridge %s",
5979                                    ifname, bridge);
5980                         if (added)
5981                                 nl80211_remove_iface(drv, ifidx);
5982                         os_free(new_bss);
5983                         return -1;
5984                 }
5985
5986                 if (linux_set_iface_flags(drv->global->ioctl_sock, ifname, 1))
5987                 {
5988                         if (added)
5989                                 nl80211_remove_iface(drv, ifidx);
5990                         os_free(new_bss);
5991                         return -1;
5992                 }
5993                 os_strlcpy(new_bss->ifname, ifname, IFNAMSIZ);
5994                 os_memcpy(new_bss->addr, if_addr, ETH_ALEN);
5995                 new_bss->ifindex = ifidx;
5996                 new_bss->drv = drv;
5997                 new_bss->next = drv->first_bss->next;
5998                 new_bss->freq = drv->first_bss->freq;
5999                 new_bss->ctx = bss_ctx;
6000                 new_bss->added_if = added;
6001                 drv->first_bss->next = new_bss;
6002                 if (drv_priv)
6003                         *drv_priv = new_bss;
6004                 nl80211_init_bss(new_bss);
6005
6006                 /* Subscribe management frames for this WPA_IF_AP_BSS */
6007                 if (nl80211_setup_ap(new_bss))
6008                         return -1;
6009         }
6010
6011         if (drv->global)
6012                 drv->global->if_add_ifindex = ifidx;
6013
6014         /*
6015          * Some virtual interfaces need to process EAPOL packets and events on
6016          * the parent interface. This is used mainly with hostapd.
6017          */
6018         if (ifidx > 0 &&
6019             (drv->hostapd ||
6020              nlmode == NL80211_IFTYPE_AP_VLAN ||
6021              nlmode == NL80211_IFTYPE_WDS ||
6022              nlmode == NL80211_IFTYPE_MONITOR))
6023                 add_ifidx(drv, ifidx);
6024
6025         return 0;
6026 }
6027
6028
6029 static int wpa_driver_nl80211_if_remove(struct i802_bss *bss,
6030                                         enum wpa_driver_if_type type,
6031                                         const char *ifname)
6032 {
6033         struct wpa_driver_nl80211_data *drv = bss->drv;
6034         int ifindex = if_nametoindex(ifname);
6035
6036         wpa_printf(MSG_DEBUG, "nl80211: %s(type=%d ifname=%s) ifindex=%d added_if=%d",
6037                    __func__, type, ifname, ifindex, bss->added_if);
6038         if (ifindex > 0 && (bss->added_if || bss->ifindex != ifindex))
6039                 nl80211_remove_iface(drv, ifindex);
6040         else if (ifindex > 0 && !bss->added_if) {
6041                 struct wpa_driver_nl80211_data *drv2;
6042                 dl_list_for_each(drv2, &drv->global->interfaces,
6043                                  struct wpa_driver_nl80211_data, list)
6044                         del_ifidx(drv2, ifindex);
6045         }
6046
6047         if (type != WPA_IF_AP_BSS)
6048                 return 0;
6049
6050         if (bss->added_if_into_bridge) {
6051                 if (linux_br_del_if(drv->global->ioctl_sock, bss->brname,
6052                                     bss->ifname) < 0)
6053                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
6054                                    "interface %s from bridge %s: %s",
6055                                    bss->ifname, bss->brname, strerror(errno));
6056         }
6057         if (bss->added_bridge) {
6058                 if (linux_br_del(drv->global->ioctl_sock, bss->brname) < 0)
6059                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
6060                                    "bridge %s: %s",
6061                                    bss->brname, strerror(errno));
6062         }
6063
6064         if (bss != drv->first_bss) {
6065                 struct i802_bss *tbss;
6066
6067                 wpa_printf(MSG_DEBUG, "nl80211: Not the first BSS - remove it");
6068                 for (tbss = drv->first_bss; tbss; tbss = tbss->next) {
6069                         if (tbss->next == bss) {
6070                                 tbss->next = bss->next;
6071                                 /* Unsubscribe management frames */
6072                                 nl80211_teardown_ap(bss);
6073                                 nl80211_destroy_bss(bss);
6074                                 if (!bss->added_if)
6075                                         i802_set_iface_flags(bss, 0);
6076                                 os_free(bss);
6077                                 bss = NULL;
6078                                 break;
6079                         }
6080                 }
6081                 if (bss)
6082                         wpa_printf(MSG_INFO, "nl80211: %s - could not find "
6083                                    "BSS %p in the list", __func__, bss);
6084         } else {
6085                 wpa_printf(MSG_DEBUG, "nl80211: First BSS - reassign context");
6086                 nl80211_teardown_ap(bss);
6087                 if (!bss->added_if && !drv->first_bss->next)
6088                         wpa_driver_nl80211_del_beacon(drv);
6089                 nl80211_destroy_bss(bss);
6090                 if (!bss->added_if)
6091                         i802_set_iface_flags(bss, 0);
6092                 if (drv->first_bss->next) {
6093                         drv->first_bss = drv->first_bss->next;
6094                         drv->ctx = drv->first_bss->ctx;
6095                         os_free(bss);
6096                 } else {
6097                         wpa_printf(MSG_DEBUG, "nl80211: No second BSS to reassign context to");
6098                 }
6099         }
6100
6101         return 0;
6102 }
6103
6104
6105 static int cookie_handler(struct nl_msg *msg, void *arg)
6106 {
6107         struct nlattr *tb[NL80211_ATTR_MAX + 1];
6108         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
6109         u64 *cookie = arg;
6110         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
6111                   genlmsg_attrlen(gnlh, 0), NULL);
6112         if (tb[NL80211_ATTR_COOKIE])
6113                 *cookie = nla_get_u64(tb[NL80211_ATTR_COOKIE]);
6114         return NL_SKIP;
6115 }
6116
6117
6118 static int nl80211_send_frame_cmd(struct i802_bss *bss,
6119                                   unsigned int freq, unsigned int wait,
6120                                   const u8 *buf, size_t buf_len,
6121                                   u64 *cookie_out, int no_cck, int no_ack,
6122                                   int offchanok)
6123 {
6124         struct wpa_driver_nl80211_data *drv = bss->drv;
6125         struct nl_msg *msg;
6126         u64 cookie;
6127         int ret = -1;
6128
6129         wpa_printf(MSG_MSGDUMP, "nl80211: CMD_FRAME freq=%u wait=%u no_cck=%d "
6130                    "no_ack=%d offchanok=%d",
6131                    freq, wait, no_cck, no_ack, offchanok);
6132         wpa_hexdump(MSG_MSGDUMP, "CMD_FRAME", buf, buf_len);
6133
6134         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_FRAME)) ||
6135             (freq && nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
6136             (wait && nla_put_u32(msg, NL80211_ATTR_DURATION, wait)) ||
6137             (offchanok && ((drv->capa.flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX) ||
6138                            drv->test_use_roc_tx) &&
6139              nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK)) ||
6140             (no_cck && nla_put_flag(msg, NL80211_ATTR_TX_NO_CCK_RATE)) ||
6141             (no_ack && nla_put_flag(msg, NL80211_ATTR_DONT_WAIT_FOR_ACK)) ||
6142             nla_put(msg, NL80211_ATTR_FRAME, buf_len, buf))
6143                 goto fail;
6144
6145         cookie = 0;
6146         ret = send_and_recv_msgs(drv, msg, cookie_handler, &cookie);
6147         msg = NULL;
6148         if (ret) {
6149                 wpa_printf(MSG_DEBUG, "nl80211: Frame command failed: ret=%d "
6150                            "(%s) (freq=%u wait=%u)", ret, strerror(-ret),
6151                            freq, wait);
6152         } else {
6153                 wpa_printf(MSG_MSGDUMP, "nl80211: Frame TX command accepted%s; "
6154                            "cookie 0x%llx", no_ack ? " (no ACK)" : "",
6155                            (long long unsigned int) cookie);
6156
6157                 if (cookie_out)
6158                         *cookie_out = no_ack ? (u64) -1 : cookie;
6159         }
6160
6161 fail:
6162         nlmsg_free(msg);
6163         return ret;
6164 }
6165
6166
6167 static int wpa_driver_nl80211_send_action(struct i802_bss *bss,
6168                                           unsigned int freq,
6169                                           unsigned int wait_time,
6170                                           const u8 *dst, const u8 *src,
6171                                           const u8 *bssid,
6172                                           const u8 *data, size_t data_len,
6173                                           int no_cck)
6174 {
6175         struct wpa_driver_nl80211_data *drv = bss->drv;
6176         int ret = -1;
6177         u8 *buf;
6178         struct ieee80211_hdr *hdr;
6179
6180         wpa_printf(MSG_DEBUG, "nl80211: Send Action frame (ifindex=%d, "
6181                    "freq=%u MHz wait=%d ms no_cck=%d)",
6182                    drv->ifindex, freq, wait_time, no_cck);
6183
6184         buf = os_zalloc(24 + data_len);
6185         if (buf == NULL)
6186                 return ret;
6187         os_memcpy(buf + 24, data, data_len);
6188         hdr = (struct ieee80211_hdr *) buf;
6189         hdr->frame_control =
6190                 IEEE80211_FC(WLAN_FC_TYPE_MGMT, WLAN_FC_STYPE_ACTION);
6191         os_memcpy(hdr->addr1, dst, ETH_ALEN);
6192         os_memcpy(hdr->addr2, src, ETH_ALEN);
6193         os_memcpy(hdr->addr3, bssid, ETH_ALEN);
6194
6195         if (is_ap_interface(drv->nlmode) &&
6196             (!(drv->capa.flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX) ||
6197              (int) freq == bss->freq || drv->device_ap_sme ||
6198              !drv->use_monitor))
6199                 ret = wpa_driver_nl80211_send_mlme(bss, buf, 24 + data_len,
6200                                                    0, freq, no_cck, 1,
6201                                                    wait_time);
6202         else
6203                 ret = nl80211_send_frame_cmd(bss, freq, wait_time, buf,
6204                                              24 + data_len,
6205                                              &drv->send_action_cookie,
6206                                              no_cck, 0, 1);
6207
6208         os_free(buf);
6209         return ret;
6210 }
6211
6212
6213 static void wpa_driver_nl80211_send_action_cancel_wait(void *priv)
6214 {
6215         struct i802_bss *bss = priv;
6216         struct wpa_driver_nl80211_data *drv = bss->drv;
6217         struct nl_msg *msg;
6218         int ret;
6219
6220         wpa_printf(MSG_DEBUG, "nl80211: Cancel TX frame wait: cookie=0x%llx",
6221                    (long long unsigned int) drv->send_action_cookie);
6222         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_FRAME_WAIT_CANCEL)) ||
6223             nla_put_u64(msg, NL80211_ATTR_COOKIE, drv->send_action_cookie)) {
6224                 nlmsg_free(msg);
6225                 return;
6226         }
6227
6228         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
6229         if (ret)
6230                 wpa_printf(MSG_DEBUG, "nl80211: wait cancel failed: ret=%d "
6231                            "(%s)", ret, strerror(-ret));
6232 }
6233
6234
6235 static int wpa_driver_nl80211_remain_on_channel(void *priv, unsigned int freq,
6236                                                 unsigned int duration)
6237 {
6238         struct i802_bss *bss = priv;
6239         struct wpa_driver_nl80211_data *drv = bss->drv;
6240         struct nl_msg *msg;
6241         int ret;
6242         u64 cookie;
6243
6244         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_REMAIN_ON_CHANNEL)) ||
6245             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
6246             nla_put_u32(msg, NL80211_ATTR_DURATION, duration)) {
6247                 nlmsg_free(msg);
6248                 return -1;
6249         }
6250
6251         cookie = 0;
6252         ret = send_and_recv_msgs(drv, msg, cookie_handler, &cookie);
6253         if (ret == 0) {
6254                 wpa_printf(MSG_DEBUG, "nl80211: Remain-on-channel cookie "
6255                            "0x%llx for freq=%u MHz duration=%u",
6256                            (long long unsigned int) cookie, freq, duration);
6257                 drv->remain_on_chan_cookie = cookie;
6258                 drv->pending_remain_on_chan = 1;
6259                 return 0;
6260         }
6261         wpa_printf(MSG_DEBUG, "nl80211: Failed to request remain-on-channel "
6262                    "(freq=%d duration=%u): %d (%s)",
6263                    freq, duration, ret, strerror(-ret));
6264         return -1;
6265 }
6266
6267
6268 static int wpa_driver_nl80211_cancel_remain_on_channel(void *priv)
6269 {
6270         struct i802_bss *bss = priv;
6271         struct wpa_driver_nl80211_data *drv = bss->drv;
6272         struct nl_msg *msg;
6273         int ret;
6274
6275         if (!drv->pending_remain_on_chan) {
6276                 wpa_printf(MSG_DEBUG, "nl80211: No pending remain-on-channel "
6277                            "to cancel");
6278                 return -1;
6279         }
6280
6281         wpa_printf(MSG_DEBUG, "nl80211: Cancel remain-on-channel with cookie "
6282                    "0x%llx",
6283                    (long long unsigned int) drv->remain_on_chan_cookie);
6284
6285         msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL);
6286         if (!msg ||
6287             nla_put_u64(msg, NL80211_ATTR_COOKIE, drv->remain_on_chan_cookie)) {
6288                 nlmsg_free(msg);
6289                 return -1;
6290         }
6291
6292         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
6293         if (ret == 0)
6294                 return 0;
6295         wpa_printf(MSG_DEBUG, "nl80211: Failed to cancel remain-on-channel: "
6296                    "%d (%s)", ret, strerror(-ret));
6297         return -1;
6298 }
6299
6300
6301 static int wpa_driver_nl80211_probe_req_report(struct i802_bss *bss, int report)
6302 {
6303         struct wpa_driver_nl80211_data *drv = bss->drv;
6304
6305         if (!report) {
6306                 if (bss->nl_preq && drv->device_ap_sme &&
6307                     is_ap_interface(drv->nlmode) && !bss->in_deinit &&
6308                     !bss->static_ap) {
6309                         /*
6310                          * Do not disable Probe Request reporting that was
6311                          * enabled in nl80211_setup_ap().
