src/drivers/driver_nl80211.c

   1 /*
   2  * Driver interaction with Linux nl80211/cfg80211
   3  * Copyright (c) 2002-2015, Jouni Malinen <j@w1.fi>
   4  * Copyright (c) 2003-2004, Instant802 Networks, Inc.
   5  * Copyright (c) 2005-2006, Devicescape Software, Inc.
   6  * Copyright (c) 2007, Johannes Berg <johannes@sipsolutions.net>
   7  * Copyright (c) 2009-2010, Atheros Communications
   8  *
   9  * This software may be distributed under the terms of the BSD license.
  10  * See README for more details.
  11  */
  12
  13 #include "includes.h"
  14 #include <sys/types.h>
  15 #include <fcntl.h>
  16 #include <net/if.h>
  17 #include <netlink/genl/genl.h>
  18 #include <netlink/genl/ctrl.h>
  19 #ifdef CONFIG_LIBNL3_ROUTE
  20 #include <netlink/route/neighbour.h>
  21 #endif /* CONFIG_LIBNL3_ROUTE */
  22 #include <linux/rtnetlink.h>
  23 #include <netpacket/packet.h>
  24 #include <linux/errqueue.h>
  25
  26 #include "common.h"
  27 #include "eloop.h"
  28 #include "common/qca-vendor.h"
  29 #include "common/qca-vendor-attr.h"
  30 #include "common/ieee802_11_defs.h"
  31 #include "common/ieee802_11_common.h"
  32 #include "l2_packet/l2_packet.h"
  33 #include "netlink.h"
  34 #include "linux_defines.h"
  35 #include "linux_ioctl.h"
  36 #include "radiotap.h"
  37 #include "radiotap_iter.h"
  38 #include "rfkill.h"
  39 #include "driver_nl80211.h"
  40
  41
  42 #ifndef CONFIG_LIBNL20
  43 /*
  44  * libnl 1.1 has a bug, it tries to allocate socket numbers densely
  45  * but when you free a socket again it will mess up its bitmap and
  46  * and use the wrong number the next time it needs a socket ID.
  47  * Therefore, we wrap the handle alloc/destroy and add our own pid
  48  * accounting.
  49  */
  50 static uint32_t port_bitmap[32] = { 0 };
  51
  52 static struct nl_handle *nl80211_handle_alloc(void *cb)
  53 {
  54         struct nl_handle *handle;
  55         uint32_t pid = getpid() & 0x3FFFFF;
  56         int i;
  57
  58         handle = nl_handle_alloc_cb(cb);
  59
  60         for (i = 0; i < 1024; i++) {
  61                 if (port_bitmap[i / 32] & (1 << (i % 32)))
  62                         continue;
  63                 port_bitmap[i / 32] |= 1 << (i % 32);
  64                 pid += i << 22;
  65                 break;
  66         }
  67
  68         nl_socket_set_local_port(handle, pid);
  69
  70         return handle;
  71 }
  72
  73 static void nl80211_handle_destroy(struct nl_handle *handle)
  74 {
  75         uint32_t port = nl_socket_get_local_port(handle);
  76
  77         port >>= 22;
  78         port_bitmap[port / 32] &= ~(1 << (port % 32));
  79
  80         nl_handle_destroy(handle);
  81 }
  82 #endif /* CONFIG_LIBNL20 */
  83
  84
  85 #ifdef ANDROID
  86 /* system/core/libnl_2 does not include nl_socket_set_nonblocking() */
  87 #undef nl_socket_set_nonblocking
  88 #define nl_socket_set_nonblocking(h) android_nl_socket_set_nonblocking(h)
  89
  90 #endif /* ANDROID */
  91
  92
  93 static struct nl_handle * nl_create_handle(struct nl_cb *cb, const char *dbg)
  94 {
  95         struct nl_handle *handle;
  96
  97         handle = nl80211_handle_alloc(cb);
  98         if (handle == NULL) {
  99                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate netlink "
 100                            "callbacks (%s)", dbg);
 101                 return NULL;
 102         }
 103
 104         if (genl_connect(handle)) {
 105                 wpa_printf(MSG_ERROR, "nl80211: Failed to connect to generic "
 106                            "netlink (%s)", dbg);
 107                 nl80211_handle_destroy(handle);
 108                 return NULL;
 109         }
 110
 111         return handle;
 112 }
 113
 114
 115 static void nl_destroy_handles(struct nl_handle **handle)
 116 {
 117         if (*handle == NULL)
 118                 return;
 119         nl80211_handle_destroy(*handle);
 120         *handle = NULL;
 121 }
 122
 123
 124 #if __WORDSIZE == 64
 125 #define ELOOP_SOCKET_INVALID    (intptr_t) 0x8888888888888889ULL
 126 #else
 127 #define ELOOP_SOCKET_INVALID    (intptr_t) 0x88888889ULL
 128 #endif
 129
 130 static void nl80211_register_eloop_read(struct nl_handle **handle,
 131                                         eloop_sock_handler handler,
 132                                         void *eloop_data)
 133 {
 134 #ifdef CONFIG_LIBNL20
 135         /*
 136          * libnl uses a pretty small buffer (32 kB that gets converted to 64 kB)
 137          * by default. It is possible to hit that limit in some cases where
 138          * operations are blocked, e.g., with a burst of Deauthentication frames
 139          * to hostapd and STA entry deletion. Try to increase the buffer to make
 140          * this less likely to occur.
 141          */
 142         if (nl_socket_set_buffer_size(*handle, 262144, 0) < 0) {
 143                 wpa_printf(MSG_DEBUG,
 144                            "nl80211: Could not set nl_socket RX buffer size: %s",
 145                            strerror(errno));
 146                 /* continue anyway with the default (smaller) buffer */
 147         }
 148 #endif /* CONFIG_LIBNL20 */
 149
 150         nl_socket_set_nonblocking(*handle);
 151         eloop_register_read_sock(nl_socket_get_fd(*handle), handler,
 152                                  eloop_data, *handle);
 153         *handle = (void *) (((intptr_t) *handle) ^ ELOOP_SOCKET_INVALID);
 154 }
 155
 156
 157 static void nl80211_destroy_eloop_handle(struct nl_handle **handle)
 158 {
 159         *handle = (void *) (((intptr_t) *handle) ^ ELOOP_SOCKET_INVALID);
 160         eloop_unregister_read_sock(nl_socket_get_fd(*handle));
 161         nl_destroy_handles(handle);
 162 }
 163
 164
 165 static void nl80211_global_deinit(void *priv);
 166 static void nl80211_check_global(struct nl80211_global *global);
 167
 168 static void wpa_driver_nl80211_deinit(struct i802_bss *bss);
 169 static int wpa_driver_nl80211_set_mode_ibss(struct i802_bss *bss,
 170                                             struct hostapd_freq_params *freq);
 171
 172 static int
 173 wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv,
 174                                    const u8 *set_addr, int first,
 175                                    const char *driver_params);
 176 static int nl80211_send_frame_cmd(struct i802_bss *bss,
 177                                   unsigned int freq, unsigned int wait,
 178                                   const u8 *buf, size_t buf_len, u64 *cookie,
 179                                   int no_cck, int no_ack, int offchanok,
 180                                   const u16 *csa_offs, size_t csa_offs_len);
 181 static int wpa_driver_nl80211_probe_req_report(struct i802_bss *bss,
 182                                                int report);
 183
 184 #define IFIDX_ANY -1
 185
 186 static void add_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx,
 187                       int ifidx_reason);
 188 static void del_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx,
 189                       int ifidx_reason);
 190 static int have_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx,
 191                       int ifidx_reason);
 192
 193 static int nl80211_set_channel(struct i802_bss *bss,
 194                                struct hostapd_freq_params *freq, int set_chan);
 195 static int nl80211_disable_11b_rates(struct wpa_driver_nl80211_data *drv,
 196                                      int ifindex, int disabled);
 197
 198 static int nl80211_leave_ibss(struct wpa_driver_nl80211_data *drv,
 199                               int reset_mode);
 200
 201 static int i802_set_iface_flags(struct i802_bss *bss, int up);
 202 static int nl80211_set_param(void *priv, const char *param);
 203
 204
 205 /* Converts nl80211_chan_width to a common format */
 206 enum chan_width convert2width(int width)
 207 {
 208         switch (width) {
 209         case NL80211_CHAN_WIDTH_20_NOHT:
 210                 return CHAN_WIDTH_20_NOHT;
 211         case NL80211_CHAN_WIDTH_20:
 212                 return CHAN_WIDTH_20;
 213         case NL80211_CHAN_WIDTH_40:
 214                 return CHAN_WIDTH_40;
 215         case NL80211_CHAN_WIDTH_80:
 216                 return CHAN_WIDTH_80;
 217         case NL80211_CHAN_WIDTH_80P80:
 218                 return CHAN_WIDTH_80P80;
 219         case NL80211_CHAN_WIDTH_160:
 220                 return CHAN_WIDTH_160;
 221         }
 222         return CHAN_WIDTH_UNKNOWN;
 223 }
 224
 225
 226 int is_ap_interface(enum nl80211_iftype nlmode)
 227 {
 228         return nlmode == NL80211_IFTYPE_AP ||
 229                 nlmode == NL80211_IFTYPE_P2P_GO;
 230 }
 231
 232
 233 int is_sta_interface(enum nl80211_iftype nlmode)
 234 {
 235         return nlmode == NL80211_IFTYPE_STATION ||
 236                 nlmode == NL80211_IFTYPE_P2P_CLIENT;
 237 }
 238
 239
 240 static int is_p2p_net_interface(enum nl80211_iftype nlmode)
 241 {
 242         return nlmode == NL80211_IFTYPE_P2P_CLIENT ||
 243                 nlmode == NL80211_IFTYPE_P2P_GO;
 244 }
 245
 246
 247 struct i802_bss * get_bss_ifindex(struct wpa_driver_nl80211_data *drv,
 248                                   int ifindex)
 249 {
 250         struct i802_bss *bss;
 251
 252         for (bss = drv->first_bss; bss; bss = bss->next) {
 253                 if (bss->ifindex == ifindex)
 254                         return bss;
 255         }
 256
 257         return NULL;
 258 }
 259
 260
 261 static int is_mesh_interface(enum nl80211_iftype nlmode)
 262 {
 263         return nlmode == NL80211_IFTYPE_MESH_POINT;
 264 }
 265
 266
 267 void nl80211_mark_disconnected(struct wpa_driver_nl80211_data *drv)
 268 {
 269         if (drv->associated)
 270                 os_memcpy(drv->prev_bssid, drv->bssid, ETH_ALEN);
 271         drv->associated = 0;
 272         os_memset(drv->bssid, 0, ETH_ALEN);
 273 }
 274
 275
 276 /* nl80211 code */
 277 static int ack_handler(struct nl_msg *msg, void *arg)
 278 {
 279         int *err = arg;
 280         *err = 0;
 281         return NL_STOP;
 282 }
 283
 284 static int finish_handler(struct nl_msg *msg, void *arg)
 285 {
 286         int *ret = arg;
 287         *ret = 0;
 288         return NL_SKIP;
 289 }
 290
 291 static int error_handler(struct sockaddr_nl *nla, struct nlmsgerr *err,
 292                          void *arg)
 293 {
 294         int *ret = arg;
 295         *ret = err->error;
 296         return NL_SKIP;
 297 }
 298
 299
 300 static int no_seq_check(struct nl_msg *msg, void *arg)
 301 {
 302         return NL_OK;
 303 }
 304
 305
 306 static void nl80211_nlmsg_clear(struct nl_msg *msg)
 307 {
 308         /*
 309          * Clear nlmsg data, e.g., to make sure key material is not left in
 310          * heap memory for unnecessarily long time.
 311          */
 312         if (msg) {
 313                 struct nlmsghdr *hdr = nlmsg_hdr(msg);
 314                 void *data = nlmsg_data(hdr);
 315                 /*
 316                  * This would use nlmsg_datalen() or the older nlmsg_len() if
 317                  * only libnl were to maintain a stable API.. Neither will work
 318                  * with all released versions, so just calculate the length
 319                  * here.
 320                  */
 321                 int len = hdr->nlmsg_len - NLMSG_HDRLEN;
 322
 323                 os_memset(data, 0, len);
 324         }
 325 }
 326
 327
 328 static int send_and_recv(struct nl80211_global *global,
 329                          struct nl_handle *nl_handle, struct nl_msg *msg,
 330                          int (*valid_handler)(struct nl_msg *, void *),
 331                          void *valid_data)
 332 {
 333         struct nl_cb *cb;
 334         int err = -ENOMEM;
 335
 336         if (!msg)
 337                 return -ENOMEM;
 338
 339         cb = nl_cb_clone(global->nl_cb);
 340         if (!cb)
 341                 goto out;
 342
 343         err = nl_send_auto_complete(nl_handle, msg);
 344         if (err < 0)
 345                 goto out;
 346
 347         err = 1;
 348
 349         nl_cb_err(cb, NL_CB_CUSTOM, error_handler, &err);
 350         nl_cb_set(cb, NL_CB_FINISH, NL_CB_CUSTOM, finish_handler, &err);
 351         nl_cb_set(cb, NL_CB_ACK, NL_CB_CUSTOM, ack_handler, &err);
 352
 353         if (valid_handler)
 354                 nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM,
 355                           valid_handler, valid_data);
 356
 357         while (err > 0) {
 358                 int res = nl_recvmsgs(nl_handle, cb);
 359                 if (res < 0) {
 360                         wpa_printf(MSG_INFO,
 361                                    "nl80211: %s->nl_recvmsgs failed: %d",
 362                                    __func__, res);
 363                 }
 364         }
 365  out:
 366         nl_cb_put(cb);
 367         if (!valid_handler && valid_data == (void *) -1)
 368                 nl80211_nlmsg_clear(msg);
 369         nlmsg_free(msg);
 370         return err;
 371 }
 372
 373
 374 int send_and_recv_msgs(struct wpa_driver_nl80211_data *drv,
 375                        struct nl_msg *msg,
 376                        int (*valid_handler)(struct nl_msg *, void *),
 377                        void *valid_data)
 378 {
 379         return send_and_recv(drv->global, drv->global->nl, msg,
 380                              valid_handler, valid_data);
 381 }
 382
 383
 384 struct family_data {
 385         const char *group;
 386         int id;
 387 };
 388
 389
 390 static int family_handler(struct nl_msg *msg, void *arg)
 391 {
 392         struct family_data *res = arg;
 393         struct nlattr *tb[CTRL_ATTR_MAX + 1];
 394         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 395         struct nlattr *mcgrp;
 396         int i;
 397
 398         nla_parse(tb, CTRL_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 399                   genlmsg_attrlen(gnlh, 0), NULL);
 400         if (!tb[CTRL_ATTR_MCAST_GROUPS])
 401                 return NL_SKIP;
 402
 403         nla_for_each_nested(mcgrp, tb[CTRL_ATTR_MCAST_GROUPS], i) {
 404                 struct nlattr *tb2[CTRL_ATTR_MCAST_GRP_MAX + 1];
 405                 nla_parse(tb2, CTRL_ATTR_MCAST_GRP_MAX, nla_data(mcgrp),
 406                           nla_len(mcgrp), NULL);
 407                 if (!tb2[CTRL_ATTR_MCAST_GRP_NAME] ||
 408                     !tb2[CTRL_ATTR_MCAST_GRP_ID] ||
 409                     os_strncmp(nla_data(tb2[CTRL_ATTR_MCAST_GRP_NAME]),
 410                                res->group,
 411                                nla_len(tb2[CTRL_ATTR_MCAST_GRP_NAME])) != 0)
 412                         continue;
 413                 res->id = nla_get_u32(tb2[CTRL_ATTR_MCAST_GRP_ID]);
 414                 break;
 415         };
 416
 417         return NL_SKIP;
 418 }
 419
 420
 421 static int nl_get_multicast_id(struct nl80211_global *global,
 422                                const char *family, const char *group)
 423 {
 424         struct nl_msg *msg;
 425         int ret;
 426         struct family_data res = { group, -ENOENT };
 427
 428         msg = nlmsg_alloc();
 429         if (!msg)
 430                 return -ENOMEM;
 431         if (!genlmsg_put(msg, 0, 0, genl_ctrl_resolve(global->nl, "nlctrl"),
 432                          0, 0, CTRL_CMD_GETFAMILY, 0) ||
 433             nla_put_string(msg, CTRL_ATTR_FAMILY_NAME, family)) {
 434                 nlmsg_free(msg);
 435                 return -1;
 436         }
 437
 438         ret = send_and_recv(global, global->nl, msg, family_handler, &res);
 439         if (ret == 0)
 440                 ret = res.id;
 441         return ret;
 442 }
 443
 444
 445 void * nl80211_cmd(struct wpa_driver_nl80211_data *drv,
 446                    struct nl_msg *msg, int flags, uint8_t cmd)
 447 {
 448         if (TEST_FAIL())
 449                 return NULL;
 450         return genlmsg_put(msg, 0, 0, drv->global->nl80211_id,
 451                            0, flags, cmd, 0);
 452 }
 453
 454
 455 static int nl80211_set_iface_id(struct nl_msg *msg, struct i802_bss *bss)
 456 {
 457         if (bss->wdev_id_set)
 458                 return nla_put_u64(msg, NL80211_ATTR_WDEV, bss->wdev_id);
 459         return nla_put_u32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
 460 }
 461
 462
 463 struct nl_msg * nl80211_cmd_msg(struct i802_bss *bss, int flags, uint8_t cmd)
 464 {
 465         struct nl_msg *msg;
 466
 467         msg = nlmsg_alloc();
 468         if (!msg)
 469                 return NULL;
 470
 471         if (!nl80211_cmd(bss->drv, msg, flags, cmd) ||
 472             nl80211_set_iface_id(msg, bss) < 0) {
 473                 nlmsg_free(msg);
 474                 return NULL;
 475         }
 476
 477         return msg;
 478 }
 479
 480
 481 static struct nl_msg *
 482 nl80211_ifindex_msg(struct wpa_driver_nl80211_data *drv, int ifindex,
 483                     int flags, uint8_t cmd)
 484 {
 485         struct nl_msg *msg;
 486
 487         msg = nlmsg_alloc();
 488         if (!msg)
 489                 return NULL;
 490
 491         if (!nl80211_cmd(drv, msg, flags, cmd) ||
 492             nla_put_u32(msg, NL80211_ATTR_IFINDEX, ifindex)) {
 493                 nlmsg_free(msg);
 494                 return NULL;
 495         }
 496
 497         return msg;
 498 }
 499
 500
 501 struct nl_msg * nl80211_drv_msg(struct wpa_driver_nl80211_data *drv, int flags,
 502                                 uint8_t cmd)
 503 {
 504         return nl80211_ifindex_msg(drv, drv->ifindex, flags, cmd);
 505 }
 506
 507
 508 struct nl_msg * nl80211_bss_msg(struct i802_bss *bss, int flags, uint8_t cmd)
 509 {
 510         return nl80211_ifindex_msg(bss->drv, bss->ifindex, flags, cmd);
 511 }
 512
 513
 514 struct wiphy_idx_data {
 515         int wiphy_idx;
 516         enum nl80211_iftype nlmode;
 517         u8 *macaddr;
 518 };
 519
 520
 521 static int netdev_info_handler(struct nl_msg *msg, void *arg)
 522 {
 523         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 524         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 525         struct wiphy_idx_data *info = arg;
 526
 527         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 528                   genlmsg_attrlen(gnlh, 0), NULL);
 529
 530         if (tb[NL80211_ATTR_WIPHY])
 531                 info->wiphy_idx = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
 532
 533         if (tb[NL80211_ATTR_IFTYPE])
 534                 info->nlmode = nla_get_u32(tb[NL80211_ATTR_IFTYPE]);
 535
 536         if (tb[NL80211_ATTR_MAC] && info->macaddr)
 537                 os_memcpy(info->macaddr, nla_data(tb[NL80211_ATTR_MAC]),
 538                           ETH_ALEN);
 539
 540         return NL_SKIP;
 541 }
 542
 543
 544 int nl80211_get_wiphy_index(struct i802_bss *bss)
 545 {
 546         struct nl_msg *msg;
 547         struct wiphy_idx_data data = {
 548                 .wiphy_idx = -1,
 549                 .macaddr = NULL,
 550         };
 551
 552         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_GET_INTERFACE)))
 553                 return -1;
 554
 555         if (send_and_recv_msgs(bss->drv, msg, netdev_info_handler, &data) == 0)
 556                 return data.wiphy_idx;
 557         return -1;
 558 }
 559
 560
 561 static enum nl80211_iftype nl80211_get_ifmode(struct i802_bss *bss)
 562 {
 563         struct nl_msg *msg;
 564         struct wiphy_idx_data data = {
 565                 .nlmode = NL80211_IFTYPE_UNSPECIFIED,
 566                 .macaddr = NULL,
 567         };
 568
 569         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_GET_INTERFACE)))
 570                 return NL80211_IFTYPE_UNSPECIFIED;
 571
 572         if (send_and_recv_msgs(bss->drv, msg, netdev_info_handler, &data) == 0)
 573                 return data.nlmode;
 574         return NL80211_IFTYPE_UNSPECIFIED;
 575 }
 576
 577
 578 static int nl80211_get_macaddr(struct i802_bss *bss)
 579 {
 580         struct nl_msg *msg;
 581         struct wiphy_idx_data data = {
 582                 .macaddr = bss->addr,
 583         };
 584
 585         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_GET_INTERFACE)))
 586                 return -1;
 587
 588         return send_and_recv_msgs(bss->drv, msg, netdev_info_handler, &data);
 589 }
 590
 591
 592 static int nl80211_register_beacons(struct wpa_driver_nl80211_data *drv,
 593                                     struct nl80211_wiphy_data *w)
 594 {
 595         struct nl_msg *msg;
 596         int ret;
 597
 598         msg = nlmsg_alloc();
 599         if (!msg)
 600                 return -1;
 601
 602         if (!nl80211_cmd(drv, msg, 0, NL80211_CMD_REGISTER_BEACONS) ||
 603             nla_put_u32(msg, NL80211_ATTR_WIPHY, w->wiphy_idx)) {
 604                 nlmsg_free(msg);
 605                 return -1;
 606         }
 607
 608         ret = send_and_recv(drv->global, w->nl_beacons, msg, NULL, NULL);
 609         if (ret) {
 610                 wpa_printf(MSG_DEBUG, "nl80211: Register beacons command "
 611                            "failed: ret=%d (%s)",
 612                            ret, strerror(-ret));
 613         }
 614         return ret;
 615 }
 616
 617
 618 static void nl80211_recv_beacons(int sock, void *eloop_ctx, void *handle)
 619 {
 620         struct nl80211_wiphy_data *w = eloop_ctx;
 621         int res;
 622
 623         wpa_printf(MSG_EXCESSIVE, "nl80211: Beacon event message available");
 624
 625         res = nl_recvmsgs(handle, w->nl_cb);
 626         if (res < 0) {
 627                 wpa_printf(MSG_INFO, "nl80211: %s->nl_recvmsgs failed: %d",
 628                            __func__, res);
 629         }
 630 }
 631
 632
 633 static int process_beacon_event(struct nl_msg *msg, void *arg)
 634 {
 635         struct nl80211_wiphy_data *w = arg;
 636         struct wpa_driver_nl80211_data *drv;
 637         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 638         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 639         union wpa_event_data event;
 640
 641         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 642                   genlmsg_attrlen(gnlh, 0), NULL);
 643
 644         if (gnlh->cmd != NL80211_CMD_FRAME) {
 645                 wpa_printf(MSG_DEBUG, "nl80211: Unexpected beacon event? (%d)",
 646                            gnlh->cmd);
 647                 return NL_SKIP;
 648         }
 649
 650         if (!tb[NL80211_ATTR_FRAME])
 651                 return NL_SKIP;
 652
 653         dl_list_for_each(drv, &w->drvs, struct wpa_driver_nl80211_data,
 654                          wiphy_list) {
 655                 os_memset(&event, 0, sizeof(event));
 656                 event.rx_mgmt.frame = nla_data(tb[NL80211_ATTR_FRAME]);
 657                 event.rx_mgmt.frame_len = nla_len(tb[NL80211_ATTR_FRAME]);
 658                 wpa_supplicant_event(drv->ctx, EVENT_RX_MGMT, &event);
 659         }
 660
 661         return NL_SKIP;
 662 }
 663
 664
 665 static struct nl80211_wiphy_data *
 666 nl80211_get_wiphy_data_ap(struct i802_bss *bss)
 667 {
 668         static DEFINE_DL_LIST(nl80211_wiphys);
 669         struct nl80211_wiphy_data *w;
 670         int wiphy_idx, found = 0;
 671         struct i802_bss *tmp_bss;
 672
 673         if (bss->wiphy_data != NULL)
 674                 return bss->wiphy_data;
 675
 676         wiphy_idx = nl80211_get_wiphy_index(bss);
 677
 678         dl_list_for_each(w, &nl80211_wiphys, struct nl80211_wiphy_data, list) {
 679                 if (w->wiphy_idx == wiphy_idx)
 680                         goto add;
 681         }
 682
 683         /* alloc new one */
 684         w = os_zalloc(sizeof(*w));
 685         if (w == NULL)
 686                 return NULL;
 687         w->wiphy_idx = wiphy_idx;
 688         dl_list_init(&w->bsss);
 689         dl_list_init(&w->drvs);
 690
 691         w->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
 692         if (!w->nl_cb) {
 693                 os_free(w);
 694                 return NULL;
 695         }
 696         nl_cb_set(w->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM, no_seq_check, NULL);
 697         nl_cb_set(w->nl_cb, NL_CB_VALID, NL_CB_CUSTOM, process_beacon_event,
 698                   w);
 699
 700         w->nl_beacons = nl_create_handle(bss->drv->global->nl_cb,
 701                                          "wiphy beacons");
 702         if (w->nl_beacons == NULL) {
 703                 os_free(w);
 704                 return NULL;
 705         }
 706
 707         if (nl80211_register_beacons(bss->drv, w)) {
 708                 nl_destroy_handles(&w->nl_beacons);
 709                 os_free(w);
 710                 return NULL;
 711         }
 712
 713         nl80211_register_eloop_read(&w->nl_beacons, nl80211_recv_beacons, w);
 714
 715         dl_list_add(&nl80211_wiphys, &w->list);
 716
 717 add:
 718         /* drv entry for this bss already there? */
 719         dl_list_for_each(tmp_bss, &w->bsss, struct i802_bss, wiphy_list) {
 720                 if (tmp_bss->drv == bss->drv) {
 721                         found = 1;
 722                         break;
 723                 }
 724         }
 725         /* if not add it */
 726         if (!found)
 727                 dl_list_add(&w->drvs, &bss->drv->wiphy_list);
 728
 729         dl_list_add(&w->bsss, &bss->wiphy_list);
 730         bss->wiphy_data = w;
 731         return w;
 732 }
 733
 734
 735 static void nl80211_put_wiphy_data_ap(struct i802_bss *bss)
 736 {
 737         struct nl80211_wiphy_data *w = bss->wiphy_data;
 738         struct i802_bss *tmp_bss;
 739         int found = 0;
 740
 741         if (w == NULL)
 742                 return;
 743         bss->wiphy_data = NULL;
 744         dl_list_del(&bss->wiphy_list);
 745
 746         /* still any for this drv present? */
 747         dl_list_for_each(tmp_bss, &w->bsss, struct i802_bss, wiphy_list) {
 748                 if (tmp_bss->drv == bss->drv) {
 749                         found = 1;
 750                         break;
 751                 }
 752         }
 753         /* if not remove it */
 754         if (!found)
 755                 dl_list_del(&bss->drv->wiphy_list);
 756
 757         if (!dl_list_empty(&w->bsss))
 758                 return;
 759
 760         nl80211_destroy_eloop_handle(&w->nl_beacons);
 761
 762         nl_cb_put(w->nl_cb);
 763         dl_list_del(&w->list);
 764         os_free(w);
 765 }
 766
 767
 768 static unsigned int nl80211_get_ifindex(void *priv)
 769 {
 770         struct i802_bss *bss = priv;
 771         struct wpa_driver_nl80211_data *drv = bss->drv;
 772
 773         return drv->ifindex;
