src/drivers/driver_nl80211.c

   1 /*
   2  * Driver interaction with Linux nl80211/cfg80211
   3  * Copyright (c) 2002-2015, Jouni Malinen <j@w1.fi>
   4  * Copyright (c) 2003-2004, Instant802 Networks, Inc.
   5  * Copyright (c) 2005-2006, Devicescape Software, Inc.
   6  * Copyright (c) 2007, Johannes Berg <johannes@sipsolutions.net>
   7  * Copyright (c) 2009-2010, Atheros Communications
   8  *
   9  * This software may be distributed under the terms of the BSD license.
  10  * See README for more details.
  11  */
  12
  13 #include "includes.h"
  14 #include <sys/types.h>
  15 #include <fcntl.h>
  16 #include <net/if.h>
  17 #include <netlink/genl/genl.h>
  18 #include <netlink/genl/ctrl.h>
  19 #ifdef CONFIG_LIBNL3_ROUTE
  20 #include <netlink/route/neighbour.h>
  21 #endif /* CONFIG_LIBNL3_ROUTE */
  22 #include <linux/rtnetlink.h>
  23 #include <netpacket/packet.h>
  24 #include <linux/errqueue.h>
  25
  26 #include "common.h"
  27 #include "eloop.h"
  28 #include "common/qca-vendor.h"
  29 #include "common/qca-vendor-attr.h"
  30 #include "common/ieee802_11_defs.h"
  31 #include "common/ieee802_11_common.h"
  32 #include "l2_packet/l2_packet.h"
  33 #include "netlink.h"
  34 #include "linux_defines.h"
  35 #include "linux_ioctl.h"
  36 #include "radiotap.h"
  37 #include "radiotap_iter.h"
  38 #include "rfkill.h"
  39 #include "driver_nl80211.h"
  40
  41
  42 #ifndef CONFIG_LIBNL20
  43 /*
  44  * libnl 1.1 has a bug, it tries to allocate socket numbers densely
  45  * but when you free a socket again it will mess up its bitmap and
  46  * and use the wrong number the next time it needs a socket ID.
  47  * Therefore, we wrap the handle alloc/destroy and add our own pid
  48  * accounting.
  49  */
  50 static uint32_t port_bitmap[32] = { 0 };
  51
  52 static struct nl_handle *nl80211_handle_alloc(void *cb)
  53 {
  54         struct nl_handle *handle;
  55         uint32_t pid = getpid() & 0x3FFFFF;
  56         int i;
  57
  58         handle = nl_handle_alloc_cb(cb);
  59
  60         for (i = 0; i < 1024; i++) {
  61                 if (port_bitmap[i / 32] & (1 << (i % 32)))
  62                         continue;
  63                 port_bitmap[i / 32] |= 1 << (i % 32);
  64                 pid += i << 22;
  65                 break;
  66         }
  67
  68         nl_socket_set_local_port(handle, pid);
  69
  70         return handle;
  71 }
  72
  73 static void nl80211_handle_destroy(struct nl_handle *handle)
  74 {
  75         uint32_t port = nl_socket_get_local_port(handle);
  76
  77         port >>= 22;
  78         port_bitmap[port / 32] &= ~(1 << (port % 32));
  79
  80         nl_handle_destroy(handle);
  81 }
  82 #endif /* CONFIG_LIBNL20 */
  83
  84
  85 #ifdef ANDROID
  86 /* system/core/libnl_2 does not include nl_socket_set_nonblocking() */
  87 #undef nl_socket_set_nonblocking
  88 #define nl_socket_set_nonblocking(h) android_nl_socket_set_nonblocking(h)
  89
  90 #endif /* ANDROID */
  91
  92
  93 static struct nl_handle * nl_create_handle(struct nl_cb *cb, const char *dbg)
  94 {
  95         struct nl_handle *handle;
  96
  97         handle = nl80211_handle_alloc(cb);
  98         if (handle == NULL) {
  99                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate netlink "
 100                            "callbacks (%s)", dbg);
 101                 return NULL;
 102         }
 103
 104         if (genl_connect(handle)) {
 105                 wpa_printf(MSG_ERROR, "nl80211: Failed to connect to generic "
 106                            "netlink (%s)", dbg);
 107                 nl80211_handle_destroy(handle);
 108                 return NULL;
 109         }
 110
 111         return handle;
 112 }
 113
 114
 115 static void nl_destroy_handles(struct nl_handle **handle)
 116 {
 117         if (*handle == NULL)
 118                 return;
 119         nl80211_handle_destroy(*handle);
 120         *handle = NULL;
 121 }
 122
 123
 124 #if __WORDSIZE == 64
 125 #define ELOOP_SOCKET_INVALID    (intptr_t) 0x8888888888888889ULL
 126 #else
 127 #define ELOOP_SOCKET_INVALID    (intptr_t) 0x88888889ULL
 128 #endif
 129
 130 static void nl80211_register_eloop_read(struct nl_handle **handle,
 131                                         eloop_sock_handler handler,
 132                                         void *eloop_data)
 133 {
 134 #ifdef CONFIG_LIBNL20
 135         /*
 136          * libnl uses a pretty small buffer (32 kB that gets converted to 64 kB)
 137          * by default. It is possible to hit that limit in some cases where
 138          * operations are blocked, e.g., with a burst of Deauthentication frames
 139          * to hostapd and STA entry deletion. Try to increase the buffer to make
 140          * this less likely to occur.
 141          */
 142         if (nl_socket_set_buffer_size(*handle, 262144, 0) < 0) {
 143                 wpa_printf(MSG_DEBUG,
 144                            "nl80211: Could not set nl_socket RX buffer size: %s",
 145                            strerror(errno));
 146                 /* continue anyway with the default (smaller) buffer */
 147         }
 148 #endif /* CONFIG_LIBNL20 */
 149
 150         nl_socket_set_nonblocking(*handle);
 151         eloop_register_read_sock(nl_socket_get_fd(*handle), handler,
 152                                  eloop_data, *handle);
 153         *handle = (void *) (((intptr_t) *handle) ^ ELOOP_SOCKET_INVALID);
 154 }
 155
 156
 157 static void nl80211_destroy_eloop_handle(struct nl_handle **handle)
 158 {
 159         *handle = (void *) (((intptr_t) *handle) ^ ELOOP_SOCKET_INVALID);
 160         eloop_unregister_read_sock(nl_socket_get_fd(*handle));
 161         nl_destroy_handles(handle);
 162 }
 163
 164
 165 static void nl80211_global_deinit(void *priv);
 166 static void nl80211_check_global(struct nl80211_global *global);
 167
 168 static void wpa_driver_nl80211_deinit(struct i802_bss *bss);
 169 static int wpa_driver_nl80211_set_mode_ibss(struct i802_bss *bss,
 170                                             struct hostapd_freq_params *freq);
 171
 172 static int
 173 wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv,
 174                                    const u8 *set_addr, int first,
 175                                    const char *driver_params);
 176 static int nl80211_send_frame_cmd(struct i802_bss *bss,
 177                                   unsigned int freq, unsigned int wait,
 178                                   const u8 *buf, size_t buf_len, u64 *cookie,
 179                                   int no_cck, int no_ack, int offchanok,
 180                                   const u16 *csa_offs, size_t csa_offs_len);
 181 static int wpa_driver_nl80211_probe_req_report(struct i802_bss *bss,
 182                                                int report);
 183
 184 #define IFIDX_ANY -1
 185
 186 static void add_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx,
 187                       int ifidx_reason);
 188 static void del_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx,
 189                       int ifidx_reason);
 190 static int have_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx,
 191                       int ifidx_reason);
 192
 193 static int nl80211_set_channel(struct i802_bss *bss,
 194                                struct hostapd_freq_params *freq, int set_chan);
 195 static int nl80211_disable_11b_rates(struct wpa_driver_nl80211_data *drv,
 196                                      int ifindex, int disabled);
 197
 198 static int nl80211_leave_ibss(struct wpa_driver_nl80211_data *drv,
 199                               int reset_mode);
 200
 201 static int i802_set_iface_flags(struct i802_bss *bss, int up);
 202 static int nl80211_set_param(void *priv, const char *param);
 203 #ifdef CONFIG_MESH
 204 static int nl80211_put_mesh_config(struct nl_msg *msg,
 205                                    struct wpa_driver_mesh_bss_params *params);
 206 #endif /* CONFIG_MESH */
 207
 208
 209 /* Converts nl80211_chan_width to a common format */
 210 enum chan_width convert2width(int width)
 211 {
 212         switch (width) {
 213         case NL80211_CHAN_WIDTH_20_NOHT:
 214                 return CHAN_WIDTH_20_NOHT;
 215         case NL80211_CHAN_WIDTH_20:
 216                 return CHAN_WIDTH_20;
 217         case NL80211_CHAN_WIDTH_40:
 218                 return CHAN_WIDTH_40;
 219         case NL80211_CHAN_WIDTH_80:
 220                 return CHAN_WIDTH_80;
 221         case NL80211_CHAN_WIDTH_80P80:
 222                 return CHAN_WIDTH_80P80;
 223         case NL80211_CHAN_WIDTH_160:
 224                 return CHAN_WIDTH_160;
 225         }
 226         return CHAN_WIDTH_UNKNOWN;
 227 }
 228
 229
 230 int is_ap_interface(enum nl80211_iftype nlmode)
 231 {
 232         return nlmode == NL80211_IFTYPE_AP ||
 233                 nlmode == NL80211_IFTYPE_P2P_GO;
 234 }
 235
 236
 237 int is_sta_interface(enum nl80211_iftype nlmode)
 238 {
 239         return nlmode == NL80211_IFTYPE_STATION ||
 240                 nlmode == NL80211_IFTYPE_P2P_CLIENT;
 241 }
 242
 243
 244 static int is_p2p_net_interface(enum nl80211_iftype nlmode)
 245 {
 246         return nlmode == NL80211_IFTYPE_P2P_CLIENT ||
 247                 nlmode == NL80211_IFTYPE_P2P_GO;
 248 }
 249
 250
 251 struct i802_bss * get_bss_ifindex(struct wpa_driver_nl80211_data *drv,
 252                                   int ifindex)
 253 {
 254         struct i802_bss *bss;
 255
 256         for (bss = drv->first_bss; bss; bss = bss->next) {
 257                 if (bss->ifindex == ifindex)
 258                         return bss;
 259         }
 260
 261         return NULL;
 262 }
 263
 264
 265 static int is_mesh_interface(enum nl80211_iftype nlmode)
 266 {
 267         return nlmode == NL80211_IFTYPE_MESH_POINT;
 268 }
 269
 270
 271 void nl80211_mark_disconnected(struct wpa_driver_nl80211_data *drv)
 272 {
 273         if (drv->associated)
 274                 os_memcpy(drv->prev_bssid, drv->bssid, ETH_ALEN);
 275         drv->associated = 0;
 276         os_memset(drv->bssid, 0, ETH_ALEN);
 277 }
 278
 279
 280 /* nl80211 code */
 281 static int ack_handler(struct nl_msg *msg, void *arg)
 282 {
 283         int *err = arg;
 284         *err = 0;
 285         return NL_STOP;
 286 }
 287
 288 static int finish_handler(struct nl_msg *msg, void *arg)
 289 {
 290         int *ret = arg;
 291         *ret = 0;
 292         return NL_SKIP;
 293 }
 294
 295 static int error_handler(struct sockaddr_nl *nla, struct nlmsgerr *err,
 296                          void *arg)
 297 {
 298         int *ret = arg;
 299         *ret = err->error;
 300         return NL_SKIP;
 301 }
 302
 303
 304 static int no_seq_check(struct nl_msg *msg, void *arg)
 305 {
 306         return NL_OK;
 307 }
 308
 309
 310 static void nl80211_nlmsg_clear(struct nl_msg *msg)
 311 {
 312         /*
 313          * Clear nlmsg data, e.g., to make sure key material is not left in
 314          * heap memory for unnecessarily long time.
 315          */
 316         if (msg) {
 317                 struct nlmsghdr *hdr = nlmsg_hdr(msg);
 318                 void *data = nlmsg_data(hdr);
 319                 /*
 320                  * This would use nlmsg_datalen() or the older nlmsg_len() if
 321                  * only libnl were to maintain a stable API.. Neither will work
 322                  * with all released versions, so just calculate the length
 323                  * here.
 324                  */
 325                 int len = hdr->nlmsg_len - NLMSG_HDRLEN;
 326
 327                 os_memset(data, 0, len);
 328         }
 329 }
 330
 331
 332 static int send_and_recv(struct nl80211_global *global,
 333                          struct nl_handle *nl_handle, struct nl_msg *msg,
 334                          int (*valid_handler)(struct nl_msg *, void *),
 335                          void *valid_data)
 336 {
 337         struct nl_cb *cb;
 338         int err = -ENOMEM;
 339
 340         if (!msg)
 341                 return -ENOMEM;
 342
 343         cb = nl_cb_clone(global->nl_cb);
 344         if (!cb)
 345                 goto out;
 346
 347         err = nl_send_auto_complete(nl_handle, msg);
 348         if (err < 0)
 349                 goto out;
 350
 351         err = 1;
 352
 353         nl_cb_err(cb, NL_CB_CUSTOM, error_handler, &err);
 354         nl_cb_set(cb, NL_CB_FINISH, NL_CB_CUSTOM, finish_handler, &err);
 355         nl_cb_set(cb, NL_CB_ACK, NL_CB_CUSTOM, ack_handler, &err);
 356
 357         if (valid_handler)
 358                 nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM,
 359                           valid_handler, valid_data);
 360
 361         while (err > 0) {
 362                 int res = nl_recvmsgs(nl_handle, cb);
 363                 if (res < 0) {
 364                         wpa_printf(MSG_INFO,
 365                                    "nl80211: %s->nl_recvmsgs failed: %d",
 366                                    __func__, res);
 367                 }
 368         }
 369  out:
 370         nl_cb_put(cb);
 371         if (!valid_handler && valid_data == (void *) -1)
 372                 nl80211_nlmsg_clear(msg);
 373         nlmsg_free(msg);
 374         return err;
 375 }
 376
 377
 378 int send_and_recv_msgs(struct wpa_driver_nl80211_data *drv,
 379                        struct nl_msg *msg,
 380                        int (*valid_handler)(struct nl_msg *, void *),
 381                        void *valid_data)
 382 {
 383         return send_and_recv(drv->global, drv->global->nl, msg,
 384                              valid_handler, valid_data);
 385 }
 386
 387
 388 struct family_data {
 389         const char *group;
 390         int id;
 391 };
 392
 393
 394 static int family_handler(struct nl_msg *msg, void *arg)
 395 {
 396         struct family_data *res = arg;
 397         struct nlattr *tb[CTRL_ATTR_MAX + 1];
 398         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 399         struct nlattr *mcgrp;
 400         int i;
 401
 402         nla_parse(tb, CTRL_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 403                   genlmsg_attrlen(gnlh, 0), NULL);
 404         if (!tb[CTRL_ATTR_MCAST_GROUPS])
 405                 return NL_SKIP;
 406
 407         nla_for_each_nested(mcgrp, tb[CTRL_ATTR_MCAST_GROUPS], i) {
 408                 struct nlattr *tb2[CTRL_ATTR_MCAST_GRP_MAX + 1];
 409                 nla_parse(tb2, CTRL_ATTR_MCAST_GRP_MAX, nla_data(mcgrp),
 410                           nla_len(mcgrp), NULL);
 411                 if (!tb2[CTRL_ATTR_MCAST_GRP_NAME] ||
 412                     !tb2[CTRL_ATTR_MCAST_GRP_ID] ||
 413                     os_strncmp(nla_data(tb2[CTRL_ATTR_MCAST_GRP_NAME]),
 414                                res->group,
 415                                nla_len(tb2[CTRL_ATTR_MCAST_GRP_NAME])) != 0)
 416                         continue;
 417                 res->id = nla_get_u32(tb2[CTRL_ATTR_MCAST_GRP_ID]);
 418                 break;
 419         };
 420
 421         return NL_SKIP;
 422 }
 423
 424
 425 static int nl_get_multicast_id(struct nl80211_global *global,
 426                                const char *family, const char *group)
 427 {
 428         struct nl_msg *msg;
 429         int ret;
 430         struct family_data res = { group, -ENOENT };
 431
 432         msg = nlmsg_alloc();
 433         if (!msg)
 434                 return -ENOMEM;
 435         if (!genlmsg_put(msg, 0, 0, genl_ctrl_resolve(global->nl, "nlctrl"),
 436                          0, 0, CTRL_CMD_GETFAMILY, 0) ||
 437             nla_put_string(msg, CTRL_ATTR_FAMILY_NAME, family)) {
 438                 nlmsg_free(msg);
 439                 return -1;
 440         }
 441
 442         ret = send_and_recv(global, global->nl, msg, family_handler, &res);
 443         if (ret == 0)
 444                 ret = res.id;
 445         return ret;
 446 }
 447
 448
 449 void * nl80211_cmd(struct wpa_driver_nl80211_data *drv,
 450                    struct nl_msg *msg, int flags, uint8_t cmd)
 451 {
 452         if (TEST_FAIL())
 453                 return NULL;
 454         return genlmsg_put(msg, 0, 0, drv->global->nl80211_id,
 455                            0, flags, cmd, 0);
 456 }
 457
 458
 459 static int nl80211_set_iface_id(struct nl_msg *msg, struct i802_bss *bss)
 460 {
 461         if (bss->wdev_id_set)
 462                 return nla_put_u64(msg, NL80211_ATTR_WDEV, bss->wdev_id);
 463         return nla_put_u32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
 464 }
 465
 466
 467 struct nl_msg * nl80211_cmd_msg(struct i802_bss *bss, int flags, uint8_t cmd)
 468 {
 469         struct nl_msg *msg;
 470
 471         msg = nlmsg_alloc();
 472         if (!msg)
 473                 return NULL;
 474
 475         if (!nl80211_cmd(bss->drv, msg, flags, cmd) ||
 476             nl80211_set_iface_id(msg, bss) < 0) {
 477                 nlmsg_free(msg);
 478                 return NULL;
 479         }
 480
 481         return msg;
 482 }
 483
 484
 485 static struct nl_msg *
 486 nl80211_ifindex_msg(struct wpa_driver_nl80211_data *drv, int ifindex,
 487                     int flags, uint8_t cmd)
 488 {
 489         struct nl_msg *msg;
 490
 491         msg = nlmsg_alloc();
 492         if (!msg)
 493                 return NULL;
 494
 495         if (!nl80211_cmd(drv, msg, flags, cmd) ||
 496             nla_put_u32(msg, NL80211_ATTR_IFINDEX, ifindex)) {
 497                 nlmsg_free(msg);
 498                 return NULL;
 499         }
 500
 501         return msg;
 502 }
 503
 504
 505 struct nl_msg * nl80211_drv_msg(struct wpa_driver_nl80211_data *drv, int flags,
 506                                 uint8_t cmd)
 507 {
 508         return nl80211_ifindex_msg(drv, drv->ifindex, flags, cmd);
 509 }
 510
 511
 512 struct nl_msg * nl80211_bss_msg(struct i802_bss *bss, int flags, uint8_t cmd)
 513 {
 514         return nl80211_ifindex_msg(bss->drv, bss->ifindex, flags, cmd);
 515 }
 516
 517
 518 struct wiphy_idx_data {
 519         int wiphy_idx;
 520         enum nl80211_iftype nlmode;
 521         u8 *macaddr;
 522 };
 523
 524
 525 static int netdev_info_handler(struct nl_msg *msg, void *arg)
 526 {
 527         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 528         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 529         struct wiphy_idx_data *info = arg;
 530
 531         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 532                   genlmsg_attrlen(gnlh, 0), NULL);
 533
 534         if (tb[NL80211_ATTR_WIPHY])
 535                 info->wiphy_idx = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
 536
 537         if (tb[NL80211_ATTR_IFTYPE])
 538                 info->nlmode = nla_get_u32(tb[NL80211_ATTR_IFTYPE]);
 539
 540         if (tb[NL80211_ATTR_MAC] && info->macaddr)
 541                 os_memcpy(info->macaddr, nla_data(tb[NL80211_ATTR_MAC]),
 542                           ETH_ALEN);
 543
 544         return NL_SKIP;
 545 }
 546
 547
 548 int nl80211_get_wiphy_index(struct i802_bss *bss)
 549 {
 550         struct nl_msg *msg;
 551         struct wiphy_idx_data data = {
 552                 .wiphy_idx = -1,
 553                 .macaddr = NULL,
 554         };
 555
 556         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_GET_INTERFACE)))
 557                 return -1;
 558
 559         if (send_and_recv_msgs(bss->drv, msg, netdev_info_handler, &data) == 0)
 560                 return data.wiphy_idx;
 561         return -1;
 562 }
 563
 564
 565 static enum nl80211_iftype nl80211_get_ifmode(struct i802_bss *bss)
 566 {
 567         struct nl_msg *msg;
 568         struct wiphy_idx_data data = {
 569                 .nlmode = NL80211_IFTYPE_UNSPECIFIED,
 570                 .macaddr = NULL,
 571         };
 572
 573         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_GET_INTERFACE)))
 574                 return NL80211_IFTYPE_UNSPECIFIED;
 575
 576         if (send_and_recv_msgs(bss->drv, msg, netdev_info_handler, &data) == 0)
 577                 return data.nlmode;
 578         return NL80211_IFTYPE_UNSPECIFIED;
 579 }
 580
 581
 582 static int nl80211_get_macaddr(struct i802_bss *bss)
 583 {
 584         struct nl_msg *msg;
 585         struct wiphy_idx_data data = {
 586                 .macaddr = bss->addr,
 587         };
 588
 589         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_GET_INTERFACE)))
 590                 return -1;
 591
 592         return send_and_recv_msgs(bss->drv, msg, netdev_info_handler, &data);
 593 }
 594
 595
 596 static int nl80211_register_beacons(struct wpa_driver_nl80211_data *drv,
 597                                     struct nl80211_wiphy_data *w)
 598 {
 599         struct nl_msg *msg;
 600         int ret;
 601
 602         msg = nlmsg_alloc();
 603         if (!msg)
 604                 return -1;
 605
 606         if (!nl80211_cmd(drv, msg, 0, NL80211_CMD_REGISTER_BEACONS) ||
 607             nla_put_u32(msg, NL80211_ATTR_WIPHY, w->wiphy_idx)) {
 608                 nlmsg_free(msg);
 609                 return -1;
 610         }
 611
 612         ret = send_and_recv(drv->global, w->nl_beacons, msg, NULL, NULL);
 613         if (ret) {
 614                 wpa_printf(MSG_DEBUG, "nl80211: Register beacons command "
 615                            "failed: ret=%d (%s)",
 616                            ret, strerror(-ret));
 617         }
 618         return ret;
 619 }
 620
 621
 622 static void nl80211_recv_beacons(int sock, void *eloop_ctx, void *handle)
 623 {
 624         struct nl80211_wiphy_data *w = eloop_ctx;
 625         int res;
 626
 627         wpa_printf(MSG_EXCESSIVE, "nl80211: Beacon event message available");
 628
 629         res = nl_recvmsgs(handle, w->nl_cb);
 630         if (res < 0) {
 631                 wpa_printf(MSG_INFO, "nl80211: %s->nl_recvmsgs failed: %d",
 632                            __func__, res);
 633         }
 634 }
 635
 636
 637 static int process_beacon_event(struct nl_msg *msg, void *arg)
 638 {
 639         struct nl80211_wiphy_data *w = arg;
 640         struct wpa_driver_nl80211_data *drv;
 641         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 642         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 643         union wpa_event_data event;
 644
 645         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 646                   genlmsg_attrlen(gnlh, 0), NULL);
 647
 648         if (gnlh->cmd != NL80211_CMD_FRAME) {
 649                 wpa_printf(MSG_DEBUG, "nl80211: Unexpected beacon event? (%d)",
 650                            gnlh->cmd);
 651                 return NL_SKIP;
 652         }
 653
 654         if (!tb[NL80211_ATTR_FRAME])
 655                 return NL_SKIP;
 656
 657         dl_list_for_each(drv, &w->drvs, struct wpa_driver_nl80211_data,
 658                          wiphy_list) {
 659                 os_memset(&event, 0, sizeof(event));
 660                 event.rx_mgmt.frame = nla_data(tb[NL80211_ATTR_FRAME]);
 661                 event.rx_mgmt.frame_len = nla_len(tb[NL80211_ATTR_FRAME]);
 662                 wpa_supplicant_event(drv->ctx, EVENT_RX_MGMT, &event);
 663         }
 664
 665         return NL_SKIP;
 666 }
 667
 668
 669 static struct nl80211_wiphy_data *
 670 nl80211_get_wiphy_data_ap(struct i802_bss *bss)
 671 {
 672         static DEFINE_DL_LIST(nl80211_wiphys);
 673         struct nl80211_wiphy_data *w;
 674         int wiphy_idx, found = 0;
 675         struct i802_bss *tmp_bss;
 676
 677         if (bss->wiphy_data != NULL)
 678                 return bss->wiphy_data;
 679
 680         wiphy_idx = nl80211_get_wiphy_index(bss);
 681
 682         dl_list_for_each(w, &nl80211_wiphys, struct nl80211_wiphy_data, list) {
 683                 if (w->wiphy_idx == wiphy_idx)
 684                         goto add;
 685         }
 686
 687         /* alloc new one */
 688         w = os_zalloc(sizeof(*w));
 689         if (w == NULL)
 690                 return NULL;
 691         w->wiphy_idx = wiphy_idx;
 692         dl_list_init(&w->bsss);
 693         dl_list_init(&w->drvs);
 694
 695         w->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
 696         if (!w->nl_cb) {
 697                 os_free(w);
 698                 return NULL;
 699         }
 700         nl_cb_set(w->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM, no_seq_check, NULL);
 701         nl_cb_set(w->nl_cb, NL_CB_VALID, NL_CB_CUSTOM, process_beacon_event,
 702                   w);
 703
 704         w->nl_beacons = nl_create_handle(bss->drv->global->nl_cb,
 705                                          "wiphy beacons");
 706         if (w->nl_beacons == NULL) {
 707                 os_free(w);
 708                 return NULL;
 709         }
 710
 711         if (nl80211_register_beacons(bss->drv, w)) {
 712                 nl_destroy_handles(&w->nl_beacons);
 713                 os_free(w);
 714                 return NULL;
 715         }
 716
 717         nl80211_register_eloop_read(&w->nl_beacons, nl80211_recv_beacons, w);
 718
 719         dl_list_add(&nl80211_wiphys, &w->list);
 720
 721 add:
 722         /* drv entry for this bss already there? */
 723         dl_list_for_each(tmp_bss, &w->bsss, struct i802_bss, wiphy_list) {
 724                 if (tmp_bss->drv == bss->drv) {
 725                         found = 1;
 726                         break;
 727                 }
 728         }
 729         /* if not add it */
 730         if (!found)
 731                 dl_list_add(&w->drvs, &bss->drv->wiphy_list);
 732
 733         dl_list_add(&w->bsss, &bss->wiphy_list);
 734         bss->wiphy_data = w;
 735         return w;
 736 }
 737
 738
 739 static void nl80211_put_wiphy_data_ap(struct i802_bss *bss)
 740 {
 741         struct nl80211_wiphy_data *w = bss->wiphy_data;
 742         struct i802_bss *tmp_bss;
 743         int found = 0;
 744
 745         if (w == NULL)
 746                 return;
 747         bss->wiphy_data = NULL;
 748         dl_list_del(&bss->wiphy_list);
 749
 750         /* still any for this drv present? */
 751         dl_list_for_each(tmp_bss, &w->bsss, struct i802_bss, wiphy_list) {
 752                 if (tmp_bss->drv == bss->drv) {
 753                         found = 1;
 754                         break;
 755                 }
 756         }
 757         /* if not remove it */
 758         if (!found)
 759                 dl_list_del(&bss->drv->wiphy_list);
 760
 761         if (!dl_list_empty(&w->bsss))
 762                 return;
 763
 764         nl80211_destroy_eloop_handle(&w->nl_beacons);
 765
 766         nl_cb_put(w->nl_cb);
 767         dl_list_del(&w->list);
 768         os_free(w);
 769 }
 770
 771
 772 static unsigned int nl80211_get_ifindex(void *priv)
 773 {
 774         struct i802_bss *bss = priv;
 775         struct wpa_driver_nl80211_data *drv = bss->drv;
 776
 777         return drv->ifindex;
 778 }
 779
 780
 781 static int wpa_driver_nl80211_get_bssid(void *priv, u8 *bssid)
 782 {
 783         struct i802_bss *bss = priv;
 784         struct wpa_driver_nl80211_data *drv = bss->drv;
 785         if (!drv->associated)
 786                 return -1;
 787         os_memcpy(bssid, drv->bssid, ETH_ALEN);
 788         return 0;
 789 }
 790
 791
 792 static int wpa_driver_nl80211_get_ssid(void *priv, u8 *ssid)
 793 {
 794         struct i802_bss *bss = priv;
 795         struct wpa_driver_nl80211_data *drv = bss->drv;
 796         if (!drv->associated)
 797                 return -1;
 798         os_memcpy(ssid, drv->ssid, drv->ssid_len);
 799         return drv->ssid_len;
 800 }
 801
 802
 803 static void wpa_driver_nl80211_event_newlink(
 804         struct nl80211_global *global, struct wpa_driver_nl80211_data *drv,
 805         int ifindex, const char *ifname)
 806 {
 807         union wpa_event_data event;
 808
 809         if (drv && os_strcmp(drv->first_bss->ifname, ifname) == 0) {
 810                 if (if_nametoindex(drv->first_bss->ifname) == 0) {
 811                         wpa_printf(MSG_DEBUG, "nl80211: Interface %s does not exist - ignore RTM_NEWLINK",
 812                                    drv->first_bss->ifname);
 813                         return;
 814                 }
 815                 if (!drv->if_removed)
 816                         return;
 817                 wpa_printf(MSG_DEBUG, "nl80211: Mark if_removed=0 for %s based on RTM_NEWLINK event",
 818                            drv->first_bss->ifname);
 819                 drv->if_removed = 0;
 820         }
 821
 822         os_memset(&event, 0, sizeof(event));
 823         event.interface_status.ifindex = ifindex;
 824         os_strlcpy(event.interface_status.ifname, ifname,
 825                    sizeof(event.interface_status.ifname));
 826         event.interface_status.ievent = EVENT_INTERFACE_ADDED;
 827         if (drv)
 828                 wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_STATUS, &event);
 829         else
 830                 wpa_supplicant_event_global(global->ctx, EVENT_INTERFACE_STATUS,
 831                                             &event);
 832 }
 833
 834
 835 static void wpa_driver_nl80211_event_dellink(
 836         struct nl80211_global *global, struct wpa_driver_nl80211_data *drv,
 837         int ifindex, const char *ifname)
 838 {
 839         union wpa_event_data event;
 840
 841         if (drv && os_strcmp(drv->first_bss->ifname, ifname) == 0) {
 842                 if (drv->if_removed) {
 843                         wpa_printf(MSG_DEBUG, "nl80211: if_removed already set - ignore RTM_DELLINK event for %s",
 844                                    ifname);
 845                         return;
 846                 }
 847                 wpa_printf(MSG_DEBUG, "RTM_DELLINK: Interface '%s' removed - mark if_removed=1",
 848                            ifname);
 849                 drv->if_removed = 1;
 850         } else {
 851                 wpa_printf(MSG_DEBUG, "RTM_DELLINK: Interface '%s' removed",
 852                            ifname);
 853         }
 854
 855         os_memset(&event, 0, sizeof(event));
 856         event.interface_status.ifindex = ifindex;
 857         os_strlcpy(event.interface_status.ifname, ifname,
 858                    sizeof(event.interface_status.ifname));
 859         event.interface_status.ievent = EVENT_INTERFACE_REMOVED;
 860         if (drv)
 861                 wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_STATUS, &event);
 862         else
 863                 wpa_supplicant_event_global(global->ctx, EVENT_INTERFACE_STATUS,
 864                                             &event);
 865 }
 866
 867
 868 static int wpa_driver_nl80211_own_ifname(struct wpa_driver_nl80211_data *drv,
 869                                          u8 *buf, size_t len)
 870 {
 871         int attrlen, rta_len;
 872         struct rtattr *attr;
 873
 874         attrlen = len;
 875         attr = (struct rtattr *) buf;
 876
 877         rta_len = RTA_ALIGN(sizeof(struct rtattr));
 878         while (RTA_OK(attr, attrlen)) {
 879                 if (attr->rta_type == IFLA_IFNAME) {
 880                         if (os_strcmp(((char *) attr) + rta_len,
 881                                       drv->first_bss->ifname) == 0)
 882                                 return 1;
 883                         else
 884                                 break;
 885                 }
 886                 attr = RTA_NEXT(attr, attrlen);
 887         }
 888
 889         return 0;
 890 }
 891
 892
 893 static int wpa_driver_nl80211_own_ifindex(struct wpa_driver_nl80211_data *drv,
 894                                           int ifindex, u8 *buf, size_t len)
 895 {
 896         if (drv->ifindex == ifindex)
 897                 return 1;
 898
 899         if (drv->if_removed && wpa_driver_nl80211_own_ifname(drv, buf, len)) {
 900                 nl80211_check_global(drv->global);
 901                 wpa_printf(MSG_DEBUG, "nl80211: Update ifindex for a removed "
 902                            "interface");
 903                 wpa_driver_nl80211_finish_drv_init(drv, NULL, 0, NULL);
 904                 return 1;
 905         }
 906
 907         return 0;
 908 }
 909
 910
 911 static struct wpa_driver_nl80211_data *
 912 nl80211_find_drv(struct nl80211_global *global, int idx, u8 *buf, size_t len)
 913 {
 914         struct wpa_driver_nl80211_data *drv;
 915         dl_list_for_each(drv, &global->interfaces,
 916                          struct wpa_driver_nl80211_data, list) {
 917                 if (wpa_driver_nl80211_own_ifindex(drv, idx, buf, len) ||
 918                     have_ifidx(drv, idx, IFIDX_ANY))
 919                         return drv;
 920         }
 921         return NULL;
 922 }
 923
 924
 925 static void wpa_driver_nl80211_event_rtm_newlink(void *ctx,
 926                                                  struct ifinfomsg *ifi,
 927                                                  u8 *buf, size_t len)
 928 {
 929         struct nl80211_global *global = ctx;
 930         struct wpa_driver_nl80211_data *drv;
 931         int attrlen;
 932         struct rtattr *attr;
 933         u32 brid = 0;
 934         char namebuf[IFNAMSIZ];
 935         char ifname[IFNAMSIZ + 1];
 936         char extra[100], *pos, *end;
 937
 938         extra[0] = '\0';
 939         pos = extra;
 940         end = pos + sizeof(extra);
 941         ifname[0] = '\0';
 942
 943         attrlen = len;
 944         attr = (struct rtattr *) buf;
 945         while (RTA_OK(attr, attrlen)) {
 946                 switch (attr->rta_type) {
 947                 case IFLA_IFNAME:
 948                         if (RTA_PAYLOAD(attr) >= IFNAMSIZ)
 949                                 break;
 950                         os_memcpy(ifname, RTA_DATA(attr), RTA_PAYLOAD(attr));
 951                         ifname[RTA_PAYLOAD(attr)] = '\0';
 952                         break;
 953                 case IFLA_MASTER:
 954                         brid = nla_get_u32((struct nlattr *) attr);
 955                         pos += os_snprintf(pos, end - pos, " master=%u", brid);
 956                         break;
 957                 case IFLA_WIRELESS:
 958                         pos += os_snprintf(pos, end - pos, " wext");
 959                         break;
 960                 case IFLA_OPERSTATE:
 961                         pos += os_snprintf(pos, end - pos, " operstate=%u",
 962                                            nla_get_u32((struct nlattr *) attr));
 963                         break;
 964                 case IFLA_LINKMODE:
 965                         pos += os_snprintf(pos, end - pos, " linkmode=%u",
 966                                            nla_get_u32((struct nlattr *) attr));
 967                         break;
 968                 }
 969                 attr = RTA_NEXT(attr, attrlen);
 970         }
 971         extra[sizeof(extra) - 1] = '\0';
 972
 973         wpa_printf(MSG_DEBUG, "RTM_NEWLINK: ifi_index=%d ifname=%s%s ifi_family=%d ifi_flags=0x%x (%s%s%s%s)",
 974                    ifi->ifi_index, ifname, extra, ifi->ifi_family,
 975                    ifi->ifi_flags,
 976                    (ifi->ifi_flags & IFF_UP) ? "[UP]" : "",
 977                    (ifi->ifi_flags & IFF_RUNNING) ? "[RUNNING]" : "",
 978                    (ifi->ifi_flags & IFF_LOWER_UP) ? "[LOWER_UP]" : "",
 979                    (ifi->ifi_flags & IFF_DORMANT) ? "[DORMANT]" : "");
 980
 981         drv = nl80211_find_drv(global, ifi->ifi_index, buf, len);
 982         if (!drv)
 983                 goto event_newlink;
 984
 985         if (!drv->if_disabled && !(ifi->ifi_flags & IFF_UP)) {
 986                 namebuf[0] = '\0';
 987                 if (if_indextoname(ifi->ifi_index, namebuf) &&
 988                     linux_iface_up(drv->global->ioctl_sock, namebuf) > 0) {
 989                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface down "
 990                                    "event since interface %s is up", namebuf);
 991                         drv->ignore_if_down_event = 0;
 992                         return;
 993                 }
 994                 wpa_printf(MSG_DEBUG, "nl80211: Interface down (%s/%s)",
 995                            namebuf, ifname);
 996                 if (os_strcmp(drv->first_bss->ifname, ifname) != 0) {
 997                         wpa_printf(MSG_DEBUG,
 998                                    "nl80211: Not the main interface (%s) - do not indicate interface down",
 999                                    drv->first_bss->ifname);
1000                 } else if (drv->ignore_if_down_event) {
1001                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface down "
1002                                    "event generated by mode change");
1003                         drv->ignore_if_down_event = 0;
1004                 } else {
1005                         drv->if_disabled = 1;
1006                         wpa_supplicant_event(drv->ctx,
1007                                              EVENT_INTERFACE_DISABLED, NULL);
1008
1009                         /*
1010                          * Try to get drv again, since it may be removed as
1011                          * part of the EVENT_INTERFACE_DISABLED handling for
1012                          * dynamic interfaces
1013                          */
1014                         drv = nl80211_find_drv(global, ifi->ifi_index,
1015                                                buf, len);
1016                         if (!drv)
1017                                 return;
1018                 }
1019         }
1020
1021         if (drv->if_disabled && (ifi->ifi_flags & IFF_UP)) {
1022                 if (if_indextoname(ifi->ifi_index, namebuf) &&
1023                     linux_iface_up(drv->global->ioctl_sock, namebuf) == 0) {
1024                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface up "
1025                                    "event since interface %s is down",
1026                                    namebuf);
1027                 } else if (if_nametoindex(drv->first_bss->ifname) == 0) {
1028                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface up "
1029                                    "event since interface %s does not exist",
1030                                    drv->first_bss->ifname);
1031                 } else if (drv->if_removed) {
1032                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface up "
1033                                    "event since interface %s is marked "
1034                                    "removed", drv->first_bss->ifname);
1035                 } else {
1036                         struct i802_bss *bss;
1037                         u8 addr[ETH_ALEN];
1038
1039                         /* Re-read MAC address as it may have changed */
1040                         bss = get_bss_ifindex(drv, ifi->ifi_index);
1041                         if (bss &&
1042                             linux_get_ifhwaddr(drv->global->ioctl_sock,
1043                                                bss->ifname, addr) < 0) {
1044                                 wpa_printf(MSG_DEBUG,
1045                                            "nl80211: %s: failed to re-read MAC address",
1046                                            bss->ifname);
1047                         } else if (bss &&
1048                                    os_memcmp(addr, bss->addr, ETH_ALEN) != 0) {
1049                                 wpa_printf(MSG_DEBUG,
1050                                            "nl80211: Own MAC address on ifindex %d (%s) changed from "
1051                                            MACSTR " to " MACSTR,
1052                                            ifi->ifi_index, bss->ifname,
1053                                            MAC2STR(bss->addr),
1054                                            MAC2STR(addr));
1055                                 os_memcpy(bss->addr, addr, ETH_ALEN);
1056                         }
1057
1058                         wpa_printf(MSG_DEBUG, "nl80211: Interface up");
1059                         drv->if_disabled = 0;
1060                         wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_ENABLED,
1061                                              NULL);
1062                 }
1063         }
1064
1065         /*
1066          * Some drivers send the association event before the operup event--in
1067          * this case, lifting operstate in wpa_driver_nl80211_set_operstate()
1068          * fails. This will hit us when wpa_supplicant does not need to do
1069          * IEEE 802.1X authentication
1070          */
1071         if (drv->operstate == 1 &&
1072             (ifi->ifi_flags & (IFF_LOWER_UP | IFF_DORMANT)) == IFF_LOWER_UP &&
1073             !(ifi->ifi_flags & IFF_RUNNING)) {
1074                 wpa_printf(MSG_DEBUG, "nl80211: Set IF_OPER_UP again based on ifi_flags and expected operstate");
1075                 netlink_send_oper_ifla(drv->global->netlink, drv->ifindex,
1076                                        -1, IF_OPER_UP);
1077         }
1078
1079 event_newlink:
1080         if (ifname[0])
1081                 wpa_driver_nl80211_event_newlink(global, drv, ifi->ifi_index,
1082                                                  ifname);
1083
1084         if (ifi->ifi_family == AF_BRIDGE && brid && drv) {
1085                 struct i802_bss *bss;
1086
1087                 /* device has been added to bridge */
1088                 if (!if_indextoname(brid, namebuf)) {
1089                         wpa_printf(MSG_DEBUG,
1090                                    "nl80211: Could not find bridge ifname for ifindex %u",
1091                                    brid);
1092                         return;
1093                 }
1094                 wpa_printf(MSG_DEBUG, "nl80211: Add ifindex %u for bridge %s",
1095                            brid, namebuf);
1096                 add_ifidx(drv, brid, ifi->ifi_index);
1097
1098                 for (bss = drv->first_bss; bss; bss = bss->next) {
1099                         if (os_strcmp(ifname, bss->ifname) == 0) {
1100                                 os_strlcpy(bss->brname, namebuf, IFNAMSIZ);
1101                                 break;
1102                         }
1103                 }
1104         }
1105 }
1106
1107
1108 static void wpa_driver_nl80211_event_rtm_dellink(void *ctx,
1109                                                  struct ifinfomsg *ifi,
1110                                                  u8 *buf, size_t len)
1111 {
1112         struct nl80211_global *global = ctx;
1113         struct wpa_driver_nl80211_data *drv;
1114         int attrlen;
1115         struct rtattr *attr;
1116         u32 brid = 0;
1117         char ifname[IFNAMSIZ + 1];
1118         char extra[100], *pos, *end;
1119
1120         extra[0] = '\0';
1121         pos = extra;
1122         end = pos + sizeof(extra);
1123         ifname[0] = '\0';
1124
1125         attrlen = len;
1126         attr = (struct rtattr *) buf;
1127         while (RTA_OK(attr, attrlen)) {
1128                 switch (attr->rta_type) {
1129                 case IFLA_IFNAME:
1130                         if (RTA_PAYLOAD(attr) >= IFNAMSIZ)
1131                                 break;
1132                         os_memcpy(ifname, RTA_DATA(attr), RTA_PAYLOAD(attr));
1133                         ifname[RTA_PAYLOAD(attr)] = '\0';
1134                         break;
1135                 case IFLA_MASTER:
1136                         brid = nla_get_u32((struct nlattr *) attr);
1137                         pos += os_snprintf(pos, end - pos, " master=%u", brid);
1138                         break;
1139                 case IFLA_OPERSTATE:
1140                         pos += os_snprintf(pos, end - pos, " operstate=%u",
1141                                            nla_get_u32((struct nlattr *) attr));
1142                         break;
1143                 case IFLA_LINKMODE:
1144                         pos += os_snprintf(pos, end - pos, " linkmode=%u",
1145                                            nla_get_u32((struct nlattr *) attr));
1146                         break;
1147                 }
1148                 attr = RTA_NEXT(attr, attrlen);
1149         }
1150         extra[sizeof(extra) - 1] = '\0';
1151
1152         wpa_printf(MSG_DEBUG, "RTM_DELLINK: ifi_index=%d ifname=%s%s ifi_family=%d ifi_flags=0x%x (%s%s%s%s)",
1153                    ifi->ifi_index, ifname, extra, ifi->ifi_family,
1154                    ifi->ifi_flags,
1155                    (ifi->ifi_flags & IFF_UP) ? "[UP]" : "",
1156                    (ifi->ifi_flags & IFF_RUNNING) ? "[RUNNING]" : "",
1157                    (ifi->ifi_flags & IFF_LOWER_UP) ? "[LOWER_UP]" : "",
1158                    (ifi->ifi_flags & IFF_DORMANT) ? "[DORMANT]" : "");
1159
1160         drv = nl80211_find_drv(global, ifi->ifi_index, buf, len);
1161
1162         if (ifi->ifi_family == AF_BRIDGE && brid && drv) {
1163                 /* device has been removed from bridge */
1164                 char namebuf[IFNAMSIZ];
1165
1166                 if (!if_indextoname(brid, namebuf)) {
1167                         wpa_printf(MSG_DEBUG,
1168                                    "nl80211: Could not find bridge ifname for ifindex %u",
1169                                    brid);
1170                 } else {
1171                         wpa_printf(MSG_DEBUG,
1172                                    "nl80211: Remove ifindex %u for bridge %s",
1173                                    brid, namebuf);
1174                 }
1175                 del_ifidx(drv, brid, ifi->ifi_index);
1176         }
1177
1178         if (ifi->ifi_family != AF_BRIDGE || !brid)
1179                 wpa_driver_nl80211_event_dellink(global, drv, ifi->ifi_index,
1180                                                  ifname);
1181 }
1182
1183
1184 unsigned int nl80211_get_assoc_freq(struct wpa_driver_nl80211_data *drv)
1185 {
1186         struct nl_msg *msg;
1187         int ret;
1188         struct nl80211_bss_info_arg arg;
1189
1190         msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_GET_SCAN);
1191         os_memset(&arg, 0, sizeof(arg));
1192         arg.drv = drv;
1193         ret = send_and_recv_msgs(drv, msg, bss_info_handler, &arg);
1194         if (ret == 0) {
1195                 unsigned int freq = drv->nlmode == NL80211_IFTYPE_ADHOC ?