6312                          */
6313                         wpa_printf(MSG_DEBUG, "nl80211: Skip disabling of "
6314                                    "Probe Request reporting nl_preq=%p while "
6315                                    "in AP mode", bss->nl_preq);
6316                 } else if (bss->nl_preq) {
6317                         wpa_printf(MSG_DEBUG, "nl80211: Disable Probe Request "
6318                                    "reporting nl_preq=%p", bss->nl_preq);
6319                         nl80211_destroy_eloop_handle(&bss->nl_preq);
6320                 }
6321                 return 0;
6322         }
6323
6324         if (bss->nl_preq) {
6325                 wpa_printf(MSG_DEBUG, "nl80211: Probe Request reporting "
6326                            "already on! nl_preq=%p", bss->nl_preq);
6327                 return 0;
6328         }
6329
6330         bss->nl_preq = nl_create_handle(drv->global->nl_cb, "preq");
6331         if (bss->nl_preq == NULL)
6332                 return -1;
6333         wpa_printf(MSG_DEBUG, "nl80211: Enable Probe Request "
6334                    "reporting nl_preq=%p", bss->nl_preq);
6335
6336         if (nl80211_register_frame(bss, bss->nl_preq,
6337                                    (WLAN_FC_TYPE_MGMT << 2) |
6338                                    (WLAN_FC_STYPE_PROBE_REQ << 4),
6339                                    NULL, 0) < 0)
6340                 goto out_err;
6341
6342         nl80211_register_eloop_read(&bss->nl_preq,
6343                                     wpa_driver_nl80211_event_receive,
6344                                     bss->nl_cb);
6345
6346         return 0;
6347
6348  out_err:
6349         nl_destroy_handles(&bss->nl_preq);
6350         return -1;
6351 }
6352
6353
6354 static int nl80211_disable_11b_rates(struct wpa_driver_nl80211_data *drv,
6355                                      int ifindex, int disabled)
6356 {
6357         struct nl_msg *msg;
6358         struct nlattr *bands, *band;
6359         int ret;
6360
6361         wpa_printf(MSG_DEBUG,
6362                    "nl80211: NL80211_CMD_SET_TX_BITRATE_MASK (ifindex=%d %s)",
6363                    ifindex, disabled ? "NL80211_TXRATE_LEGACY=OFDM-only" :
6364                    "no NL80211_TXRATE_LEGACY constraint");
6365
6366         msg = nl80211_ifindex_msg(drv, ifindex, 0,
6367                                   NL80211_CMD_SET_TX_BITRATE_MASK);
6368         if (!msg)
6369                 return -1;
6370
6371         bands = nla_nest_start(msg, NL80211_ATTR_TX_RATES);
6372         if (!bands)
6373                 goto fail;
6374
6375         /*
6376          * Disable 2 GHz rates 1, 2, 5.5, 11 Mbps by masking out everything
6377          * else apart from 6, 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS
6378          * rates. All 5 GHz rates are left enabled.
6379          */
6380         band = nla_nest_start(msg, NL80211_BAND_2GHZ);
6381         if (!band ||
6382             (disabled && nla_put(msg, NL80211_TXRATE_LEGACY, 8,
6383                                  "\x0c\x12\x18\x24\x30\x48\x60\x6c")))
6384                 goto fail;
6385         nla_nest_end(msg, band);
6386
6387         nla_nest_end(msg, bands);
6388
6389         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
6390         if (ret) {
6391                 wpa_printf(MSG_DEBUG, "nl80211: Set TX rates failed: ret=%d "
6392                            "(%s)", ret, strerror(-ret));
6393         } else
6394                 drv->disabled_11b_rates = disabled;
6395
6396         return ret;
6397
6398 fail:
6399         nlmsg_free(msg);
6400         return -1;
6401 }
6402
6403
6404 static int wpa_driver_nl80211_deinit_ap(void *priv)
6405 {
6406         struct i802_bss *bss = priv;
6407         struct wpa_driver_nl80211_data *drv = bss->drv;
6408         if (!is_ap_interface(drv->nlmode))
6409                 return -1;
6410         wpa_driver_nl80211_del_beacon(drv);
6411         bss->beacon_set = 0;
6412
6413         /*
6414          * If the P2P GO interface was dynamically added, then it is
6415          * possible that the interface change to station is not possible.
6416          */
6417         if (drv->nlmode == NL80211_IFTYPE_P2P_GO && bss->if_dynamic)
6418                 return 0;
6419
6420         return wpa_driver_nl80211_set_mode(priv, NL80211_IFTYPE_STATION);
6421 }
6422
6423
6424 static int wpa_driver_nl80211_stop_ap(void *priv)
6425 {
6426         struct i802_bss *bss = priv;
6427         struct wpa_driver_nl80211_data *drv = bss->drv;
6428         if (!is_ap_interface(drv->nlmode))
6429                 return -1;
6430         wpa_driver_nl80211_del_beacon(drv);
6431         bss->beacon_set = 0;
6432         return 0;
6433 }
6434
6435
6436 static int wpa_driver_nl80211_deinit_p2p_cli(void *priv)
6437 {
6438         struct i802_bss *bss = priv;
6439         struct wpa_driver_nl80211_data *drv = bss->drv;
6440         if (drv->nlmode != NL80211_IFTYPE_P2P_CLIENT)
6441                 return -1;
6442
6443         /*
6444          * If the P2P Client interface was dynamically added, then it is
6445          * possible that the interface change to station is not possible.
6446          */
6447         if (bss->if_dynamic)
6448                 return 0;
6449
6450         return wpa_driver_nl80211_set_mode(priv, NL80211_IFTYPE_STATION);
6451 }
6452
6453
6454 static void wpa_driver_nl80211_resume(void *priv)
6455 {
6456         struct i802_bss *bss = priv;
6457
6458         if (i802_set_iface_flags(bss, 1))
6459                 wpa_printf(MSG_DEBUG, "nl80211: Failed to set interface up on resume event");
6460 }
6461
6462
6463 static int nl80211_signal_monitor(void *priv, int threshold, int hysteresis)
6464 {
6465         struct i802_bss *bss = priv;
6466         struct wpa_driver_nl80211_data *drv = bss->drv;
6467         struct nl_msg *msg;
6468         struct nlattr *cqm;
6469
6470         wpa_printf(MSG_DEBUG, "nl80211: Signal monitor threshold=%d "
6471                    "hysteresis=%d", threshold, hysteresis);
6472
6473         if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_SET_CQM)) ||
6474             !(cqm = nla_nest_start(msg, NL80211_ATTR_CQM)) ||
6475             nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THOLD, threshold) ||
6476             nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_HYST, hysteresis)) {
6477                 nlmsg_free(msg);
6478                 return -1;
6479         }
6480         nla_nest_end(msg, cqm);
6481
6482         return send_and_recv_msgs(drv, msg, NULL, NULL);
6483 }
6484
6485
6486 static int get_channel_width(struct nl_msg *msg, void *arg)
6487 {
6488         struct nlattr *tb[NL80211_ATTR_MAX + 1];
6489         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
6490         struct wpa_signal_info *sig_change = arg;
6491
6492         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
6493                   genlmsg_attrlen(gnlh, 0), NULL);
6494
6495         sig_change->center_frq1 = -1;
6496         sig_change->center_frq2 = -1;
6497         sig_change->chanwidth = CHAN_WIDTH_UNKNOWN;
6498
6499         if (tb[NL80211_ATTR_CHANNEL_WIDTH]) {
6500                 sig_change->chanwidth = convert2width(
6501                         nla_get_u32(tb[NL80211_ATTR_CHANNEL_WIDTH]));
6502                 if (tb[NL80211_ATTR_CENTER_FREQ1])
6503                         sig_change->center_frq1 =
6504                                 nla_get_u32(tb[NL80211_ATTR_CENTER_FREQ1]);
6505                 if (tb[NL80211_ATTR_CENTER_FREQ2])
6506                         sig_change->center_frq2 =
6507                                 nla_get_u32(tb[NL80211_ATTR_CENTER_FREQ2]);
6508         }
6509
6510         return NL_SKIP;
6511 }
6512
6513
6514 static int nl80211_get_channel_width(struct wpa_driver_nl80211_data *drv,
6515                                      struct wpa_signal_info *sig)
6516 {
6517         struct nl_msg *msg;
6518
6519         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_GET_INTERFACE);
6520         return send_and_recv_msgs(drv, msg, get_channel_width, sig);
6521 }
6522
6523
6524 static int nl80211_signal_poll(void *priv, struct wpa_signal_info *si)
6525 {
6526         struct i802_bss *bss = priv;
6527         struct wpa_driver_nl80211_data *drv = bss->drv;
6528         int res;
6529
6530         os_memset(si, 0, sizeof(*si));
6531         res = nl80211_get_link_signal(drv, si);
6532         if (res != 0)
6533                 return res;
6534
6535         res = nl80211_get_channel_width(drv, si);
6536         if (res != 0)
6537                 return res;
6538
6539         return nl80211_get_link_noise(drv, si);
6540 }
6541
6542
6543 static int nl80211_send_frame(void *priv, const u8 *data, size_t data_len,
6544                               int encrypt)
6545 {
6546         struct i802_bss *bss = priv;
6547         return wpa_driver_nl80211_send_frame(bss, data, data_len, encrypt, 0,
6548                                              0, 0, 0, 0);
6549 }
6550
6551
6552 static int nl80211_set_param(void *priv, const char *param)
6553 {
6554         wpa_printf(MSG_DEBUG, "nl80211: driver param='%s'", param);
6555         if (param == NULL)
6556                 return 0;
6557
6558 #ifdef CONFIG_P2P
6559         if (os_strstr(param, "use_p2p_group_interface=1")) {
6560                 struct i802_bss *bss = priv;
6561                 struct wpa_driver_nl80211_data *drv = bss->drv;
6562
6563                 wpa_printf(MSG_DEBUG, "nl80211: Use separate P2P group "
6564                            "interface");
6565                 drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_CONCURRENT;
6566                 drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_MGMT_AND_NON_P2P;
6567         }
6568 #endif /* CONFIG_P2P */
6569
6570         if (os_strstr(param, "use_monitor=1")) {
6571                 struct i802_bss *bss = priv;
6572                 struct wpa_driver_nl80211_data *drv = bss->drv;
6573                 drv->use_monitor = 1;
6574         }
6575
6576         if (os_strstr(param, "force_connect_cmd=1")) {
6577                 struct i802_bss *bss = priv;
6578                 struct wpa_driver_nl80211_data *drv = bss->drv;
6579                 drv->capa.flags &= ~WPA_DRIVER_FLAGS_SME;
6580                 drv->force_connect_cmd = 1;
6581         }
6582
6583         if (os_strstr(param, "no_offchannel_tx=1")) {
6584                 struct i802_bss *bss = priv;
6585                 struct wpa_driver_nl80211_data *drv = bss->drv;
6586                 drv->capa.flags &= ~WPA_DRIVER_FLAGS_OFFCHANNEL_TX;
6587                 drv->test_use_roc_tx = 1;
6588         }
6589
6590         return 0;
6591 }
6592
6593
6594 static void * nl80211_global_init(void)
6595 {
6596         struct nl80211_global *global;
6597         struct netlink_config *cfg;
6598
6599         global = os_zalloc(sizeof(*global));
6600         if (global == NULL)
6601                 return NULL;
6602         global->ioctl_sock = -1;
6603         dl_list_init(&global->interfaces);
6604         global->if_add_ifindex = -1;
6605
6606         cfg = os_zalloc(sizeof(*cfg));
6607         if (cfg == NULL)
6608                 goto err;
6609
6610         cfg->ctx = global;
6611         cfg->newlink_cb = wpa_driver_nl80211_event_rtm_newlink;
6612         cfg->dellink_cb = wpa_driver_nl80211_event_rtm_dellink;
6613         global->netlink = netlink_init(cfg);
6614         if (global->netlink == NULL) {
6615                 os_free(cfg);
6616                 goto err;
6617         }
6618
6619         if (wpa_driver_nl80211_init_nl_global(global) < 0)
6620                 goto err;
6621
6622         global->ioctl_sock = socket(PF_INET, SOCK_DGRAM, 0);
6623         if (global->ioctl_sock < 0) {
6624                 wpa_printf(MSG_ERROR, "nl80211: socket(PF_INET,SOCK_DGRAM) failed: %s",
6625                            strerror(errno));
6626                 goto err;
6627         }
6628
6629         return global;
6630
6631 err:
6632         nl80211_global_deinit(global);
6633         return NULL;
6634 }
6635
6636
6637 static void nl80211_global_deinit(void *priv)
6638 {
6639         struct nl80211_global *global = priv;
6640         if (global == NULL)
6641                 return;
6642         if (!dl_list_empty(&global->interfaces)) {
6643                 wpa_printf(MSG_ERROR, "nl80211: %u interface(s) remain at "
6644                            "nl80211_global_deinit",
6645                            dl_list_len(&global->interfaces));
6646         }
6647
6648         if (global->netlink)
6649                 netlink_deinit(global->netlink);
6650
6651         nl_destroy_handles(&global->nl);
6652
6653         if (global->nl_event)
6654                 nl80211_destroy_eloop_handle(&global->nl_event);
6655
6656         nl_cb_put(global->nl_cb);
6657
6658         if (global->ioctl_sock >= 0)
6659                 close(global->ioctl_sock);
6660
6661         os_free(global);
6662 }
6663
6664
6665 static const char * nl80211_get_radio_name(void *priv)
6666 {
6667         struct i802_bss *bss = priv;
6668         struct wpa_driver_nl80211_data *drv = bss->drv;
6669         return drv->phyname;
6670 }
6671
6672
6673 static int nl80211_pmkid(struct i802_bss *bss, int cmd, const u8 *bssid,
6674                          const u8 *pmkid)
6675 {
6676         struct nl_msg *msg;
6677
6678         if (!(msg = nl80211_bss_msg(bss, 0, cmd)) ||
6679             (pmkid && nla_put(msg, NL80211_ATTR_PMKID, 16, pmkid)) ||
6680             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))) {
6681                 nlmsg_free(msg);
6682                 return -ENOBUFS;
6683         }
6684
6685         return send_and_recv_msgs(bss->drv, msg, NULL, NULL);
6686 }
6687
6688
6689 static int nl80211_add_pmkid(void *priv, const u8 *bssid, const u8 *pmkid)
6690 {
6691         struct i802_bss *bss = priv;
6692         wpa_printf(MSG_DEBUG, "nl80211: Add PMKID for " MACSTR, MAC2STR(bssid));
6693         return nl80211_pmkid(bss, NL80211_CMD_SET_PMKSA, bssid, pmkid);
6694 }
6695
6696
6697 static int nl80211_remove_pmkid(void *priv, const u8 *bssid, const u8 *pmkid)
6698 {
6699         struct i802_bss *bss = priv;
6700         wpa_printf(MSG_DEBUG, "nl80211: Delete PMKID for " MACSTR,
6701                    MAC2STR(bssid));
6702         return nl80211_pmkid(bss, NL80211_CMD_DEL_PMKSA, bssid, pmkid);
6703 }
6704
6705
6706 static int nl80211_flush_pmkid(void *priv)
6707 {
6708         struct i802_bss *bss = priv;
6709         wpa_printf(MSG_DEBUG, "nl80211: Flush PMKIDs");
6710         return nl80211_pmkid(bss, NL80211_CMD_FLUSH_PMKSA, NULL, NULL);
6711 }
6712
6713
6714 static void clean_survey_results(struct survey_results *survey_results)
6715 {
6716         struct freq_survey *survey, *tmp;
6717
6718         if (dl_list_empty(&survey_results->survey_list))
6719                 return;
6720
6721         dl_list_for_each_safe(survey, tmp, &survey_results->survey_list,