 774 }
 775
 776
 777 static int wpa_driver_nl80211_get_bssid(void *priv, u8 *bssid)
 778 {
 779         struct i802_bss *bss = priv;
 780         struct wpa_driver_nl80211_data *drv = bss->drv;
 781         if (!drv->associated)
 782                 return -1;
 783         os_memcpy(bssid, drv->bssid, ETH_ALEN);
 784         return 0;
 785 }
 786
 787
 788 static int wpa_driver_nl80211_get_ssid(void *priv, u8 *ssid)
 789 {
 790         struct i802_bss *bss = priv;
 791         struct wpa_driver_nl80211_data *drv = bss->drv;
 792         if (!drv->associated)
 793                 return -1;
 794         os_memcpy(ssid, drv->ssid, drv->ssid_len);
 795         return drv->ssid_len;
 796 }
 797
 798
 799 static void wpa_driver_nl80211_event_newlink(
 800         struct nl80211_global *global, struct wpa_driver_nl80211_data *drv,
 801         int ifindex, const char *ifname)
 802 {
 803         union wpa_event_data event;
 804
 805         if (drv && os_strcmp(drv->first_bss->ifname, ifname) == 0) {
 806                 if (if_nametoindex(drv->first_bss->ifname) == 0) {
 807                         wpa_printf(MSG_DEBUG, "nl80211: Interface %s does not exist - ignore RTM_NEWLINK",
 808                                    drv->first_bss->ifname);
 809                         return;
 810                 }
 811                 if (!drv->if_removed)
 812                         return;
 813                 wpa_printf(MSG_DEBUG, "nl80211: Mark if_removed=0 for %s based on RTM_NEWLINK event",
 814                            drv->first_bss->ifname);
 815                 drv->if_removed = 0;
 816         }
 817
 818         os_memset(&event, 0, sizeof(event));
 819         event.interface_status.ifindex = ifindex;
 820         os_strlcpy(event.interface_status.ifname, ifname,
 821                    sizeof(event.interface_status.ifname));
 822         event.interface_status.ievent = EVENT_INTERFACE_ADDED;
 823         if (drv)
 824                 wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_STATUS, &event);
 825         else
 826                 wpa_supplicant_event_global(global->ctx, EVENT_INTERFACE_STATUS,
 827                                             &event);
 828 }
 829
 830
 831 static void wpa_driver_nl80211_event_dellink(
 832         struct nl80211_global *global, struct wpa_driver_nl80211_data *drv,
 833         int ifindex, const char *ifname)
 834 {
 835         union wpa_event_data event;
 836
 837         if (drv && os_strcmp(drv->first_bss->ifname, ifname) == 0) {
 838                 if (drv->if_removed) {
 839                         wpa_printf(MSG_DEBUG, "nl80211: if_removed already set - ignore RTM_DELLINK event for %s",
 840                                    ifname);
 841                         return;
 842                 }
 843                 wpa_printf(MSG_DEBUG, "RTM_DELLINK: Interface '%s' removed - mark if_removed=1",
 844                            ifname);
 845                 drv->if_removed = 1;
 846         } else {
 847                 wpa_printf(MSG_DEBUG, "RTM_DELLINK: Interface '%s' removed",
 848                            ifname);
 849         }
 850
 851         os_memset(&event, 0, sizeof(event));
 852         event.interface_status.ifindex = ifindex;
 853         os_strlcpy(event.interface_status.ifname, ifname,
 854                    sizeof(event.interface_status.ifname));
 855         event.interface_status.ievent = EVENT_INTERFACE_REMOVED;
 856         if (drv)
 857                 wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_STATUS, &event);
 858         else
 859                 wpa_supplicant_event_global(global->ctx, EVENT_INTERFACE_STATUS,
 860                                             &event);
 861 }
 862
 863
 864 static int wpa_driver_nl80211_own_ifname(struct wpa_driver_nl80211_data *drv,
 865                                          u8 *buf, size_t len)
 866 {
 867         int attrlen, rta_len;
 868         struct rtattr *attr;
 869
 870         attrlen = len;
 871         attr = (struct rtattr *) buf;
 872
 873         rta_len = RTA_ALIGN(sizeof(struct rtattr));
 874         while (RTA_OK(attr, attrlen)) {
 875                 if (attr->rta_type == IFLA_IFNAME) {
 876                         if (os_strcmp(((char *) attr) + rta_len,
 877                                       drv->first_bss->ifname) == 0)
 878                                 return 1;
 879                         else
 880                                 break;
 881                 }
 882                 attr = RTA_NEXT(attr, attrlen);
 883         }
 884
 885         return 0;
 886 }
 887
 888
 889 static int wpa_driver_nl80211_own_ifindex(struct wpa_driver_nl80211_data *drv,
 890                                           int ifindex, u8 *buf, size_t len)
 891 {
 892         if (drv->ifindex == ifindex)
 893                 return 1;
 894
 895         if (drv->if_removed && wpa_driver_nl80211_own_ifname(drv, buf, len)) {
 896                 nl80211_check_global(drv->global);
 897                 wpa_printf(MSG_DEBUG, "nl80211: Update ifindex for a removed "
 898                            "interface");
 899                 wpa_driver_nl80211_finish_drv_init(drv, NULL, 0, NULL);
 900                 return 1;
 901         }
 902
 903         return 0;
 904 }
 905
 906
 907 static struct wpa_driver_nl80211_data *
 908 nl80211_find_drv(struct nl80211_global *global, int idx, u8 *buf, size_t len)
 909 {
 910         struct wpa_driver_nl80211_data *drv;
 911         dl_list_for_each(drv, &global->interfaces,
 912                          struct wpa_driver_nl80211_data, list) {
 913                 if (wpa_driver_nl80211_own_ifindex(drv, idx, buf, len) ||
 914                     have_ifidx(drv, idx, IFIDX_ANY))
 915                         return drv;
 916         }
 917         return NULL;
 918 }
 919
 920
 921 static void wpa_driver_nl80211_event_rtm_newlink(void *ctx,
 922                                                  struct ifinfomsg *ifi,
 923                                                  u8 *buf, size_t len)
 924 {
 925         struct nl80211_global *global = ctx;
 926         struct wpa_driver_nl80211_data *drv;
 927         int attrlen;
 928         struct rtattr *attr;
 929         u32 brid = 0;
 930         char namebuf[IFNAMSIZ];
 931         char ifname[IFNAMSIZ + 1];
 932         char extra[100], *pos, *end;
 933
 934         extra[0] = '\0';
 935         pos = extra;
 936         end = pos + sizeof(extra);
 937         ifname[0] = '\0';
 938
 939         attrlen = len;
 940         attr = (struct rtattr *) buf;
 941         while (RTA_OK(attr, attrlen)) {
 942                 switch (attr->rta_type) {
 943                 case IFLA_IFNAME:
 944                         if (RTA_PAYLOAD(attr) >= IFNAMSIZ)
 945                                 break;
 946                         os_memcpy(ifname, RTA_DATA(attr), RTA_PAYLOAD(attr));
 947                         ifname[RTA_PAYLOAD(attr)] = '\0';
 948                         break;
 949                 case IFLA_MASTER:
 950                         brid = nla_get_u32((struct nlattr *) attr);
 951                         pos += os_snprintf(pos, end - pos, " master=%u", brid);
 952                         break;
 953                 case IFLA_WIRELESS:
 954                         pos += os_snprintf(pos, end - pos, " wext");
 955                         break;
 956                 case IFLA_OPERSTATE:
 957                         pos += os_snprintf(pos, end - pos, " operstate=%u",
 958                                            nla_get_u32((struct nlattr *) attr));
 959                         break;
 960                 case IFLA_LINKMODE:
 961                         pos += os_snprintf(pos, end - pos, " linkmode=%u",
 962                                            nla_get_u32((struct nlattr *) attr));
 963                         break;
 964                 }
 965                 attr = RTA_NEXT(attr, attrlen);
 966         }
 967         extra[sizeof(extra) - 1] = '\0';
 968
 969         wpa_printf(MSG_DEBUG, "RTM_NEWLINK: ifi_index=%d ifname=%s%s ifi_family=%d ifi_flags=0x%x (%s%s%s%s)",
 970                    ifi->ifi_index, ifname, extra, ifi->ifi_family,
 971                    ifi->ifi_flags,
 972                    (ifi->ifi_flags & IFF_UP) ? "[UP]" : "",
 973                    (ifi->ifi_flags & IFF_RUNNING) ? "[RUNNING]" : "",
 974                    (ifi->ifi_flags & IFF_LOWER_UP) ? "[LOWER_UP]" : "",
 975                    (ifi->ifi_flags & IFF_DORMANT) ? "[DORMANT]" : "");
 976
 977         drv = nl80211_find_drv(global, ifi->ifi_index, buf, len);
 978         if (!drv)
 979                 goto event_newlink;
 980
 981         if (!drv->if_disabled && !(ifi->ifi_flags & IFF_UP)) {
 982                 namebuf[0] = '\0';
 983                 if (if_indextoname(ifi->ifi_index, namebuf) &&
 984                     linux_iface_up(drv->global->ioctl_sock, namebuf) > 0) {
 985                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface down "
 986                                    "event since interface %s is up", namebuf);
 987                         drv->ignore_if_down_event = 0;
 988                         return;
 989                 }
 990                 wpa_printf(MSG_DEBUG, "nl80211: Interface down (%s/%s)",
 991                            namebuf, ifname);
 992                 if (os_strcmp(drv->first_bss->ifname, ifname) != 0) {
 993                         wpa_printf(MSG_DEBUG,
 994                                    "nl80211: Not the main interface (%s) - do not indicate interface down",
 995                                    drv->first_bss->ifname);
 996                 } else if (drv->ignore_if_down_event) {
 997                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface down "
 998                                    "event generated by mode change");
 999                         drv->ignore_if_down_event = 0;
1000                 } else {
1001                         drv->if_disabled = 1;
1002                         wpa_supplicant_event(drv->ctx,
1003                                              EVENT_INTERFACE_DISABLED, NULL);
1004
1005                         /*
1006                          * Try to get drv again, since it may be removed as
1007                          * part of the EVENT_INTERFACE_DISABLED handling for
1008                          * dynamic interfaces
1009                          */
1010                         drv = nl80211_find_drv(global, ifi->ifi_index,
1011                                                buf, len);
1012                         if (!drv)
1013                                 return;
1014                 }
1015         }
1016
1017         if (drv->if_disabled && (ifi->ifi_flags & IFF_UP)) {
1018                 if (if_indextoname(ifi->ifi_index, namebuf) &&
1019                     linux_iface_up(drv->global->ioctl_sock, namebuf) == 0) {
1020                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface up "
1021                                    "event since interface %s is down",
1022                                    namebuf);
1023                 } else if (if_nametoindex(drv->first_bss->ifname) == 0) {
1024                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface up "
1025                                    "event since interface %s does not exist",
1026                                    drv->first_bss->ifname);
1027                 } else if (drv->if_removed) {
1028                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface up "
1029                                    "event since interface %s is marked "
1030                                    "removed", drv->first_bss->ifname);
1031                 } else {
1032                         struct i802_bss *bss;
1033                         u8 addr[ETH_ALEN];
1034
1035                         /* Re-read MAC address as it may have changed */
1036                         bss = get_bss_ifindex(drv, ifi->ifi_index);
1037                         if (bss &&
1038                             linux_get_ifhwaddr(drv->global->ioctl_sock,
1039                                                bss->ifname, addr) < 0) {
1040                                 wpa_printf(MSG_DEBUG,
1041                                            "nl80211: %s: failed to re-read MAC address",
1042                                            bss->ifname);
1043                         } else if (bss &&
1044                                    os_memcmp(addr, bss->addr, ETH_ALEN) != 0) {
1045                                 wpa_printf(MSG_DEBUG,
1046                                            "nl80211: Own MAC address on ifindex %d (%s) changed from "
1047                                            MACSTR " to " MACSTR,
1048                                            ifi->ifi_index, bss->ifname,
1049                                            MAC2STR(bss->addr),
1050                                            MAC2STR(addr));
1051                                 os_memcpy(bss->addr, addr, ETH_ALEN);
1052                         }
1053
1054                         wpa_printf(MSG_DEBUG, "nl80211: Interface up");
1055                         drv->if_disabled = 0;
1056                         wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_ENABLED,
1057                                              NULL);
1058                 }
1059         }
1060
1061         /*
1062          * Some drivers send the association event before the operup event--in
1063          * this case, lifting operstate in wpa_driver_nl80211_set_operstate()
1064          * fails. This will hit us when wpa_supplicant does not need to do
1065          * IEEE 802.1X authentication
1066          */
1067         if (drv->operstate == 1 &&
1068             (ifi->ifi_flags & (IFF_LOWER_UP | IFF_DORMANT)) == IFF_LOWER_UP &&
1069             !(ifi->ifi_flags & IFF_RUNNING)) {
1070                 wpa_printf(MSG_DEBUG, "nl80211: Set IF_OPER_UP again based on ifi_flags and expected operstate");
1071                 netlink_send_oper_ifla(drv->global->netlink, drv->ifindex,
1072                                        -1, IF_OPER_UP);
1073         }
1074
1075 event_newlink:
1076         if (ifname[0])
1077                 wpa_driver_nl80211_event_newlink(global, drv, ifi->ifi_index,
1078                                                  ifname);
1079
1080         if (ifi->ifi_family == AF_BRIDGE && brid && drv) {
1081                 struct i802_bss *bss;
1082
1083                 /* device has been added to bridge */
1084                 if (!if_indextoname(brid, namebuf)) {
1085                         wpa_printf(MSG_DEBUG,
1086                                    "nl80211: Could not find bridge ifname for ifindex %u",
1087                                    brid);
1088                         return;
1089                 }
1090                 wpa_printf(MSG_DEBUG, "nl80211: Add ifindex %u for bridge %s",
1091                            brid, namebuf);
1092                 add_ifidx(drv, brid, ifi->ifi_index);
1093
1094                 for (bss = drv->first_bss; bss; bss = bss->next) {
1095                         if (os_strcmp(ifname, bss->ifname) == 0) {
1096                                 os_strlcpy(bss->brname, namebuf, IFNAMSIZ);
1097                                 break;
1098                         }
1099                 }
1100         }
1101 }
1102
1103
1104 static void wpa_driver_nl80211_event_rtm_dellink(void *ctx,
1105                                                  struct ifinfomsg *ifi,
1106                                                  u8 *buf, size_t len)
1107 {
1108         struct nl80211_global *global = ctx;
1109         struct wpa_driver_nl80211_data *drv;
1110         int attrlen;
1111         struct rtattr *attr;
1112         u32 brid = 0;
1113         char ifname[IFNAMSIZ + 1];
1114         char extra[100], *pos, *end;
1115
1116         extra[0] = '\0';
1117         pos = extra;
1118         end = pos + sizeof(extra);
1119         ifname[0] = '\0';
1120
1121         attrlen = len;
1122         attr = (struct rtattr *) buf;
1123         while (RTA_OK(attr, attrlen)) {
1124                 switch (attr->rta_type) {
1125                 case IFLA_IFNAME:
1126                         if (RTA_PAYLOAD(attr) >= IFNAMSIZ)
1127                                 break;
1128                         os_memcpy(ifname, RTA_DATA(attr), RTA_PAYLOAD(attr));
1129                         ifname[RTA_PAYLOAD(attr)] = '\0';
1130                         break;
1131                 case IFLA_MASTER:
1132                         brid = nla_get_u32((struct nlattr *) attr);
1133                         pos += os_snprintf(pos, end - pos, " master=%u", brid);
1134                         break;
1135                 case IFLA_OPERSTATE:
1136                         pos += os_snprintf(pos, end - pos, " operstate=%u",
1137                                            nla_get_u32((struct nlattr *) attr));
1138                         break;
1139                 case IFLA_LINKMODE:
1140                         pos += os_snprintf(pos, end - pos, " linkmode=%u",
1141                                            nla_get_u32((struct nlattr *) attr));
1142                         break;
1143                 }
1144                 attr = RTA_NEXT(attr, attrlen);
1145         }
1146         extra[sizeof(extra) - 1] = '\0';
1147
1148         wpa_printf(MSG_DEBUG, "RTM_DELLINK: ifi_index=%d ifname=%s%s ifi_family=%d ifi_flags=0x%x (%s%s%s%s)",
1149                    ifi->ifi_index, ifname, extra, ifi->ifi_family,
1150                    ifi->ifi_flags,
1151                    (ifi->ifi_flags & IFF_UP) ? "[UP]" : "",
1152                    (ifi->ifi_flags & IFF_RUNNING) ? "[RUNNING]" : "",
1153                    (ifi->ifi_flags & IFF_LOWER_UP) ? "[LOWER_UP]" : "",
1154                    (ifi->ifi_flags & IFF_DORMANT) ? "[DORMANT]" : "");
1155
1156         drv = nl80211_find_drv(global, ifi->ifi_index, buf, len);
1157
1158         if (ifi->ifi_family == AF_BRIDGE && brid && drv) {
1159                 /* device has been removed from bridge */
1160                 char namebuf[IFNAMSIZ];
1161
1162                 if (!if_indextoname(brid, namebuf)) {
1163                         wpa_printf(MSG_DEBUG,
1164                                    "nl80211: Could not find bridge ifname for ifindex %u",
1165                                    brid);
1166                 } else {
1167                         wpa_printf(MSG_DEBUG,
1168                                    "nl80211: Remove ifindex %u for bridge %s",
1169                                    brid, namebuf);
1170                 }
1171                 del_ifidx(drv, brid, ifi->ifi_index);
1172         }
1173
1174         if (ifi->ifi_family != AF_BRIDGE || !brid)
1175                 wpa_driver_nl80211_event_dellink(global, drv, ifi->ifi_index,
1176                                                  ifname);
1177 }
1178
1179
1180 unsigned int nl80211_get_assoc_freq(struct wpa_driver_nl80211_data *drv)
1181 {
1182         struct nl_msg *msg;
1183         int ret;
1184         struct nl80211_bss_info_arg arg;
1185
1186         msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_GET_SCAN);
1187         os_memset(&arg, 0, sizeof(arg));
1188         arg.drv = drv;
1189         ret = send_and_recv_msgs(drv, msg, bss_info_handler, &arg);
1190         if (ret == 0) {
1191                 unsigned int freq = drv->nlmode == NL80211_IFTYPE_ADHOC ?
1192                         arg.ibss_freq : arg.assoc_freq;
1193                 wpa_printf(MSG_DEBUG, "nl80211: Operating frequency for the "
1194                            "associated BSS from scan results: %u MHz", freq);
1195                 if (freq)
1196                         drv->assoc_freq = freq;
1197                 return drv->assoc_freq;
1198         }
1199         wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d "
1200                    "(%s)", ret, strerror(-ret));
1201         return drv->assoc_freq;
1202 }
1203
1204
1205 static int get_link_signal(struct nl_msg *msg, void *arg)
1206 {
1207         struct nlattr *tb[NL80211_ATTR_MAX + 1];
1208         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1209         struct nlattr *sinfo[NL80211_STA_INFO_MAX + 1];
1210         static struct nla_policy policy[NL80211_STA_INFO_MAX + 1] = {
1211                 [NL80211_STA_INFO_SIGNAL] = { .type = NLA_U8 },
1212                 [NL80211_STA_INFO_SIGNAL_AVG] = { .type = NLA_U8 },
1213                 [NL80211_STA_INFO_BEACON_SIGNAL_AVG] = { .type = NLA_U8 },
1214         };
1215         struct nlattr *rinfo[NL80211_RATE_INFO_MAX + 1];
1216         static struct nla_policy rate_policy[NL80211_RATE_INFO_MAX + 1] = {
1217                 [NL80211_RATE_INFO_BITRATE] = { .type = NLA_U16 },
1218                 [NL80211_RATE_INFO_MCS] = { .type = NLA_U8 },
1219                 [NL80211_RATE_INFO_40_MHZ_WIDTH] = { .type = NLA_FLAG },
1220                 [NL80211_RATE_INFO_SHORT_GI] = { .type = NLA_FLAG },
1221         };
1222         struct wpa_signal_info *sig_change = arg;
1223
1224         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1225                   genlmsg_attrlen(gnlh, 0), NULL);
1226         if (!tb[NL80211_ATTR_STA_INFO] ||
1227             nla_parse_nested(sinfo, NL80211_STA_INFO_MAX,
1228                              tb[NL80211_ATTR_STA_INFO], policy))
1229                 return NL_SKIP;
1230         if (!sinfo[NL80211_STA_INFO_SIGNAL])
1231                 return NL_SKIP;
1232
1233         sig_change->current_signal =
1234                 (s8) nla_get_u8(sinfo[NL80211_STA_INFO_SIGNAL]);
1235
1236         if (sinfo[NL80211_STA_INFO_SIGNAL_AVG])
1237                 sig_change->avg_signal =
1238                         (s8) nla_get_u8(sinfo[NL80211_STA_INFO_SIGNAL_AVG]);
1239         else
1240                 sig_change->avg_signal = 0;
1241
1242         if (sinfo[NL80211_STA_INFO_BEACON_SIGNAL_AVG])
1243                 sig_change->avg_beacon_signal =
1244                         (s8)
1245                         nla_get_u8(sinfo[NL80211_STA_INFO_BEACON_SIGNAL_AVG]);
1246         else
1247                 sig_change->avg_beacon_signal = 0;
1248
1249         if (sinfo[NL80211_STA_INFO_TX_BITRATE]) {
1250                 if (nla_parse_nested(rinfo, NL80211_RATE_INFO_MAX,
1251                                      sinfo[NL80211_STA_INFO_TX_BITRATE],
1252                                      rate_policy)) {
1253                         sig_change->current_txrate = 0;
1254                 } else {
1255                         if (rinfo[NL80211_RATE_INFO_BITRATE]) {
1256                                 sig_change->current_txrate =
1257                                         nla_get_u16(rinfo[
1258                                              NL80211_RATE_INFO_BITRATE]) * 100;
1259                         }
1260                 }
1261         }
1262
1263         return NL_SKIP;
1264 }
1265
1266
1267 int nl80211_get_link_signal(struct wpa_driver_nl80211_data *drv,
1268                             struct wpa_signal_info *sig)
1269 {
1270         struct nl_msg *msg;
1271
1272         sig->current_signal = -9999;
1273         sig->current_txrate = 0;
1274
1275         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_GET_STATION)) ||
1276             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, drv->bssid)) {
1277                 nlmsg_free(msg);
1278                 return -ENOBUFS;
1279         }
1280
1281         return send_and_recv_msgs(drv, msg, get_link_signal, sig);
1282 }
1283
1284
1285 static int get_link_noise(struct nl_msg *msg, void *arg)
1286 {
1287         struct nlattr *tb[NL80211_ATTR_MAX + 1];
1288         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1289         struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
1290         static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
1291                 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
1292                 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
1293         };
1294         struct wpa_signal_info *sig_change = arg;
1295
1296         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1297                   genlmsg_attrlen(gnlh, 0), NULL);
1298
1299         if (!tb[NL80211_ATTR_SURVEY_INFO]) {
1300                 wpa_printf(MSG_DEBUG, "nl80211: survey data missing!");
1301                 return NL_SKIP;
1302         }
1303
1304         if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
1305                              tb[NL80211_ATTR_SURVEY_INFO],
1306                              survey_policy)) {
1307                 wpa_printf(MSG_DEBUG, "nl80211: failed to parse nested "
1308                            "attributes!");
1309                 return NL_SKIP;
1310         }
1311
1312         if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY])
1313                 return NL_SKIP;
1314
1315         if (nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]) !=
1316             sig_change->frequency)
1317                 return NL_SKIP;
1318
1319         if (!sinfo[NL80211_SURVEY_INFO_NOISE])
1320                 return NL_SKIP;
1321
1322         sig_change->current_noise =
1323                 (s8) nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
1324
1325         return NL_SKIP;
1326 }
1327
1328
1329 int nl80211_get_link_noise(struct wpa_driver_nl80211_data *drv,
1330                            struct wpa_signal_info *sig_change)
1331 {
1332         struct nl_msg *msg;
1333
1334         sig_change->current_noise = 9999;
1335         sig_change->frequency = drv->assoc_freq;
1336
1337         msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_GET_SURVEY);
1338         return send_and_recv_msgs(drv, msg, get_link_noise, sig_change);
1339 }
1340
1341
1342 static void wpa_driver_nl80211_event_receive(int sock, void *eloop_ctx,
1343                                              void *handle)
1344 {
1345         struct nl_cb *cb = eloop_ctx;
1346         int res;
1347
1348         wpa_printf(MSG_MSGDUMP, "nl80211: Event message available");
1349
1350         res = nl_recvmsgs(handle, cb);
1351         if (res < 0) {
1352                 wpa_printf(MSG_INFO, "nl80211: %s->nl_recvmsgs failed: %d",
1353                            __func__, res);
1354         }
1355 }
1356
1357
1358 /**
1359  * wpa_driver_nl80211_set_country - ask nl80211 to set the regulatory domain
1360  * @priv: driver_nl80211 private data
1361  * @alpha2_arg: country to which to switch to
1362  * Returns: 0 on success, -1 on failure
1363  *
1364  * This asks nl80211 to set the regulatory domain for given
1365  * country ISO / IEC alpha2.