1196                         arg.ibss_freq : arg.assoc_freq;
1197                 wpa_printf(MSG_DEBUG, "nl80211: Operating frequency for the "
1198                            "associated BSS from scan results: %u MHz", freq);
1199                 if (freq)
1200                         drv->assoc_freq = freq;
1201                 return drv->assoc_freq;
1202         }
1203         wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d "
1204                    "(%s)", ret, strerror(-ret));
1205         return drv->assoc_freq;
1206 }
1207
1208
1209 static int get_link_signal(struct nl_msg *msg, void *arg)
1210 {
1211         struct nlattr *tb[NL80211_ATTR_MAX + 1];
1212         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1213         struct nlattr *sinfo[NL80211_STA_INFO_MAX + 1];
1214         static struct nla_policy policy[NL80211_STA_INFO_MAX + 1] = {
1215                 [NL80211_STA_INFO_SIGNAL] = { .type = NLA_U8 },
1216                 [NL80211_STA_INFO_SIGNAL_AVG] = { .type = NLA_U8 },
1217                 [NL80211_STA_INFO_BEACON_SIGNAL_AVG] = { .type = NLA_U8 },
1218         };
1219         struct nlattr *rinfo[NL80211_RATE_INFO_MAX + 1];
1220         static struct nla_policy rate_policy[NL80211_RATE_INFO_MAX + 1] = {
1221                 [NL80211_RATE_INFO_BITRATE] = { .type = NLA_U16 },
1222                 [NL80211_RATE_INFO_MCS] = { .type = NLA_U8 },
1223                 [NL80211_RATE_INFO_40_MHZ_WIDTH] = { .type = NLA_FLAG },
1224                 [NL80211_RATE_INFO_SHORT_GI] = { .type = NLA_FLAG },
1225         };
1226         struct wpa_signal_info *sig_change = arg;
1227
1228         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1229                   genlmsg_attrlen(gnlh, 0), NULL);
1230         if (!tb[NL80211_ATTR_STA_INFO] ||
1231             nla_parse_nested(sinfo, NL80211_STA_INFO_MAX,
1232                              tb[NL80211_ATTR_STA_INFO], policy))
1233                 return NL_SKIP;
1234         if (!sinfo[NL80211_STA_INFO_SIGNAL])
1235                 return NL_SKIP;
1236
1237         sig_change->current_signal =
1238                 (s8) nla_get_u8(sinfo[NL80211_STA_INFO_SIGNAL]);
1239
1240         if (sinfo[NL80211_STA_INFO_SIGNAL_AVG])
1241                 sig_change->avg_signal =
1242                         (s8) nla_get_u8(sinfo[NL80211_STA_INFO_SIGNAL_AVG]);
1243         else
1244                 sig_change->avg_signal = 0;
1245
1246         if (sinfo[NL80211_STA_INFO_BEACON_SIGNAL_AVG])
1247                 sig_change->avg_beacon_signal =
1248                         (s8)
1249                         nla_get_u8(sinfo[NL80211_STA_INFO_BEACON_SIGNAL_AVG]);
1250         else
1251                 sig_change->avg_beacon_signal = 0;
1252
1253         if (sinfo[NL80211_STA_INFO_TX_BITRATE]) {
1254                 if (nla_parse_nested(rinfo, NL80211_RATE_INFO_MAX,
1255                                      sinfo[NL80211_STA_INFO_TX_BITRATE],
1256                                      rate_policy)) {
1257                         sig_change->current_txrate = 0;
1258                 } else {
1259                         if (rinfo[NL80211_RATE_INFO_BITRATE]) {
1260                                 sig_change->current_txrate =
1261                                         nla_get_u16(rinfo[
1262                                              NL80211_RATE_INFO_BITRATE]) * 100;
1263                         }
1264                 }
1265         }
1266
1267         return NL_SKIP;
1268 }
1269
1270
1271 int nl80211_get_link_signal(struct wpa_driver_nl80211_data *drv,
1272                             struct wpa_signal_info *sig)
1273 {
1274         struct nl_msg *msg;
1275
1276         sig->current_signal = -9999;
1277         sig->current_txrate = 0;
1278
1279         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_GET_STATION)) ||
1280             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, drv->bssid)) {
1281                 nlmsg_free(msg);
1282                 return -ENOBUFS;
1283         }
1284
1285         return send_and_recv_msgs(drv, msg, get_link_signal, sig);
1286 }
1287
1288
1289 static int get_link_noise(struct nl_msg *msg, void *arg)
1290 {
1291         struct nlattr *tb[NL80211_ATTR_MAX + 1];
1292         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1293         struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
1294         static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
1295                 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
1296                 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
1297         };
1298         struct wpa_signal_info *sig_change = arg;
1299
1300         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1301                   genlmsg_attrlen(gnlh, 0), NULL);
1302
1303         if (!tb[NL80211_ATTR_SURVEY_INFO]) {
1304                 wpa_printf(MSG_DEBUG, "nl80211: survey data missing!");
1305                 return NL_SKIP;
1306         }
1307
1308         if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
1309                              tb[NL80211_ATTR_SURVEY_INFO],
1310                              survey_policy)) {
1311                 wpa_printf(MSG_DEBUG, "nl80211: failed to parse nested "
1312                            "attributes!");
1313                 return NL_SKIP;
1314         }
1315
1316         if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY])
1317                 return NL_SKIP;
1318
1319         if (nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]) !=
1320             sig_change->frequency)
1321                 return NL_SKIP;
1322
1323         if (!sinfo[NL80211_SURVEY_INFO_NOISE])
1324                 return NL_SKIP;
1325
1326         sig_change->current_noise =
1327                 (s8) nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
1328
1329         return NL_SKIP;
1330 }
1331
1332
1333 int nl80211_get_link_noise(struct wpa_driver_nl80211_data *drv,
1334                            struct wpa_signal_info *sig_change)
1335 {
1336         struct nl_msg *msg;
1337
1338         sig_change->current_noise = 9999;
1339         sig_change->frequency = drv->assoc_freq;
1340
1341         msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_GET_SURVEY);
1342         return send_and_recv_msgs(drv, msg, get_link_noise, sig_change);
1343 }
1344
1345
1346 static void wpa_driver_nl80211_event_receive(int sock, void *eloop_ctx,
1347                                              void *handle)
1348 {
1349         struct nl_cb *cb = eloop_ctx;
1350         int res;
1351
1352         wpa_printf(MSG_MSGDUMP, "nl80211: Event message available");
1353
1354         res = nl_recvmsgs(handle, cb);
1355         if (res < 0) {
1356                 wpa_printf(MSG_INFO, "nl80211: %s->nl_recvmsgs failed: %d",
1357                            __func__, res);
1358         }
1359 }
1360
1361
1362 /**
1363  * wpa_driver_nl80211_set_country - ask nl80211 to set the regulatory domain
1364  * @priv: driver_nl80211 private data
1365  * @alpha2_arg: country to which to switch to
1366  * Returns: 0 on success, -1 on failure
1367  *
1368  * This asks nl80211 to set the regulatory domain for given
1369  * country ISO / IEC alpha2.
1370  */
1371 static int wpa_driver_nl80211_set_country(void *priv, const char *alpha2_arg)
1372 {
1373         struct i802_bss *bss = priv;
1374         struct wpa_driver_nl80211_data *drv = bss->drv;
1375         char alpha2[3];
1376         struct nl_msg *msg;
1377
1378         msg = nlmsg_alloc();
1379         if (!msg)
1380                 return -ENOMEM;
1381
1382         alpha2[0] = alpha2_arg[0];
1383         alpha2[1] = alpha2_arg[1];
1384         alpha2[2] = '\0';
1385
1386         if (!nl80211_cmd(drv, msg, 0, NL80211_CMD_REQ_SET_REG) ||
1387             nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, alpha2)) {
1388                 nlmsg_free(msg);
1389                 return -EINVAL;
1390         }
1391         if (send_and_recv_msgs(drv, msg, NULL, NULL))
1392                 return -EINVAL;
1393         return 0;
1394 }
1395
1396
1397 static int nl80211_get_country(struct nl_msg *msg, void *arg)
1398 {
1399         char *alpha2 = arg;
1400         struct nlattr *tb_msg[NL80211_ATTR_MAX + 1];
1401         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1402
1403         nla_parse(tb_msg, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1404                   genlmsg_attrlen(gnlh, 0), NULL);
1405         if (!tb_msg[NL80211_ATTR_REG_ALPHA2]) {
1406                 wpa_printf(MSG_DEBUG, "nl80211: No country information available");
1407                 return NL_SKIP;
1408         }
1409         os_strlcpy(alpha2, nla_data(tb_msg[NL80211_ATTR_REG_ALPHA2]), 3);
1410         return NL_SKIP;
1411 }
1412
1413
1414 static int wpa_driver_nl80211_get_country(void *priv, char *alpha2)
1415 {
1416         struct i802_bss *bss = priv;
1417         struct wpa_driver_nl80211_data *drv = bss->drv;
1418         struct nl_msg *msg;
1419         int ret;
1420
1421         msg = nlmsg_alloc();
1422         if (!msg)
1423                 return -ENOMEM;
1424
1425         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_REG);
1426         alpha2[0] = '\0';
1427         ret = send_and_recv_msgs(drv, msg, nl80211_get_country, alpha2);
1428         if (!alpha2[0])
1429                 ret = -1;
1430
1431         return ret;
1432 }
1433
1434
1435 static int wpa_driver_nl80211_init_nl_global(struct nl80211_global *global)
1436 {
1437         int ret;
1438
1439         global->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
1440         if (global->nl_cb == NULL) {
1441                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate netlink "
1442                            "callbacks");
1443                 return -1;
1444         }
1445
1446         global->nl = nl_create_handle(global->nl_cb, "nl");
1447         if (global->nl == NULL)
1448                 goto err;
1449
1450         global->nl80211_id = genl_ctrl_resolve(global->nl, "nl80211");
1451         if (global->nl80211_id < 0) {
1452                 wpa_printf(MSG_ERROR, "nl80211: 'nl80211' generic netlink not "
1453                            "found");
1454                 goto err;
1455         }
1456
1457         global->nl_event = nl_create_handle(global->nl_cb, "event");
1458         if (global->nl_event == NULL)
1459                 goto err;
1460
1461         ret = nl_get_multicast_id(global, "nl80211", "scan");
1462         if (ret >= 0)
1463                 ret = nl_socket_add_membership(global->nl_event, ret);
1464         if (ret < 0) {
1465                 wpa_printf(MSG_ERROR, "nl80211: Could not add multicast "
1466                            "membership for scan events: %d (%s)",
1467                            ret, strerror(-ret));
1468                 goto err;
1469         }
1470
1471         ret = nl_get_multicast_id(global, "nl80211", "mlme");
1472         if (ret >= 0)
1473                 ret = nl_socket_add_membership(global->nl_event, ret);
1474         if (ret < 0) {
1475                 wpa_printf(MSG_ERROR, "nl80211: Could not add multicast "
1476                            "membership for mlme events: %d (%s)",
1477                            ret, strerror(-ret));
1478                 goto err;
1479         }
1480
1481         ret = nl_get_multicast_id(global, "nl80211", "regulatory");
1482         if (ret >= 0)
1483                 ret = nl_socket_add_membership(global->nl_event, ret);
1484         if (ret < 0) {
1485                 wpa_printf(MSG_DEBUG, "nl80211: Could not add multicast "
1486                            "membership for regulatory events: %d (%s)",
1487                            ret, strerror(-ret));
1488                 /* Continue without regulatory events */
1489         }
1490
1491         ret = nl_get_multicast_id(global, "nl80211", "vendor");
1492         if (ret >= 0)
1493                 ret = nl_socket_add_membership(global->nl_event, ret);
1494         if (ret < 0) {
1495                 wpa_printf(MSG_DEBUG, "nl80211: Could not add multicast "
1496                            "membership for vendor events: %d (%s)",
1497                            ret, strerror(-ret));
1498                 /* Continue without vendor events */
1499         }
1500
1501         nl_cb_set(global->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM,
1502                   no_seq_check, NULL);
1503         nl_cb_set(global->nl_cb, NL_CB_VALID, NL_CB_CUSTOM,
1504                   process_global_event, global);
1505
1506         nl80211_register_eloop_read(&global->nl_event,
1507                                     wpa_driver_nl80211_event_receive,
1508                                     global->nl_cb);
1509
1510         return 0;
1511
1512 err:
1513         nl_destroy_handles(&global->nl_event);
1514         nl_destroy_handles(&global->nl);
1515         nl_cb_put(global->nl_cb);
1516         global->nl_cb = NULL;
1517         return -1;
1518 }
1519
1520
1521 static void nl80211_check_global(struct nl80211_global *global)
1522 {
1523         struct nl_handle *handle;
1524         const char *groups[] = { "scan", "mlme", "regulatory", "vendor", NULL };
1525         int ret;
1526         unsigned int i;
1527
1528         /*
1529          * Try to re-add memberships to handle case of cfg80211 getting reloaded
1530          * and all registration having been cleared.
1531          */
1532         handle = (void *) (((intptr_t) global->nl_event) ^
1533                            ELOOP_SOCKET_INVALID);
1534
1535         for (i = 0; groups[i]; i++) {
1536                 ret = nl_get_multicast_id(global, "nl80211", groups[i]);
1537                 if (ret >= 0)
1538                         ret = nl_socket_add_membership(handle, ret);
1539                 if (ret < 0) {
1540                         wpa_printf(MSG_INFO,
1541                                    "nl80211: Could not re-add multicast membership for %s events: %d (%s)",
1542                                    groups[i], ret, strerror(-ret));
1543                 }
1544         }
1545 }
1546
1547
1548 static void wpa_driver_nl80211_rfkill_blocked(void *ctx)
1549 {
1550         struct wpa_driver_nl80211_data *drv = ctx;
1551
1552         wpa_printf(MSG_DEBUG, "nl80211: RFKILL blocked");
1553
1554         /*
1555          * rtnetlink ifdown handler will report interfaces other than the P2P
1556          * Device interface as disabled.
1557          */
1558         if (drv->nlmode == NL80211_IFTYPE_P2P_DEVICE)
1559                 wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_DISABLED, NULL);
1560 }
1561
1562
1563 static void wpa_driver_nl80211_rfkill_unblocked(void *ctx)
1564 {
1565         struct wpa_driver_nl80211_data *drv = ctx;
1566         wpa_printf(MSG_DEBUG, "nl80211: RFKILL unblocked");
1567         if (i802_set_iface_flags(drv->first_bss, 1)) {
1568                 wpa_printf(MSG_DEBUG, "nl80211: Could not set interface UP "
1569                            "after rfkill unblock");
1570                 return;
1571         }
1572
1573         if (is_p2p_net_interface(drv->nlmode))
1574                 nl80211_disable_11b_rates(drv, drv->ifindex, 1);
1575
1576         /*
1577          * rtnetlink ifup handler will report interfaces other than the P2P
1578          * Device interface as enabled.
1579          */
1580         if (drv->nlmode == NL80211_IFTYPE_P2P_DEVICE)
1581                 wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_ENABLED, NULL);
1582 }
1583
1584
1585 static void wpa_driver_nl80211_handle_eapol_tx_status(int sock,
1586                                                       void *eloop_ctx,
1587                                                       void *handle)
1588 {
1589         struct wpa_driver_nl80211_data *drv = eloop_ctx;
1590         u8 data[2048];
1591         struct msghdr msg;
1592         struct iovec entry;
1593         u8 control[512];
1594         struct cmsghdr *cmsg;
1595         int res, found_ee = 0, found_wifi = 0, acked = 0;
1596         union wpa_event_data event;
1597
1598         memset(&msg, 0, sizeof(msg));
1599         msg.msg_iov = &entry;
1600         msg.msg_iovlen = 1;
1601         entry.iov_base = data;
1602         entry.iov_len = sizeof(data);
1603         msg.msg_control = &control;
1604         msg.msg_controllen = sizeof(control);
1605
1606         res = recvmsg(sock, &msg, MSG_ERRQUEUE);
1607         /* if error or not fitting 802.3 header, return */
1608         if (res < 14)
1609                 return;
1610
1611         for (cmsg = CMSG_FIRSTHDR(&msg); cmsg; cmsg = CMSG_NXTHDR(&msg, cmsg))
1612         {
1613                 if (cmsg->cmsg_level == SOL_SOCKET &&
1614                     cmsg->cmsg_type == SCM_WIFI_STATUS) {
1615                         int *ack;
1616
1617                         found_wifi = 1;
1618                         ack = (void *)CMSG_DATA(cmsg);
1619                         acked = *ack;
1620                 }
1621
1622                 if (cmsg->cmsg_level == SOL_PACKET &&
1623                     cmsg->cmsg_type == PACKET_TX_TIMESTAMP) {
1624                         struct sock_extended_err *err =
1625                                 (struct sock_extended_err *)CMSG_DATA(cmsg);
1626
1627                         if (err->ee_origin == SO_EE_ORIGIN_TXSTATUS)
1628                                 found_ee = 1;
1629                 }
1630         }
1631
1632         if (!found_ee || !found_wifi)
1633                 return;
1634
1635         memset(&event, 0, sizeof(event));
1636         event.eapol_tx_status.dst = data;
1637         event.eapol_tx_status.data = data + 14;
1638         event.eapol_tx_status.data_len = res - 14;
1639         event.eapol_tx_status.ack = acked;
1640         wpa_supplicant_event(drv->ctx, EVENT_EAPOL_TX_STATUS, &event);
1641 }
1642
1643
1644 static int nl80211_init_bss(struct i802_bss *bss)
1645 {
1646         bss->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
1647         if (!bss->nl_cb)
1648                 return -1;
1649
1650         nl_cb_set(bss->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM,
1651                   no_seq_check, NULL);
1652         nl_cb_set(bss->nl_cb, NL_CB_VALID, NL_CB_CUSTOM,
1653                   process_bss_event, bss);
1654
1655         return 0;
1656 }
1657
1658
1659 static void nl80211_destroy_bss(struct i802_bss *bss)
1660 {
1661         nl_cb_put(bss->nl_cb);
1662         bss->nl_cb = NULL;
1663 }
1664
1665
1666 static void
1667 wpa_driver_nl80211_drv_init_rfkill(struct wpa_driver_nl80211_data *drv)
1668 {
1669         struct rfkill_config *rcfg;
1670
1671         if (drv->rfkill)
1672                 return;
1673
1674         rcfg = os_zalloc(sizeof(*rcfg));
1675         if (!rcfg)
1676                 return;
1677
1678         rcfg->ctx = drv;
1679
1680         /* rfkill uses netdev sysfs for initialization. However, P2P Device is
1681          * not associated with a netdev, so use the name of some other interface
1682          * sharing the same wiphy as the P2P Device interface.
1683          *
1684          * Note: This is valid, as a P2P Device interface is always dynamically
1685          * created and is created only once another wpa_s interface was added.
1686          */
1687         if (drv->nlmode == NL80211_IFTYPE_P2P_DEVICE) {
1688                 struct nl80211_global *global = drv->global;
1689                 struct wpa_driver_nl80211_data *tmp1;
1690
1691                 dl_list_for_each(tmp1, &global->interfaces,
1692                                  struct wpa_driver_nl80211_data, list) {
1693                         if (drv == tmp1 || drv->wiphy_idx != tmp1->wiphy_idx ||
1694                             !tmp1->rfkill)
1695                                 continue;
1696
1697                         wpa_printf(MSG_DEBUG,
1698                                    "nl80211: Use (%s) to initialize P2P Device rfkill",
1699                                    tmp1->first_bss->ifname);
1700                         os_strlcpy(rcfg->ifname, tmp1->first_bss->ifname,
1701                                    sizeof(rcfg->ifname));
1702                         break;
1703                 }
1704         } else {
1705                 os_strlcpy(rcfg->ifname, drv->first_bss->ifname,
1706                            sizeof(rcfg->ifname));
1707         }
1708
1709         rcfg->blocked_cb = wpa_driver_nl80211_rfkill_blocked;
1710         rcfg->unblocked_cb = wpa_driver_nl80211_rfkill_unblocked;
1711         drv->rfkill = rfkill_init(rcfg);
1712         if (!drv->rfkill) {
1713                 wpa_printf(MSG_DEBUG, "nl80211: RFKILL status not available");
1714                 os_free(rcfg);
1715         }
1716 }
1717
1718
1719 static void * wpa_driver_nl80211_drv_init(void *ctx, const char *ifname,
1720                                           void *global_priv, int hostapd,
1721                                           const u8 *set_addr,
1722                                           const char *driver_params)
1723 {
1724         struct wpa_driver_nl80211_data *drv;
1725         struct i802_bss *bss;
1726
1727         if (global_priv == NULL)
1728                 return NULL;
1729         drv = os_zalloc(sizeof(*drv));
1730         if (drv == NULL)
1731                 return NULL;
1732         drv->global = global_priv;
1733         drv->ctx = ctx;
1734         drv->hostapd = !!hostapd;
1735         drv->eapol_sock = -1;
1736
1737         /*
1738          * There is no driver capability flag for this, so assume it is
1739          * supported and disable this on first attempt to use if the driver
1740          * rejects the command due to missing support.
1741          */
1742         drv->set_rekey_offload = 1;
1743
1744         drv->num_if_indices = sizeof(drv->default_if_indices) / sizeof(int);
1745         drv->if_indices = drv->default_if_indices;
1746         drv->if_indices_reason = drv->default_if_indices_reason;
1747
1748         drv->first_bss = os_zalloc(sizeof(*drv->first_bss));
1749         if (!drv->first_bss) {
1750                 os_free(drv);
1751                 return NULL;
1752         }
1753         bss = drv->first_bss;
1754         bss->drv = drv;
1755         bss->ctx = ctx;
1756
1757         os_strlcpy(bss->ifname, ifname, sizeof(bss->ifname));
1758         drv->monitor_ifidx = -1;
1759         drv->monitor_sock = -1;
1760         drv->eapol_tx_sock = -1;
1761         drv->ap_scan_as_station = NL80211_IFTYPE_UNSPECIFIED;
1762
1763         if (nl80211_init_bss(bss))
1764                 goto failed;
1765
1766         if (wpa_driver_nl80211_finish_drv_init(drv, set_addr, 1, driver_params))
1767                 goto failed;
1768
1769         drv->eapol_tx_sock = socket(PF_PACKET, SOCK_DGRAM, 0);
1770         if (drv->eapol_tx_sock < 0)
1771                 goto failed;
1772
1773         if (drv->data_tx_status) {
1774                 int enabled = 1;
1775
1776                 if (setsockopt(drv->eapol_tx_sock, SOL_SOCKET, SO_WIFI_STATUS,
1777                                &enabled, sizeof(enabled)) < 0) {
1778                         wpa_printf(MSG_DEBUG,
1779                                 "nl80211: wifi status sockopt failed\n");
1780                         drv->data_tx_status = 0;
1781                         if (!drv->use_monitor)
1782                                 drv->capa.flags &=
1783                                         ~WPA_DRIVER_FLAGS_EAPOL_TX_STATUS;
1784                 } else {
1785                         eloop_register_read_sock(drv->eapol_tx_sock,
1786                                 wpa_driver_nl80211_handle_eapol_tx_status,
1787                                 drv, NULL);
1788                 }
1789         }
1790
1791         if (drv->global) {
1792                 nl80211_check_global(drv->global);
1793                 dl_list_add(&drv->global->interfaces, &drv->list);
1794                 drv->in_interface_list = 1;
1795         }
1796
1797         return bss;
1798
1799 failed:
1800         wpa_driver_nl80211_deinit(bss);
1801         return NULL;
1802 }
1803
1804
1805 /**
1806  * wpa_driver_nl80211_init - Initialize nl80211 driver interface
1807  * @ctx: context to be used when calling wpa_supplicant functions,
1808  * e.g., wpa_supplicant_event()
1809  * @ifname: interface name, e.g., wlan0
1810  * @global_priv: private driver global data from global_init()
1811  * Returns: Pointer to private data, %NULL on failure
1812  */
1813 static void * wpa_driver_nl80211_init(void *ctx, const char *ifname,
1814                                       void *global_priv)
1815 {
1816         return wpa_driver_nl80211_drv_init(ctx, ifname, global_priv, 0, NULL,
1817                                            NULL);
1818 }
1819
1820
1821 static int nl80211_register_frame(struct i802_bss *bss,
1822                                   struct nl_handle *nl_handle,
1823                                   u16 type, const u8 *match, size_t match_len)
1824 {
1825         struct wpa_driver_nl80211_data *drv = bss->drv;
1826         struct nl_msg *msg;
1827         int ret;
1828         char buf[30];
1829
1830         buf[0] = '\0';
1831         wpa_snprintf_hex(buf, sizeof(buf), match, match_len);
1832         wpa_printf(MSG_DEBUG, "nl80211: Register frame type=0x%x (%s) nl_handle=%p match=%s",
1833                    type, fc2str(type), nl_handle, buf);
1834
1835         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_REGISTER_ACTION)) ||
1836             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE, type) ||
1837             nla_put(msg, NL80211_ATTR_FRAME_MATCH, match_len, match)) {
1838                 nlmsg_free(msg);
1839                 return -1;
1840         }
1841
1842         ret = send_and_recv(drv->global, nl_handle, msg, NULL, NULL);
1843         if (ret) {
1844                 wpa_printf(MSG_DEBUG, "nl80211: Register frame command "
1845                            "failed (type=%u): ret=%d (%s)",
1846                            type, ret, strerror(-ret));
1847                 wpa_hexdump(MSG_DEBUG, "nl80211: Register frame match",
1848                             match, match_len);
1849         }
1850         return ret;
1851 }
1852
1853
1854 static int nl80211_alloc_mgmt_handle(struct i802_bss *bss)
1855 {
1856         if (bss->nl_mgmt) {
1857                 wpa_printf(MSG_DEBUG, "nl80211: Mgmt reporting "
1858                            "already on! (nl_mgmt=%p)", bss->nl_mgmt);
1859                 return -1;
1860         }
1861
1862         bss->nl_mgmt = nl_create_handle(bss->nl_cb, "mgmt");
1863         if (bss->nl_mgmt == NULL)
1864                 return -1;
1865
1866         return 0;
1867 }
1868
1869
1870 static void nl80211_mgmt_handle_register_eloop(struct i802_bss *bss)
1871 {
1872         nl80211_register_eloop_read(&bss->nl_mgmt,
1873                                     wpa_driver_nl80211_event_receive,
1874                                     bss->nl_cb);
1875 }
1876
1877
1878 static int nl80211_register_action_frame(struct i802_bss *bss,
1879                                          const u8 *match, size_t match_len)
1880 {
1881         u16 type = (WLAN_FC_TYPE_MGMT << 2) | (WLAN_FC_STYPE_ACTION << 4);
1882         return nl80211_register_frame(bss, bss->nl_mgmt,
1883                                       type, match, match_len);
1884 }
1885
1886
1887 static int nl80211_mgmt_subscribe_non_ap(struct i802_bss *bss)
1888 {
1889         struct wpa_driver_nl80211_data *drv = bss->drv;
1890         int ret = 0;
1891
1892         if (nl80211_alloc_mgmt_handle(bss))
1893                 return -1;
1894         wpa_printf(MSG_DEBUG, "nl80211: Subscribe to mgmt frames with non-AP "
1895                    "handle %p", bss->nl_mgmt);
1896
1897         if (drv->nlmode == NL80211_IFTYPE_ADHOC) {
1898                 u16 type = (WLAN_FC_TYPE_MGMT << 2) | (WLAN_FC_STYPE_AUTH << 4);
1899
1900                 /* register for any AUTH message */
1901                 nl80211_register_frame(bss, bss->nl_mgmt, type, NULL, 0);
1902         }
1903
1904 #ifdef CONFIG_INTERWORKING
1905         /* QoS Map Configure */
1906         if (nl80211_register_action_frame(bss, (u8 *) "\x01\x04", 2) < 0)
1907                 ret = -1;
1908 #endif /* CONFIG_INTERWORKING */
1909 #if defined(CONFIG_P2P) || defined(CONFIG_INTERWORKING)
1910         /* GAS Initial Request */
1911         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0a", 2) < 0)
1912                 ret = -1;
1913         /* GAS Initial Response */
1914         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0b", 2) < 0)
1915                 ret = -1;
1916         /* GAS Comeback Request */
1917         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0c", 2) < 0)
1918                 ret = -1;
1919         /* GAS Comeback Response */
1920         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0d", 2) < 0)
1921                 ret = -1;
1922         /* Protected GAS Initial Request */
1923         if (nl80211_register_action_frame(bss, (u8 *) "\x09\x0a", 2) < 0)
1924                 ret = -1;
1925         /* Protected GAS Initial Response */
1926         if (nl80211_register_action_frame(bss, (u8 *) "\x09\x0b", 2) < 0)
1927                 ret = -1;
1928         /* Protected GAS Comeback Request */
1929         if (nl80211_register_action_frame(bss, (u8 *) "\x09\x0c", 2) < 0)
1930                 ret = -1;
1931         /* Protected GAS Comeback Response */
1932         if (nl80211_register_action_frame(bss, (u8 *) "\x09\x0d", 2) < 0)
1933                 ret = -1;
1934 #endif /* CONFIG_P2P || CONFIG_INTERWORKING */
1935 #ifdef CONFIG_P2P
1936         /* P2P Public Action */
1937         if (nl80211_register_action_frame(bss,
1938                                           (u8 *) "\x04\x09\x50\x6f\x9a\x09",
1939                                           6) < 0)
1940                 ret = -1;
1941         /* P2P Action */
1942         if (nl80211_register_action_frame(bss,
1943                                           (u8 *) "\x7f\x50\x6f\x9a\x09",
1944                                           5) < 0)
1945                 ret = -1;
1946 #endif /* CONFIG_P2P */
1947 #ifdef CONFIG_IEEE80211W
1948         /* SA Query Response */
1949         if (nl80211_register_action_frame(bss, (u8 *) "\x08\x01", 2) < 0)
1950                 ret = -1;
1951 #endif /* CONFIG_IEEE80211W */
1952 #ifdef CONFIG_TDLS
1953         if ((drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT)) {
1954                 /* TDLS Discovery Response */
1955                 if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0e", 2) <
1956                     0)
1957                         ret = -1;
1958         }
1959 #endif /* CONFIG_TDLS */
1960 #ifdef CONFIG_FST
1961         /* FST Action frames */
1962         if (nl80211_register_action_frame(bss, (u8 *) "\x12", 1) < 0)
1963                 ret = -1;
1964 #endif /* CONFIG_FST */
1965
1966         /* FT Action frames */
1967         if (nl80211_register_action_frame(bss, (u8 *) "\x06", 1) < 0)
1968                 ret = -1;
1969         else
1970                 drv->capa.key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_FT |
1971                         WPA_DRIVER_CAPA_KEY_MGMT_FT_PSK;
1972
1973         /* WNM - BSS Transition Management Request */
1974         if (nl80211_register_action_frame(bss, (u8 *) "\x0a\x07", 2) < 0)
1975                 ret = -1;
1976         /* WNM-Sleep Mode Response */
1977         if (nl80211_register_action_frame(bss, (u8 *) "\x0a\x11", 2) < 0)
1978                 ret = -1;
1979
1980 #ifdef CONFIG_HS20
1981         /* WNM-Notification */
1982         if (nl80211_register_action_frame(bss, (u8 *) "\x0a\x1a", 2) < 0)
1983                 ret = -1;
1984 #endif /* CONFIG_HS20 */
1985
1986         /* WMM-AC ADDTS Response */
1987         if (nl80211_register_action_frame(bss, (u8 *) "\x11\x01", 2) < 0)
1988                 ret = -1;
1989
1990         /* WMM-AC DELTS */
1991         if (nl80211_register_action_frame(bss, (u8 *) "\x11\x02", 2) < 0)
1992                 ret = -1;
1993
1994         /* Radio Measurement - Neighbor Report Response */
1995         if (nl80211_register_action_frame(bss, (u8 *) "\x05\x05", 2) < 0)
1996                 ret = -1;
1997
1998         /* Radio Measurement - Radio Measurement Request */
1999         if (nl80211_register_action_frame(bss, (u8 *) "\x05\x00", 2) < 0)
2000                 ret = -1;
2001
2002         /* Radio Measurement - Link Measurement Request */
2003         if ((drv->capa.rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION) &&
2004             (nl80211_register_action_frame(bss, (u8 *) "\x05\x02", 2) < 0))
2005                 ret = -1;
2006
2007         nl80211_mgmt_handle_register_eloop(bss);
2008
2009         return ret;
2010 }
2011
2012
2013 static int nl80211_mgmt_subscribe_mesh(struct i802_bss *bss)
2014 {
2015         int ret = 0;
2016
2017         if (nl80211_alloc_mgmt_handle(bss))
2018                 return -1;
2019
2020         wpa_printf(MSG_DEBUG,
2021                    "nl80211: Subscribe to mgmt frames with mesh handle %p",
2022                    bss->nl_mgmt);
2023
2024         /* Auth frames for mesh SAE */
2025         if (nl80211_register_frame(bss, bss->nl_mgmt,
2026                                    (WLAN_FC_TYPE_MGMT << 2) |
2027                                    (WLAN_FC_STYPE_AUTH << 4),
2028                                    NULL, 0) < 0)
2029                 ret = -1;
2030
2031         /* Mesh peering open */
2032         if (nl80211_register_action_frame(bss, (u8 *) "\x0f\x01", 2) < 0)
2033                 ret = -1;
2034         /* Mesh peering confirm */
2035         if (nl80211_register_action_frame(bss, (u8 *) "\x0f\x02", 2) < 0)
2036                 ret = -1;
2037         /* Mesh peering close */
2038         if (nl80211_register_action_frame(bss, (u8 *) "\x0f\x03", 2) < 0)
2039                 ret = -1;
2040
2041         nl80211_mgmt_handle_register_eloop(bss);
2042
2043         return ret;
2044 }
2045
2046
2047 static int nl80211_register_spurious_class3(struct i802_bss *bss)
2048 {
2049         struct nl_msg *msg;
2050         int ret;
2051
2052         msg = nl80211_bss_msg(bss, 0, NL80211_CMD_UNEXPECTED_FRAME);
2053         ret = send_and_recv(bss->drv->global, bss->nl_mgmt, msg, NULL, NULL);
2054         if (ret) {
2055                 wpa_printf(MSG_DEBUG, "nl80211: Register spurious class3 "
2056                            "failed: ret=%d (%s)",
2057                            ret, strerror(-ret));
2058         }
2059         return ret;
2060 }
2061
2062
2063 static int nl80211_action_subscribe_ap(struct i802_bss *bss)
2064 {
2065         int ret = 0;
2066
2067         /* Public Action frames */
2068         if (nl80211_register_action_frame(bss, (u8 *) "\x04", 1) < 0)
2069                 ret = -1;
2070         /* RRM Measurement Report */
2071         if (nl80211_register_action_frame(bss, (u8 *) "\x05\x01", 2) < 0)
2072                 ret = -1;
2073         /* RRM Neighbor Report Request */
2074         if (nl80211_register_action_frame(bss, (u8 *) "\x05\x04", 2) < 0)
2075                 ret = -1;
2076         /* FT Action frames */
2077         if (nl80211_register_action_frame(bss, (u8 *) "\x06", 1) < 0)
2078                 ret = -1;
2079 #ifdef CONFIG_IEEE80211W
2080         /* SA Query */
2081         if (nl80211_register_action_frame(bss, (u8 *) "\x08", 1) < 0)
2082                 ret = -1;
2083 #endif /* CONFIG_IEEE80211W */
2084         /* Protected Dual of Public Action */
2085         if (nl80211_register_action_frame(bss, (u8 *) "\x09", 1) < 0)
2086                 ret = -1;
2087         /* WNM */
2088         if (nl80211_register_action_frame(bss, (u8 *) "\x0a", 1) < 0)
2089                 ret = -1;
2090         /* WMM */
2091         if (nl80211_register_action_frame(bss, (u8 *) "\x11", 1) < 0)
2092                 ret = -1;
2093 #ifdef CONFIG_FST
2094         /* FST Action frames */
2095         if (nl80211_register_action_frame(bss, (u8 *) "\x12", 1) < 0)
2096                 ret = -1;
2097 #endif /* CONFIG_FST */
2098         /* Vendor-specific */
2099         if (nl80211_register_action_frame(bss, (u8 *) "\x7f", 1) < 0)
2100                 ret = -1;
2101
2102         return ret;
2103 }
2104
2105
2106 static int nl80211_mgmt_subscribe_ap(struct i802_bss *bss)
2107 {
2108         static const int stypes[] = {
2109                 WLAN_FC_STYPE_AUTH,
2110                 WLAN_FC_STYPE_ASSOC_REQ,
2111                 WLAN_FC_STYPE_REASSOC_REQ,
2112                 WLAN_FC_STYPE_DISASSOC,
2113                 WLAN_FC_STYPE_DEAUTH,
2114                 WLAN_FC_STYPE_PROBE_REQ,
2115 /* Beacon doesn't work as mac80211 doesn't currently allow
2116  * it, but it wouldn't really be the right thing anyway as
2117  * it isn't per interface ... maybe just dump the scan
2118  * results periodically for OLBC?
2119  */
2120                 /* WLAN_FC_STYPE_BEACON, */
2121         };
2122         unsigned int i;
2123
2124         if (nl80211_alloc_mgmt_handle(bss))
2125                 return -1;
2126         wpa_printf(MSG_DEBUG, "nl80211: Subscribe to mgmt frames with AP "
2127                    "handle %p", bss->nl_mgmt);
2128
2129         for (i = 0; i < ARRAY_SIZE(stypes); i++) {
2130                 if (nl80211_register_frame(bss, bss->nl_mgmt,
2131                                            (WLAN_FC_TYPE_MGMT << 2) |
2132                                            (stypes[i] << 4),
2133                                            NULL, 0) < 0) {
2134                         goto out_err;
2135                 }
2136         }
2137
2138         if (nl80211_action_subscribe_ap(bss))
2139                 goto out_err;
2140
2141         if (nl80211_register_spurious_class3(bss))
2142                 goto out_err;
2143
2144         if (nl80211_get_wiphy_data_ap(bss) == NULL)
2145                 goto out_err;
2146
2147         nl80211_mgmt_handle_register_eloop(bss);
2148         return 0;
2149
2150 out_err:
2151         nl_destroy_handles(&bss->nl_mgmt);
2152         return -1;
2153 }
2154
2155
2156 static int nl80211_mgmt_subscribe_ap_dev_sme(struct i802_bss *bss)
2157 {
2158         if (nl80211_alloc_mgmt_handle(bss))
2159                 return -1;
2160         wpa_printf(MSG_DEBUG, "nl80211: Subscribe to mgmt frames with AP "
2161                    "handle %p (device SME)", bss->nl_mgmt);
2162
2163         if (nl80211_action_subscribe_ap(bss))
2164                 goto out_err;
2165
2166         nl80211_mgmt_handle_register_eloop(bss);
2167         return 0;
2168
2169 out_err:
2170         nl_destroy_handles(&bss->nl_mgmt);
2171         return -1;
2172 }
2173
2174
2175 static void nl80211_mgmt_unsubscribe(struct i802_bss *bss, const char *reason)
2176 {
2177         if (bss->nl_mgmt == NULL)
2178                 return;
2179         wpa_printf(MSG_DEBUG, "nl80211: Unsubscribe mgmt frames handle %p "
2180                    "(%s)", bss->nl_mgmt, reason);
2181         nl80211_destroy_eloop_handle(&bss->nl_mgmt);
2182
2183         nl80211_put_wiphy_data_ap(bss);
2184 }
2185
2186
2187 static void wpa_driver_nl80211_send_rfkill(void *eloop_ctx, void *timeout_ctx)
2188 {
2189         wpa_supplicant_event(timeout_ctx, EVENT_INTERFACE_DISABLED, NULL);
2190 }
2191
2192
2193 static void nl80211_del_p2pdev(struct i802_bss *bss)
2194 {
2195         struct nl_msg *msg;
2196         int ret;
2197
2198         msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_DEL_INTERFACE);
2199         ret = send_and_recv_msgs(bss->drv, msg, NULL, NULL);
2200
2201         wpa_printf(MSG_DEBUG, "nl80211: Delete P2P Device %s (0x%llx): %s",
2202                    bss->ifname, (long long unsigned int) bss->wdev_id,
2203                    strerror(-ret));
2204 }
2205
2206
2207 static int nl80211_set_p2pdev(struct i802_bss *bss, int start)
2208 {
2209         struct nl_msg *msg;
2210         int ret;
2211
2212         msg = nl80211_cmd_msg(bss, 0, start ? NL80211_CMD_START_P2P_DEVICE :
2213                               NL80211_CMD_STOP_P2P_DEVICE);
2214         ret = send_and_recv_msgs(bss->drv, msg, NULL, NULL);
2215
2216         wpa_printf(MSG_DEBUG, "nl80211: %s P2P Device %s (0x%llx): %s",
2217                    start ? "Start" : "Stop",
2218                    bss->ifname, (long long unsigned int) bss->wdev_id,
2219                    strerror(-ret));
2220         return ret;
2221 }
2222
2223
2224 static int i802_set_iface_flags(struct i802_bss *bss, int up)
2225 {
2226         enum nl80211_iftype nlmode;
2227
2228         nlmode = nl80211_get_ifmode(bss);
2229         if (nlmode != NL80211_IFTYPE_P2P_DEVICE) {
2230                 return linux_set_iface_flags(bss->drv->global->ioctl_sock,
2231                                              bss->ifname, up);
2232         }
2233
2234         /* P2P Device has start/stop which is equivalent */
2235         return nl80211_set_p2pdev(bss, up);
2236 }
2237
2238
2239 #ifdef CONFIG_TESTING_OPTIONS
2240 static int qca_vendor_test_cmd_handler(struct nl_msg *msg, void *arg)
2241 {
2242         /* struct wpa_driver_nl80211_data *drv = arg; */
2243         struct nlattr *tb[NL80211_ATTR_MAX + 1];
2244         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
2245
2246
2247         wpa_printf(MSG_DEBUG,
2248                    "nl80211: QCA vendor test command response received");
2249
2250         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
2251                   genlmsg_attrlen(gnlh, 0), NULL);
2252         if (!tb[NL80211_ATTR_VENDOR_DATA]) {
2253                 wpa_printf(MSG_DEBUG, "nl80211: No vendor data attribute");
2254                 return NL_SKIP;
2255         }
2256
2257         wpa_hexdump(MSG_DEBUG,
2258                     "nl80211: Received QCA vendor test command response",
2259                     nla_data(tb[NL80211_ATTR_VENDOR_DATA]),
2260                     nla_len(tb[NL80211_ATTR_VENDOR_DATA]));
2261
2262         return NL_SKIP;
2263 }
2264 #endif /* CONFIG_TESTING_OPTIONS */
2265
2266
2267 static void qca_vendor_test(struct wpa_driver_nl80211_data *drv)
2268 {
2269 #ifdef CONFIG_TESTING_OPTIONS
2270         struct nl_msg *msg;
2271         struct nlattr *params;
2272         int ret;
2273
2274         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
2275             nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
2276             nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
2277                         QCA_NL80211_VENDOR_SUBCMD_TEST) ||
2278             !(params = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
2279             nla_put_u32(msg, QCA_WLAN_VENDOR_ATTR_TEST, 123)) {
2280                 nlmsg_free(msg);
2281                 return;
2282         }
2283         nla_nest_end(msg, params);
2284
2285         ret = send_and_recv_msgs(drv, msg, qca_vendor_test_cmd_handler, drv);
2286         wpa_printf(MSG_DEBUG,
2287                    "nl80211: QCA vendor test command returned %d (%s)",
2288                    ret, strerror(-ret));
2289 #endif /* CONFIG_TESTING_OPTIONS */
2290 }
2291
2292
2293 static int
2294 wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv,
2295                                    const u8 *set_addr, int first,
2296                                    const char *driver_params)
2297 {
2298         struct i802_bss *bss = drv->first_bss;
2299         int send_rfkill_event = 0;
2300         enum nl80211_iftype nlmode;
2301
2302         drv->ifindex = if_nametoindex(bss->ifname);
2303         bss->ifindex = drv->ifindex;
2304         bss->wdev_id = drv->global->if_add_wdevid;
2305         bss->wdev_id_set = drv->global->if_add_wdevid_set;
2306
2307         bss->if_dynamic = drv->ifindex == drv->global->if_add_ifindex;
2308         bss->if_dynamic = bss->if_dynamic || drv->global->if_add_wdevid_set;
2309         drv->global->if_add_wdevid_set = 0;
2310
2311         if (!bss->if_dynamic && nl80211_get_ifmode(bss) == NL80211_IFTYPE_AP)
2312                 bss->static_ap = 1;
2313
2314         if (first &&
2315             nl80211_get_ifmode(bss) != NL80211_IFTYPE_P2P_DEVICE &&
2316             linux_iface_up(drv->global->ioctl_sock, bss->ifname) > 0)
2317                 drv->start_iface_up = 1;
2318
2319         if (wpa_driver_nl80211_capa(drv))
2320                 return -1;
2321
2322         if (driver_params && nl80211_set_param(bss, driver_params) < 0)
2323                 return -1;
2324
2325         wpa_printf(MSG_DEBUG, "nl80211: interface %s in phy %s",
2326                    bss->ifname, drv->phyname);
2327
2328         if (set_addr &&
2329             (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 0) ||
2330              linux_set_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
2331                                 set_addr)))
2332                 return -1;
2333
2334         if (first && nl80211_get_ifmode(bss) == NL80211_IFTYPE_AP)
2335                 drv->start_mode_ap = 1;
2336
2337         if (drv->hostapd || bss->static_ap)
2338                 nlmode = NL80211_IFTYPE_AP;
2339         else if (bss->if_dynamic ||
2340                  nl80211_get_ifmode(bss) == NL80211_IFTYPE_MESH_POINT)
2341                 nlmode = nl80211_get_ifmode(bss);
2342         else
2343                 nlmode = NL80211_IFTYPE_STATION;
2344
2345         if (wpa_driver_nl80211_set_mode(bss, nlmode) < 0) {
2346                 wpa_printf(MSG_ERROR, "nl80211: Could not configure driver mode");
2347                 return -1;
2348         }
2349
2350         if (nlmode == NL80211_IFTYPE_P2P_DEVICE)
2351                 nl80211_get_macaddr(bss);
2352
2353         wpa_driver_nl80211_drv_init_rfkill(drv);
2354
2355         if (!rfkill_is_blocked(drv->rfkill)) {
2356                 int ret = i802_set_iface_flags(bss, 1);
2357                 if (ret) {
2358                         wpa_printf(MSG_ERROR, "nl80211: Could not set "
2359                                    "interface '%s' UP", bss->ifname);
2360                         return ret;
2361                 }
2362
2363                 if (is_p2p_net_interface(nlmode))
2364                         nl80211_disable_11b_rates(bss->drv,
2365                                                   bss->drv->ifindex, 1);
2366
2367                 if (nlmode == NL80211_IFTYPE_P2P_DEVICE)
2368                         return ret;
2369         } else {
2370                 wpa_printf(MSG_DEBUG, "nl80211: Could not yet enable "
2371                            "interface '%s' due to rfkill", bss->ifname);
2372                 if (nlmode != NL80211_IFTYPE_P2P_DEVICE)
2373                         drv->if_disabled = 1;
2374
2375                 send_rfkill_event = 1;
2376         }
2377
2378         if (!drv->hostapd && nlmode != NL80211_IFTYPE_P2P_DEVICE)
2379                 netlink_send_oper_ifla(drv->global->netlink, drv->ifindex,
2380                                        1, IF_OPER_DORMANT);
2381
2382         if (nlmode != NL80211_IFTYPE_P2P_DEVICE) {
2383                 if (linux_get_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
2384                                        bss->addr))
2385                         return -1;
2386                 os_memcpy(drv->perm_addr, bss->addr, ETH_ALEN);
2387         }
2388
2389         if (send_rfkill_event) {
2390                 eloop_register_timeout(0, 0, wpa_driver_nl80211_send_rfkill,
2391                                        drv, drv->ctx);
2392         }
2393
2394         if (drv->vendor_cmd_test_avail)
2395                 qca_vendor_test(drv);
2396
2397         return 0;
2398 }
2399
2400
2401 static int wpa_driver_nl80211_del_beacon(struct wpa_driver_nl80211_data *drv)
2402 {
2403         struct nl_msg *msg;
2404
2405         wpa_printf(MSG_DEBUG, "nl80211: Remove beacon (ifindex=%d)",
2406                    drv->ifindex);
2407         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_DEL_BEACON);
2408         return send_and_recv_msgs(drv, msg, NULL, NULL);
2409 }
2410
2411
2412 /**
2413  * wpa_driver_nl80211_deinit - Deinitialize nl80211 driver interface
2414  * @bss: Pointer to private nl80211 data from wpa_driver_nl80211_init()
2415  *
2416  * Shut down driver interface and processing of driver events. Free
2417  * private data buffer if one was allocated in wpa_driver_nl80211_init().