6722                               struct freq_survey, list) {
6723                 dl_list_del(&survey->list);
6724                 os_free(survey);
6725         }
6726 }
6727
6728
6729 static void add_survey(struct nlattr **sinfo, u32 ifidx,
6730                        struct dl_list *survey_list)
6731 {
6732         struct freq_survey *survey;
6733
6734         survey = os_zalloc(sizeof(struct freq_survey));
6735         if  (!survey)
6736                 return;
6737
6738         survey->ifidx = ifidx;
6739         survey->freq = nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]);
6740         survey->filled = 0;
6741
6742         if (sinfo[NL80211_SURVEY_INFO_NOISE]) {
6743                 survey->nf = (int8_t)
6744                         nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
6745                 survey->filled |= SURVEY_HAS_NF;
6746         }
6747
6748         if (sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME]) {
6749                 survey->channel_time =
6750                         nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME]);
6751                 survey->filled |= SURVEY_HAS_CHAN_TIME;
6752         }
6753
6754         if (sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY]) {
6755                 survey->channel_time_busy =
6756                         nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY]);
6757                 survey->filled |= SURVEY_HAS_CHAN_TIME_BUSY;
6758         }
6759
6760         if (sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_RX]) {
6761                 survey->channel_time_rx =
6762                         nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_RX]);
6763                 survey->filled |= SURVEY_HAS_CHAN_TIME_RX;
6764         }
6765
6766         if (sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_TX]) {
6767                 survey->channel_time_tx =
6768                         nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_TX]);
6769                 survey->filled |= SURVEY_HAS_CHAN_TIME_TX;
6770         }
6771
6772         wpa_printf(MSG_DEBUG, "nl80211: Freq survey dump event (freq=%d MHz noise=%d channel_time=%ld busy_time=%ld tx_time=%ld rx_time=%ld filled=%04x)",
6773                    survey->freq,
6774                    survey->nf,
6775                    (unsigned long int) survey->channel_time,
6776                    (unsigned long int) survey->channel_time_busy,
6777                    (unsigned long int) survey->channel_time_tx,
6778                    (unsigned long int) survey->channel_time_rx,
6779                    survey->filled);
6780
6781         dl_list_add_tail(survey_list, &survey->list);
6782 }
6783
6784
6785 static int check_survey_ok(struct nlattr **sinfo, u32 surveyed_freq,
6786                            unsigned int freq_filter)
6787 {
6788         if (!freq_filter)
6789                 return 1;
6790
6791         return freq_filter == surveyed_freq;
6792 }
6793
6794
6795 static int survey_handler(struct nl_msg *msg, void *arg)
6796 {
6797         struct nlattr *tb[NL80211_ATTR_MAX + 1];
6798         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
6799         struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
6800         struct survey_results *survey_results;
6801         u32 surveyed_freq = 0;
6802         u32 ifidx;
6803
6804         static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
6805                 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
6806                 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
6807         };
6808
6809         survey_results = (struct survey_results *) arg;
6810
6811         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
6812                   genlmsg_attrlen(gnlh, 0), NULL);
6813
6814         if (!tb[NL80211_ATTR_IFINDEX])
6815                 return NL_SKIP;
6816
6817         ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
6818
6819         if (!tb[NL80211_ATTR_SURVEY_INFO])
6820                 return NL_SKIP;
6821
6822         if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
6823                              tb[NL80211_ATTR_SURVEY_INFO],
6824                              survey_policy))
6825                 return NL_SKIP;
6826
6827         if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY]) {
6828                 wpa_printf(MSG_ERROR, "nl80211: Invalid survey data");
6829                 return NL_SKIP;
6830         }
6831
6832         surveyed_freq = nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]);
6833
6834         if (!check_survey_ok(sinfo, surveyed_freq,
6835                              survey_results->freq_filter))
6836                 return NL_SKIP;
6837
6838         if (survey_results->freq_filter &&
6839             survey_results->freq_filter != surveyed_freq) {
6840                 wpa_printf(MSG_EXCESSIVE, "nl80211: Ignoring survey data for freq %d MHz",
6841                            surveyed_freq);
6842                 return NL_SKIP;
6843         }
6844
6845         add_survey(sinfo, ifidx, &survey_results->survey_list);
6846
6847         return NL_SKIP;
6848 }
6849
6850
6851 static int wpa_driver_nl80211_get_survey(void *priv, unsigned int freq)
6852 {
6853         struct i802_bss *bss = priv;
6854         struct wpa_driver_nl80211_data *drv = bss->drv;
6855         struct nl_msg *msg;
6856         int err;
6857         union wpa_event_data data;
6858         struct survey_results *survey_results;
6859
6860         os_memset(&data, 0, sizeof(data));
6861         survey_results = &data.survey_results;
6862
6863         dl_list_init(&survey_results->survey_list);
6864
6865         msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_GET_SURVEY);
6866         if (!msg)
6867                 return -ENOBUFS;
6868
6869         if (freq)
6870                 data.survey_results.freq_filter = freq;
6871
6872         do {
6873                 wpa_printf(MSG_DEBUG, "nl80211: Fetch survey data");
6874                 err = send_and_recv_msgs(drv, msg, survey_handler,
6875                                          survey_results);
6876         } while (err > 0);
6877
6878         if (err)
6879                 wpa_printf(MSG_ERROR, "nl80211: Failed to process survey data");
6880         else
6881                 wpa_supplicant_event(drv->ctx, EVENT_SURVEY, &data);
6882
6883         clean_survey_results(survey_results);
6884         return err;
6885 }
6886
6887
6888 static void nl80211_set_rekey_info(void *priv, const u8 *kek, size_t kek_len,
6889                                    const u8 *kck, size_t kck_len,
6890                                    const u8 *replay_ctr)
6891 {
6892         struct i802_bss *bss = priv;
6893         struct wpa_driver_nl80211_data *drv = bss->drv;
6894         struct nlattr *replay_nested;
6895         struct nl_msg *msg;
6896         int ret;
6897
6898         if (!drv->set_rekey_offload)
6899                 return;
6900
6901         wpa_printf(MSG_DEBUG, "nl80211: Set rekey offload");
6902         if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_SET_REKEY_OFFLOAD)) ||
6903             !(replay_nested = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA)) ||
6904             nla_put(msg, NL80211_REKEY_DATA_KEK, kek_len, kek) ||
6905             nla_put(msg, NL80211_REKEY_DATA_KCK, kck_len, kck) ||
6906             nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR, NL80211_REPLAY_CTR_LEN,
6907                     replay_ctr)) {
6908                 nl80211_nlmsg_clear(msg);
6909                 nlmsg_free(msg);
6910                 return;
6911         }
6912
6913         nla_nest_end(msg, replay_nested);
6914
6915         ret = send_and_recv_msgs(drv, msg, NULL, (void *) -1);
6916         if (ret == -EOPNOTSUPP) {
6917                 wpa_printf(MSG_DEBUG,
6918                            "nl80211: Driver does not support rekey offload");
6919                 drv->set_rekey_offload = 0;
6920         }
6921 }
6922
6923
6924 static void nl80211_send_null_frame(struct i802_bss *bss, const u8 *own_addr,
6925                                     const u8 *addr, int qos)
6926 {
6927         /* send data frame to poll STA and check whether
6928          * this frame is ACKed */
6929         struct {
6930                 struct ieee80211_hdr hdr;
6931                 u16 qos_ctl;
6932         } STRUCT_PACKED nulldata;
6933         size_t size;
6934
6935         /* Send data frame to poll STA and check whether this frame is ACKed */
6936
6937         os_memset(&nulldata, 0, sizeof(nulldata));
6938
6939         if (qos) {
6940                 nulldata.hdr.frame_control =
6941                         IEEE80211_FC(WLAN_FC_TYPE_DATA,
6942                                      WLAN_FC_STYPE_QOS_NULL);
6943                 size = sizeof(nulldata);
6944         } else {
6945                 nulldata.hdr.frame_control =
6946                         IEEE80211_FC(WLAN_FC_TYPE_DATA,
6947                                      WLAN_FC_STYPE_NULLFUNC);
6948                 size = sizeof(struct ieee80211_hdr);
6949         }
6950
6951         nulldata.hdr.frame_control |= host_to_le16(WLAN_FC_FROMDS);
6952         os_memcpy(nulldata.hdr.IEEE80211_DA_FROMDS, addr, ETH_ALEN);
6953         os_memcpy(nulldata.hdr.IEEE80211_BSSID_FROMDS, own_addr, ETH_ALEN);
6954         os_memcpy(nulldata.hdr.IEEE80211_SA_FROMDS, own_addr, ETH_ALEN);
6955
6956         if (wpa_driver_nl80211_send_mlme(bss, (u8 *) &nulldata, size, 0, 0, 0,
6957                                          0, 0) < 0)
6958                 wpa_printf(MSG_DEBUG, "nl80211_send_null_frame: Failed to "
6959                            "send poll frame");
6960 }
6961
6962 static void nl80211_poll_client(void *priv, const u8 *own_addr, const u8 *addr,
6963                                 int qos)
6964 {
6965         struct i802_bss *bss = priv;
6966         struct wpa_driver_nl80211_data *drv = bss->drv;
6967         struct nl_msg *msg;
6968         int ret;
6969
6970         if (!drv->poll_command_supported) {
6971                 nl80211_send_null_frame(bss, own_addr, addr, qos);
6972                 return;
6973         }
6974
6975         if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_PROBE_CLIENT)) ||
6976             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) {
6977                 nlmsg_free(msg);
6978                 return;
6979         }
6980
6981         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
6982         if (ret < 0) {
6983                 wpa_printf(MSG_DEBUG, "nl80211: Client probe request for "
6984                            MACSTR " failed: ret=%d (%s)",
6985                            MAC2STR(addr), ret, strerror(-ret));
6986         }
6987 }
6988
6989
6990 static int nl80211_set_power_save(struct i802_bss *bss, int enabled)
6991 {
6992         struct nl_msg *msg;
6993
6994         if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_SET_POWER_SAVE)) ||
6995             nla_put_u32(msg, NL80211_ATTR_PS_STATE,
6996                         enabled ? NL80211_PS_ENABLED : NL80211_PS_DISABLED)) {
6997                 nlmsg_free(msg);
6998                 return -ENOBUFS;
6999         }
7000         return send_and_recv_msgs(bss->drv, msg, NULL, NULL);
7001 }
7002
7003
7004 static int nl80211_set_p2p_powersave(void *priv, int legacy_ps, int opp_ps,
7005                                      int ctwindow)
7006 {
7007         struct i802_bss *bss = priv;
7008
7009         wpa_printf(MSG_DEBUG, "nl80211: set_p2p_powersave (legacy_ps=%d "
7010                    "opp_ps=%d ctwindow=%d)", legacy_ps, opp_ps, ctwindow);
7011
7012         if (opp_ps != -1 || ctwindow != -1) {
7013 #ifdef ANDROID_P2P
7014                 wpa_driver_set_p2p_ps(priv, legacy_ps, opp_ps, ctwindow);
7015 #else /* ANDROID_P2P */
7016                 return -1; /* Not yet supported */
7017 #endif /* ANDROID_P2P */
7018         }
7019
7020         if (legacy_ps == -1)
7021                 return 0;
7022         if (legacy_ps != 0 && legacy_ps != 1)
7023                 return -1; /* Not yet supported */
7024
7025         return nl80211_set_power_save(bss, legacy_ps);
7026 }
7027
7028
7029 static int nl80211_start_radar_detection(void *priv,
7030                                          struct hostapd_freq_params *freq)
7031 {
7032         struct i802_bss *bss = priv;
7033         struct wpa_driver_nl80211_data *drv = bss->drv;
7034         struct nl_msg *msg;
7035         int ret;
7036
7037         wpa_printf(MSG_DEBUG, "nl80211: Start radar detection (CAC) %d MHz (ht_enabled=%d, vht_enabled=%d, bandwidth=%d MHz, cf1=%d MHz, cf2=%d MHz)",
7038                    freq->freq, freq->ht_enabled, freq->vht_enabled,
7039                    freq->bandwidth, freq->center_freq1, freq->center_freq2);
7040
7041         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_RADAR)) {
7042                 wpa_printf(MSG_DEBUG, "nl80211: Driver does not support radar "
7043                            "detection");
7044                 return -1;
7045         }
7046
7047         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_RADAR_DETECT)) ||
7048             nl80211_put_freq_params(msg, freq) < 0) {
7049                 nlmsg_free(msg);
7050                 return -1;
7051         }
7052
7053         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7054         if (ret == 0)
7055                 return 0;
7056         wpa_printf(MSG_DEBUG, "nl80211: Failed to start radar detection: "
7057                    "%d (%s)", ret, strerror(-ret));
7058         return -1;
7059 }
7060
7061 #ifdef CONFIG_TDLS
7062
7063 static int nl80211_send_tdls_mgmt(void *priv, const u8 *dst, u8 action_code,
7064                                   u8 dialog_token, u16 status_code,
7065                                   u32 peer_capab, int initiator, const u8 *buf,
7066                                   size_t len)
7067 {
7068         struct i802_bss *bss = priv;
7069         struct wpa_driver_nl80211_data *drv = bss->drv;
7070         struct nl_msg *msg;
7071
7072         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT))
7073                 return -EOPNOTSUPP;
7074
7075         if (!dst)
7076                 return -EINVAL;
7077
7078         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_TDLS_MGMT)) ||
7079             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
7080             nla_put_u8(msg, NL80211_ATTR_TDLS_ACTION, action_code) ||
7081             nla_put_u8(msg, NL80211_ATTR_TDLS_DIALOG_TOKEN, dialog_token) ||
7082             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status_code))
7083                 goto fail;
7084         if (peer_capab) {
7085                 /*
7086                  * The internal enum tdls_peer_capability definition is
7087                  * currently identical with the nl80211 enum
7088                  * nl80211_tdls_peer_capability, so no conversion is needed
7089                  * here.