1366  */
1367 static int wpa_driver_nl80211_set_country(void *priv, const char *alpha2_arg)
1368 {
1369         struct i802_bss *bss = priv;
1370         struct wpa_driver_nl80211_data *drv = bss->drv;
1371         char alpha2[3];
1372         struct nl_msg *msg;
1373
1374         msg = nlmsg_alloc();
1375         if (!msg)
1376                 return -ENOMEM;
1377
1378         alpha2[0] = alpha2_arg[0];
1379         alpha2[1] = alpha2_arg[1];
1380         alpha2[2] = '\0';
1381
1382         if (!nl80211_cmd(drv, msg, 0, NL80211_CMD_REQ_SET_REG) ||
1383             nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, alpha2)) {
1384                 nlmsg_free(msg);
1385                 return -EINVAL;
1386         }
1387         if (send_and_recv_msgs(drv, msg, NULL, NULL))
1388                 return -EINVAL;
1389         return 0;
1390 }
1391
1392
1393 static int nl80211_get_country(struct nl_msg *msg, void *arg)
1394 {
1395         char *alpha2 = arg;
1396         struct nlattr *tb_msg[NL80211_ATTR_MAX + 1];
1397         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1398
1399         nla_parse(tb_msg, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1400                   genlmsg_attrlen(gnlh, 0), NULL);
1401         if (!tb_msg[NL80211_ATTR_REG_ALPHA2]) {
1402                 wpa_printf(MSG_DEBUG, "nl80211: No country information available");
1403                 return NL_SKIP;
1404         }
1405         os_strlcpy(alpha2, nla_data(tb_msg[NL80211_ATTR_REG_ALPHA2]), 3);
1406         return NL_SKIP;
1407 }
1408
1409
1410 static int wpa_driver_nl80211_get_country(void *priv, char *alpha2)
1411 {
1412         struct i802_bss *bss = priv;
1413         struct wpa_driver_nl80211_data *drv = bss->drv;
1414         struct nl_msg *msg;
1415         int ret;
1416
1417         msg = nlmsg_alloc();
1418         if (!msg)
1419                 return -ENOMEM;
1420
1421         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_REG);
1422         alpha2[0] = '\0';
1423         ret = send_and_recv_msgs(drv, msg, nl80211_get_country, alpha2);
1424         if (!alpha2[0])
1425                 ret = -1;
1426
1427         return ret;
1428 }
1429
1430
1431 static int wpa_driver_nl80211_init_nl_global(struct nl80211_global *global)
1432 {
1433         int ret;
1434
1435         global->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
1436         if (global->nl_cb == NULL) {
1437                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate netlink "
1438                            "callbacks");
1439                 return -1;
1440         }
1441
1442         global->nl = nl_create_handle(global->nl_cb, "nl");
1443         if (global->nl == NULL)
1444                 goto err;
1445
1446         global->nl80211_id = genl_ctrl_resolve(global->nl, "nl80211");
1447         if (global->nl80211_id < 0) {
1448                 wpa_printf(MSG_ERROR, "nl80211: 'nl80211' generic netlink not "
1449                            "found");
1450                 goto err;
1451         }
1452
1453         global->nl_event = nl_create_handle(global->nl_cb, "event");
1454         if (global->nl_event == NULL)
1455                 goto err;
1456
1457         ret = nl_get_multicast_id(global, "nl80211", "scan");
1458         if (ret >= 0)
1459                 ret = nl_socket_add_membership(global->nl_event, ret);
1460         if (ret < 0) {
1461                 wpa_printf(MSG_ERROR, "nl80211: Could not add multicast "
1462                            "membership for scan events: %d (%s)",
1463                            ret, strerror(-ret));
1464                 goto err;
1465         }
1466
1467         ret = nl_get_multicast_id(global, "nl80211", "mlme");
1468         if (ret >= 0)
1469                 ret = nl_socket_add_membership(global->nl_event, ret);
1470         if (ret < 0) {
1471                 wpa_printf(MSG_ERROR, "nl80211: Could not add multicast "
1472                            "membership for mlme events: %d (%s)",
1473                            ret, strerror(-ret));
1474                 goto err;
1475         }
1476
1477         ret = nl_get_multicast_id(global, "nl80211", "regulatory");
1478         if (ret >= 0)
1479                 ret = nl_socket_add_membership(global->nl_event, ret);
1480         if (ret < 0) {
1481                 wpa_printf(MSG_DEBUG, "nl80211: Could not add multicast "
1482                            "membership for regulatory events: %d (%s)",
1483                            ret, strerror(-ret));
1484                 /* Continue without regulatory events */
1485         }
1486
1487         ret = nl_get_multicast_id(global, "nl80211", "vendor");
1488         if (ret >= 0)
1489                 ret = nl_socket_add_membership(global->nl_event, ret);
1490         if (ret < 0) {
1491                 wpa_printf(MSG_DEBUG, "nl80211: Could not add multicast "
1492                            "membership for vendor events: %d (%s)",
1493                            ret, strerror(-ret));
1494                 /* Continue without vendor events */
1495         }
1496
1497         nl_cb_set(global->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM,
1498                   no_seq_check, NULL);
1499         nl_cb_set(global->nl_cb, NL_CB_VALID, NL_CB_CUSTOM,
1500                   process_global_event, global);
1501
1502         nl80211_register_eloop_read(&global->nl_event,
1503                                     wpa_driver_nl80211_event_receive,
1504                                     global->nl_cb);
1505
1506         return 0;
1507
1508 err:
1509         nl_destroy_handles(&global->nl_event);
1510         nl_destroy_handles(&global->nl);
1511         nl_cb_put(global->nl_cb);
1512         global->nl_cb = NULL;
1513         return -1;
1514 }
1515
1516
1517 static void nl80211_check_global(struct nl80211_global *global)
1518 {
1519         struct nl_handle *handle;
1520         const char *groups[] = { "scan", "mlme", "regulatory", "vendor", NULL };
1521         int ret;
1522         unsigned int i;
1523
1524         /*
1525          * Try to re-add memberships to handle case of cfg80211 getting reloaded
1526          * and all registration having been cleared.
1527          */
1528         handle = (void *) (((intptr_t) global->nl_event) ^
1529                            ELOOP_SOCKET_INVALID);
1530
1531         for (i = 0; groups[i]; i++) {
1532                 ret = nl_get_multicast_id(global, "nl80211", groups[i]);
1533                 if (ret >= 0)
1534                         ret = nl_socket_add_membership(handle, ret);
1535                 if (ret < 0) {
1536                         wpa_printf(MSG_INFO,
1537                                    "nl80211: Could not re-add multicast membership for %s events: %d (%s)",
1538                                    groups[i], ret, strerror(-ret));
1539                 }
1540         }
1541 }
1542
1543
1544 static void wpa_driver_nl80211_rfkill_blocked(void *ctx)
1545 {
1546         struct wpa_driver_nl80211_data *drv = ctx;
1547
1548         wpa_printf(MSG_DEBUG, "nl80211: RFKILL blocked");
1549
1550         /*
1551          * rtnetlink ifdown handler will report interfaces other than the P2P
1552          * Device interface as disabled.
1553          */
1554         if (drv->nlmode == NL80211_IFTYPE_P2P_DEVICE)
1555                 wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_DISABLED, NULL);
1556 }
1557
1558
1559 static void wpa_driver_nl80211_rfkill_unblocked(void *ctx)
1560 {
1561         struct wpa_driver_nl80211_data *drv = ctx;
1562         wpa_printf(MSG_DEBUG, "nl80211: RFKILL unblocked");
1563         if (i802_set_iface_flags(drv->first_bss, 1)) {
1564                 wpa_printf(MSG_DEBUG, "nl80211: Could not set interface UP "
1565                            "after rfkill unblock");
1566                 return;
1567         }
1568
1569         if (is_p2p_net_interface(drv->nlmode))
1570                 nl80211_disable_11b_rates(drv, drv->ifindex, 1);
1571
1572         /*
1573          * rtnetlink ifup handler will report interfaces other than the P2P
1574          * Device interface as enabled.
1575          */
1576         if (drv->nlmode == NL80211_IFTYPE_P2P_DEVICE)
1577                 wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_ENABLED, NULL);
1578 }
1579
1580
1581 static void wpa_driver_nl80211_handle_eapol_tx_status(int sock,
1582                                                       void *eloop_ctx,
1583                                                       void *handle)
1584 {
1585         struct wpa_driver_nl80211_data *drv = eloop_ctx;
1586         u8 data[2048];
1587         struct msghdr msg;
1588         struct iovec entry;
1589         u8 control[512];
1590         struct cmsghdr *cmsg;
1591         int res, found_ee = 0, found_wifi = 0, acked = 0;
1592         union wpa_event_data event;
1593
1594         memset(&msg, 0, sizeof(msg));
1595         msg.msg_iov = &entry;
1596         msg.msg_iovlen = 1;
1597         entry.iov_base = data;
1598         entry.iov_len = sizeof(data);
1599         msg.msg_control = &control;
1600         msg.msg_controllen = sizeof(control);
1601
1602         res = recvmsg(sock, &msg, MSG_ERRQUEUE);
1603         /* if error or not fitting 802.3 header, return */
1604         if (res < 14)
1605                 return;
1606
1607         for (cmsg = CMSG_FIRSTHDR(&msg); cmsg; cmsg = CMSG_NXTHDR(&msg, cmsg))
1608         {
1609                 if (cmsg->cmsg_level == SOL_SOCKET &&
1610                     cmsg->cmsg_type == SCM_WIFI_STATUS) {
1611                         int *ack;
1612
1613                         found_wifi = 1;
1614                         ack = (void *)CMSG_DATA(cmsg);
1615                         acked = *ack;
1616                 }
1617
1618                 if (cmsg->cmsg_level == SOL_PACKET &&
1619                     cmsg->cmsg_type == PACKET_TX_TIMESTAMP) {
1620                         struct sock_extended_err *err =
1621                                 (struct sock_extended_err *)CMSG_DATA(cmsg);
1622
1623                         if (err->ee_origin == SO_EE_ORIGIN_TXSTATUS)
1624                                 found_ee = 1;
1625                 }
1626         }
1627
1628         if (!found_ee || !found_wifi)
1629                 return;
1630
1631         memset(&event, 0, sizeof(event));
1632         event.eapol_tx_status.dst = data;
1633         event.eapol_tx_status.data = data + 14;
1634         event.eapol_tx_status.data_len = res - 14;
1635         event.eapol_tx_status.ack = acked;
1636         wpa_supplicant_event(drv->ctx, EVENT_EAPOL_TX_STATUS, &event);
1637 }
1638
1639
1640 static int nl80211_init_bss(struct i802_bss *bss)
1641 {
1642         bss->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
1643         if (!bss->nl_cb)
1644                 return -1;
1645
1646         nl_cb_set(bss->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM,
1647                   no_seq_check, NULL);
1648         nl_cb_set(bss->nl_cb, NL_CB_VALID, NL_CB_CUSTOM,
1649                   process_bss_event, bss);
1650
1651         return 0;
1652 }
1653
1654
1655 static void nl80211_destroy_bss(struct i802_bss *bss)
1656 {
1657         nl_cb_put(bss->nl_cb);
1658         bss->nl_cb = NULL;
1659 }
1660
1661
1662 static void
1663 wpa_driver_nl80211_drv_init_rfkill(struct wpa_driver_nl80211_data *drv)
1664 {
1665         struct rfkill_config *rcfg;
1666
1667         if (drv->rfkill)
1668                 return;
1669
1670         rcfg = os_zalloc(sizeof(*rcfg));
1671         if (!rcfg)
1672                 return;
1673
1674         rcfg->ctx = drv;
1675
1676         /* rfkill uses netdev sysfs for initialization. However, P2P Device is
1677          * not associated with a netdev, so use the name of some other interface
1678          * sharing the same wiphy as the P2P Device interface.
1679          *
1680          * Note: This is valid, as a P2P Device interface is always dynamically
1681          * created and is created only once another wpa_s interface was added.
1682          */
1683         if (drv->nlmode == NL80211_IFTYPE_P2P_DEVICE) {
1684                 struct nl80211_global *global = drv->global;
1685                 struct wpa_driver_nl80211_data *tmp1;
1686
1687                 dl_list_for_each(tmp1, &global->interfaces,
1688                                  struct wpa_driver_nl80211_data, list) {
1689                         if (drv == tmp1 || drv->wiphy_idx != tmp1->wiphy_idx ||
1690                             !tmp1->rfkill)
1691                                 continue;
1692
1693                         wpa_printf(MSG_DEBUG,
1694                                    "nl80211: Use (%s) to initialize P2P Device rfkill",
1695                                    tmp1->first_bss->ifname);
1696                         os_strlcpy(rcfg->ifname, tmp1->first_bss->ifname,
1697                                    sizeof(rcfg->ifname));
1698                         break;
1699                 }
1700         } else {
1701                 os_strlcpy(rcfg->ifname, drv->first_bss->ifname,
1702                            sizeof(rcfg->ifname));
1703         }
1704
1705         rcfg->blocked_cb = wpa_driver_nl80211_rfkill_blocked;
1706         rcfg->unblocked_cb = wpa_driver_nl80211_rfkill_unblocked;
1707         drv->rfkill = rfkill_init(rcfg);
1708         if (!drv->rfkill) {
1709                 wpa_printf(MSG_DEBUG, "nl80211: RFKILL status not available");
1710                 os_free(rcfg);
1711         }
1712 }
1713
1714
1715 static void * wpa_driver_nl80211_drv_init(void *ctx, const char *ifname,
1716                                           void *global_priv, int hostapd,
1717                                           const u8 *set_addr,
1718                                           const char *driver_params)
1719 {
1720         struct wpa_driver_nl80211_data *drv;
1721         struct i802_bss *bss;
1722
1723         if (global_priv == NULL)
1724                 return NULL;
1725         drv = os_zalloc(sizeof(*drv));
1726         if (drv == NULL)
1727                 return NULL;
1728         drv->global = global_priv;
1729         drv->ctx = ctx;
1730         drv->hostapd = !!hostapd;
1731         drv->eapol_sock = -1;
1732
1733         /*
1734          * There is no driver capability flag for this, so assume it is
1735          * supported and disable this on first attempt to use if the driver
1736          * rejects the command due to missing support.
1737          */
1738         drv->set_rekey_offload = 1;
1739
1740         drv->num_if_indices = sizeof(drv->default_if_indices) / sizeof(int);
1741         drv->if_indices = drv->default_if_indices;
1742         drv->if_indices_reason = drv->default_if_indices_reason;
1743
1744         drv->first_bss = os_zalloc(sizeof(*drv->first_bss));
1745         if (!drv->first_bss) {
1746                 os_free(drv);
1747                 return NULL;
1748         }
1749         bss = drv->first_bss;
1750         bss->drv = drv;
1751         bss->ctx = ctx;
1752
1753         os_strlcpy(bss->ifname, ifname, sizeof(bss->ifname));
1754         drv->monitor_ifidx = -1;
1755         drv->monitor_sock = -1;
1756         drv->eapol_tx_sock = -1;
1757         drv->ap_scan_as_station = NL80211_IFTYPE_UNSPECIFIED;
1758
1759         if (nl80211_init_bss(bss))
1760                 goto failed;
1761
1762         if (wpa_driver_nl80211_finish_drv_init(drv, set_addr, 1, driver_params))
1763                 goto failed;
1764
1765         drv->eapol_tx_sock = socket(PF_PACKET, SOCK_DGRAM, 0);
1766         if (drv->eapol_tx_sock < 0)
1767                 goto failed;
1768
1769         if (drv->data_tx_status) {
1770                 int enabled = 1;
1771
1772                 if (setsockopt(drv->eapol_tx_sock, SOL_SOCKET, SO_WIFI_STATUS,
1773                                &enabled, sizeof(enabled)) < 0) {
1774                         wpa_printf(MSG_DEBUG,
1775                                 "nl80211: wifi status sockopt failed\n");
1776                         drv->data_tx_status = 0;
1777                         if (!drv->use_monitor)
1778                                 drv->capa.flags &=
1779                                         ~WPA_DRIVER_FLAGS_EAPOL_TX_STATUS;
1780                 } else {
1781                         eloop_register_read_sock(drv->eapol_tx_sock,
1782                                 wpa_driver_nl80211_handle_eapol_tx_status,
1783                                 drv, NULL);
1784                 }
1785         }
1786
1787         if (drv->global) {
1788                 nl80211_check_global(drv->global);
1789                 dl_list_add(&drv->global->interfaces, &drv->list);
1790                 drv->in_interface_list = 1;
1791         }
1792
1793         return bss;
1794
1795 failed:
1796         wpa_driver_nl80211_deinit(bss);
1797         return NULL;
1798 }
1799
1800
1801 /**
1802  * wpa_driver_nl80211_init - Initialize nl80211 driver interface
1803  * @ctx: context to be used when calling wpa_supplicant functions,
1804  * e.g., wpa_supplicant_event()
1805  * @ifname: interface name, e.g., wlan0
1806  * @global_priv: private driver global data from global_init()
1807  * Returns: Pointer to private data, %NULL on failure
1808  */
1809 static void * wpa_driver_nl80211_init(void *ctx, const char *ifname,
1810                                       void *global_priv)
1811 {
1812         return wpa_driver_nl80211_drv_init(ctx, ifname, global_priv, 0, NULL,
1813                                            NULL);
1814 }
1815
1816
1817 static int nl80211_register_frame(struct i802_bss *bss,
1818                                   struct nl_handle *nl_handle,
1819                                   u16 type, const u8 *match, size_t match_len)
1820 {
1821         struct wpa_driver_nl80211_data *drv = bss->drv;
1822         struct nl_msg *msg;
1823         int ret;
1824         char buf[30];
1825
1826         buf[0] = '\0';
1827         wpa_snprintf_hex(buf, sizeof(buf), match, match_len);
1828         wpa_printf(MSG_DEBUG, "nl80211: Register frame type=0x%x (%s) nl_handle=%p match=%s",
1829                    type, fc2str(type), nl_handle, buf);
1830
1831         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_REGISTER_ACTION)) ||
1832             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE, type) ||
1833             nla_put(msg, NL80211_ATTR_FRAME_MATCH, match_len, match)) {
1834                 nlmsg_free(msg);
1835                 return -1;
1836         }
1837
1838         ret = send_and_recv(drv->global, nl_handle, msg, NULL, NULL);
1839         if (ret) {
1840                 wpa_printf(MSG_DEBUG, "nl80211: Register frame command "
1841                            "failed (type=%u): ret=%d (%s)",
1842                            type, ret, strerror(-ret));
1843                 wpa_hexdump(MSG_DEBUG, "nl80211: Register frame match",
1844                             match, match_len);
1845         }
1846         return ret;
1847 }
1848
1849
1850 static int nl80211_alloc_mgmt_handle(struct i802_bss *bss)
1851 {
1852         if (bss->nl_mgmt) {
1853                 wpa_printf(MSG_DEBUG, "nl80211: Mgmt reporting "
1854                            "already on! (nl_mgmt=%p)", bss->nl_mgmt);
1855                 return -1;
1856         }
1857
1858         bss->nl_mgmt = nl_create_handle(bss->nl_cb, "mgmt");
1859         if (bss->nl_mgmt == NULL)
1860                 return -1;
1861
1862         return 0;
1863 }
1864
1865
1866 static void nl80211_mgmt_handle_register_eloop(struct i802_bss *bss)
1867 {
1868         nl80211_register_eloop_read(&bss->nl_mgmt,
1869                                     wpa_driver_nl80211_event_receive,
1870                                     bss->nl_cb);
1871 }
1872
1873
1874 static int nl80211_register_action_frame(struct i802_bss *bss,
1875                                          const u8 *match, size_t match_len)
1876 {
1877         u16 type = (WLAN_FC_TYPE_MGMT << 2) | (WLAN_FC_STYPE_ACTION << 4);
1878         return nl80211_register_frame(bss, bss->nl_mgmt,
1879                                       type, match, match_len);
1880 }
1881
1882
1883 static int nl80211_mgmt_subscribe_non_ap(struct i802_bss *bss)
1884 {
1885         struct wpa_driver_nl80211_data *drv = bss->drv;
1886         int ret = 0;
1887
1888         if (nl80211_alloc_mgmt_handle(bss))
1889                 return -1;
1890         wpa_printf(MSG_DEBUG, "nl80211: Subscribe to mgmt frames with non-AP "
1891                    "handle %p", bss->nl_mgmt);
1892