2418  */
2419 static void wpa_driver_nl80211_deinit(struct i802_bss *bss)
2420 {
2421         struct wpa_driver_nl80211_data *drv = bss->drv;
2422         unsigned int i;
2423
2424         wpa_printf(MSG_INFO, "nl80211: deinit ifname=%s disabled_11b_rates=%d",
2425                    bss->ifname, drv->disabled_11b_rates);
2426
2427         bss->in_deinit = 1;
2428         if (drv->data_tx_status)
2429                 eloop_unregister_read_sock(drv->eapol_tx_sock);
2430         if (drv->eapol_tx_sock >= 0)
2431                 close(drv->eapol_tx_sock);
2432
2433         if (bss->nl_preq)
2434                 wpa_driver_nl80211_probe_req_report(bss, 0);
2435         if (bss->added_if_into_bridge) {
2436                 if (linux_br_del_if(drv->global->ioctl_sock, bss->brname,
2437                                     bss->ifname) < 0)
2438                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
2439                                    "interface %s from bridge %s: %s",
2440                                    bss->ifname, bss->brname, strerror(errno));
2441                 if (drv->rtnl_sk)
2442                         nl80211_handle_destroy(drv->rtnl_sk);
2443         }
2444         if (bss->added_bridge) {
2445                 if (linux_set_iface_flags(drv->global->ioctl_sock, bss->brname,
2446                                           0) < 0)
2447                         wpa_printf(MSG_INFO,
2448                                    "nl80211: Could not set bridge %s down",
2449                                    bss->brname);
2450                 if (linux_br_del(drv->global->ioctl_sock, bss->brname) < 0)
2451                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
2452                                    "bridge %s: %s",
2453                                    bss->brname, strerror(errno));
2454         }
2455
2456         nl80211_remove_monitor_interface(drv);
2457
2458         if (is_ap_interface(drv->nlmode))
2459                 wpa_driver_nl80211_del_beacon(drv);
2460
2461         if (drv->eapol_sock >= 0) {
2462                 eloop_unregister_read_sock(drv->eapol_sock);
2463                 close(drv->eapol_sock);
2464         }
2465
2466         if (drv->if_indices != drv->default_if_indices)
2467                 os_free(drv->if_indices);
2468
2469         if (drv->if_indices_reason != drv->default_if_indices_reason)
2470                 os_free(drv->if_indices_reason);
2471
2472         if (drv->disabled_11b_rates)
2473                 nl80211_disable_11b_rates(drv, drv->ifindex, 0);
2474
2475         netlink_send_oper_ifla(drv->global->netlink, drv->ifindex, 0,
2476                                IF_OPER_UP);
2477         eloop_cancel_timeout(wpa_driver_nl80211_send_rfkill, drv, drv->ctx);
2478         rfkill_deinit(drv->rfkill);
2479
2480         eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
2481
2482         if (!drv->start_iface_up)
2483                 (void) i802_set_iface_flags(bss, 0);
2484
2485         if (drv->addr_changed) {
2486                 if (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname,
2487                                           0) < 0) {
2488                         wpa_printf(MSG_DEBUG,
2489                                    "nl80211: Could not set interface down to restore permanent MAC address");
2490                 }
2491                 if (linux_set_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
2492                                        drv->perm_addr) < 0) {
2493                         wpa_printf(MSG_DEBUG,
2494                                    "nl80211: Could not restore permanent MAC address");
2495                 }
2496         }
2497
2498         if (drv->nlmode != NL80211_IFTYPE_P2P_DEVICE) {
2499                 if (!drv->hostapd || !drv->start_mode_ap)
2500                         wpa_driver_nl80211_set_mode(bss,
2501                                                     NL80211_IFTYPE_STATION);
2502                 nl80211_mgmt_unsubscribe(bss, "deinit");
2503         } else {
2504                 nl80211_mgmt_unsubscribe(bss, "deinit");
2505                 nl80211_del_p2pdev(bss);
2506         }
2507
2508         nl80211_destroy_bss(drv->first_bss);
2509
2510         os_free(drv->filter_ssids);
2511
2512         os_free(drv->auth_ie);
2513
2514         if (drv->in_interface_list)
2515                 dl_list_del(&drv->list);
2516
2517         os_free(drv->extended_capa);
2518         os_free(drv->extended_capa_mask);
2519         for (i = 0; i < drv->num_iface_ext_capa; i++) {
2520                 os_free(drv->iface_ext_capa[i].ext_capa);
2521                 os_free(drv->iface_ext_capa[i].ext_capa_mask);
2522         }
2523         os_free(drv->first_bss);
2524         os_free(drv);
2525 }
2526
2527
2528 static u32 wpa_alg_to_cipher_suite(enum wpa_alg alg, size_t key_len)
2529 {
2530         switch (alg) {
2531         case WPA_ALG_WEP:
2532                 if (key_len == 5)
2533                         return WLAN_CIPHER_SUITE_WEP40;
2534                 return WLAN_CIPHER_SUITE_WEP104;
2535         case WPA_ALG_TKIP:
2536                 return WLAN_CIPHER_SUITE_TKIP;
2537         case WPA_ALG_CCMP:
2538                 return WLAN_CIPHER_SUITE_CCMP;
2539         case WPA_ALG_GCMP:
2540                 return WLAN_CIPHER_SUITE_GCMP;
2541         case WPA_ALG_CCMP_256:
2542                 return WLAN_CIPHER_SUITE_CCMP_256;
2543         case WPA_ALG_GCMP_256:
2544                 return WLAN_CIPHER_SUITE_GCMP_256;
2545         case WPA_ALG_IGTK:
2546                 return WLAN_CIPHER_SUITE_AES_CMAC;
2547         case WPA_ALG_BIP_GMAC_128:
2548                 return WLAN_CIPHER_SUITE_BIP_GMAC_128;
2549         case WPA_ALG_BIP_GMAC_256:
2550                 return WLAN_CIPHER_SUITE_BIP_GMAC_256;
2551         case WPA_ALG_BIP_CMAC_256:
2552                 return WLAN_CIPHER_SUITE_BIP_CMAC_256;
2553         case WPA_ALG_SMS4:
2554                 return WLAN_CIPHER_SUITE_SMS4;
2555         case WPA_ALG_KRK:
2556                 return WLAN_CIPHER_SUITE_KRK;
2557         case WPA_ALG_NONE:
2558         case WPA_ALG_PMK:
2559                 wpa_printf(MSG_ERROR, "nl80211: Unexpected encryption algorithm %d",
2560                            alg);
2561                 return 0;
2562         }
2563
2564         wpa_printf(MSG_ERROR, "nl80211: Unsupported encryption algorithm %d",
2565                    alg);
2566         return 0;
2567 }
2568
2569
2570 static u32 wpa_cipher_to_cipher_suite(unsigned int cipher)
2571 {
2572         switch (cipher) {
2573         case WPA_CIPHER_CCMP_256:
2574                 return WLAN_CIPHER_SUITE_CCMP_256;
2575         case WPA_CIPHER_GCMP_256:
2576                 return WLAN_CIPHER_SUITE_GCMP_256;
2577         case WPA_CIPHER_CCMP:
2578                 return WLAN_CIPHER_SUITE_CCMP;
2579         case WPA_CIPHER_GCMP:
2580                 return WLAN_CIPHER_SUITE_GCMP;
2581         case WPA_CIPHER_TKIP:
2582                 return WLAN_CIPHER_SUITE_TKIP;
2583         case WPA_CIPHER_WEP104:
2584                 return WLAN_CIPHER_SUITE_WEP104;
2585         case WPA_CIPHER_WEP40:
2586                 return WLAN_CIPHER_SUITE_WEP40;
2587         case WPA_CIPHER_GTK_NOT_USED:
2588                 return WLAN_CIPHER_SUITE_NO_GROUP_ADDR;
2589         }
2590
2591         return 0;
2592 }
2593
2594
2595 static int wpa_cipher_to_cipher_suites(unsigned int ciphers, u32 suites[],
2596                                        int max_suites)
2597 {
2598         int num_suites = 0;
2599
2600         if (num_suites < max_suites && ciphers & WPA_CIPHER_CCMP_256)
2601                 suites[num_suites++] = WLAN_CIPHER_SUITE_CCMP_256;
2602         if (num_suites < max_suites && ciphers & WPA_CIPHER_GCMP_256)
2603                 suites[num_suites++] = WLAN_CIPHER_SUITE_GCMP_256;
2604         if (num_suites < max_suites && ciphers & WPA_CIPHER_CCMP)
2605                 suites[num_suites++] = WLAN_CIPHER_SUITE_CCMP;
2606         if (num_suites < max_suites && ciphers & WPA_CIPHER_GCMP)
2607                 suites[num_suites++] = WLAN_CIPHER_SUITE_GCMP;
2608         if (num_suites < max_suites && ciphers & WPA_CIPHER_TKIP)
2609                 suites[num_suites++] = WLAN_CIPHER_SUITE_TKIP;
2610         if (num_suites < max_suites && ciphers & WPA_CIPHER_WEP104)
2611                 suites[num_suites++] = WLAN_CIPHER_SUITE_WEP104;
2612         if (num_suites < max_suites && ciphers & WPA_CIPHER_WEP40)
2613                 suites[num_suites++] = WLAN_CIPHER_SUITE_WEP40;
2614
2615         return num_suites;
2616 }
2617
2618
2619 #ifdef CONFIG_DRIVER_NL80211_QCA
2620 static int issue_key_mgmt_set_key(struct wpa_driver_nl80211_data *drv,
2621                                   const u8 *key, size_t key_len)
2622 {
2623         struct nl_msg *msg;
2624         int ret;
2625
2626         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_KEY_MGMT_OFFLOAD))
2627                 return 0;
2628
2629         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
2630             nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
2631             nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
2632                         QCA_NL80211_VENDOR_SUBCMD_KEY_MGMT_SET_KEY) ||
2633             nla_put(msg, NL80211_ATTR_VENDOR_DATA, key_len, key)) {
2634                 nl80211_nlmsg_clear(msg);
2635                 nlmsg_free(msg);
2636                 return -1;
2637         }
2638         ret = send_and_recv_msgs(drv, msg, NULL, (void *) -1);
2639         if (ret) {
2640                 wpa_printf(MSG_DEBUG,
2641                            "nl80211: Key management set key failed: ret=%d (%s)",
2642                            ret, strerror(-ret));
2643         }
2644
2645         return ret;
2646 }
2647 #endif /* CONFIG_DRIVER_NL80211_QCA */
2648
2649
2650 static int wpa_driver_nl80211_set_key(const char *ifname, struct i802_bss *bss,
2651                                       enum wpa_alg alg, const u8 *addr,
2652                                       int key_idx, int set_tx,
2653                                       const u8 *seq, size_t seq_len,
2654                                       const u8 *key, size_t key_len)
2655 {
2656         struct wpa_driver_nl80211_data *drv = bss->drv;
2657         int ifindex;
2658         struct nl_msg *msg = NULL;
2659         int ret;
2660         int tdls = 0;
2661
2662         /* Ignore for P2P Device */
2663         if (drv->nlmode == NL80211_IFTYPE_P2P_DEVICE)
2664                 return 0;
2665
2666         ifindex = if_nametoindex(ifname);
2667         wpa_printf(MSG_DEBUG, "%s: ifindex=%d (%s) alg=%d addr=%p key_idx=%d "
2668                    "set_tx=%d seq_len=%lu key_len=%lu",
2669                    __func__, ifindex, ifname, alg, addr, key_idx, set_tx,
2670                    (unsigned long) seq_len, (unsigned long) key_len);
2671 #ifdef CONFIG_TDLS
2672         if (key_idx == -1) {
2673                 key_idx = 0;
2674                 tdls = 1;
2675         }
2676 #endif /* CONFIG_TDLS */
2677
2678 #ifdef CONFIG_DRIVER_NL80211_QCA
2679         if (alg == WPA_ALG_PMK &&
2680             (drv->capa.flags & WPA_DRIVER_FLAGS_KEY_MGMT_OFFLOAD)) {
2681                 wpa_printf(MSG_DEBUG, "%s: calling issue_key_mgmt_set_key",
2682                            __func__);
2683                 ret = issue_key_mgmt_set_key(drv, key, key_len);
2684                 return ret;
2685         }
2686 #endif /* CONFIG_DRIVER_NL80211_QCA */
2687
2688         if (alg == WPA_ALG_NONE) {
2689                 msg = nl80211_ifindex_msg(drv, ifindex, 0, NL80211_CMD_DEL_KEY);
2690                 if (!msg)
2691                         return -ENOBUFS;
2692         } else {
2693                 u32 suite;
2694
2695                 suite = wpa_alg_to_cipher_suite(alg, key_len);
2696                 if (!suite)
2697                         goto fail;
2698                 msg = nl80211_ifindex_msg(drv, ifindex, 0, NL80211_CMD_NEW_KEY);
2699                 if (!msg ||
2700                     nla_put(msg, NL80211_ATTR_KEY_DATA, key_len, key) ||
2701                     nla_put_u32(msg, NL80211_ATTR_KEY_CIPHER, suite))
2702                         goto fail;
2703                 wpa_hexdump_key(MSG_DEBUG, "nl80211: KEY_DATA", key, key_len);
2704         }
2705
2706         if (seq && seq_len) {
2707                 if (nla_put(msg, NL80211_ATTR_KEY_SEQ, seq_len, seq))
2708                         goto fail;
2709                 wpa_hexdump(MSG_DEBUG, "nl80211: KEY_SEQ", seq, seq_len);
2710         }
2711
2712         if (addr && !is_broadcast_ether_addr(addr)) {
2713                 wpa_printf(MSG_DEBUG, "   addr=" MACSTR, MAC2STR(addr));
2714                 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
2715                         goto fail;
2716
2717                 if (alg != WPA_ALG_WEP && key_idx && !set_tx) {
2718                         wpa_printf(MSG_DEBUG, "   RSN IBSS RX GTK");
2719                         if (nla_put_u32(msg, NL80211_ATTR_KEY_TYPE,
2720                                         NL80211_KEYTYPE_GROUP))
2721                                 goto fail;
2722                 }
2723         } else if (addr && is_broadcast_ether_addr(addr)) {
2724                 struct nlattr *types;
2725
2726                 wpa_printf(MSG_DEBUG, "   broadcast key");
2727
2728                 types = nla_nest_start(msg, NL80211_ATTR_KEY_DEFAULT_TYPES);
2729                 if (!types ||
2730                     nla_put_flag(msg, NL80211_KEY_DEFAULT_TYPE_MULTICAST))
2731                         goto fail;
2732                 nla_nest_end(msg, types);
2733         }
2734         if (nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2735                 goto fail;
2736
2737         ret = send_and_recv_msgs(drv, msg, NULL, key ? (void *) -1 : NULL);
2738         if ((ret == -ENOENT || ret == -ENOLINK) && alg == WPA_ALG_NONE)
2739                 ret = 0;
2740         if (ret)
2741                 wpa_printf(MSG_DEBUG, "nl80211: set_key failed; err=%d %s)",
2742                            ret, strerror(-ret));
2743
2744         /*
2745          * If we failed or don't need to set the default TX key (below),
2746          * we're done here.
2747          */
2748         if (ret || !set_tx || alg == WPA_ALG_NONE || tdls)
2749                 return ret;
2750         if (is_ap_interface(drv->nlmode) && addr &&
2751             !is_broadcast_ether_addr(addr))
2752                 return ret;
2753
2754         msg = nl80211_ifindex_msg(drv, ifindex, 0, NL80211_CMD_SET_KEY);
2755         if (!msg ||
2756             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx) ||
2757             nla_put_flag(msg, (alg == WPA_ALG_IGTK ||
2758                                alg == WPA_ALG_BIP_GMAC_128 ||
2759                                alg == WPA_ALG_BIP_GMAC_256 ||
2760                                alg == WPA_ALG_BIP_CMAC_256) ?
2761                          NL80211_ATTR_KEY_DEFAULT_MGMT :
2762                          NL80211_ATTR_KEY_DEFAULT))
2763                 goto fail;
2764         if (addr && is_broadcast_ether_addr(addr)) {
2765                 struct nlattr *types;
2766
2767                 types = nla_nest_start(msg, NL80211_ATTR_KEY_DEFAULT_TYPES);
2768                 if (!types ||
2769                     nla_put_flag(msg, NL80211_KEY_DEFAULT_TYPE_MULTICAST))
2770                         goto fail;
2771                 nla_nest_end(msg, types);
2772         } else if (addr) {
2773                 struct nlattr *types;
2774
2775                 types = nla_nest_start(msg, NL80211_ATTR_KEY_DEFAULT_TYPES);
2776                 if (!types ||
2777                     nla_put_flag(msg, NL80211_KEY_DEFAULT_TYPE_UNICAST))
2778                         goto fail;
2779                 nla_nest_end(msg, types);
2780         }
2781
2782         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
2783         if (ret == -ENOENT)
2784                 ret = 0;
2785         if (ret)
2786                 wpa_printf(MSG_DEBUG, "nl80211: set_key default failed; "
2787                            "err=%d %s)", ret, strerror(-ret));
2788         return ret;
2789
2790 fail:
2791         nl80211_nlmsg_clear(msg);
2792         nlmsg_free(msg);
2793         return -ENOBUFS;
2794 }
2795
2796
2797 static int nl_add_key(struct nl_msg *msg, enum wpa_alg alg,
2798                       int key_idx, int defkey,
2799                       const u8 *seq, size_t seq_len,
2800                       const u8 *key, size_t key_len)
2801 {
2802         struct nlattr *key_attr = nla_nest_start(msg, NL80211_ATTR_KEY);
2803         u32 suite;
2804
2805         if (!key_attr)
2806                 return -1;
2807
2808         suite = wpa_alg_to_cipher_suite(alg, key_len);
2809         if (!suite)
2810                 return -1;
2811
2812         if (defkey && alg == WPA_ALG_IGTK) {
2813                 if (nla_put_flag(msg, NL80211_KEY_DEFAULT_MGMT))
2814                         return -1;
2815         } else if (defkey) {
2816                 if (nla_put_flag(msg, NL80211_KEY_DEFAULT))
2817                         return -1;
2818         }
2819
2820         if (nla_put_u8(msg, NL80211_KEY_IDX, key_idx) ||
2821             nla_put_u32(msg, NL80211_KEY_CIPHER, suite) ||
2822             (seq && seq_len &&
2823              nla_put(msg, NL80211_KEY_SEQ, seq_len, seq)) ||
2824             nla_put(msg, NL80211_KEY_DATA, key_len, key))
2825                 return -1;
2826
2827         nla_nest_end(msg, key_attr);
2828
2829         return 0;
2830 }
2831
2832
2833 static int nl80211_set_conn_keys(struct wpa_driver_associate_params *params,
2834                                  struct nl_msg *msg)
2835 {
2836         int i, privacy = 0;
2837         struct nlattr *nl_keys, *nl_key;
2838
2839         for (i = 0; i < 4; i++) {
2840                 if (!params->wep_key[i])
2841                         continue;
2842                 privacy = 1;
2843                 break;
2844         }
2845         if (params->wps == WPS_MODE_PRIVACY)
2846                 privacy = 1;
2847         if (params->pairwise_suite &&
2848             params->pairwise_suite != WPA_CIPHER_NONE)
2849                 privacy = 1;
2850
2851         if (!privacy)
2852                 return 0;
2853
2854         if (nla_put_flag(msg, NL80211_ATTR_PRIVACY))
2855                 return -ENOBUFS;
2856
2857         nl_keys = nla_nest_start(msg, NL80211_ATTR_KEYS);
2858         if (!nl_keys)
2859                 return -ENOBUFS;
2860
2861         for (i = 0; i < 4; i++) {
2862                 if (!params->wep_key[i])
2863                         continue;
2864
2865                 nl_key = nla_nest_start(msg, i);
2866                 if (!nl_key ||
2867                     nla_put(msg, NL80211_KEY_DATA, params->wep_key_len[i],
2868                             params->wep_key[i]) ||
2869                     nla_put_u32(msg, NL80211_KEY_CIPHER,
2870                                 params->wep_key_len[i] == 5 ?
2871                                 WLAN_CIPHER_SUITE_WEP40 :
2872                                 WLAN_CIPHER_SUITE_WEP104) ||
2873                     nla_put_u8(msg, NL80211_KEY_IDX, i) ||
2874                     (i == params->wep_tx_keyidx &&
2875                      nla_put_flag(msg, NL80211_KEY_DEFAULT)))
2876                         return -ENOBUFS;
2877
2878                 nla_nest_end(msg, nl_key);
2879         }
2880         nla_nest_end(msg, nl_keys);
2881
2882         return 0;
2883 }
2884
2885
2886 int wpa_driver_nl80211_mlme(struct wpa_driver_nl80211_data *drv,
2887                             const u8 *addr, int cmd, u16 reason_code,
2888                             int local_state_change)
2889 {
2890         int ret;
2891         struct nl_msg *msg;
2892
2893         if (!(msg = nl80211_drv_msg(drv, 0, cmd)) ||
2894             nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code) ||
2895             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
2896             (local_state_change &&
2897              nla_put_flag(msg, NL80211_ATTR_LOCAL_STATE_CHANGE))) {
2898                 nlmsg_free(msg);
2899                 return -1;
2900         }
2901
2902         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
2903         if (ret) {
2904                 wpa_dbg(drv->ctx, MSG_DEBUG,
2905                         "nl80211: MLME command failed: reason=%u ret=%d (%s)",
2906                         reason_code, ret, strerror(-ret));
2907         }
2908         return ret;
2909 }
2910
2911
2912 static int wpa_driver_nl80211_disconnect(struct wpa_driver_nl80211_data *drv,
2913                                          int reason_code)
2914 {
2915         int ret;
2916
2917         wpa_printf(MSG_DEBUG, "%s(reason_code=%d)", __func__, reason_code);
2918         nl80211_mark_disconnected(drv);
2919         /* Disconnect command doesn't need BSSID - it uses cached value */
2920         ret = wpa_driver_nl80211_mlme(drv, NULL, NL80211_CMD_DISCONNECT,
2921                                       reason_code, 0);
2922         /*
2923          * For locally generated disconnect, supplicant already generates a
2924          * DEAUTH event, so ignore the event from NL80211.
2925          */
2926         drv->ignore_next_local_disconnect = ret == 0;
2927
2928         return ret;
2929 }
2930
2931
2932 static int wpa_driver_nl80211_deauthenticate(struct i802_bss *bss,
2933                                              const u8 *addr, int reason_code)
2934 {
2935         struct wpa_driver_nl80211_data *drv = bss->drv;
2936         int ret;
2937
2938         if (drv->nlmode == NL80211_IFTYPE_ADHOC) {
2939                 nl80211_mark_disconnected(drv);
2940                 return nl80211_leave_ibss(drv, 1);
2941         }
2942         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME))
2943                 return wpa_driver_nl80211_disconnect(drv, reason_code);
2944         wpa_printf(MSG_DEBUG, "%s(addr=" MACSTR " reason_code=%d)",
2945                    __func__, MAC2STR(addr), reason_code);
2946         nl80211_mark_disconnected(drv);
2947         ret = wpa_driver_nl80211_mlme(drv, addr, NL80211_CMD_DEAUTHENTICATE,
2948                                       reason_code, 0);
2949         /*
2950          * For locally generated deauthenticate, supplicant already generates a
2951          * DEAUTH event, so ignore the event from NL80211.
2952          */
2953         drv->ignore_next_local_deauth = ret == 0;
2954         return ret;
2955 }
2956
2957
2958 static void nl80211_copy_auth_params(struct wpa_driver_nl80211_data *drv,
2959                                      struct wpa_driver_auth_params *params)
2960 {
2961         int i;
2962
2963         drv->auth_freq = params->freq;
2964         drv->auth_alg = params->auth_alg;
2965         drv->auth_wep_tx_keyidx = params->wep_tx_keyidx;
2966         drv->auth_local_state_change = params->local_state_change;
2967         drv->auth_p2p = params->p2p;
2968
2969         if (params->bssid)
2970                 os_memcpy(drv->auth_bssid_, params->bssid, ETH_ALEN);
2971         else
2972                 os_memset(drv->auth_bssid_, 0, ETH_ALEN);
2973
2974         if (params->ssid) {
2975                 os_memcpy(drv->auth_ssid, params->ssid, params->ssid_len);
2976                 drv->auth_ssid_len = params->ssid_len;
2977         } else
2978                 drv->auth_ssid_len = 0;
2979
2980
2981         os_free(drv->auth_ie);
2982         drv->auth_ie = NULL;
2983         drv->auth_ie_len = 0;
2984         if (params->ie) {
2985                 drv->auth_ie = os_malloc(params->ie_len);
2986                 if (drv->auth_ie) {
2987                         os_memcpy(drv->auth_ie, params->ie, params->ie_len);
2988                         drv->auth_ie_len = params->ie_len;
2989                 }
2990         }
2991
2992         for (i = 0; i < 4; i++) {
2993                 if (params->wep_key[i] && params->wep_key_len[i] &&
2994                     params->wep_key_len[i] <= 16) {
2995                         os_memcpy(drv->auth_wep_key[i], params->wep_key[i],
2996                                   params->wep_key_len[i]);
2997                         drv->auth_wep_key_len[i] = params->wep_key_len[i];
2998                 } else
2999                         drv->auth_wep_key_len[i] = 0;
3000         }
3001 }
3002
3003
3004 static void nl80211_unmask_11b_rates(struct i802_bss *bss)
3005 {
3006         struct wpa_driver_nl80211_data *drv = bss->drv;
3007
3008         if (is_p2p_net_interface(drv->nlmode) || !drv->disabled_11b_rates)
3009                 return;
3010
3011         /*
3012          * Looks like we failed to unmask 11b rates previously. This could
3013          * happen, e.g., if the interface was down at the point in time when a
3014          * P2P group was terminated.
3015          */
3016         wpa_printf(MSG_DEBUG,
3017                    "nl80211: Interface %s mode is for non-P2P, but 11b rates were disabled - re-enable them",
3018                    bss->ifname);
3019         nl80211_disable_11b_rates(drv, drv->ifindex, 0);
3020 }
3021
3022
3023 static int wpa_driver_nl80211_authenticate(
3024         struct i802_bss *bss, struct wpa_driver_auth_params *params)
3025 {
3026         struct wpa_driver_nl80211_data *drv = bss->drv;
3027         int ret = -1, i;
3028         struct nl_msg *msg;
3029         enum nl80211_auth_type type;
3030         enum nl80211_iftype nlmode;
3031         int count = 0;
3032         int is_retry;
3033
3034         nl80211_unmask_11b_rates(bss);
3035
3036         is_retry = drv->retry_auth;
3037         drv->retry_auth = 0;
3038         drv->ignore_deauth_event = 0;
3039
3040         nl80211_mark_disconnected(drv);
3041         os_memset(drv->auth_bssid, 0, ETH_ALEN);
3042         if (params->bssid)
3043                 os_memcpy(drv->auth_attempt_bssid, params->bssid, ETH_ALEN);
3044         else
3045                 os_memset(drv->auth_attempt_bssid, 0, ETH_ALEN);
3046         /* FIX: IBSS mode */
3047         nlmode = params->p2p ?
3048                 NL80211_IFTYPE_P2P_CLIENT : NL80211_IFTYPE_STATION;
3049         if (drv->nlmode != nlmode &&
3050             wpa_driver_nl80211_set_mode(bss, nlmode) < 0)
3051                 return -1;
3052
3053 retry:
3054         wpa_printf(MSG_DEBUG, "nl80211: Authenticate (ifindex=%d)",
3055                    drv->ifindex);
3056
3057         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_AUTHENTICATE);
3058         if (!msg)
3059                 goto fail;
3060
3061         for (i = 0; i < 4; i++) {
3062                 if (!params->wep_key[i])
3063                         continue;
3064                 wpa_driver_nl80211_set_key(bss->ifname, bss, WPA_ALG_WEP,
3065                                            NULL, i,
3066                                            i == params->wep_tx_keyidx, NULL, 0,
3067                                            params->wep_key[i],
3068                                            params->wep_key_len[i]);
3069                 if (params->wep_tx_keyidx != i)
3070                         continue;
3071                 if (nl_add_key(msg, WPA_ALG_WEP, i, 1, NULL, 0,
3072                                params->wep_key[i], params->wep_key_len[i]))
3073                         goto fail;
3074         }
3075
3076         if (params->bssid) {
3077                 wpa_printf(MSG_DEBUG, "  * bssid=" MACSTR,
3078                            MAC2STR(params->bssid));
3079                 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid))
3080                         goto fail;
3081         }
3082         if (params->freq) {
3083                 wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq);
3084                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq))
3085                         goto fail;
3086         }
3087         if (params->ssid) {
3088                 wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
3089                                   params->ssid, params->ssid_len);
3090                 if (nla_put(msg, NL80211_ATTR_SSID, params->ssid_len,
3091                             params->ssid))
3092                         goto fail;
3093         }
3094         wpa_hexdump(MSG_DEBUG, "  * IEs", params->ie, params->ie_len);
3095         if (params->ie &&
3096             nla_put(msg, NL80211_ATTR_IE, params->ie_len, params->ie))
3097                 goto fail;
3098         if (params->sae_data) {
3099                 wpa_hexdump(MSG_DEBUG, "  * SAE data", params->sae_data,
3100                             params->sae_data_len);
3101                 if (nla_put(msg, NL80211_ATTR_SAE_DATA, params->sae_data_len,
3102                             params->sae_data))
3103                         goto fail;
3104         }
3105         if (params->auth_alg & WPA_AUTH_ALG_OPEN)
3106                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
3107         else if (params->auth_alg & WPA_AUTH_ALG_SHARED)
3108                 type = NL80211_AUTHTYPE_SHARED_KEY;
3109         else if (params->auth_alg & WPA_AUTH_ALG_LEAP)
3110                 type = NL80211_AUTHTYPE_NETWORK_EAP;
3111         else if (params->auth_alg & WPA_AUTH_ALG_FT)
3112                 type = NL80211_AUTHTYPE_FT;
3113         else if (params->auth_alg & WPA_AUTH_ALG_SAE)
3114                 type = NL80211_AUTHTYPE_SAE;
3115         else
3116                 goto fail;
3117         wpa_printf(MSG_DEBUG, "  * Auth Type %d", type);
3118         if (nla_put_u32(msg, NL80211_ATTR_AUTH_TYPE, type))
3119                 goto fail;
3120         if (params->local_state_change) {
3121                 wpa_printf(MSG_DEBUG, "  * Local state change only");
3122                 if (nla_put_flag(msg, NL80211_ATTR_LOCAL_STATE_CHANGE))
3123                         goto fail;
3124         }
3125
3126         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3127         msg = NULL;
3128         if (ret) {
3129                 wpa_dbg(drv->ctx, MSG_DEBUG,
3130                         "nl80211: MLME command failed (auth): ret=%d (%s)",
3131                         ret, strerror(-ret));
3132                 count++;
3133                 if (ret == -EALREADY && count == 1 && params->bssid &&
3134                     !params->local_state_change) {
3135                         /*
3136                          * mac80211 does not currently accept new
3137                          * authentication if we are already authenticated. As a
3138                          * workaround, force deauthentication and try again.
3139                          */
3140                         wpa_printf(MSG_DEBUG, "nl80211: Retry authentication "
3141                                    "after forced deauthentication");
3142                         drv->ignore_deauth_event = 1;
3143                         wpa_driver_nl80211_deauthenticate(
3144                                 bss, params->bssid,
3145                                 WLAN_REASON_PREV_AUTH_NOT_VALID);
3146                         nlmsg_free(msg);
3147                         goto retry;
3148                 }
3149
3150                 if (ret == -ENOENT && params->freq && !is_retry) {
3151                         /*
3152                          * cfg80211 has likely expired the BSS entry even
3153                          * though it was previously available in our internal
3154                          * BSS table. To recover quickly, start a single
3155                          * channel scan on the specified channel.
3156                          */
3157                         struct wpa_driver_scan_params scan;
3158                         int freqs[2];
3159
3160                         os_memset(&scan, 0, sizeof(scan));
3161                         scan.num_ssids = 1;
3162                         if (params->ssid) {
3163                                 scan.ssids[0].ssid = params->ssid;
3164                                 scan.ssids[0].ssid_len = params->ssid_len;
3165                         }
3166                         freqs[0] = params->freq;
3167                         freqs[1] = 0;
3168                         scan.freqs = freqs;
3169                         wpa_printf(MSG_DEBUG, "nl80211: Trigger single "
3170                                    "channel scan to refresh cfg80211 BSS "
3171                                    "entry");
3172                         ret = wpa_driver_nl80211_scan(bss, &scan);
3173                         if (ret == 0) {
3174                                 nl80211_copy_auth_params(drv, params);
3175                                 drv->scan_for_auth = 1;
3176                         }
3177                 } else if (is_retry) {
3178                         /*
3179                          * Need to indicate this with an event since the return
3180                          * value from the retry is not delivered to core code.
3181                          */
3182                         union wpa_event_data event;
3183                         wpa_printf(MSG_DEBUG, "nl80211: Authentication retry "
3184                                    "failed");
3185                         os_memset(&event, 0, sizeof(event));
3186                         os_memcpy(event.timeout_event.addr, drv->auth_bssid_,
3187                                   ETH_ALEN);
3188                         wpa_supplicant_event(drv->ctx, EVENT_AUTH_TIMED_OUT,
3189                                              &event);
3190                 }
3191         } else {
3192                 wpa_printf(MSG_DEBUG,
3193                            "nl80211: Authentication request send successfully");
3194         }
3195
3196 fail:
3197         nlmsg_free(msg);
3198         return ret;
3199 }
3200
3201
3202 int wpa_driver_nl80211_authenticate_retry(struct wpa_driver_nl80211_data *drv)
3203 {
3204         struct wpa_driver_auth_params params;
3205         struct i802_bss *bss = drv->first_bss;
3206         int i;
3207
3208         wpa_printf(MSG_DEBUG, "nl80211: Try to authenticate again");
3209
3210         os_memset(&params, 0, sizeof(params));
3211         params.freq = drv->auth_freq;
3212         params.auth_alg = drv->auth_alg;
3213         params.wep_tx_keyidx = drv->auth_wep_tx_keyidx;
3214         params.local_state_change = drv->auth_local_state_change;
3215         params.p2p = drv->auth_p2p;
3216
3217         if (!is_zero_ether_addr(drv->auth_bssid_))
3218                 params.bssid = drv->auth_bssid_;
3219
3220         if (drv->auth_ssid_len) {
3221                 params.ssid = drv->auth_ssid;
3222                 params.ssid_len = drv->auth_ssid_len;
3223         }
3224
3225         params.ie = drv->auth_ie;
3226         params.ie_len = drv->auth_ie_len;
3227
3228         for (i = 0; i < 4; i++) {
3229                 if (drv->auth_wep_key_len[i]) {
3230                         params.wep_key[i] = drv->auth_wep_key[i];
3231                         params.wep_key_len[i] = drv->auth_wep_key_len[i];
3232                 }
3233         }
3234
3235         drv->retry_auth = 1;
3236         return wpa_driver_nl80211_authenticate(bss, &params);
3237 }
3238
3239
3240 static int wpa_driver_nl80211_send_frame(struct i802_bss *bss,
3241                                          const void *data, size_t len,
3242                                          int encrypt, int noack,
3243                                          unsigned int freq, int no_cck,
3244                                          int offchanok, unsigned int wait_time,
3245                                          const u16 *csa_offs,
3246                                          size_t csa_offs_len)
3247 {
3248         struct wpa_driver_nl80211_data *drv = bss->drv;
3249         u64 cookie;
3250         int res;
3251
3252         if (freq == 0 && drv->nlmode == NL80211_IFTYPE_ADHOC) {
3253                 freq = nl80211_get_assoc_freq(drv);
3254                 wpa_printf(MSG_DEBUG,
3255                            "nl80211: send_frame - Use assoc_freq=%u for IBSS",
3256                            freq);
3257         }
3258         if (freq == 0) {
3259                 wpa_printf(MSG_DEBUG, "nl80211: send_frame - Use bss->freq=%u",
3260                            bss->freq);
3261                 freq = bss->freq;
3262         }
3263
3264         if (drv->use_monitor) {
3265                 wpa_printf(MSG_DEBUG, "nl80211: send_frame(freq=%u bss->freq=%u) -> send_monitor",
3266                            freq, bss->freq);
3267                 return nl80211_send_monitor(drv, data, len, encrypt, noack);
3268         }
3269
3270         wpa_printf(MSG_DEBUG, "nl80211: send_frame -> send_frame_cmd");
3271         res = nl80211_send_frame_cmd(bss, freq, wait_time, data, len,
3272                                      &cookie, no_cck, noack, offchanok,
3273                                      csa_offs, csa_offs_len);
3274         if (res == 0 && !noack) {
3275                 const struct ieee80211_mgmt *mgmt;
3276                 u16 fc;
3277
3278                 mgmt = (const struct ieee80211_mgmt *) data;
3279                 fc = le_to_host16(mgmt->frame_control);
3280                 if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
3281                     WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_ACTION) {
3282                         wpa_printf(MSG_MSGDUMP,
3283                                    "nl80211: Update send_action_cookie from 0x%llx to 0x%llx",
3284                                    (long long unsigned int)
3285                                    drv->send_action_cookie,
3286                                    (long long unsigned int) cookie);
3287                         drv->send_action_cookie = cookie;
3288                 }
3289         }
3290
3291         return res;
3292 }
3293
3294
3295 static int wpa_driver_nl80211_send_mlme(struct i802_bss *bss, const u8 *data,
3296                                         size_t data_len, int noack,
3297                                         unsigned int freq, int no_cck,
3298                                         int offchanok,
3299                                         unsigned int wait_time,
3300                                         const u16 *csa_offs,
3301                                         size_t csa_offs_len)
3302 {
3303         struct wpa_driver_nl80211_data *drv = bss->drv;
3304         struct ieee80211_mgmt *mgmt;
3305         int encrypt = 1;
3306         u16 fc;
3307
3308         mgmt = (struct ieee80211_mgmt *) data;
3309         fc = le_to_host16(mgmt->frame_control);
3310         wpa_printf(MSG_DEBUG, "nl80211: send_mlme - da= " MACSTR
3311                    " noack=%d freq=%u no_cck=%d offchanok=%d wait_time=%u fc=0x%x (%s) nlmode=%d",
3312                    MAC2STR(mgmt->da), noack, freq, no_cck, offchanok, wait_time,
3313                    fc, fc2str(fc), drv->nlmode);
3314
3315         if ((is_sta_interface(drv->nlmode) ||
3316              drv->nlmode == NL80211_IFTYPE_P2P_DEVICE) &&
3317             WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
3318             WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_PROBE_RESP) {
3319                 /*
3320                  * The use of last_mgmt_freq is a bit of a hack,
3321                  * but it works due to the single-threaded nature
3322                  * of wpa_supplicant.
3323                  */
3324                 if (freq == 0) {
3325                         wpa_printf(MSG_DEBUG, "nl80211: Use last_mgmt_freq=%d",
3326                                    drv->last_mgmt_freq);
3327                         freq = drv->last_mgmt_freq;
3328                 }
3329                 return nl80211_send_frame_cmd(bss, freq, 0,
3330                                               data, data_len, NULL, 1, noack,
3331                                               1, csa_offs, csa_offs_len);
3332         }
3333
3334         if (drv->device_ap_sme && is_ap_interface(drv->nlmode)) {
3335                 if (freq == 0) {
3336                         wpa_printf(MSG_DEBUG, "nl80211: Use bss->freq=%d",
3337                                    bss->freq);
3338                         freq = bss->freq;
3339                 }
3340                 return nl80211_send_frame_cmd(bss, freq,
3341                                               (int) freq == bss->freq ? 0 :
3342                                               wait_time,
3343                                               data, data_len,
3344                                               &drv->send_action_cookie,
3345                                               no_cck, noack, offchanok,
3346                                               csa_offs, csa_offs_len);
3347         }
3348
3349         if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
3350             WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_AUTH) {
3351                 /*
3352                  * Only one of the authentication frame types is encrypted.
3353                  * In order for static WEP encryption to work properly (i.e.,
3354                  * to not encrypt the frame), we need to tell mac80211 about
3355                  * the frames that must not be encrypted.
3356                  */
3357                 u16 auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
3358                 u16 auth_trans = le_to_host16(mgmt->u.auth.auth_transaction);
3359                 if (auth_alg != WLAN_AUTH_SHARED_KEY || auth_trans != 3)
3360                         encrypt = 0;
3361         }
3362
3363         wpa_printf(MSG_DEBUG, "nl80211: send_mlme -> send_frame");
3364         return wpa_driver_nl80211_send_frame(bss, data, data_len, encrypt,
3365                                              noack, freq, no_cck, offchanok,
3366                                              wait_time, csa_offs,
3367                                              csa_offs_len);
3368 }
3369
3370
3371 static int nl80211_put_basic_rates(struct nl_msg *msg, const int *basic_rates)
3372 {
3373         u8 rates[NL80211_MAX_SUPP_RATES];
3374         u8 rates_len = 0;
3375         int i;
3376
3377         if (!basic_rates)
3378                 return 0;
3379
3380         for (i = 0; i < NL80211_MAX_SUPP_RATES && basic_rates[i] >= 0; i++)
3381                 rates[rates_len++] = basic_rates[i] / 5;
3382
3383         return nla_put(msg, NL80211_ATTR_BSS_BASIC_RATES, rates_len, rates);
3384 }
3385
3386
3387 static int nl80211_set_bss(struct i802_bss *bss, int cts, int preamble,
3388                            int slot, int ht_opmode, int ap_isolate,
3389                            const int *basic_rates)
3390 {
3391         struct wpa_driver_nl80211_data *drv = bss->drv;
3392         struct nl_msg *msg;
3393
3394         if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_SET_BSS)) ||
3395             (cts >= 0 &&
3396              nla_put_u8(msg, NL80211_ATTR_BSS_CTS_PROT, cts)) ||
3397             (preamble >= 0 &&
3398              nla_put_u8(msg, NL80211_ATTR_BSS_SHORT_PREAMBLE, preamble)) ||
3399             (slot >= 0 &&
3400              nla_put_u8(msg, NL80211_ATTR_BSS_SHORT_SLOT_TIME, slot)) ||
3401             (ht_opmode >= 0 &&
3402              nla_put_u16(msg, NL80211_ATTR_BSS_HT_OPMODE, ht_opmode)) ||
3403             (ap_isolate >= 0 &&
3404              nla_put_u8(msg, NL80211_ATTR_AP_ISOLATE, ap_isolate)) ||
3405             nl80211_put_basic_rates(msg, basic_rates)) {
3406                 nlmsg_free(msg);
3407                 return -ENOBUFS;
3408         }
3409
3410         return send_and_recv_msgs(drv, msg, NULL, NULL);
3411 }
3412
3413
3414 static int wpa_driver_nl80211_set_acl(void *priv,
3415                                       struct hostapd_acl_params *params)
3416 {
3417         struct i802_bss *bss = priv;
3418         struct wpa_driver_nl80211_data *drv = bss->drv;
3419         struct nl_msg *msg;
3420         struct nl_msg *acl;
3421         unsigned int i;
3422         int ret;
3423
3424         if (!(drv->capa.max_acl_mac_addrs))
3425                 return -ENOTSUP;
3426
3427         if (params->num_mac_acl > drv->capa.max_acl_mac_addrs)
3428                 return -ENOTSUP;
3429
3430         wpa_printf(MSG_DEBUG, "nl80211: Set %s ACL (num_mac_acl=%u)",
3431                    params->acl_policy ? "Accept" : "Deny", params->num_mac_acl);
3432
3433         acl = nlmsg_alloc();
3434         if (!acl)
3435                 return -ENOMEM;
3436         for (i = 0; i < params->num_mac_acl; i++) {
3437                 if (nla_put(acl, i + 1, ETH_ALEN, params->mac_acl[i].addr)) {
3438                         nlmsg_free(acl);
3439                         return -ENOMEM;
3440                 }
3441         }
3442
3443         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_SET_MAC_ACL)) ||
3444             nla_put_u32(msg, NL80211_ATTR_ACL_POLICY, params->acl_policy ?