7090                  */
7091                 if (nla_put_u32(msg, NL80211_ATTR_TDLS_PEER_CAPABILITY,
7092                                 peer_capab))
7093                         goto fail;
7094         }
7095         if ((initiator &&
7096              nla_put_flag(msg, NL80211_ATTR_TDLS_INITIATOR)) ||
7097             nla_put(msg, NL80211_ATTR_IE, len, buf))
7098                 goto fail;
7099
7100         return send_and_recv_msgs(drv, msg, NULL, NULL);
7101
7102 fail:
7103         nlmsg_free(msg);
7104         return -ENOBUFS;
7105 }
7106
7107
7108 static int nl80211_tdls_oper(void *priv, enum tdls_oper oper, const u8 *peer)
7109 {
7110         struct i802_bss *bss = priv;
7111         struct wpa_driver_nl80211_data *drv = bss->drv;
7112         struct nl_msg *msg;
7113         enum nl80211_tdls_operation nl80211_oper;
7114
7115         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT))
7116                 return -EOPNOTSUPP;
7117
7118         switch (oper) {
7119         case TDLS_DISCOVERY_REQ:
7120                 nl80211_oper = NL80211_TDLS_DISCOVERY_REQ;
7121                 break;
7122         case TDLS_SETUP:
7123                 nl80211_oper = NL80211_TDLS_SETUP;
7124                 break;
7125         case TDLS_TEARDOWN:
7126                 nl80211_oper = NL80211_TDLS_TEARDOWN;
7127                 break;
7128         case TDLS_ENABLE_LINK:
7129                 nl80211_oper = NL80211_TDLS_ENABLE_LINK;
7130                 break;
7131         case TDLS_DISABLE_LINK:
7132                 nl80211_oper = NL80211_TDLS_DISABLE_LINK;
7133                 break;
7134         case TDLS_ENABLE:
7135                 return 0;
7136         case TDLS_DISABLE:
7137                 return 0;
7138         default:
7139                 return -EINVAL;
7140         }
7141
7142         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_TDLS_OPER)) ||
7143             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, nl80211_oper) ||
7144             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer)) {
7145                 nlmsg_free(msg);
7146                 return -ENOBUFS;
7147         }
7148
7149         return send_and_recv_msgs(drv, msg, NULL, NULL);
7150 }
7151
7152
7153 static int
7154 nl80211_tdls_enable_channel_switch(void *priv, const u8 *addr, u8 oper_class,
7155                                    const struct hostapd_freq_params *params)
7156 {
7157         struct i802_bss *bss = priv;
7158         struct wpa_driver_nl80211_data *drv = bss->drv;
7159         struct nl_msg *msg;
7160         int ret = -ENOBUFS;
7161
7162         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT) ||
7163             !(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_CHANNEL_SWITCH))
7164                 return -EOPNOTSUPP;
7165
7166         wpa_printf(MSG_DEBUG, "nl80211: Enable TDLS channel switch " MACSTR
7167                    " oper_class=%u freq=%u",
7168                    MAC2STR(addr), oper_class, params->freq);
7169         msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_TDLS_CHANNEL_SWITCH);
7170         if (!msg ||
7171             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
7172             nla_put_u8(msg, NL80211_ATTR_OPER_CLASS, oper_class) ||
7173             (ret = nl80211_put_freq_params(msg, params))) {
7174                 nlmsg_free(msg);
7175                 wpa_printf(MSG_DEBUG, "nl80211: Could not build TDLS chan switch");
7176                 return ret;
7177         }
7178
7179         return send_and_recv_msgs(drv, msg, NULL, NULL);
7180 }
7181
7182
7183 static int
7184 nl80211_tdls_disable_channel_switch(void *priv, const u8 *addr)
7185 {
7186         struct i802_bss *bss = priv;
7187         struct wpa_driver_nl80211_data *drv = bss->drv;
7188         struct nl_msg *msg;
7189
7190         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT) ||
7191             !(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_CHANNEL_SWITCH))
7192                 return -EOPNOTSUPP;
7193
7194         wpa_printf(MSG_DEBUG, "nl80211: Disable TDLS channel switch " MACSTR,
7195                    MAC2STR(addr));
7196         msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH);
7197         if (!msg ||
7198             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) {
7199                 nlmsg_free(msg);
7200                 wpa_printf(MSG_DEBUG,
7201                            "nl80211: Could not build TDLS cancel chan switch");
7202                 return -ENOBUFS;
7203         }
7204
7205         return send_and_recv_msgs(drv, msg, NULL, NULL);
7206 }
7207
7208 #endif /* CONFIG TDLS */
7209
7210
7211 static int driver_nl80211_set_key(const char *ifname, void *priv,
7212                                   enum wpa_alg alg, const u8 *addr,
7213                                   int key_idx, int set_tx,
7214                                   const u8 *seq, size_t seq_len,
7215                                   const u8 *key, size_t key_len)
7216 {
7217         struct i802_bss *bss = priv;
7218         return wpa_driver_nl80211_set_key(ifname, bss, alg, addr, key_idx,
7219                                           set_tx, seq, seq_len, key, key_len);
7220 }
7221
7222
7223 static int driver_nl80211_scan2(void *priv,
7224                                 struct wpa_driver_scan_params *params)
7225 {
7226         struct i802_bss *bss = priv;
7227         return wpa_driver_nl80211_scan(bss, params);
7228 }
7229
7230
7231 static int driver_nl80211_deauthenticate(void *priv, const u8 *addr,
7232                                          int reason_code)
7233 {
7234         struct i802_bss *bss = priv;
7235         return wpa_driver_nl80211_deauthenticate(bss, addr, reason_code);
7236 }
7237
7238
7239 static int driver_nl80211_authenticate(void *priv,
7240                                        struct wpa_driver_auth_params *params)
7241 {
7242         struct i802_bss *bss = priv;
7243         return wpa_driver_nl80211_authenticate(bss, params);
7244 }
7245
7246
7247 static void driver_nl80211_deinit(void *priv)
7248 {
7249         struct i802_bss *bss = priv;
7250         wpa_driver_nl80211_deinit(bss);
7251 }
7252
7253
7254 static int driver_nl80211_if_remove(void *priv, enum wpa_driver_if_type type,
7255                                     const char *ifname)
7256 {
7257         struct i802_bss *bss = priv;
7258         return wpa_driver_nl80211_if_remove(bss, type, ifname);
7259 }
7260
7261
7262 static int driver_nl80211_send_mlme(void *priv, const u8 *data,
7263                                     size_t data_len, int noack,
7264                                     unsigned int freq)
7265 {
7266         struct i802_bss *bss = priv;
7267         return wpa_driver_nl80211_send_mlme(bss, data, data_len, noack,
7268                                             freq, 0, 0, 0);
7269 }
7270
7271
7272 static int driver_nl80211_sta_remove(void *priv, const u8 *addr)
7273 {
7274         struct i802_bss *bss = priv;
7275         return wpa_driver_nl80211_sta_remove(bss, addr, -1, 0);
7276 }
7277
7278
7279 static int driver_nl80211_set_sta_vlan(void *priv, const u8 *addr,
7280                                        const char *ifname, int vlan_id)
7281 {
7282         struct i802_bss *bss = priv;
7283         return i802_set_sta_vlan(bss, addr, ifname, vlan_id);
7284 }
7285
7286
7287 static int driver_nl80211_read_sta_data(void *priv,
7288                                         struct hostap_sta_driver_data *data,
7289                                         const u8 *addr)
7290 {
7291         struct i802_bss *bss = priv;
7292         return i802_read_sta_data(bss, data, addr);
7293 }
7294
7295
7296 static int driver_nl80211_send_action(void *priv, unsigned int freq,
7297                                       unsigned int wait_time,
7298                                       const u8 *dst, const u8 *src,
7299                                       const u8 *bssid,
7300                                       const u8 *data, size_t data_len,
7301                                       int no_cck)
7302 {
7303         struct i802_bss *bss = priv;
7304         return wpa_driver_nl80211_send_action(bss, freq, wait_time, dst, src,
7305                                               bssid, data, data_len, no_cck);
7306 }
7307
7308
7309 static int driver_nl80211_probe_req_report(void *priv, int report)
7310 {
7311         struct i802_bss *bss = priv;
7312         return wpa_driver_nl80211_probe_req_report(bss, report);
7313 }
7314
7315
7316 static int wpa_driver_nl80211_update_ft_ies(void *priv, const u8 *md,
7317                                             const u8 *ies, size_t ies_len)
7318 {
7319         int ret;
7320         struct nl_msg *msg;
7321         struct i802_bss *bss = priv;
7322         struct wpa_driver_nl80211_data *drv = bss->drv;
7323         u16 mdid = WPA_GET_LE16(md);
7324
7325         wpa_printf(MSG_DEBUG, "nl80211: Updating FT IEs");
7326         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_UPDATE_FT_IES)) ||
7327             nla_put(msg, NL80211_ATTR_IE, ies_len, ies) ||
7328             nla_put_u16(msg, NL80211_ATTR_MDID, mdid)) {
7329                 nlmsg_free(msg);
7330                 return -ENOBUFS;
7331         }
7332
7333         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7334         if (ret) {
7335                 wpa_printf(MSG_DEBUG, "nl80211: update_ft_ies failed "
7336                            "err=%d (%s)", ret, strerror(-ret));
7337         }
7338
7339         return ret;
7340 }
7341
7342
7343 const u8 * wpa_driver_nl80211_get_macaddr(void *priv)
7344 {
7345         struct i802_bss *bss = priv;
7346         struct wpa_driver_nl80211_data *drv = bss->drv;
7347
7348         if (drv->nlmode != NL80211_IFTYPE_P2P_DEVICE)
7349                 return NULL;
7350
7351         return bss->addr;
7352 }
7353
7354
7355 static const char * scan_state_str(enum scan_states scan_state)
7356 {
7357         switch (scan_state) {
7358         case NO_SCAN:
7359                 return "NO_SCAN";
7360         case SCAN_REQUESTED:
7361                 return "SCAN_REQUESTED";
7362         case SCAN_STARTED:
7363                 return "SCAN_STARTED";
7364         case SCAN_COMPLETED:
7365                 return "SCAN_COMPLETED";
7366         case SCAN_ABORTED:
7367                 return "SCAN_ABORTED";
7368         case SCHED_SCAN_STARTED:
7369                 return "SCHED_SCAN_STARTED";
7370         case SCHED_SCAN_STOPPED:
7371                 return "SCHED_SCAN_STOPPED";
7372         case SCHED_SCAN_RESULTS:
7373                 return "SCHED_SCAN_RESULTS";
7374         }
7375
7376         return "??";
7377 }
7378
7379
7380 static int wpa_driver_nl80211_status(void *priv, char *buf, size_t buflen)
7381 {
7382         struct i802_bss *bss = priv;
7383         struct wpa_driver_nl80211_data *drv = bss->drv;
7384         int res;
7385         char *pos, *end;
7386
7387         pos = buf;
7388         end = buf + buflen;
7389
7390         res = os_snprintf(pos, end - pos,
7391                           "ifindex=%d\n"
7392                           "ifname=%s\n"
7393                           "brname=%s\n"
7394                           "addr=" MACSTR "\n"
7395                           "freq=%d\n"
7396                           "%s%s%s%s%s",
7397                           bss->ifindex,
7398                           bss->ifname,
7399                           bss->brname,
7400                           MAC2STR(bss->addr),
7401                           bss->freq,
7402                           bss->beacon_set ? "beacon_set=1\n" : "",
7403                           bss->added_if_into_bridge ?
7404                           "added_if_into_bridge=1\n" : "",
7405                           bss->added_bridge ? "added_bridge=1\n" : "",
7406                           bss->in_deinit ? "in_deinit=1\n" : "",
7407                           bss->if_dynamic ? "if_dynamic=1\n" : "");
7408         if (os_snprintf_error(end - pos, res))
7409                 return pos - buf;
7410         pos += res;
7411
7412         if (bss->wdev_id_set) {
7413                 res = os_snprintf(pos, end - pos, "wdev_id=%llu\n",
7414                                   (unsigned long long) bss->wdev_id);
7415                 if (os_snprintf_error(end - pos, res))
7416                         return pos - buf;
7417                 pos += res;
7418         }
7419
7420         res = os_snprintf(pos, end - pos,
7421                           "phyname=%s\n"
7422                           "perm_addr=" MACSTR "\n"
7423                           "drv_ifindex=%d\n"
7424                           "operstate=%d\n"
7425                           "scan_state=%s\n"
7426                           "auth_bssid=" MACSTR "\n"
7427                           "auth_attempt_bssid=" MACSTR "\n"
7428                           "bssid=" MACSTR "\n"
7429                           "prev_bssid=" MACSTR "\n"
7430                           "associated=%d\n"
7431                           "assoc_freq=%u\n"
7432                           "monitor_sock=%d\n"
7433                           "monitor_ifidx=%d\n"
7434                           "monitor_refcount=%d\n"
7435                           "last_mgmt_freq=%u\n"
7436                           "eapol_tx_sock=%d\n"
7437                           "%s%s%s%s%s%s%s%s%s%s%s%s%s",
7438                           drv->phyname,
7439                           MAC2STR(drv->perm_addr),
7440                           drv->ifindex,
7441                           drv->operstate,
7442                           scan_state_str(drv->scan_state),
7443                           MAC2STR(drv->auth_bssid),
7444                           MAC2STR(drv->auth_attempt_bssid),
7445                           MAC2STR(drv->bssid),
7446                           MAC2STR(drv->prev_bssid),
7447                           drv->associated,
7448                           drv->assoc_freq,
7449                           drv->monitor_sock,
7450                           drv->monitor_ifidx,
7451                           drv->monitor_refcount,
7452                           drv->last_mgmt_freq,
7453                           drv->eapol_tx_sock,
7454                           drv->ignore_if_down_event ?