1893         if (drv->nlmode == NL80211_IFTYPE_ADHOC) {
1894                 u16 type = (WLAN_FC_TYPE_MGMT << 2) | (WLAN_FC_STYPE_AUTH << 4);
1895
1896                 /* register for any AUTH message */
1897                 nl80211_register_frame(bss, bss->nl_mgmt, type, NULL, 0);
1898         }
1899
1900 #ifdef CONFIG_INTERWORKING
1901         /* QoS Map Configure */
1902         if (nl80211_register_action_frame(bss, (u8 *) "\x01\x04", 2) < 0)
1903                 ret = -1;
1904 #endif /* CONFIG_INTERWORKING */
1905 #if defined(CONFIG_P2P) || defined(CONFIG_INTERWORKING)
1906         /* GAS Initial Request */
1907         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0a", 2) < 0)
1908                 ret = -1;
1909         /* GAS Initial Response */
1910         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0b", 2) < 0)
1911                 ret = -1;
1912         /* GAS Comeback Request */
1913         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0c", 2) < 0)
1914                 ret = -1;
1915         /* GAS Comeback Response */
1916         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0d", 2) < 0)
1917                 ret = -1;
1918         /* Protected GAS Initial Request */
1919         if (nl80211_register_action_frame(bss, (u8 *) "\x09\x0a", 2) < 0)
1920                 ret = -1;
1921         /* Protected GAS Initial Response */
1922         if (nl80211_register_action_frame(bss, (u8 *) "\x09\x0b", 2) < 0)
1923                 ret = -1;
1924         /* Protected GAS Comeback Request */
1925         if (nl80211_register_action_frame(bss, (u8 *) "\x09\x0c", 2) < 0)
1926                 ret = -1;
1927         /* Protected GAS Comeback Response */
1928         if (nl80211_register_action_frame(bss, (u8 *) "\x09\x0d", 2) < 0)
1929                 ret = -1;
1930 #endif /* CONFIG_P2P || CONFIG_INTERWORKING */
1931 #ifdef CONFIG_P2P
1932         /* P2P Public Action */
1933         if (nl80211_register_action_frame(bss,
1934                                           (u8 *) "\x04\x09\x50\x6f\x9a\x09",
1935                                           6) < 0)
1936                 ret = -1;
1937         /* P2P Action */
1938         if (nl80211_register_action_frame(bss,
1939                                           (u8 *) "\x7f\x50\x6f\x9a\x09",
1940                                           5) < 0)
1941                 ret = -1;
1942 #endif /* CONFIG_P2P */
1943 #ifdef CONFIG_IEEE80211W
1944         /* SA Query Response */
1945         if (nl80211_register_action_frame(bss, (u8 *) "\x08\x01", 2) < 0)
1946                 ret = -1;
1947 #endif /* CONFIG_IEEE80211W */
1948 #ifdef CONFIG_TDLS
1949         if ((drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT)) {
1950                 /* TDLS Discovery Response */
1951                 if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0e", 2) <
1952                     0)
1953                         ret = -1;
1954         }
1955 #endif /* CONFIG_TDLS */
1956 #ifdef CONFIG_FST
1957         /* FST Action frames */
1958         if (nl80211_register_action_frame(bss, (u8 *) "\x12", 1) < 0)
1959                 ret = -1;
1960 #endif /* CONFIG_FST */
1961
1962         /* FT Action frames */
1963         if (nl80211_register_action_frame(bss, (u8 *) "\x06", 1) < 0)
1964                 ret = -1;
1965         else
1966                 drv->capa.key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_FT |
1967                         WPA_DRIVER_CAPA_KEY_MGMT_FT_PSK;
1968
1969         /* WNM - BSS Transition Management Request */
1970         if (nl80211_register_action_frame(bss, (u8 *) "\x0a\x07", 2) < 0)
1971                 ret = -1;
1972         /* WNM-Sleep Mode Response */
1973         if (nl80211_register_action_frame(bss, (u8 *) "\x0a\x11", 2) < 0)
1974                 ret = -1;
1975
1976 #ifdef CONFIG_HS20
1977         /* WNM-Notification */
1978         if (nl80211_register_action_frame(bss, (u8 *) "\x0a\x1a", 2) < 0)
1979                 ret = -1;
1980 #endif /* CONFIG_HS20 */
1981
1982         /* WMM-AC ADDTS Response */
1983         if (nl80211_register_action_frame(bss, (u8 *) "\x11\x01", 2) < 0)
1984                 ret = -1;
1985
1986         /* WMM-AC DELTS */
1987         if (nl80211_register_action_frame(bss, (u8 *) "\x11\x02", 2) < 0)
1988                 ret = -1;
1989
1990         /* Radio Measurement - Neighbor Report Response */
1991         if (nl80211_register_action_frame(bss, (u8 *) "\x05\x05", 2) < 0)
1992                 ret = -1;
1993
1994         /* Radio Measurement - Radio Measurement Request */
1995         if (nl80211_register_action_frame(bss, (u8 *) "\x05\x00", 2) < 0)
1996                 ret = -1;
1997
1998         /* Radio Measurement - Link Measurement Request */
1999         if ((drv->capa.rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION) &&
2000             (nl80211_register_action_frame(bss, (u8 *) "\x05\x02", 2) < 0))
2001                 ret = -1;
2002
2003         nl80211_mgmt_handle_register_eloop(bss);
2004
2005         return ret;
2006 }
2007
2008
2009 static int nl80211_mgmt_subscribe_mesh(struct i802_bss *bss)
2010 {
2011         int ret = 0;
2012
2013         if (nl80211_alloc_mgmt_handle(bss))
2014                 return -1;
2015
2016         wpa_printf(MSG_DEBUG,
2017                    "nl80211: Subscribe to mgmt frames with mesh handle %p",
2018                    bss->nl_mgmt);
2019
2020         /* Auth frames for mesh SAE */
2021         if (nl80211_register_frame(bss, bss->nl_mgmt,
2022                                    (WLAN_FC_TYPE_MGMT << 2) |
2023                                    (WLAN_FC_STYPE_AUTH << 4),
2024                                    NULL, 0) < 0)
2025                 ret = -1;
2026
2027         /* Mesh peering open */
2028         if (nl80211_register_action_frame(bss, (u8 *) "\x0f\x01", 2) < 0)
2029                 ret = -1;
2030         /* Mesh peering confirm */
2031         if (nl80211_register_action_frame(bss, (u8 *) "\x0f\x02", 2) < 0)
2032                 ret = -1;
2033         /* Mesh peering close */
2034         if (nl80211_register_action_frame(bss, (u8 *) "\x0f\x03", 2) < 0)
2035                 ret = -1;
2036
2037         nl80211_mgmt_handle_register_eloop(bss);
2038
2039         return ret;
2040 }
2041
2042
2043 static int nl80211_register_spurious_class3(struct i802_bss *bss)
2044 {
2045         struct nl_msg *msg;
2046         int ret;
2047
2048         msg = nl80211_bss_msg(bss, 0, NL80211_CMD_UNEXPECTED_FRAME);
2049         ret = send_and_recv(bss->drv->global, bss->nl_mgmt, msg, NULL, NULL);
2050         if (ret) {
2051                 wpa_printf(MSG_DEBUG, "nl80211: Register spurious class3 "
2052                            "failed: ret=%d (%s)",
2053                            ret, strerror(-ret));
2054         }
2055         return ret;
2056 }
2057
2058
2059 static int nl80211_action_subscribe_ap(struct i802_bss *bss)
2060 {
2061         int ret = 0;
2062
2063         /* Public Action frames */
2064         if (nl80211_register_action_frame(bss, (u8 *) "\x04", 1) < 0)
2065                 ret = -1;
2066         /* RRM Measurement Report */
2067         if (nl80211_register_action_frame(bss, (u8 *) "\x05\x01", 2) < 0)
2068                 ret = -1;
2069         /* RRM Neighbor Report Request */
2070         if (nl80211_register_action_frame(bss, (u8 *) "\x05\x04", 2) < 0)
2071                 ret = -1;
2072         /* FT Action frames */
2073         if (nl80211_register_action_frame(bss, (u8 *) "\x06", 1) < 0)
2074                 ret = -1;
2075 #ifdef CONFIG_IEEE80211W
2076         /* SA Query */
2077         if (nl80211_register_action_frame(bss, (u8 *) "\x08", 1) < 0)
2078                 ret = -1;
2079 #endif /* CONFIG_IEEE80211W */
2080         /* Protected Dual of Public Action */
2081         if (nl80211_register_action_frame(bss, (u8 *) "\x09", 1) < 0)
2082                 ret = -1;
2083         /* WNM */
2084         if (nl80211_register_action_frame(bss, (u8 *) "\x0a", 1) < 0)
2085                 ret = -1;
2086         /* WMM */
2087         if (nl80211_register_action_frame(bss, (u8 *) "\x11", 1) < 0)
2088                 ret = -1;
2089 #ifdef CONFIG_FST
2090         /* FST Action frames */
2091         if (nl80211_register_action_frame(bss, (u8 *) "\x12", 1) < 0)
2092                 ret = -1;
2093 #endif /* CONFIG_FST */
2094         /* Vendor-specific */
2095         if (nl80211_register_action_frame(bss, (u8 *) "\x7f", 1) < 0)
2096                 ret = -1;
2097
2098         return ret;
2099 }
2100
2101
2102 static int nl80211_mgmt_subscribe_ap(struct i802_bss *bss)
2103 {
2104         static const int stypes[] = {
2105                 WLAN_FC_STYPE_AUTH,
2106                 WLAN_FC_STYPE_ASSOC_REQ,
2107                 WLAN_FC_STYPE_REASSOC_REQ,
2108                 WLAN_FC_STYPE_DISASSOC,
2109                 WLAN_FC_STYPE_DEAUTH,
2110                 WLAN_FC_STYPE_PROBE_REQ,
2111 /* Beacon doesn't work as mac80211 doesn't currently allow
2112  * it, but it wouldn't really be the right thing anyway as
2113  * it isn't per interface ... maybe just dump the scan
2114  * results periodically for OLBC?
2115  */
2116                 /* WLAN_FC_STYPE_BEACON, */
2117         };
2118         unsigned int i;
2119
2120         if (nl80211_alloc_mgmt_handle(bss))
2121                 return -1;
2122         wpa_printf(MSG_DEBUG, "nl80211: Subscribe to mgmt frames with AP "
2123                    "handle %p", bss->nl_mgmt);
2124
2125         for (i = 0; i < ARRAY_SIZE(stypes); i++) {
2126                 if (nl80211_register_frame(bss, bss->nl_mgmt,
2127                                            (WLAN_FC_TYPE_MGMT << 2) |
2128                                            (stypes[i] << 4),
2129                                            NULL, 0) < 0) {
2130                         goto out_err;
2131                 }
2132         }
2133
2134         if (nl80211_action_subscribe_ap(bss))
2135                 goto out_err;
2136
2137         if (nl80211_register_spurious_class3(bss))
2138                 goto out_err;
2139
2140         if (nl80211_get_wiphy_data_ap(bss) == NULL)
2141                 goto out_err;
2142
2143         nl80211_mgmt_handle_register_eloop(bss);
2144         return 0;
2145
2146 out_err:
2147         nl_destroy_handles(&bss->nl_mgmt);
2148         return -1;
2149 }
2150
2151
2152 static int nl80211_mgmt_subscribe_ap_dev_sme(struct i802_bss *bss)
2153 {
2154         if (nl80211_alloc_mgmt_handle(bss))
2155                 return -1;
2156         wpa_printf(MSG_DEBUG, "nl80211: Subscribe to mgmt frames with AP "
2157                    "handle %p (device SME)", bss->nl_mgmt);
2158
2159         if (nl80211_action_subscribe_ap(bss))
2160                 goto out_err;
2161
2162         nl80211_mgmt_handle_register_eloop(bss);
2163         return 0;
2164
2165 out_err:
2166         nl_destroy_handles(&bss->nl_mgmt);
2167         return -1;
2168 }
2169
2170
2171 static void nl80211_mgmt_unsubscribe(struct i802_bss *bss, const char *reason)
2172 {
2173         if (bss->nl_mgmt == NULL)
2174                 return;
2175         wpa_printf(MSG_DEBUG, "nl80211: Unsubscribe mgmt frames handle %p "
2176                    "(%s)", bss->nl_mgmt, reason);
2177         nl80211_destroy_eloop_handle(&bss->nl_mgmt);
2178
2179         nl80211_put_wiphy_data_ap(bss);
2180 }
2181
2182
2183 static void wpa_driver_nl80211_send_rfkill(void *eloop_ctx, void *timeout_ctx)
2184 {
2185         wpa_supplicant_event(timeout_ctx, EVENT_INTERFACE_DISABLED, NULL);
2186 }
2187
2188
2189 static void nl80211_del_p2pdev(struct i802_bss *bss)
2190 {
2191         struct nl_msg *msg;
2192         int ret;
2193
2194         msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_DEL_INTERFACE);
2195         ret = send_and_recv_msgs(bss->drv, msg, NULL, NULL);
2196
2197         wpa_printf(MSG_DEBUG, "nl80211: Delete P2P Device %s (0x%llx): %s",
2198                    bss->ifname, (long long unsigned int) bss->wdev_id,
2199                    strerror(-ret));
2200 }
2201
2202
2203 static int nl80211_set_p2pdev(struct i802_bss *bss, int start)
2204 {
2205         struct nl_msg *msg;
2206         int ret;
2207
2208         msg = nl80211_cmd_msg(bss, 0, start ? NL80211_CMD_START_P2P_DEVICE :
2209                               NL80211_CMD_STOP_P2P_DEVICE);
2210         ret = send_and_recv_msgs(bss->drv, msg, NULL, NULL);
2211
2212         wpa_printf(MSG_DEBUG, "nl80211: %s P2P Device %s (0x%llx): %s",
2213                    start ? "Start" : "Stop",
2214                    bss->ifname, (long long unsigned int) bss->wdev_id,
2215                    strerror(-ret));
2216         return ret;
2217 }
2218
2219
2220 static int i802_set_iface_flags(struct i802_bss *bss, int up)
2221 {
2222         enum nl80211_iftype nlmode;
2223
2224         nlmode = nl80211_get_ifmode(bss);
2225         if (nlmode != NL80211_IFTYPE_P2P_DEVICE) {
2226                 return linux_set_iface_flags(bss->drv->global->ioctl_sock,
2227                                              bss->ifname, up);
2228         }
2229
2230         /* P2P Device has start/stop which is equivalent */
2231         return nl80211_set_p2pdev(bss, up);
2232 }
2233
2234
2235 #ifdef CONFIG_TESTING_OPTIONS
2236 static int qca_vendor_test_cmd_handler(struct nl_msg *msg, void *arg)
2237 {
2238         /* struct wpa_driver_nl80211_data *drv = arg; */
2239         struct nlattr *tb[NL80211_ATTR_MAX + 1];
2240         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
2241
2242
2243         wpa_printf(MSG_DEBUG,
2244                    "nl80211: QCA vendor test command response received");
2245
2246         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
2247                   genlmsg_attrlen(gnlh, 0), NULL);
2248         if (!tb[NL80211_ATTR_VENDOR_DATA]) {
2249                 wpa_printf(MSG_DEBUG, "nl80211: No vendor data attribute");
2250                 return NL_SKIP;
2251         }
2252
2253         wpa_hexdump(MSG_DEBUG,
2254                     "nl80211: Received QCA vendor test command response",
2255                     nla_data(tb[NL80211_ATTR_VENDOR_DATA]),
2256                     nla_len(tb[NL80211_ATTR_VENDOR_DATA]));
2257
2258         return NL_SKIP;
2259 }
2260 #endif /* CONFIG_TESTING_OPTIONS */
2261
2262
2263 static void qca_vendor_test(struct wpa_driver_nl80211_data *drv)
2264 {
2265 #ifdef CONFIG_TESTING_OPTIONS
2266         struct nl_msg *msg;
2267         struct nlattr *params;
2268         int ret;
2269
2270         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
2271             nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
2272             nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
2273                         QCA_NL80211_VENDOR_SUBCMD_TEST) ||
2274             !(params = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
2275             nla_put_u32(msg, QCA_WLAN_VENDOR_ATTR_TEST, 123)) {
2276                 nlmsg_free(msg);
2277                 return;
2278         }
2279         nla_nest_end(msg, params);
2280
2281         ret = send_and_recv_msgs(drv, msg, qca_vendor_test_cmd_handler, drv);
2282         wpa_printf(MSG_DEBUG,
2283                    "nl80211: QCA vendor test command returned %d (%s)",
2284                    ret, strerror(-ret));
2285 #endif /* CONFIG_TESTING_OPTIONS */
2286 }
2287
2288
2289 static int
2290 wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv,
2291                                    const u8 *set_addr, int first,
2292                                    const char *driver_params)
2293 {
2294         struct i802_bss *bss = drv->first_bss;
2295         int send_rfkill_event = 0;
2296         enum nl80211_iftype nlmode;
2297
2298         drv->ifindex = if_nametoindex(bss->ifname);
2299         bss->ifindex = drv->ifindex;
2300         bss->wdev_id = drv->global->if_add_wdevid;
2301         bss->wdev_id_set = drv->global->if_add_wdevid_set;
2302
2303         bss->if_dynamic = drv->ifindex == drv->global->if_add_ifindex;
2304         bss->if_dynamic = bss->if_dynamic || drv->global->if_add_wdevid_set;
2305         drv->global->if_add_wdevid_set = 0;
2306
2307         if (!bss->if_dynamic && nl80211_get_ifmode(bss) == NL80211_IFTYPE_AP)
2308                 bss->static_ap = 1;
2309
2310         if (first &&
2311             nl80211_get_ifmode(bss) != NL80211_IFTYPE_P2P_DEVICE &&
2312             linux_iface_up(drv->global->ioctl_sock, bss->ifname) > 0)
2313                 drv->start_iface_up = 1;
2314
2315         if (wpa_driver_nl80211_capa(drv))
2316                 return -1;
2317
2318         if (driver_params && nl80211_set_param(bss, driver_params) < 0)
2319                 return -1;
2320
2321         wpa_printf(MSG_DEBUG, "nl80211: interface %s in phy %s",
2322                    bss->ifname, drv->phyname);
2323
2324         if (set_addr &&
2325             (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 0) ||
2326              linux_set_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
2327                                 set_addr)))
2328                 return -1;
2329
2330         if (first && nl80211_get_ifmode(bss) == NL80211_IFTYPE_AP)
2331                 drv->start_mode_ap = 1;
2332
2333         if (drv->hostapd || bss->static_ap)
2334                 nlmode = NL80211_IFTYPE_AP;
2335         else if (bss->if_dynamic ||
2336                  nl80211_get_ifmode(bss) == NL80211_IFTYPE_MESH_POINT)
2337                 nlmode = nl80211_get_ifmode(bss);
2338         else
2339                 nlmode = NL80211_IFTYPE_STATION;
2340
2341         if (wpa_driver_nl80211_set_mode(bss, nlmode) < 0) {
2342                 wpa_printf(MSG_ERROR, "nl80211: Could not configure driver mode");
2343                 return -1;
2344         }
2345
2346         if (nlmode == NL80211_IFTYPE_P2P_DEVICE)
2347                 nl80211_get_macaddr(bss);
2348
2349         wpa_driver_nl80211_drv_init_rfkill(drv);
2350
2351         if (!rfkill_is_blocked(drv->rfkill)) {
2352                 int ret = i802_set_iface_flags(bss, 1);
2353                 if (ret) {
2354                         wpa_printf(MSG_ERROR, "nl80211: Could not set "
2355                                    "interface '%s' UP", bss->ifname);
2356                         return ret;
2357                 }
2358
2359                 if (is_p2p_net_interface(nlmode))
2360                         nl80211_disable_11b_rates(bss->drv,
2361                                                   bss->drv->ifindex, 1);
2362
2363                 if (nlmode == NL80211_IFTYPE_P2P_DEVICE)
2364                         return ret;
2365         } else {
2366                 wpa_printf(MSG_DEBUG, "nl80211: Could not yet enable "
2367                            "interface '%s' due to rfkill", bss->ifname);
2368                 if (nlmode != NL80211_IFTYPE_P2P_DEVICE)
2369                         drv->if_disabled = 1;
2370
2371                 send_rfkill_event = 1;
2372         }
2373
2374         if (!drv->hostapd && nlmode != NL80211_IFTYPE_P2P_DEVICE)
2375                 netlink_send_oper_ifla(drv->global->netlink, drv->ifindex,
2376                                        1, IF_OPER_DORMANT);
2377
2378         if (nlmode != NL80211_IFTYPE_P2P_DEVICE) {
2379                 if (linux_get_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
2380                                        bss->addr))
2381                         return -1;
2382                 os_memcpy(drv->perm_addr, bss->addr, ETH_ALEN);
2383         }
2384
2385         if (send_rfkill_event) {
2386                 eloop_register_timeout(0, 0, wpa_driver_nl80211_send_rfkill,
2387                                        drv, drv->ctx);
2388         }
2389
2390         if (drv->vendor_cmd_test_avail)
2391                 qca_vendor_test(drv);
2392
2393         return 0;
2394 }
2395
2396
2397 static int wpa_driver_nl80211_del_beacon(struct wpa_driver_nl80211_data *drv)
2398 {
2399         struct nl_msg *msg;
2400
2401         wpa_printf(MSG_DEBUG, "nl80211: Remove beacon (ifindex=%d)",
2402                    drv->ifindex);
2403         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_DEL_BEACON);
2404         return send_and_recv_msgs(drv, msg, NULL, NULL);
2405 }
2406
2407
2408 /**
2409  * wpa_driver_nl80211_deinit - Deinitialize nl80211 driver interface
2410  * @bss: Pointer to private nl80211 data from wpa_driver_nl80211_init()
2411  *
2412  * Shut down driver interface and processing of driver events. Free
2413  * private data buffer if one was allocated in wpa_driver_nl80211_init().