3445                         NL80211_ACL_POLICY_DENY_UNLESS_LISTED :
3446                         NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED) ||
3447             nla_put_nested(msg, NL80211_ATTR_MAC_ADDRS, acl)) {
3448                 nlmsg_free(msg);
3449                 nlmsg_free(acl);
3450                 return -ENOMEM;
3451         }
3452         nlmsg_free(acl);
3453
3454         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3455         if (ret) {
3456                 wpa_printf(MSG_DEBUG, "nl80211: Failed to set MAC ACL: %d (%s)",
3457                            ret, strerror(-ret));
3458         }
3459
3460         return ret;
3461 }
3462
3463
3464 static int nl80211_put_beacon_int(struct nl_msg *msg, int beacon_int)
3465 {
3466         if (beacon_int > 0) {
3467                 wpa_printf(MSG_DEBUG, "  * beacon_int=%d", beacon_int);
3468                 return nla_put_u32(msg, NL80211_ATTR_BEACON_INTERVAL,
3469                                    beacon_int);
3470         }
3471
3472         return 0;
3473 }
3474
3475
3476 static int nl80211_put_dtim_period(struct nl_msg *msg, int dtim_period)
3477 {
3478         if (dtim_period > 0) {
3479                 wpa_printf(MSG_DEBUG, "  * dtim_period=%d", dtim_period);
3480                 return nla_put_u32(msg, NL80211_ATTR_DTIM_PERIOD, dtim_period);
3481         }
3482
3483         return 0;
3484 }
3485
3486
3487 #ifdef CONFIG_MESH
3488 static int nl80211_set_mesh_config(void *priv,
3489                                    struct wpa_driver_mesh_bss_params *params)
3490 {
3491         struct i802_bss *bss = priv;
3492         struct wpa_driver_nl80211_data *drv = bss->drv;
3493         struct nl_msg *msg;
3494         int ret;
3495
3496         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_SET_MESH_CONFIG);
3497         if (!msg)
3498                 return -1;
3499
3500         ret = nl80211_put_mesh_config(msg, params);
3501         if (ret < 0) {
3502                 nlmsg_free(msg);
3503                 return ret;
3504         }
3505
3506         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3507         if (ret) {
3508                 wpa_printf(MSG_ERROR,
3509                            "nl80211: Mesh config set failed: %d (%s)",
3510                            ret, strerror(-ret));
3511                 return ret;
3512         }
3513         return 0;
3514 }
3515 #endif /* CONFIG_MESH */
3516
3517
3518 static int wpa_driver_nl80211_set_ap(void *priv,
3519                                      struct wpa_driver_ap_params *params)
3520 {
3521         struct i802_bss *bss = priv;
3522         struct wpa_driver_nl80211_data *drv = bss->drv;
3523         struct nl_msg *msg;
3524         u8 cmd = NL80211_CMD_NEW_BEACON;
3525         int ret;
3526         int beacon_set;
3527         int num_suites;
3528         int smps_mode;
3529         u32 suites[10], suite;
3530         u32 ver;
3531 #ifdef CONFIG_MESH
3532         struct wpa_driver_mesh_bss_params mesh_params;
3533 #endif /* CONFIG_MESH */
3534
3535         beacon_set = params->reenable ? 0 : bss->beacon_set;
3536
3537         wpa_printf(MSG_DEBUG, "nl80211: Set beacon (beacon_set=%d)",
3538                    beacon_set);
3539         if (beacon_set)
3540                 cmd = NL80211_CMD_SET_BEACON;
3541
3542         wpa_hexdump(MSG_DEBUG, "nl80211: Beacon head",
3543                     params->head, params->head_len);
3544         wpa_hexdump(MSG_DEBUG, "nl80211: Beacon tail",
3545                     params->tail, params->tail_len);
3546         wpa_printf(MSG_DEBUG, "nl80211: ifindex=%d", bss->ifindex);
3547         wpa_printf(MSG_DEBUG, "nl80211: beacon_int=%d", params->beacon_int);
3548         wpa_printf(MSG_DEBUG, "nl80211: dtim_period=%d", params->dtim_period);
3549         wpa_hexdump_ascii(MSG_DEBUG, "nl80211: ssid",
3550                           params->ssid, params->ssid_len);
3551         if (!(msg = nl80211_bss_msg(bss, 0, cmd)) ||
3552             nla_put(msg, NL80211_ATTR_BEACON_HEAD, params->head_len,
3553                     params->head) ||
3554             nla_put(msg, NL80211_ATTR_BEACON_TAIL, params->tail_len,
3555                     params->tail) ||
3556             nl80211_put_beacon_int(msg, params->beacon_int) ||
3557             nl80211_put_dtim_period(msg, params->dtim_period) ||
3558             nla_put(msg, NL80211_ATTR_SSID, params->ssid_len, params->ssid))
3559                 goto fail;
3560         if (params->proberesp && params->proberesp_len) {
3561                 wpa_hexdump(MSG_DEBUG, "nl80211: proberesp (offload)",
3562                             params->proberesp, params->proberesp_len);
3563                 if (nla_put(msg, NL80211_ATTR_PROBE_RESP, params->proberesp_len,
3564                             params->proberesp))
3565                         goto fail;
3566         }
3567         switch (params->hide_ssid) {
3568         case NO_SSID_HIDING:
3569                 wpa_printf(MSG_DEBUG, "nl80211: hidden SSID not in use");
3570                 if (nla_put_u32(msg, NL80211_ATTR_HIDDEN_SSID,
3571                                 NL80211_HIDDEN_SSID_NOT_IN_USE))
3572                         goto fail;
3573                 break;
3574         case HIDDEN_SSID_ZERO_LEN:
3575                 wpa_printf(MSG_DEBUG, "nl80211: hidden SSID zero len");
3576                 if (nla_put_u32(msg, NL80211_ATTR_HIDDEN_SSID,
3577                                 NL80211_HIDDEN_SSID_ZERO_LEN))
3578                         goto fail;
3579                 break;
3580         case HIDDEN_SSID_ZERO_CONTENTS:
3581                 wpa_printf(MSG_DEBUG, "nl80211: hidden SSID zero contents");
3582                 if (nla_put_u32(msg, NL80211_ATTR_HIDDEN_SSID,
3583                                 NL80211_HIDDEN_SSID_ZERO_CONTENTS))
3584                         goto fail;
3585                 break;
3586         }
3587         wpa_printf(MSG_DEBUG, "nl80211: privacy=%d", params->privacy);
3588         if (params->privacy &&
3589             nla_put_flag(msg, NL80211_ATTR_PRIVACY))
3590                 goto fail;
3591         wpa_printf(MSG_DEBUG, "nl80211: auth_algs=0x%x", params->auth_algs);
3592         if ((params->auth_algs & (WPA_AUTH_ALG_OPEN | WPA_AUTH_ALG_SHARED)) ==
3593             (WPA_AUTH_ALG_OPEN | WPA_AUTH_ALG_SHARED)) {
3594                 /* Leave out the attribute */
3595         } else if (params->auth_algs & WPA_AUTH_ALG_SHARED) {
3596                 if (nla_put_u32(msg, NL80211_ATTR_AUTH_TYPE,
3597                                 NL80211_AUTHTYPE_SHARED_KEY))
3598                         goto fail;
3599         } else {
3600                 if (nla_put_u32(msg, NL80211_ATTR_AUTH_TYPE,
3601                                 NL80211_AUTHTYPE_OPEN_SYSTEM))
3602                         goto fail;
3603         }
3604
3605         wpa_printf(MSG_DEBUG, "nl80211: wpa_version=0x%x", params->wpa_version);
3606         ver = 0;
3607         if (params->wpa_version & WPA_PROTO_WPA)
3608                 ver |= NL80211_WPA_VERSION_1;
3609         if (params->wpa_version & WPA_PROTO_RSN)
3610                 ver |= NL80211_WPA_VERSION_2;
3611         if (ver &&
3612             nla_put_u32(msg, NL80211_ATTR_WPA_VERSIONS, ver))
3613                 goto fail;
3614
3615         wpa_printf(MSG_DEBUG, "nl80211: key_mgmt_suites=0x%x",
3616                    params->key_mgmt_suites);
3617         num_suites = 0;
3618         if (params->key_mgmt_suites & WPA_KEY_MGMT_IEEE8021X)
3619                 suites[num_suites++] = WLAN_AKM_SUITE_8021X;
3620         if (params->key_mgmt_suites & WPA_KEY_MGMT_PSK)
3621                 suites[num_suites++] = WLAN_AKM_SUITE_PSK;
3622         if (num_suites &&
3623             nla_put(msg, NL80211_ATTR_AKM_SUITES, num_suites * sizeof(u32),
3624                     suites))
3625                 goto fail;
3626
3627         if (params->key_mgmt_suites & WPA_KEY_MGMT_IEEE8021X_NO_WPA &&
3628             (!params->pairwise_ciphers ||
3629              params->pairwise_ciphers & (WPA_CIPHER_WEP104 | WPA_CIPHER_WEP40)) &&
3630             (nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, ETH_P_PAE) ||
3631              nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT)))
3632                 goto fail;
3633
3634         wpa_printf(MSG_DEBUG, "nl80211: pairwise_ciphers=0x%x",
3635                    params->pairwise_ciphers);
3636         num_suites = wpa_cipher_to_cipher_suites(params->pairwise_ciphers,
3637                                                  suites, ARRAY_SIZE(suites));
3638         if (num_suites &&
3639             nla_put(msg, NL80211_ATTR_CIPHER_SUITES_PAIRWISE,
3640                     num_suites * sizeof(u32), suites))
3641                 goto fail;
3642
3643         wpa_printf(MSG_DEBUG, "nl80211: group_cipher=0x%x",
3644                    params->group_cipher);
3645         suite = wpa_cipher_to_cipher_suite(params->group_cipher);
3646         if (suite &&
3647             nla_put_u32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP, suite))
3648                 goto fail;
3649
3650         if (params->ht_opmode != -1) {
3651                 switch (params->smps_mode) {
3652                 case HT_CAP_INFO_SMPS_DYNAMIC:
3653                         wpa_printf(MSG_DEBUG, "nl80211: SMPS mode - dynamic");
3654                         smps_mode = NL80211_SMPS_DYNAMIC;
3655                         break;
3656                 case HT_CAP_INFO_SMPS_STATIC:
3657                         wpa_printf(MSG_DEBUG, "nl80211: SMPS mode - static");
3658                         smps_mode = NL80211_SMPS_STATIC;
3659                         break;
3660                 default:
3661                         /* invalid - fallback to smps off */
3662                 case HT_CAP_INFO_SMPS_DISABLED:
3663                         wpa_printf(MSG_DEBUG, "nl80211: SMPS mode - off");
3664                         smps_mode = NL80211_SMPS_OFF;
3665                         break;
3666                 }
3667                 if (nla_put_u32(msg, NL80211_ATTR_SMPS_MODE, smps_mode))
3668                         goto fail;
3669         }
3670
3671         if (params->beacon_ies) {
3672                 wpa_hexdump_buf(MSG_DEBUG, "nl80211: beacon_ies",
3673                                 params->beacon_ies);
3674                 if (nla_put(msg, NL80211_ATTR_IE,
3675                             wpabuf_len(params->beacon_ies),
3676                             wpabuf_head(params->beacon_ies)))
3677                         goto fail;
3678         }
3679         if (params->proberesp_ies) {
3680                 wpa_hexdump_buf(MSG_DEBUG, "nl80211: proberesp_ies",
3681                                 params->proberesp_ies);
3682                 if (nla_put(msg, NL80211_ATTR_IE_PROBE_RESP,
3683                             wpabuf_len(params->proberesp_ies),
3684                             wpabuf_head(params->proberesp_ies)))
3685                         goto fail;
3686         }
3687         if (params->assocresp_ies) {
3688                 wpa_hexdump_buf(MSG_DEBUG, "nl80211: assocresp_ies",
3689                                 params->assocresp_ies);
3690                 if (nla_put(msg, NL80211_ATTR_IE_ASSOC_RESP,
3691                             wpabuf_len(params->assocresp_ies),
3692                             wpabuf_head(params->assocresp_ies)))
3693                         goto fail;
3694         }
3695
3696         if (drv->capa.flags & WPA_DRIVER_FLAGS_INACTIVITY_TIMER)  {
3697                 wpa_printf(MSG_DEBUG, "nl80211: ap_max_inactivity=%d",
3698                            params->ap_max_inactivity);
3699                 if (nla_put_u16(msg, NL80211_ATTR_INACTIVITY_TIMEOUT,
3700                                 params->ap_max_inactivity))
3701                         goto fail;
3702         }
3703
3704 #ifdef CONFIG_P2P
3705         if (params->p2p_go_ctwindow > 0) {
3706                 if (drv->p2p_go_ctwindow_supported) {
3707                         wpa_printf(MSG_DEBUG, "nl80211: P2P GO ctwindow=%d",
3708                                    params->p2p_go_ctwindow);
3709                         if (nla_put_u8(msg, NL80211_ATTR_P2P_CTWINDOW,
3710                                        params->p2p_go_ctwindow))
3711                                 goto fail;
3712                 } else {
3713                         wpa_printf(MSG_INFO,
3714                                    "nl80211: Driver does not support CTWindow configuration - ignore this parameter");
3715                 }
3716         }
3717 #endif /* CONFIG_P2P */
3718
3719         if (params->pbss) {
3720                 wpa_printf(MSG_DEBUG, "nl80211: PBSS");
3721                 if (nla_put_flag(msg, NL80211_ATTR_PBSS))
3722                         goto fail;
3723         }
3724
3725         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3726         if (ret) {
3727                 wpa_printf(MSG_DEBUG, "nl80211: Beacon set failed: %d (%s)",
3728                            ret, strerror(-ret));
3729         } else {
3730                 bss->beacon_set = 1;
3731                 nl80211_set_bss(bss, params->cts_protect, params->preamble,
3732                                 params->short_slot_time, params->ht_opmode,
3733                                 params->isolate, params->basic_rates);
3734                 if (beacon_set && params->freq &&
3735                     params->freq->bandwidth != bss->bandwidth) {
3736                         wpa_printf(MSG_DEBUG,
3737                                    "nl80211: Update BSS %s bandwidth: %d -> %d",
3738                                    bss->ifname, bss->bandwidth,
3739                                    params->freq->bandwidth);
3740                         ret = nl80211_set_channel(bss, params->freq, 1);
3741                         if (ret) {
3742                                 wpa_printf(MSG_DEBUG,
3743                                            "nl80211: Frequency set failed: %d (%s)",
3744                                            ret, strerror(-ret));
3745                         } else {
3746                                 wpa_printf(MSG_DEBUG,
3747                                            "nl80211: Frequency set succeeded for ht2040 coex");
3748                                 bss->bandwidth = params->freq->bandwidth;
3749                         }
3750                 } else if (!beacon_set && params->freq) {
3751                         /*
3752                          * cfg80211 updates the driver on frequence change in AP
3753                          * mode only at the point when beaconing is started, so
3754                          * set the initial value here.
3755                          */
3756                         bss->bandwidth = params->freq->bandwidth;
3757                 }
3758         }
3759
3760 #ifdef CONFIG_MESH
3761         if (is_mesh_interface(drv->nlmode) && params->ht_opmode != -1) {
3762                 os_memset(&mesh_params, 0, sizeof(mesh_params));
3763                 mesh_params.flags |= WPA_DRIVER_MESH_CONF_FLAG_HT_OP_MODE;
3764                 mesh_params.ht_opmode = params->ht_opmode;
3765                 ret = nl80211_set_mesh_config(priv, &mesh_params);
3766                 if (ret < 0)
3767                         return ret;
3768         }
3769 #endif /* CONFIG_MESH */
3770
3771         return ret;
3772 fail:
3773         nlmsg_free(msg);
3774         return -ENOBUFS;
3775 }
3776
3777
3778 static int nl80211_put_freq_params(struct nl_msg *msg,
3779                                    const struct hostapd_freq_params *freq)
3780 {
3781         wpa_printf(MSG_DEBUG, "  * freq=%d", freq->freq);
3782         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq->freq))
3783                 return -ENOBUFS;
3784
3785         wpa_printf(MSG_DEBUG, "  * vht_enabled=%d", freq->vht_enabled);
3786         wpa_printf(MSG_DEBUG, "  * ht_enabled=%d", freq->ht_enabled);
3787
3788         if (freq->vht_enabled) {
3789                 enum nl80211_chan_width cw;
3790
3791                 wpa_printf(MSG_DEBUG, "  * bandwidth=%d", freq->bandwidth);
3792                 switch (freq->bandwidth) {
3793                 case 20:
3794                         cw = NL80211_CHAN_WIDTH_20;
3795                         break;
3796                 case 40:
3797                         cw = NL80211_CHAN_WIDTH_40;
3798                         break;
3799                 case 80:
3800                         if (freq->center_freq2)
3801                                 cw = NL80211_CHAN_WIDTH_80P80;
3802                         else
3803                                 cw = NL80211_CHAN_WIDTH_80;
3804                         break;
3805                 case 160:
3806                         cw = NL80211_CHAN_WIDTH_160;
3807                         break;
3808                 default:
3809                         return -EINVAL;
3810                 }
3811
3812                 wpa_printf(MSG_DEBUG, "  * channel_width=%d", cw);
3813                 wpa_printf(MSG_DEBUG, "  * center_freq1=%d",
3814                            freq->center_freq1);
3815                 wpa_printf(MSG_DEBUG, "  * center_freq2=%d",
3816                            freq->center_freq2);
3817                 if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, cw) ||
3818                     nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1,
3819                                 freq->center_freq1) ||
3820                     (freq->center_freq2 &&
3821                      nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2,
3822                                  freq->center_freq2)))
3823                         return -ENOBUFS;
3824         } else if (freq->ht_enabled) {
3825                 enum nl80211_channel_type ct;
3826
3827                 wpa_printf(MSG_DEBUG, "  * sec_channel_offset=%d",
3828                            freq->sec_channel_offset);
3829                 switch (freq->sec_channel_offset) {
3830                 case -1:
3831                         ct = NL80211_CHAN_HT40MINUS;
3832                         break;
3833                 case 1:
3834                         ct = NL80211_CHAN_HT40PLUS;
3835                         break;
3836                 default:
3837                         ct = NL80211_CHAN_HT20;
3838                         break;
3839                 }
3840
3841                 wpa_printf(MSG_DEBUG, "  * channel_type=%d", ct);
3842                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, ct))
3843                         return -ENOBUFS;
3844         } else {
3845                 wpa_printf(MSG_DEBUG, "  * channel_type=%d",
3846                            NL80211_CHAN_NO_HT);
3847                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
3848                                 NL80211_CHAN_NO_HT))
3849                         return -ENOBUFS;
3850         }
3851         return 0;
3852 }
3853
3854
3855 static int nl80211_set_channel(struct i802_bss *bss,
3856                                struct hostapd_freq_params *freq, int set_chan)
3857 {
3858         struct wpa_driver_nl80211_data *drv = bss->drv;
3859         struct nl_msg *msg;
3860         int ret;
3861
3862         wpa_printf(MSG_DEBUG,
3863                    "nl80211: Set freq %d (ht_enabled=%d, vht_enabled=%d, bandwidth=%d MHz, cf1=%d MHz, cf2=%d MHz)",
3864                    freq->freq, freq->ht_enabled, freq->vht_enabled,
3865                    freq->bandwidth, freq->center_freq1, freq->center_freq2);
3866
3867         msg = nl80211_drv_msg(drv, 0, set_chan ? NL80211_CMD_SET_CHANNEL :
3868                               NL80211_CMD_SET_WIPHY);
3869         if (!msg || nl80211_put_freq_params(msg, freq) < 0) {
3870                 nlmsg_free(msg);
3871                 return -1;
3872         }
3873
3874         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3875         if (ret == 0) {
3876                 bss->freq = freq->freq;
3877                 return 0;
3878         }
3879         wpa_printf(MSG_DEBUG, "nl80211: Failed to set channel (freq=%d): "
3880                    "%d (%s)", freq->freq, ret, strerror(-ret));
3881         return -1;
3882 }
3883
3884
3885 static u32 sta_flags_nl80211(int flags)
3886 {
3887         u32 f = 0;
3888
3889         if (flags & WPA_STA_AUTHORIZED)
3890                 f |= BIT(NL80211_STA_FLAG_AUTHORIZED);
3891         if (flags & WPA_STA_WMM)
3892                 f |= BIT(NL80211_STA_FLAG_WME);
3893         if (flags & WPA_STA_SHORT_PREAMBLE)
3894                 f |= BIT(NL80211_STA_FLAG_SHORT_PREAMBLE);
3895         if (flags & WPA_STA_MFP)
3896                 f |= BIT(NL80211_STA_FLAG_MFP);
3897         if (flags & WPA_STA_TDLS_PEER)
3898                 f |= BIT(NL80211_STA_FLAG_TDLS_PEER);
3899         if (flags & WPA_STA_AUTHENTICATED)
3900                 f |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
3901         if (flags & WPA_STA_ASSOCIATED)
3902                 f |= BIT(NL80211_STA_FLAG_ASSOCIATED);
3903
3904         return f;
3905 }
3906
3907
3908 #ifdef CONFIG_MESH
3909 static u32 sta_plink_state_nl80211(enum mesh_plink_state state)
3910 {
3911         switch (state) {
3912         case PLINK_IDLE:
3913                 return NL80211_PLINK_LISTEN;
3914         case PLINK_OPN_SNT:
3915                 return NL80211_PLINK_OPN_SNT;
3916         case PLINK_OPN_RCVD:
3917                 return NL80211_PLINK_OPN_RCVD;
3918         case PLINK_CNF_RCVD:
3919                 return NL80211_PLINK_CNF_RCVD;
3920         case PLINK_ESTAB:
3921                 return NL80211_PLINK_ESTAB;
3922         case PLINK_HOLDING:
3923                 return NL80211_PLINK_HOLDING;
3924         case PLINK_BLOCKED:
3925                 return NL80211_PLINK_BLOCKED;
3926         default:
3927                 wpa_printf(MSG_ERROR, "nl80211: Invalid mesh plink state %d",
3928                            state);
3929         }
3930         return -1;
3931 }
3932 #endif /* CONFIG_MESH */
3933
3934
3935 static int wpa_driver_nl80211_sta_add(void *priv,
3936                                       struct hostapd_sta_add_params *params)
3937 {
3938         struct i802_bss *bss = priv;
3939         struct wpa_driver_nl80211_data *drv = bss->drv;
3940         struct nl_msg *msg;
3941         struct nl80211_sta_flag_update upd;
3942         int ret = -ENOBUFS;
3943
3944         if ((params->flags & WPA_STA_TDLS_PEER) &&
3945             !(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT))
3946                 return -EOPNOTSUPP;
3947
3948         wpa_printf(MSG_DEBUG, "nl80211: %s STA " MACSTR,
3949                    params->set ? "Set" : "Add", MAC2STR(params->addr));
3950         msg = nl80211_bss_msg(bss, 0, params->set ? NL80211_CMD_SET_STATION :
3951                               NL80211_CMD_NEW_STATION);
3952         if (!msg || nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, params->addr))
3953                 goto fail;
3954
3955         /*
3956          * Set the below properties only in one of the following cases:
3957          * 1. New station is added, already associated.
3958          * 2. Set WPA_STA_TDLS_PEER station.
3959          * 3. Set an already added unassociated station, if driver supports
3960          * full AP client state. (Set these properties after station became
3961          * associated will be rejected by the driver).
3962          */
3963         if (!params->set || (params->flags & WPA_STA_TDLS_PEER) ||
3964             (params->set && FULL_AP_CLIENT_STATE_SUPP(drv->capa.flags) &&
3965              (params->flags & WPA_STA_ASSOCIATED))) {
3966                 wpa_hexdump(MSG_DEBUG, "  * supported rates",
3967                             params->supp_rates, params->supp_rates_len);
3968                 wpa_printf(MSG_DEBUG, "  * capability=0x%x",
3969                            params->capability);
3970                 if (nla_put(msg, NL80211_ATTR_STA_SUPPORTED_RATES,
3971                             params->supp_rates_len, params->supp_rates) ||
3972                     nla_put_u16(msg, NL80211_ATTR_STA_CAPABILITY,
3973                                 params->capability))
3974                         goto fail;
3975
3976                 if (params->ht_capabilities) {
3977                         wpa_hexdump(MSG_DEBUG, "  * ht_capabilities",
3978                                     (u8 *) params->ht_capabilities,
3979                                     sizeof(*params->ht_capabilities));
3980                         if (nla_put(msg, NL80211_ATTR_HT_CAPABILITY,
3981                                     sizeof(*params->ht_capabilities),
3982                                     params->ht_capabilities))
3983                                 goto fail;
3984                 }
3985
3986                 if (params->vht_capabilities) {
3987                         wpa_hexdump(MSG_DEBUG, "  * vht_capabilities",
3988                                     (u8 *) params->vht_capabilities,
3989                                     sizeof(*params->vht_capabilities));
3990                         if (nla_put(msg, NL80211_ATTR_VHT_CAPABILITY,
3991                                     sizeof(*params->vht_capabilities),
3992                                     params->vht_capabilities))
3993                                 goto fail;
3994                 }
3995
3996                 if (params->ext_capab) {
3997                         wpa_hexdump(MSG_DEBUG, "  * ext_capab",
3998                                     params->ext_capab, params->ext_capab_len);
3999                         if (nla_put(msg, NL80211_ATTR_STA_EXT_CAPABILITY,
4000                                     params->ext_capab_len, params->ext_capab))
4001                                 goto fail;
4002                 }
4003
4004                 if (is_ap_interface(drv->nlmode) &&
4005                     nla_put_u8(msg, NL80211_ATTR_STA_SUPPORT_P2P_PS,
4006                                params->support_p2p_ps ?
4007                                NL80211_P2P_PS_SUPPORTED :
4008                                NL80211_P2P_PS_UNSUPPORTED))
4009                         goto fail;
4010         }
4011         if (!params->set) {
4012                 if (params->aid) {
4013                         wpa_printf(MSG_DEBUG, "  * aid=%u", params->aid);
4014                         if (nla_put_u16(msg, NL80211_ATTR_STA_AID, params->aid))
4015                                 goto fail;
4016                 } else {
4017                         /*
4018                          * cfg80211 validates that AID is non-zero, so we have
4019                          * to make this a non-zero value for the TDLS case where
4020                          * a dummy STA entry is used for now and for a station
4021                          * that is still not associated.
4022                          */
4023                         wpa_printf(MSG_DEBUG, "  * aid=1 (%s workaround)",
4024                                    (params->flags & WPA_STA_TDLS_PEER) ?
4025                                    "TDLS" : "UNASSOC_STA");
4026                         if (nla_put_u16(msg, NL80211_ATTR_STA_AID, 1))
4027                                 goto fail;
4028                 }
4029                 wpa_printf(MSG_DEBUG, "  * listen_interval=%u",
4030                            params->listen_interval);
4031                 if (nla_put_u16(msg, NL80211_ATTR_STA_LISTEN_INTERVAL,
4032                                 params->listen_interval))
4033                         goto fail;
4034         } else if (params->aid && (params->flags & WPA_STA_TDLS_PEER)) {
4035                 wpa_printf(MSG_DEBUG, "  * peer_aid=%u", params->aid);
4036                 if (nla_put_u16(msg, NL80211_ATTR_PEER_AID, params->aid))
4037                         goto fail;
4038         } else if (FULL_AP_CLIENT_STATE_SUPP(drv->capa.flags) &&
4039                    (params->flags & WPA_STA_ASSOCIATED)) {
4040                 wpa_printf(MSG_DEBUG, "  * aid=%u", params->aid);
4041                 wpa_printf(MSG_DEBUG, "  * listen_interval=%u",
4042                            params->listen_interval);
4043                 if (nla_put_u16(msg, NL80211_ATTR_STA_AID, params->aid) ||
4044                     nla_put_u16(msg, NL80211_ATTR_STA_LISTEN_INTERVAL,
4045                                 params->listen_interval))
4046                         goto fail;
4047         }
4048
4049         if (params->vht_opmode_enabled) {
4050                 wpa_printf(MSG_DEBUG, "  * opmode=%u", params->vht_opmode);
4051                 if (nla_put_u8(msg, NL80211_ATTR_OPMODE_NOTIF,
4052                                params->vht_opmode))
4053                         goto fail;
4054         }
4055
4056         if (params->supp_channels) {
4057                 wpa_hexdump(MSG_DEBUG, "  * supported channels",
4058                             params->supp_channels, params->supp_channels_len);
4059                 if (nla_put(msg, NL80211_ATTR_STA_SUPPORTED_CHANNELS,
4060                             params->supp_channels_len, params->supp_channels))
4061                         goto fail;
4062         }
4063
4064         if (params->supp_oper_classes) {
4065                 wpa_hexdump(MSG_DEBUG, "  * supported operating classes",
4066                             params->supp_oper_classes,
4067                             params->supp_oper_classes_len);
4068                 if (nla_put(msg, NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES,
4069                             params->supp_oper_classes_len,
4070                             params->supp_oper_classes))
4071                         goto fail;
4072         }
4073
4074         os_memset(&upd, 0, sizeof(upd));
4075         upd.set = sta_flags_nl80211(params->flags);
4076         upd.mask = upd.set | sta_flags_nl80211(params->flags_mask);
4077
4078         /*
4079          * If the driver doesn't support full AP client state, ignore ASSOC/AUTH
4080          * flags, as nl80211 driver moves a new station, by default, into
4081          * associated state.
4082          *
4083          * On the other hand, if the driver supports that feature and the
4084          * station is added in unauthenticated state, set the
4085          * authenticated/associated bits in the mask to prevent moving this
4086          * station to associated state before it is actually associated.
4087          *
4088          * This is irrelevant for mesh mode where the station is added to the
4089          * driver as authenticated already, and ASSOCIATED isn't part of the
4090          * nl80211 API.
4091          */
4092         if (!is_mesh_interface(drv->nlmode)) {
4093                 if (!FULL_AP_CLIENT_STATE_SUPP(drv->capa.flags)) {
4094                         wpa_printf(MSG_DEBUG,
4095                                    "nl80211: Ignore ASSOC/AUTH flags since driver doesn't support full AP client state");
4096                         upd.mask &= ~(BIT(NL80211_STA_FLAG_ASSOCIATED) |
4097                                       BIT(NL80211_STA_FLAG_AUTHENTICATED));
4098                 } else if (!params->set &&
4099                            !(params->flags & WPA_STA_TDLS_PEER)) {
4100                         if (!(params->flags & WPA_STA_AUTHENTICATED))
4101                                 upd.mask |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
4102                         if (!(params->flags & WPA_STA_ASSOCIATED))
4103                                 upd.mask |= BIT(NL80211_STA_FLAG_ASSOCIATED);
4104                 }
4105 #ifdef CONFIG_MESH
4106         } else {
4107                 if (params->plink_state == PLINK_ESTAB && params->peer_aid) {
4108                         ret = nla_put_u16(msg, NL80211_ATTR_MESH_PEER_AID,
4109                                           params->peer_aid);
4110                         if (ret)
4111                                 goto fail;
4112                 }
4113 #endif /* CONFIG_MESH */
4114         }
4115
4116         wpa_printf(MSG_DEBUG, "  * flags set=0x%x mask=0x%x",
4117                    upd.set, upd.mask);
4118         if (nla_put(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd))
4119                 goto fail;
4120
4121 #ifdef CONFIG_MESH
4122         if (params->plink_state &&
4123             nla_put_u8(msg, NL80211_ATTR_STA_PLINK_STATE,
4124                        sta_plink_state_nl80211(params->plink_state)))
4125                 goto fail;
4126 #endif /* CONFIG_MESH */
4127
4128         if (params->flags & WPA_STA_WMM) {
4129                 struct nlattr *wme = nla_nest_start(msg, NL80211_ATTR_STA_WME);
4130
4131                 wpa_printf(MSG_DEBUG, "  * qosinfo=0x%x", params->qosinfo);
4132                 if (!wme ||
4133                     nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
4134                                params->qosinfo & WMM_QOSINFO_STA_AC_MASK) ||
4135                     nla_put_u8(msg, NL80211_STA_WME_MAX_SP,
4136                                (params->qosinfo >> WMM_QOSINFO_STA_SP_SHIFT) &
4137                                WMM_QOSINFO_STA_SP_MASK))
4138                         goto fail;
4139                 nla_nest_end(msg, wme);
4140         }
4141
4142         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4143         msg = NULL;
4144         if (ret)
4145                 wpa_printf(MSG_DEBUG, "nl80211: NL80211_CMD_%s_STATION "
4146                            "result: %d (%s)", params->set ? "SET" : "NEW", ret,
4147                            strerror(-ret));
4148         if (ret == -EEXIST)
4149                 ret = 0;
4150 fail:
4151         nlmsg_free(msg);
4152         return ret;
4153 }
4154
4155
4156 static void rtnl_neigh_delete_fdb_entry(struct i802_bss *bss, const u8 *addr)
4157 {
4158 #ifdef CONFIG_LIBNL3_ROUTE
4159         struct wpa_driver_nl80211_data *drv = bss->drv;
4160         struct rtnl_neigh *rn;
4161         struct nl_addr *nl_addr;
4162         int err;
4163
4164         rn = rtnl_neigh_alloc();
4165         if (!rn)
4166                 return;
4167
4168         rtnl_neigh_set_family(rn, AF_BRIDGE);
4169         rtnl_neigh_set_ifindex(rn, bss->ifindex);
4170         nl_addr = nl_addr_build(AF_BRIDGE, (void *) addr, ETH_ALEN);
4171         if (!nl_addr) {
4172                 rtnl_neigh_put(rn);
4173                 return;
4174         }
4175         rtnl_neigh_set_lladdr(rn, nl_addr);
4176
4177         err = rtnl_neigh_delete(drv->rtnl_sk, rn, 0);
4178         if (err < 0) {
4179                 wpa_printf(MSG_DEBUG, "nl80211: bridge FDB entry delete for "
4180                            MACSTR " ifindex=%d failed: %s", MAC2STR(addr),
4181                            bss->ifindex, nl_geterror(err));
4182         } else {
4183                 wpa_printf(MSG_DEBUG, "nl80211: deleted bridge FDB entry for "
4184                            MACSTR, MAC2STR(addr));
4185         }
4186
4187         nl_addr_put(nl_addr);
4188         rtnl_neigh_put(rn);
4189 #endif /* CONFIG_LIBNL3_ROUTE */
4190 }
4191
4192
4193 static int wpa_driver_nl80211_sta_remove(struct i802_bss *bss, const u8 *addr,
4194                                          int deauth, u16 reason_code)
4195 {
4196         struct wpa_driver_nl80211_data *drv = bss->drv;
4197         struct nl_msg *msg;
4198         int ret;
4199
4200         if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_DEL_STATION)) ||
4201             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
4202             (deauth == 0 &&
4203              nla_put_u8(msg, NL80211_ATTR_MGMT_SUBTYPE,
4204                         WLAN_FC_STYPE_DISASSOC)) ||
4205             (deauth == 1 &&
4206              nla_put_u8(msg, NL80211_ATTR_MGMT_SUBTYPE,
4207                         WLAN_FC_STYPE_DEAUTH)) ||
4208             (reason_code &&
4209              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code))) {
4210                 nlmsg_free(msg);
4211                 return -ENOBUFS;
4212         }
4213
4214         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4215         wpa_printf(MSG_DEBUG, "nl80211: sta_remove -> DEL_STATION %s " MACSTR
4216                    " --> %d (%s)",
4217                    bss->ifname, MAC2STR(addr), ret, strerror(-ret));
4218
4219         if (drv->rtnl_sk)
4220                 rtnl_neigh_delete_fdb_entry(bss, addr);
4221
4222         if (ret == -ENOENT)
4223                 return 0;
4224         return ret;
4225 }
4226
4227
4228 void nl80211_remove_iface(struct wpa_driver_nl80211_data *drv, int ifidx)
4229 {
4230         struct nl_msg *msg;
4231         struct wpa_driver_nl80211_data *drv2;
4232
4233         wpa_printf(MSG_DEBUG, "nl80211: Remove interface ifindex=%d", ifidx);
4234
4235         /* stop listening for EAPOL on this interface */
4236         dl_list_for_each(drv2, &drv->global->interfaces,
4237                          struct wpa_driver_nl80211_data, list)
4238         {
4239                 del_ifidx(drv2, ifidx, IFIDX_ANY);
4240                 /* Remove all bridges learned for this iface */
4241                 del_ifidx(drv2, IFIDX_ANY, ifidx);
4242         }
4243
4244         msg = nl80211_ifindex_msg(drv, ifidx, 0, NL80211_CMD_DEL_INTERFACE);
4245         if (send_and_recv_msgs(drv, msg, NULL, NULL) == 0)
4246                 return;
4247         wpa_printf(MSG_ERROR, "Failed to remove interface (ifidx=%d)", ifidx);
4248 }
4249
4250
4251 const char * nl80211_iftype_str(enum nl80211_iftype mode)
4252 {
4253         switch (mode) {
4254         case NL80211_IFTYPE_ADHOC:
4255                 return "ADHOC";
4256         case NL80211_IFTYPE_STATION:
4257                 return "STATION";
4258         case NL80211_IFTYPE_AP:
4259                 return "AP";
4260         case NL80211_IFTYPE_AP_VLAN:
4261                 return "AP_VLAN";
4262         case NL80211_IFTYPE_WDS:
4263                 return "WDS";
4264         case NL80211_IFTYPE_MONITOR:
4265                 return "MONITOR";
4266         case NL80211_IFTYPE_MESH_POINT:
4267                 return "MESH_POINT";
4268         case NL80211_IFTYPE_P2P_CLIENT:
4269                 return "P2P_CLIENT";
4270         case NL80211_IFTYPE_P2P_GO:
4271                 return "P2P_GO";
4272         case NL80211_IFTYPE_P2P_DEVICE:
4273                 return "P2P_DEVICE";
4274         default:
4275                 return "unknown";
4276         }
4277 }
4278
4279
4280 static int nl80211_create_iface_once(struct wpa_driver_nl80211_data *drv,
4281                                      const char *ifname,
4282                                      enum nl80211_iftype iftype,
4283                                      const u8 *addr, int wds,
4284                                      int (*handler)(struct nl_msg *, void *),
4285                                      void *arg)
4286 {
4287         struct nl_msg *msg;
4288         int ifidx;
4289         int ret = -ENOBUFS;
4290
4291         wpa_printf(MSG_DEBUG, "nl80211: Create interface iftype %d (%s)",
4292                    iftype, nl80211_iftype_str(iftype));
4293
4294         msg = nl80211_cmd_msg(drv->first_bss, 0, NL80211_CMD_NEW_INTERFACE);
4295         if (!msg ||
4296             nla_put_string(msg, NL80211_ATTR_IFNAME, ifname) ||
4297             nla_put_u32(msg, NL80211_ATTR_IFTYPE, iftype))
4298                 goto fail;
4299
4300         if (iftype == NL80211_IFTYPE_MONITOR) {
4301                 struct nlattr *flags;
4302
4303                 flags = nla_nest_start(msg, NL80211_ATTR_MNTR_FLAGS);
4304                 if (!flags ||
4305                     nla_put_flag(msg, NL80211_MNTR_FLAG_COOK_FRAMES))
4306                         goto fail;
4307
4308                 nla_nest_end(msg, flags);
4309         } else if (wds) {
4310                 if (nla_put_u8(msg, NL80211_ATTR_4ADDR, wds))
4311                         goto fail;
4312         }
4313
4314         /*
4315          * Tell cfg80211 that the interface belongs to the socket that created
4316          * it, and the interface should be deleted when the socket is closed.
4317          */
4318         if (nla_put_flag(msg, NL80211_ATTR_IFACE_SOCKET_OWNER))
4319                 goto fail;
4320
4321         ret = send_and_recv_msgs(drv, msg, handler, arg);
4322         msg = NULL;
4323         if (ret) {
4324         fail:
4325                 nlmsg_free(msg);
4326                 wpa_printf(MSG_ERROR, "Failed to create interface %s: %d (%s)",
4327                            ifname, ret, strerror(-ret));
4328                 return ret;
4329         }
4330
4331         if (iftype == NL80211_IFTYPE_P2P_DEVICE)
4332                 return 0;
4333
4334         ifidx = if_nametoindex(ifname);
4335         wpa_printf(MSG_DEBUG, "nl80211: New interface %s created: ifindex=%d",
4336                    ifname, ifidx);
4337
4338         if (ifidx <= 0)
4339                 return -1;
4340
4341         /*
4342          * Some virtual interfaces need to process EAPOL packets and events on
4343          * the parent interface. This is used mainly with hostapd.
4344          */
4345         if (drv->hostapd ||
4346             iftype == NL80211_IFTYPE_AP_VLAN ||
4347             iftype == NL80211_IFTYPE_WDS ||
4348             iftype == NL80211_IFTYPE_MONITOR) {
4349                 /* start listening for EAPOL on this interface */
4350                 add_ifidx(drv, ifidx, IFIDX_ANY);
4351         }
4352
4353         if (addr && iftype != NL80211_IFTYPE_MONITOR &&
4354             linux_set_ifhwaddr(drv->global->ioctl_sock, ifname, addr)) {
4355                 nl80211_remove_iface(drv, ifidx);
4356                 return -1;
4357         }
4358
4359         return ifidx;
4360 }
4361
4362
4363 int nl80211_create_iface(struct wpa_driver_nl80211_data *drv,
4364                          const char *ifname, enum nl80211_iftype iftype,
4365                          const u8 *addr, int wds,
4366                          int (*handler)(struct nl_msg *, void *),
4367                          void *arg, int use_existing)
4368 {
4369         int ret;
4370
4371         ret = nl80211_create_iface_once(drv, ifname, iftype, addr, wds, handler,
4372                                         arg);
4373
4374         /* if error occurred and interface exists already */
4375         if (ret == -ENFILE && if_nametoindex(ifname)) {
4376                 if (use_existing) {
4377                         wpa_printf(MSG_DEBUG, "nl80211: Continue using existing interface %s",
4378                                    ifname);
4379                         if (addr && iftype != NL80211_IFTYPE_MONITOR &&
4380                             linux_set_ifhwaddr(drv->global->ioctl_sock, ifname,
4381                                                addr) < 0 &&
4382                             (linux_set_iface_flags(drv->global->ioctl_sock,
4383                                                    ifname, 0) < 0 ||
4384                              linux_set_ifhwaddr(drv->global->ioctl_sock, ifname,
4385                                                 addr) < 0 ||
4386                              linux_set_iface_flags(drv->global->ioctl_sock,
4387                                                    ifname, 1) < 0))
4388                                         return -1;
4389                         return -ENFILE;
4390                 }
4391                 wpa_printf(MSG_INFO, "Try to remove and re-create %s", ifname);
4392
4393                 /* Try to remove the interface that was already there. */
4394                 nl80211_remove_iface(drv, if_nametoindex(ifname));
4395
4396                 /* Try to create the interface again */
4397                 ret = nl80211_create_iface_once(drv, ifname, iftype, addr,
4398                                                 wds, handler, arg);
4399         }
4400
4401         if (ret >= 0 && is_p2p_net_interface(iftype)) {
4402                 wpa_printf(MSG_DEBUG,
4403                            "nl80211: Interface %s created for P2P - disable 11b rates",
4404                            ifname);
4405                 nl80211_disable_11b_rates(drv, ret, 1);
4406         }
4407
4408         return ret;
4409 }
4410
4411
4412 static int nl80211_setup_ap(struct i802_bss *bss)
4413 {
4414         struct wpa_driver_nl80211_data *drv = bss->drv;
4415
4416         wpa_printf(MSG_DEBUG, "nl80211: Setup AP(%s) - device_ap_sme=%d use_monitor=%d",
4417                    bss->ifname, drv->device_ap_sme, drv->use_monitor);
4418
4419         /*
4420          * Disable Probe Request reporting unless we need it in this way for
4421          * devices that include the AP SME, in the other case (unless using
4422          * monitor iface) we'll get it through the nl_mgmt socket instead.
4423          */
4424         if (!drv->device_ap_sme)
4425                 wpa_driver_nl80211_probe_req_report(bss, 0);
4426
4427         if (!drv->device_ap_sme && !drv->use_monitor)
4428                 if (nl80211_mgmt_subscribe_ap(bss))
4429                         return -1;
4430
4431         if (drv->device_ap_sme && !drv->use_monitor)
4432                 if (nl80211_mgmt_subscribe_ap_dev_sme(bss))
4433                         wpa_printf(MSG_DEBUG,
4434                                    "nl80211: Failed to subscribe for mgmt frames from SME driver - trying to run without it");
4435
4436         if (!drv->device_ap_sme && drv->use_monitor &&
4437             nl80211_create_monitor_interface(drv))
4438                 return -1;
4439
4440         if (drv->device_ap_sme &&
4441             wpa_driver_nl80211_probe_req_report(bss, 1) < 0) {
4442                 wpa_printf(MSG_DEBUG, "nl80211: Failed to enable "
4443                            "Probe Request frame reporting in AP mode");
4444                 /* Try to survive without this */
4445         }
4446
4447         return 0;
4448 }
4449
4450
4451 static void nl80211_teardown_ap(struct i802_bss *bss)
4452 {
4453         struct wpa_driver_nl80211_data *drv = bss->drv;
4454
4455         wpa_printf(MSG_DEBUG, "nl80211: Teardown AP(%s) - device_ap_sme=%d use_monitor=%d",
4456                    bss->ifname, drv->device_ap_sme, drv->use_monitor);
4457         if (drv->device_ap_sme) {
4458                 wpa_driver_nl80211_probe_req_report(bss, 0);
4459                 if (!drv->use_monitor)
4460                         nl80211_mgmt_unsubscribe(bss, "AP teardown (dev SME)");
4461         } else if (drv->use_monitor)
4462                 nl80211_remove_monitor_interface(drv);
4463         else
4464                 nl80211_mgmt_unsubscribe(bss, "AP teardown");
4465
4466         bss->beacon_set = 0;
4467 }
4468
4469
4470 static int nl80211_send_eapol_data(struct i802_bss *bss,
4471                                    const u8 *addr, const u8 *data,
4472                                    size_t data_len)
4473 {
4474         struct sockaddr_ll ll;
4475         int ret;
4476
4477         if (bss->drv->eapol_tx_sock < 0) {
4478                 wpa_printf(MSG_DEBUG, "nl80211: No socket to send EAPOL");
4479                 return -1;
4480         }
4481
4482         os_memset(&ll, 0, sizeof(ll));
4483         ll.sll_family = AF_PACKET;
4484         ll.sll_ifindex = bss->ifindex;
4485         ll.sll_protocol = htons(ETH_P_PAE);
4486         ll.sll_halen = ETH_ALEN;
4487         os_memcpy(ll.sll_addr, addr, ETH_ALEN);
4488         ret = sendto(bss->drv->eapol_tx_sock, data, data_len, 0,
4489                      (struct sockaddr *) &ll, sizeof(ll));
4490         if (ret < 0)
4491                 wpa_printf(MSG_ERROR, "nl80211: EAPOL TX: %s",
4492                            strerror(errno));
4493
4494         return ret;
4495 }
4496
4497
4498 static const u8 rfc1042_header[6] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
4499
4500 static int wpa_driver_nl80211_hapd_send_eapol(
4501         void *priv, const u8 *addr, const u8 *data,
4502         size_t data_len, int encrypt, const u8 *own_addr, u32 flags)
4503 {
4504         struct i802_bss *bss = priv;
4505         struct wpa_driver_nl80211_data *drv = bss->drv;
4506         struct ieee80211_hdr *hdr;
4507         size_t len;
4508         u8 *pos;
4509         int res;
4510         int qos = flags & WPA_STA_WMM;
4511
4512         if (drv->device_ap_sme || !drv->use_monitor)
4513                 return nl80211_send_eapol_data(bss, addr, data, data_len);
4514
4515         len = sizeof(*hdr) + (qos ? 2 : 0) + sizeof(rfc1042_header) + 2 +
4516                 data_len;
4517         hdr = os_zalloc(len);
4518         if (hdr == NULL) {
4519                 wpa_printf(MSG_INFO, "nl80211: Failed to allocate EAPOL buffer(len=%lu)",
4520                            (unsigned long) len);
4521                 return -1;
4522         }
4523
4524         hdr->frame_control =
4525                 IEEE80211_FC(WLAN_FC_TYPE_DATA, WLAN_FC_STYPE_DATA);
4526         hdr->frame_control |= host_to_le16(WLAN_FC_FROMDS);
4527         if (encrypt)
4528                 hdr->frame_control |= host_to_le16(WLAN_FC_ISWEP);
4529         if (qos) {
4530                 hdr->frame_control |=
4531                         host_to_le16(WLAN_FC_STYPE_QOS_DATA << 4);
4532         }
4533
4534         memcpy(hdr->IEEE80211_DA_FROMDS, addr, ETH_ALEN);
4535         memcpy(hdr->IEEE80211_BSSID_FROMDS, own_addr, ETH_ALEN);
4536         memcpy(hdr->IEEE80211_SA_FROMDS, own_addr, ETH_ALEN);
4537         pos = (u8 *) (hdr + 1);
4538
4539         if (qos) {
4540                 /* Set highest priority in QoS header */
4541                 pos[0] = 7;
4542                 pos[1] = 0;
4543                 pos += 2;
4544         }
4545
4546         memcpy(pos, rfc1042_header, sizeof(rfc1042_header));
4547         pos += sizeof(rfc1042_header);
4548         WPA_PUT_BE16(pos, ETH_P_PAE);
4549         pos += 2;
4550         memcpy(pos, data, data_len);
4551
4552         res = wpa_driver_nl80211_send_frame(bss, (u8 *) hdr, len, encrypt, 0,
4553                                             0, 0, 0, 0, NULL, 0);
4554         if (res < 0) {
4555                 wpa_printf(MSG_ERROR, "i802_send_eapol - packet len: %lu - "
4556                            "failed: %d (%s)",
4557                            (unsigned long) len, errno, strerror(errno));
4558         }
4559         os_free(hdr);
4560
4561         return res;
4562 }
4563
4564
4565 static int wpa_driver_nl80211_sta_set_flags(void *priv, const u8 *addr,
4566                                             unsigned int total_flags,
4567                                             unsigned int flags_or,
4568                                             unsigned int flags_and)
4569 {
4570         struct i802_bss *bss = priv;
4571         struct nl_msg *msg;
4572         struct nlattr *flags;
4573         struct nl80211_sta_flag_update upd;
4574
4575         wpa_printf(MSG_DEBUG, "nl80211: Set STA flags - ifname=%s addr=" MACSTR
4576                    " total_flags=0x%x flags_or=0x%x flags_and=0x%x authorized=%d",
4577                    bss->ifname, MAC2STR(addr), total_flags, flags_or, flags_and,
4578                    !!(total_flags & WPA_STA_AUTHORIZED));
4579
4580         if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_SET_STATION)) ||
4581             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
4582                 goto fail;
4583
4584         /*
4585          * Backwards compatibility version using NL80211_ATTR_STA_FLAGS. This
4586          * can be removed eventually.