7455                           "ignore_if_down_event=1\n" : "",
7456                           drv->scan_complete_events ?
7457                           "scan_complete_events=1\n" : "",
7458                           drv->disabled_11b_rates ?
7459                           "disabled_11b_rates=1\n" : "",
7460                           drv->pending_remain_on_chan ?
7461                           "pending_remain_on_chan=1\n" : "",
7462                           drv->in_interface_list ? "in_interface_list=1\n" : "",
7463                           drv->device_ap_sme ? "device_ap_sme=1\n" : "",
7464                           drv->poll_command_supported ?
7465                           "poll_command_supported=1\n" : "",
7466                           drv->data_tx_status ? "data_tx_status=1\n" : "",
7467                           drv->scan_for_auth ? "scan_for_auth=1\n" : "",
7468                           drv->retry_auth ? "retry_auth=1\n" : "",
7469                           drv->use_monitor ? "use_monitor=1\n" : "",
7470                           drv->ignore_next_local_disconnect ?
7471                           "ignore_next_local_disconnect=1\n" : "",
7472                           drv->ignore_next_local_deauth ?
7473                           "ignore_next_local_deauth=1\n" : "");
7474         if (os_snprintf_error(end - pos, res))
7475                 return pos - buf;
7476         pos += res;
7477
7478         if (drv->has_capability) {
7479                 res = os_snprintf(pos, end - pos,
7480                                   "capa.key_mgmt=0x%x\n"
7481                                   "capa.enc=0x%x\n"
7482                                   "capa.auth=0x%x\n"
7483                                   "capa.flags=0x%llx\n"
7484                                   "capa.rrm_flags=0x%x\n"
7485                                   "capa.max_scan_ssids=%d\n"
7486                                   "capa.max_sched_scan_ssids=%d\n"
7487                                   "capa.sched_scan_supported=%d\n"
7488                                   "capa.max_match_sets=%d\n"
7489                                   "capa.max_remain_on_chan=%u\n"
7490                                   "capa.max_stations=%u\n"
7491                                   "capa.probe_resp_offloads=0x%x\n"
7492                                   "capa.max_acl_mac_addrs=%u\n"
7493                                   "capa.num_multichan_concurrent=%u\n"
7494                                   "capa.mac_addr_rand_sched_scan_supported=%d\n"
7495                                   "capa.mac_addr_rand_scan_supported=%d\n"
7496                                   "capa.conc_capab=%u\n"
7497                                   "capa.max_conc_chan_2_4=%u\n"
7498                                   "capa.max_conc_chan_5_0=%u\n",
7499                                   drv->capa.key_mgmt,
7500                                   drv->capa.enc,
7501                                   drv->capa.auth,
7502                                   (unsigned long long) drv->capa.flags,
7503                                   drv->capa.rrm_flags,
7504                                   drv->capa.max_scan_ssids,
7505                                   drv->capa.max_sched_scan_ssids,
7506                                   drv->capa.sched_scan_supported,
7507                                   drv->capa.max_match_sets,
7508                                   drv->capa.max_remain_on_chan,
7509                                   drv->capa.max_stations,
7510                                   drv->capa.probe_resp_offloads,
7511                                   drv->capa.max_acl_mac_addrs,
7512                                   drv->capa.num_multichan_concurrent,
7513                                   drv->capa.mac_addr_rand_sched_scan_supported,
7514                                   drv->capa.mac_addr_rand_scan_supported,
7515                                   drv->capa.conc_capab,
7516                                   drv->capa.max_conc_chan_2_4,
7517                                   drv->capa.max_conc_chan_5_0);
7518                 if (os_snprintf_error(end - pos, res))
7519                         return pos - buf;
7520                 pos += res;
7521         }
7522
7523         return pos - buf;
7524 }
7525
7526
7527 static int set_beacon_data(struct nl_msg *msg, struct beacon_data *settings)
7528 {
7529         if ((settings->head &&
7530              nla_put(msg, NL80211_ATTR_BEACON_HEAD,
7531                      settings->head_len, settings->head)) ||
7532             (settings->tail &&
7533              nla_put(msg, NL80211_ATTR_BEACON_TAIL,
7534                      settings->tail_len, settings->tail)) ||
7535             (settings->beacon_ies &&
7536              nla_put(msg, NL80211_ATTR_IE,
7537                      settings->beacon_ies_len, settings->beacon_ies)) ||
7538             (settings->proberesp_ies &&
7539              nla_put(msg, NL80211_ATTR_IE_PROBE_RESP,
7540                      settings->proberesp_ies_len, settings->proberesp_ies)) ||
7541             (settings->assocresp_ies &&
7542              nla_put(msg, NL80211_ATTR_IE_ASSOC_RESP,
7543                      settings->assocresp_ies_len, settings->assocresp_ies)) ||
7544             (settings->probe_resp &&
7545              nla_put(msg, NL80211_ATTR_PROBE_RESP,
7546                      settings->probe_resp_len, settings->probe_resp)))
7547                 return -ENOBUFS;
7548
7549         return 0;
7550 }
7551
7552
7553 static int nl80211_switch_channel(void *priv, struct csa_settings *settings)
7554 {
7555         struct nl_msg *msg;
7556         struct i802_bss *bss = priv;
7557         struct wpa_driver_nl80211_data *drv = bss->drv;
7558         struct nlattr *beacon_csa;
7559         int ret = -ENOBUFS;
7560
7561         wpa_printf(MSG_DEBUG, "nl80211: Channel switch request (cs_count=%u block_tx=%u freq=%d width=%d cf1=%d cf2=%d)",
7562                    settings->cs_count, settings->block_tx,
7563                    settings->freq_params.freq, settings->freq_params.bandwidth,
7564                    settings->freq_params.center_freq1,
7565                    settings->freq_params.center_freq2);
7566
7567         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_AP_CSA)) {
7568                 wpa_printf(MSG_DEBUG, "nl80211: Driver does not support channel switch command");
7569                 return -EOPNOTSUPP;
7570         }
7571
7572         if ((drv->nlmode != NL80211_IFTYPE_AP) &&
7573             (drv->nlmode != NL80211_IFTYPE_P2P_GO))
7574                 return -EOPNOTSUPP;
7575
7576         /* check settings validity */
7577         if (!settings->beacon_csa.tail ||
7578             ((settings->beacon_csa.tail_len <=
7579               settings->counter_offset_beacon) ||
7580              (settings->beacon_csa.tail[settings->counter_offset_beacon] !=
7581               settings->cs_count)))
7582                 return -EINVAL;
7583
7584         if (settings->beacon_csa.probe_resp &&
7585             ((settings->beacon_csa.probe_resp_len <=
7586               settings->counter_offset_presp) ||
7587              (settings->beacon_csa.probe_resp[settings->counter_offset_presp] !=
7588               settings->cs_count)))
7589                 return -EINVAL;
7590
7591         if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_CHANNEL_SWITCH)) ||
7592             nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT,
7593                         settings->cs_count) ||
7594             (ret = nl80211_put_freq_params(msg, &settings->freq_params)) ||
7595             (settings->block_tx &&
7596              nla_put_flag(msg, NL80211_ATTR_CH_SWITCH_BLOCK_TX)))
7597                 goto error;
7598
7599         /* beacon_after params */
7600         ret = set_beacon_data(msg, &settings->beacon_after);
7601         if (ret)
7602                 goto error;
7603
7604         /* beacon_csa params */
7605         beacon_csa = nla_nest_start(msg, NL80211_ATTR_CSA_IES);
7606         if (!beacon_csa)
7607                 goto fail;
7608
7609         ret = set_beacon_data(msg, &settings->beacon_csa);
7610         if (ret)
7611                 goto error;
7612
7613         if (nla_put_u16(msg, NL80211_ATTR_CSA_C_OFF_BEACON,
7614                         settings->counter_offset_beacon) ||
7615             (settings->beacon_csa.probe_resp &&
7616              nla_put_u16(msg, NL80211_ATTR_CSA_C_OFF_PRESP,
7617                          settings->counter_offset_presp)))
7618                 goto fail;
7619
7620         nla_nest_end(msg, beacon_csa);
7621         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7622         if (ret) {
7623                 wpa_printf(MSG_DEBUG, "nl80211: switch_channel failed err=%d (%s)",
7624                            ret, strerror(-ret));
7625         }
7626         return ret;
7627
7628 fail:
7629         ret = -ENOBUFS;
7630 error:
7631         nlmsg_free(msg);
7632         wpa_printf(MSG_DEBUG, "nl80211: Could not build channel switch request");
7633         return ret;
7634 }
7635
7636
7637 static int nl80211_add_ts(void *priv, u8 tsid, const u8 *addr,
7638                           u8 user_priority, u16 admitted_time)
7639 {
7640         struct i802_bss *bss = priv;
7641         struct wpa_driver_nl80211_data *drv = bss->drv;
7642         struct nl_msg *msg;
7643         int ret;
7644
7645         wpa_printf(MSG_DEBUG,
7646                    "nl80211: add_ts request: tsid=%u admitted_time=%u up=%d",
7647                    tsid, admitted_time, user_priority);
7648
7649         if (!is_sta_interface(drv->nlmode))
7650                 return -ENOTSUP;
7651
7652         msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_ADD_TX_TS);
7653         if (!msg ||
7654             nla_put_u8(msg, NL80211_ATTR_TSID, tsid) ||
7655             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
7656             nla_put_u8(msg, NL80211_ATTR_USER_PRIO, user_priority) ||
7657             nla_put_u16(msg, NL80211_ATTR_ADMITTED_TIME, admitted_time)) {
7658                 nlmsg_free(msg);
7659                 return -ENOBUFS;
7660         }
7661
7662         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7663         if (ret)
7664                 wpa_printf(MSG_DEBUG, "nl80211: add_ts failed err=%d (%s)",
7665                            ret, strerror(-ret));
7666         return ret;
7667 }
7668
7669
7670 static int nl80211_del_ts(void *priv, u8 tsid, const u8 *addr)
7671 {
7672         struct i802_bss *bss = priv;
7673         struct wpa_driver_nl80211_data *drv = bss->drv;
7674         struct nl_msg *msg;
7675         int ret;
7676
7677         wpa_printf(MSG_DEBUG, "nl80211: del_ts request: tsid=%u", tsid);
7678
7679         if (!is_sta_interface(drv->nlmode))
7680                 return -ENOTSUP;
7681
7682         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_DEL_TX_TS)) ||
7683             nla_put_u8(msg, NL80211_ATTR_TSID, tsid) ||
7684             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) {
7685                 nlmsg_free(msg);
7686                 return -ENOBUFS;
7687         }
7688
7689         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7690         if (ret)
7691                 wpa_printf(MSG_DEBUG, "nl80211: del_ts failed err=%d (%s)",
7692                            ret, strerror(-ret));
7693         return ret;
7694 }
7695
7696
7697 #ifdef CONFIG_TESTING_OPTIONS
7698 static int cmd_reply_handler(struct nl_msg *msg, void *arg)
7699 {
7700         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
7701         struct wpabuf *buf = arg;
7702
7703         if (!buf)
7704                 return NL_SKIP;
7705
7706         if ((size_t) genlmsg_attrlen(gnlh, 0) > wpabuf_tailroom(buf)) {
7707                 wpa_printf(MSG_INFO, "nl80211: insufficient buffer space for reply");
7708                 return NL_SKIP;
7709         }
7710
7711         wpabuf_put_data(buf, genlmsg_attrdata(gnlh, 0),
7712                         genlmsg_attrlen(gnlh, 0));
7713
7714         return NL_SKIP;
7715 }
7716 #endif /* CONFIG_TESTING_OPTIONS */
7717
7718
7719 static int vendor_reply_handler(struct nl_msg *msg, void *arg)
7720 {
7721         struct nlattr *tb[NL80211_ATTR_MAX + 1];
7722         struct nlattr *nl_vendor_reply, *nl;
7723         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
7724         struct wpabuf *buf = arg;
7725         int rem;
7726
7727         if (!buf)
7728                 return NL_SKIP;
7729
7730         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
7731                   genlmsg_attrlen(gnlh, 0), NULL);
7732         nl_vendor_reply = tb[NL80211_ATTR_VENDOR_DATA];
7733
7734         if (!nl_vendor_reply)
7735                 return NL_SKIP;
7736
7737         if ((size_t) nla_len(nl_vendor_reply) > wpabuf_tailroom(buf)) {
7738                 wpa_printf(MSG_INFO, "nl80211: Vendor command: insufficient buffer space for reply");
7739                 return NL_SKIP;
7740         }
7741
7742         nla_for_each_nested(nl, nl_vendor_reply, rem) {
7743                 wpabuf_put_data(buf, nla_data(nl), nla_len(nl));
7744         }
7745