2414  */
2415 static void wpa_driver_nl80211_deinit(struct i802_bss *bss)
2416 {
2417         struct wpa_driver_nl80211_data *drv = bss->drv;
2418         unsigned int i;
2419
2420         wpa_printf(MSG_INFO, "nl80211: deinit ifname=%s disabled_11b_rates=%d",
2421                    bss->ifname, drv->disabled_11b_rates);
2422
2423         bss->in_deinit = 1;
2424         if (drv->data_tx_status)
2425                 eloop_unregister_read_sock(drv->eapol_tx_sock);
2426         if (drv->eapol_tx_sock >= 0)
2427                 close(drv->eapol_tx_sock);
2428
2429         if (bss->nl_preq)
2430                 wpa_driver_nl80211_probe_req_report(bss, 0);
2431         if (bss->added_if_into_bridge) {
2432                 if (linux_br_del_if(drv->global->ioctl_sock, bss->brname,
2433                                     bss->ifname) < 0)
2434                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
2435                                    "interface %s from bridge %s: %s",
2436                                    bss->ifname, bss->brname, strerror(errno));
2437                 if (drv->rtnl_sk)
2438                         nl80211_handle_destroy(drv->rtnl_sk);
2439         }
2440         if (bss->added_bridge) {
2441                 if (linux_set_iface_flags(drv->global->ioctl_sock, bss->brname,
2442                                           0) < 0)
2443                         wpa_printf(MSG_INFO,
2444                                    "nl80211: Could not set bridge %s down",
2445                                    bss->brname);
2446                 if (linux_br_del(drv->global->ioctl_sock, bss->brname) < 0)
2447                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
2448                                    "bridge %s: %s",
2449                                    bss->brname, strerror(errno));
2450         }
2451
2452         nl80211_remove_monitor_interface(drv);
2453
2454         if (is_ap_interface(drv->nlmode))
2455                 wpa_driver_nl80211_del_beacon(drv);
2456
2457         if (drv->eapol_sock >= 0) {
2458                 eloop_unregister_read_sock(drv->eapol_sock);
2459                 close(drv->eapol_sock);
2460         }
2461
2462         if (drv->if_indices != drv->default_if_indices)
2463                 os_free(drv->if_indices);
2464
2465         if (drv->if_indices_reason != drv->default_if_indices_reason)
2466                 os_free(drv->if_indices_reason);
2467
2468         if (drv->disabled_11b_rates)
2469                 nl80211_disable_11b_rates(drv, drv->ifindex, 0);
2470
2471         netlink_send_oper_ifla(drv->global->netlink, drv->ifindex, 0,
2472                                IF_OPER_UP);
2473         eloop_cancel_timeout(wpa_driver_nl80211_send_rfkill, drv, drv->ctx);
2474         rfkill_deinit(drv->rfkill);
2475
2476         eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
2477
2478         if (!drv->start_iface_up)
2479                 (void) i802_set_iface_flags(bss, 0);
2480
2481         if (drv->addr_changed) {
2482                 if (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname,
2483                                           0) < 0) {
2484                         wpa_printf(MSG_DEBUG,
2485                                    "nl80211: Could not set interface down to restore permanent MAC address");
2486                 }
2487                 if (linux_set_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
2488                                        drv->perm_addr) < 0) {
2489                         wpa_printf(MSG_DEBUG,
2490                                    "nl80211: Could not restore permanent MAC address");
2491                 }
2492         }
2493
2494         if (drv->nlmode != NL80211_IFTYPE_P2P_DEVICE) {
2495                 if (!drv->hostapd || !drv->start_mode_ap)
2496                         wpa_driver_nl80211_set_mode(bss,
2497                                                     NL80211_IFTYPE_STATION);
2498                 nl80211_mgmt_unsubscribe(bss, "deinit");
2499         } else {
2500                 nl80211_mgmt_unsubscribe(bss, "deinit");
2501                 nl80211_del_p2pdev(bss);
2502         }
2503
2504         nl80211_destroy_bss(drv->first_bss);
2505
2506         os_free(drv->filter_ssids);
2507
2508         os_free(drv->auth_ie);
2509
2510         if (drv->in_interface_list)
2511                 dl_list_del(&drv->list);
2512
2513         os_free(drv->extended_capa);
2514         os_free(drv->extended_capa_mask);
2515         for (i = 0; i < drv->num_iface_ext_capa; i++) {
2516                 os_free(drv->iface_ext_capa[i].ext_capa);
2517                 os_free(drv->iface_ext_capa[i].ext_capa_mask);
2518         }
2519         os_free(drv->first_bss);
2520         os_free(drv);
2521 }
2522
2523
2524 static u32 wpa_alg_to_cipher_suite(enum wpa_alg alg, size_t key_len)
2525 {
2526         switch (alg) {
2527         case WPA_ALG_WEP:
2528                 if (key_len == 5)
2529                         return WLAN_CIPHER_SUITE_WEP40;
2530                 return WLAN_CIPHER_SUITE_WEP104;
2531         case WPA_ALG_TKIP:
2532                 return WLAN_CIPHER_SUITE_TKIP;
2533         case WPA_ALG_CCMP:
2534                 return WLAN_CIPHER_SUITE_CCMP;
2535         case WPA_ALG_GCMP:
2536                 return WLAN_CIPHER_SUITE_GCMP;
2537         case WPA_ALG_CCMP_256:
2538                 return WLAN_CIPHER_SUITE_CCMP_256;
2539         case WPA_ALG_GCMP_256:
2540                 return WLAN_CIPHER_SUITE_GCMP_256;
2541         case WPA_ALG_IGTK:
2542                 return WLAN_CIPHER_SUITE_AES_CMAC;
2543         case WPA_ALG_BIP_GMAC_128:
2544                 return WLAN_CIPHER_SUITE_BIP_GMAC_128;
2545         case WPA_ALG_BIP_GMAC_256:
2546                 return WLAN_CIPHER_SUITE_BIP_GMAC_256;
2547         case WPA_ALG_BIP_CMAC_256:
2548                 return WLAN_CIPHER_SUITE_BIP_CMAC_256;
2549         case WPA_ALG_SMS4:
2550                 return WLAN_CIPHER_SUITE_SMS4;
2551         case WPA_ALG_KRK:
2552                 return WLAN_CIPHER_SUITE_KRK;
2553         case WPA_ALG_NONE:
2554         case WPA_ALG_PMK:
2555                 wpa_printf(MSG_ERROR, "nl80211: Unexpected encryption algorithm %d",
2556                            alg);
2557                 return 0;
2558         }
2559
2560         wpa_printf(MSG_ERROR, "nl80211: Unsupported encryption algorithm %d",
2561                    alg);
2562         return 0;
2563 }
2564
2565
2566 static u32 wpa_cipher_to_cipher_suite(unsigned int cipher)
2567 {
2568         switch (cipher) {
2569         case WPA_CIPHER_CCMP_256:
2570                 return WLAN_CIPHER_SUITE_CCMP_256;
2571         case WPA_CIPHER_GCMP_256:
2572                 return WLAN_CIPHER_SUITE_GCMP_256;
2573         case WPA_CIPHER_CCMP:
2574                 return WLAN_CIPHER_SUITE_CCMP;
2575         case WPA_CIPHER_GCMP:
2576                 return WLAN_CIPHER_SUITE_GCMP;
2577         case WPA_CIPHER_TKIP:
2578                 return WLAN_CIPHER_SUITE_TKIP;
2579         case WPA_CIPHER_WEP104:
2580                 return WLAN_CIPHER_SUITE_WEP104;
2581         case WPA_CIPHER_WEP40:
2582                 return WLAN_CIPHER_SUITE_WEP40;
2583         case WPA_CIPHER_GTK_NOT_USED:
2584                 return WLAN_CIPHER_SUITE_NO_GROUP_ADDR;
2585         }
2586
2587         return 0;
2588 }
2589
2590
2591 static int wpa_cipher_to_cipher_suites(unsigned int ciphers, u32 suites[],
2592                                        int max_suites)
2593 {
2594         int num_suites = 0;
2595
2596         if (num_suites < max_suites && ciphers & WPA_CIPHER_CCMP_256)
2597                 suites[num_suites++] = WLAN_CIPHER_SUITE_CCMP_256;
2598         if (num_suites < max_suites && ciphers & WPA_CIPHER_GCMP_256)
2599                 suites[num_suites++] = WLAN_CIPHER_SUITE_GCMP_256;
2600         if (num_suites < max_suites && ciphers & WPA_CIPHER_CCMP)
2601                 suites[num_suites++] = WLAN_CIPHER_SUITE_CCMP;
2602         if (num_suites < max_suites && ciphers & WPA_CIPHER_GCMP)
2603                 suites[num_suites++] = WLAN_CIPHER_SUITE_GCMP;
2604         if (num_suites < max_suites && ciphers & WPA_CIPHER_TKIP)
2605                 suites[num_suites++] = WLAN_CIPHER_SUITE_TKIP;
2606         if (num_suites < max_suites && ciphers & WPA_CIPHER_WEP104)
2607                 suites[num_suites++] = WLAN_CIPHER_SUITE_WEP104;
2608         if (num_suites < max_suites && ciphers & WPA_CIPHER_WEP40)
2609                 suites[num_suites++] = WLAN_CIPHER_SUITE_WEP40;
2610
2611         return num_suites;
2612 }
2613
2614
2615 #ifdef CONFIG_DRIVER_NL80211_QCA
2616 static int issue_key_mgmt_set_key(struct wpa_driver_nl80211_data *drv,
2617                                   const u8 *key, size_t key_len)
2618 {
2619         struct nl_msg *msg;
2620         int ret;
2621
2622         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_KEY_MGMT_OFFLOAD))
2623                 return 0;
2624
2625         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
2626             nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
2627             nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
2628                         QCA_NL80211_VENDOR_SUBCMD_KEY_MGMT_SET_KEY) ||
2629             nla_put(msg, NL80211_ATTR_VENDOR_DATA, key_len, key)) {
2630                 nl80211_nlmsg_clear(msg);
2631                 nlmsg_free(msg);
2632                 return -1;
2633         }
2634         ret = send_and_recv_msgs(drv, msg, NULL, (void *) -1);
2635         if (ret) {
2636                 wpa_printf(MSG_DEBUG,
2637                            "nl80211: Key management set key failed: ret=%d (%s)",
2638                            ret, strerror(-ret));
2639         }
2640
2641         return ret;
2642 }
2643 #endif /* CONFIG_DRIVER_NL80211_QCA */
2644
2645
2646 static int wpa_driver_nl80211_set_key(const char *ifname, struct i802_bss *bss,
2647                                       enum wpa_alg alg, const u8 *addr,
2648                                       int key_idx, int set_tx,
2649                                       const u8 *seq, size_t seq_len,
2650                                       const u8 *key, size_t key_len)
2651 {
2652         struct wpa_driver_nl80211_data *drv = bss->drv;
2653         int ifindex;
2654         struct nl_msg *msg = NULL;
2655         int ret;
2656         int tdls = 0;
2657
2658         /* Ignore for P2P Device */
2659         if (drv->nlmode == NL80211_IFTYPE_P2P_DEVICE)
2660                 return 0;
2661
2662         ifindex = if_nametoindex(ifname);
2663         wpa_printf(MSG_DEBUG, "%s: ifindex=%d (%s) alg=%d addr=%p key_idx=%d "
2664                    "set_tx=%d seq_len=%lu key_len=%lu",
2665                    __func__, ifindex, ifname, alg, addr, key_idx, set_tx,
2666                    (unsigned long) seq_len, (unsigned long) key_len);
2667 #ifdef CONFIG_TDLS
2668         if (key_idx == -1) {
2669                 key_idx = 0;
2670                 tdls = 1;
2671         }
2672 #endif /* CONFIG_TDLS */
2673
2674 #ifdef CONFIG_DRIVER_NL80211_QCA
2675         if (alg == WPA_ALG_PMK &&
2676             (drv->capa.flags & WPA_DRIVER_FLAGS_KEY_MGMT_OFFLOAD)) {
2677                 wpa_printf(MSG_DEBUG, "%s: calling issue_key_mgmt_set_key",
2678                            __func__);
2679                 ret = issue_key_mgmt_set_key(drv, key, key_len);
2680                 return ret;
2681         }
2682 #endif /* CONFIG_DRIVER_NL80211_QCA */
2683
2684         if (alg == WPA_ALG_NONE) {
2685                 msg = nl80211_ifindex_msg(drv, ifindex, 0, NL80211_CMD_DEL_KEY);
2686                 if (!msg)
2687                         return -ENOBUFS;
2688         } else {
2689                 u32 suite;
2690
2691                 suite = wpa_alg_to_cipher_suite(alg, key_len);
2692                 if (!suite)
2693                         goto fail;
2694                 msg = nl80211_ifindex_msg(drv, ifindex, 0, NL80211_CMD_NEW_KEY);
2695                 if (!msg ||
2696                     nla_put(msg, NL80211_ATTR_KEY_DATA, key_len, key) ||
2697                     nla_put_u32(msg, NL80211_ATTR_KEY_CIPHER, suite))
2698                         goto fail;
2699                 wpa_hexdump_key(MSG_DEBUG, "nl80211: KEY_DATA", key, key_len);
2700         }
2701
2702         if (seq && seq_len) {
2703                 if (nla_put(msg, NL80211_ATTR_KEY_SEQ, seq_len, seq))
2704                         goto fail;
2705                 wpa_hexdump(MSG_DEBUG, "nl80211: KEY_SEQ", seq, seq_len);
2706         }
2707
2708         if (addr && !is_broadcast_ether_addr(addr)) {
2709                 wpa_printf(MSG_DEBUG, "   addr=" MACSTR, MAC2STR(addr));
2710                 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
2711                         goto fail;
2712
2713                 if (alg != WPA_ALG_WEP && key_idx && !set_tx) {
2714                         wpa_printf(MSG_DEBUG, "   RSN IBSS RX GTK");
2715                         if (nla_put_u32(msg, NL80211_ATTR_KEY_TYPE,
2716                                         NL80211_KEYTYPE_GROUP))
2717                                 goto fail;
2718                 }
2719         } else if (addr && is_broadcast_ether_addr(addr)) {
2720                 struct nlattr *types;
2721
2722                 wpa_printf(MSG_DEBUG, "   broadcast key");
2723
2724                 types = nla_nest_start(msg, NL80211_ATTR_KEY_DEFAULT_TYPES);
2725                 if (!types ||
2726                     nla_put_flag(msg, NL80211_KEY_DEFAULT_TYPE_MULTICAST))
2727                         goto fail;
2728                 nla_nest_end(msg, types);
2729         }
2730         if (nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2731                 goto fail;
2732
2733         ret = send_and_recv_msgs(drv, msg, NULL, key ? (void *) -1 : NULL);
2734         if ((ret == -ENOENT || ret == -ENOLINK) && alg == WPA_ALG_NONE)
2735                 ret = 0;
2736         if (ret)
2737                 wpa_printf(MSG_DEBUG, "nl80211: set_key failed; err=%d %s)",
2738                            ret, strerror(-ret));
2739
2740         /*
2741          * If we failed or don't need to set the default TX key (below),
2742          * we're done here.
2743          */
2744         if (ret || !set_tx || alg == WPA_ALG_NONE || tdls)
2745                 return ret;
2746         if (is_ap_interface(drv->nlmode) && addr &&
2747             !is_broadcast_ether_addr(addr))
2748                 return ret;
2749
2750         msg = nl80211_ifindex_msg(drv, ifindex, 0, NL80211_CMD_SET_KEY);
2751         if (!msg ||
2752             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx) ||
2753             nla_put_flag(msg, (alg == WPA_ALG_IGTK ||
2754                                alg == WPA_ALG_BIP_GMAC_128 ||
2755                                alg == WPA_ALG_BIP_GMAC_256 ||
2756                                alg == WPA_ALG_BIP_CMAC_256) ?
2757                          NL80211_ATTR_KEY_DEFAULT_MGMT :
2758                          NL80211_ATTR_KEY_DEFAULT))
2759                 goto fail;
2760         if (addr && is_broadcast_ether_addr(addr)) {
2761                 struct nlattr *types;
2762
2763                 types = nla_nest_start(msg, NL80211_ATTR_KEY_DEFAULT_TYPES);
2764                 if (!types ||
2765                     nla_put_flag(msg, NL80211_KEY_DEFAULT_TYPE_MULTICAST))
2766                         goto fail;
2767                 nla_nest_end(msg, types);
2768         } else if (addr) {
2769                 struct nlattr *types;
2770
2771                 types = nla_nest_start(msg, NL80211_ATTR_KEY_DEFAULT_TYPES);
2772                 if (!types ||
2773                     nla_put_flag(msg, NL80211_KEY_DEFAULT_TYPE_UNICAST))
2774                         goto fail;
2775                 nla_nest_end(msg, types);
2776         }
2777
2778         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
2779         if (ret == -ENOENT)
2780                 ret = 0;
2781         if (ret)
2782                 wpa_printf(MSG_DEBUG, "nl80211: set_key default failed; "
2783                            "err=%d %s)", ret, strerror(-ret));
2784         return ret;
2785
2786 fail:
2787         nl80211_nlmsg_clear(msg);
2788         nlmsg_free(msg);
2789         return -ENOBUFS;
2790 }
2791
2792
2793 static int nl_add_key(struct nl_msg *msg, enum wpa_alg alg,
2794                       int key_idx, int defkey,
2795                       const u8 *seq, size_t seq_len,
2796                       const u8 *key, size_t key_len)
2797 {
2798         struct nlattr *key_attr = nla_nest_start(msg, NL80211_ATTR_KEY);
2799         u32 suite;
2800
2801         if (!key_attr)
2802                 return -1;
2803
2804         suite = wpa_alg_to_cipher_suite(alg, key_len);
2805         if (!suite)
2806                 return -1;
2807
2808         if (defkey && alg == WPA_ALG_IGTK) {
2809                 if (nla_put_flag(msg, NL80211_KEY_DEFAULT_MGMT))
2810                         return -1;
2811         } else if (defkey) {
2812                 if (nla_put_flag(msg, NL80211_KEY_DEFAULT))
2813                         return -1;
2814         }
2815
2816         if (nla_put_u8(msg, NL80211_KEY_IDX, key_idx) ||
2817             nla_put_u32(msg, NL80211_KEY_CIPHER, suite) ||
2818             (seq && seq_len &&
2819              nla_put(msg, NL80211_KEY_SEQ, seq_len, seq)) ||
2820             nla_put(msg, NL80211_KEY_DATA, key_len, key))
2821                 return -1;
2822
2823         nla_nest_end(msg, key_attr);
2824
2825         return 0;
2826 }
2827
2828
2829 static int nl80211_set_conn_keys(struct wpa_driver_associate_params *params,
2830                                  struct nl_msg *msg)
2831 {
2832         int i, privacy = 0;
2833         struct nlattr *nl_keys, *nl_key;
2834
2835         for (i = 0; i < 4; i++) {
2836                 if (!params->wep_key[i])
2837                         continue;
2838                 privacy = 1;
2839                 break;
2840         }
2841         if (params->wps == WPS_MODE_PRIVACY)
2842                 privacy = 1;
2843         if (params->pairwise_suite &&
2844             params->pairwise_suite != WPA_CIPHER_NONE)
2845                 privacy = 1;
2846
2847         if (!privacy)
2848                 return 0;
2849
2850         if (nla_put_flag(msg, NL80211_ATTR_PRIVACY))
2851                 return -ENOBUFS;
2852
2853         nl_keys = nla_nest_start(msg, NL80211_ATTR_KEYS);
2854         if (!nl_keys)
2855                 return -ENOBUFS;
2856
2857         for (i = 0; i < 4; i++) {
2858                 if (!params->wep_key[i])
2859                         continue;
2860
2861                 nl_key = nla_nest_start(msg, i);
2862                 if (!nl_key ||
2863                     nla_put(msg, NL80211_KEY_DATA, params->wep_key_len[i],
2864                             params->wep_key[i]) ||
2865                     nla_put_u32(msg, NL80211_KEY_CIPHER,
2866                                 params->wep_key_len[i] == 5 ?
2867                                 WLAN_CIPHER_SUITE_WEP40 :
2868                                 WLAN_CIPHER_SUITE_WEP104) ||
2869                     nla_put_u8(msg, NL80211_KEY_IDX, i) ||
2870                     (i == params->wep_tx_keyidx &&
2871                      nla_put_flag(msg, NL80211_KEY_DEFAULT)))
2872                         return -ENOBUFS;
2873
2874                 nla_nest_end(msg, nl_key);
2875         }
2876         nla_nest_end(msg, nl_keys);
2877
2878         return 0;
2879 }
2880
2881
2882 int wpa_driver_nl80211_mlme(struct wpa_driver_nl80211_data *drv,
2883                             const u8 *addr, int cmd, u16 reason_code,
2884                             int local_state_change)
2885 {
2886         int ret;
2887         struct nl_msg *msg;
2888
2889         if (!(msg = nl80211_drv_msg(drv, 0, cmd)) ||
2890             nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code) ||
2891             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
2892             (local_state_change &&
2893              nla_put_flag(msg, NL80211_ATTR_LOCAL_STATE_CHANGE))) {
2894                 nlmsg_free(msg);
2895                 return -1;
2896         }
2897
2898         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
2899         if (ret) {
2900                 wpa_dbg(drv->ctx, MSG_DEBUG,
2901                         "nl80211: MLME command failed: reason=%u ret=%d (%s)",
2902                         reason_code, ret, strerror(-ret));
2903         }
2904         return ret;
2905 }
2906
2907
2908 static int wpa_driver_nl80211_disconnect(struct wpa_driver_nl80211_data *drv,
2909                                          int reason_code)
2910 {
2911         int ret;
2912
2913         wpa_printf(MSG_DEBUG, "%s(reason_code=%d)", __func__, reason_code);
2914         nl80211_mark_disconnected(drv);
2915         /* Disconnect command doesn't need BSSID - it uses cached value */
2916         ret = wpa_driver_nl80211_mlme(drv, NULL, NL80211_CMD_DISCONNECT,
2917                                       reason_code, 0);
2918         /*
2919          * For locally generated disconnect, supplicant already generates a
2920          * DEAUTH event, so ignore the event from NL80211.
2921          */
2922         drv->ignore_next_local_disconnect = ret == 0;
2923
2924         return ret;
2925 }
2926
2927
2928 static int wpa_driver_nl80211_deauthenticate(struct i802_bss *bss,
2929                                              const u8 *addr, int reason_code)
2930 {
2931         struct wpa_driver_nl80211_data *drv = bss->drv;
2932         int ret;
2933
2934         if (drv->nlmode == NL80211_IFTYPE_ADHOC) {
2935                 nl80211_mark_disconnected(drv);
2936                 return nl80211_leave_ibss(drv, 1);
2937         }
2938         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME))
2939                 return wpa_driver_nl80211_disconnect(drv, reason_code);
2940         wpa_printf(MSG_DEBUG, "%s(addr=" MACSTR " reason_code=%d)",
2941                    __func__, MAC2STR(addr), reason_code);
2942         nl80211_mark_disconnected(drv);
2943         ret = wpa_driver_nl80211_mlme(drv, addr, NL80211_CMD_DEAUTHENTICATE,
2944                                       reason_code, 0);
2945         /*
2946          * For locally generated deauthenticate, supplicant already generates a
2947          * DEAUTH event, so ignore the event from NL80211.
2948          */
2949         drv->ignore_next_local_deauth = ret == 0;
2950         return ret;
2951 }
2952
2953
2954 static void nl80211_copy_auth_params(struct wpa_driver_nl80211_data *drv,
2955                                      struct wpa_driver_auth_params *params)
2956 {
2957         int i;
2958
2959         drv->auth_freq = params->freq;
2960         drv->auth_alg = params->auth_alg;
2961         drv->auth_wep_tx_keyidx = params->wep_tx_keyidx;
2962         drv->auth_local_state_change = params->local_state_change;
2963         drv->auth_p2p = params->p2p;
2964
2965         if (params->bssid)
2966                 os_memcpy(drv->auth_bssid_, params->bssid, ETH_ALEN);
2967         else
2968                 os_memset(drv->auth_bssid_, 0, ETH_ALEN);
2969
2970         if (params->ssid) {
2971                 os_memcpy(drv->auth_ssid, params->ssid, params->ssid_len);
2972                 drv->auth_ssid_len = params->ssid_len;
2973         } else
2974                 drv->auth_ssid_len = 0;
2975
2976
2977         os_free(drv->auth_ie);
2978         drv->auth_ie = NULL;
2979         drv->auth_ie_len = 0;
2980         if (params->ie) {
2981                 drv->auth_ie = os_malloc(params->ie_len);
2982                 if (drv->auth_ie) {
2983                         os_memcpy(drv->auth_ie, params->ie, params->ie_len);
2984                         drv->auth_ie_len = params->ie_len;
2985                 }
2986         }
2987
2988         for (i = 0; i < 4; i++) {
2989                 if (params->wep_key[i] && params->wep_key_len[i] &&
2990                     params->wep_key_len[i] <= 16) {
2991                         os_memcpy(drv->auth_wep_key[i], params->wep_key[i],
2992                                   params->wep_key_len[i]);
2993                         drv->auth_wep_key_len[i] = params->wep_key_len[i];
2994                 } else
2995                         drv->auth_wep_key_len[i] = 0;
2996         }
2997 }
2998
2999
3000 static void nl80211_unmask_11b_rates(struct i802_bss *bss)
3001 {
3002         struct wpa_driver_nl80211_data *drv = bss->drv;
3003
3004         if (is_p2p_net_interface(drv->nlmode) || !drv->disabled_11b_rates)
3005                 return;
3006
3007         /*
3008          * Looks like we failed to unmask 11b rates previously. This could
3009          * happen, e.g., if the interface was down at the point in time when a
3010          * P2P group was terminated.
3011          */
3012         wpa_printf(MSG_DEBUG,
3013                    "nl80211: Interface %s mode is for non-P2P, but 11b rates were disabled - re-enable them",
3014                    bss->ifname);
3015         nl80211_disable_11b_rates(drv, drv->ifindex, 0);
3016 }
3017
3018
3019 static int wpa_driver_nl80211_authenticate(
3020         struct i802_bss *bss, struct wpa_driver_auth_params *params)
3021 {
3022         struct wpa_driver_nl80211_data *drv = bss->drv;
3023         int ret = -1, i;
3024         struct nl_msg *msg;
3025         enum nl80211_auth_type type;
3026         enum nl80211_iftype nlmode;
3027         int count = 0;
3028         int is_retry;
3029
3030         nl80211_unmask_11b_rates(bss);
3031
3032         is_retry = drv->retry_auth;
3033         drv->retry_auth = 0;
3034         drv->ignore_deauth_event = 0;
3035
3036         nl80211_mark_disconnected(drv);
3037         os_memset(drv->auth_bssid, 0, ETH_ALEN);
3038         if (params->bssid)
3039                 os_memcpy(drv->auth_attempt_bssid, params->bssid, ETH_ALEN);
3040         else
3041                 os_memset(drv->auth_attempt_bssid, 0, ETH_ALEN);
3042         /* FIX: IBSS mode */
3043         nlmode = params->p2p ?
3044                 NL80211_IFTYPE_P2P_CLIENT : NL80211_IFTYPE_STATION;
3045         if (drv->nlmode != nlmode &&
3046             wpa_driver_nl80211_set_mode(bss, nlmode) < 0)
3047                 return -1;
3048
3049 retry:
3050         wpa_printf(MSG_DEBUG, "nl80211: Authenticate (ifindex=%d)",
3051                    drv->ifindex);
3052
3053         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_AUTHENTICATE);
3054         if (!msg)
3055                 goto fail;
3056
3057         for (i = 0; i < 4; i++) {
3058                 if (!params->wep_key[i])
3059                         continue;
3060                 wpa_driver_nl80211_set_key(bss->ifname, bss, WPA_ALG_WEP,
3061                                            NULL, i,
3062                                            i == params->wep_tx_keyidx, NULL, 0,
3063                                            params->wep_key[i],
3064                                            params->wep_key_len[i]);
3065                 if (params->wep_tx_keyidx != i)
3066                         continue;
3067                 if (nl_add_key(msg, WPA_ALG_WEP, i, 1, NULL, 0,
3068                                params->wep_key[i], params->wep_key_len[i]))
3069                         goto fail;
3070         }
3071
3072         if (params->bssid) {
3073                 wpa_printf(MSG_DEBUG, "  * bssid=" MACSTR,
3074                            MAC2STR(params->bssid));
3075                 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid))
3076                         goto fail;
3077         }
3078         if (params->freq) {
3079                 wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq);
3080                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq))
3081                         goto fail;
3082         }
3083         if (params->ssid) {
3084                 wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
3085                                   params->ssid, params->ssid_len);
3086                 if (nla_put(msg, NL80211_ATTR_SSID, params->ssid_len,
3087                             params->ssid))
3088                         goto fail;
3089         }
3090         wpa_hexdump(MSG_DEBUG, "  * IEs", params->ie, params->ie_len);
3091         if (params->ie &&
3092             nla_put(msg, NL80211_ATTR_IE, params->ie_len, params->ie))
3093                 goto fail;
3094         if (params->sae_data) {
3095                 wpa_hexdump(MSG_DEBUG, "  * SAE data", params->sae_data,
3096                             params->sae_data_len);
3097                 if (nla_put(msg, NL80211_ATTR_SAE_DATA, params->sae_data_len,
3098                             params->sae_data))
3099                         goto fail;
3100         }
3101         if (params->auth_alg & WPA_AUTH_ALG_OPEN)
3102                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
3103         else if (params->auth_alg & WPA_AUTH_ALG_SHARED)
3104                 type = NL80211_AUTHTYPE_SHARED_KEY;
3105         else if (params->auth_alg & WPA_AUTH_ALG_LEAP)
3106                 type = NL80211_AUTHTYPE_NETWORK_EAP;
3107         else if (params->auth_alg & WPA_AUTH_ALG_FT)
3108                 type = NL80211_AUTHTYPE_FT;
3109         else if (params->auth_alg & WPA_AUTH_ALG_SAE)
3110                 type = NL80211_AUTHTYPE_SAE;
3111         else
3112                 goto fail;
3113         wpa_printf(MSG_DEBUG, "  * Auth Type %d", type);
3114         if (nla_put_u32(msg, NL80211_ATTR_AUTH_TYPE, type))
3115                 goto fail;
3116         if (params->local_state_change) {
3117                 wpa_printf(MSG_DEBUG, "  * Local state change only");
3118                 if (nla_put_flag(msg, NL80211_ATTR_LOCAL_STATE_CHANGE))
3119                         goto fail;
3120         }
3121
3122         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3123         msg = NULL;
3124         if (ret) {
3125                 wpa_dbg(drv->ctx, MSG_DEBUG,
3126                         "nl80211: MLME command failed (auth): ret=%d (%s)",
3127                         ret, strerror(-ret));
3128                 count++;
3129                 if (ret == -EALREADY && count == 1 && params->bssid &&
3130                     !params->local_state_change) {
3131                         /*
3132                          * mac80211 does not currently accept new
3133                          * authentication if we are already authenticated. As a
3134                          * workaround, force deauthentication and try again.