4587          */
4588         flags = nla_nest_start(msg, NL80211_ATTR_STA_FLAGS);
4589         if (!flags ||
4590             ((total_flags & WPA_STA_AUTHORIZED) &&
4591              nla_put_flag(msg, NL80211_STA_FLAG_AUTHORIZED)) ||
4592             ((total_flags & WPA_STA_WMM) &&
4593              nla_put_flag(msg, NL80211_STA_FLAG_WME)) ||
4594             ((total_flags & WPA_STA_SHORT_PREAMBLE) &&
4595              nla_put_flag(msg, NL80211_STA_FLAG_SHORT_PREAMBLE)) ||
4596             ((total_flags & WPA_STA_MFP) &&
4597              nla_put_flag(msg, NL80211_STA_FLAG_MFP)) ||
4598             ((total_flags & WPA_STA_TDLS_PEER) &&
4599              nla_put_flag(msg, NL80211_STA_FLAG_TDLS_PEER)))
4600                 goto fail;
4601
4602         nla_nest_end(msg, flags);
4603
4604         os_memset(&upd, 0, sizeof(upd));
4605         upd.mask = sta_flags_nl80211(flags_or | ~flags_and);
4606         upd.set = sta_flags_nl80211(flags_or);
4607         if (nla_put(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd))
4608                 goto fail;
4609
4610         return send_and_recv_msgs(bss->drv, msg, NULL, NULL);
4611 fail:
4612         nlmsg_free(msg);
4613         return -ENOBUFS;
4614 }
4615
4616
4617 static int wpa_driver_nl80211_ap(struct wpa_driver_nl80211_data *drv,
4618                                  struct wpa_driver_associate_params *params)
4619 {
4620         enum nl80211_iftype nlmode, old_mode;
4621
4622         if (params->p2p) {
4623                 wpa_printf(MSG_DEBUG, "nl80211: Setup AP operations for P2P "
4624                            "group (GO)");
4625                 nlmode = NL80211_IFTYPE_P2P_GO;
4626         } else
4627                 nlmode = NL80211_IFTYPE_AP;
4628
4629         old_mode = drv->nlmode;
4630         if (wpa_driver_nl80211_set_mode(drv->first_bss, nlmode)) {
4631                 nl80211_remove_monitor_interface(drv);
4632                 return -1;
4633         }
4634
4635         if (params->freq.freq &&
4636             nl80211_set_channel(drv->first_bss, &params->freq, 0)) {
4637                 if (old_mode != nlmode)
4638                         wpa_driver_nl80211_set_mode(drv->first_bss, old_mode);
4639                 nl80211_remove_monitor_interface(drv);
4640                 return -1;
4641         }
4642
4643         return 0;
4644 }
4645
4646
4647 static int nl80211_leave_ibss(struct wpa_driver_nl80211_data *drv,
4648                               int reset_mode)
4649 {
4650         struct nl_msg *msg;
4651         int ret;
4652
4653         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_LEAVE_IBSS);
4654         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4655         if (ret) {
4656                 wpa_printf(MSG_DEBUG, "nl80211: Leave IBSS failed: ret=%d "
4657                            "(%s)", ret, strerror(-ret));
4658         } else {
4659                 wpa_printf(MSG_DEBUG,
4660                            "nl80211: Leave IBSS request sent successfully");
4661         }
4662
4663         if (reset_mode &&
4664             wpa_driver_nl80211_set_mode(drv->first_bss,
4665                                         NL80211_IFTYPE_STATION)) {
4666                 wpa_printf(MSG_INFO, "nl80211: Failed to set interface into "
4667                            "station mode");
4668         }
4669
4670         return ret;
4671 }
4672
4673
4674 static int nl80211_ht_vht_overrides(struct nl_msg *msg,
4675                                     struct wpa_driver_associate_params *params)
4676 {
4677         if (params->disable_ht && nla_put_flag(msg, NL80211_ATTR_DISABLE_HT))
4678                 return -1;
4679
4680         if (params->htcaps && params->htcaps_mask) {
4681                 int sz = sizeof(struct ieee80211_ht_capabilities);
4682                 wpa_hexdump(MSG_DEBUG, "  * htcaps", params->htcaps, sz);
4683                 wpa_hexdump(MSG_DEBUG, "  * htcaps_mask",
4684                             params->htcaps_mask, sz);
4685                 if (nla_put(msg, NL80211_ATTR_HT_CAPABILITY, sz,
4686                             params->htcaps) ||
4687                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK, sz,
4688                             params->htcaps_mask))
4689                         return -1;
4690         }
4691
4692 #ifdef CONFIG_VHT_OVERRIDES
4693         if (params->disable_vht) {
4694                 wpa_printf(MSG_DEBUG, "  * VHT disabled");
4695                 if (nla_put_flag(msg, NL80211_ATTR_DISABLE_VHT))
4696                         return -1;
4697         }
4698
4699         if (params->vhtcaps && params->vhtcaps_mask) {
4700                 int sz = sizeof(struct ieee80211_vht_capabilities);
4701                 wpa_hexdump(MSG_DEBUG, "  * vhtcaps", params->vhtcaps, sz);
4702                 wpa_hexdump(MSG_DEBUG, "  * vhtcaps_mask",
4703                             params->vhtcaps_mask, sz);
4704                 if (nla_put(msg, NL80211_ATTR_VHT_CAPABILITY, sz,
4705                             params->vhtcaps) ||
4706                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK, sz,
4707                             params->vhtcaps_mask))
4708                         return -1;
4709         }
4710 #endif /* CONFIG_VHT_OVERRIDES */
4711
4712         return 0;
4713 }
4714
4715
4716 static int wpa_driver_nl80211_ibss(struct wpa_driver_nl80211_data *drv,
4717                                    struct wpa_driver_associate_params *params)
4718 {
4719         struct nl_msg *msg;
4720         int ret = -1;
4721         int count = 0;
4722
4723         wpa_printf(MSG_DEBUG, "nl80211: Join IBSS (ifindex=%d)", drv->ifindex);
4724
4725         if (wpa_driver_nl80211_set_mode_ibss(drv->first_bss, &params->freq)) {
4726                 wpa_printf(MSG_INFO, "nl80211: Failed to set interface into "
4727                            "IBSS mode");
4728                 return -1;
4729         }
4730
4731 retry:
4732         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_JOIN_IBSS)) ||
4733             params->ssid == NULL || params->ssid_len > sizeof(drv->ssid))
4734                 goto fail;
4735
4736         wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
4737                           params->ssid, params->ssid_len);
4738         if (nla_put(msg, NL80211_ATTR_SSID, params->ssid_len, params->ssid))
4739                 goto fail;
4740         os_memcpy(drv->ssid, params->ssid, params->ssid_len);
4741         drv->ssid_len = params->ssid_len;
4742
4743         if (nl80211_put_freq_params(msg, &params->freq) < 0 ||
4744             nl80211_put_beacon_int(msg, params->beacon_int))
4745                 goto fail;
4746
4747         ret = nl80211_set_conn_keys(params, msg);
4748         if (ret)
4749                 goto fail;
4750
4751         if (params->bssid && params->fixed_bssid) {
4752                 wpa_printf(MSG_DEBUG, "  * BSSID=" MACSTR,
4753                            MAC2STR(params->bssid));
4754                 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid))
4755                         goto fail;
4756         }
4757
4758         if (params->fixed_freq) {
4759                 wpa_printf(MSG_DEBUG, "  * fixed_freq");
4760                 if (nla_put_flag(msg, NL80211_ATTR_FREQ_FIXED))
4761                         goto fail;
4762         }
4763
4764         if (params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
4765             params->key_mgmt_suite == WPA_KEY_MGMT_PSK ||
4766             params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
4767             params->key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256) {
4768                 wpa_printf(MSG_DEBUG, "  * control port");
4769                 if (nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT))
4770                         goto fail;
4771         }
4772
4773         if (params->wpa_ie) {
4774                 wpa_hexdump(MSG_DEBUG,
4775                             "  * Extra IEs for Beacon/Probe Response frames",
4776                             params->wpa_ie, params->wpa_ie_len);
4777                 if (nla_put(msg, NL80211_ATTR_IE, params->wpa_ie_len,
4778                             params->wpa_ie))
4779                         goto fail;
4780         }
4781
4782         ret = nl80211_ht_vht_overrides(msg, params);
4783         if (ret < 0)
4784                 goto fail;
4785
4786         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4787         msg = NULL;
4788         if (ret) {
4789                 wpa_printf(MSG_DEBUG, "nl80211: Join IBSS failed: ret=%d (%s)",
4790                            ret, strerror(-ret));
4791                 count++;
4792                 if (ret == -EALREADY && count == 1) {
4793                         wpa_printf(MSG_DEBUG, "nl80211: Retry IBSS join after "
4794                                    "forced leave");
4795                         nl80211_leave_ibss(drv, 0);
4796                         nlmsg_free(msg);
4797                         goto retry;
4798                 }
4799         } else {
4800                 wpa_printf(MSG_DEBUG,
4801                            "nl80211: Join IBSS request sent successfully");
4802         }
4803
4804 fail:
4805         nlmsg_free(msg);
4806         return ret;
4807 }
4808
4809
4810 static int nl80211_connect_common(struct wpa_driver_nl80211_data *drv,
4811                                   struct wpa_driver_associate_params *params,
4812                                   struct nl_msg *msg)
4813 {
4814         if (params->bssid) {
4815                 wpa_printf(MSG_DEBUG, "  * bssid=" MACSTR,
4816                            MAC2STR(params->bssid));
4817                 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid))
4818                         return -1;
4819         }
4820
4821         if (params->bssid_hint) {
4822                 wpa_printf(MSG_DEBUG, "  * bssid_hint=" MACSTR,
4823                            MAC2STR(params->bssid_hint));
4824                 if (nla_put(msg, NL80211_ATTR_MAC_HINT, ETH_ALEN,
4825                             params->bssid_hint))
4826                         return -1;
4827         }
4828
4829         if (params->freq.freq) {
4830                 wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq.freq);
4831                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
4832                                 params->freq.freq))
4833                         return -1;
4834                 drv->assoc_freq = params->freq.freq;
4835         } else
4836                 drv->assoc_freq = 0;
4837
4838         if (params->freq_hint) {
4839                 wpa_printf(MSG_DEBUG, "  * freq_hint=%d", params->freq_hint);
4840                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_HINT,
4841                                 params->freq_hint))
4842                         return -1;
4843         }
4844
4845         if (params->bg_scan_period >= 0) {
4846                 wpa_printf(MSG_DEBUG, "  * bg scan period=%d",
4847                            params->bg_scan_period);
4848                 if (nla_put_u16(msg, NL80211_ATTR_BG_SCAN_PERIOD,
4849                                 params->bg_scan_period))
4850                         return -1;
4851         }
4852
4853         if (params->ssid) {
4854                 wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
4855                                   params->ssid, params->ssid_len);
4856                 if (nla_put(msg, NL80211_ATTR_SSID, params->ssid_len,
4857                             params->ssid))
4858                         return -1;
4859                 if (params->ssid_len > sizeof(drv->ssid))
4860                         return -1;
4861                 os_memcpy(drv->ssid, params->ssid, params->ssid_len);
4862                 drv->ssid_len = params->ssid_len;
4863         }
4864
4865         wpa_hexdump(MSG_DEBUG, "  * IEs", params->wpa_ie, params->wpa_ie_len);
4866         if (params->wpa_ie &&
4867             nla_put(msg, NL80211_ATTR_IE, params->wpa_ie_len, params->wpa_ie))
4868                 return -1;
4869
4870         if (params->wpa_proto) {
4871                 enum nl80211_wpa_versions ver = 0;
4872
4873                 if (params->wpa_proto & WPA_PROTO_WPA)
4874                         ver |= NL80211_WPA_VERSION_1;
4875                 if (params->wpa_proto & WPA_PROTO_RSN)
4876                         ver |= NL80211_WPA_VERSION_2;
4877
4878                 wpa_printf(MSG_DEBUG, "  * WPA Versions 0x%x", ver);
4879                 if (nla_put_u32(msg, NL80211_ATTR_WPA_VERSIONS, ver))
4880                         return -1;
4881         }
4882
4883         if (params->pairwise_suite != WPA_CIPHER_NONE) {
4884                 u32 cipher = wpa_cipher_to_cipher_suite(params->pairwise_suite);
4885                 wpa_printf(MSG_DEBUG, "  * pairwise=0x%x", cipher);
4886                 if (nla_put_u32(msg, NL80211_ATTR_CIPHER_SUITES_PAIRWISE,
4887                                 cipher))
4888                         return -1;
4889         }
4890
4891         if (params->group_suite == WPA_CIPHER_GTK_NOT_USED &&
4892             !(drv->capa.enc & WPA_DRIVER_CAPA_ENC_GTK_NOT_USED)) {
4893                 /*
4894                  * This is likely to work even though many drivers do not
4895                  * advertise support for operations without GTK.
4896                  */
4897                 wpa_printf(MSG_DEBUG, "  * skip group cipher configuration for GTK_NOT_USED due to missing driver support advertisement");
4898         } else if (params->group_suite != WPA_CIPHER_NONE) {
4899                 u32 cipher = wpa_cipher_to_cipher_suite(params->group_suite);
4900                 wpa_printf(MSG_DEBUG, "  * group=0x%x", cipher);
4901                 if (nla_put_u32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP, cipher))
4902                         return -1;
4903         }
4904
4905         if (params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
4906             params->key_mgmt_suite == WPA_KEY_MGMT_PSK ||
4907             params->key_mgmt_suite == WPA_KEY_MGMT_FT_IEEE8021X ||
4908             params->key_mgmt_suite == WPA_KEY_MGMT_FT_PSK ||
4909             params->key_mgmt_suite == WPA_KEY_MGMT_CCKM ||
4910             params->key_mgmt_suite == WPA_KEY_MGMT_OSEN ||
4911             params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
4912             params->key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256 ||
4913             params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B ||
4914             params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) {
4915                 int mgmt = WLAN_AKM_SUITE_PSK;
4916
4917                 switch (params->key_mgmt_suite) {
4918                 case WPA_KEY_MGMT_CCKM:
4919                         mgmt = WLAN_AKM_SUITE_CCKM;
4920                         break;
4921                 case WPA_KEY_MGMT_IEEE8021X:
4922                         mgmt = WLAN_AKM_SUITE_8021X;
4923                         break;
4924                 case WPA_KEY_MGMT_FT_IEEE8021X:
4925                         mgmt = WLAN_AKM_SUITE_FT_8021X;
4926                         break;
4927                 case WPA_KEY_MGMT_FT_PSK:
4928                         mgmt = WLAN_AKM_SUITE_FT_PSK;
4929                         break;
4930                 case WPA_KEY_MGMT_IEEE8021X_SHA256:
4931                         mgmt = WLAN_AKM_SUITE_8021X_SHA256;
4932                         break;
4933                 case WPA_KEY_MGMT_PSK_SHA256:
4934                         mgmt = WLAN_AKM_SUITE_PSK_SHA256;
4935                         break;
4936                 case WPA_KEY_MGMT_OSEN:
4937                         mgmt = WLAN_AKM_SUITE_OSEN;
4938                         break;
4939                 case WPA_KEY_MGMT_IEEE8021X_SUITE_B:
4940                         mgmt = WLAN_AKM_SUITE_8021X_SUITE_B;
4941                         break;
4942                 case WPA_KEY_MGMT_IEEE8021X_SUITE_B_192:
4943                         mgmt = WLAN_AKM_SUITE_8021X_SUITE_B_192;
4944                         break;
4945                 case WPA_KEY_MGMT_PSK:
4946                 default:
4947                         mgmt = WLAN_AKM_SUITE_PSK;
4948                         break;
4949                 }
4950                 wpa_printf(MSG_DEBUG, "  * akm=0x%x", mgmt);
4951                 if (nla_put_u32(msg, NL80211_ATTR_AKM_SUITES, mgmt))
4952                         return -1;
4953         }
4954
4955         if (nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT))
4956                 return -1;
4957
4958         if (params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_NO_WPA &&
4959             (params->pairwise_suite == WPA_CIPHER_NONE ||
4960              params->pairwise_suite == WPA_CIPHER_WEP104 ||
4961              params->pairwise_suite == WPA_CIPHER_WEP40) &&
4962             (nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, ETH_P_PAE) ||
4963              nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT)))
4964                 return -1;
4965
4966         if (params->mgmt_frame_protection == MGMT_FRAME_PROTECTION_REQUIRED &&
4967             nla_put_u32(msg, NL80211_ATTR_USE_MFP, NL80211_MFP_REQUIRED))
4968                 return -1;
4969
4970         if (params->rrm_used) {
4971                 u32 drv_rrm_flags = drv->capa.rrm_flags;
4972                 if ((!((drv_rrm_flags &
4973                         WPA_DRIVER_FLAGS_DS_PARAM_SET_IE_IN_PROBES) &&
4974                        (drv_rrm_flags & WPA_DRIVER_FLAGS_QUIET)) &&
4975                      !(drv_rrm_flags & WPA_DRIVER_FLAGS_SUPPORT_RRM)) ||
4976                     nla_put_flag(msg, NL80211_ATTR_USE_RRM))
4977                         return -1;
4978         }
4979
4980         if (nl80211_ht_vht_overrides(msg, params) < 0)
4981                 return -1;
4982
4983         if (params->p2p)
4984                 wpa_printf(MSG_DEBUG, "  * P2P group");
4985
4986         if (params->pbss) {
4987                 wpa_printf(MSG_DEBUG, "  * PBSS");
4988                 if (nla_put_flag(msg, NL80211_ATTR_PBSS))
4989                         return -1;
4990         }
4991
4992         drv->connect_reassoc = 0;
4993         if (params->prev_bssid) {
4994                 wpa_printf(MSG_DEBUG, "  * prev_bssid=" MACSTR,
4995                            MAC2STR(params->prev_bssid));
4996                 if (nla_put(msg, NL80211_ATTR_PREV_BSSID, ETH_ALEN,
4997                             params->prev_bssid))
4998                         return -1;
4999                 drv->connect_reassoc = 1;
5000         }
5001
5002         return 0;
5003 }
5004
5005
5006 static int wpa_driver_nl80211_try_connect(
5007         struct wpa_driver_nl80211_data *drv,
5008         struct wpa_driver_associate_params *params)
5009 {
5010         struct nl_msg *msg;
5011         enum nl80211_auth_type type;
5012         int ret;
5013         int algs;
5014
5015 #ifdef CONFIG_DRIVER_NL80211_QCA
5016         if (params->req_key_mgmt_offload && params->psk &&
5017             (params->key_mgmt_suite == WPA_KEY_MGMT_PSK ||
5018              params->key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256 ||
5019              params->key_mgmt_suite == WPA_KEY_MGMT_FT_PSK)) {
5020                 wpa_printf(MSG_DEBUG, "nl80211: Key management set PSK");
5021                 ret = issue_key_mgmt_set_key(drv, params->psk, 32);
5022                 if (ret)
5023                         return ret;
5024         }
5025 #endif /* CONFIG_DRIVER_NL80211_QCA */
5026
5027         wpa_printf(MSG_DEBUG, "nl80211: Connect (ifindex=%d)", drv->ifindex);
5028         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_CONNECT);
5029         if (!msg)
5030                 return -1;
5031
5032         ret = nl80211_connect_common(drv, params, msg);
5033         if (ret)
5034                 goto fail;
5035
5036         algs = 0;
5037         if (params->auth_alg & WPA_AUTH_ALG_OPEN)
5038                 algs++;
5039         if (params->auth_alg & WPA_AUTH_ALG_SHARED)
5040                 algs++;
5041         if (params->auth_alg & WPA_AUTH_ALG_LEAP)
5042                 algs++;
5043         if (algs > 1) {
5044                 wpa_printf(MSG_DEBUG, "  * Leave out Auth Type for automatic "
5045                            "selection");
5046                 goto skip_auth_type;
5047         }
5048
5049         if (params->auth_alg & WPA_AUTH_ALG_OPEN)
5050                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
5051         else if (params->auth_alg & WPA_AUTH_ALG_SHARED)
5052                 type = NL80211_AUTHTYPE_SHARED_KEY;
5053         else if (params->auth_alg & WPA_AUTH_ALG_LEAP)
5054                 type = NL80211_AUTHTYPE_NETWORK_EAP;
5055         else if (params->auth_alg & WPA_AUTH_ALG_FT)
5056                 type = NL80211_AUTHTYPE_FT;
5057         else
5058                 goto fail;
5059
5060         wpa_printf(MSG_DEBUG, "  * Auth Type %d", type);
5061         if (nla_put_u32(msg, NL80211_ATTR_AUTH_TYPE, type))
5062                 goto fail;
5063
5064 skip_auth_type:
5065         ret = nl80211_set_conn_keys(params, msg);
5066         if (ret)
5067                 goto fail;
5068
5069         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5070         msg = NULL;
5071         if (ret) {
5072                 wpa_printf(MSG_DEBUG, "nl80211: MLME connect failed: ret=%d "
5073                            "(%s)", ret, strerror(-ret));
5074         } else {
5075                 wpa_printf(MSG_DEBUG,
5076                            "nl80211: Connect request send successfully");
5077         }
5078
5079 fail:
5080         nlmsg_free(msg);
5081         return ret;
5082
5083 }
5084
5085
5086 static int wpa_driver_nl80211_connect(
5087         struct wpa_driver_nl80211_data *drv,
5088         struct wpa_driver_associate_params *params)
5089 {
5090         int ret;
5091
5092         /* Store the connection attempted bssid for future use */
5093         if (params->bssid)
5094                 os_memcpy(drv->auth_attempt_bssid, params->bssid, ETH_ALEN);
5095         else
5096                 os_memset(drv->auth_attempt_bssid, 0, ETH_ALEN);
5097
5098         ret = wpa_driver_nl80211_try_connect(drv, params);
5099         if (ret == -EALREADY) {
5100                 /*
5101                  * cfg80211 does not currently accept new connections if
5102                  * we are already connected. As a workaround, force
5103                  * disconnection and try again.
5104                  */
5105                 wpa_printf(MSG_DEBUG, "nl80211: Explicitly "
5106                            "disconnecting before reassociation "
5107                            "attempt");
5108                 if (wpa_driver_nl80211_disconnect(
5109                             drv, WLAN_REASON_PREV_AUTH_NOT_VALID))
5110                         return -1;
5111                 ret = wpa_driver_nl80211_try_connect(drv, params);
5112         }
5113         return ret;
5114 }
5115
5116
5117 static int wpa_driver_nl80211_associate(
5118         void *priv, struct wpa_driver_associate_params *params)
5119 {
5120         struct i802_bss *bss = priv;
5121         struct wpa_driver_nl80211_data *drv = bss->drv;
5122         int ret = -1;
5123         struct nl_msg *msg;
5124
5125         nl80211_unmask_11b_rates(bss);
5126
5127         if (params->mode == IEEE80211_MODE_AP)
5128                 return wpa_driver_nl80211_ap(drv, params);
5129
5130         if (params->mode == IEEE80211_MODE_IBSS)
5131                 return wpa_driver_nl80211_ibss(drv, params);
5132
5133         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME)) {
5134                 enum nl80211_iftype nlmode = params->p2p ?
5135                         NL80211_IFTYPE_P2P_CLIENT : NL80211_IFTYPE_STATION;
5136
5137                 if (wpa_driver_nl80211_set_mode(priv, nlmode) < 0)
5138                         return -1;
5139                 return wpa_driver_nl80211_connect(drv, params);
5140         }
5141
5142         nl80211_mark_disconnected(drv);
5143
5144         wpa_printf(MSG_DEBUG, "nl80211: Associate (ifindex=%d)",
5145                    drv->ifindex);
5146         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_ASSOCIATE);
5147         if (!msg)
5148                 return -1;
5149
5150         ret = nl80211_connect_common(drv, params, msg);
5151         if (ret)
5152                 goto fail;
5153
5154         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5155         msg = NULL;
5156         if (ret) {
5157                 wpa_dbg(drv->ctx, MSG_DEBUG,
5158                         "nl80211: MLME command failed (assoc): ret=%d (%s)",
5159                         ret, strerror(-ret));
5160                 nl80211_dump_scan(drv);
5161         } else {
5162                 wpa_printf(MSG_DEBUG,
5163                            "nl80211: Association request send successfully");
5164         }
5165
5166 fail:
5167         nlmsg_free(msg);
5168         return ret;
5169 }
5170
5171
5172 static int nl80211_set_mode(struct wpa_driver_nl80211_data *drv,
5173                             int ifindex, enum nl80211_iftype mode)
5174 {
5175         struct nl_msg *msg;
5176         int ret = -ENOBUFS;
5177
5178         wpa_printf(MSG_DEBUG, "nl80211: Set mode ifindex %d iftype %d (%s)",
5179                    ifindex, mode, nl80211_iftype_str(mode));
5180
5181         msg = nl80211_cmd_msg(drv->first_bss, 0, NL80211_CMD_SET_INTERFACE);
5182         if (!msg || nla_put_u32(msg, NL80211_ATTR_IFTYPE, mode))
5183                 goto fail;
5184
5185         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5186         msg = NULL;
5187         if (!ret)
5188                 return 0;
5189 fail:
5190         nlmsg_free(msg);
5191         wpa_printf(MSG_DEBUG, "nl80211: Failed to set interface %d to mode %d:"
5192                    " %d (%s)", ifindex, mode, ret, strerror(-ret));
5193         return ret;
5194 }
5195
5196
5197 static int wpa_driver_nl80211_set_mode_impl(
5198                 struct i802_bss *bss,
5199                 enum nl80211_iftype nlmode,
5200                 struct hostapd_freq_params *desired_freq_params)
5201 {
5202         struct wpa_driver_nl80211_data *drv = bss->drv;
5203         int ret = -1;
5204         int i;
5205         int was_ap = is_ap_interface(drv->nlmode);
5206         int res;
5207         int mode_switch_res;
5208
5209         if (TEST_FAIL())
5210                 return -1;
5211
5212         mode_switch_res = nl80211_set_mode(drv, drv->ifindex, nlmode);
5213         if (mode_switch_res && nlmode == nl80211_get_ifmode(bss))
5214                 mode_switch_res = 0;
5215
5216         if (mode_switch_res == 0) {
5217                 drv->nlmode = nlmode;
5218                 ret = 0;
5219                 goto done;
5220         }
5221
5222         if (mode_switch_res == -ENODEV)
5223                 return -1;
5224
5225         if (nlmode == drv->nlmode) {
5226                 wpa_printf(MSG_DEBUG, "nl80211: Interface already in "
5227                            "requested mode - ignore error");
5228                 ret = 0;
5229                 goto done; /* Already in the requested mode */
5230         }
5231
5232         /* mac80211 doesn't allow mode changes while the device is up, so
5233          * take the device down, try to set the mode again, and bring the
5234          * device back up.
5235          */
5236         wpa_printf(MSG_DEBUG, "nl80211: Try mode change after setting "
5237                    "interface down");
5238         for (i = 0; i < 10; i++) {
5239                 res = i802_set_iface_flags(bss, 0);
5240                 if (res == -EACCES || res == -ENODEV)
5241                         break;
5242                 if (res != 0) {
5243                         wpa_printf(MSG_DEBUG, "nl80211: Failed to set "
5244                                    "interface down");
5245                         os_sleep(0, 100000);
5246                         continue;
5247                 }
5248
5249                 /*
5250                  * Setting the mode will fail for some drivers if the phy is
5251                  * on a frequency that the mode is disallowed in.
5252                  */
5253                 if (desired_freq_params) {
5254                         res = nl80211_set_channel(bss, desired_freq_params, 0);
5255                         if (res) {
5256                                 wpa_printf(MSG_DEBUG,
5257                                            "nl80211: Failed to set frequency on interface");
5258                         }
5259                 }
5260
5261                 /* Try to set the mode again while the interface is down */
5262                 mode_switch_res = nl80211_set_mode(drv, drv->ifindex, nlmode);
5263                 if (mode_switch_res == -EBUSY) {
5264                         wpa_printf(MSG_DEBUG,
5265                                    "nl80211: Delaying mode set while interface going down");
5266                         os_sleep(0, 100000);
5267                         continue;
5268                 }
5269                 ret = mode_switch_res;
5270                 break;
5271         }
5272
5273         if (!ret) {
5274                 wpa_printf(MSG_DEBUG, "nl80211: Mode change succeeded while "
5275                            "interface is down");
5276                 drv->nlmode = nlmode;
5277                 drv->ignore_if_down_event = 1;
5278         }
5279
5280         /* Bring the interface back up */
5281         res = linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 1);
5282         if (res != 0) {
5283                 wpa_printf(MSG_DEBUG,
5284                            "nl80211: Failed to set interface up after switching mode");
5285                 ret = -1;
5286         }
5287
5288 done:
5289         if (ret) {
5290                 wpa_printf(MSG_DEBUG, "nl80211: Interface mode change to %d "
5291                            "from %d failed", nlmode, drv->nlmode);
5292                 return ret;
5293         }
5294
5295         if (is_p2p_net_interface(nlmode)) {
5296                 wpa_printf(MSG_DEBUG,
5297                            "nl80211: Interface %s mode change to P2P - disable 11b rates",
5298                            bss->ifname);
5299                 nl80211_disable_11b_rates(drv, drv->ifindex, 1);
5300         } else if (drv->disabled_11b_rates) {
5301                 wpa_printf(MSG_DEBUG,
5302                            "nl80211: Interface %s mode changed to non-P2P - re-enable 11b rates",
5303                            bss->ifname);
5304                 nl80211_disable_11b_rates(drv, drv->ifindex, 0);
5305         }
5306
5307         if (is_ap_interface(nlmode)) {
5308                 nl80211_mgmt_unsubscribe(bss, "start AP");
5309                 /* Setup additional AP mode functionality if needed */
5310                 if (nl80211_setup_ap(bss))
5311                         return -1;
5312         } else if (was_ap) {
5313                 /* Remove additional AP mode functionality */
5314                 nl80211_teardown_ap(bss);
5315         } else {
5316                 nl80211_mgmt_unsubscribe(bss, "mode change");
5317         }
5318
5319         if (is_mesh_interface(nlmode) &&
5320             nl80211_mgmt_subscribe_mesh(bss))
5321                 return -1;
5322
5323         if (!bss->in_deinit && !is_ap_interface(nlmode) &&
5324             !is_mesh_interface(nlmode) &&
5325             nl80211_mgmt_subscribe_non_ap(bss) < 0)
5326                 wpa_printf(MSG_DEBUG, "nl80211: Failed to register Action "
5327                            "frame processing - ignore for now");
5328
5329         return 0;
5330 }
5331
5332
5333 int wpa_driver_nl80211_set_mode(struct i802_bss *bss,
5334                                 enum nl80211_iftype nlmode)
5335 {
5336         return wpa_driver_nl80211_set_mode_impl(bss, nlmode, NULL);
5337 }
5338
5339
5340 static int wpa_driver_nl80211_set_mode_ibss(struct i802_bss *bss,
5341                                             struct hostapd_freq_params *freq)
5342 {
5343         return wpa_driver_nl80211_set_mode_impl(bss, NL80211_IFTYPE_ADHOC,
5344                                                 freq);
5345 }
5346
5347
5348 static int wpa_driver_nl80211_get_capa(void *priv,
5349                                        struct wpa_driver_capa *capa)
5350 {
5351         struct i802_bss *bss = priv;
5352         struct wpa_driver_nl80211_data *drv = bss->drv;
5353
5354         if (!drv->has_capability)
5355                 return -1;
5356         os_memcpy(capa, &drv->capa, sizeof(*capa));
5357         if (drv->extended_capa && drv->extended_capa_mask) {
5358                 capa->extended_capa = drv->extended_capa;
5359                 capa->extended_capa_mask = drv->extended_capa_mask;
5360                 capa->extended_capa_len = drv->extended_capa_len;
5361         }
5362
5363         return 0;
5364 }
5365
5366
5367 static int wpa_driver_nl80211_set_operstate(void *priv, int state)
5368 {
5369         struct i802_bss *bss = priv;
5370         struct wpa_driver_nl80211_data *drv = bss->drv;
5371
5372         wpa_printf(MSG_DEBUG, "nl80211: Set %s operstate %d->%d (%s)",
5373                    bss->ifname, drv->operstate, state,
5374                    state ? "UP" : "DORMANT");
5375         drv->operstate = state;
5376         return netlink_send_oper_ifla(drv->global->netlink, drv->ifindex, -1,
5377                                       state ? IF_OPER_UP : IF_OPER_DORMANT);
5378 }
5379
5380
5381 static int wpa_driver_nl80211_set_supp_port(void *priv, int authorized)
5382 {
5383         struct i802_bss *bss = priv;
5384         struct wpa_driver_nl80211_data *drv = bss->drv;
5385         struct nl_msg *msg;
5386         struct nl80211_sta_flag_update upd;
5387         int ret;
5388
5389         if (!drv->associated && is_zero_ether_addr(drv->bssid) && !authorized) {
5390                 wpa_printf(MSG_DEBUG, "nl80211: Skip set_supp_port(unauthorized) while not associated");
5391                 return 0;
5392         }
5393
5394         wpa_printf(MSG_DEBUG, "nl80211: Set supplicant port %sauthorized for "
5395                    MACSTR, authorized ? "" : "un", MAC2STR(drv->bssid));
5396
5397         os_memset(&upd, 0, sizeof(upd));
5398         upd.mask = BIT(NL80211_STA_FLAG_AUTHORIZED);
5399         if (authorized)
5400                 upd.set = BIT(NL80211_STA_FLAG_AUTHORIZED);
5401
5402         if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_SET_STATION)) ||
5403             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, drv->bssid) ||
5404             nla_put(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd)) {
5405                 nlmsg_free(msg);
5406                 return -ENOBUFS;
5407         }
5408
5409         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5410         if (!ret)
5411                 return 0;
5412         wpa_printf(MSG_DEBUG, "nl80211: Failed to set STA flag: %d (%s)",
5413                    ret, strerror(-ret));
5414         return ret;
5415 }
5416
5417
5418 /* Set kernel driver on given frequency (MHz) */
5419 static int i802_set_freq(void *priv, struct hostapd_freq_params *freq)
5420 {
5421         struct i802_bss *bss = priv;
5422         return nl80211_set_channel(bss, freq, 0);
5423 }
5424
5425
5426 static inline int min_int(int a, int b)
5427 {
5428         if (a < b)
5429                 return a;
5430         return b;
5431 }
5432
5433
5434 static int get_key_handler(struct nl_msg *msg, void *arg)
5435 {
5436         struct nlattr *tb[NL80211_ATTR_MAX + 1];
5437         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
5438
5439         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
5440                   genlmsg_attrlen(gnlh, 0), NULL);
5441
5442         /*
5443          * TODO: validate the key index and mac address!
5444          * Otherwise, there's a race condition as soon as
5445          * the kernel starts sending key notifications.
5446          */
5447
5448         if (tb[NL80211_ATTR_KEY_SEQ])
5449                 memcpy(arg, nla_data(tb[NL80211_ATTR_KEY_SEQ]),
5450                        min_int(nla_len(tb[NL80211_ATTR_KEY_SEQ]), 6));
5451         return NL_SKIP;
5452 }
5453
5454
5455 static int i802_get_seqnum(const char *iface, void *priv, const u8 *addr,
5456                            int idx, u8 *seq)
5457 {
5458         struct i802_bss *bss = priv;
5459         struct wpa_driver_nl80211_data *drv = bss->drv;
5460         struct nl_msg *msg;
5461
5462         msg = nl80211_ifindex_msg(drv, if_nametoindex(iface), 0,
5463                                   NL80211_CMD_GET_KEY);
5464         if (!msg ||
5465             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
5466             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, idx)) {
5467                 nlmsg_free(msg);
5468                 return -ENOBUFS;
5469         }
5470
5471         memset(seq, 0, 6);
5472
5473         return send_and_recv_msgs(drv, msg, get_key_handler, seq);
5474 }
5475
5476
5477 static int i802_set_rts(void *priv, int rts)
5478 {
5479         struct i802_bss *bss = priv;
5480         struct wpa_driver_nl80211_data *drv = bss->drv;
5481         struct nl_msg *msg;
5482         int ret;
5483         u32 val;
5484
5485         if (rts >= 2347)
5486                 val = (u32) -1;
5487         else
5488                 val = rts;
5489
5490         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_SET_WIPHY)) ||
5491             nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD, val)) {
5492                 nlmsg_free(msg);
5493                 return -ENOBUFS;
5494         }
5495
5496         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5497         if (!ret)
5498                 return 0;
5499         wpa_printf(MSG_DEBUG, "nl80211: Failed to set RTS threshold %d: "
5500                    "%d (%s)", rts, ret, strerror(-ret));
5501         return ret;
5502 }
5503
5504
5505 static int i802_set_frag(void *priv, int frag)
5506 {
5507         struct i802_bss *bss = priv;
5508         struct wpa_driver_nl80211_data *drv = bss->drv;
5509         struct nl_msg *msg;
5510         int ret;
5511         u32 val;
5512
5513         if (frag >= 2346)
5514                 val = (u32) -1;
5515         else
5516                 val = frag;
5517
5518         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_SET_WIPHY)) ||
5519             nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD, val)) {
5520                 nlmsg_free(msg);
5521                 return -ENOBUFS;
5522         }
5523
5524         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5525         if (!ret)
5526                 return 0;
5527         wpa_printf(MSG_DEBUG, "nl80211: Failed to set fragmentation threshold "
5528                    "%d: %d (%s)", frag, ret, strerror(-ret));
5529         return ret;
5530 }
5531
5532
5533 static int i802_flush(void *priv)
5534 {
5535         struct i802_bss *bss = priv;
5536         struct nl_msg *msg;
5537         int res;
5538
5539         wpa_printf(MSG_DEBUG, "nl80211: flush -> DEL_STATION %s (all)",
5540                    bss->ifname);
5541
5542         /*
5543          * XXX: FIX! this needs to flush all VLANs too
5544          */
5545         msg = nl80211_bss_msg(bss, 0, NL80211_CMD_DEL_STATION);
5546         res = send_and_recv_msgs(bss->drv, msg, NULL, NULL);
5547         if (res) {
5548                 wpa_printf(MSG_DEBUG, "nl80211: Station flush failed: ret=%d "
5549                            "(%s)", res, strerror(-res));
5550         }
5551         return res;
5552 }
5553
5554
5555 static int get_sta_handler(struct nl_msg *msg, void *arg)
5556 {
5557         struct nlattr *tb[NL80211_ATTR_MAX + 1];
5558         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
5559         struct hostap_sta_driver_data *data = arg;
5560         struct nlattr *stats[NL80211_STA_INFO_MAX + 1];
5561         static struct nla_policy stats_policy[NL80211_STA_INFO_MAX + 1] = {
5562                 [NL80211_STA_INFO_INACTIVE_TIME] = { .type = NLA_U32 },
5563                 [NL80211_STA_INFO_RX_BYTES] = { .type = NLA_U32 },
5564                 [NL80211_STA_INFO_TX_BYTES] = { .type = NLA_U32 },
5565                 [NL80211_STA_INFO_RX_PACKETS] = { .type = NLA_U32 },
5566                 [NL80211_STA_INFO_TX_PACKETS] = { .type = NLA_U32 },
5567                 [NL80211_STA_INFO_TX_FAILED] = { .type = NLA_U32 },
5568                 [NL80211_STA_INFO_RX_BYTES64] = { .type = NLA_U64 },
5569                 [NL80211_STA_INFO_TX_BYTES64] = { .type = NLA_U64 },
5570         };
5571
5572         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
5573                   genlmsg_attrlen(gnlh, 0), NULL);
5574
5575         /*
5576          * TODO: validate the interface and mac address!
5577          * Otherwise, there's a race condition as soon as
5578          * the kernel starts sending station notifications.
5579          */
5580
5581         if (!tb[NL80211_ATTR_STA_INFO]) {
5582                 wpa_printf(MSG_DEBUG, "sta stats missing!");
5583                 return NL_SKIP;
5584         }
5585         if (nla_parse_nested(stats, NL80211_STA_INFO_MAX,
5586                              tb[NL80211_ATTR_STA_INFO],
5587                              stats_policy)) {
5588                 wpa_printf(MSG_DEBUG, "failed to parse nested attributes!");
5589                 return NL_SKIP;
5590         }
5591
5592         if (stats[NL80211_STA_INFO_INACTIVE_TIME])
5593                 data->inactive_msec =
5594                         nla_get_u32(stats[NL80211_STA_INFO_INACTIVE_TIME]);
5595         /* For backwards compatibility, fetch the 32-bit counters first. */
5596         if (stats[NL80211_STA_INFO_RX_BYTES])
5597                 data->rx_bytes = nla_get_u32(stats[NL80211_STA_INFO_RX_BYTES]);
5598         if (stats[NL80211_STA_INFO_TX_BYTES])
5599                 data->tx_bytes = nla_get_u32(stats[NL80211_STA_INFO_TX_BYTES]);
5600         if (stats[NL80211_STA_INFO_RX_BYTES64] &&
5601             stats[NL80211_STA_INFO_TX_BYTES64]) {
5602                 /*
5603                  * The driver supports 64-bit counters, so use them to override
5604                  * the 32-bit values.
5605                  */
5606                 data->rx_bytes =
5607                         nla_get_u64(stats[NL80211_STA_INFO_RX_BYTES64]);
5608                 data->tx_bytes =
5609                         nla_get_u64(stats[NL80211_STA_INFO_TX_BYTES64]);
5610                 data->bytes_64bit = 1;
5611         }
5612         if (stats[NL80211_STA_INFO_RX_PACKETS])
5613                 data->rx_packets =
5614                         nla_get_u32(stats[NL80211_STA_INFO_RX_PACKETS]);
5615         if (stats[NL80211_STA_INFO_TX_PACKETS])
5616                 data->tx_packets =
5617                         nla_get_u32(stats[NL80211_STA_INFO_TX_PACKETS]);
5618         if (stats[NL80211_STA_INFO_TX_FAILED])
5619                 data->tx_retry_failed =
5620                         nla_get_u32(stats[NL80211_STA_INFO_TX_FAILED]);
5621
5622         return NL_SKIP;
5623 }
5624
5625 static int i802_read_sta_data(struct i802_bss *bss,
5626                               struct hostap_sta_driver_data *data,
5627                               const u8 *addr)
5628 {
5629         struct nl_msg *msg;
5630
5631         os_memset(data, 0, sizeof(*data));
5632
5633         if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_GET_STATION)) ||
5634             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) {
5635                 nlmsg_free(msg);
5636                 return -ENOBUFS;
5637         }
5638
5639         return send_and_recv_msgs(bss->drv, msg, get_sta_handler, data);
5640 }
5641
5642
5643 static int i802_set_tx_queue_params(void *priv, int queue, int aifs,
5644                                     int cw_min, int cw_max, int burst_time)
5645 {
5646         struct i802_bss *bss = priv;
5647         struct wpa_driver_nl80211_data *drv = bss->drv;
5648         struct nl_msg *msg;
5649         struct nlattr *txq, *params;
5650
5651         msg = nl80211_bss_msg(bss, 0, NL80211_CMD_SET_WIPHY);
5652         if (!msg)
5653                 return -1;
5654
5655         txq = nla_nest_start(msg, NL80211_ATTR_WIPHY_TXQ_PARAMS);
5656         if (!txq)
5657                 goto fail;
5658
5659         /* We are only sending parameters for a single TXQ at a time */
5660         params = nla_nest_start(msg, 1);
5661         if (!params)
5662                 goto fail;
5663
5664         switch (queue) {
5665         case 0:
5666                 if (nla_put_u8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_VO))
5667                         goto fail;
5668                 break;
5669         case 1:
5670                 if (nla_put_u8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_VI))
5671                         goto fail;
5672                 break;
5673         case 2:
5674                 if (nla_put_u8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_BE))
5675                         goto fail;
5676                 break;
5677         case 3:
5678                 if (nla_put_u8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_BK))
5679                         goto fail;
5680                 break;
5681         }
5682         /* Burst time is configured in units of 0.1 msec and TXOP parameter in
5683          * 32 usec, so need to convert the value here. */
5684         if (nla_put_u16(msg, NL80211_TXQ_ATTR_TXOP,
5685                         (burst_time * 100 + 16) / 32) ||
5686             nla_put_u16(msg, NL80211_TXQ_ATTR_CWMIN, cw_min) ||
5687             nla_put_u16(msg, NL80211_TXQ_ATTR_CWMAX, cw_max) ||
5688             nla_put_u8(msg, NL80211_TXQ_ATTR_AIFS, aifs))
5689                 goto fail;
5690
5691         nla_nest_end(msg, params);
5692
5693         nla_nest_end(msg, txq);
5694
5695         if (send_and_recv_msgs(drv, msg, NULL, NULL) == 0)
5696                 return 0;
5697         msg = NULL;
5698 fail:
5699         nlmsg_free(msg);
5700         return -1;
5701 }
5702
5703
5704 static int i802_set_sta_vlan(struct i802_bss *bss, const u8 *addr,
5705                              const char *ifname, int vlan_id)
5706 {
5707         struct wpa_driver_nl80211_data *drv = bss->drv;
5708         struct nl_msg *msg;
5709         int ret;
5710
5711         wpa_printf(MSG_DEBUG, "nl80211: %s[%d]: set_sta_vlan(" MACSTR
5712                    ", ifname=%s[%d], vlan_id=%d)",
5713                    bss->ifname, if_nametoindex(bss->ifname),
5714                    MAC2STR(addr), ifname, if_nametoindex(ifname), vlan_id);
5715         if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_SET_STATION)) ||
5716             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
5717             nla_put_u32(msg, NL80211_ATTR_STA_VLAN, if_nametoindex(ifname))) {
5718                 nlmsg_free(msg);
5719                 return -ENOBUFS;
5720         }
5721
5722         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5723         if (ret < 0) {
5724                 wpa_printf(MSG_ERROR, "nl80211: NL80211_ATTR_STA_VLAN (addr="
5725                            MACSTR " ifname=%s vlan_id=%d) failed: %d (%s)",
5726                            MAC2STR(addr), ifname, vlan_id, ret,
5727                            strerror(-ret));
5728         }
5729         return ret;
5730 }
5731
5732
5733 static int i802_get_inact_sec(void *priv, const u8 *addr)
5734 {
5735         struct hostap_sta_driver_data data;
5736         int ret;
5737
5738         data.inactive_msec = (unsigned long) -1;
5739         ret = i802_read_sta_data(priv, &data, addr);
5740         if (ret == -ENOENT)
5741                 return -ENOENT;
5742         if (ret || data.inactive_msec == (unsigned long) -1)
5743                 return -1;
5744         return data.inactive_msec / 1000;
5745 }
5746
5747
5748 static int i802_sta_clear_stats(void *priv, const u8 *addr)
5749 {
5750 #if 0
5751         /* TODO */
5752 #endif
5753         return 0;
5754 }
5755
5756
5757 static int i802_sta_deauth(void *priv, const u8 *own_addr, const u8 *addr,
5758                            int reason)
5759 {
5760         struct i802_bss *bss = priv;
5761         struct wpa_driver_nl80211_data *drv = bss->drv;
5762         struct ieee80211_mgmt mgmt;
5763
5764         if (is_mesh_interface(drv->nlmode))
5765                 return -1;
5766
5767         if (drv->device_ap_sme)
5768                 return wpa_driver_nl80211_sta_remove(bss, addr, 1, reason);
5769
5770         memset(&mgmt, 0, sizeof(mgmt));
5771         mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
5772                                           WLAN_FC_STYPE_DEAUTH);
5773         memcpy(mgmt.da, addr, ETH_ALEN);
5774         memcpy(mgmt.sa, own_addr, ETH_ALEN);
5775         memcpy(mgmt.bssid, own_addr, ETH_ALEN);
5776         mgmt.u.deauth.reason_code = host_to_le16(reason);
5777         return wpa_driver_nl80211_send_mlme(bss, (u8 *) &mgmt,
5778                                             IEEE80211_HDRLEN +
5779                                             sizeof(mgmt.u.deauth), 0, 0, 0, 0,
5780                                             0, NULL, 0);
5781 }
5782
5783
5784 static int i802_sta_disassoc(void *priv, const u8 *own_addr, const u8 *addr,
5785                              int reason)
5786 {
5787         struct i802_bss *bss = priv;
5788         struct wpa_driver_nl80211_data *drv = bss->drv;
5789         struct ieee80211_mgmt mgmt;
5790
5791         if (is_mesh_interface(drv->nlmode))
5792                 return -1;
5793
5794         if (drv->device_ap_sme)
5795                 return wpa_driver_nl80211_sta_remove(bss, addr, 0, reason);
5796
5797         memset(&mgmt, 0, sizeof(mgmt));
5798         mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
5799                                           WLAN_FC_STYPE_DISASSOC);
5800         memcpy(mgmt.da, addr, ETH_ALEN);
5801         memcpy(mgmt.sa, own_addr, ETH_ALEN);
5802         memcpy(mgmt.bssid, own_addr, ETH_ALEN);
5803         mgmt.u.disassoc.reason_code = host_to_le16(reason);
5804         return wpa_driver_nl80211_send_mlme(bss, (u8 *) &mgmt,
5805                                             IEEE80211_HDRLEN +
5806                                             sizeof(mgmt.u.disassoc), 0, 0, 0, 0,
5807                                             0, NULL, 0);
5808 }
5809
5810
5811 static void dump_ifidx(struct wpa_driver_nl80211_data *drv)
5812 {
5813         char buf[200], *pos, *end;
5814         int i, res;
5815
5816         pos = buf;
5817         end = pos + sizeof(buf);
5818
5819         for (i = 0; i < drv->num_if_indices; i++) {
5820                 if (!drv->if_indices[i])
5821                         continue;
5822                 res = os_snprintf(pos, end - pos, " %d(%d)",
5823                                   drv->if_indices[i],
5824                                   drv->if_indices_reason[i]);
5825                 if (os_snprintf_error(end - pos, res))
5826                         break;
5827                 pos += res;
5828         }
5829         *pos = '\0';
5830
5831         wpa_printf(MSG_DEBUG, "nl80211: if_indices[%d]:%s",
5832                    drv->num_if_indices, buf);
5833 }
5834
5835
5836 static void add_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx,
5837                       int ifidx_reason)
5838 {
5839         int i;
5840         int *old, *old_reason;
5841
5842         wpa_printf(MSG_DEBUG,
5843                    "nl80211: Add own interface ifindex %d (ifidx_reason %d)",
5844                    ifidx, ifidx_reason);
5845         if (have_ifidx(drv, ifidx, ifidx_reason)) {
5846                 wpa_printf(MSG_DEBUG, "nl80211: ifindex %d already in the list",
5847                            ifidx);
5848                 return;
5849         }
5850         for (i = 0; i < drv->num_if_indices; i++) {
5851                 if (drv->if_indices[i] == 0) {
5852                         drv->if_indices[i] = ifidx;
5853                         drv->if_indices_reason[i] = ifidx_reason;
5854                         dump_ifidx(drv);
5855                         return;
5856                 }
5857         }
5858
5859         if (drv->if_indices != drv->default_if_indices)
5860                 old = drv->if_indices;
5861         else
5862                 old = NULL;
5863
5864         if (drv->if_indices_reason != drv->default_if_indices_reason)
5865                 old_reason = drv->if_indices_reason;
5866         else
5867                 old_reason = NULL;
5868
5869         drv->if_indices = os_realloc_array(old, drv->num_if_indices + 1,
5870                                            sizeof(int));
5871         drv->if_indices_reason = os_realloc_array(old_reason,
5872                                                   drv->num_if_indices + 1,
5873                                                   sizeof(int));
5874         if (!drv->if_indices) {
5875                 if (!old)
5876                         drv->if_indices = drv->default_if_indices;
5877                 else
5878                         drv->if_indices = old;
5879         }
5880         if (!drv->if_indices_reason) {
5881                 if (!old_reason)
5882                         drv->if_indices_reason = drv->default_if_indices_reason;
5883                 else
5884                         drv->if_indices_reason = old_reason;
5885         }
5886         if (!drv->if_indices || !drv->if_indices_reason) {
5887                 wpa_printf(MSG_ERROR, "Failed to reallocate memory for "
5888                            "interfaces");
5889                 wpa_printf(MSG_ERROR, "Ignoring EAPOL on interface %d", ifidx);
5890                 return;
5891         }
5892         if (!old)
5893                 os_memcpy(drv->if_indices, drv->default_if_indices,
5894                           sizeof(drv->default_if_indices));
5895         if (!old_reason)
5896                 os_memcpy(drv->if_indices_reason,
5897                           drv->default_if_indices_reason,
5898                           sizeof(drv->default_if_indices_reason));
5899         drv->if_indices[drv->num_if_indices] = ifidx;
5900         drv->if_indices_reason[drv->num_if_indices] = ifidx_reason;
5901         drv->num_if_indices++;
5902         dump_ifidx(drv);
5903 }
5904
5905
5906 static void del_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx,
5907                       int ifidx_reason)
5908 {
5909         int i;
5910
5911         for (i = 0; i < drv->num_if_indices; i++) {
5912                 if ((drv->if_indices[i] == ifidx || ifidx == IFIDX_ANY) &&
5913                     (drv->if_indices_reason[i] == ifidx_reason ||
5914                      ifidx_reason == IFIDX_ANY)) {
5915                         drv->if_indices[i] = 0;
5916                         break;
5917                 }
5918         }
5919         dump_ifidx(drv);
5920 }
5921
5922
5923 static int have_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx,
5924                       int ifidx_reason)
5925 {
5926         int i;
5927
5928         for (i = 0; i < drv->num_if_indices; i++)
5929                 if (drv->if_indices[i] == ifidx &&
5930                     (drv->if_indices_reason[i] == ifidx_reason ||
5931                      ifidx_reason == IFIDX_ANY))
5932                         return 1;
5933
5934         return 0;
5935 }
5936
5937
5938 static int i802_set_wds_sta(void *priv, const u8 *addr, int aid, int val,
5939                             const char *bridge_ifname, char *ifname_wds)
5940 {
5941         struct i802_bss *bss = priv;
5942         struct wpa_driver_nl80211_data *drv = bss->drv;
5943         char name[IFNAMSIZ + 1];
5944
5945         os_snprintf(name, sizeof(name), "%s.sta%d", bss->ifname, aid);
5946         if (ifname_wds)
5947                 os_strlcpy(ifname_wds, name, IFNAMSIZ + 1);
5948
5949         wpa_printf(MSG_DEBUG, "nl80211: Set WDS STA addr=" MACSTR
5950                    " aid=%d val=%d name=%s", MAC2STR(addr), aid, val, name);
5951         if (val) {
5952                 if (!if_nametoindex(name)) {
5953                         if (nl80211_create_iface(drv, name,
5954                                                  NL80211_IFTYPE_AP_VLAN,
5955                                                  bss->addr, 1, NULL, NULL, 0) <
5956                             0)
5957                                 return -1;
5958                         if (bridge_ifname &&
5959                             linux_br_add_if(drv->global->ioctl_sock,
5960                                             bridge_ifname, name) < 0)
5961                                 return -1;
5962                 }
5963                 if (linux_set_iface_flags(drv->global->ioctl_sock, name, 1)) {
5964                         wpa_printf(MSG_ERROR, "nl80211: Failed to set WDS STA "
5965                                    "interface %s up", name);
5966                 }
5967                 return i802_set_sta_vlan(priv, addr, name, 0);
5968         } else {
5969                 if (bridge_ifname)
5970                         linux_br_del_if(drv->global->ioctl_sock, bridge_ifname,
5971                                         name);
5972
5973                 i802_set_sta_vlan(priv, addr, bss->ifname, 0);
5974                 nl80211_remove_iface(drv, if_nametoindex(name));
5975                 return 0;
5976         }
5977 }
5978
5979
5980 static void handle_eapol(int sock, void *eloop_ctx, void *sock_ctx)
5981 {
5982         struct wpa_driver_nl80211_data *drv = eloop_ctx;
5983         struct sockaddr_ll lladdr;
5984         unsigned char buf[3000];
5985         int len;
5986         socklen_t fromlen = sizeof(lladdr);
5987
5988         len = recvfrom(sock, buf, sizeof(buf), 0,
5989                        (struct sockaddr *)&lladdr, &fromlen);
5990         if (len < 0) {
5991                 wpa_printf(MSG_ERROR, "nl80211: EAPOL recv failed: %s",
5992                            strerror(errno));
5993                 return;
5994         }
5995
5996         if (have_ifidx(drv, lladdr.sll_ifindex, IFIDX_ANY))
5997                 drv_event_eapol_rx(drv->ctx, lladdr.sll_addr, buf, len);
5998 }
5999
6000
6001 static int i802_check_bridge(struct wpa_driver_nl80211_data *drv,
6002                              struct i802_bss *bss,
6003                              const char *brname, const char *ifname)
6004 {
6005         int br_ifindex;
6006         char in_br[IFNAMSIZ];
6007
6008         os_strlcpy(bss->brname, brname, IFNAMSIZ);
6009         br_ifindex = if_nametoindex(brname);
6010         if (br_ifindex == 0) {
6011                 /*
6012                  * Bridge was configured, but the bridge device does
6013                  * not exist. Try to add it now.