7746         return NL_SKIP;
7747 }
7748
7749
7750 static int nl80211_vendor_cmd(void *priv, unsigned int vendor_id,
7751                               unsigned int subcmd, const u8 *data,
7752                               size_t data_len, struct wpabuf *buf)
7753 {
7754         struct i802_bss *bss = priv;
7755         struct wpa_driver_nl80211_data *drv = bss->drv;
7756         struct nl_msg *msg;
7757         int ret;
7758
7759 #ifdef CONFIG_TESTING_OPTIONS
7760         if (vendor_id == 0xffffffff) {
7761                 msg = nlmsg_alloc();
7762                 if (!msg)
7763                         return -ENOMEM;
7764
7765                 nl80211_cmd(drv, msg, 0, subcmd);
7766                 if (nlmsg_append(msg, (void *) data, data_len, NLMSG_ALIGNTO) <
7767                     0)
7768                         goto fail;
7769                 ret = send_and_recv_msgs(drv, msg, cmd_reply_handler, buf);
7770                 if (ret)
7771                         wpa_printf(MSG_DEBUG, "nl80211: command failed err=%d",
7772                                    ret);
7773                 return ret;
7774         }
7775 #endif /* CONFIG_TESTING_OPTIONS */
7776
7777         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_VENDOR)) ||
7778             nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, vendor_id) ||
7779             nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, subcmd) ||
7780             (data &&
7781              nla_put(msg, NL80211_ATTR_VENDOR_DATA, data_len, data)))
7782                 goto fail;
7783
7784         ret = send_and_recv_msgs(drv, msg, vendor_reply_handler, buf);
7785         if (ret)
7786                 wpa_printf(MSG_DEBUG, "nl80211: vendor command failed err=%d",
7787                            ret);
7788         return ret;
7789
7790 fail:
7791         nlmsg_free(msg);
7792         return -ENOBUFS;
7793 }
7794
7795
7796 static int nl80211_set_qos_map(void *priv, const u8 *qos_map_set,
7797                                u8 qos_map_set_len)
7798 {
7799         struct i802_bss *bss = priv;
7800         struct wpa_driver_nl80211_data *drv = bss->drv;
7801         struct nl_msg *msg;
7802         int ret;
7803
7804         wpa_hexdump(MSG_DEBUG, "nl80211: Setting QoS Map",
7805                     qos_map_set, qos_map_set_len);
7806
7807         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_SET_QOS_MAP)) ||
7808             nla_put(msg, NL80211_ATTR_QOS_MAP, qos_map_set_len, qos_map_set)) {
7809                 nlmsg_free(msg);
7810                 return -ENOBUFS;
7811         }
7812
7813         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7814         if (ret)
7815                 wpa_printf(MSG_DEBUG, "nl80211: Setting QoS Map failed");
7816
7817         return ret;
7818 }
7819
7820
7821 static int nl80211_set_wowlan(void *priv,
7822                               const struct wowlan_triggers *triggers)
7823 {
7824         struct i802_bss *bss = priv;
7825         struct wpa_driver_nl80211_data *drv = bss->drv;
7826         struct nl_msg *msg;
7827         struct nlattr *wowlan_triggers;
7828         int ret;
7829
7830         wpa_printf(MSG_DEBUG, "nl80211: Setting wowlan");
7831
7832         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_SET_WOWLAN)) ||
7833             !(wowlan_triggers = nla_nest_start(msg,
7834                                                NL80211_ATTR_WOWLAN_TRIGGERS)) ||
7835             (triggers->any &&
7836              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
7837             (triggers->disconnect &&
7838              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
7839             (triggers->magic_pkt &&
7840              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
7841             (triggers->gtk_rekey_failure &&
7842              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
7843             (triggers->eap_identity_req &&
7844              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
7845             (triggers->four_way_handshake &&
7846              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
7847             (triggers->rfkill_release &&
7848              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))) {
7849                 nlmsg_free(msg);
7850                 return -ENOBUFS;
7851         }
7852
7853         nla_nest_end(msg, wowlan_triggers);
7854
7855         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7856         if (ret)
7857                 wpa_printf(MSG_DEBUG, "nl80211: Setting wowlan failed");
7858
7859         return ret;
7860 }
7861
7862
7863 static int nl80211_roaming(void *priv, int allowed, const u8 *bssid)
7864 {
7865         struct i802_bss *bss = priv;
7866         struct wpa_driver_nl80211_data *drv = bss->drv;
7867         struct nl_msg *msg;
7868         struct nlattr *params;
7869
7870         wpa_printf(MSG_DEBUG, "nl80211: Roaming policy: allowed=%d", allowed);
7871
7872         if (!drv->roaming_vendor_cmd_avail) {
7873                 wpa_printf(MSG_DEBUG,
7874                            "nl80211: Ignore roaming policy change since driver does not provide command for setting it");
7875                 return -1;
7876         }
7877
7878         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
7879             nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
7880             nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
7881                         QCA_NL80211_VENDOR_SUBCMD_ROAMING) ||
7882             !(params = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
7883             nla_put_u32(msg, QCA_WLAN_VENDOR_ATTR_ROAMING_POLICY,
7884                         allowed ? QCA_ROAMING_ALLOWED_WITHIN_ESS :
7885                         QCA_ROAMING_NOT_ALLOWED) ||
7886             (bssid &&
7887              nla_put(msg, QCA_WLAN_VENDOR_ATTR_MAC_ADDR, ETH_ALEN, bssid))) {
7888                 nlmsg_free(msg);
7889                 return -1;
7890         }
7891         nla_nest_end(msg, params);
7892
7893         return send_and_recv_msgs(drv, msg, NULL, NULL);
7894 }
7895
7896
7897 static int nl80211_set_mac_addr(void *priv, const u8 *addr)
7898 {
7899         struct i802_bss *bss = priv;
7900         struct wpa_driver_nl80211_data *drv = bss->drv;
7901         int new_addr = addr != NULL;
7902
7903         if (!addr)
7904                 addr = drv->perm_addr;
7905
7906         if (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 0) < 0)
7907                 return -1;
7908
7909         if (linux_set_ifhwaddr(drv->global->ioctl_sock, bss->ifname, addr) < 0)
7910         {
7911                 wpa_printf(MSG_DEBUG,
7912                            "nl80211: failed to set_mac_addr for %s to " MACSTR,
7913                            bss->ifname, MAC2STR(addr));
7914                 if (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname,
7915                                           1) < 0) {
7916                         wpa_printf(MSG_DEBUG,
7917                                    "nl80211: Could not restore interface UP after failed set_mac_addr");
7918                 }
7919                 return -1;
7920         }
7921
7922         wpa_printf(MSG_DEBUG, "nl80211: set_mac_addr for %s to " MACSTR,
7923                    bss->ifname, MAC2STR(addr));
7924         drv->addr_changed = new_addr;
7925         os_memcpy(bss->addr, addr, ETH_ALEN);
7926
7927         if (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 1) < 0)
7928         {
7929                 wpa_printf(MSG_DEBUG,
7930                            "nl80211: Could not restore interface UP after set_mac_addr");
7931         }
7932
7933         return 0;
7934 }
7935
7936
7937 #ifdef CONFIG_MESH
7938
7939 static int wpa_driver_nl80211_init_mesh(void *priv)
7940 {
7941         if (wpa_driver_nl80211_set_mode(priv, NL80211_IFTYPE_MESH_POINT)) {
7942                 wpa_printf(MSG_INFO,
7943                            "nl80211: Failed to set interface into mesh mode");
7944                 return -1;
7945         }
7946         return 0;
7947 }
7948
7949
7950 static int nl80211_put_mesh_id(struct nl_msg *msg, const u8 *mesh_id,
7951                                size_t mesh_id_len)
7952 {
7953         if (mesh_id) {
7954                 wpa_hexdump_ascii(MSG_DEBUG, "  * Mesh ID (SSID)",
7955                                   mesh_id, mesh_id_len);
7956                 return nla_put(msg, NL80211_ATTR_MESH_ID, mesh_id_len, mesh_id);
7957         }
7958
7959         return 0;
7960 }
7961
7962
7963 static int nl80211_join_mesh(struct i802_bss *bss,
7964                              struct wpa_driver_mesh_join_params *params)
7965 {
7966         struct wpa_driver_nl80211_data *drv = bss->drv;
7967         struct nl_msg *msg;
7968         struct nlattr *container;
7969         int ret = -1;
7970
7971         wpa_printf(MSG_DEBUG, "nl80211: mesh join (ifindex=%d)", drv->ifindex);
7972         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_JOIN_MESH);
7973         if (!msg ||
7974             nl80211_put_freq_params(msg, &params->freq) ||
7975             nl80211_put_basic_rates(msg, params->basic_rates) ||
7976             nl80211_put_mesh_id(msg, params->meshid, params->meshid_len) ||
7977             nl80211_put_beacon_int(msg, params->beacon_int))
7978                 goto fail;
7979
7980         wpa_printf(MSG_DEBUG, "  * flags=%08X", params->flags);
7981
7982         container = nla_nest_start(msg, NL80211_ATTR_MESH_SETUP);
7983         if (!container)
7984                 goto fail;
7985
7986         if (params->ies) {
7987                 wpa_hexdump(MSG_DEBUG, "  * IEs", params->ies, params->ie_len);
7988                 if (nla_put(msg, NL80211_MESH_SETUP_IE, params->ie_len,
7989                             params->ies))
7990                         goto fail;
7991         }
7992         /* WPA_DRIVER_MESH_FLAG_OPEN_AUTH is treated as default by nl80211 */
7993         if (params->flags & WPA_DRIVER_MESH_FLAG_SAE_AUTH) {
7994                 if (nla_put_u8(msg, NL80211_MESH_SETUP_AUTH_PROTOCOL, 0x1) ||
7995                     nla_put_flag(msg, NL80211_MESH_SETUP_USERSPACE_AUTH))
7996                         goto fail;
7997         }
7998         if ((params->flags & WPA_DRIVER_MESH_FLAG_AMPE) &&
7999             nla_put_flag(msg, NL80211_MESH_SETUP_USERSPACE_AMPE))
8000                 goto fail;
8001         if ((params->flags & WPA_DRIVER_MESH_FLAG_USER_MPM) &&
8002             nla_put_flag(msg, NL80211_MESH_SETUP_USERSPACE_MPM))
8003                 goto fail;
8004         nla_nest_end(msg, container);
8005
8006         container = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
8007         if (!container)
8008                 goto fail;
8009
8010         if (!(params->conf.flags & WPA_DRIVER_MESH_CONF_FLAG_AUTO_PLINKS) &&
8011             nla_put_u32(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS, 0))
8012                 goto fail;
8013         if ((params->conf.flags & WPA_DRIVER_MESH_FLAG_DRIVER_MPM) &&
8014             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
8015                         params->max_peer_links))
8016                 goto fail;
8017
8018         /*
8019          * Set NL80211_MESHCONF_PLINK_TIMEOUT even if user mpm is used because
8020          * the timer could disconnect stations even in that case.
8021          */
8022         if (nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
8023                         params->conf.peer_link_timeout)) {
8024                 wpa_printf(MSG_ERROR, "nl80211: Failed to set PLINK_TIMEOUT");
8025                 goto fail;
8026         }
8027
8028         nla_nest_end(msg, container);
8029
8030         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8031         msg = NULL;
8032         if (ret) {
8033                 wpa_printf(MSG_DEBUG, "nl80211: mesh join failed: ret=%d (%s)",
8034                            ret, strerror(-ret));
8035                 goto fail;
8036         }
8037         ret = 0;
8038         bss->freq = params->freq.freq;
8039         wpa_printf(MSG_DEBUG, "nl80211: mesh join request send successfully");
8040
8041 fail:
8042         nlmsg_free(msg);
8043         return ret;
8044 }
8045
8046
8047 static int
8048 wpa_driver_nl80211_join_mesh(void *priv,
8049                              struct wpa_driver_mesh_join_params *params)
8050 {
8051         struct i802_bss *bss = priv;
8052         int ret, timeout;
8053
8054         timeout = params->conf.peer_link_timeout;
8055
8056         /* Disable kernel inactivity timer */
8057         if (params->flags & WPA_DRIVER_MESH_FLAG_USER_MPM)
8058                 params->conf.peer_link_timeout = 0;
8059
8060         ret = nl80211_join_mesh(bss, params);
8061         if (ret == -EINVAL && params->conf.peer_link_timeout == 0) {
8062                 wpa_printf(MSG_DEBUG,
8063                            "nl80211: Mesh join retry for peer_link_timeout");
8064                 /*
8065                  * Old kernel does not support setting
8066                  * NL80211_MESHCONF_PLINK_TIMEOUT to zero, so set 60 seconds
8067                  * into future from peer_link_timeout.