3135                          */
3136                         wpa_printf(MSG_DEBUG, "nl80211: Retry authentication "
3137                                    "after forced deauthentication");
3138                         drv->ignore_deauth_event = 1;
3139                         wpa_driver_nl80211_deauthenticate(
3140                                 bss, params->bssid,
3141                                 WLAN_REASON_PREV_AUTH_NOT_VALID);
3142                         nlmsg_free(msg);
3143                         goto retry;
3144                 }
3145
3146                 if (ret == -ENOENT && params->freq && !is_retry) {
3147                         /*
3148                          * cfg80211 has likely expired the BSS entry even
3149                          * though it was previously available in our internal
3150                          * BSS table. To recover quickly, start a single
3151                          * channel scan on the specified channel.
3152                          */
3153                         struct wpa_driver_scan_params scan;
3154                         int freqs[2];
3155
3156                         os_memset(&scan, 0, sizeof(scan));
3157                         scan.num_ssids = 1;
3158                         if (params->ssid) {
3159                                 scan.ssids[0].ssid = params->ssid;
3160                                 scan.ssids[0].ssid_len = params->ssid_len;
3161                         }
3162                         freqs[0] = params->freq;
3163                         freqs[1] = 0;
3164                         scan.freqs = freqs;
3165                         wpa_printf(MSG_DEBUG, "nl80211: Trigger single "
3166                                    "channel scan to refresh cfg80211 BSS "
3167                                    "entry");
3168                         ret = wpa_driver_nl80211_scan(bss, &scan);
3169                         if (ret == 0) {
3170                                 nl80211_copy_auth_params(drv, params);
3171                                 drv->scan_for_auth = 1;
3172                         }
3173                 } else if (is_retry) {
3174                         /*
3175                          * Need to indicate this with an event since the return
3176                          * value from the retry is not delivered to core code.
3177                          */
3178                         union wpa_event_data event;
3179                         wpa_printf(MSG_DEBUG, "nl80211: Authentication retry "
3180                                    "failed");
3181                         os_memset(&event, 0, sizeof(event));
3182                         os_memcpy(event.timeout_event.addr, drv->auth_bssid_,
3183                                   ETH_ALEN);
3184                         wpa_supplicant_event(drv->ctx, EVENT_AUTH_TIMED_OUT,
3185                                              &event);
3186                 }
3187         } else {
3188                 wpa_printf(MSG_DEBUG,
3189                            "nl80211: Authentication request send successfully");
3190         }
3191
3192 fail:
3193         nlmsg_free(msg);
3194         return ret;
3195 }
3196
3197
3198 int wpa_driver_nl80211_authenticate_retry(struct wpa_driver_nl80211_data *drv)
3199 {
3200         struct wpa_driver_auth_params params;
3201         struct i802_bss *bss = drv->first_bss;
3202         int i;
3203
3204         wpa_printf(MSG_DEBUG, "nl80211: Try to authenticate again");
3205
3206         os_memset(&params, 0, sizeof(params));
3207         params.freq = drv->auth_freq;
3208         params.auth_alg = drv->auth_alg;
3209         params.wep_tx_keyidx = drv->auth_wep_tx_keyidx;
3210         params.local_state_change = drv->auth_local_state_change;
3211         params.p2p = drv->auth_p2p;
3212
3213         if (!is_zero_ether_addr(drv->auth_bssid_))
3214                 params.bssid = drv->auth_bssid_;
3215
3216         if (drv->auth_ssid_len) {
3217                 params.ssid = drv->auth_ssid;
3218                 params.ssid_len = drv->auth_ssid_len;
3219         }
3220
3221         params.ie = drv->auth_ie;
3222         params.ie_len = drv->auth_ie_len;
3223
3224         for (i = 0; i < 4; i++) {
3225                 if (drv->auth_wep_key_len[i]) {
3226                         params.wep_key[i] = drv->auth_wep_key[i];
3227                         params.wep_key_len[i] = drv->auth_wep_key_len[i];
3228                 }
3229         }
3230
3231         drv->retry_auth = 1;
3232         return wpa_driver_nl80211_authenticate(bss, &params);
3233 }
3234
3235
3236 static int wpa_driver_nl80211_send_frame(struct i802_bss *bss,
3237                                          const void *data, size_t len,
3238                                          int encrypt, int noack,
3239                                          unsigned int freq, int no_cck,
3240                                          int offchanok, unsigned int wait_time,
3241                                          const u16 *csa_offs,
3242                                          size_t csa_offs_len)
3243 {
3244         struct wpa_driver_nl80211_data *drv = bss->drv;
3245         u64 cookie;
3246         int res;
3247
3248         if (freq == 0 && drv->nlmode == NL80211_IFTYPE_ADHOC) {
3249                 freq = nl80211_get_assoc_freq(drv);
3250                 wpa_printf(MSG_DEBUG,
3251                            "nl80211: send_frame - Use assoc_freq=%u for IBSS",
3252                            freq);
3253         }
3254         if (freq == 0) {
3255                 wpa_printf(MSG_DEBUG, "nl80211: send_frame - Use bss->freq=%u",
3256                            bss->freq);
3257                 freq = bss->freq;
3258         }
3259
3260         if (drv->use_monitor) {
3261                 wpa_printf(MSG_DEBUG, "nl80211: send_frame(freq=%u bss->freq=%u) -> send_monitor",
3262                            freq, bss->freq);
3263                 return nl80211_send_monitor(drv, data, len, encrypt, noack);
3264         }
3265
3266         wpa_printf(MSG_DEBUG, "nl80211: send_frame -> send_frame_cmd");
3267         res = nl80211_send_frame_cmd(bss, freq, wait_time, data, len,
3268                                      &cookie, no_cck, noack, offchanok,
3269                                      csa_offs, csa_offs_len);
3270         if (res == 0 && !noack) {
3271                 const struct ieee80211_mgmt *mgmt;
3272                 u16 fc;
3273
3274                 mgmt = (const struct ieee80211_mgmt *) data;
3275                 fc = le_to_host16(mgmt->frame_control);
3276                 if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
3277                     WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_ACTION) {
3278                         wpa_printf(MSG_MSGDUMP,
3279                                    "nl80211: Update send_action_cookie from 0x%llx to 0x%llx",
3280                                    (long long unsigned int)
3281                                    drv->send_action_cookie,
3282                                    (long long unsigned int) cookie);
3283                         drv->send_action_cookie = cookie;
3284                 }
3285         }
3286
3287         return res;
3288 }
3289
3290
3291 static int wpa_driver_nl80211_send_mlme(struct i802_bss *bss, const u8 *data,
3292                                         size_t data_len, int noack,
3293                                         unsigned int freq, int no_cck,
3294                                         int offchanok,
3295                                         unsigned int wait_time,
3296                                         const u16 *csa_offs,
3297                                         size_t csa_offs_len)
3298 {
3299         struct wpa_driver_nl80211_data *drv = bss->drv;
3300         struct ieee80211_mgmt *mgmt;
3301         int encrypt = 1;
3302         u16 fc;
3303
3304         mgmt = (struct ieee80211_mgmt *) data;
3305         fc = le_to_host16(mgmt->frame_control);
3306         wpa_printf(MSG_DEBUG, "nl80211: send_mlme - da= " MACSTR
3307                    " noack=%d freq=%u no_cck=%d offchanok=%d wait_time=%u fc=0x%x (%s) nlmode=%d",
3308                    MAC2STR(mgmt->da), noack, freq, no_cck, offchanok, wait_time,
3309                    fc, fc2str(fc), drv->nlmode);
3310
3311         if ((is_sta_interface(drv->nlmode) ||
3312              drv->nlmode == NL80211_IFTYPE_P2P_DEVICE) &&
3313             WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
3314             WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_PROBE_RESP) {
3315                 /*
3316                  * The use of last_mgmt_freq is a bit of a hack,
3317                  * but it works due to the single-threaded nature
3318                  * of wpa_supplicant.
3319                  */
3320                 if (freq == 0) {
3321                         wpa_printf(MSG_DEBUG, "nl80211: Use last_mgmt_freq=%d",
3322                                    drv->last_mgmt_freq);
3323                         freq = drv->last_mgmt_freq;
3324                 }
3325                 return nl80211_send_frame_cmd(bss, freq, 0,
3326                                               data, data_len, NULL, 1, noack,
3327                                               1, csa_offs, csa_offs_len);
3328         }
3329
3330         if (drv->device_ap_sme && is_ap_interface(drv->nlmode)) {
3331                 if (freq == 0) {
3332                         wpa_printf(MSG_DEBUG, "nl80211: Use bss->freq=%d",
3333                                    bss->freq);
3334                         freq = bss->freq;
3335                 }
3336                 return nl80211_send_frame_cmd(bss, freq,
3337                                               (int) freq == bss->freq ? 0 :
3338                                               wait_time,
3339                                               data, data_len,
3340                                               &drv->send_action_cookie,
3341                                               no_cck, noack, offchanok,
3342                                               csa_offs, csa_offs_len);
3343         }
3344
3345         if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
3346             WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_AUTH) {
3347                 /*
3348                  * Only one of the authentication frame types is encrypted.
3349                  * In order for static WEP encryption to work properly (i.e.,
3350                  * to not encrypt the frame), we need to tell mac80211 about
3351                  * the frames that must not be encrypted.
3352                  */
3353                 u16 auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
3354                 u16 auth_trans = le_to_host16(mgmt->u.auth.auth_transaction);
3355                 if (auth_alg != WLAN_AUTH_SHARED_KEY || auth_trans != 3)
3356                         encrypt = 0;
3357         }
3358
3359         wpa_printf(MSG_DEBUG, "nl80211: send_mlme -> send_frame");
3360         return wpa_driver_nl80211_send_frame(bss, data, data_len, encrypt,
3361                                              noack, freq, no_cck, offchanok,
3362                                              wait_time, csa_offs,
3363                                              csa_offs_len);
3364 }
3365
3366
3367 static int nl80211_put_basic_rates(struct nl_msg *msg, const int *basic_rates)
3368 {
3369         u8 rates[NL80211_MAX_SUPP_RATES];
3370         u8 rates_len = 0;
3371         int i;
3372
3373         if (!basic_rates)
3374                 return 0;
3375
3376         for (i = 0; i < NL80211_MAX_SUPP_RATES && basic_rates[i] >= 0; i++)
3377                 rates[rates_len++] = basic_rates[i] / 5;
3378
3379         return nla_put(msg, NL80211_ATTR_BSS_BASIC_RATES, rates_len, rates);
3380 }
3381
3382
3383 static int nl80211_set_bss(struct i802_bss *bss, int cts, int preamble,
3384                            int slot, int ht_opmode, int ap_isolate,
3385                            const int *basic_rates)
3386 {
3387         struct wpa_driver_nl80211_data *drv = bss->drv;
3388         struct nl_msg *msg;
3389
3390         if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_SET_BSS)) ||
3391             (cts >= 0 &&
3392              nla_put_u8(msg, NL80211_ATTR_BSS_CTS_PROT, cts)) ||
3393             (preamble >= 0 &&
3394              nla_put_u8(msg, NL80211_ATTR_BSS_SHORT_PREAMBLE, preamble)) ||
3395             (slot >= 0 &&
3396              nla_put_u8(msg, NL80211_ATTR_BSS_SHORT_SLOT_TIME, slot)) ||
3397             (ht_opmode >= 0 &&
3398              nla_put_u16(msg, NL80211_ATTR_BSS_HT_OPMODE, ht_opmode)) ||
3399             (ap_isolate >= 0 &&
3400              nla_put_u8(msg, NL80211_ATTR_AP_ISOLATE, ap_isolate)) ||
3401             nl80211_put_basic_rates(msg, basic_rates)) {
3402                 nlmsg_free(msg);
3403                 return -ENOBUFS;
3404         }
3405
3406         return send_and_recv_msgs(drv, msg, NULL, NULL);
3407 }
3408
3409
3410 static int wpa_driver_nl80211_set_acl(void *priv,
3411                                       struct hostapd_acl_params *params)
3412 {
3413         struct i802_bss *bss = priv;
3414         struct wpa_driver_nl80211_data *drv = bss->drv;
3415         struct nl_msg *msg;
3416         struct nl_msg *acl;
3417         unsigned int i;
3418         int ret;
3419
3420         if (!(drv->capa.max_acl_mac_addrs))
3421                 return -ENOTSUP;
3422
3423         if (params->num_mac_acl > drv->capa.max_acl_mac_addrs)
3424                 return -ENOTSUP;
3425
3426         wpa_printf(MSG_DEBUG, "nl80211: Set %s ACL (num_mac_acl=%u)",
3427                    params->acl_policy ? "Accept" : "Deny", params->num_mac_acl);
3428
3429         acl = nlmsg_alloc();
3430         if (!acl)
3431                 return -ENOMEM;
3432         for (i = 0; i < params->num_mac_acl; i++) {
3433                 if (nla_put(acl, i + 1, ETH_ALEN, params->mac_acl[i].addr)) {
3434                         nlmsg_free(acl);
3435                         return -ENOMEM;
3436                 }
3437         }
3438
3439         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_SET_MAC_ACL)) ||
3440             nla_put_u32(msg, NL80211_ATTR_ACL_POLICY, params->acl_policy ?
3441                         NL80211_ACL_POLICY_DENY_UNLESS_LISTED :
3442                         NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED) ||
3443             nla_put_nested(msg, NL80211_ATTR_MAC_ADDRS, acl)) {
3444                 nlmsg_free(msg);
3445                 nlmsg_free(acl);
3446                 return -ENOMEM;
3447         }
3448         nlmsg_free(acl);
3449
3450         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3451         if (ret) {
3452                 wpa_printf(MSG_DEBUG, "nl80211: Failed to set MAC ACL: %d (%s)",
3453                            ret, strerror(-ret));
3454         }
3455
3456         return ret;
3457 }
3458
3459
3460 static int nl80211_put_beacon_int(struct nl_msg *msg, int beacon_int)
3461 {
3462         if (beacon_int > 0) {
3463                 wpa_printf(MSG_DEBUG, "  * beacon_int=%d", beacon_int);
3464                 return nla_put_u32(msg, NL80211_ATTR_BEACON_INTERVAL,
3465                                    beacon_int);
3466         }
3467
3468         return 0;
3469 }
3470
3471
3472 static int nl80211_put_dtim_period(struct nl_msg *msg, int dtim_period)
3473 {
3474         if (dtim_period > 0) {
3475                 wpa_printf(MSG_DEBUG, "  * dtim_period=%d", dtim_period);
3476                 return nla_put_u32(msg, NL80211_ATTR_DTIM_PERIOD, dtim_period);
3477         }
3478
3479         return 0;
3480 }
3481
3482
3483 static int wpa_driver_nl80211_set_ap(void *priv,
3484                                      struct wpa_driver_ap_params *params)
3485 {
3486         struct i802_bss *bss = priv;
3487         struct wpa_driver_nl80211_data *drv = bss->drv;
3488         struct nl_msg *msg;
3489         u8 cmd = NL80211_CMD_NEW_BEACON;
3490         int ret;
3491         int beacon_set;
3492         int num_suites;
3493         int smps_mode;
3494         u32 suites[10], suite;
3495         u32 ver;
3496
3497         beacon_set = params->reenable ? 0 : bss->beacon_set;
3498
3499         wpa_printf(MSG_DEBUG, "nl80211: Set beacon (beacon_set=%d)",
3500                    beacon_set);
3501         if (beacon_set)
3502                 cmd = NL80211_CMD_SET_BEACON;
3503
3504         wpa_hexdump(MSG_DEBUG, "nl80211: Beacon head",
3505                     params->head, params->head_len);
3506         wpa_hexdump(MSG_DEBUG, "nl80211: Beacon tail",
3507                     params->tail, params->tail_len);
3508         wpa_printf(MSG_DEBUG, "nl80211: ifindex=%d", bss->ifindex);
3509         wpa_printf(MSG_DEBUG, "nl80211: beacon_int=%d", params->beacon_int);
3510         wpa_printf(MSG_DEBUG, "nl80211: dtim_period=%d", params->dtim_period);
3511         wpa_hexdump_ascii(MSG_DEBUG, "nl80211: ssid",
3512                           params->ssid, params->ssid_len);
3513         if (!(msg = nl80211_bss_msg(bss, 0, cmd)) ||
3514             nla_put(msg, NL80211_ATTR_BEACON_HEAD, params->head_len,
3515                     params->head) ||
3516             nla_put(msg, NL80211_ATTR_BEACON_TAIL, params->tail_len,
3517                     params->tail) ||
3518             nl80211_put_beacon_int(msg, params->beacon_int) ||
3519             nl80211_put_dtim_period(msg, params->dtim_period) ||
3520             nla_put(msg, NL80211_ATTR_SSID, params->ssid_len, params->ssid))
3521                 goto fail;
3522         if (params->proberesp && params->proberesp_len) {
3523                 wpa_hexdump(MSG_DEBUG, "nl80211: proberesp (offload)",
3524                             params->proberesp, params->proberesp_len);
3525                 if (nla_put(msg, NL80211_ATTR_PROBE_RESP, params->proberesp_len,
3526                             params->proberesp))
3527                         goto fail;
3528         }
3529         switch (params->hide_ssid) {
3530         case NO_SSID_HIDING:
3531                 wpa_printf(MSG_DEBUG, "nl80211: hidden SSID not in use");
3532                 if (nla_put_u32(msg, NL80211_ATTR_HIDDEN_SSID,
3533                                 NL80211_HIDDEN_SSID_NOT_IN_USE))
3534                         goto fail;
3535                 break;
3536         case HIDDEN_SSID_ZERO_LEN:
3537                 wpa_printf(MSG_DEBUG, "nl80211: hidden SSID zero len");
3538                 if (nla_put_u32(msg, NL80211_ATTR_HIDDEN_SSID,
3539                                 NL80211_HIDDEN_SSID_ZERO_LEN))
3540                         goto fail;
3541                 break;
3542         case HIDDEN_SSID_ZERO_CONTENTS:
3543                 wpa_printf(MSG_DEBUG, "nl80211: hidden SSID zero contents");
3544                 if (nla_put_u32(msg, NL80211_ATTR_HIDDEN_SSID,
3545                                 NL80211_HIDDEN_SSID_ZERO_CONTENTS))
3546                         goto fail;
3547                 break;
3548         }
3549         wpa_printf(MSG_DEBUG, "nl80211: privacy=%d", params->privacy);
3550         if (params->privacy &&
3551             nla_put_flag(msg, NL80211_ATTR_PRIVACY))
3552                 goto fail;
3553         wpa_printf(MSG_DEBUG, "nl80211: auth_algs=0x%x", params->auth_algs);
3554         if ((params->auth_algs & (WPA_AUTH_ALG_OPEN | WPA_AUTH_ALG_SHARED)) ==
3555             (WPA_AUTH_ALG_OPEN | WPA_AUTH_ALG_SHARED)) {
3556                 /* Leave out the attribute */
3557         } else if (params->auth_algs & WPA_AUTH_ALG_SHARED) {
3558                 if (nla_put_u32(msg, NL80211_ATTR_AUTH_TYPE,
3559                                 NL80211_AUTHTYPE_SHARED_KEY))
3560                         goto fail;
3561         } else {
3562                 if (nla_put_u32(msg, NL80211_ATTR_AUTH_TYPE,
3563                                 NL80211_AUTHTYPE_OPEN_SYSTEM))
3564                         goto fail;
3565         }
3566
3567         wpa_printf(MSG_DEBUG, "nl80211: wpa_version=0x%x", params->wpa_version);
3568         ver = 0;
3569         if (params->wpa_version & WPA_PROTO_WPA)
3570                 ver |= NL80211_WPA_VERSION_1;
3571         if (params->wpa_version & WPA_PROTO_RSN)
3572                 ver |= NL80211_WPA_VERSION_2;
3573         if (ver &&
3574             nla_put_u32(msg, NL80211_ATTR_WPA_VERSIONS, ver))
3575                 goto fail;
3576
3577         wpa_printf(MSG_DEBUG, "nl80211: key_mgmt_suites=0x%x",
3578                    params->key_mgmt_suites);
3579         num_suites = 0;
3580         if (params->key_mgmt_suites & WPA_KEY_MGMT_IEEE8021X)
3581                 suites[num_suites++] = WLAN_AKM_SUITE_8021X;
3582         if (params->key_mgmt_suites & WPA_KEY_MGMT_PSK)
3583                 suites[num_suites++] = WLAN_AKM_SUITE_PSK;
3584         if (num_suites &&
3585             nla_put(msg, NL80211_ATTR_AKM_SUITES, num_suites * sizeof(u32),
3586                     suites))
3587                 goto fail;
3588
3589         if (params->key_mgmt_suites & WPA_KEY_MGMT_IEEE8021X_NO_WPA &&
3590             (!params->pairwise_ciphers ||
3591              params->pairwise_ciphers & (WPA_CIPHER_WEP104 | WPA_CIPHER_WEP40)) &&
3592             (nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, ETH_P_PAE) ||
3593              nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT)))
3594                 goto fail;
3595
3596         wpa_printf(MSG_DEBUG, "nl80211: pairwise_ciphers=0x%x",
3597                    params->pairwise_ciphers);
3598         num_suites = wpa_cipher_to_cipher_suites(params->pairwise_ciphers,
3599                                                  suites, ARRAY_SIZE(suites));
3600         if (num_suites &&
3601             nla_put(msg, NL80211_ATTR_CIPHER_SUITES_PAIRWISE,
3602                     num_suites * sizeof(u32), suites))
3603                 goto fail;
3604
3605         wpa_printf(MSG_DEBUG, "nl80211: group_cipher=0x%x",
3606                    params->group_cipher);
3607         suite = wpa_cipher_to_cipher_suite(params->group_cipher);
3608         if (suite &&
3609             nla_put_u32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP, suite))
3610                 goto fail;
3611
3612         if (params->ht_opmode != -1) {
3613                 switch (params->smps_mode) {
3614                 case HT_CAP_INFO_SMPS_DYNAMIC:
3615                         wpa_printf(MSG_DEBUG, "nl80211: SMPS mode - dynamic");
3616                         smps_mode = NL80211_SMPS_DYNAMIC;
3617                         break;
3618                 case HT_CAP_INFO_SMPS_STATIC:
3619                         wpa_printf(MSG_DEBUG, "nl80211: SMPS mode - static");
3620                         smps_mode = NL80211_SMPS_STATIC;
3621                         break;
3622                 default:
3623                         /* invalid - fallback to smps off */
3624                 case HT_CAP_INFO_SMPS_DISABLED:
3625                         wpa_printf(MSG_DEBUG, "nl80211: SMPS mode - off");
3626                         smps_mode = NL80211_SMPS_OFF;
3627                         break;
3628                 }
3629                 if (nla_put_u32(msg, NL80211_ATTR_SMPS_MODE, smps_mode))
3630                         goto fail;
3631         }
3632
3633         if (params->beacon_ies) {
3634                 wpa_hexdump_buf(MSG_DEBUG, "nl80211: beacon_ies",
3635                                 params->beacon_ies);
3636                 if (nla_put(msg, NL80211_ATTR_IE,
3637                             wpabuf_len(params->beacon_ies),
3638                             wpabuf_head(params->beacon_ies)))
3639                         goto fail;
3640         }
3641         if (params->proberesp_ies) {
3642                 wpa_hexdump_buf(MSG_DEBUG, "nl80211: proberesp_ies",
3643                                 params->proberesp_ies);
3644                 if (nla_put(msg, NL80211_ATTR_IE_PROBE_RESP,
3645                             wpabuf_len(params->proberesp_ies),
3646                             wpabuf_head(params->proberesp_ies)))
3647                         goto fail;
3648         }
3649         if (params->assocresp_ies) {
3650                 wpa_hexdump_buf(MSG_DEBUG, "nl80211: assocresp_ies",
3651                                 params->assocresp_ies);
3652                 if (nla_put(msg, NL80211_ATTR_IE_ASSOC_RESP,
3653                             wpabuf_len(params->assocresp_ies),
3654                             wpabuf_head(params->assocresp_ies)))
3655                         goto fail;
3656         }
3657
3658         if (drv->capa.flags & WPA_DRIVER_FLAGS_INACTIVITY_TIMER)  {
3659                 wpa_printf(MSG_DEBUG, "nl80211: ap_max_inactivity=%d",
3660                            params->ap_max_inactivity);
3661                 if (nla_put_u16(msg, NL80211_ATTR_INACTIVITY_TIMEOUT,
3662                                 params->ap_max_inactivity))
3663                         goto fail;
3664         }
3665
3666 #ifdef CONFIG_P2P
3667         if (params->p2p_go_ctwindow > 0) {
3668                 if (drv->p2p_go_ctwindow_supported) {
3669                         wpa_printf(MSG_DEBUG, "nl80211: P2P GO ctwindow=%d",
3670                                    params->p2p_go_ctwindow);
3671                         if (nla_put_u8(msg, NL80211_ATTR_P2P_CTWINDOW,
3672                                        params->p2p_go_ctwindow))
3673                                 goto fail;
3674                 } else {
3675                         wpa_printf(MSG_INFO,
3676                                    "nl80211: Driver does not support CTWindow configuration - ignore this parameter");
3677                 }
3678         }
3679 #endif /* CONFIG_P2P */
3680
3681         if (params->pbss) {
3682                 wpa_printf(MSG_DEBUG, "nl80211: PBSS");
3683                 if (nla_put_flag(msg, NL80211_ATTR_PBSS))
3684                         goto fail;
3685         }
3686
3687         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3688         if (ret) {
3689                 wpa_printf(MSG_DEBUG, "nl80211: Beacon set failed: %d (%s)",
3690                            ret, strerror(-ret));
3691         } else {
3692                 bss->beacon_set = 1;
3693                 nl80211_set_bss(bss, params->cts_protect, params->preamble,
3694                                 params->short_slot_time, params->ht_opmode,
3695                                 params->isolate, params->basic_rates);
3696                 if (beacon_set && params->freq &&
3697                     params->freq->bandwidth != bss->bandwidth) {
3698                         wpa_printf(MSG_DEBUG,
3699                                    "nl80211: Update BSS %s bandwidth: %d -> %d",
3700                                    bss->ifname, bss->bandwidth,
3701                                    params->freq->bandwidth);
3702                         ret = nl80211_set_channel(bss, params->freq, 1);
3703                         if (ret) {
3704                                 wpa_printf(MSG_DEBUG,
3705                                            "nl80211: Frequency set failed: %d (%s)",
3706                                            ret, strerror(-ret));
3707                         } else {
3708                                 wpa_printf(MSG_DEBUG,
3709                                            "nl80211: Frequency set succeeded for ht2040 coex");
3710                                 bss->bandwidth = params->freq->bandwidth;
3711                         }
3712                 } else if (!beacon_set && params->freq) {
3713                         /*
3714                          * cfg80211 updates the driver on frequence change in AP
3715                          * mode only at the point when beaconing is started, so
3716                          * set the initial value here.