6014                  */
6015                 if (linux_br_add(drv->global->ioctl_sock, brname) < 0) {
6016                         wpa_printf(MSG_ERROR, "nl80211: Failed to add the "
6017                                    "bridge interface %s: %s",
6018                                    brname, strerror(errno));
6019                         return -1;
6020                 }
6021                 bss->added_bridge = 1;
6022                 br_ifindex = if_nametoindex(brname);
6023                 add_ifidx(drv, br_ifindex, drv->ifindex);
6024         }
6025         bss->br_ifindex = br_ifindex;
6026
6027         if (linux_br_get(in_br, ifname) == 0) {
6028                 if (os_strcmp(in_br, brname) == 0)
6029                         return 0; /* already in the bridge */
6030
6031                 wpa_printf(MSG_DEBUG, "nl80211: Removing interface %s from "
6032                            "bridge %s", ifname, in_br);
6033                 if (linux_br_del_if(drv->global->ioctl_sock, in_br, ifname) <
6034                     0) {
6035                         wpa_printf(MSG_ERROR, "nl80211: Failed to "
6036                                    "remove interface %s from bridge "
6037                                    "%s: %s",
6038                                    ifname, brname, strerror(errno));
6039                         return -1;
6040                 }
6041         }
6042
6043         wpa_printf(MSG_DEBUG, "nl80211: Adding interface %s into bridge %s",
6044                    ifname, brname);
6045         if (linux_br_add_if(drv->global->ioctl_sock, brname, ifname) < 0) {
6046                 wpa_printf(MSG_ERROR, "nl80211: Failed to add interface %s "
6047                            "into bridge %s: %s",
6048                            ifname, brname, strerror(errno));
6049                 return -1;
6050         }
6051         bss->added_if_into_bridge = 1;
6052
6053         return 0;
6054 }
6055
6056
6057 static void *i802_init(struct hostapd_data *hapd,
6058                        struct wpa_init_params *params)
6059 {
6060         struct wpa_driver_nl80211_data *drv;
6061         struct i802_bss *bss;
6062         size_t i;
6063         char master_ifname[IFNAMSIZ];
6064         int ifindex, br_ifindex = 0;
6065         int br_added = 0;
6066
6067         bss = wpa_driver_nl80211_drv_init(hapd, params->ifname,
6068                                           params->global_priv, 1,
6069                                           params->bssid, params->driver_params);
6070         if (bss == NULL)
6071                 return NULL;
6072
6073         drv = bss->drv;
6074
6075         if (linux_br_get(master_ifname, params->ifname) == 0) {
6076                 wpa_printf(MSG_DEBUG, "nl80211: Interface %s is in bridge %s",
6077                            params->ifname, master_ifname);
6078                 br_ifindex = if_nametoindex(master_ifname);
6079                 os_strlcpy(bss->brname, master_ifname, IFNAMSIZ);
6080         } else if ((params->num_bridge == 0 || !params->bridge[0]) &&
6081                    linux_master_get(master_ifname, params->ifname) == 0) {
6082                 wpa_printf(MSG_DEBUG, "nl80211: Interface %s is in master %s",
6083                         params->ifname, master_ifname);
6084                 /* start listening for EAPOL on the master interface */
6085                 add_ifidx(drv, if_nametoindex(master_ifname), drv->ifindex);
6086
6087                 /* check if master itself is under bridge */
6088                 if (linux_br_get(master_ifname, master_ifname) == 0) {
6089                         wpa_printf(MSG_DEBUG, "nl80211: which is in bridge %s",
6090                                    master_ifname);
6091                         br_ifindex = if_nametoindex(master_ifname);
6092                         os_strlcpy(bss->brname, master_ifname, IFNAMSIZ);
6093                 }
6094         } else {
6095                 master_ifname[0] = '\0';
6096         }
6097
6098         bss->br_ifindex = br_ifindex;
6099
6100         for (i = 0; i < params->num_bridge; i++) {
6101                 if (params->bridge[i]) {
6102                         ifindex = if_nametoindex(params->bridge[i]);
6103                         if (ifindex)
6104                                 add_ifidx(drv, ifindex, drv->ifindex);
6105                         if (ifindex == br_ifindex)
6106                                 br_added = 1;
6107                 }
6108         }
6109
6110         /* start listening for EAPOL on the default AP interface */
6111         add_ifidx(drv, drv->ifindex, IFIDX_ANY);
6112
6113         if (params->num_bridge && params->bridge[0]) {
6114                 if (i802_check_bridge(drv, bss, params->bridge[0],
6115                                       params->ifname) < 0)
6116                         goto failed;
6117                 if (os_strcmp(params->bridge[0], master_ifname) != 0)
6118                         br_added = 1;
6119         }
6120
6121         if (!br_added && br_ifindex &&
6122             (params->num_bridge == 0 || !params->bridge[0]))
6123                 add_ifidx(drv, br_ifindex, drv->ifindex);
6124
6125 #ifdef CONFIG_LIBNL3_ROUTE
6126         if (bss->added_if_into_bridge) {
6127                 drv->rtnl_sk = nl_socket_alloc();
6128                 if (drv->rtnl_sk == NULL) {
6129                         wpa_printf(MSG_ERROR, "nl80211: Failed to allocate nl_sock");
6130                         goto failed;
6131                 }
6132
6133                 if (nl_connect(drv->rtnl_sk, NETLINK_ROUTE)) {
6134                         wpa_printf(MSG_ERROR, "nl80211: Failed to connect nl_sock to NETLINK_ROUTE: %s",
6135                                    strerror(errno));
6136                         goto failed;
6137                 }
6138         }
6139 #endif /* CONFIG_LIBNL3_ROUTE */
6140
6141         drv->eapol_sock = socket(PF_PACKET, SOCK_DGRAM, htons(ETH_P_PAE));
6142         if (drv->eapol_sock < 0) {
6143                 wpa_printf(MSG_ERROR, "nl80211: socket(PF_PACKET, SOCK_DGRAM, ETH_P_PAE) failed: %s",
6144                            strerror(errno));
6145                 goto failed;
6146         }
6147
6148         if (eloop_register_read_sock(drv->eapol_sock, handle_eapol, drv, NULL))
6149         {
6150                 wpa_printf(MSG_INFO, "nl80211: Could not register read socket for eapol");
6151                 goto failed;
6152         }
6153
6154         if (linux_get_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
6155                                params->own_addr))
6156                 goto failed;
6157         os_memcpy(drv->perm_addr, params->own_addr, ETH_ALEN);
6158
6159         memcpy(bss->addr, params->own_addr, ETH_ALEN);
6160
6161         return bss;
6162
6163 failed:
6164         wpa_driver_nl80211_deinit(bss);
6165         return NULL;
6166 }
6167
6168
6169 static void i802_deinit(void *priv)
6170 {
6171         struct i802_bss *bss = priv;
6172         wpa_driver_nl80211_deinit(bss);
6173 }
6174
6175
6176 static enum nl80211_iftype wpa_driver_nl80211_if_type(
6177         enum wpa_driver_if_type type)
6178 {
6179         switch (type) {
6180         case WPA_IF_STATION:
6181                 return NL80211_IFTYPE_STATION;
6182         case WPA_IF_P2P_CLIENT:
6183         case WPA_IF_P2P_GROUP:
6184                 return NL80211_IFTYPE_P2P_CLIENT;
6185         case WPA_IF_AP_VLAN:
6186                 return NL80211_IFTYPE_AP_VLAN;
6187         case WPA_IF_AP_BSS:
6188                 return NL80211_IFTYPE_AP;
6189         case WPA_IF_P2P_GO:
6190                 return NL80211_IFTYPE_P2P_GO;
6191         case WPA_IF_P2P_DEVICE:
6192                 return NL80211_IFTYPE_P2P_DEVICE;
6193         case WPA_IF_MESH:
6194                 return NL80211_IFTYPE_MESH_POINT;
6195         default:
6196                 return -1;
6197         }
6198 }
6199
6200
6201 static int nl80211_addr_in_use(struct nl80211_global *global, const u8 *addr)
6202 {
6203         struct wpa_driver_nl80211_data *drv;
6204         dl_list_for_each(drv, &global->interfaces,
6205                          struct wpa_driver_nl80211_data, list) {
6206                 if (os_memcmp(addr, drv->first_bss->addr, ETH_ALEN) == 0)
6207                         return 1;
6208         }
6209         return 0;
6210 }
6211
6212
6213 static int nl80211_vif_addr(struct wpa_driver_nl80211_data *drv, u8 *new_addr)
6214 {
6215         unsigned int idx;
6216
6217         if (!drv->global)
6218                 return -1;
6219
6220         os_memcpy(new_addr, drv->first_bss->addr, ETH_ALEN);
6221         for (idx = 0; idx < 64; idx++) {
6222                 new_addr[0] = drv->first_bss->addr[0] | 0x02;
6223                 new_addr[0] ^= idx << 2;
6224                 if (!nl80211_addr_in_use(drv->global, new_addr))
6225                         break;
6226         }
6227         if (idx == 64)
6228                 return -1;
6229
6230         wpa_printf(MSG_DEBUG, "nl80211: Assigned new virtual interface address "
6231                    MACSTR, MAC2STR(new_addr));
6232
6233         return 0;
6234 }
6235
6236
6237 struct wdev_info {
6238         u64 wdev_id;
6239         int wdev_id_set;
6240         u8 macaddr[ETH_ALEN];
6241 };
6242
6243 static int nl80211_wdev_handler(struct nl_msg *msg, void *arg)
6244 {
6245         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
6246         struct nlattr *tb[NL80211_ATTR_MAX + 1];
6247         struct wdev_info *wi = arg;
6248
6249         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
6250                   genlmsg_attrlen(gnlh, 0), NULL);
6251         if (tb[NL80211_ATTR_WDEV]) {
6252                 wi->wdev_id = nla_get_u64(tb[NL80211_ATTR_WDEV]);
6253                 wi->wdev_id_set = 1;
6254         }
6255
6256         if (tb[NL80211_ATTR_MAC])
6257                 os_memcpy(wi->macaddr, nla_data(tb[NL80211_ATTR_MAC]),
6258                           ETH_ALEN);
6259
6260         return NL_SKIP;
6261 }
6262
6263
6264 static int wpa_driver_nl80211_if_add(void *priv, enum wpa_driver_if_type type,
6265                                      const char *ifname, const u8 *addr,
6266                                      void *bss_ctx, void **drv_priv,
6267                                      char *force_ifname, u8 *if_addr,
6268                                      const char *bridge, int use_existing,
6269                                      int setup_ap)
6270 {
6271         enum nl80211_iftype nlmode;
6272         struct i802_bss *bss = priv;
6273         struct wpa_driver_nl80211_data *drv = bss->drv;
6274         int ifidx;
6275         int added = 1;
6276
6277         if (addr)
6278                 os_memcpy(if_addr, addr, ETH_ALEN);
6279         nlmode = wpa_driver_nl80211_if_type(type);
6280         if (nlmode == NL80211_IFTYPE_P2P_DEVICE) {
6281                 struct wdev_info p2pdev_info;
6282
6283                 os_memset(&p2pdev_info, 0, sizeof(p2pdev_info));
6284                 ifidx = nl80211_create_iface(drv, ifname, nlmode, addr,
6285                                              0, nl80211_wdev_handler,
6286                                              &p2pdev_info, use_existing);
6287                 if (!p2pdev_info.wdev_id_set || ifidx != 0) {
6288                         wpa_printf(MSG_ERROR, "nl80211: Failed to create a P2P Device interface %s",
6289                                    ifname);
6290                         return -1;
6291                 }
6292
6293                 drv->global->if_add_wdevid = p2pdev_info.wdev_id;
6294                 drv->global->if_add_wdevid_set = p2pdev_info.wdev_id_set;
6295                 if (!is_zero_ether_addr(p2pdev_info.macaddr))
6296                         os_memcpy(if_addr, p2pdev_info.macaddr, ETH_ALEN);
6297                 wpa_printf(MSG_DEBUG, "nl80211: New P2P Device interface %s (0x%llx) created",
6298                            ifname,
6299                            (long long unsigned int) p2pdev_info.wdev_id);
6300         } else {
6301                 ifidx = nl80211_create_iface(drv, ifname, nlmode, addr,
6302                                              0, NULL, NULL, use_existing);
6303                 if (use_existing && ifidx == -ENFILE) {
6304                         added = 0;
6305                         ifidx = if_nametoindex(ifname);
6306                 } else if (ifidx < 0) {
6307                         return -1;
6308                 }
6309         }
6310
6311         if (!addr) {
6312                 if (nlmode == NL80211_IFTYPE_P2P_DEVICE)
6313                         os_memcpy(if_addr, bss->addr, ETH_ALEN);
6314                 else if (linux_get_ifhwaddr(drv->global->ioctl_sock,
6315                                             ifname, if_addr) < 0) {
6316                         if (added)
6317                                 nl80211_remove_iface(drv, ifidx);
6318                         return -1;
6319                 }
6320         }
6321
6322         if (!addr &&
6323             (type == WPA_IF_P2P_CLIENT || type == WPA_IF_P2P_GROUP ||
6324              type == WPA_IF_P2P_GO || type == WPA_IF_MESH ||
6325              type == WPA_IF_STATION)) {
6326                 /* Enforce unique address */
6327                 u8 new_addr[ETH_ALEN];
6328
6329                 if (linux_get_ifhwaddr(drv->global->ioctl_sock, ifname,
6330                                        new_addr) < 0) {
6331                         if (added)
6332                                 nl80211_remove_iface(drv, ifidx);
6333                         return -1;
6334                 }
6335                 if (nl80211_addr_in_use(drv->global, new_addr)) {
6336                         wpa_printf(MSG_DEBUG, "nl80211: Allocate new address "
6337                                    "for interface %s type %d", ifname, type);
6338                         if (nl80211_vif_addr(drv, new_addr) < 0) {
6339                                 if (added)
6340                                         nl80211_remove_iface(drv, ifidx);
6341                                 return -1;
6342                         }
6343                         if (linux_set_ifhwaddr(drv->global->ioctl_sock, ifname,
6344                                                new_addr) < 0) {
6345                                 if (added)
6346                                         nl80211_remove_iface(drv, ifidx);
6347                                 return -1;
6348                         }
6349                 }
6350                 os_memcpy(if_addr, new_addr, ETH_ALEN);
6351         }
6352
6353         if (type == WPA_IF_AP_BSS && setup_ap) {
6354                 struct i802_bss *new_bss = os_zalloc(sizeof(*new_bss));
6355                 if (new_bss == NULL) {
6356                         if (added)
6357                                 nl80211_remove_iface(drv, ifidx);
6358                         return -1;
6359                 }
6360
6361                 if (bridge &&
6362                     i802_check_bridge(drv, new_bss, bridge, ifname) < 0) {
6363                         wpa_printf(MSG_ERROR, "nl80211: Failed to add the new "
6364                                    "interface %s to a bridge %s",
6365                                    ifname, bridge);
6366                         if (added)
6367                                 nl80211_remove_iface(drv, ifidx);
6368                         os_free(new_bss);
6369                         return -1;
6370                 }
6371
6372                 if (linux_set_iface_flags(drv->global->ioctl_sock, ifname, 1))
6373                 {
6374                         if (added)
6375                                 nl80211_remove_iface(drv, ifidx);
6376                         os_free(new_bss);
6377                         return -1;
6378                 }
6379                 os_strlcpy(new_bss->ifname, ifname, IFNAMSIZ);
6380                 os_memcpy(new_bss->addr, if_addr, ETH_ALEN);
6381                 new_bss->ifindex = ifidx;
6382                 new_bss->drv = drv;
6383                 new_bss->next = drv->first_bss->next;
6384                 new_bss->freq = drv->first_bss->freq;
6385                 new_bss->ctx = bss_ctx;
6386                 new_bss->added_if = added;
6387                 drv->first_bss->next = new_bss;
6388                 if (drv_priv)
6389                         *drv_priv = new_bss;
6390                 nl80211_init_bss(new_bss);
6391
6392                 /* Subscribe management frames for this WPA_IF_AP_BSS */
6393                 if (nl80211_setup_ap(new_bss))
6394                         return -1;
6395         }
6396
6397         if (drv->global)
6398                 drv->global->if_add_ifindex = ifidx;
6399
6400         /*
6401          * Some virtual interfaces need to process EAPOL packets and events on
6402          * the parent interface. This is used mainly with hostapd.
6403          */
6404         if (ifidx > 0 &&
6405             (drv->hostapd ||
6406              nlmode == NL80211_IFTYPE_AP_VLAN ||
6407              nlmode == NL80211_IFTYPE_WDS ||
6408              nlmode == NL80211_IFTYPE_MONITOR))
6409                 add_ifidx(drv, ifidx, IFIDX_ANY);
6410
6411         return 0;
6412 }
6413
6414
6415 static int wpa_driver_nl80211_if_remove(struct i802_bss *bss,
6416                                         enum wpa_driver_if_type type,
6417                                         const char *ifname)
6418 {
6419         struct wpa_driver_nl80211_data *drv = bss->drv;
6420         int ifindex = if_nametoindex(ifname);
6421
6422         wpa_printf(MSG_DEBUG, "nl80211: %s(type=%d ifname=%s) ifindex=%d added_if=%d",
6423                    __func__, type, ifname, ifindex, bss->added_if);
6424         if (ifindex > 0 && (bss->added_if || bss->ifindex != ifindex))
6425                 nl80211_remove_iface(drv, ifindex);
6426         else if (ifindex > 0 && !bss->added_if) {
6427                 struct wpa_driver_nl80211_data *drv2;
6428                 dl_list_for_each(drv2, &drv->global->interfaces,
6429                                  struct wpa_driver_nl80211_data, list) {
6430                         del_ifidx(drv2, ifindex, IFIDX_ANY);
6431                         del_ifidx(drv2, IFIDX_ANY, ifindex);
6432                 }
6433         }
6434
6435         if (type != WPA_IF_AP_BSS)
6436                 return 0;
6437
6438         if (bss->added_if_into_bridge) {
6439                 if (linux_br_del_if(drv->global->ioctl_sock, bss->brname,
6440                                     bss->ifname) < 0)
6441                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
6442                                    "interface %s from bridge %s: %s",
6443                                    bss->ifname, bss->brname, strerror(errno));
6444         }
6445         if (bss->added_bridge) {
6446                 if (linux_br_del(drv->global->ioctl_sock, bss->brname) < 0)
6447                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
6448                                    "bridge %s: %s",
6449                                    bss->brname, strerror(errno));
6450         }
6451
6452         if (bss != drv->first_bss) {
6453                 struct i802_bss *tbss;
6454
6455                 wpa_printf(MSG_DEBUG, "nl80211: Not the first BSS - remove it");
6456                 for (tbss = drv->first_bss; tbss; tbss = tbss->next) {
6457                         if (tbss->next == bss) {
6458                                 tbss->next = bss->next;
6459                                 /* Unsubscribe management frames */
6460                                 nl80211_teardown_ap(bss);
6461                                 nl80211_destroy_bss(bss);
6462                                 if (!bss->added_if)
6463                                         i802_set_iface_flags(bss, 0);
6464                                 os_free(bss);
6465                                 bss = NULL;
6466                                 break;
6467                         }
6468                 }
6469                 if (bss)
6470                         wpa_printf(MSG_INFO, "nl80211: %s - could not find "
6471                                    "BSS %p in the list", __func__, bss);
6472         } else {
6473                 wpa_printf(MSG_DEBUG, "nl80211: First BSS - reassign context");
6474                 nl80211_teardown_ap(bss);
6475                 if (!bss->added_if && !drv->first_bss->next)
6476                         wpa_driver_nl80211_del_beacon(drv);
6477                 nl80211_destroy_bss(bss);
6478                 if (!bss->added_if)
6479                         i802_set_iface_flags(bss, 0);
6480                 if (drv->first_bss->next) {
6481                         drv->first_bss = drv->first_bss->next;
6482                         drv->ctx = drv->first_bss->ctx;
6483                         os_free(bss);
6484                 } else {
6485                         wpa_printf(MSG_DEBUG, "nl80211: No second BSS to reassign context to");
6486                 }
6487         }
6488
6489         return 0;
6490 }
6491
6492
6493 static int cookie_handler(struct nl_msg *msg, void *arg)
6494 {
6495         struct nlattr *tb[NL80211_ATTR_MAX + 1];
6496         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
6497         u64 *cookie = arg;
6498         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
6499                   genlmsg_attrlen(gnlh, 0), NULL);
6500         if (tb[NL80211_ATTR_COOKIE])
6501                 *cookie = nla_get_u64(tb[NL80211_ATTR_COOKIE]);
6502         return NL_SKIP;
6503 }
6504
6505
6506 static int nl80211_send_frame_cmd(struct i802_bss *bss,
6507                                   unsigned int freq, unsigned int wait,
6508                                   const u8 *buf, size_t buf_len,
6509                                   u64 *cookie_out, int no_cck, int no_ack,
6510                                   int offchanok, const u16 *csa_offs,
6511                                   size_t csa_offs_len)
6512 {
6513         struct wpa_driver_nl80211_data *drv = bss->drv;
6514         struct nl_msg *msg;
6515         u64 cookie;
6516         int ret = -1;
6517
6518         wpa_printf(MSG_MSGDUMP, "nl80211: CMD_FRAME freq=%u wait=%u no_cck=%d "
6519                    "no_ack=%d offchanok=%d",
6520                    freq, wait, no_cck, no_ack, offchanok);
6521         wpa_hexdump(MSG_MSGDUMP, "CMD_FRAME", buf, buf_len);
6522
6523         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_FRAME)) ||
6524             (freq && nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
6525             (wait && nla_put_u32(msg, NL80211_ATTR_DURATION, wait)) ||
6526             (offchanok && ((drv->capa.flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX) ||
6527                            drv->test_use_roc_tx) &&
6528              nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK)) ||
6529             (no_cck && nla_put_flag(msg, NL80211_ATTR_TX_NO_CCK_RATE)) ||
6530             (no_ack && nla_put_flag(msg, NL80211_ATTR_DONT_WAIT_FOR_ACK)) ||
6531             (csa_offs && nla_put(msg, NL80211_ATTR_CSA_C_OFFSETS_TX,
6532                                  csa_offs_len * sizeof(u16), csa_offs)) ||
6533             nla_put(msg, NL80211_ATTR_FRAME, buf_len, buf))
6534                 goto fail;
6535
6536         cookie = 0;
6537         ret = send_and_recv_msgs(drv, msg, cookie_handler, &cookie);
6538         msg = NULL;
6539         if (ret) {
6540                 wpa_printf(MSG_DEBUG, "nl80211: Frame command failed: ret=%d "
6541                            "(%s) (freq=%u wait=%u)", ret, strerror(-ret),
6542                            freq, wait);
6543         } else {
6544                 wpa_printf(MSG_MSGDUMP, "nl80211: Frame TX command accepted%s; "
6545                            "cookie 0x%llx", no_ack ? " (no ACK)" : "",
6546                            (long long unsigned int) cookie);
6547
6548                 if (cookie_out)
6549                         *cookie_out = no_ack ? (u64) -1 : cookie;
6550
6551                 if (drv->num_send_action_cookies == MAX_SEND_ACTION_COOKIES) {
6552                         wpa_printf(MSG_DEBUG,
6553                                    "nl80211: Drop oldest pending send action cookie 0x%llx",
6554                                    (long long unsigned int)
6555                                    drv->send_action_cookies[0]);
6556                         os_memmove(&drv->send_action_cookies[0],
6557                                    &drv->send_action_cookies[1],
6558                                    (MAX_SEND_ACTION_COOKIES - 1) *
6559                                    sizeof(u64));
6560                         drv->num_send_action_cookies--;
6561                 }
6562                 drv->send_action_cookies[drv->num_send_action_cookies] = cookie;
6563                 drv->num_send_action_cookies++;
6564         }
6565
6566 fail:
6567         nlmsg_free(msg);
6568         return ret;
6569 }
6570
6571
6572 static int wpa_driver_nl80211_send_action(struct i802_bss *bss,
6573                                           unsigned int freq,
6574                                           unsigned int wait_time,
6575                                           const u8 *dst, const u8 *src,
6576                                           const u8 *bssid,
6577                                           const u8 *data, size_t data_len,
6578                                           int no_cck)
6579 {
6580         struct wpa_driver_nl80211_data *drv = bss->drv;
6581         int ret = -1;
6582         u8 *buf;
6583         struct ieee80211_hdr *hdr;
6584
6585         wpa_printf(MSG_DEBUG, "nl80211: Send Action frame (ifindex=%d, "
6586                    "freq=%u MHz wait=%d ms no_cck=%d)",
6587                    drv->ifindex, freq, wait_time, no_cck);
6588
6589         buf = os_zalloc(24 + data_len);
6590         if (buf == NULL)
6591                 return ret;
6592         os_memcpy(buf + 24, data, data_len);
6593         hdr = (struct ieee80211_hdr *) buf;
6594         hdr->frame_control =
6595                 IEEE80211_FC(WLAN_FC_TYPE_MGMT, WLAN_FC_STYPE_ACTION);
6596         os_memcpy(hdr->addr1, dst, ETH_ALEN);
6597         os_memcpy(hdr->addr2, src, ETH_ALEN);
6598         os_memcpy(hdr->addr3, bssid, ETH_ALEN);
6599
6600         if (is_ap_interface(drv->nlmode) &&
6601             (!(drv->capa.flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX) ||
6602              (int) freq == bss->freq || drv->device_ap_sme ||
6603              !drv->use_monitor))
6604                 ret = wpa_driver_nl80211_send_mlme(bss, buf, 24 + data_len,
6605                                                    0, freq, no_cck, 1,
6606                                                    wait_time, NULL, 0);
6607         else
6608                 ret = nl80211_send_frame_cmd(bss, freq, wait_time, buf,
6609                                              24 + data_len,
6610                                              &drv->send_action_cookie,
6611                                              no_cck, 0, 1, NULL, 0);
6612
6613         os_free(buf);
6614         return ret;
6615 }
6616
6617
6618 static void nl80211_frame_wait_cancel(struct i802_bss *bss, u64 cookie)
6619 {
6620         struct wpa_driver_nl80211_data *drv = bss->drv;
6621         struct nl_msg *msg;
6622         int ret;
6623
6624         wpa_printf(MSG_DEBUG, "nl80211: Cancel TX frame wait: cookie=0x%llx",
6625                    (long long unsigned int) cookie);
6626         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_FRAME_WAIT_CANCEL)) ||
6627             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie)) {
6628                 nlmsg_free(msg);
6629                 return;
6630         }
6631
6632         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
6633         if (ret)
6634                 wpa_printf(MSG_DEBUG, "nl80211: wait cancel failed: ret=%d "
6635                            "(%s)", ret, strerror(-ret));
6636 }
6637
6638
6639 static void wpa_driver_nl80211_send_action_cancel_wait(void *priv)
6640 {
6641         struct i802_bss *bss = priv;
6642         struct wpa_driver_nl80211_data *drv = bss->drv;
6643         unsigned int i;
6644         u64 cookie;
6645
6646         /* Cancel the last pending TX cookie */
6647         nl80211_frame_wait_cancel(bss, drv->send_action_cookie);
6648
6649         /*
6650          * Cancel the other pending TX cookies, if any. This is needed since
6651          * the driver may keep a list of all pending offchannel TX operations
6652          * and free up the radio only once they have expired or cancelled.
6653          */
6654         for (i = drv->num_send_action_cookies; i > 0; i--) {
6655                 cookie = drv->send_action_cookies[i - 1];
6656                 if (cookie != drv->send_action_cookie)
6657                         nl80211_frame_wait_cancel(bss, cookie);
6658         }
6659         drv->num_send_action_cookies = 0;
6660 }
6661
6662
6663 static int wpa_driver_nl80211_remain_on_channel(void *priv, unsigned int freq,
6664                                                 unsigned int duration)
6665 {
6666         struct i802_bss *bss = priv;
6667         struct wpa_driver_nl80211_data *drv = bss->drv;
6668         struct nl_msg *msg;
6669         int ret;
6670         u64 cookie;
6671
6672         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_REMAIN_ON_CHANNEL)) ||
6673             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
6674             nla_put_u32(msg, NL80211_ATTR_DURATION, duration)) {
6675                 nlmsg_free(msg);
6676                 return -1;
6677         }
6678
6679         cookie = 0;
6680         ret = send_and_recv_msgs(drv, msg, cookie_handler, &cookie);
6681         if (ret == 0) {
6682                 wpa_printf(MSG_DEBUG, "nl80211: Remain-on-channel cookie "
6683                            "0x%llx for freq=%u MHz duration=%u",
6684                            (long long unsigned int) cookie, freq, duration);
6685                 drv->remain_on_chan_cookie = cookie;
6686                 drv->pending_remain_on_chan = 1;
6687                 return 0;
6688         }
6689         wpa_printf(MSG_DEBUG, "nl80211: Failed to request remain-on-channel "
6690                    "(freq=%d duration=%u): %d (%s)",
6691                    freq, duration, ret, strerror(-ret));
6692         return -1;
6693 }
6694
6695
6696 static int wpa_driver_nl80211_cancel_remain_on_channel(void *priv)
6697 {
6698         struct i802_bss *bss = priv;
6699         struct wpa_driver_nl80211_data *drv = bss->drv;
6700         struct nl_msg *msg;
6701         int ret;
6702
6703         if (!drv->pending_remain_on_chan) {
6704                 wpa_printf(MSG_DEBUG, "nl80211: No pending remain-on-channel "
6705                            "to cancel");
6706                 return -1;
6707         }
6708
6709         wpa_printf(MSG_DEBUG, "nl80211: Cancel remain-on-channel with cookie "
6710                    "0x%llx",
6711                    (long long unsigned int) drv->remain_on_chan_cookie);
6712
6713         msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL);
6714         if (!msg ||
6715             nla_put_u64(msg, NL80211_ATTR_COOKIE, drv->remain_on_chan_cookie)) {
6716                 nlmsg_free(msg);
6717                 return -1;
6718         }
6719
6720         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
6721         if (ret == 0)
6722                 return 0;
6723         wpa_printf(MSG_DEBUG, "nl80211: Failed to cancel remain-on-channel: "
6724                    "%d (%s)", ret, strerror(-ret));
6725         return -1;
6726 }
6727
6728
6729 static int wpa_driver_nl80211_probe_req_report(struct i802_bss *bss, int report)
6730 {
6731         struct wpa_driver_nl80211_data *drv = bss->drv;
6732
6733         if (!report) {
6734                 if (bss->nl_preq && drv->device_ap_sme &&
6735                     is_ap_interface(drv->nlmode) && !bss->in_deinit &&
6736                     !bss->static_ap) {
6737                         /*
6738                          * Do not disable Probe Request reporting that was
6739                          * enabled in nl80211_setup_ap().
6740                          */
6741                         wpa_printf(MSG_DEBUG, "nl80211: Skip disabling of "
6742                                    "Probe Request reporting nl_preq=%p while "
6743                                    "in AP mode", bss->nl_preq);
6744                 } else if (bss->nl_preq) {
6745                         wpa_printf(MSG_DEBUG, "nl80211: Disable Probe Request "
6746                                    "reporting nl_preq=%p", bss->nl_preq);
6747                         nl80211_destroy_eloop_handle(&bss->nl_preq);
6748                 }
6749                 return 0;
6750         }
6751
6752         if (bss->nl_preq) {
6753                 wpa_printf(MSG_DEBUG, "nl80211: Probe Request reporting "
6754                            "already on! nl_preq=%p", bss->nl_preq);
6755                 return 0;
6756         }
6757
6758         bss->nl_preq = nl_create_handle(drv->global->nl_cb, "preq");
6759         if (bss->nl_preq == NULL)
6760                 return -1;
6761         wpa_printf(MSG_DEBUG, "nl80211: Enable Probe Request "
6762                    "reporting nl_preq=%p", bss->nl_preq);
6763
6764         if (nl80211_register_frame(bss, bss->nl_preq,
6765                                    (WLAN_FC_TYPE_MGMT << 2) |
6766                                    (WLAN_FC_STYPE_PROBE_REQ << 4),
6767                                    NULL, 0) < 0)
6768                 goto out_err;
6769
6770         nl80211_register_eloop_read(&bss->nl_preq,
6771                                     wpa_driver_nl80211_event_receive,
6772                                     bss->nl_cb);
6773
6774         return 0;
6775
6776  out_err:
6777         nl_destroy_handles(&bss->nl_preq);
6778         return -1;
6779 }
6780
6781
6782 static int nl80211_disable_11b_rates(struct wpa_driver_nl80211_data *drv,
6783                                      int ifindex, int disabled)
6784 {
6785         struct nl_msg *msg;
6786         struct nlattr *bands, *band;
6787         int ret;
6788
6789         wpa_printf(MSG_DEBUG,
6790                    "nl80211: NL80211_CMD_SET_TX_BITRATE_MASK (ifindex=%d %s)",
6791                    ifindex, disabled ? "NL80211_TXRATE_LEGACY=OFDM-only" :
6792                    "no NL80211_TXRATE_LEGACY constraint");
6793
6794         msg = nl80211_ifindex_msg(drv, ifindex, 0,
6795                                   NL80211_CMD_SET_TX_BITRATE_MASK);
6796         if (!msg)
6797                 return -1;
6798
6799         bands = nla_nest_start(msg, NL80211_ATTR_TX_RATES);
6800         if (!bands)
6801                 goto fail;
6802
6803         /*
6804          * Disable 2 GHz rates 1, 2, 5.5, 11 Mbps by masking out everything
6805          * else apart from 6, 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS
6806          * rates. All 5 GHz rates are left enabled.
6807          */
6808         band = nla_nest_start(msg, NL80211_BAND_2GHZ);
6809         if (!band ||
6810             (disabled && nla_put(msg, NL80211_TXRATE_LEGACY, 8,
6811                                  "\x0c\x12\x18\x24\x30\x48\x60\x6c")))
6812                 goto fail;
6813         nla_nest_end(msg, band);
6814
6815         nla_nest_end(msg, bands);
6816
6817         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
6818         if (ret) {
6819                 wpa_printf(MSG_DEBUG, "nl80211: Set TX rates failed: ret=%d "
6820                            "(%s)", ret, strerror(-ret));
6821         } else
6822                 drv->disabled_11b_rates = disabled;
6823
6824         return ret;
6825
6826 fail:
6827         nlmsg_free(msg);
6828         return -1;
6829 }
6830
6831
6832 static int wpa_driver_nl80211_deinit_ap(void *priv)
6833 {
6834         struct i802_bss *bss = priv;
6835         struct wpa_driver_nl80211_data *drv = bss->drv;
6836         if (!is_ap_interface(drv->nlmode))
6837                 return -1;
6838         wpa_driver_nl80211_del_beacon(drv);
6839         bss->beacon_set = 0;
6840
6841         /*
6842          * If the P2P GO interface was dynamically added, then it is
6843          * possible that the interface change to station is not possible.
6844          */
6845         if (drv->nlmode == NL80211_IFTYPE_P2P_GO && bss->if_dynamic)
6846                 return 0;
6847
6848         return wpa_driver_nl80211_set_mode(priv, NL80211_IFTYPE_STATION);
6849 }
6850
6851
6852 static int wpa_driver_nl80211_stop_ap(void *priv)
6853 {
6854         struct i802_bss *bss = priv;
6855         struct wpa_driver_nl80211_data *drv = bss->drv;
6856         if (!is_ap_interface(drv->nlmode))
6857                 return -1;
6858         wpa_driver_nl80211_del_beacon(drv);
6859         bss->beacon_set = 0;
6860         return 0;
6861 }
6862
6863
6864 static int wpa_driver_nl80211_deinit_p2p_cli(void *priv)
6865 {
6866         struct i802_bss *bss = priv;
6867         struct wpa_driver_nl80211_data *drv = bss->drv;
6868         if (drv->nlmode != NL80211_IFTYPE_P2P_CLIENT)
6869                 return -1;
6870
6871         /*
6872          * If the P2P Client interface was dynamically added, then it is
6873          * possible that the interface change to station is not possible.