8068                  */
8069                 params->conf.peer_link_timeout = timeout + 60;
8070                 ret = nl80211_join_mesh(priv, params);
8071         }
8072
8073         params->conf.peer_link_timeout = timeout;
8074         return ret;
8075 }
8076
8077
8078 static int wpa_driver_nl80211_leave_mesh(void *priv)
8079 {
8080         struct i802_bss *bss = priv;
8081         struct wpa_driver_nl80211_data *drv = bss->drv;
8082         struct nl_msg *msg;
8083         int ret;
8084
8085         wpa_printf(MSG_DEBUG, "nl80211: mesh leave (ifindex=%d)", drv->ifindex);
8086         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_LEAVE_MESH);
8087         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8088         if (ret) {
8089                 wpa_printf(MSG_DEBUG, "nl80211: mesh leave failed: ret=%d (%s)",
8090                            ret, strerror(-ret));
8091         } else {
8092                 wpa_printf(MSG_DEBUG,
8093                            "nl80211: mesh leave request send successfully");
8094         }
8095
8096         if (wpa_driver_nl80211_set_mode(drv->first_bss,
8097                                         NL80211_IFTYPE_STATION)) {
8098                 wpa_printf(MSG_INFO,
8099                            "nl80211: Failed to set interface into station mode");
8100         }
8101         return ret;
8102 }
8103
8104 #endif /* CONFIG_MESH */
8105
8106
8107 static int wpa_driver_br_add_ip_neigh(void *priv, u8 version,
8108                                       const u8 *ipaddr, int prefixlen,
8109                                       const u8 *addr)
8110 {
8111 #ifdef CONFIG_LIBNL3_ROUTE
8112         struct i802_bss *bss = priv;
8113         struct wpa_driver_nl80211_data *drv = bss->drv;
8114         struct rtnl_neigh *rn;
8115         struct nl_addr *nl_ipaddr = NULL;
8116         struct nl_addr *nl_lladdr = NULL;
8117         int family, addrsize;
8118         int res;
8119
8120         if (!ipaddr || prefixlen == 0 || !addr)
8121                 return -EINVAL;
8122
8123         if (bss->br_ifindex == 0) {
8124                 wpa_printf(MSG_DEBUG,
8125                            "nl80211: bridge must be set before adding an ip neigh to it");
8126                 return -1;
8127         }
8128
8129         if (!drv->rtnl_sk) {
8130                 wpa_printf(MSG_DEBUG,
8131                            "nl80211: nl_sock for NETLINK_ROUTE is not initialized");
8132                 return -1;
8133         }
8134
8135         if (version == 4) {
8136                 family = AF_INET;
8137                 addrsize = 4;
8138         } else if (version == 6) {
8139                 family = AF_INET6;
8140                 addrsize = 16;
8141         } else {
8142                 return -EINVAL;
8143         }
8144
8145         rn = rtnl_neigh_alloc();
8146         if (rn == NULL)
8147                 return -ENOMEM;
8148
8149         /* set the destination ip address for neigh */
8150         nl_ipaddr = nl_addr_build(family, (void *) ipaddr, addrsize);
8151         if (nl_ipaddr == NULL) {
8152                 wpa_printf(MSG_DEBUG, "nl80211: nl_ipaddr build failed");
8153                 res = -ENOMEM;
8154                 goto errout;
8155         }
8156         nl_addr_set_prefixlen(nl_ipaddr, prefixlen);
8157         res = rtnl_neigh_set_dst(rn, nl_ipaddr);
8158         if (res) {
8159                 wpa_printf(MSG_DEBUG,
8160                            "nl80211: neigh set destination addr failed");
8161                 goto errout;
8162         }
8163
8164         /* set the corresponding lladdr for neigh */
8165         nl_lladdr = nl_addr_build(AF_BRIDGE, (u8 *) addr, ETH_ALEN);
8166         if (nl_lladdr == NULL) {
8167                 wpa_printf(MSG_DEBUG, "nl80211: neigh set lladdr failed");
8168                 res = -ENOMEM;
8169                 goto errout;
8170         }
8171         rtnl_neigh_set_lladdr(rn, nl_lladdr);
8172
8173         rtnl_neigh_set_ifindex(rn, bss->br_ifindex);
8174         rtnl_neigh_set_state(rn, NUD_PERMANENT);
8175
8176         res = rtnl_neigh_add(drv->rtnl_sk, rn, NLM_F_CREATE);
8177         if (res) {
8178                 wpa_printf(MSG_DEBUG,
8179                            "nl80211: Adding bridge ip neigh failed: %s",
8180                            strerror(errno));
8181         }
8182 errout:
8183         if (nl_lladdr)
8184                 nl_addr_put(nl_lladdr);
8185         if (nl_ipaddr)
8186                 nl_addr_put(nl_ipaddr);
8187         if (rn)
8188                 rtnl_neigh_put(rn);
8189         return res;
8190 #else /* CONFIG_LIBNL3_ROUTE */
8191         return -1;
8192 #endif /* CONFIG_LIBNL3_ROUTE */
8193 }
8194
8195
8196 static int wpa_driver_br_delete_ip_neigh(void *priv, u8 version,
8197                                          const u8 *ipaddr)
8198 {
8199 #ifdef CONFIG_LIBNL3_ROUTE
8200         struct i802_bss *bss = priv;
8201         struct wpa_driver_nl80211_data *drv = bss->drv;
8202         struct rtnl_neigh *rn;
8203         struct nl_addr *nl_ipaddr;
8204         int family, addrsize;
8205         int res;
8206
8207         if (!ipaddr)
8208                 return -EINVAL;
8209
8210         if (version == 4) {
8211                 family = AF_INET;
8212                 addrsize = 4;
8213         } else if (version == 6) {
8214                 family = AF_INET6;
8215                 addrsize = 16;
8216         } else {
8217                 return -EINVAL;
8218         }
8219
8220         if (bss->br_ifindex == 0) {
8221                 wpa_printf(MSG_DEBUG,
8222                            "nl80211: bridge must be set to delete an ip neigh");
8223                 return -1;
8224         }
8225
8226         if (!drv->rtnl_sk) {
8227                 wpa_printf(MSG_DEBUG,
8228                            "nl80211: nl_sock for NETLINK_ROUTE is not initialized");
8229                 return -1;
8230         }
8231
8232         rn = rtnl_neigh_alloc();
8233         if (rn == NULL)
8234                 return -ENOMEM;
8235
8236         /* set the destination ip address for neigh */
8237         nl_ipaddr = nl_addr_build(family, (void *) ipaddr, addrsize);
8238         if (nl_ipaddr == NULL) {
8239                 wpa_printf(MSG_DEBUG, "nl80211: nl_ipaddr build failed");
8240                 res = -ENOMEM;
8241                 goto errout;
8242         }
8243         res = rtnl_neigh_set_dst(rn, nl_ipaddr);
8244         if (res) {
8245                 wpa_printf(MSG_DEBUG,
8246                            "nl80211: neigh set destination addr failed");
8247                 goto errout;
8248         }
8249
8250         rtnl_neigh_set_ifindex(rn, bss->br_ifindex);
8251
8252         res = rtnl_neigh_delete(drv->rtnl_sk, rn, 0);
8253         if (res) {
8254                 wpa_printf(MSG_DEBUG,
8255                            "nl80211: Deleting bridge ip neigh failed: %s",
8256                            strerror(errno));
8257         }
8258 errout:
8259         if (nl_ipaddr)
8260                 nl_addr_put(nl_ipaddr);
8261         if (rn)
8262                 rtnl_neigh_put(rn);
8263         return res;
8264 #else /* CONFIG_LIBNL3_ROUTE */
8265         return -1;
8266 #endif /* CONFIG_LIBNL3_ROUTE */
8267 }
8268
8269
8270 static int linux_write_system_file(const char *path, unsigned int val)
8271 {
8272         char buf[50];
8273         int fd, len;
8274
8275         len = os_snprintf(buf, sizeof(buf), "%u\n", val);
8276         if (os_snprintf_error(sizeof(buf), len))
8277                 return -1;
8278
8279         fd = open(path, O_WRONLY);
8280         if (fd < 0)
8281                 return -1;
8282
8283         if (write(fd, buf, len) < 0) {
8284                 wpa_printf(MSG_DEBUG,
8285                            "nl80211: Failed to write Linux system file: %s with the value of %d",
8286                            path, val);
8287                 close(fd);
8288                 return -1;
8289         }
8290         close(fd);
8291
8292         return 0;
8293 }
8294
8295
8296 static const char * drv_br_port_attr_str(enum drv_br_port_attr attr)
8297 {
8298         switch (attr) {
8299         case DRV_BR_PORT_ATTR_PROXYARP:
8300                 return "proxyarp_wifi";
8301         case DRV_BR_PORT_ATTR_HAIRPIN_MODE:
8302                 return "hairpin_mode";
8303         }
8304
8305         return NULL;
8306 }
8307
8308
8309 static int wpa_driver_br_port_set_attr(void *priv, enum drv_br_port_attr attr,
8310                                        unsigned int val)
8311 {
8312         struct i802_bss *bss = priv;
8313         char path[128];
8314         const char *attr_txt;
8315
8316         attr_txt = drv_br_port_attr_str(attr);
8317         if (attr_txt == NULL)
8318                 return -EINVAL;
8319
8320         os_snprintf(path, sizeof(path), "/sys/class/net/%s/brport/%s",
8321                     bss->ifname, attr_txt);
8322
8323         if (linux_write_system_file(path, val))
8324                 return -1;
8325
8326         return 0;
8327 }
8328
8329
8330 static const char * drv_br_net_param_str(enum drv_br_net_param param)
8331 {
8332         switch (param) {
8333         case DRV_BR_NET_PARAM_GARP_ACCEPT:
8334                 return "arp_accept";
8335         default:
8336                 return NULL;
8337         }
8338 }
8339
8340
8341 static int wpa_driver_br_set_net_param(void *priv, enum drv_br_net_param param,
8342                                        unsigned int val)
8343 {
8344         struct i802_bss *bss = priv;
8345         char path[128];
8346         const char *param_txt;
8347         int ip_version = 4;
8348
8349         if (param == DRV_BR_MULTICAST_SNOOPING) {
8350                 os_snprintf(path, sizeof(path),
8351                             "/sys/devices/virtual/net/%s/bridge/multicast_snooping",
8352                             bss->brname);
8353                 goto set_val;
8354         }
8355
8356         param_txt = drv_br_net_param_str(param);
8357         if (param_txt == NULL)
8358                 return -EINVAL;
8359
8360         switch (param) {
8361                 case DRV_BR_NET_PARAM_GARP_ACCEPT:
8362                         ip_version = 4;
8363                         break;
8364                 default:
8365                         return -EINVAL;
8366         }
8367
8368         os_snprintf(path, sizeof(path), "/proc/sys/net/ipv%d/conf/%s/%s",
8369                     ip_version, bss->brname, param_txt);
8370
8371 set_val:
8372         if (linux_write_system_file(path, val))
8373                 return -1;
8374
8375         return 0;
8376 }
8377
8378
8379 static int hw_mode_to_qca_acs(enum hostapd_hw_mode hw_mode)
8380 {
8381         switch (hw_mode) {
8382         case HOSTAPD_MODE_IEEE80211B:
8383                 return QCA_ACS_MODE_IEEE80211B;
8384         case HOSTAPD_MODE_IEEE80211G:
8385                 return QCA_ACS_MODE_IEEE80211G;
8386         case HOSTAPD_MODE_IEEE80211A:
8387                 return QCA_ACS_MODE_IEEE80211A;
8388         case HOSTAPD_MODE_IEEE80211AD:
8389                 return QCA_ACS_MODE_IEEE80211AD;
8390         case HOSTAPD_MODE_IEEE80211ANY:
8391                 return QCA_ACS_MODE_IEEE80211ANY;
8392         default:
8393                 return -1;
8394         }
8395 }
8396
8397
8398 static int add_acs_freq_list(struct nl_msg *msg, const int *freq_list)
8399 {
8400         int i, len, ret;
8401         u32 *freqs;
8402
8403         if (!freq_list)
8404                 return 0;
8405         len = int_array_len(freq_list);
8406         freqs = os_malloc(sizeof(u32) * len);
8407         if (!freqs)
8408                 return -1;
8409         for (i = 0; i < len; i++)
8410                 freqs[i] = freq_list[i];
8411         ret = nla_put(msg, QCA_WLAN_VENDOR_ATTR_ACS_FREQ_LIST,
8412                       sizeof(u32) * len, freqs);
8413         os_free(freqs);
8414         return ret;
8415 }
8416
8417
8418 static int wpa_driver_do_acs(void *priv, struct drv_acs_params *params)
8419 {
8420         struct i802_bss *bss = priv;
8421         struct wpa_driver_nl80211_data *drv = bss->drv;
8422         struct nl_msg *msg;
8423         struct nlattr *data;
8424         int ret;
8425         int mode;
8426
8427         mode = hw_mode_to_qca_acs(params->hw_mode);
8428         if (mode < 0)
8429                 return -1;
8430
8431         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
8432             nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
8433             nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
8434                         QCA_NL80211_VENDOR_SUBCMD_DO_ACS) ||
8435             !(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
8436             nla_put_u8(msg, QCA_WLAN_VENDOR_ATTR_ACS_HW_MODE, mode) ||
8437             (params->ht_enabled &&
8438              nla_put_flag(msg, QCA_WLAN_VENDOR_ATTR_ACS_HT_ENABLED)) ||
8439             (params->ht40_enabled &&
8440              nla_put_flag(msg, QCA_WLAN_VENDOR_ATTR_ACS_HT40_ENABLED)) ||
8441             (params->vht_enabled &&
8442              nla_put_flag(msg, QCA_WLAN_VENDOR_ATTR_ACS_VHT_ENABLED)) ||
8443             nla_put_u16(msg, QCA_WLAN_VENDOR_ATTR_ACS_CHWIDTH,
8444                         params->ch_width) ||
8445             (params->ch_list_len &&
8446              nla_put(msg, QCA_WLAN_VENDOR_ATTR_ACS_CH_LIST, params->ch_list_len,
8447                      params->ch_list)) ||
8448             add_acs_freq_list(msg, params->freq_list)) {
8449                 nlmsg_free(msg);
8450                 return -ENOBUFS;
8451         }
8452         nla_nest_end(msg, data);
8453
8454         wpa_printf(MSG_DEBUG,
8455                    "nl80211: ACS Params: HW_MODE: %d HT: %d HT40: %d VHT: %d BW: %d CH_LIST_LEN: %u",
8456                    params->hw_mode, params->ht_enabled, params->ht40_enabled,
8457                    params->vht_enabled, params->ch_width, params->ch_list_len);
8458
8459         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8460         if (ret) {
8461                 wpa_printf(MSG_DEBUG,
8462                            "nl80211: Failed to invoke driver ACS function: %s",
8463                            strerror(errno));
8464         }
8465         return ret;
8466 }
8467
8468
8469 static int nl80211_set_band(void *priv, enum set_band band)
8470 {
8471         struct i802_bss *bss = priv;
8472         struct wpa_driver_nl80211_data *drv = bss->drv;
8473         struct nl_msg *msg;
8474         struct nlattr *data;
8475         int ret;
8476         enum qca_set_band qca_band;
8477
8478         if (!drv->setband_vendor_cmd_avail)
8479                 return -1;
8480
8481         switch (band) {
8482         case WPA_SETBAND_AUTO:
8483                 qca_band = QCA_SETBAND_AUTO;
8484                 break;
8485         case WPA_SETBAND_5G:
8486                 qca_band = QCA_SETBAND_5G;
8487                 break;
8488         case WPA_SETBAND_2G:
8489                 qca_band = QCA_SETBAND_2G;
8490                 break;
8491         default:
8492                 return -1;
8493         }
8494
8495         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
8496             nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
8497             nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
8498                         QCA_NL80211_VENDOR_SUBCMD_SETBAND) ||
8499             !(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
8500             nla_put_u32(msg, QCA_WLAN_VENDOR_ATTR_SETBAND_VALUE, qca_band)) {
8501                 nlmsg_free(msg);
8502                 return -ENOBUFS;
8503         }
8504         nla_nest_end(msg, data);
8505
8506         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8507         if (ret) {
8508                 wpa_printf(MSG_DEBUG,
8509                            "nl80211: Driver setband function failed: %s",
8510                            strerror(errno));
8511         }
8512         return ret;
8513 }
8514
8515
8516 struct nl80211_pcl {
8517         unsigned int num;
8518         unsigned int *freq_list;
8519 };
8520
8521 static int preferred_freq_info_handler(struct nl_msg *msg, void *arg)
8522 {
8523         struct nlattr *tb[NL80211_ATTR_MAX + 1];
8524         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
8525         struct nl80211_pcl *param = arg;
8526         struct nlattr *nl_vend, *attr;
8527         enum qca_iface_type iface_type;
8528         struct nlattr *tb_vendor[QCA_WLAN_VENDOR_ATTR_MAX + 1];
8529         unsigned int num, max_num;
8530         u32 *freqs;
8531
8532         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
8533                   genlmsg_attrlen(gnlh, 0), NULL);
8534
8535         nl_vend = tb[NL80211_ATTR_VENDOR_DATA];
8536         if (!nl_vend)
8537                 return NL_SKIP;
8538
8539         nla_parse(tb_vendor, QCA_WLAN_VENDOR_ATTR_MAX,
8540                   nla_data(nl_vend), nla_len(nl_vend), NULL);
8541
8542         attr = tb_vendor[
8543                 QCA_WLAN_VENDOR_ATTR_GET_PREFERRED_FREQ_LIST_IFACE_TYPE];
8544         if (!attr) {
8545                 wpa_printf(MSG_ERROR, "nl80211: iface_type couldn't be found");
8546                 param->num = 0;
8547                 return NL_SKIP;
8548         }
8549
8550         iface_type = (enum qca_iface_type) nla_get_u32(attr);
8551         wpa_printf(MSG_DEBUG, "nl80211: Driver returned iface_type=%d",
8552                    iface_type);
8553
8554         attr = tb_vendor[QCA_WLAN_VENDOR_ATTR_GET_PREFERRED_FREQ_LIST];
8555         if (!attr) {
8556                 wpa_printf(MSG_ERROR,
8557                            "nl80211: preferred_freq_list couldn't be found");
8558                 param->num = 0;
8559                 return NL_SKIP;
8560         }
8561
8562         /*
8563          * param->num has the maximum number of entries for which there
8564          * is room in the freq_list provided by the caller.