3717                          */
3718                         bss->bandwidth = params->freq->bandwidth;
3719                 }
3720         }
3721         return ret;
3722 fail:
3723         nlmsg_free(msg);
3724         return -ENOBUFS;
3725 }
3726
3727
3728 static int nl80211_put_freq_params(struct nl_msg *msg,
3729                                    const struct hostapd_freq_params *freq)
3730 {
3731         wpa_printf(MSG_DEBUG, "  * freq=%d", freq->freq);
3732         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq->freq))
3733                 return -ENOBUFS;
3734
3735         wpa_printf(MSG_DEBUG, "  * vht_enabled=%d", freq->vht_enabled);
3736         wpa_printf(MSG_DEBUG, "  * ht_enabled=%d", freq->ht_enabled);
3737
3738         if (freq->vht_enabled) {
3739                 enum nl80211_chan_width cw;
3740
3741                 wpa_printf(MSG_DEBUG, "  * bandwidth=%d", freq->bandwidth);
3742                 switch (freq->bandwidth) {
3743                 case 20:
3744                         cw = NL80211_CHAN_WIDTH_20;
3745                         break;
3746                 case 40:
3747                         cw = NL80211_CHAN_WIDTH_40;
3748                         break;
3749                 case 80:
3750                         if (freq->center_freq2)
3751                                 cw = NL80211_CHAN_WIDTH_80P80;
3752                         else
3753                                 cw = NL80211_CHAN_WIDTH_80;
3754                         break;
3755                 case 160:
3756                         cw = NL80211_CHAN_WIDTH_160;
3757                         break;
3758                 default:
3759                         return -EINVAL;
3760                 }
3761
3762                 wpa_printf(MSG_DEBUG, "  * channel_width=%d", cw);
3763                 wpa_printf(MSG_DEBUG, "  * center_freq1=%d",
3764                            freq->center_freq1);
3765                 wpa_printf(MSG_DEBUG, "  * center_freq2=%d",
3766                            freq->center_freq2);
3767                 if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, cw) ||
3768                     nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1,
3769                                 freq->center_freq1) ||
3770                     (freq->center_freq2 &&
3771                      nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2,
3772                                  freq->center_freq2)))
3773                         return -ENOBUFS;
3774         } else if (freq->ht_enabled) {
3775                 enum nl80211_channel_type ct;
3776
3777                 wpa_printf(MSG_DEBUG, "  * sec_channel_offset=%d",
3778                            freq->sec_channel_offset);
3779                 switch (freq->sec_channel_offset) {
3780                 case -1:
3781                         ct = NL80211_CHAN_HT40MINUS;
3782                         break;
3783                 case 1:
3784                         ct = NL80211_CHAN_HT40PLUS;
3785                         break;
3786                 default:
3787                         ct = NL80211_CHAN_HT20;
3788                         break;
3789                 }
3790
3791                 wpa_printf(MSG_DEBUG, "  * channel_type=%d", ct);
3792                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, ct))
3793                         return -ENOBUFS;
3794         } else {
3795                 wpa_printf(MSG_DEBUG, "  * channel_type=%d",
3796                            NL80211_CHAN_NO_HT);
3797                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
3798                                 NL80211_CHAN_NO_HT))
3799                         return -ENOBUFS;
3800         }
3801         return 0;
3802 }
3803
3804
3805 static int nl80211_set_channel(struct i802_bss *bss,
3806                                struct hostapd_freq_params *freq, int set_chan)
3807 {
3808         struct wpa_driver_nl80211_data *drv = bss->drv;
3809         struct nl_msg *msg;
3810         int ret;
3811
3812         wpa_printf(MSG_DEBUG,
3813                    "nl80211: Set freq %d (ht_enabled=%d, vht_enabled=%d, bandwidth=%d MHz, cf1=%d MHz, cf2=%d MHz)",
3814                    freq->freq, freq->ht_enabled, freq->vht_enabled,
3815                    freq->bandwidth, freq->center_freq1, freq->center_freq2);
3816
3817         msg = nl80211_drv_msg(drv, 0, set_chan ? NL80211_CMD_SET_CHANNEL :
3818                               NL80211_CMD_SET_WIPHY);
3819         if (!msg || nl80211_put_freq_params(msg, freq) < 0) {
3820                 nlmsg_free(msg);
3821                 return -1;
3822         }
3823
3824         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3825         if (ret == 0) {
3826                 bss->freq = freq->freq;
3827                 return 0;
3828         }
3829         wpa_printf(MSG_DEBUG, "nl80211: Failed to set channel (freq=%d): "
3830                    "%d (%s)", freq->freq, ret, strerror(-ret));
3831         return -1;
3832 }
3833
3834
3835 static u32 sta_flags_nl80211(int flags)
3836 {
3837         u32 f = 0;
3838
3839         if (flags & WPA_STA_AUTHORIZED)
3840                 f |= BIT(NL80211_STA_FLAG_AUTHORIZED);
3841         if (flags & WPA_STA_WMM)
3842                 f |= BIT(NL80211_STA_FLAG_WME);
3843         if (flags & WPA_STA_SHORT_PREAMBLE)
3844                 f |= BIT(NL80211_STA_FLAG_SHORT_PREAMBLE);
3845         if (flags & WPA_STA_MFP)
3846                 f |= BIT(NL80211_STA_FLAG_MFP);
3847         if (flags & WPA_STA_TDLS_PEER)
3848                 f |= BIT(NL80211_STA_FLAG_TDLS_PEER);
3849         if (flags & WPA_STA_AUTHENTICATED)
3850                 f |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
3851         if (flags & WPA_STA_ASSOCIATED)
3852                 f |= BIT(NL80211_STA_FLAG_ASSOCIATED);
3853
3854         return f;
3855 }
3856
3857
3858 #ifdef CONFIG_MESH
3859 static u32 sta_plink_state_nl80211(enum mesh_plink_state state)
3860 {
3861         switch (state) {
3862         case PLINK_IDLE:
3863                 return NL80211_PLINK_LISTEN;
3864         case PLINK_OPN_SNT:
3865                 return NL80211_PLINK_OPN_SNT;
3866         case PLINK_OPN_RCVD:
3867                 return NL80211_PLINK_OPN_RCVD;
3868         case PLINK_CNF_RCVD:
3869                 return NL80211_PLINK_CNF_RCVD;
3870         case PLINK_ESTAB:
3871                 return NL80211_PLINK_ESTAB;
3872         case PLINK_HOLDING:
3873                 return NL80211_PLINK_HOLDING;
3874         case PLINK_BLOCKED:
3875                 return NL80211_PLINK_BLOCKED;
3876         default:
3877                 wpa_printf(MSG_ERROR, "nl80211: Invalid mesh plink state %d",
3878                            state);
3879         }
3880         return -1;
3881 }
3882 #endif /* CONFIG_MESH */
3883
3884
3885 static int wpa_driver_nl80211_sta_add(void *priv,
3886                                       struct hostapd_sta_add_params *params)
3887 {
3888         struct i802_bss *bss = priv;
3889         struct wpa_driver_nl80211_data *drv = bss->drv;
3890         struct nl_msg *msg;
3891         struct nl80211_sta_flag_update upd;
3892         int ret = -ENOBUFS;
3893
3894         if ((params->flags & WPA_STA_TDLS_PEER) &&
3895             !(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT))
3896                 return -EOPNOTSUPP;
3897
3898         wpa_printf(MSG_DEBUG, "nl80211: %s STA " MACSTR,
3899                    params->set ? "Set" : "Add", MAC2STR(params->addr));
3900         msg = nl80211_bss_msg(bss, 0, params->set ? NL80211_CMD_SET_STATION :
3901                               NL80211_CMD_NEW_STATION);
3902         if (!msg || nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, params->addr))
3903                 goto fail;
3904
3905         /*
3906          * Set the below properties only in one of the following cases:
3907          * 1. New station is added, already associated.
3908          * 2. Set WPA_STA_TDLS_PEER station.
3909          * 3. Set an already added unassociated station, if driver supports
3910          * full AP client state. (Set these properties after station became
3911          * associated will be rejected by the driver).
3912          */
3913         if (!params->set || (params->flags & WPA_STA_TDLS_PEER) ||
3914             (params->set && FULL_AP_CLIENT_STATE_SUPP(drv->capa.flags) &&
3915              (params->flags & WPA_STA_ASSOCIATED))) {
3916                 wpa_hexdump(MSG_DEBUG, "  * supported rates",
3917                             params->supp_rates, params->supp_rates_len);
3918                 wpa_printf(MSG_DEBUG, "  * capability=0x%x",
3919                            params->capability);
3920                 if (nla_put(msg, NL80211_ATTR_STA_SUPPORTED_RATES,
3921                             params->supp_rates_len, params->supp_rates) ||
3922                     nla_put_u16(msg, NL80211_ATTR_STA_CAPABILITY,
3923                                 params->capability))
3924                         goto fail;
3925
3926                 if (params->ht_capabilities) {
3927                         wpa_hexdump(MSG_DEBUG, "  * ht_capabilities",
3928                                     (u8 *) params->ht_capabilities,
3929                                     sizeof(*params->ht_capabilities));
3930                         if (nla_put(msg, NL80211_ATTR_HT_CAPABILITY,
3931                                     sizeof(*params->ht_capabilities),
3932                                     params->ht_capabilities))
3933                                 goto fail;
3934                 }
3935
3936                 if (params->vht_capabilities) {
3937                         wpa_hexdump(MSG_DEBUG, "  * vht_capabilities",
3938                                     (u8 *) params->vht_capabilities,
3939                                     sizeof(*params->vht_capabilities));
3940                         if (nla_put(msg, NL80211_ATTR_VHT_CAPABILITY,
3941                                     sizeof(*params->vht_capabilities),
3942                                     params->vht_capabilities))
3943                                 goto fail;
3944                 }
3945
3946                 if (params->ext_capab) {
3947                         wpa_hexdump(MSG_DEBUG, "  * ext_capab",
3948                                     params->ext_capab, params->ext_capab_len);
3949                         if (nla_put(msg, NL80211_ATTR_STA_EXT_CAPABILITY,
3950                                     params->ext_capab_len, params->ext_capab))
3951                                 goto fail;
3952                 }
3953
3954                 if (is_ap_interface(drv->nlmode) &&
3955                     nla_put_u8(msg, NL80211_ATTR_STA_SUPPORT_P2P_PS,
3956                                params->support_p2p_ps ?
3957                                NL80211_P2P_PS_SUPPORTED :
3958                                NL80211_P2P_PS_UNSUPPORTED))
3959                         goto fail;
3960         }
3961         if (!params->set) {
3962                 if (params->aid) {
3963                         wpa_printf(MSG_DEBUG, "  * aid=%u", params->aid);
3964                         if (nla_put_u16(msg, NL80211_ATTR_STA_AID, params->aid))
3965                                 goto fail;
3966                 } else {
3967                         /*
3968                          * cfg80211 validates that AID is non-zero, so we have
3969                          * to make this a non-zero value for the TDLS case where
3970                          * a dummy STA entry is used for now and for a station
3971                          * that is still not associated.
3972                          */
3973                         wpa_printf(MSG_DEBUG, "  * aid=1 (%s workaround)",
3974                                    (params->flags & WPA_STA_TDLS_PEER) ?
3975                                    "TDLS" : "UNASSOC_STA");
3976                         if (nla_put_u16(msg, NL80211_ATTR_STA_AID, 1))
3977                                 goto fail;
3978                 }
3979                 wpa_printf(MSG_DEBUG, "  * listen_interval=%u",
3980                            params->listen_interval);
3981                 if (nla_put_u16(msg, NL80211_ATTR_STA_LISTEN_INTERVAL,
3982                                 params->listen_interval))
3983                         goto fail;
3984         } else if (params->aid && (params->flags & WPA_STA_TDLS_PEER)) {
3985                 wpa_printf(MSG_DEBUG, "  * peer_aid=%u", params->aid);
3986                 if (nla_put_u16(msg, NL80211_ATTR_PEER_AID, params->aid))
3987                         goto fail;
3988         } else if (FULL_AP_CLIENT_STATE_SUPP(drv->capa.flags) &&
3989                    (params->flags & WPA_STA_ASSOCIATED)) {
3990                 wpa_printf(MSG_DEBUG, "  * aid=%u", params->aid);
3991                 wpa_printf(MSG_DEBUG, "  * listen_interval=%u",
3992                            params->listen_interval);
3993                 if (nla_put_u16(msg, NL80211_ATTR_STA_AID, params->aid) ||
3994                     nla_put_u16(msg, NL80211_ATTR_STA_LISTEN_INTERVAL,
3995                                 params->listen_interval))
3996                         goto fail;
3997         }
3998
3999         if (params->vht_opmode_enabled) {
4000                 wpa_printf(MSG_DEBUG, "  * opmode=%u", params->vht_opmode);
4001                 if (nla_put_u8(msg, NL80211_ATTR_OPMODE_NOTIF,
4002                                params->vht_opmode))
4003                         goto fail;
4004         }
4005
4006         if (params->supp_channels) {
4007                 wpa_hexdump(MSG_DEBUG, "  * supported channels",
4008                             params->supp_channels, params->supp_channels_len);
4009                 if (nla_put(msg, NL80211_ATTR_STA_SUPPORTED_CHANNELS,
4010                             params->supp_channels_len, params->supp_channels))
4011                         goto fail;
4012         }
4013
4014         if (params->supp_oper_classes) {
4015                 wpa_hexdump(MSG_DEBUG, "  * supported operating classes",
4016                             params->supp_oper_classes,
4017                             params->supp_oper_classes_len);
4018                 if (nla_put(msg, NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES,
4019                             params->supp_oper_classes_len,
4020                             params->supp_oper_classes))
4021                         goto fail;
4022         }
4023
4024         os_memset(&upd, 0, sizeof(upd));
4025         upd.set = sta_flags_nl80211(params->flags);
4026         upd.mask = upd.set | sta_flags_nl80211(params->flags_mask);
4027
4028         /*
4029          * If the driver doesn't support full AP client state, ignore ASSOC/AUTH
4030          * flags, as nl80211 driver moves a new station, by default, into
4031          * associated state.
4032          *
4033          * On the other hand, if the driver supports that feature and the
4034          * station is added in unauthenticated state, set the
4035          * authenticated/associated bits in the mask to prevent moving this
4036          * station to associated state before it is actually associated.
4037          *
4038          * This is irrelevant for mesh mode where the station is added to the
4039          * driver as authenticated already, and ASSOCIATED isn't part of the
4040          * nl80211 API.
4041          */
4042         if (!is_mesh_interface(drv->nlmode)) {
4043                 if (!FULL_AP_CLIENT_STATE_SUPP(drv->capa.flags)) {
4044                         wpa_printf(MSG_DEBUG,
4045                                    "nl80211: Ignore ASSOC/AUTH flags since driver doesn't support full AP client state");
4046                         upd.mask &= ~(BIT(NL80211_STA_FLAG_ASSOCIATED) |
4047                                       BIT(NL80211_STA_FLAG_AUTHENTICATED));
4048                 } else if (!params->set &&
4049                            !(params->flags & WPA_STA_TDLS_PEER)) {
4050                         if (!(params->flags & WPA_STA_AUTHENTICATED))
4051                                 upd.mask |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
4052                         if (!(params->flags & WPA_STA_ASSOCIATED))
4053                                 upd.mask |= BIT(NL80211_STA_FLAG_ASSOCIATED);
4054                 }
4055 #ifdef CONFIG_MESH
4056         } else {
4057                 if (params->plink_state == PLINK_ESTAB && params->peer_aid) {
4058                         ret = nla_put_u16(msg, NL80211_ATTR_MESH_PEER_AID,
4059                                           params->peer_aid);
4060                         if (ret)
4061                                 goto fail;
4062                 }
4063 #endif /* CONFIG_MESH */
4064         }
4065
4066         wpa_printf(MSG_DEBUG, "  * flags set=0x%x mask=0x%x",
4067                    upd.set, upd.mask);
4068         if (nla_put(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd))
4069                 goto fail;
4070
4071 #ifdef CONFIG_MESH
4072         if (params->plink_state &&
4073             nla_put_u8(msg, NL80211_ATTR_STA_PLINK_STATE,
4074                        sta_plink_state_nl80211(params->plink_state)))
4075                 goto fail;
4076 #endif /* CONFIG_MESH */
4077
4078         if (params->flags & WPA_STA_WMM) {
4079                 struct nlattr *wme = nla_nest_start(msg, NL80211_ATTR_STA_WME);
4080
4081                 wpa_printf(MSG_DEBUG, "  * qosinfo=0x%x", params->qosinfo);
4082                 if (!wme ||
4083                     nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
4084                                params->qosinfo & WMM_QOSINFO_STA_AC_MASK) ||
4085                     nla_put_u8(msg, NL80211_STA_WME_MAX_SP,
4086                                (params->qosinfo >> WMM_QOSINFO_STA_SP_SHIFT) &
4087                                WMM_QOSINFO_STA_SP_MASK))
4088                         goto fail;
4089                 nla_nest_end(msg, wme);
4090         }
4091
4092         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4093         msg = NULL;
4094         if (ret)
4095                 wpa_printf(MSG_DEBUG, "nl80211: NL80211_CMD_%s_STATION "
4096                            "result: %d (%s)", params->set ? "SET" : "NEW", ret,
4097                            strerror(-ret));
4098         if (ret == -EEXIST)
4099                 ret = 0;
4100 fail:
4101         nlmsg_free(msg);
4102         return ret;
4103 }
4104
4105
4106 static void rtnl_neigh_delete_fdb_entry(struct i802_bss *bss, const u8 *addr)
4107 {
4108 #ifdef CONFIG_LIBNL3_ROUTE
4109         struct wpa_driver_nl80211_data *drv = bss->drv;
4110         struct rtnl_neigh *rn;
4111         struct nl_addr *nl_addr;
4112         int err;
4113
4114         rn = rtnl_neigh_alloc();
4115         if (!rn)
4116                 return;
4117
4118         rtnl_neigh_set_family(rn, AF_BRIDGE);
4119         rtnl_neigh_set_ifindex(rn, bss->ifindex);
4120         nl_addr = nl_addr_build(AF_BRIDGE, (void *) addr, ETH_ALEN);
4121         if (!nl_addr) {
4122                 rtnl_neigh_put(rn);
4123                 return;
4124         }
4125         rtnl_neigh_set_lladdr(rn, nl_addr);
4126
4127         err = rtnl_neigh_delete(drv->rtnl_sk, rn, 0);
4128         if (err < 0) {
4129                 wpa_printf(MSG_DEBUG, "nl80211: bridge FDB entry delete for "
4130                            MACSTR " ifindex=%d failed: %s", MAC2STR(addr),
4131                            bss->ifindex, nl_geterror(err));
4132         } else {
4133                 wpa_printf(MSG_DEBUG, "nl80211: deleted bridge FDB entry for "
4134                            MACSTR, MAC2STR(addr));
4135         }
4136
4137         nl_addr_put(nl_addr);
4138         rtnl_neigh_put(rn);
4139 #endif /* CONFIG_LIBNL3_ROUTE */
4140 }
4141
4142
4143 static int wpa_driver_nl80211_sta_remove(struct i802_bss *bss, const u8 *addr,
4144                                          int deauth, u16 reason_code)
4145 {
4146         struct wpa_driver_nl80211_data *drv = bss->drv;
4147         struct nl_msg *msg;
4148         int ret;
4149
4150         if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_DEL_STATION)) ||
4151             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
4152             (deauth == 0 &&
4153              nla_put_u8(msg, NL80211_ATTR_MGMT_SUBTYPE,
4154                         WLAN_FC_STYPE_DISASSOC)) ||
4155             (deauth == 1 &&
4156              nla_put_u8(msg, NL80211_ATTR_MGMT_SUBTYPE,
4157                         WLAN_FC_STYPE_DEAUTH)) ||
4158             (reason_code &&
4159              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code))) {
4160                 nlmsg_free(msg);
4161                 return -ENOBUFS;
4162         }
4163
4164         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4165         wpa_printf(MSG_DEBUG, "nl80211: sta_remove -> DEL_STATION %s " MACSTR
4166                    " --> %d (%s)",
4167                    bss->ifname, MAC2STR(addr), ret, strerror(-ret));
4168
4169         if (drv->rtnl_sk)
4170                 rtnl_neigh_delete_fdb_entry(bss, addr);
4171
4172         if (ret == -ENOENT)
4173                 return 0;
4174         return ret;
4175 }
4176
4177
4178 void nl80211_remove_iface(struct wpa_driver_nl80211_data *drv, int ifidx)
4179 {
4180         struct nl_msg *msg;
4181         struct wpa_driver_nl80211_data *drv2;
4182
4183         wpa_printf(MSG_DEBUG, "nl80211: Remove interface ifindex=%d", ifidx);
4184
4185         /* stop listening for EAPOL on this interface */
4186         dl_list_for_each(drv2, &drv->global->interfaces,
4187                          struct wpa_driver_nl80211_data, list)
4188         {
4189                 del_ifidx(drv2, ifidx, IFIDX_ANY);
4190                 /* Remove all bridges learned for this iface */
4191                 del_ifidx(drv2, IFIDX_ANY, ifidx);
4192         }
4193
4194         msg = nl80211_ifindex_msg(drv, ifidx, 0, NL80211_CMD_DEL_INTERFACE);
4195         if (send_and_recv_msgs(drv, msg, NULL, NULL) == 0)
4196                 return;
4197         wpa_printf(MSG_ERROR, "Failed to remove interface (ifidx=%d)", ifidx);
4198 }
4199
4200
4201 const char * nl80211_iftype_str(enum nl80211_iftype mode)
4202 {
4203         switch (mode) {
4204         case NL80211_IFTYPE_ADHOC:
4205                 return "ADHOC";
4206         case NL80211_IFTYPE_STATION:
4207                 return "STATION";
4208         case NL80211_IFTYPE_AP:
4209                 return "AP";
4210         case NL80211_IFTYPE_AP_VLAN:
4211                 return "AP_VLAN";
4212         case NL80211_IFTYPE_WDS:
4213                 return "WDS";
4214         case NL80211_IFTYPE_MONITOR:
4215                 return "MONITOR";
4216         case NL80211_IFTYPE_MESH_POINT:
4217                 return "MESH_POINT";
4218         case NL80211_IFTYPE_P2P_CLIENT:
4219                 return "P2P_CLIENT";
4220         case NL80211_IFTYPE_P2P_GO:
4221                 return "P2P_GO";
4222         case NL80211_IFTYPE_P2P_DEVICE:
4223                 return "P2P_DEVICE";
4224         default:
4225                 return "unknown";
4226         }
4227 }
4228
4229
4230 static int nl80211_create_iface_once(struct wpa_driver_nl80211_data *drv,
4231                                      const char *ifname,
4232                                      enum nl80211_iftype iftype,
4233                                      const u8 *addr, int wds,
4234                                      int (*handler)(struct nl_msg *, void *),
4235                                      void *arg)
4236 {
4237         struct nl_msg *msg;
4238         int ifidx;
4239         int ret = -ENOBUFS;
4240
4241         wpa_printf(MSG_DEBUG, "nl80211: Create interface iftype %d (%s)",
4242                    iftype, nl80211_iftype_str(iftype));
4243
4244         msg = nl80211_cmd_msg(drv->first_bss, 0, NL80211_CMD_NEW_INTERFACE);
4245         if (!msg ||
4246             nla_put_string(msg, NL80211_ATTR_IFNAME, ifname) ||
4247             nla_put_u32(msg, NL80211_ATTR_IFTYPE, iftype))
4248                 goto fail;
4249
4250         if (iftype == NL80211_IFTYPE_MONITOR) {
4251                 struct nlattr *flags;
4252
4253                 flags = nla_nest_start(msg, NL80211_ATTR_MNTR_FLAGS);
4254                 if (!flags ||
4255                     nla_put_flag(msg, NL80211_MNTR_FLAG_COOK_FRAMES))
4256                         goto fail;
4257
4258                 nla_nest_end(msg, flags);
4259         } else if (wds) {
4260                 if (nla_put_u8(msg, NL80211_ATTR_4ADDR, wds))
4261                         goto fail;
4262         }
4263
4264         /*
4265          * Tell cfg80211 that the interface belongs to the socket that created
4266          * it, and the interface should be deleted when the socket is closed.