6874          */
6875         if (bss->if_dynamic)
6876                 return 0;
6877
6878         return wpa_driver_nl80211_set_mode(priv, NL80211_IFTYPE_STATION);
6879 }
6880
6881
6882 static void wpa_driver_nl80211_resume(void *priv)
6883 {
6884         struct i802_bss *bss = priv;
6885         enum nl80211_iftype nlmode = nl80211_get_ifmode(bss);
6886
6887         if (i802_set_iface_flags(bss, 1))
6888                 wpa_printf(MSG_DEBUG, "nl80211: Failed to set interface up on resume event");
6889
6890         if (is_p2p_net_interface(nlmode))
6891                 nl80211_disable_11b_rates(bss->drv, bss->drv->ifindex, 1);
6892 }
6893
6894
6895 static int nl80211_signal_monitor(void *priv, int threshold, int hysteresis)
6896 {
6897         struct i802_bss *bss = priv;
6898         struct wpa_driver_nl80211_data *drv = bss->drv;
6899         struct nl_msg *msg;
6900         struct nlattr *cqm;
6901
6902         wpa_printf(MSG_DEBUG, "nl80211: Signal monitor threshold=%d "
6903                    "hysteresis=%d", threshold, hysteresis);
6904
6905         if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_SET_CQM)) ||
6906             !(cqm = nla_nest_start(msg, NL80211_ATTR_CQM)) ||
6907             nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THOLD, threshold) ||
6908             nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_HYST, hysteresis)) {
6909                 nlmsg_free(msg);
6910                 return -1;
6911         }
6912         nla_nest_end(msg, cqm);
6913
6914         return send_and_recv_msgs(drv, msg, NULL, NULL);
6915 }
6916
6917
6918 static int get_channel_width(struct nl_msg *msg, void *arg)
6919 {
6920         struct nlattr *tb[NL80211_ATTR_MAX + 1];
6921         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
6922         struct wpa_signal_info *sig_change = arg;
6923
6924         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
6925                   genlmsg_attrlen(gnlh, 0), NULL);
6926
6927         sig_change->center_frq1 = -1;
6928         sig_change->center_frq2 = -1;
6929         sig_change->chanwidth = CHAN_WIDTH_UNKNOWN;
6930
6931         if (tb[NL80211_ATTR_CHANNEL_WIDTH]) {
6932                 sig_change->chanwidth = convert2width(
6933                         nla_get_u32(tb[NL80211_ATTR_CHANNEL_WIDTH]));
6934                 if (tb[NL80211_ATTR_CENTER_FREQ1])
6935                         sig_change->center_frq1 =
6936                                 nla_get_u32(tb[NL80211_ATTR_CENTER_FREQ1]);
6937                 if (tb[NL80211_ATTR_CENTER_FREQ2])
6938                         sig_change->center_frq2 =
6939                                 nla_get_u32(tb[NL80211_ATTR_CENTER_FREQ2]);
6940         }
6941
6942         return NL_SKIP;
6943 }
6944
6945
6946 static int nl80211_get_channel_width(struct wpa_driver_nl80211_data *drv,
6947                                      struct wpa_signal_info *sig)
6948 {
6949         struct nl_msg *msg;
6950
6951         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_GET_INTERFACE);
6952         return send_and_recv_msgs(drv, msg, get_channel_width, sig);
6953 }
6954
6955
6956 static int nl80211_signal_poll(void *priv, struct wpa_signal_info *si)
6957 {
6958         struct i802_bss *bss = priv;
6959         struct wpa_driver_nl80211_data *drv = bss->drv;
6960         int res;
6961
6962         os_memset(si, 0, sizeof(*si));
6963         res = nl80211_get_link_signal(drv, si);
6964         if (res) {
6965                 if (drv->nlmode != NL80211_IFTYPE_ADHOC &&
6966                     drv->nlmode != NL80211_IFTYPE_MESH_POINT)
6967                         return res;
6968                 si->current_signal = 0;
6969         }
6970
6971         res = nl80211_get_channel_width(drv, si);
6972         if (res != 0)
6973                 return res;
6974
6975         return nl80211_get_link_noise(drv, si);
6976 }
6977
6978
6979 static int nl80211_send_frame(void *priv, const u8 *data, size_t data_len,
6980                               int encrypt)
6981 {
6982         struct i802_bss *bss = priv;
6983         return wpa_driver_nl80211_send_frame(bss, data, data_len, encrypt, 0,
6984                                              0, 0, 0, 0, NULL, 0);
6985 }
6986
6987
6988 static int nl80211_set_param(void *priv, const char *param)
6989 {
6990         if (param == NULL)
6991                 return 0;
6992         wpa_printf(MSG_DEBUG, "nl80211: driver param='%s'", param);
6993
6994 #ifdef CONFIG_P2P
6995         if (os_strstr(param, "use_p2p_group_interface=1")) {
6996                 struct i802_bss *bss = priv;
6997                 struct wpa_driver_nl80211_data *drv = bss->drv;
6998
6999                 wpa_printf(MSG_DEBUG, "nl80211: Use separate P2P group "
7000                            "interface");
7001                 drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_CONCURRENT;
7002                 drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_MGMT_AND_NON_P2P;
7003         }
7004 #endif /* CONFIG_P2P */
7005
7006         if (os_strstr(param, "use_monitor=1")) {
7007                 struct i802_bss *bss = priv;
7008                 struct wpa_driver_nl80211_data *drv = bss->drv;
7009                 drv->use_monitor = 1;
7010         }
7011
7012         if (os_strstr(param, "force_connect_cmd=1")) {
7013                 struct i802_bss *bss = priv;
7014                 struct wpa_driver_nl80211_data *drv = bss->drv;
7015                 drv->capa.flags &= ~WPA_DRIVER_FLAGS_SME;
7016                 drv->force_connect_cmd = 1;
7017         }
7018
7019         if (os_strstr(param, "no_offchannel_tx=1")) {
7020                 struct i802_bss *bss = priv;
7021                 struct wpa_driver_nl80211_data *drv = bss->drv;
7022                 drv->capa.flags &= ~WPA_DRIVER_FLAGS_OFFCHANNEL_TX;
7023                 drv->test_use_roc_tx = 1;
7024         }
7025
7026         return 0;
7027 }
7028
7029
7030 static void * nl80211_global_init(void *ctx)
7031 {
7032         struct nl80211_global *global;
7033         struct netlink_config *cfg;
7034
7035         global = os_zalloc(sizeof(*global));
7036         if (global == NULL)
7037                 return NULL;
7038         global->ctx = ctx;
7039         global->ioctl_sock = -1;
7040         dl_list_init(&global->interfaces);
7041         global->if_add_ifindex = -1;
7042
7043         cfg = os_zalloc(sizeof(*cfg));
7044         if (cfg == NULL)
7045                 goto err;
7046
7047         cfg->ctx = global;
7048         cfg->newlink_cb = wpa_driver_nl80211_event_rtm_newlink;
7049         cfg->dellink_cb = wpa_driver_nl80211_event_rtm_dellink;
7050         global->netlink = netlink_init(cfg);
7051         if (global->netlink == NULL) {
7052                 os_free(cfg);
7053                 goto err;
7054         }
7055
7056         if (wpa_driver_nl80211_init_nl_global(global) < 0)
7057                 goto err;
7058
7059         global->ioctl_sock = socket(PF_INET, SOCK_DGRAM, 0);
7060         if (global->ioctl_sock < 0) {
7061                 wpa_printf(MSG_ERROR, "nl80211: socket(PF_INET,SOCK_DGRAM) failed: %s",
7062                            strerror(errno));
7063                 goto err;
7064         }
7065
7066         return global;
7067
7068 err:
7069         nl80211_global_deinit(global);
7070         return NULL;
7071 }
7072
7073
7074 static void nl80211_global_deinit(void *priv)
7075 {
7076         struct nl80211_global *global = priv;
7077         if (global == NULL)
7078                 return;
7079         if (!dl_list_empty(&global->interfaces)) {
7080                 wpa_printf(MSG_ERROR, "nl80211: %u interface(s) remain at "
7081                            "nl80211_global_deinit",
7082                            dl_list_len(&global->interfaces));
7083         }
7084
7085         if (global->netlink)
7086                 netlink_deinit(global->netlink);
7087
7088         nl_destroy_handles(&global->nl);
7089
7090         if (global->nl_event)
7091                 nl80211_destroy_eloop_handle(&global->nl_event);
7092
7093         nl_cb_put(global->nl_cb);
7094
7095         if (global->ioctl_sock >= 0)
7096                 close(global->ioctl_sock);
7097
7098         os_free(global);
7099 }
7100
7101
7102 static const char * nl80211_get_radio_name(void *priv)
7103 {
7104         struct i802_bss *bss = priv;
7105         struct wpa_driver_nl80211_data *drv = bss->drv;
7106         return drv->phyname;
7107 }
7108
7109
7110 static int nl80211_pmkid(struct i802_bss *bss, int cmd, const u8 *bssid,
7111                          const u8 *pmkid)
7112 {
7113         struct nl_msg *msg;
7114
7115         if (!(msg = nl80211_bss_msg(bss, 0, cmd)) ||
7116             (pmkid && nla_put(msg, NL80211_ATTR_PMKID, 16, pmkid)) ||
7117             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))) {
7118                 nlmsg_free(msg);
7119                 return -ENOBUFS;
7120         }
7121
7122         return send_and_recv_msgs(bss->drv, msg, NULL, NULL);
7123 }
7124
7125
7126 static int nl80211_add_pmkid(void *priv, const u8 *bssid, const u8 *pmkid)
7127 {
7128         struct i802_bss *bss = priv;
7129         wpa_printf(MSG_DEBUG, "nl80211: Add PMKID for " MACSTR, MAC2STR(bssid));
7130         return nl80211_pmkid(bss, NL80211_CMD_SET_PMKSA, bssid, pmkid);
7131 }
7132
7133
7134 static int nl80211_remove_pmkid(void *priv, const u8 *bssid, const u8 *pmkid)
7135 {
7136         struct i802_bss *bss = priv;
7137         wpa_printf(MSG_DEBUG, "nl80211: Delete PMKID for " MACSTR,
7138                    MAC2STR(bssid));
7139         return nl80211_pmkid(bss, NL80211_CMD_DEL_PMKSA, bssid, pmkid);
7140 }
7141
7142
7143 static int nl80211_flush_pmkid(void *priv)
7144 {
7145         struct i802_bss *bss = priv;
7146         wpa_printf(MSG_DEBUG, "nl80211: Flush PMKIDs");
7147         return nl80211_pmkid(bss, NL80211_CMD_FLUSH_PMKSA, NULL, NULL);
7148 }
7149
7150
7151 static void clean_survey_results(struct survey_results *survey_results)
7152 {
7153         struct freq_survey *survey, *tmp;
7154
7155         if (dl_list_empty(&survey_results->survey_list))
7156                 return;
7157
7158         dl_list_for_each_safe(survey, tmp, &survey_results->survey_list,
7159                               struct freq_survey, list) {
7160                 dl_list_del(&survey->list);
7161                 os_free(survey);
7162         }
7163 }
7164
7165
7166 static void add_survey(struct nlattr **sinfo, u32 ifidx,
7167                        struct dl_list *survey_list)
7168 {
7169         struct freq_survey *survey;
7170
7171         survey = os_zalloc(sizeof(struct freq_survey));
7172         if  (!survey)
7173                 return;
7174
7175         survey->ifidx = ifidx;
7176         survey->freq = nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]);
7177         survey->filled = 0;
7178
7179         if (sinfo[NL80211_SURVEY_INFO_NOISE]) {
7180                 survey->nf = (int8_t)
7181                         nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
7182                 survey->filled |= SURVEY_HAS_NF;
7183         }
7184
7185         if (sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME]) {
7186                 survey->channel_time =
7187                         nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME]);
7188                 survey->filled |= SURVEY_HAS_CHAN_TIME;
7189         }
7190
7191         if (sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY]) {
7192                 survey->channel_time_busy =
7193                         nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY]);
7194                 survey->filled |= SURVEY_HAS_CHAN_TIME_BUSY;
7195         }
7196
7197         if (sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_RX]) {
7198                 survey->channel_time_rx =
7199                         nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_RX]);
7200                 survey->filled |= SURVEY_HAS_CHAN_TIME_RX;
7201         }
7202
7203         if (sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_TX]) {
7204                 survey->channel_time_tx =
7205                         nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_TX]);
7206                 survey->filled |= SURVEY_HAS_CHAN_TIME_TX;
7207         }
7208
7209         wpa_printf(MSG_DEBUG, "nl80211: Freq survey dump event (freq=%d MHz noise=%d channel_time=%ld busy_time=%ld tx_time=%ld rx_time=%ld filled=%04x)",
7210                    survey->freq,
7211                    survey->nf,
7212                    (unsigned long int) survey->channel_time,
7213                    (unsigned long int) survey->channel_time_busy,
7214                    (unsigned long int) survey->channel_time_tx,
7215                    (unsigned long int) survey->channel_time_rx,
7216                    survey->filled);
7217
7218         dl_list_add_tail(survey_list, &survey->list);
7219 }
7220
7221
7222 static int check_survey_ok(struct nlattr **sinfo, u32 surveyed_freq,
7223                            unsigned int freq_filter)
7224 {
7225         if (!freq_filter)
7226                 return 1;
7227
7228         return freq_filter == surveyed_freq;
7229 }
7230
7231
7232 static int survey_handler(struct nl_msg *msg, void *arg)
7233 {
7234         struct nlattr *tb[NL80211_ATTR_MAX + 1];
7235         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
7236         struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
7237         struct survey_results *survey_results;
7238         u32 surveyed_freq = 0;
7239         u32 ifidx;
7240
7241         static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
7242                 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
7243                 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
7244         };
7245
7246         survey_results = (struct survey_results *) arg;
7247
7248         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
7249                   genlmsg_attrlen(gnlh, 0), NULL);
7250
7251         if (!tb[NL80211_ATTR_IFINDEX])
7252                 return NL_SKIP;
7253
7254         ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
7255
7256         if (!tb[NL80211_ATTR_SURVEY_INFO])
7257                 return NL_SKIP;
7258
7259         if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
7260                              tb[NL80211_ATTR_SURVEY_INFO],
7261                              survey_policy))
7262                 return NL_SKIP;
7263
7264         if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY]) {
7265                 wpa_printf(MSG_ERROR, "nl80211: Invalid survey data");
7266                 return NL_SKIP;
7267         }
7268
7269         surveyed_freq = nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]);
7270
7271         if (!check_survey_ok(sinfo, surveyed_freq,
7272                              survey_results->freq_filter))
7273                 return NL_SKIP;
7274
7275         if (survey_results->freq_filter &&
7276             survey_results->freq_filter != surveyed_freq) {
7277                 wpa_printf(MSG_EXCESSIVE, "nl80211: Ignoring survey data for freq %d MHz",
7278                            surveyed_freq);
7279                 return NL_SKIP;
7280         }
7281
7282         add_survey(sinfo, ifidx, &survey_results->survey_list);
7283
7284         return NL_SKIP;
7285 }
7286
7287
7288 static int wpa_driver_nl80211_get_survey(void *priv, unsigned int freq)
7289 {
7290         struct i802_bss *bss = priv;
7291         struct wpa_driver_nl80211_data *drv = bss->drv;
7292         struct nl_msg *msg;
7293         int err;
7294         union wpa_event_data data;
7295         struct survey_results *survey_results;
7296
7297         os_memset(&data, 0, sizeof(data));
7298         survey_results = &data.survey_results;
7299
7300         dl_list_init(&survey_results->survey_list);
7301
7302         msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_GET_SURVEY);
7303         if (!msg)
7304                 return -ENOBUFS;
7305
7306         if (freq)
7307                 data.survey_results.freq_filter = freq;
7308
7309         do {
7310                 wpa_printf(MSG_DEBUG, "nl80211: Fetch survey data");
7311                 err = send_and_recv_msgs(drv, msg, survey_handler,
7312                                          survey_results);
7313         } while (err > 0);
7314
7315         if (err)
7316                 wpa_printf(MSG_ERROR, "nl80211: Failed to process survey data");
7317         else
7318                 wpa_supplicant_event(drv->ctx, EVENT_SURVEY, &data);
7319
7320         clean_survey_results(survey_results);
7321         return err;
7322 }
7323
7324
7325 static void nl80211_set_rekey_info(void *priv, const u8 *kek, size_t kek_len,
7326                                    const u8 *kck, size_t kck_len,
7327                                    const u8 *replay_ctr)
7328 {
7329         struct i802_bss *bss = priv;
7330         struct wpa_driver_nl80211_data *drv = bss->drv;
7331         struct nlattr *replay_nested;
7332         struct nl_msg *msg;
7333         int ret;
7334
7335         if (!drv->set_rekey_offload)
7336                 return;
7337
7338         wpa_printf(MSG_DEBUG, "nl80211: Set rekey offload");
7339         if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_SET_REKEY_OFFLOAD)) ||
7340             !(replay_nested = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA)) ||
7341             nla_put(msg, NL80211_REKEY_DATA_KEK, kek_len, kek) ||
7342             nla_put(msg, NL80211_REKEY_DATA_KCK, kck_len, kck) ||
7343             nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR, NL80211_REPLAY_CTR_LEN,
7344                     replay_ctr)) {
7345                 nl80211_nlmsg_clear(msg);
7346                 nlmsg_free(msg);
7347                 return;
7348         }
7349
7350         nla_nest_end(msg, replay_nested);
7351
7352         ret = send_and_recv_msgs(drv, msg, NULL, (void *) -1);
7353         if (ret == -EOPNOTSUPP) {
7354                 wpa_printf(MSG_DEBUG,
7355                            "nl80211: Driver does not support rekey offload");
7356                 drv->set_rekey_offload = 0;
7357         }
7358 }
7359
7360
7361 static void nl80211_send_null_frame(struct i802_bss *bss, const u8 *own_addr,
7362                                     const u8 *addr, int qos)
7363 {
7364         /* send data frame to poll STA and check whether
7365          * this frame is ACKed */
7366         struct {
7367                 struct ieee80211_hdr hdr;
7368                 u16 qos_ctl;
7369         } STRUCT_PACKED nulldata;
7370         size_t size;
7371
7372         /* Send data frame to poll STA and check whether this frame is ACKed */
7373
7374         os_memset(&nulldata, 0, sizeof(nulldata));
7375
7376         if (qos) {
7377                 nulldata.hdr.frame_control =
7378                         IEEE80211_FC(WLAN_FC_TYPE_DATA,
7379                                      WLAN_FC_STYPE_QOS_NULL);
7380                 size = sizeof(nulldata);
7381         } else {
7382                 nulldata.hdr.frame_control =
7383                         IEEE80211_FC(WLAN_FC_TYPE_DATA,
7384                                      WLAN_FC_STYPE_NULLFUNC);
7385                 size = sizeof(struct ieee80211_hdr);
7386         }
7387
7388         nulldata.hdr.frame_control |= host_to_le16(WLAN_FC_FROMDS);
7389         os_memcpy(nulldata.hdr.IEEE80211_DA_FROMDS, addr, ETH_ALEN);
7390         os_memcpy(nulldata.hdr.IEEE80211_BSSID_FROMDS, own_addr, ETH_ALEN);
7391         os_memcpy(nulldata.hdr.IEEE80211_SA_FROMDS, own_addr, ETH_ALEN);
7392
7393         if (wpa_driver_nl80211_send_mlme(bss, (u8 *) &nulldata, size, 0, 0, 0,
7394                                          0, 0, NULL, 0) < 0)
7395                 wpa_printf(MSG_DEBUG, "nl80211_send_null_frame: Failed to "
7396                            "send poll frame");
7397 }
7398
7399 static void nl80211_poll_client(void *priv, const u8 *own_addr, const u8 *addr,
7400                                 int qos)
7401 {
7402         struct i802_bss *bss = priv;
7403         struct wpa_driver_nl80211_data *drv = bss->drv;
7404         struct nl_msg *msg;
7405         int ret;
7406
7407         if (!drv->poll_command_supported) {
7408                 nl80211_send_null_frame(bss, own_addr, addr, qos);
7409                 return;
7410         }
7411
7412         if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_PROBE_CLIENT)) ||
7413             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) {
7414                 nlmsg_free(msg);
7415                 return;
7416         }
7417
7418         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7419         if (ret < 0) {
7420                 wpa_printf(MSG_DEBUG, "nl80211: Client probe request for "
7421                            MACSTR " failed: ret=%d (%s)",
7422                            MAC2STR(addr), ret, strerror(-ret));
7423         }
7424 }
7425
7426
7427 static int nl80211_set_power_save(struct i802_bss *bss, int enabled)
7428 {
7429         struct nl_msg *msg;
7430
7431         if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_SET_POWER_SAVE)) ||
7432             nla_put_u32(msg, NL80211_ATTR_PS_STATE,
7433                         enabled ? NL80211_PS_ENABLED : NL80211_PS_DISABLED)) {
7434                 nlmsg_free(msg);
7435                 return -ENOBUFS;
7436         }
7437         return send_and_recv_msgs(bss->drv, msg, NULL, NULL);
7438 }
7439
7440
7441 static int nl80211_set_p2p_powersave(void *priv, int legacy_ps, int opp_ps,
7442                                      int ctwindow)
7443 {
7444         struct i802_bss *bss = priv;
7445
7446         wpa_printf(MSG_DEBUG, "nl80211: set_p2p_powersave (legacy_ps=%d "
7447                    "opp_ps=%d ctwindow=%d)", legacy_ps, opp_ps, ctwindow);
7448
7449         if (opp_ps != -1 || ctwindow != -1) {
7450 #ifdef ANDROID_P2P
7451                 wpa_driver_set_p2p_ps(priv, legacy_ps, opp_ps, ctwindow);
7452 #else /* ANDROID_P2P */
7453                 return -1; /* Not yet supported */
7454 #endif /* ANDROID_P2P */
7455         }
7456
7457         if (legacy_ps == -1)
7458                 return 0;
7459         if (legacy_ps != 0 && legacy_ps != 1)
7460                 return -1; /* Not yet supported */
7461
7462         return nl80211_set_power_save(bss, legacy_ps);
7463 }
7464
7465
7466 static int nl80211_start_radar_detection(void *priv,
7467                                          struct hostapd_freq_params *freq)
7468 {
7469         struct i802_bss *bss = priv;
7470         struct wpa_driver_nl80211_data *drv = bss->drv;
7471         struct nl_msg *msg;
7472         int ret;
7473
7474         wpa_printf(MSG_DEBUG, "nl80211: Start radar detection (CAC) %d MHz (ht_enabled=%d, vht_enabled=%d, bandwidth=%d MHz, cf1=%d MHz, cf2=%d MHz)",
7475                    freq->freq, freq->ht_enabled, freq->vht_enabled,
7476                    freq->bandwidth, freq->center_freq1, freq->center_freq2);
7477
7478         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_RADAR)) {
7479                 wpa_printf(MSG_DEBUG, "nl80211: Driver does not support radar "
7480                            "detection");
7481                 return -1;
7482         }
7483
7484         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_RADAR_DETECT)) ||
7485             nl80211_put_freq_params(msg, freq) < 0) {
7486                 nlmsg_free(msg);
7487                 return -1;
7488         }
7489
7490         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7491         if (ret == 0)
7492                 return 0;
7493         wpa_printf(MSG_DEBUG, "nl80211: Failed to start radar detection: "
7494                    "%d (%s)", ret, strerror(-ret));
7495         return -1;
7496 }
7497
7498 #ifdef CONFIG_TDLS
7499
7500 static int nl80211_send_tdls_mgmt(void *priv, const u8 *dst, u8 action_code,
7501                                   u8 dialog_token, u16 status_code,
7502                                   u32 peer_capab, int initiator, const u8 *buf,
7503                                   size_t len)
7504 {
7505         struct i802_bss *bss = priv;
7506         struct wpa_driver_nl80211_data *drv = bss->drv;
7507         struct nl_msg *msg;
7508
7509         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT))
7510                 return -EOPNOTSUPP;
7511
7512         if (!dst)
7513                 return -EINVAL;
7514
7515         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_TDLS_MGMT)) ||
7516             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
7517             nla_put_u8(msg, NL80211_ATTR_TDLS_ACTION, action_code) ||
7518             nla_put_u8(msg, NL80211_ATTR_TDLS_DIALOG_TOKEN, dialog_token) ||
7519             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status_code))
7520                 goto fail;
7521         if (peer_capab) {
7522                 /*
7523                  * The internal enum tdls_peer_capability definition is
7524                  * currently identical with the nl80211 enum
7525                  * nl80211_tdls_peer_capability, so no conversion is needed
7526                  * here.
7527                  */
7528                 if (nla_put_u32(msg, NL80211_ATTR_TDLS_PEER_CAPABILITY,
7529                                 peer_capab))
7530                         goto fail;
7531         }
7532         if ((initiator &&
7533              nla_put_flag(msg, NL80211_ATTR_TDLS_INITIATOR)) ||
7534             nla_put(msg, NL80211_ATTR_IE, len, buf))
7535                 goto fail;
7536
7537         return send_and_recv_msgs(drv, msg, NULL, NULL);
7538
7539 fail:
7540         nlmsg_free(msg);
7541         return -ENOBUFS;
7542 }
7543
7544
7545 static int nl80211_tdls_oper(void *priv, enum tdls_oper oper, const u8 *peer)
7546 {
7547         struct i802_bss *bss = priv;
7548         struct wpa_driver_nl80211_data *drv = bss->drv;
7549         struct nl_msg *msg;
7550         enum nl80211_tdls_operation nl80211_oper;
7551
7552         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT))
7553                 return -EOPNOTSUPP;
7554
7555         switch (oper) {
7556         case TDLS_DISCOVERY_REQ:
7557                 nl80211_oper = NL80211_TDLS_DISCOVERY_REQ;
7558                 break;
7559         case TDLS_SETUP:
7560                 nl80211_oper = NL80211_TDLS_SETUP;
7561                 break;
7562         case TDLS_TEARDOWN:
7563                 nl80211_oper = NL80211_TDLS_TEARDOWN;
7564                 break;
7565         case TDLS_ENABLE_LINK:
7566                 nl80211_oper = NL80211_TDLS_ENABLE_LINK;
7567                 break;
7568         case TDLS_DISABLE_LINK:
7569                 nl80211_oper = NL80211_TDLS_DISABLE_LINK;
7570                 break;
7571         case TDLS_ENABLE:
7572                 return 0;
7573         case TDLS_DISABLE:
7574                 return 0;
7575         default:
7576                 return -EINVAL;
7577         }
7578
7579         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_TDLS_OPER)) ||
7580             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, nl80211_oper) ||
7581             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer)) {
7582                 nlmsg_free(msg);
7583                 return -ENOBUFS;
7584         }
7585
7586         return send_and_recv_msgs(drv, msg, NULL, NULL);
7587 }
7588
7589
7590 static int
7591 nl80211_tdls_enable_channel_switch(void *priv, const u8 *addr, u8 oper_class,
7592                                    const struct hostapd_freq_params *params)
7593 {
7594         struct i802_bss *bss = priv;
7595         struct wpa_driver_nl80211_data *drv = bss->drv;
7596         struct nl_msg *msg;
7597         int ret = -ENOBUFS;
7598
7599         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT) ||
7600             !(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_CHANNEL_SWITCH))
7601                 return -EOPNOTSUPP;
7602
7603         wpa_printf(MSG_DEBUG, "nl80211: Enable TDLS channel switch " MACSTR
7604                    " oper_class=%u freq=%u",
7605                    MAC2STR(addr), oper_class, params->freq);
7606         msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_TDLS_CHANNEL_SWITCH);
7607         if (!msg ||
7608             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
7609             nla_put_u8(msg, NL80211_ATTR_OPER_CLASS, oper_class) ||
7610             (ret = nl80211_put_freq_params(msg, params))) {
7611                 nlmsg_free(msg);
7612                 wpa_printf(MSG_DEBUG, "nl80211: Could not build TDLS chan switch");
7613                 return ret;
7614         }
7615
7616         return send_and_recv_msgs(drv, msg, NULL, NULL);
7617 }
7618
7619
7620 static int
7621 nl80211_tdls_disable_channel_switch(void *priv, const u8 *addr)
7622 {
7623         struct i802_bss *bss = priv;
7624         struct wpa_driver_nl80211_data *drv = bss->drv;
7625         struct nl_msg *msg;
7626
7627         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT) ||
7628             !(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_CHANNEL_SWITCH))
7629                 return -EOPNOTSUPP;
7630
7631         wpa_printf(MSG_DEBUG, "nl80211: Disable TDLS channel switch " MACSTR,
7632                    MAC2STR(addr));
7633         msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH);
7634         if (!msg ||
7635             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) {
7636                 nlmsg_free(msg);
7637                 wpa_printf(MSG_DEBUG,
7638                            "nl80211: Could not build TDLS cancel chan switch");
7639                 return -ENOBUFS;
7640         }
7641
7642         return send_and_recv_msgs(drv, msg, NULL, NULL);
7643 }
7644
7645 #endif /* CONFIG TDLS */
7646
7647
7648 static int driver_nl80211_set_key(const char *ifname, void *priv,
7649                                   enum wpa_alg alg, const u8 *addr,
7650                                   int key_idx, int set_tx,
7651                                   const u8 *seq, size_t seq_len,
7652                                   const u8 *key, size_t key_len)
7653 {
7654         struct i802_bss *bss = priv;
7655         return wpa_driver_nl80211_set_key(ifname, bss, alg, addr, key_idx,
7656                                           set_tx, seq, seq_len, key, key_len);
7657 }
7658
7659
7660 static int driver_nl80211_scan2(void *priv,
7661                                 struct wpa_driver_scan_params *params)
7662 {
7663         struct i802_bss *bss = priv;
7664 #ifdef CONFIG_DRIVER_NL80211_QCA
7665         struct wpa_driver_nl80211_data *drv = bss->drv;
7666
7667         /*
7668          * Do a vendor specific scan if possible. If only_new_results is
7669          * set, do a normal scan since a kernel (cfg80211) BSS cache flush
7670          * cannot be achieved through a vendor scan. The below condition may
7671          * need to be modified if new scan flags are added in the future whose
7672          * functionality can only be achieved through a normal scan.
7673          */
7674         if (drv->scan_vendor_cmd_avail && !params->only_new_results)
7675                 return wpa_driver_nl80211_vendor_scan(bss, params);
7676 #endif /* CONFIG_DRIVER_NL80211_QCA */
7677         return wpa_driver_nl80211_scan(bss, params);
7678 }
7679
7680
7681 static int driver_nl80211_deauthenticate(void *priv, const u8 *addr,
7682                                          int reason_code)
7683 {
7684         struct i802_bss *bss = priv;
7685         return wpa_driver_nl80211_deauthenticate(bss, addr, reason_code);
7686 }
7687
7688
7689 static int driver_nl80211_authenticate(void *priv,
7690                                        struct wpa_driver_auth_params *params)
7691 {
7692         struct i802_bss *bss = priv;
7693         return wpa_driver_nl80211_authenticate(bss, params);
7694 }
7695
7696
7697 static void driver_nl80211_deinit(void *priv)
7698 {
7699         struct i802_bss *bss = priv;
7700         wpa_driver_nl80211_deinit(bss);
7701 }
7702
7703
7704 static int driver_nl80211_if_remove(void *priv, enum wpa_driver_if_type type,
7705                                     const char *ifname)
7706 {
7707         struct i802_bss *bss = priv;
7708         return wpa_driver_nl80211_if_remove(bss, type, ifname);
7709 }
7710
7711
7712 static int driver_nl80211_send_mlme(void *priv, const u8 *data,
7713                                     size_t data_len, int noack,
7714                                     unsigned int freq,
7715                                     const u16 *csa_offs, size_t csa_offs_len)
7716 {
7717         struct i802_bss *bss = priv;
7718         return wpa_driver_nl80211_send_mlme(bss, data, data_len, noack,
7719                                             freq, 0, 0, 0, csa_offs,
7720                                             csa_offs_len);
7721 }
7722
7723
7724 static int driver_nl80211_sta_remove(void *priv, const u8 *addr)
7725 {
7726         struct i802_bss *bss = priv;
7727         return wpa_driver_nl80211_sta_remove(bss, addr, -1, 0);
7728 }
7729
7730
7731 static int driver_nl80211_set_sta_vlan(void *priv, const u8 *addr,
7732                                        const char *ifname, int vlan_id)
7733 {
7734         struct i802_bss *bss = priv;
7735         return i802_set_sta_vlan(bss, addr, ifname, vlan_id);
7736 }
7737
7738
7739 static int driver_nl80211_read_sta_data(void *priv,
7740                                         struct hostap_sta_driver_data *data,
7741                                         const u8 *addr)
7742 {
7743         struct i802_bss *bss = priv;
7744         return i802_read_sta_data(bss, data, addr);
7745 }
7746
7747
7748 static int driver_nl80211_send_action(void *priv, unsigned int freq,
7749                                       unsigned int wait_time,
7750                                       const u8 *dst, const u8 *src,
7751                                       const u8 *bssid,
7752                                       const u8 *data, size_t data_len,
7753                                       int no_cck)
7754 {
7755         struct i802_bss *bss = priv;
7756         return wpa_driver_nl80211_send_action(bss, freq, wait_time, dst, src,
7757                                               bssid, data, data_len, no_cck);
7758 }
7759
7760
7761 static int driver_nl80211_probe_req_report(void *priv, int report)
7762 {
7763         struct i802_bss *bss = priv;
7764         return wpa_driver_nl80211_probe_req_report(bss, report);
7765 }
7766
7767
7768 static int wpa_driver_nl80211_update_ft_ies(void *priv, const u8 *md,
7769                                             const u8 *ies, size_t ies_len)
7770 {
7771         int ret;
7772         struct nl_msg *msg;
7773         struct i802_bss *bss = priv;
7774         struct wpa_driver_nl80211_data *drv = bss->drv;
7775         u16 mdid = WPA_GET_LE16(md);
7776
7777         wpa_printf(MSG_DEBUG, "nl80211: Updating FT IEs");
7778         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_UPDATE_FT_IES)) ||
7779             nla_put(msg, NL80211_ATTR_IE, ies_len, ies) ||
7780             nla_put_u16(msg, NL80211_ATTR_MDID, mdid)) {
7781                 nlmsg_free(msg);
7782                 return -ENOBUFS;
7783         }
7784
7785         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7786         if (ret) {
7787                 wpa_printf(MSG_DEBUG, "nl80211: update_ft_ies failed "
7788                            "err=%d (%s)", ret, strerror(-ret));
7789         }
7790
7791         return ret;
7792 }
7793
7794
7795 static const u8 * wpa_driver_nl80211_get_macaddr(void *priv)
7796 {
7797         struct i802_bss *bss = priv;
7798         struct wpa_driver_nl80211_data *drv = bss->drv;
7799
7800         if (drv->nlmode != NL80211_IFTYPE_P2P_DEVICE)
7801                 return NULL;
7802
7803         return bss->addr;
7804 }
7805
7806
7807 static const char * scan_state_str(enum scan_states scan_state)
7808 {
7809         switch (scan_state) {
7810         case NO_SCAN:
7811                 return "NO_SCAN";
7812         case SCAN_REQUESTED:
7813                 return "SCAN_REQUESTED";
7814         case SCAN_STARTED:
7815                 return "SCAN_STARTED";
7816         case SCAN_COMPLETED:
7817                 return "SCAN_COMPLETED";
7818         case SCAN_ABORTED:
7819                 return "SCAN_ABORTED";
7820         case SCHED_SCAN_STARTED:
7821                 return "SCHED_SCAN_STARTED";
7822         case SCHED_SCAN_STOPPED:
7823                 return "SCHED_SCAN_STOPPED";
7824         case SCHED_SCAN_RESULTS:
7825                 return "SCHED_SCAN_RESULTS";
7826         }
7827
7828         return "??";
7829 }
7830
7831
7832 static int wpa_driver_nl80211_status(void *priv, char *buf, size_t buflen)
7833 {
7834         struct i802_bss *bss = priv;
7835         struct wpa_driver_nl80211_data *drv = bss->drv;
7836         int res;
7837         char *pos, *end;
7838
7839         pos = buf;
7840         end = buf + buflen;
7841
7842         res = os_snprintf(pos, end - pos,
7843                           "ifindex=%d\n"
7844                           "ifname=%s\n"
7845                           "brname=%s\n"
7846                           "addr=" MACSTR "\n"
7847                           "freq=%d\n"
7848                           "%s%s%s%s%s",
7849                           bss->ifindex,
7850                           bss->ifname,
7851                           bss->brname,
7852                           MAC2STR(bss->addr),
7853                           bss->freq,
7854                           bss->beacon_set ? "beacon_set=1\n" : "",
7855                           bss->added_if_into_bridge ?
7856                           "added_if_into_bridge=1\n" : "",
7857                           bss->added_bridge ? "added_bridge=1\n" : "",
7858                           bss->in_deinit ? "in_deinit=1\n" : "",
7859                           bss->if_dynamic ? "if_dynamic=1\n" : "");
7860         if (os_snprintf_error(end - pos, res))
7861                 return pos - buf;
7862         pos += res;
7863
7864         if (bss->wdev_id_set) {
7865                 res = os_snprintf(pos, end - pos, "wdev_id=%llu\n",
7866                                   (unsigned long long) bss->wdev_id);
7867                 if (os_snprintf_error(end - pos, res))
7868                         return pos - buf;
7869                 pos += res;
7870         }
7871
7872         res = os_snprintf(pos, end - pos,
7873                           "phyname=%s\n"
7874                           "perm_addr=" MACSTR "\n"
7875                           "drv_ifindex=%d\n"
7876                           "operstate=%d\n"
7877                           "scan_state=%s\n"
7878                           "auth_bssid=" MACSTR "\n"
7879                           "auth_attempt_bssid=" MACSTR "\n"
7880                           "bssid=" MACSTR "\n"
7881                           "prev_bssid=" MACSTR "\n"
7882                           "associated=%d\n"
7883                           "assoc_freq=%u\n"
7884                           "monitor_sock=%d\n"
7885                           "monitor_ifidx=%d\n"
7886                           "monitor_refcount=%d\n"
7887                           "last_mgmt_freq=%u\n"
7888                           "eapol_tx_sock=%d\n"
7889                           "%s%s%s%s%s%s%s%s%s%s%s%s%s",
7890                           drv->phyname,
7891                           MAC2STR(drv->perm_addr),
7892                           drv->ifindex,
7893                           drv->operstate,
7894                           scan_state_str(drv->scan_state),
7895                           MAC2STR(drv->auth_bssid),
7896                           MAC2STR(drv->auth_attempt_bssid),
7897                           MAC2STR(drv->bssid),
7898                           MAC2STR(drv->prev_bssid),
7899                           drv->associated,
7900                           drv->assoc_freq,
7901                           drv->monitor_sock,
7902                           drv->monitor_ifidx,
7903                           drv->monitor_refcount,
7904                           drv->last_mgmt_freq,
7905                           drv->eapol_tx_sock,
7906                           drv->ignore_if_down_event ?
7907                           "ignore_if_down_event=1\n" : "",
7908                           drv->scan_complete_events ?
7909                           "scan_complete_events=1\n" : "",
7910                           drv->disabled_11b_rates ?
7911                           "disabled_11b_rates=1\n" : "",
7912                           drv->pending_remain_on_chan ?
7913                           "pending_remain_on_chan=1\n" : "",
7914                           drv->in_interface_list ? "in_interface_list=1\n" : "",
7915                           drv->device_ap_sme ? "device_ap_sme=1\n" : "",
7916                           drv->poll_command_supported ?
7917                           "poll_command_supported=1\n" : "",
7918                           drv->data_tx_status ? "data_tx_status=1\n" : "",
7919                           drv->scan_for_auth ? "scan_for_auth=1\n" : "",
7920                           drv->retry_auth ? "retry_auth=1\n" : "",
7921                           drv->use_monitor ? "use_monitor=1\n" : "",
7922                           drv->ignore_next_local_disconnect ?
7923                           "ignore_next_local_disconnect=1\n" : "",
7924                           drv->ignore_next_local_deauth ?
7925                           "ignore_next_local_deauth=1\n" : "");
7926         if (os_snprintf_error(end - pos, res))
7927                 return pos - buf;
7928         pos += res;
7929
7930         if (drv->has_capability) {
7931                 res = os_snprintf(pos, end - pos,
7932                                   "capa.key_mgmt=0x%x\n"
7933                                   "capa.enc=0x%x\n"
7934                                   "capa.auth=0x%x\n"
7935                                   "capa.flags=0x%llx\n"
7936                                   "capa.rrm_flags=0x%x\n"
7937                                   "capa.max_scan_ssids=%d\n"
7938                                   "capa.max_sched_scan_ssids=%d\n"
7939                                   "capa.sched_scan_supported=%d\n"
7940                                   "capa.max_match_sets=%d\n"
7941                                   "capa.max_remain_on_chan=%u\n"
7942                                   "capa.max_stations=%u\n"
7943                                   "capa.probe_resp_offloads=0x%x\n"
7944                                   "capa.max_acl_mac_addrs=%u\n"
7945                                   "capa.num_multichan_concurrent=%u\n"
7946                                   "capa.mac_addr_rand_sched_scan_supported=%d\n"
7947                                   "capa.mac_addr_rand_scan_supported=%d\n"
7948                                   "capa.conc_capab=%u\n"
7949                                   "capa.max_conc_chan_2_4=%u\n"
7950                                   "capa.max_conc_chan_5_0=%u\n"
7951                                   "capa.max_sched_scan_plans=%u\n"
7952                                   "capa.max_sched_scan_plan_interval=%u\n"
7953                                   "capa.max_sched_scan_plan_iterations=%u\n",
7954                                   drv->capa.key_mgmt,
7955                                   drv->capa.enc,
7956                                   drv->capa.auth,
7957                                   (unsigned long long) drv->capa.flags,
7958                                   drv->capa.rrm_flags,
7959                                   drv->capa.max_scan_ssids,
7960                                   drv->capa.max_sched_scan_ssids,
7961                                   drv->capa.sched_scan_supported,
7962                                   drv->capa.max_match_sets,
7963                                   drv->capa.max_remain_on_chan,
7964                                   drv->capa.max_stations,
7965                                   drv->capa.probe_resp_offloads,
7966                                   drv->capa.max_acl_mac_addrs,
7967                                   drv->capa.num_multichan_concurrent,
7968                                   drv->capa.mac_addr_rand_sched_scan_supported,
7969                                   drv->capa.mac_addr_rand_scan_supported,
7970                                   drv->capa.conc_capab,
7971                                   drv->capa.max_conc_chan_2_4,
7972                                   drv->capa.max_conc_chan_5_0,
7973                                   drv->capa.max_sched_scan_plans,
7974                                   drv->capa.max_sched_scan_plan_interval,
7975                                   drv->capa.max_sched_scan_plan_iterations);
7976                 if (os_snprintf_error(end - pos, res))
7977                         return pos - buf;
7978                 pos += res;
7979         }
7980
7981         return pos - buf;
7982 }
7983
7984
7985 static int set_beacon_data(struct nl_msg *msg, struct beacon_data *settings)
7986 {
7987         if ((settings->head &&
7988              nla_put(msg, NL80211_ATTR_BEACON_HEAD,
7989                      settings->head_len, settings->head)) ||
7990             (settings->tail &&
7991              nla_put(msg, NL80211_ATTR_BEACON_TAIL,
7992                      settings->tail_len, settings->tail)) ||
7993             (settings->beacon_ies &&
7994              nla_put(msg, NL80211_ATTR_IE,
7995                      settings->beacon_ies_len, settings->beacon_ies)) ||
7996             (settings->proberesp_ies &&
7997              nla_put(msg, NL80211_ATTR_IE_PROBE_RESP,
7998                      settings->proberesp_ies_len, settings->proberesp_ies)) ||
7999             (settings->assocresp_ies &&
8000              nla_put(msg, NL80211_ATTR_IE_ASSOC_RESP,
8001                      settings->assocresp_ies_len, settings->assocresp_ies)) ||
8002             (settings->probe_resp &&
8003              nla_put(msg, NL80211_ATTR_PROBE_RESP,
8004                      settings->probe_resp_len, settings->probe_resp)))
8005                 return -ENOBUFS;
8006
8007         return 0;
8008 }
8009
8010
8011 static int nl80211_switch_channel(void *priv, struct csa_settings *settings)
8012 {
8013         struct nl_msg *msg;
8014         struct i802_bss *bss = priv;
8015         struct wpa_driver_nl80211_data *drv = bss->drv;
8016         struct nlattr *beacon_csa;
8017         int ret = -ENOBUFS;
8018         int csa_off_len = 0;
8019         int i;
8020
8021         wpa_printf(MSG_DEBUG, "nl80211: Channel switch request (cs_count=%u block_tx=%u freq=%d width=%d cf1=%d cf2=%d)",
8022                    settings->cs_count, settings->block_tx,
8023                    settings->freq_params.freq, settings->freq_params.bandwidth,
8024                    settings->freq_params.center_freq1,
8025                    settings->freq_params.center_freq2);
8026
8027         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_AP_CSA)) {
8028                 wpa_printf(MSG_DEBUG, "nl80211: Driver does not support channel switch command");
8029                 return -EOPNOTSUPP;
8030         }
8031
8032         if ((drv->nlmode != NL80211_IFTYPE_AP) &&
8033             (drv->nlmode != NL80211_IFTYPE_P2P_GO))
8034                 return -EOPNOTSUPP;
8035
8036         /*
8037          * Remove empty counters, assuming Probe Response and Beacon frame
8038          * counters match. This implementation assumes that there are only two
8039          * counters.
8040          */
8041         if (settings->counter_offset_beacon[0] &&
8042             !settings->counter_offset_beacon[1]) {
8043                 csa_off_len = 1;
8044         } else if (settings->counter_offset_beacon[1] &&
8045                    !settings->counter_offset_beacon[0]) {
8046                 csa_off_len = 1;
8047                 settings->counter_offset_beacon[0] =
8048                         settings->counter_offset_beacon[1];
8049                 settings->counter_offset_presp[0] =
8050                         settings->counter_offset_presp[1];
8051         } else if (settings->counter_offset_beacon[1] &&
8052                    settings->counter_offset_beacon[0]) {
8053                 csa_off_len = 2;
8054         } else {
8055                 wpa_printf(MSG_ERROR, "nl80211: No CSA counters provided");
8056                 return -EINVAL;
8057         }
8058
8059         /* Check CSA counters validity */
8060         if (drv->capa.max_csa_counters &&
8061             csa_off_len > drv->capa.max_csa_counters) {
8062                 wpa_printf(MSG_ERROR,
8063                            "nl80211: Too many CSA counters provided");
8064                 return -EINVAL;
8065         }
8066
8067         if (!settings->beacon_csa.tail)
8068                 return -EINVAL;
8069
8070         for (i = 0; i < csa_off_len; i++) {
8071                 u16 csa_c_off_bcn = settings->counter_offset_beacon[i];
8072                 u16 csa_c_off_presp = settings->counter_offset_presp[i];
8073
8074                 if ((settings->beacon_csa.tail_len <= csa_c_off_bcn) ||
8075                     (settings->beacon_csa.tail[csa_c_off_bcn] !=
8076                      settings->cs_count))
8077                         return -EINVAL;
8078
8079                 if (settings->beacon_csa.probe_resp &&
8080                     ((settings->beacon_csa.probe_resp_len <=
8081                       csa_c_off_presp) ||
8082                      (settings->beacon_csa.probe_resp[csa_c_off_presp] !=
8083                       settings->cs_count)))
8084                         return -EINVAL;
8085         }
8086
8087         if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_CHANNEL_SWITCH)) ||
8088             nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT,
8089                         settings->cs_count) ||
8090             (ret = nl80211_put_freq_params(msg, &settings->freq_params)) ||
8091             (settings->block_tx &&
8092              nla_put_flag(msg, NL80211_ATTR_CH_SWITCH_BLOCK_TX)))
8093                 goto error;
8094
8095         /* beacon_after params */
8096         ret = set_beacon_data(msg, &settings->beacon_after);
8097         if (ret)
8098                 goto error;
8099
8100         /* beacon_csa params */
8101         beacon_csa = nla_nest_start(msg, NL80211_ATTR_CSA_IES);
8102         if (!beacon_csa)
8103                 goto fail;
8104
8105         ret = set_beacon_data(msg, &settings->beacon_csa);
8106         if (ret)
8107                 goto error;
8108
8109         if (nla_put(msg, NL80211_ATTR_CSA_C_OFF_BEACON,
8110                     csa_off_len * sizeof(u16),
8111                     settings->counter_offset_beacon) ||
8112             (settings->beacon_csa.probe_resp &&
8113              nla_put(msg, NL80211_ATTR_CSA_C_OFF_PRESP,
8114                      csa_off_len * sizeof(u16),
8115                      settings->counter_offset_presp)))
8116                 goto fail;
8117
8118         nla_nest_end(msg, beacon_csa);
8119         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8120         if (ret) {
8121                 wpa_printf(MSG_DEBUG, "nl80211: switch_channel failed err=%d (%s)",
8122                            ret, strerror(-ret));
8123         }
8124         return ret;
8125
8126 fail:
8127         ret = -ENOBUFS;
8128 error:
8129         nlmsg_free(msg);
8130         wpa_printf(MSG_DEBUG, "nl80211: Could not build channel switch request");
8131         return ret;
8132 }
8133
8134
8135 static int nl80211_add_ts(void *priv, u8 tsid, const u8 *addr,
8136                           u8 user_priority, u16 admitted_time)
8137 {
8138         struct i802_bss *bss = priv;
8139         struct wpa_driver_nl80211_data *drv = bss->drv;
8140         struct nl_msg *msg;
8141         int ret;
8142
8143         wpa_printf(MSG_DEBUG,
8144                    "nl80211: add_ts request: tsid=%u admitted_time=%u up=%d",
8145                    tsid, admitted_time, user_priority);
8146
8147         if (!is_sta_interface(drv->nlmode))
8148                 return -ENOTSUP;
8149
8150         msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_ADD_TX_TS);
8151         if (!msg ||
8152             nla_put_u8(msg, NL80211_ATTR_TSID, tsid) ||
8153             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
8154             nla_put_u8(msg, NL80211_ATTR_USER_PRIO, user_priority) ||
8155             nla_put_u16(msg, NL80211_ATTR_ADMITTED_TIME, admitted_time)) {
8156                 nlmsg_free(msg);
8157                 return -ENOBUFS;
8158         }
8159
8160         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8161         if (ret)
8162                 wpa_printf(MSG_DEBUG, "nl80211: add_ts failed err=%d (%s)",
8163                            ret, strerror(-ret));
8164         return ret;
8165 }
8166
8167
8168 static int nl80211_del_ts(void *priv, u8 tsid, const u8 *addr)
8169 {
8170         struct i802_bss *bss = priv;
8171         struct wpa_driver_nl80211_data *drv = bss->drv;
8172         struct nl_msg *msg;
8173         int ret;
8174
8175         wpa_printf(MSG_DEBUG, "nl80211: del_ts request: tsid=%u", tsid);
8176
8177         if (!is_sta_interface(drv->nlmode))
8178                 return -ENOTSUP;
8179
8180         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_DEL_TX_TS)) ||
8181             nla_put_u8(msg, NL80211_ATTR_TSID, tsid) ||
8182             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) {
8183                 nlmsg_free(msg);
8184                 return -ENOBUFS;
8185         }
8186
8187         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8188         if (ret)
8189                 wpa_printf(MSG_DEBUG, "nl80211: del_ts failed err=%d (%s)",
8190                            ret, strerror(-ret));
8191         return ret;
8192 }
8193
8194
8195 #ifdef CONFIG_TESTING_OPTIONS
8196 static int cmd_reply_handler(struct nl_msg *msg, void *arg)
8197 {
8198         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
8199         struct wpabuf *buf = arg;
8200
8201         if (!buf)
8202                 return NL_SKIP;
8203
8204         if ((size_t) genlmsg_attrlen(gnlh, 0) > wpabuf_tailroom(buf)) {
8205                 wpa_printf(MSG_INFO, "nl80211: insufficient buffer space for reply");
8206                 return NL_SKIP;
8207         }
8208
8209         wpabuf_put_data(buf, genlmsg_attrdata(gnlh, 0),
8210                         genlmsg_attrlen(gnlh, 0));
8211
8212         return NL_SKIP;
8213 }
8214 #endif /* CONFIG_TESTING_OPTIONS */
8215
8216
8217 static int vendor_reply_handler(struct nl_msg *msg, void *arg)
8218 {
8219         struct nlattr *tb[NL80211_ATTR_MAX + 1];
8220         struct nlattr *nl_vendor_reply, *nl;
8221         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
8222         struct wpabuf *buf = arg;
8223         int rem;
8224
8225         if (!buf)
8226                 return NL_SKIP;
8227
8228         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
8229                   genlmsg_attrlen(gnlh, 0), NULL);
8230         nl_vendor_reply = tb[NL80211_ATTR_VENDOR_DATA];
8231
8232         if (!nl_vendor_reply)
8233                 return NL_SKIP;
8234
8235         if ((size_t) nla_len(nl_vendor_reply) > wpabuf_tailroom(buf)) {
8236                 wpa_printf(MSG_INFO, "nl80211: Vendor command: insufficient buffer space for reply");
8237                 return NL_SKIP;
8238         }
8239
8240         nla_for_each_nested(nl, nl_vendor_reply, rem) {
8241                 wpabuf_put_data(buf, nla_data(nl), nla_len(nl));
8242         }
8243
8244         return NL_SKIP;
8245 }
8246
8247
8248 static int nl80211_vendor_cmd(void *priv, unsigned int vendor_id,
8249                               unsigned int subcmd, const u8 *data,
8250                               size_t data_len, struct wpabuf *buf)
8251 {
8252         struct i802_bss *bss = priv;
8253         struct wpa_driver_nl80211_data *drv = bss->drv;
8254         struct nl_msg *msg;
8255         int ret;
8256
8257 #ifdef CONFIG_TESTING_OPTIONS
8258         if (vendor_id == 0xffffffff) {
8259                 msg = nlmsg_alloc();
8260                 if (!msg)
8261                         return -ENOMEM;
8262
8263                 nl80211_cmd(drv, msg, 0, subcmd);
8264                 if (nlmsg_append(msg, (void *) data, data_len, NLMSG_ALIGNTO) <
8265                     0)
8266                         goto fail;
8267                 ret = send_and_recv_msgs(drv, msg, cmd_reply_handler, buf);
8268                 if (ret)
8269                         wpa_printf(MSG_DEBUG, "nl80211: command failed err=%d",
8270                                    ret);
8271                 return ret;
8272         }
8273 #endif /* CONFIG_TESTING_OPTIONS */
8274
8275         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_VENDOR)) ||
8276             nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, vendor_id) ||
8277             nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, subcmd) ||
8278             (data &&
8279              nla_put(msg, NL80211_ATTR_VENDOR_DATA, data_len, data)))
8280                 goto fail;
8281
8282         ret = send_and_recv_msgs(drv, msg, vendor_reply_handler, buf);
8283         if (ret)
8284                 wpa_printf(MSG_DEBUG, "nl80211: vendor command failed err=%d",
8285                            ret);
8286         return ret;
8287
8288 fail:
8289         nlmsg_free(msg);
8290         return -ENOBUFS;
8291 }
8292
8293
8294 static int nl80211_set_qos_map(void *priv, const u8 *qos_map_set,
8295                                u8 qos_map_set_len)
8296 {
8297         struct i802_bss *bss = priv;
8298         struct wpa_driver_nl80211_data *drv = bss->drv;
8299         struct nl_msg *msg;
8300         int ret;
8301
8302         wpa_hexdump(MSG_DEBUG, "nl80211: Setting QoS Map",
8303                     qos_map_set, qos_map_set_len);
8304
8305         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_SET_QOS_MAP)) ||
8306             nla_put(msg, NL80211_ATTR_QOS_MAP, qos_map_set_len, qos_map_set)) {
8307                 nlmsg_free(msg);
8308                 return -ENOBUFS;
8309         }
8310
8311         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8312         if (ret)
8313                 wpa_printf(MSG_DEBUG, "nl80211: Setting QoS Map failed");
8314
8315         return ret;
8316 }
8317
8318
8319 static int nl80211_set_wowlan(void *priv,
8320                               const struct wowlan_triggers *triggers)
8321 {
8322         struct i802_bss *bss = priv;
8323         struct wpa_driver_nl80211_data *drv = bss->drv;
8324         struct nl_msg *msg;
8325         struct nlattr *wowlan_triggers;
8326         int ret;
8327
8328         wpa_printf(MSG_DEBUG, "nl80211: Setting wowlan");
8329
8330         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_SET_WOWLAN)) ||
8331             !(wowlan_triggers = nla_nest_start(msg,
8332                                                NL80211_ATTR_WOWLAN_TRIGGERS)) ||
8333             (triggers->any &&
8334              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
8335             (triggers->disconnect &&
8336              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
8337             (triggers->magic_pkt &&
8338              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
8339             (triggers->gtk_rekey_failure &&
8340              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
8341             (triggers->eap_identity_req &&
8342              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
8343             (triggers->four_way_handshake &&
8344              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
8345             (triggers->rfkill_release &&
8346              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))) {
8347                 nlmsg_free(msg);
8348                 return -ENOBUFS;
8349         }
8350
8351         nla_nest_end(msg, wowlan_triggers);
8352
8353         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8354         if (ret)
8355                 wpa_printf(MSG_DEBUG, "nl80211: Setting wowlan failed");
8356
8357         return ret;
8358 }
8359
8360
8361 #ifdef CONFIG_DRIVER_NL80211_QCA
8362 static int nl80211_roaming(void *priv, int allowed, const u8 *bssid)
8363 {
8364         struct i802_bss *bss = priv;
8365         struct wpa_driver_nl80211_data *drv = bss->drv;
8366         struct nl_msg *msg;
8367         struct nlattr *params;
8368
8369         wpa_printf(MSG_DEBUG, "nl80211: Roaming policy: allowed=%d", allowed);
8370
8371         if (!drv->roaming_vendor_cmd_avail) {
8372                 wpa_printf(MSG_DEBUG,
8373                            "nl80211: Ignore roaming policy change since driver does not provide command for setting it");
8374                 return -1;
8375         }
8376
8377         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
8378             nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
8379             nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
8380                         QCA_NL80211_VENDOR_SUBCMD_ROAMING) ||
8381             !(params = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
8382             nla_put_u32(msg, QCA_WLAN_VENDOR_ATTR_ROAMING_POLICY,
8383                         allowed ? QCA_ROAMING_ALLOWED_WITHIN_ESS :
8384                         QCA_ROAMING_NOT_ALLOWED) ||
8385             (bssid &&
8386              nla_put(msg, QCA_WLAN_VENDOR_ATTR_MAC_ADDR, ETH_ALEN, bssid))) {
8387                 nlmsg_free(msg);
8388                 return -1;
8389         }
8390         nla_nest_end(msg, params);
8391
8392         return send_and_recv_msgs(drv, msg, NULL, NULL);
8393 }
8394 #endif /* CONFIG_DRIVER_NL80211_QCA */
8395
8396
8397 static int nl80211_set_mac_addr(void *priv, const u8 *addr)
8398 {
8399         struct i802_bss *bss = priv;
8400         struct wpa_driver_nl80211_data *drv = bss->drv;
8401         int new_addr = addr != NULL;
8402
8403         if (TEST_FAIL())
8404                 return -1;
8405
8406         if (!addr)
8407                 addr = drv->perm_addr;
8408
8409         if (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 0) < 0)
8410                 return -1;
8411
8412         if (linux_set_ifhwaddr(drv->global->ioctl_sock, bss->ifname, addr) < 0)
8413         {
8414                 wpa_printf(MSG_DEBUG,
8415                            "nl80211: failed to set_mac_addr for %s to " MACSTR,
8416                            bss->ifname, MAC2STR(addr));
8417                 if (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname,
8418                                           1) < 0) {
8419                         wpa_printf(MSG_DEBUG,
8420                                    "nl80211: Could not restore interface UP after failed set_mac_addr");
8421                 }
8422                 return -1;
8423         }
8424
8425         wpa_printf(MSG_DEBUG, "nl80211: set_mac_addr for %s to " MACSTR,
8426                    bss->ifname, MAC2STR(addr));
8427         drv->addr_changed = new_addr;
8428         os_memcpy(bss->addr, addr, ETH_ALEN);
8429
8430         if (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 1) < 0)
8431         {
8432                 wpa_printf(MSG_DEBUG,
8433                            "nl80211: Could not restore interface UP after set_mac_addr");
8434         }
8435
8436         return 0;
8437 }
8438
8439
8440 #ifdef CONFIG_MESH
8441
8442 static int wpa_driver_nl80211_init_mesh(void *priv)
8443 {
8444         if (wpa_driver_nl80211_set_mode(priv, NL80211_IFTYPE_MESH_POINT)) {
8445                 wpa_printf(MSG_INFO,
8446                            "nl80211: Failed to set interface into mesh mode");
8447                 return -1;
8448         }
8449         return 0;
8450 }
8451
8452
8453 static int nl80211_put_mesh_id(struct nl_msg *msg, const u8 *mesh_id,
8454                                size_t mesh_id_len)
8455 {
8456         if (mesh_id) {
8457                 wpa_hexdump_ascii(MSG_DEBUG, "  * Mesh ID (SSID)",
8458                                   mesh_id, mesh_id_len);
8459                 return nla_put(msg, NL80211_ATTR_MESH_ID, mesh_id_len, mesh_id);
8460         }
8461
8462         return 0;
8463 }
8464
8465
8466 static int nl80211_put_mesh_config(struct nl_msg *msg,
8467                                    struct wpa_driver_mesh_bss_params *params)
8468 {
8469         struct nlattr *container;
8470
8471         container = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
8472         if (!container)
8473                 return -1;
8474
8475         if (((params->flags & WPA_DRIVER_MESH_CONF_FLAG_AUTO_PLINKS) &&
8476              nla_put_u32(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
8477                          params->auto_plinks)) ||
8478             ((params->flags & WPA_DRIVER_MESH_CONF_FLAG_MAX_PEER_LINKS) &&
8479              nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
8480                          params->max_peer_links)))
8481                 return -1;
8482
8483         /*
8484          * Set NL80211_MESHCONF_PLINK_TIMEOUT even if user mpm is used because
8485          * the timer could disconnect stations even in that case.