8565          */
8566         freqs = nla_data(attr);
8567         max_num = nla_len(attr) / sizeof(u32);
8568         if (max_num > param->num)
8569                 max_num = param->num;
8570         for (num = 0; num < max_num; num++)
8571                 param->freq_list[num] = freqs[num];
8572         param->num = num;
8573
8574         return NL_SKIP;
8575 }
8576
8577
8578 static int nl80211_get_pref_freq_list(void *priv,
8579                                       enum wpa_driver_if_type if_type,
8580                                       unsigned int *num,
8581                                       unsigned int *freq_list)
8582 {
8583         struct i802_bss *bss = priv;
8584         struct wpa_driver_nl80211_data *drv = bss->drv;
8585         struct nl_msg *msg;
8586         int ret;
8587         unsigned int i;
8588         struct nlattr *params;
8589         struct nl80211_pcl param;
8590         enum qca_iface_type iface_type;
8591
8592         if (!drv->get_pref_freq_list)
8593                 return -1;
8594
8595         switch (if_type) {
8596         case WPA_IF_STATION:
8597                 iface_type = QCA_IFACE_TYPE_STA;
8598                 break;
8599         case WPA_IF_AP_BSS:
8600                 iface_type = QCA_IFACE_TYPE_AP;
8601                 break;
8602         case WPA_IF_P2P_GO:
8603                 iface_type = QCA_IFACE_TYPE_P2P_GO;
8604                 break;
8605         case WPA_IF_P2P_CLIENT:
8606                 iface_type = QCA_IFACE_TYPE_P2P_CLIENT;
8607                 break;
8608         case WPA_IF_IBSS:
8609                 iface_type = QCA_IFACE_TYPE_IBSS;
8610                 break;
8611         case WPA_IF_TDLS:
8612                 iface_type = QCA_IFACE_TYPE_TDLS;
8613                 break;
8614         default:
8615                 return -1;
8616         }
8617
8618         param.num = *num;
8619         param.freq_list = freq_list;
8620
8621         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
8622             nla_put_u32(msg, NL80211_ATTR_IFINDEX, drv->ifindex) ||
8623             nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
8624             nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
8625                         QCA_NL80211_VENDOR_SUBCMD_GET_PREFERRED_FREQ_LIST) ||
8626             !(params = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
8627             nla_put_u32(msg,
8628                         QCA_WLAN_VENDOR_ATTR_GET_PREFERRED_FREQ_LIST_IFACE_TYPE,
8629                         iface_type)) {
8630                 wpa_printf(MSG_ERROR,
8631                            "%s: err in adding vendor_cmd and vendor_data",
8632                            __func__);
8633                 nlmsg_free(msg);
8634                 return -1;
8635         }
8636         nla_nest_end(msg, params);
8637
8638         os_memset(freq_list, 0, *num * sizeof(freq_list[0]));
8639         ret = send_and_recv_msgs(drv, msg, preferred_freq_info_handler, &param);
8640         if (ret) {
8641                 wpa_printf(MSG_ERROR,
8642                            "%s: err in send_and_recv_msgs", __func__);
8643                 return ret;
8644         }
8645
8646         *num = param.num;
8647
8648         for (i = 0; i < *num; i++) {
8649                 wpa_printf(MSG_DEBUG, "nl80211: preferred_channel_list[%d]=%d",
8650                            i, freq_list[i]);
8651         }
8652
8653         return 0;
8654 }
8655
8656
8657 static int nl80211_set_prob_oper_freq(void *priv, unsigned int freq)
8658 {
8659         struct i802_bss *bss = priv;
8660         struct wpa_driver_nl80211_data *drv = bss->drv;
8661         struct nl_msg *msg;
8662         int ret;
8663         struct nlattr *params;
8664
8665         if (!drv->set_prob_oper_freq)
8666                 return -1;
8667
8668         wpa_printf(MSG_DEBUG,
8669                    "nl80211: Set P2P probable operating freq %u for ifindex %d",
8670                    freq, bss->ifindex);
8671
8672         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
8673             nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
8674             nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
8675                         QCA_NL80211_VENDOR_SUBCMD_SET_PROBABLE_OPER_CHANNEL) ||
8676             !(params = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
8677             nla_put_u32(msg,
8678                         QCA_WLAN_VENDOR_ATTR_PROBABLE_OPER_CHANNEL_IFACE_TYPE,
8679                         QCA_IFACE_TYPE_P2P_CLIENT) ||
8680             nla_put_u32(msg,
8681                         QCA_WLAN_VENDOR_ATTR_PROBABLE_OPER_CHANNEL_FREQ,
8682                         freq)) {
8683                 wpa_printf(MSG_ERROR,
8684                            "%s: err in adding vendor_cmd and vendor_data",
8685                            __func__);
8686                 nlmsg_free(msg);
8687                 return -1;
8688         }
8689         nla_nest_end(msg, params);
8690
8691         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8692         msg = NULL;
8693         if (ret) {
8694                 wpa_printf(MSG_ERROR, "%s: err in send_and_recv_msgs",
8695                            __func__);
8696                 return ret;
8697         }
8698         nlmsg_free(msg);
8699         return 0;
8700 }
8701
8702
8703 const struct wpa_driver_ops wpa_driver_nl80211_ops = {
8704         .name = "nl80211",
8705         .desc = "Linux nl80211/cfg80211",
8706         .get_bssid = wpa_driver_nl80211_get_bssid,
8707         .get_ssid = wpa_driver_nl80211_get_ssid,
8708         .set_key = driver_nl80211_set_key,
8709         .scan2 = driver_nl80211_scan2,
8710         .sched_scan = wpa_driver_nl80211_sched_scan,
8711         .stop_sched_scan = wpa_driver_nl80211_stop_sched_scan,
8712         .get_scan_results2 = wpa_driver_nl80211_get_scan_results,
8713         .deauthenticate = driver_nl80211_deauthenticate,
8714         .authenticate = driver_nl80211_authenticate,
8715         .associate = wpa_driver_nl80211_associate,
8716         .global_init = nl80211_global_init,
8717         .global_deinit = nl80211_global_deinit,
8718         .init2 = wpa_driver_nl80211_init,
8719         .deinit = driver_nl80211_deinit,
8720         .get_capa = wpa_driver_nl80211_get_capa,
8721         .set_operstate = wpa_driver_nl80211_set_operstate,
8722         .set_supp_port = wpa_driver_nl80211_set_supp_port,
8723         .set_country = wpa_driver_nl80211_set_country,
8724         .get_country = wpa_driver_nl80211_get_country,
8725         .set_ap = wpa_driver_nl80211_set_ap,
8726         .set_acl = wpa_driver_nl80211_set_acl,
8727         .if_add = wpa_driver_nl80211_if_add,
8728         .if_remove = driver_nl80211_if_remove,
8729         .send_mlme = driver_nl80211_send_mlme,
8730         .get_hw_feature_data = nl80211_get_hw_feature_data,
8731         .sta_add = wpa_driver_nl80211_sta_add,
8732         .sta_remove = driver_nl80211_sta_remove,
8733         .hapd_send_eapol = wpa_driver_nl80211_hapd_send_eapol,
8734         .sta_set_flags = wpa_driver_nl80211_sta_set_flags,
8735         .hapd_init = i802_init,
8736         .hapd_deinit = i802_deinit,
8737         .set_wds_sta = i802_set_wds_sta,
8738         .get_seqnum = i802_get_seqnum,
8739         .flush = i802_flush,
8740         .get_inact_sec = i802_get_inact_sec,
8741         .sta_clear_stats = i802_sta_clear_stats,
8742         .set_rts = i802_set_rts,
8743         .set_frag = i802_set_frag,
8744         .set_tx_queue_params = i802_set_tx_queue_params,
8745         .set_sta_vlan = driver_nl80211_set_sta_vlan,
8746         .sta_deauth = i802_sta_deauth,
8747         .sta_disassoc = i802_sta_disassoc,
8748         .read_sta_data = driver_nl80211_read_sta_data,
8749         .set_freq = i802_set_freq,
8750         .send_action = driver_nl80211_send_action,
8751         .send_action_cancel_wait = wpa_driver_nl80211_send_action_cancel_wait,
8752         .remain_on_channel = wpa_driver_nl80211_remain_on_channel,
8753         .cancel_remain_on_channel =
8754         wpa_driver_nl80211_cancel_remain_on_channel,
8755         .probe_req_report = driver_nl80211_probe_req_report,
8756         .deinit_ap = wpa_driver_nl80211_deinit_ap,
8757         .deinit_p2p_cli = wpa_driver_nl80211_deinit_p2p_cli,
8758         .resume = wpa_driver_nl80211_resume,
8759         .signal_monitor = nl80211_signal_monitor,
8760         .signal_poll = nl80211_signal_poll,
8761         .send_frame = nl80211_send_frame,
8762         .set_param = nl80211_set_param,
8763         .get_radio_name = nl80211_get_radio_name,
8764         .add_pmkid = nl80211_add_pmkid,
8765         .remove_pmkid = nl80211_remove_pmkid,
8766         .flush_pmkid = nl80211_flush_pmkid,
8767         .set_rekey_info = nl80211_set_rekey_info,
8768         .poll_client = nl80211_poll_client,
8769         .set_p2p_powersave = nl80211_set_p2p_powersave,
8770         .start_dfs_cac = nl80211_start_radar_detection,
8771         .stop_ap = wpa_driver_nl80211_stop_ap,
8772 #ifdef CONFIG_TDLS
8773         .send_tdls_mgmt = nl80211_send_tdls_mgmt,
8774         .tdls_oper = nl80211_tdls_oper,
8775         .tdls_enable_channel_switch = nl80211_tdls_enable_channel_switch,
8776         .tdls_disable_channel_switch = nl80211_tdls_disable_channel_switch,
8777 #endif /* CONFIG_TDLS */
8778         .update_ft_ies = wpa_driver_nl80211_update_ft_ies,
8779         .get_mac_addr = wpa_driver_nl80211_get_macaddr,
8780         .get_survey = wpa_driver_nl80211_get_survey,
8781         .status = wpa_driver_nl80211_status,
8782         .switch_channel = nl80211_switch_channel,
8783 #ifdef ANDROID_P2P
8784         .set_noa = wpa_driver_set_p2p_noa,
8785         .get_noa = wpa_driver_get_p2p_noa,
8786         .set_ap_wps_ie = wpa_driver_set_ap_wps_p2p_ie,
8787 #endif /* ANDROID_P2P */
8788 #ifdef ANDROID
8789 #ifndef ANDROID_LIB_STUB
8790         .driver_cmd = wpa_driver_nl80211_driver_cmd,
8791 #endif /* !ANDROID_LIB_STUB */
8792 #endif /* ANDROID */
8793         .vendor_cmd = nl80211_vendor_cmd,
8794         .set_qos_map = nl80211_set_qos_map,
8795         .set_wowlan = nl80211_set_wowlan,
8796         .roaming = nl80211_roaming,
8797         .set_mac_addr = nl80211_set_mac_addr,
8798 #ifdef CONFIG_MESH
8799         .init_mesh = wpa_driver_nl80211_init_mesh,
8800         .join_mesh = wpa_driver_nl80211_join_mesh,
8801         .leave_mesh = wpa_driver_nl80211_leave_mesh,
8802 #endif /* CONFIG_MESH */
8803         .br_add_ip_neigh = wpa_driver_br_add_ip_neigh,
8804         .br_delete_ip_neigh = wpa_driver_br_delete_ip_neigh,
8805         .br_port_set_attr = wpa_driver_br_port_set_attr,
8806         .br_set_net_param = wpa_driver_br_set_net_param,
8807         .add_tx_ts = nl80211_add_ts,
8808         .del_tx_ts = nl80211_del_ts,
8809         .do_acs = wpa_driver_do_acs,
8810         .set_band = nl80211_set_band,
8811         .get_pref_freq_list = nl80211_get_pref_freq_list,
8812         .set_prob_oper_freq = nl80211_set_prob_oper_freq,
8813 };