8486          */
8487         if ((params->flags & WPA_DRIVER_MESH_CONF_FLAG_PEER_LINK_TIMEOUT) &&
8488             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
8489                         params->peer_link_timeout)) {
8490                 wpa_printf(MSG_ERROR, "nl80211: Failed to set PLINK_TIMEOUT");
8491                 return -1;
8492         }
8493
8494         if ((params->flags & WPA_DRIVER_MESH_CONF_FLAG_HT_OP_MODE) &&
8495             nla_put_u16(msg, NL80211_MESHCONF_HT_OPMODE, params->ht_opmode)) {
8496                 wpa_printf(MSG_ERROR, "nl80211: Failed to set HT_OP_MODE");
8497                 return -1;
8498         }
8499
8500         nla_nest_end(msg, container);
8501
8502         return 0;
8503 }
8504
8505
8506 static int nl80211_join_mesh(struct i802_bss *bss,
8507                              struct wpa_driver_mesh_join_params *params)
8508 {
8509         struct wpa_driver_nl80211_data *drv = bss->drv;
8510         struct nl_msg *msg;
8511         struct nlattr *container;
8512         int ret = -1;
8513
8514         wpa_printf(MSG_DEBUG, "nl80211: mesh join (ifindex=%d)", drv->ifindex);
8515         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_JOIN_MESH);
8516         if (!msg ||
8517             nl80211_put_freq_params(msg, &params->freq) ||
8518             nl80211_put_basic_rates(msg, params->basic_rates) ||
8519             nl80211_put_mesh_id(msg, params->meshid, params->meshid_len) ||
8520             nl80211_put_beacon_int(msg, params->beacon_int) ||
8521             nl80211_put_dtim_period(msg, params->dtim_period))
8522                 goto fail;
8523
8524         wpa_printf(MSG_DEBUG, "  * flags=%08X", params->flags);
8525
8526         container = nla_nest_start(msg, NL80211_ATTR_MESH_SETUP);
8527         if (!container)
8528                 goto fail;
8529
8530         if (params->ies) {
8531                 wpa_hexdump(MSG_DEBUG, "  * IEs", params->ies, params->ie_len);
8532                 if (nla_put(msg, NL80211_MESH_SETUP_IE, params->ie_len,
8533                             params->ies))
8534                         goto fail;
8535         }
8536         /* WPA_DRIVER_MESH_FLAG_OPEN_AUTH is treated as default by nl80211 */
8537         if (params->flags & WPA_DRIVER_MESH_FLAG_SAE_AUTH) {
8538                 if (nla_put_u8(msg, NL80211_MESH_SETUP_AUTH_PROTOCOL, 0x1) ||
8539                     nla_put_flag(msg, NL80211_MESH_SETUP_USERSPACE_AUTH))
8540                         goto fail;
8541         }
8542         if ((params->flags & WPA_DRIVER_MESH_FLAG_AMPE) &&
8543             nla_put_flag(msg, NL80211_MESH_SETUP_USERSPACE_AMPE))
8544                 goto fail;
8545         if ((params->flags & WPA_DRIVER_MESH_FLAG_USER_MPM) &&
8546             nla_put_flag(msg, NL80211_MESH_SETUP_USERSPACE_MPM))
8547                 goto fail;
8548         nla_nest_end(msg, container);
8549
8550         params->conf.flags |= WPA_DRIVER_MESH_CONF_FLAG_AUTO_PLINKS;
8551         params->conf.flags |= WPA_DRIVER_MESH_CONF_FLAG_PEER_LINK_TIMEOUT;
8552         params->conf.flags |= WPA_DRIVER_MESH_CONF_FLAG_MAX_PEER_LINKS;
8553         if (nl80211_put_mesh_config(msg, &params->conf) < 0)
8554                 goto fail;
8555
8556         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8557         msg = NULL;
8558         if (ret) {
8559                 wpa_printf(MSG_DEBUG, "nl80211: mesh join failed: ret=%d (%s)",
8560                            ret, strerror(-ret));
8561                 goto fail;
8562         }
8563         ret = 0;
8564         drv->assoc_freq = bss->freq = params->freq.freq;
8565         wpa_printf(MSG_DEBUG, "nl80211: mesh join request send successfully");
8566
8567 fail:
8568         nlmsg_free(msg);
8569         return ret;
8570 }
8571
8572
8573 static int
8574 wpa_driver_nl80211_join_mesh(void *priv,
8575                              struct wpa_driver_mesh_join_params *params)
8576 {
8577         struct i802_bss *bss = priv;
8578         int ret, timeout;
8579
8580         timeout = params->conf.peer_link_timeout;
8581
8582         /* Disable kernel inactivity timer */
8583         if (params->flags & WPA_DRIVER_MESH_FLAG_USER_MPM)
8584                 params->conf.peer_link_timeout = 0;
8585
8586         ret = nl80211_join_mesh(bss, params);
8587         if (ret == -EINVAL && params->conf.peer_link_timeout == 0) {
8588                 wpa_printf(MSG_DEBUG,
8589                            "nl80211: Mesh join retry for peer_link_timeout");
8590                 /*
8591                  * Old kernel does not support setting
8592                  * NL80211_MESHCONF_PLINK_TIMEOUT to zero, so set 60 seconds
8593                  * into future from peer_link_timeout.
8594                  */
8595                 params->conf.peer_link_timeout = timeout + 60;
8596                 ret = nl80211_join_mesh(priv, params);
8597         }
8598
8599         params->conf.peer_link_timeout = timeout;
8600         return ret;
8601 }
8602
8603
8604 static int wpa_driver_nl80211_leave_mesh(void *priv)
8605 {
8606         struct i802_bss *bss = priv;
8607         struct wpa_driver_nl80211_data *drv = bss->drv;
8608         struct nl_msg *msg;
8609         int ret;
8610
8611         wpa_printf(MSG_DEBUG, "nl80211: mesh leave (ifindex=%d)", drv->ifindex);
8612         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_LEAVE_MESH);
8613         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8614         if (ret) {
8615                 wpa_printf(MSG_DEBUG, "nl80211: mesh leave failed: ret=%d (%s)",
8616                            ret, strerror(-ret));
8617         } else {
8618                 wpa_printf(MSG_DEBUG,
8619                            "nl80211: mesh leave request send successfully");
8620         }
8621
8622         if (wpa_driver_nl80211_set_mode(drv->first_bss,
8623                                         NL80211_IFTYPE_STATION)) {
8624                 wpa_printf(MSG_INFO,
8625                            "nl80211: Failed to set interface into station mode");
8626         }
8627         return ret;
8628 }
8629
8630 #endif /* CONFIG_MESH */
8631
8632
8633 static int wpa_driver_br_add_ip_neigh(void *priv, u8 version,
8634                                       const u8 *ipaddr, int prefixlen,
8635                                       const u8 *addr)
8636 {
8637 #ifdef CONFIG_LIBNL3_ROUTE
8638         struct i802_bss *bss = priv;
8639         struct wpa_driver_nl80211_data *drv = bss->drv;
8640         struct rtnl_neigh *rn;
8641         struct nl_addr *nl_ipaddr = NULL;
8642         struct nl_addr *nl_lladdr = NULL;
8643         int family, addrsize;
8644         int res;
8645
8646         if (!ipaddr || prefixlen == 0 || !addr)
8647                 return -EINVAL;
8648
8649         if (bss->br_ifindex == 0) {
8650                 wpa_printf(MSG_DEBUG,
8651                            "nl80211: bridge must be set before adding an ip neigh to it");
8652                 return -1;
8653         }
8654
8655         if (!drv->rtnl_sk) {
8656                 wpa_printf(MSG_DEBUG,
8657                            "nl80211: nl_sock for NETLINK_ROUTE is not initialized");
8658                 return -1;
8659         }
8660
8661         if (version == 4) {
8662                 family = AF_INET;
8663                 addrsize = 4;
8664         } else if (version == 6) {
8665                 family = AF_INET6;
8666                 addrsize = 16;
8667         } else {
8668                 return -EINVAL;
8669         }
8670
8671         rn = rtnl_neigh_alloc();
8672         if (rn == NULL)
8673                 return -ENOMEM;
8674
8675         /* set the destination ip address for neigh */
8676         nl_ipaddr = nl_addr_build(family, (void *) ipaddr, addrsize);
8677         if (nl_ipaddr == NULL) {
8678                 wpa_printf(MSG_DEBUG, "nl80211: nl_ipaddr build failed");
8679                 res = -ENOMEM;
8680                 goto errout;
8681         }
8682         nl_addr_set_prefixlen(nl_ipaddr, prefixlen);
8683         res = rtnl_neigh_set_dst(rn, nl_ipaddr);
8684         if (res) {
8685                 wpa_printf(MSG_DEBUG,
8686                            "nl80211: neigh set destination addr failed");
8687                 goto errout;
8688         }
8689
8690         /* set the corresponding lladdr for neigh */
8691         nl_lladdr = nl_addr_build(AF_BRIDGE, (u8 *) addr, ETH_ALEN);
8692         if (nl_lladdr == NULL) {
8693                 wpa_printf(MSG_DEBUG, "nl80211: neigh set lladdr failed");
8694                 res = -ENOMEM;
8695                 goto errout;
8696         }
8697         rtnl_neigh_set_lladdr(rn, nl_lladdr);
8698
8699         rtnl_neigh_set_ifindex(rn, bss->br_ifindex);
8700         rtnl_neigh_set_state(rn, NUD_PERMANENT);
8701
8702         res = rtnl_neigh_add(drv->rtnl_sk, rn, NLM_F_CREATE);
8703         if (res) {
8704                 wpa_printf(MSG_DEBUG,
8705                            "nl80211: Adding bridge ip neigh failed: %s",
8706                            strerror(errno));
8707         }
8708 errout:
8709         if (nl_lladdr)
8710                 nl_addr_put(nl_lladdr);
8711         if (nl_ipaddr)
8712                 nl_addr_put(nl_ipaddr);
8713         if (rn)
8714                 rtnl_neigh_put(rn);
8715         return res;
8716 #else /* CONFIG_LIBNL3_ROUTE */
8717         return -1;
8718 #endif /* CONFIG_LIBNL3_ROUTE */
8719 }
8720
8721
8722 static int wpa_driver_br_delete_ip_neigh(void *priv, u8 version,
8723                                          const u8 *ipaddr)
8724 {
8725 #ifdef CONFIG_LIBNL3_ROUTE
8726         struct i802_bss *bss = priv;
8727         struct wpa_driver_nl80211_data *drv = bss->drv;
8728         struct rtnl_neigh *rn;
8729         struct nl_addr *nl_ipaddr;
8730         int family, addrsize;
8731         int res;
8732
8733         if (!ipaddr)
8734                 return -EINVAL;
8735
8736         if (version == 4) {
8737                 family = AF_INET;
8738                 addrsize = 4;
8739         } else if (version == 6) {
8740                 family = AF_INET6;
8741                 addrsize = 16;
8742         } else {
8743                 return -EINVAL;
8744         }
8745
8746         if (bss->br_ifindex == 0) {
8747                 wpa_printf(MSG_DEBUG,
8748                            "nl80211: bridge must be set to delete an ip neigh");
8749                 return -1;
8750         }
8751
8752         if (!drv->rtnl_sk) {
8753                 wpa_printf(MSG_DEBUG,
8754                            "nl80211: nl_sock for NETLINK_ROUTE is not initialized");
8755                 return -1;
8756         }
8757
8758         rn = rtnl_neigh_alloc();
8759         if (rn == NULL)
8760                 return -ENOMEM;
8761
8762         /* set the destination ip address for neigh */
8763         nl_ipaddr = nl_addr_build(family, (void *) ipaddr, addrsize);
8764         if (nl_ipaddr == NULL) {
8765                 wpa_printf(MSG_DEBUG, "nl80211: nl_ipaddr build failed");
8766                 res = -ENOMEM;
8767                 goto errout;
8768         }
8769         res = rtnl_neigh_set_dst(rn, nl_ipaddr);
8770         if (res) {
8771                 wpa_printf(MSG_DEBUG,
8772                            "nl80211: neigh set destination addr failed");
8773                 goto errout;
8774         }
8775
8776         rtnl_neigh_set_ifindex(rn, bss->br_ifindex);
8777
8778         res = rtnl_neigh_delete(drv->rtnl_sk, rn, 0);
8779         if (res) {
8780                 wpa_printf(MSG_DEBUG,
8781                            "nl80211: Deleting bridge ip neigh failed: %s",
8782                            strerror(errno));
8783         }
8784 errout:
8785         if (nl_ipaddr)
8786                 nl_addr_put(nl_ipaddr);
8787         if (rn)
8788                 rtnl_neigh_put(rn);
8789         return res;
8790 #else /* CONFIG_LIBNL3_ROUTE */
8791         return -1;
8792 #endif /* CONFIG_LIBNL3_ROUTE */
8793 }
8794
8795
8796 static int linux_write_system_file(const char *path, unsigned int val)
8797 {
8798         char buf[50];
8799         int fd, len;
8800
8801         len = os_snprintf(buf, sizeof(buf), "%u\n", val);
8802         if (os_snprintf_error(sizeof(buf), len))
8803                 return -1;
8804
8805         fd = open(path, O_WRONLY);
8806         if (fd < 0)
8807                 return -1;
8808
8809         if (write(fd, buf, len) < 0) {
8810                 wpa_printf(MSG_DEBUG,
8811                            "nl80211: Failed to write Linux system file: %s with the value of %d",
8812                            path, val);
8813                 close(fd);
8814                 return -1;
8815         }
8816         close(fd);
8817
8818         return 0;
8819 }
8820
8821
8822 static const char * drv_br_port_attr_str(enum drv_br_port_attr attr)
8823 {
8824         switch (attr) {
8825         case DRV_BR_PORT_ATTR_PROXYARP:
8826                 return "proxyarp_wifi";
8827         case DRV_BR_PORT_ATTR_HAIRPIN_MODE:
8828                 return "hairpin_mode";
8829         }
8830
8831         return NULL;
8832 }
8833
8834
8835 static int wpa_driver_br_port_set_attr(void *priv, enum drv_br_port_attr attr,
8836                                        unsigned int val)
8837 {
8838         struct i802_bss *bss = priv;
8839         char path[128];
8840         const char *attr_txt;
8841
8842         attr_txt = drv_br_port_attr_str(attr);
8843         if (attr_txt == NULL)
8844                 return -EINVAL;
8845
8846         os_snprintf(path, sizeof(path), "/sys/class/net/%s/brport/%s",
8847                     bss->ifname, attr_txt);
8848
8849         if (linux_write_system_file(path, val))
8850                 return -1;
8851
8852         return 0;
8853 }
8854
8855
8856 static const char * drv_br_net_param_str(enum drv_br_net_param param)
8857 {
8858         switch (param) {
8859         case DRV_BR_NET_PARAM_GARP_ACCEPT:
8860                 return "arp_accept";
8861         default:
8862                 return NULL;
8863         }
8864 }
8865
8866
8867 static int wpa_driver_br_set_net_param(void *priv, enum drv_br_net_param param,
8868                                        unsigned int val)
8869 {
8870         struct i802_bss *bss = priv;
8871         char path[128];
8872         const char *param_txt;
8873         int ip_version = 4;
8874
8875         if (param == DRV_BR_MULTICAST_SNOOPING) {
8876                 os_snprintf(path, sizeof(path),
8877                             "/sys/devices/virtual/net/%s/bridge/multicast_snooping",
8878                             bss->brname);
8879                 goto set_val;
8880         }
8881
8882         param_txt = drv_br_net_param_str(param);
8883         if (param_txt == NULL)
8884                 return -EINVAL;
8885
8886         switch (param) {
8887                 case DRV_BR_NET_PARAM_GARP_ACCEPT:
8888                         ip_version = 4;
8889                         break;
8890                 default:
8891                         return -EINVAL;
8892         }
8893
8894         os_snprintf(path, sizeof(path), "/proc/sys/net/ipv%d/conf/%s/%s",
8895                     ip_version, bss->brname, param_txt);
8896
8897 set_val:
8898         if (linux_write_system_file(path, val))
8899                 return -1;
8900
8901         return 0;
8902 }
8903
8904
8905 #ifdef CONFIG_DRIVER_NL80211_QCA
8906
8907 static int hw_mode_to_qca_acs(enum hostapd_hw_mode hw_mode)
8908 {
8909         switch (hw_mode) {
8910         case HOSTAPD_MODE_IEEE80211B:
8911                 return QCA_ACS_MODE_IEEE80211B;
8912         case HOSTAPD_MODE_IEEE80211G:
8913                 return QCA_ACS_MODE_IEEE80211G;
8914         case HOSTAPD_MODE_IEEE80211A:
8915                 return QCA_ACS_MODE_IEEE80211A;
8916         case HOSTAPD_MODE_IEEE80211AD:
8917                 return QCA_ACS_MODE_IEEE80211AD;
8918         case HOSTAPD_MODE_IEEE80211ANY:
8919                 return QCA_ACS_MODE_IEEE80211ANY;
8920         default:
8921                 return -1;
8922         }
8923 }
8924
8925
8926 static int add_acs_freq_list(struct nl_msg *msg, const int *freq_list)
8927 {
8928         int i, len, ret;
8929         u32 *freqs;
8930
8931         if (!freq_list)
8932                 return 0;
8933         len = int_array_len(freq_list);
8934         freqs = os_malloc(sizeof(u32) * len);
8935         if (!freqs)
8936                 return -1;
8937         for (i = 0; i < len; i++)
8938                 freqs[i] = freq_list[i];
8939         ret = nla_put(msg, QCA_WLAN_VENDOR_ATTR_ACS_FREQ_LIST,
8940                       sizeof(u32) * len, freqs);
8941         os_free(freqs);
8942         return ret;
8943 }
8944
8945
8946 static int wpa_driver_do_acs(void *priv, struct drv_acs_params *params)
8947 {
8948         struct i802_bss *bss = priv;
8949         struct wpa_driver_nl80211_data *drv = bss->drv;
8950         struct nl_msg *msg;
8951         struct nlattr *data;
8952         int ret;
8953         int mode;
8954
8955         mode = hw_mode_to_qca_acs(params->hw_mode);
8956         if (mode < 0)
8957                 return -1;
8958
8959         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
8960             nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
8961             nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
8962                         QCA_NL80211_VENDOR_SUBCMD_DO_ACS) ||
8963             !(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
8964             nla_put_u8(msg, QCA_WLAN_VENDOR_ATTR_ACS_HW_MODE, mode) ||
8965             (params->ht_enabled &&
8966              nla_put_flag(msg, QCA_WLAN_VENDOR_ATTR_ACS_HT_ENABLED)) ||
8967             (params->ht40_enabled &&
8968              nla_put_flag(msg, QCA_WLAN_VENDOR_ATTR_ACS_HT40_ENABLED)) ||
8969             (params->vht_enabled &&
8970              nla_put_flag(msg, QCA_WLAN_VENDOR_ATTR_ACS_VHT_ENABLED)) ||
8971             nla_put_u16(msg, QCA_WLAN_VENDOR_ATTR_ACS_CHWIDTH,
8972                         params->ch_width) ||
8973             (params->ch_list_len &&
8974              nla_put(msg, QCA_WLAN_VENDOR_ATTR_ACS_CH_LIST, params->ch_list_len,
8975                      params->ch_list)) ||
8976             add_acs_freq_list(msg, params->freq_list)) {
8977                 nlmsg_free(msg);
8978                 return -ENOBUFS;
8979         }
8980         nla_nest_end(msg, data);
8981
8982         wpa_printf(MSG_DEBUG,
8983                    "nl80211: ACS Params: HW_MODE: %d HT: %d HT40: %d VHT: %d BW: %d CH_LIST_LEN: %u",
8984                    params->hw_mode, params->ht_enabled, params->ht40_enabled,
8985                    params->vht_enabled, params->ch_width, params->ch_list_len);
8986
8987         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8988         if (ret) {
8989                 wpa_printf(MSG_DEBUG,
8990                            "nl80211: Failed to invoke driver ACS function: %s",
8991                            strerror(errno));
8992         }
8993         return ret;
8994 }
8995
8996
8997 static int nl80211_set_band(void *priv, enum set_band band)
8998 {
8999         struct i802_bss *bss = priv;
9000         struct wpa_driver_nl80211_data *drv = bss->drv;
9001         struct nl_msg *msg;
9002         struct nlattr *data;
9003         int ret;
9004         enum qca_set_band qca_band;
9005
9006         if (!drv->setband_vendor_cmd_avail)
9007                 return -1;
9008
9009         switch (band) {
9010         case WPA_SETBAND_AUTO:
9011                 qca_band = QCA_SETBAND_AUTO;
9012                 break;
9013         case WPA_SETBAND_5G:
9014                 qca_band = QCA_SETBAND_5G;
9015                 break;
9016         case WPA_SETBAND_2G:
9017                 qca_band = QCA_SETBAND_2G;
9018                 break;
9019         default:
9020                 return -1;
9021         }
9022
9023         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
9024             nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
9025             nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
9026                         QCA_NL80211_VENDOR_SUBCMD_SETBAND) ||
9027             !(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
9028             nla_put_u32(msg, QCA_WLAN_VENDOR_ATTR_SETBAND_VALUE, qca_band)) {
9029                 nlmsg_free(msg);
9030                 return -ENOBUFS;
9031         }
9032         nla_nest_end(msg, data);
9033
9034         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
9035         if (ret) {
9036                 wpa_printf(MSG_DEBUG,
9037                            "nl80211: Driver setband function failed: %s",
9038                            strerror(errno));
9039         }
9040         return ret;
9041 }
9042
9043
9044 struct nl80211_pcl {
9045         unsigned int num;
9046         unsigned int *freq_list;
9047 };
9048
9049 static int preferred_freq_info_handler(struct nl_msg *msg, void *arg)
9050 {
9051         struct nlattr *tb[NL80211_ATTR_MAX + 1];
9052         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
9053         struct nl80211_pcl *param = arg;
9054         struct nlattr *nl_vend, *attr;
9055         enum qca_iface_type iface_type;
9056         struct nlattr *tb_vendor[QCA_WLAN_VENDOR_ATTR_MAX + 1];
9057         unsigned int num, max_num;
9058         u32 *freqs;
9059
9060         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
9061                   genlmsg_attrlen(gnlh, 0), NULL);
9062
9063         nl_vend = tb[NL80211_ATTR_VENDOR_DATA];
9064         if (!nl_vend)
9065                 return NL_SKIP;
9066
9067         nla_parse(tb_vendor, QCA_WLAN_VENDOR_ATTR_MAX,
9068                   nla_data(nl_vend), nla_len(nl_vend), NULL);
9069
9070         attr = tb_vendor[
9071                 QCA_WLAN_VENDOR_ATTR_GET_PREFERRED_FREQ_LIST_IFACE_TYPE];
9072         if (!attr) {
9073                 wpa_printf(MSG_ERROR, "nl80211: iface_type couldn't be found");
9074                 param->num = 0;
9075                 return NL_SKIP;
9076         }
9077
9078         iface_type = (enum qca_iface_type) nla_get_u32(attr);
9079         wpa_printf(MSG_DEBUG, "nl80211: Driver returned iface_type=%d",
9080                    iface_type);
9081
9082         attr = tb_vendor[QCA_WLAN_VENDOR_ATTR_GET_PREFERRED_FREQ_LIST];
9083         if (!attr) {
9084                 wpa_printf(MSG_ERROR,
9085                            "nl80211: preferred_freq_list couldn't be found");
9086                 param->num = 0;
9087                 return NL_SKIP;
9088         }
9089
9090         /*
9091          * param->num has the maximum number of entries for which there
9092          * is room in the freq_list provided by the caller.
9093          */
9094         freqs = nla_data(attr);
9095         max_num = nla_len(attr) / sizeof(u32);
9096         if (max_num > param->num)
9097                 max_num = param->num;
9098         for (num = 0; num < max_num; num++)
9099                 param->freq_list[num] = freqs[num];
9100         param->num = num;
9101
9102         return NL_SKIP;
9103 }
9104
9105
9106 static int nl80211_get_pref_freq_list(void *priv,
9107                                       enum wpa_driver_if_type if_type,
9108                                       unsigned int *num,
9109                                       unsigned int *freq_list)
9110 {
9111         struct i802_bss *bss = priv;
9112         struct wpa_driver_nl80211_data *drv = bss->drv;
9113         struct nl_msg *msg;
9114         int ret;
9115         unsigned int i;
9116         struct nlattr *params;
9117         struct nl80211_pcl param;
9118         enum qca_iface_type iface_type;
9119
9120         if (!drv->get_pref_freq_list)
9121                 return -1;
9122
9123         switch (if_type) {
9124         case WPA_IF_STATION:
9125                 iface_type = QCA_IFACE_TYPE_STA;
9126                 break;
9127         case WPA_IF_AP_BSS:
9128                 iface_type = QCA_IFACE_TYPE_AP;
9129                 break;
9130         case WPA_IF_P2P_GO:
9131                 iface_type = QCA_IFACE_TYPE_P2P_GO;
9132                 break;
9133         case WPA_IF_P2P_CLIENT:
9134                 iface_type = QCA_IFACE_TYPE_P2P_CLIENT;
9135                 break;
9136         case WPA_IF_IBSS:
9137                 iface_type = QCA_IFACE_TYPE_IBSS;
9138                 break;
9139         case WPA_IF_TDLS:
9140                 iface_type = QCA_IFACE_TYPE_TDLS;
9141                 break;
9142         default:
9143                 return -1;
9144         }
9145
9146         param.num = *num;
9147         param.freq_list = freq_list;
9148
9149         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
9150             nla_put_u32(msg, NL80211_ATTR_IFINDEX, drv->ifindex) ||
9151             nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
9152             nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
9153                         QCA_NL80211_VENDOR_SUBCMD_GET_PREFERRED_FREQ_LIST) ||
9154             !(params = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
9155             nla_put_u32(msg,
9156                         QCA_WLAN_VENDOR_ATTR_GET_PREFERRED_FREQ_LIST_IFACE_TYPE,
9157                         iface_type)) {
9158                 wpa_printf(MSG_ERROR,
9159                            "%s: err in adding vendor_cmd and vendor_data",
9160                            __func__);
9161                 nlmsg_free(msg);
9162                 return -1;
9163         }
9164         nla_nest_end(msg, params);
9165
9166         os_memset(freq_list, 0, *num * sizeof(freq_list[0]));
9167         ret = send_and_recv_msgs(drv, msg, preferred_freq_info_handler, &param);
9168         if (ret) {
9169                 wpa_printf(MSG_ERROR,
9170                            "%s: err in send_and_recv_msgs", __func__);
9171                 return ret;
9172         }
9173
9174         *num = param.num;
9175
9176         for (i = 0; i < *num; i++) {
9177                 wpa_printf(MSG_DEBUG, "nl80211: preferred_channel_list[%d]=%d",
9178                            i, freq_list[i]);
9179         }
9180
9181         return 0;
9182 }
9183
9184
9185 static int nl80211_set_prob_oper_freq(void *priv, unsigned int freq)
9186 {
9187         struct i802_bss *bss = priv;
9188         struct wpa_driver_nl80211_data *drv = bss->drv;
9189         struct nl_msg *msg;
9190         int ret;
9191         struct nlattr *params;
9192
9193         if (!drv->set_prob_oper_freq)
9194                 return -1;
9195
9196         wpa_printf(MSG_DEBUG,
9197                    "nl80211: Set P2P probable operating freq %u for ifindex %d",
9198                    freq, bss->ifindex);
9199
9200         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
9201             nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
9202             nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
9203                         QCA_NL80211_VENDOR_SUBCMD_SET_PROBABLE_OPER_CHANNEL) ||
9204             !(params = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
9205             nla_put_u32(msg,
9206                         QCA_WLAN_VENDOR_ATTR_PROBABLE_OPER_CHANNEL_IFACE_TYPE,
9207                         QCA_IFACE_TYPE_P2P_CLIENT) ||
9208             nla_put_u32(msg,
9209                         QCA_WLAN_VENDOR_ATTR_PROBABLE_OPER_CHANNEL_FREQ,
9210                         freq)) {
9211                 wpa_printf(MSG_ERROR,
9212                            "%s: err in adding vendor_cmd and vendor_data",
9213                            __func__);
9214                 nlmsg_free(msg);
9215                 return -1;
9216         }
9217         nla_nest_end(msg, params);
9218
9219         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
9220         msg = NULL;
9221         if (ret) {
9222                 wpa_printf(MSG_ERROR, "%s: err in send_and_recv_msgs",
9223                            __func__);
9224                 return ret;
9225         }
9226         nlmsg_free(msg);
9227         return 0;
9228 }
9229
9230
9231 static int nl80211_p2p_lo_start(void *priv, unsigned int freq,
9232                                 unsigned int period, unsigned int interval,
9233                                 unsigned int count, const u8 *device_types,
9234                                 size_t dev_types_len,
9235                                 const u8 *ies, size_t ies_len)
9236 {
9237         struct i802_bss *bss = priv;
9238         struct wpa_driver_nl80211_data *drv = bss->drv;
9239         struct nl_msg *msg;
9240         struct nlattr *container;
9241         int ret;
9242
9243         wpa_printf(MSG_DEBUG,
9244                    "nl80211: Start P2P Listen offload: freq=%u, period=%u, interval=%u, count=%u",
9245                    freq, period, interval, count);
9246
9247         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_P2P_LISTEN_OFFLOAD))
9248                 return -1;
9249
9250         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
9251             nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
9252             nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
9253                         QCA_NL80211_VENDOR_SUBCMD_P2P_LISTEN_OFFLOAD_START))
9254                 goto fail;
9255
9256         container = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
9257         if (!container)
9258                 goto fail;
9259
9260         if (nla_put_u32(msg, QCA_WLAN_VENDOR_ATTR_P2P_LISTEN_OFFLOAD_CHANNEL,
9261                         freq) ||
9262             nla_put_u32(msg, QCA_WLAN_VENDOR_ATTR_P2P_LISTEN_OFFLOAD_PERIOD,
9263                         period) ||
9264             nla_put_u32(msg, QCA_WLAN_VENDOR_ATTR_P2P_LISTEN_OFFLOAD_INTERVAL,
9265                         interval) ||
9266             nla_put_u32(msg, QCA_WLAN_VENDOR_ATTR_P2P_LISTEN_OFFLOAD_COUNT,
9267                         count) ||
9268             nla_put(msg, QCA_WLAN_VENDOR_ATTR_P2P_LISTEN_OFFLOAD_DEVICE_TYPES,
9269                     dev_types_len, device_types) ||
9270             nla_put(msg, QCA_WLAN_VENDOR_ATTR_P2P_LISTEN_OFFLOAD_VENDOR_IE,
9271                     ies_len, ies))
9272                 goto fail;
9273
9274         nla_nest_end(msg, container);
9275         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
9276         msg = NULL;
9277         if (ret) {
9278                 wpa_printf(MSG_DEBUG,
9279                            "nl80211: Failed to send P2P Listen offload vendor command");
9280                 goto fail;
9281         }
9282
9283         return 0;
9284
9285 fail:
9286         nlmsg_free(msg);
9287         return -1;
9288 }
9289
9290
9291 static int nl80211_p2p_lo_stop(void *priv)
9292 {
9293         struct i802_bss *bss = priv;
9294         struct wpa_driver_nl80211_data *drv = bss->drv;
9295         struct nl_msg *msg;
9296
9297         wpa_printf(MSG_DEBUG, "nl80211: Stop P2P Listen offload");
9298
9299         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_P2P_LISTEN_OFFLOAD))
9300                 return -1;
9301
9302         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
9303             nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
9304             nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
9305                         QCA_NL80211_VENDOR_SUBCMD_P2P_LISTEN_OFFLOAD_STOP)) {
9306                 nlmsg_free(msg);
9307                 return -1;
9308         }
9309
9310         return send_and_recv_msgs(drv, msg, NULL, NULL);
9311 }
9312
9313 #endif /* CONFIG_DRIVER_NL80211_QCA */
9314
9315
9316 static int nl80211_write_to_file(const char *name, unsigned int val)
9317 {
9318         int fd, len;
9319         char tmp[128];
9320
9321         fd = open(name, O_RDWR);
9322         if (fd < 0) {
9323                 wpa_printf(MSG_ERROR, "nl80211: Failed to open %s: %s",
9324                            name, strerror(errno));
9325                 return fd;
9326         }
9327
9328         len = os_snprintf(tmp, sizeof(tmp), "%u\n", val);
9329         len = write(fd, tmp, len);
9330         if (len < 0)
9331                 wpa_printf(MSG_ERROR, "nl80211: Failed to write to %s: %s",
9332                            name, strerror(errno));
9333         close(fd);
9334
9335         return 0;
9336 }
9337
9338
9339 static int nl80211_configure_data_frame_filters(void *priv, u32 filter_flags)
9340 {
9341         struct i802_bss *bss = priv;
9342         char path[128];
9343         int ret;
9344
9345         wpa_printf(MSG_DEBUG, "nl80211: Data frame filter flags=0x%x",
9346                    filter_flags);
9347
9348         /* Configure filtering of unicast frame encrypted using GTK */
9349         ret = os_snprintf(path, sizeof(path),
9350                           "/proc/sys/net/ipv4/conf/%s/drop_unicast_in_l2_multicast",
9351                           bss->ifname);
9352         if (os_snprintf_error(sizeof(path), ret))
9353                 return -1;
9354
9355         ret = nl80211_write_to_file(path,
9356                                     !!(filter_flags &
9357                                        WPA_DATA_FRAME_FILTER_FLAG_GTK));
9358         if (ret) {
9359                 wpa_printf(MSG_ERROR,
9360                            "nl80211: Failed to set IPv4 unicast in multicast filter");
9361                 return ret;
9362         }
9363
9364         os_snprintf(path, sizeof(path),
9365                     "/proc/sys/net/ipv6/conf/%s/drop_unicast_in_l2_multicast",
9366                     bss->ifname);
9367         ret = nl80211_write_to_file(path,
9368                                     !!(filter_flags &
9369                                        WPA_DATA_FRAME_FILTER_FLAG_GTK));
9370
9371         if (ret) {
9372                 wpa_printf(MSG_ERROR,
9373                            "nl80211: Failed to set IPv6 unicast in multicast filter");
9374                 return ret;
9375         }
9376
9377         /* Configure filtering of unicast frame encrypted using GTK */
9378         os_snprintf(path, sizeof(path),
9379                     "/proc/sys/net/ipv4/conf/%s/drop_gratuitous_arp",
9380                     bss->ifname);
9381         ret = nl80211_write_to_file(path,
9382                                     !!(filter_flags &
9383                                        WPA_DATA_FRAME_FILTER_FLAG_ARP));
9384         if (ret) {
9385                 wpa_printf(MSG_ERROR,
9386                            "nl80211: Failed set gratuitous ARP filter");
9387                 return ret;
9388         }
9389
9390         /* Configure filtering of IPv6 NA frames */
9391         os_snprintf(path, sizeof(path),
9392                     "/proc/sys/net/ipv6/conf/%s/drop_unsolicited_na",
9393                     bss->ifname);
9394         ret = nl80211_write_to_file(path,
9395                                     !!(filter_flags &
9396                                        WPA_DATA_FRAME_FILTER_FLAG_NA));
9397         if (ret) {
9398                 wpa_printf(MSG_ERROR,
9399                            "nl80211: Failed to set unsolicited NA filter");
9400                 return ret;
9401         }
9402
9403         return 0;
9404 }
9405
9406
9407 static int nl80211_get_ext_capab(void *priv, enum wpa_driver_if_type type,
9408                                  const u8 **ext_capa, const u8 **ext_capa_mask,
9409                                  unsigned int *ext_capa_len)
9410 {
9411         struct i802_bss *bss = priv;
9412         struct wpa_driver_nl80211_data *drv = bss->drv;
9413         enum nl80211_iftype nlmode;
9414         unsigned int i;
9415
9416         if (!ext_capa || !ext_capa_mask || !ext_capa_len)
9417                 return -1;
9418
9419         nlmode = wpa_driver_nl80211_if_type(type);
9420
9421         /* By default, use the per-radio values */
9422         *ext_capa = drv->extended_capa;
9423         *ext_capa_mask = drv->extended_capa_mask;
9424         *ext_capa_len = drv->extended_capa_len;
9425
9426         /* Replace the default value if a per-interface type value exists */
9427         for (i = 0; i < drv->num_iface_ext_capa; i++) {
9428                 if (nlmode == drv->iface_ext_capa[i].iftype) {
9429                         *ext_capa = drv->iface_ext_capa[i].ext_capa;
9430                         *ext_capa_mask = drv->iface_ext_capa[i].ext_capa_mask;
9431                         *ext_capa_len = drv->iface_ext_capa[i].ext_capa_len;
9432                         break;
9433                 }
9434         }
9435
9436         return 0;
9437 }
9438
9439
9440 const struct wpa_driver_ops wpa_driver_nl80211_ops = {
9441         .name = "nl80211",
9442         .desc = "Linux nl80211/cfg80211",
9443         .get_bssid = wpa_driver_nl80211_get_bssid,
9444         .get_ssid = wpa_driver_nl80211_get_ssid,
9445         .set_key = driver_nl80211_set_key,
9446         .scan2 = driver_nl80211_scan2,
9447         .sched_scan = wpa_driver_nl80211_sched_scan,
9448         .stop_sched_scan = wpa_driver_nl80211_stop_sched_scan,
9449         .get_scan_results2 = wpa_driver_nl80211_get_scan_results,
9450         .abort_scan = wpa_driver_nl80211_abort_scan,
9451         .deauthenticate = driver_nl80211_deauthenticate,
9452         .authenticate = driver_nl80211_authenticate,
9453         .associate = wpa_driver_nl80211_associate,
9454         .global_init = nl80211_global_init,
9455         .global_deinit = nl80211_global_deinit,
9456         .init2 = wpa_driver_nl80211_init,
9457         .deinit = driver_nl80211_deinit,
9458         .get_capa = wpa_driver_nl80211_get_capa,
9459         .set_operstate = wpa_driver_nl80211_set_operstate,
9460         .set_supp_port = wpa_driver_nl80211_set_supp_port,
9461         .set_country = wpa_driver_nl80211_set_country,
9462         .get_country = wpa_driver_nl80211_get_country,
9463         .set_ap = wpa_driver_nl80211_set_ap,
9464         .set_acl = wpa_driver_nl80211_set_acl,
9465         .if_add = wpa_driver_nl80211_if_add,
9466         .if_remove = driver_nl80211_if_remove,
9467         .send_mlme = driver_nl80211_send_mlme,
9468         .get_hw_feature_data = nl80211_get_hw_feature_data,
9469         .sta_add = wpa_driver_nl80211_sta_add,
9470         .sta_remove = driver_nl80211_sta_remove,
9471         .hapd_send_eapol = wpa_driver_nl80211_hapd_send_eapol,
9472         .sta_set_flags = wpa_driver_nl80211_sta_set_flags,
9473         .hapd_init = i802_init,
9474         .hapd_deinit = i802_deinit,
9475         .set_wds_sta = i802_set_wds_sta,
9476         .get_seqnum = i802_get_seqnum,
9477         .flush = i802_flush,
9478         .get_inact_sec = i802_get_inact_sec,
9479         .sta_clear_stats = i802_sta_clear_stats,
9480         .set_rts = i802_set_rts,
9481         .set_frag = i802_set_frag,
9482         .set_tx_queue_params = i802_set_tx_queue_params,
9483         .set_sta_vlan = driver_nl80211_set_sta_vlan,
9484         .sta_deauth = i802_sta_deauth,
9485         .sta_disassoc = i802_sta_disassoc,
9486         .read_sta_data = driver_nl80211_read_sta_data,
9487         .set_freq = i802_set_freq,
9488         .send_action = driver_nl80211_send_action,
9489         .send_action_cancel_wait = wpa_driver_nl80211_send_action_cancel_wait,
9490         .remain_on_channel = wpa_driver_nl80211_remain_on_channel,
9491         .cancel_remain_on_channel =
9492         wpa_driver_nl80211_cancel_remain_on_channel,
9493         .probe_req_report = driver_nl80211_probe_req_report,
9494         .deinit_ap = wpa_driver_nl80211_deinit_ap,
9495         .deinit_p2p_cli = wpa_driver_nl80211_deinit_p2p_cli,
9496         .resume = wpa_driver_nl80211_resume,
9497         .signal_monitor = nl80211_signal_monitor,
9498         .signal_poll = nl80211_signal_poll,
9499         .send_frame = nl80211_send_frame,
9500         .set_param = nl80211_set_param,
9501         .get_radio_name = nl80211_get_radio_name,
9502         .add_pmkid = nl80211_add_pmkid,
9503         .remove_pmkid = nl80211_remove_pmkid,
9504         .flush_pmkid = nl80211_flush_pmkid,
9505         .set_rekey_info = nl80211_set_rekey_info,
9506         .poll_client = nl80211_poll_client,
9507         .set_p2p_powersave = nl80211_set_p2p_powersave,
9508         .start_dfs_cac = nl80211_start_radar_detection,
9509         .stop_ap = wpa_driver_nl80211_stop_ap,
9510 #ifdef CONFIG_TDLS
9511         .send_tdls_mgmt = nl80211_send_tdls_mgmt,
9512         .tdls_oper = nl80211_tdls_oper,
9513         .tdls_enable_channel_switch = nl80211_tdls_enable_channel_switch,
9514         .tdls_disable_channel_switch = nl80211_tdls_disable_channel_switch,
9515 #endif /* CONFIG_TDLS */
9516         .update_ft_ies = wpa_driver_nl80211_update_ft_ies,
9517         .get_mac_addr = wpa_driver_nl80211_get_macaddr,
9518         .get_survey = wpa_driver_nl80211_get_survey,
9519         .status = wpa_driver_nl80211_status,
9520         .switch_channel = nl80211_switch_channel,
9521 #ifdef ANDROID_P2P
9522         .set_noa = wpa_driver_set_p2p_noa,
9523         .get_noa = wpa_driver_get_p2p_noa,
9524         .set_ap_wps_ie = wpa_driver_set_ap_wps_p2p_ie,
9525 #endif /* ANDROID_P2P */
9526 #ifdef ANDROID
9527 #ifndef ANDROID_LIB_STUB
9528         .driver_cmd = wpa_driver_nl80211_driver_cmd,
9529 #endif /* !ANDROID_LIB_STUB */
9530 #endif /* ANDROID */
9531         .vendor_cmd = nl80211_vendor_cmd,
9532         .set_qos_map = nl80211_set_qos_map,
9533         .set_wowlan = nl80211_set_wowlan,
9534         .set_mac_addr = nl80211_set_mac_addr,
9535 #ifdef CONFIG_MESH
9536         .init_mesh = wpa_driver_nl80211_init_mesh,
9537         .join_mesh = wpa_driver_nl80211_join_mesh,
9538         .leave_mesh = wpa_driver_nl80211_leave_mesh,
9539 #endif /* CONFIG_MESH */
9540         .br_add_ip_neigh = wpa_driver_br_add_ip_neigh,
9541         .br_delete_ip_neigh = wpa_driver_br_delete_ip_neigh,
9542         .br_port_set_attr = wpa_driver_br_port_set_attr,
9543         .br_set_net_param = wpa_driver_br_set_net_param,
9544         .add_tx_ts = nl80211_add_ts,
9545         .del_tx_ts = nl80211_del_ts,
9546         .get_ifindex = nl80211_get_ifindex,
9547 #ifdef CONFIG_DRIVER_NL80211_QCA
9548         .roaming = nl80211_roaming,
9549         .do_acs = wpa_driver_do_acs,
9550         .set_band = nl80211_set_band,
9551         .get_pref_freq_list = nl80211_get_pref_freq_list,
9552         .set_prob_oper_freq = nl80211_set_prob_oper_freq,
9553         .p2p_lo_start = nl80211_p2p_lo_start,
9554         .p2p_lo_stop = nl80211_p2p_lo_stop,
9555         .set_default_scan_ies = nl80211_set_default_scan_ies,
9556 #endif /* CONFIG_DRIVER_NL80211_QCA */
9557         .configure_data_frame_filters = nl80211_configure_data_frame_filters,
9558         .get_ext_capab = nl80211_get_ext_capab,
9559 };