4267          */
4268         if (nla_put_flag(msg, NL80211_ATTR_IFACE_SOCKET_OWNER))
4269                 goto fail;
4270
4271         ret = send_and_recv_msgs(drv, msg, handler, arg);
4272         msg = NULL;
4273         if (ret) {
4274         fail:
4275                 nlmsg_free(msg);
4276                 wpa_printf(MSG_ERROR, "Failed to create interface %s: %d (%s)",
4277                            ifname, ret, strerror(-ret));
4278                 return ret;
4279         }
4280
4281         if (iftype == NL80211_IFTYPE_P2P_DEVICE)
4282                 return 0;
4283
4284         ifidx = if_nametoindex(ifname);
4285         wpa_printf(MSG_DEBUG, "nl80211: New interface %s created: ifindex=%d",
4286                    ifname, ifidx);
4287
4288         if (ifidx <= 0)
4289                 return -1;
4290
4291         /*
4292          * Some virtual interfaces need to process EAPOL packets and events on
4293          * the parent interface. This is used mainly with hostapd.
4294          */
4295         if (drv->hostapd ||
4296             iftype == NL80211_IFTYPE_AP_VLAN ||
4297             iftype == NL80211_IFTYPE_WDS ||
4298             iftype == NL80211_IFTYPE_MONITOR) {
4299                 /* start listening for EAPOL on this interface */
4300                 add_ifidx(drv, ifidx, IFIDX_ANY);
4301         }
4302
4303         if (addr && iftype != NL80211_IFTYPE_MONITOR &&
4304             linux_set_ifhwaddr(drv->global->ioctl_sock, ifname, addr)) {
4305                 nl80211_remove_iface(drv, ifidx);
4306                 return -1;
4307         }
4308
4309         return ifidx;
4310 }
4311
4312
4313 int nl80211_create_iface(struct wpa_driver_nl80211_data *drv,
4314                          const char *ifname, enum nl80211_iftype iftype,
4315                          const u8 *addr, int wds,
4316                          int (*handler)(struct nl_msg *, void *),
4317                          void *arg, int use_existing)
4318 {
4319         int ret;
4320
4321         ret = nl80211_create_iface_once(drv, ifname, iftype, addr, wds, handler,
4322                                         arg);
4323
4324         /* if error occurred and interface exists already */
4325         if (ret == -ENFILE && if_nametoindex(ifname)) {
4326                 if (use_existing) {
4327                         wpa_printf(MSG_DEBUG, "nl80211: Continue using existing interface %s",
4328                                    ifname);
4329                         if (addr && iftype != NL80211_IFTYPE_MONITOR &&
4330                             linux_set_ifhwaddr(drv->global->ioctl_sock, ifname,
4331                                                addr) < 0 &&
4332                             (linux_set_iface_flags(drv->global->ioctl_sock,
4333                                                    ifname, 0) < 0 ||
4334                              linux_set_ifhwaddr(drv->global->ioctl_sock, ifname,
4335                                                 addr) < 0 ||
4336                              linux_set_iface_flags(drv->global->ioctl_sock,
4337                                                    ifname, 1) < 0))
4338                                         return -1;
4339                         return -ENFILE;
4340                 }
4341                 wpa_printf(MSG_INFO, "Try to remove and re-create %s", ifname);
4342
4343                 /* Try to remove the interface that was already there. */
4344                 nl80211_remove_iface(drv, if_nametoindex(ifname));
4345
4346                 /* Try to create the interface again */
4347                 ret = nl80211_create_iface_once(drv, ifname, iftype, addr,
4348                                                 wds, handler, arg);
4349         }
4350
4351         if (ret >= 0 && is_p2p_net_interface(iftype)) {
4352                 wpa_printf(MSG_DEBUG,
4353                            "nl80211: Interface %s created for P2P - disable 11b rates",
4354                            ifname);
4355                 nl80211_disable_11b_rates(drv, ret, 1);
4356         }
4357
4358         return ret;
4359 }
4360
4361
4362 static int nl80211_setup_ap(struct i802_bss *bss)
4363 {
4364         struct wpa_driver_nl80211_data *drv = bss->drv;
4365
4366         wpa_printf(MSG_DEBUG, "nl80211: Setup AP(%s) - device_ap_sme=%d use_monitor=%d",
4367                    bss->ifname, drv->device_ap_sme, drv->use_monitor);
4368
4369         /*
4370          * Disable Probe Request reporting unless we need it in this way for
4371          * devices that include the AP SME, in the other case (unless using
4372          * monitor iface) we'll get it through the nl_mgmt socket instead.
4373          */
4374         if (!drv->device_ap_sme)
4375                 wpa_driver_nl80211_probe_req_report(bss, 0);
4376
4377         if (!drv->device_ap_sme && !drv->use_monitor)
4378                 if (nl80211_mgmt_subscribe_ap(bss))
4379                         return -1;
4380
4381         if (drv->device_ap_sme && !drv->use_monitor)
4382                 if (nl80211_mgmt_subscribe_ap_dev_sme(bss))
4383                         wpa_printf(MSG_DEBUG,
4384                                    "nl80211: Failed to subscribe for mgmt frames from SME driver - trying to run without it");
4385
4386         if (!drv->device_ap_sme && drv->use_monitor &&
4387             nl80211_create_monitor_interface(drv))
4388                 return -1;
4389
4390         if (drv->device_ap_sme &&
4391             wpa_driver_nl80211_probe_req_report(bss, 1) < 0) {
4392                 wpa_printf(MSG_DEBUG, "nl80211: Failed to enable "
4393                            "Probe Request frame reporting in AP mode");
4394                 /* Try to survive without this */
4395         }
4396
4397         return 0;
4398 }
4399
4400
4401 static void nl80211_teardown_ap(struct i802_bss *bss)
4402 {
4403         struct wpa_driver_nl80211_data *drv = bss->drv;
4404
4405         wpa_printf(MSG_DEBUG, "nl80211: Teardown AP(%s) - device_ap_sme=%d use_monitor=%d",
4406                    bss->ifname, drv->device_ap_sme, drv->use_monitor);
4407         if (drv->device_ap_sme) {
4408                 wpa_driver_nl80211_probe_req_report(bss, 0);
4409                 if (!drv->use_monitor)
4410                         nl80211_mgmt_unsubscribe(bss, "AP teardown (dev SME)");
4411         } else if (drv->use_monitor)
4412                 nl80211_remove_monitor_interface(drv);
4413         else
4414                 nl80211_mgmt_unsubscribe(bss, "AP teardown");
4415
4416         bss->beacon_set = 0;
4417 }
4418
4419
4420 static int nl80211_send_eapol_data(struct i802_bss *bss,
4421                                    const u8 *addr, const u8 *data,
4422                                    size_t data_len)
4423 {
4424         struct sockaddr_ll ll;
4425         int ret;
4426
4427         if (bss->drv->eapol_tx_sock < 0) {
4428                 wpa_printf(MSG_DEBUG, "nl80211: No socket to send EAPOL");
4429                 return -1;
4430         }
4431
4432         os_memset(&ll, 0, sizeof(ll));
4433         ll.sll_family = AF_PACKET;
4434         ll.sll_ifindex = bss->ifindex;
4435         ll.sll_protocol = htons(ETH_P_PAE);
4436         ll.sll_halen = ETH_ALEN;
4437         os_memcpy(ll.sll_addr, addr, ETH_ALEN);
4438         ret = sendto(bss->drv->eapol_tx_sock, data, data_len, 0,
4439                      (struct sockaddr *) &ll, sizeof(ll));
4440         if (ret < 0)
4441                 wpa_printf(MSG_ERROR, "nl80211: EAPOL TX: %s",
4442                            strerror(errno));
4443
4444         return ret;
4445 }
4446
4447
4448 static const u8 rfc1042_header[6] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
4449
4450 static int wpa_driver_nl80211_hapd_send_eapol(
4451         void *priv, const u8 *addr, const u8 *data,
4452         size_t data_len, int encrypt, const u8 *own_addr, u32 flags)
4453 {
4454         struct i802_bss *bss = priv;
4455         struct wpa_driver_nl80211_data *drv = bss->drv;
4456         struct ieee80211_hdr *hdr;
4457         size_t len;
4458         u8 *pos;
4459         int res;
4460         int qos = flags & WPA_STA_WMM;
4461
4462         if (drv->device_ap_sme || !drv->use_monitor)
4463                 return nl80211_send_eapol_data(bss, addr, data, data_len);
4464
4465         len = sizeof(*hdr) + (qos ? 2 : 0) + sizeof(rfc1042_header) + 2 +
4466                 data_len;
4467         hdr = os_zalloc(len);
4468         if (hdr == NULL) {
4469                 wpa_printf(MSG_INFO, "nl80211: Failed to allocate EAPOL buffer(len=%lu)",
4470                            (unsigned long) len);
4471                 return -1;
4472         }
4473
4474         hdr->frame_control =
4475                 IEEE80211_FC(WLAN_FC_TYPE_DATA, WLAN_FC_STYPE_DATA);
4476         hdr->frame_control |= host_to_le16(WLAN_FC_FROMDS);
4477         if (encrypt)
4478                 hdr->frame_control |= host_to_le16(WLAN_FC_ISWEP);
4479         if (qos) {
4480                 hdr->frame_control |=
4481                         host_to_le16(WLAN_FC_STYPE_QOS_DATA << 4);
4482         }
4483
4484         memcpy(hdr->IEEE80211_DA_FROMDS, addr, ETH_ALEN);
4485         memcpy(hdr->IEEE80211_BSSID_FROMDS, own_addr, ETH_ALEN);
4486         memcpy(hdr->IEEE80211_SA_FROMDS, own_addr, ETH_ALEN);
4487         pos = (u8 *) (hdr + 1);
4488
4489         if (qos) {
4490                 /* Set highest priority in QoS header */
4491                 pos[0] = 7;
4492                 pos[1] = 0;
4493                 pos += 2;
4494         }
4495
4496         memcpy(pos, rfc1042_header, sizeof(rfc1042_header));
4497         pos += sizeof(rfc1042_header);
4498         WPA_PUT_BE16(pos, ETH_P_PAE);
4499         pos += 2;
4500         memcpy(pos, data, data_len);
4501
4502         res = wpa_driver_nl80211_send_frame(bss, (u8 *) hdr, len, encrypt, 0,
4503                                             0, 0, 0, 0, NULL, 0);
4504         if (res < 0) {
4505                 wpa_printf(MSG_ERROR, "i802_send_eapol - packet len: %lu - "
4506                            "failed: %d (%s)",
4507                            (unsigned long) len, errno, strerror(errno));
4508         }
4509         os_free(hdr);
4510
4511         return res;
4512 }
4513
4514
4515 static int wpa_driver_nl80211_sta_set_flags(void *priv, const u8 *addr,
4516                                             unsigned int total_flags,
4517                                             unsigned int flags_or,
4518                                             unsigned int flags_and)
4519 {
4520         struct i802_bss *bss = priv;
4521         struct nl_msg *msg;
4522         struct nlattr *flags;
4523         struct nl80211_sta_flag_update upd;
4524
4525         wpa_printf(MSG_DEBUG, "nl80211: Set STA flags - ifname=%s addr=" MACSTR
4526                    " total_flags=0x%x flags_or=0x%x flags_and=0x%x authorized=%d",
4527                    bss->ifname, MAC2STR(addr), total_flags, flags_or, flags_and,
4528                    !!(total_flags & WPA_STA_AUTHORIZED));
4529
4530         if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_SET_STATION)) ||
4531             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
4532                 goto fail;
4533
4534         /*
4535          * Backwards compatibility version using NL80211_ATTR_STA_FLAGS. This
4536          * can be removed eventually.
4537          */
4538         flags = nla_nest_start(msg, NL80211_ATTR_STA_FLAGS);
4539         if (!flags ||
4540             ((total_flags & WPA_STA_AUTHORIZED) &&
4541              nla_put_flag(msg, NL80211_STA_FLAG_AUTHORIZED)) ||
4542             ((total_flags & WPA_STA_WMM) &&
4543              nla_put_flag(msg, NL80211_STA_FLAG_WME)) ||
4544             ((total_flags & WPA_STA_SHORT_PREAMBLE) &&
4545              nla_put_flag(msg, NL80211_STA_FLAG_SHORT_PREAMBLE)) ||
4546             ((total_flags & WPA_STA_MFP) &&
4547              nla_put_flag(msg, NL80211_STA_FLAG_MFP)) ||
4548             ((total_flags & WPA_STA_TDLS_PEER) &&
4549              nla_put_flag(msg, NL80211_STA_FLAG_TDLS_PEER)))
4550                 goto fail;
4551
4552         nla_nest_end(msg, flags);
4553
4554         os_memset(&upd, 0, sizeof(upd));
4555         upd.mask = sta_flags_nl80211(flags_or | ~flags_and);
4556         upd.set = sta_flags_nl80211(flags_or);
4557         if (nla_put(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd))
4558                 goto fail;
4559
4560         return send_and_recv_msgs(bss->drv, msg, NULL, NULL);
4561 fail:
4562         nlmsg_free(msg);
4563         return -ENOBUFS;
4564 }
4565
4566
4567 static int wpa_driver_nl80211_ap(struct wpa_driver_nl80211_data *drv,
4568                                  struct wpa_driver_associate_params *params)
4569 {
4570         enum nl80211_iftype nlmode, old_mode;
4571
4572         if (params->p2p) {
4573                 wpa_printf(MSG_DEBUG, "nl80211: Setup AP operations for P2P "
4574                            "group (GO)");
4575                 nlmode = NL80211_IFTYPE_P2P_GO;
4576         } else
4577                 nlmode = NL80211_IFTYPE_AP;
4578
4579         old_mode = drv->nlmode;
4580         if (wpa_driver_nl80211_set_mode(drv->first_bss, nlmode)) {
4581                 nl80211_remove_monitor_interface(drv);
4582                 return -1;
4583         }
4584
4585         if (params->freq.freq &&
4586             nl80211_set_channel(drv->first_bss, &params->freq, 0)) {
4587                 if (old_mode != nlmode)
4588                         wpa_driver_nl80211_set_mode(drv->first_bss, old_mode);
4589                 nl80211_remove_monitor_interface(drv);
4590                 return -1;
4591         }
4592
4593         return 0;
4594 }
4595
4596
4597 static int nl80211_leave_ibss(struct wpa_driver_nl80211_data *drv,
4598                               int reset_mode)
4599 {
4600         struct nl_msg *msg;
4601         int ret;
4602
4603         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_LEAVE_IBSS);
4604         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4605         if (ret) {
4606                 wpa_printf(MSG_DEBUG, "nl80211: Leave IBSS failed: ret=%d "
4607                            "(%s)", ret, strerror(-ret));
4608         } else {
4609                 wpa_printf(MSG_DEBUG,
4610                            "nl80211: Leave IBSS request sent successfully");
4611         }
4612
4613         if (reset_mode &&
4614             wpa_driver_nl80211_set_mode(drv->first_bss,
4615                                         NL80211_IFTYPE_STATION)) {
4616                 wpa_printf(MSG_INFO, "nl80211: Failed to set interface into "
4617                            "station mode");
4618         }
4619
4620         return ret;
4621 }
4622
4623
4624 static int nl80211_ht_vht_overrides(struct nl_msg *msg,
4625                                     struct wpa_driver_associate_params *params)
4626 {
4627         if (params->disable_ht && nla_put_flag(msg, NL80211_ATTR_DISABLE_HT))
4628                 return -1;
4629
4630         if (params->htcaps && params->htcaps_mask) {
4631                 int sz = sizeof(struct ieee80211_ht_capabilities);
4632                 wpa_hexdump(MSG_DEBUG, "  * htcaps", params->htcaps, sz);
4633                 wpa_hexdump(MSG_DEBUG, "  * htcaps_mask",
4634                             params->htcaps_mask, sz);
4635                 if (nla_put(msg, NL80211_ATTR_HT_CAPABILITY, sz,
4636                             params->htcaps) ||
4637                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK, sz,
4638                             params->htcaps_mask))
4639                         return -1;
4640         }
4641
4642 #ifdef CONFIG_VHT_OVERRIDES
4643         if (params->disable_vht) {
4644                 wpa_printf(MSG_DEBUG, "  * VHT disabled");
4645                 if (nla_put_flag(msg, NL80211_ATTR_DISABLE_VHT))
4646                         return -1;
4647         }
4648
4649         if (params->vhtcaps && params->vhtcaps_mask) {
4650                 int sz = sizeof(struct ieee80211_vht_capabilities);
4651                 wpa_hexdump(MSG_DEBUG, "  * vhtcaps", params->vhtcaps, sz);
4652                 wpa_hexdump(MSG_DEBUG, "  * vhtcaps_mask",
4653                             params->vhtcaps_mask, sz);
4654                 if (nla_put(msg, NL80211_ATTR_VHT_CAPABILITY, sz,
4655                             params->vhtcaps) ||
4656                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK, sz,
4657                             params->vhtcaps_mask))
4658                         return -1;
4659         }
4660 #endif /* CONFIG_VHT_OVERRIDES */
4661
4662         return 0;
4663 }
4664
4665
4666 static int wpa_driver_nl80211_ibss(struct wpa_driver_nl80211_data *drv,
4667                                    struct wpa_driver_associate_params *params)
4668 {
4669         struct nl_msg *msg;
4670         int ret = -1;
4671         int count = 0;
4672
4673         wpa_printf(MSG_DEBUG, "nl80211: Join IBSS (ifindex=%d)", drv->ifindex);
4674
4675         if (wpa_driver_nl80211_set_mode_ibss(drv->first_bss, &params->freq)) {
4676                 wpa_printf(MSG_INFO, "nl80211: Failed to set interface into "
4677                            "IBSS mode");
4678                 return -1;
4679         }
4680
4681 retry:
4682         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_JOIN_IBSS)) ||
4683             params->ssid == NULL || params->ssid_len > sizeof(drv->ssid))
4684                 goto fail;
4685
4686         wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
4687                           params->ssid, params->ssid_len);
4688         if (nla_put(msg, NL80211_ATTR_SSID, params->ssid_len, params->ssid))
4689                 goto fail;
4690         os_memcpy(drv->ssid, params->ssid, params->ssid_len);
4691         drv->ssid_len = params->ssid_len;
4692
4693         if (nl80211_put_freq_params(msg, &params->freq) < 0 ||
4694             nl80211_put_beacon_int(msg, params->beacon_int))
4695                 goto fail;
4696
4697         ret = nl80211_set_conn_keys(params, msg);
4698         if (ret)
4699                 goto fail;
4700
4701         if (params->bssid && params->fixed_bssid) {
4702                 wpa_printf(MSG_DEBUG, "  * BSSID=" MACSTR,
4703                            MAC2STR(params->bssid));
4704                 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid))
4705                         goto fail;
4706         }
4707
4708         if (params->fixed_freq) {
4709                 wpa_printf(MSG_DEBUG, "  * fixed_freq");
4710                 if (nla_put_flag(msg, NL80211_ATTR_FREQ_FIXED))
4711                         goto fail;
4712         }
4713
4714         if (params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
4715             params->key_mgmt_suite == WPA_KEY_MGMT_PSK ||
4716             params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
4717             params->key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256) {
4718                 wpa_printf(MSG_DEBUG, "  * control port");
4719                 if (nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT))
4720                         goto fail;
4721         }
4722
4723         if (params->wpa_ie) {
4724                 wpa_hexdump(MSG_DEBUG,
4725                             "  * Extra IEs for Beacon/Probe Response frames",
4726                             params->wpa_ie, params->wpa_ie_len);
4727                 if (nla_put(msg, NL80211_ATTR_IE, params->wpa_ie_len,
4728                             params->wpa_ie))
4729                         goto fail;
4730         }
4731
4732         ret = nl80211_ht_vht_overrides(msg, params);
4733         if (ret < 0)
4734                 goto fail;
4735
4736         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4737         msg = NULL;
4738         if (ret) {
4739                 wpa_printf(MSG_DEBUG, "nl80211: Join IBSS failed: ret=%d (%s)",
4740                            ret, strerror(-ret));
4741                 count++;
4742                 if (ret == -EALREADY && count == 1) {
4743                         wpa_printf(MSG_DEBUG, "nl80211: Retry IBSS join after "
4744                                    "forced leave");
4745                         nl80211_leave_ibss(drv, 0);
4746                         nlmsg_free(msg);
4747                         goto retry;
4748                 }
4749         } else {
4750                 wpa_printf(MSG_DEBUG,
4751                            "nl80211: Join IBSS request sent successfully");
4752         }
4753
4754 fail:
4755         nlmsg_free(msg);
4756         return ret;
4757 }
4758
4759
4760 static int nl80211_connect_common(struct wpa_driver_nl80211_data *drv,
4761                                   struct wpa_driver_associate_params *params,
4762                                   struct nl_msg *msg)
4763 {
4764         if (params->bssid) {
4765                 wpa_printf(MSG_DEBUG, "  * bssid=" MACSTR,
4766                            MAC2STR(params->bssid));
4767                 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid))
4768                         return -1;
4769         }
4770
4771         if (params->bssid_hint) {
4772                 wpa_printf(MSG_DEBUG, "  * bssid_hint=" MACSTR,
4773                            MAC2STR(params->bssid_hint));
4774                 if (nla_put(msg, NL80211_ATTR_MAC_HINT, ETH_ALEN,
4775                             params->bssid_hint))
4776                         return -1;
4777         }
4778
4779         if (params->freq.freq) {
4780                 wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq.freq);
4781                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
4782                                 params->freq.freq))
4783                         return -1;
4784                 drv->assoc_freq = params->freq.freq;
4785         } else
4786                 drv->assoc_freq = 0;
4787
4788         if (params->freq_hint) {
4789                 wpa_printf(MSG_DEBUG, "  * freq_hint=%d", params->freq_hint);
4790                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_HINT,
4791                                 params->freq_hint))
4792                         return -1;
4793         }
4794
4795         if (params->bg_scan_period >= 0) {
4796                 wpa_printf(MSG_DEBUG, "  * bg scan period=%d",
4797                            params->bg_scan_period);
4798                 if (nla_put_u16(msg, NL80211_ATTR_BG_SCAN_PERIOD,
4799                                 params->bg_scan_period))
4800                         return -1;
4801         }
4802
4803         if (params->ssid) {
4804                 wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
4805                                   params->ssid, params->ssid_len);
4806                 if (nla_put(msg, NL80211_ATTR_SSID, params->ssid_len,
4807                             params->ssid))
4808                         return -1;
4809                 if (params->ssid_len > sizeof(drv->ssid))
4810                         return -1;
4811                 os_memcpy(drv->ssid, params->ssid, params->ssid_len);
4812                 drv->ssid_len = params->ssid_len;
4813         }
4814
4815         wpa_hexdump(MSG_DEBUG, "  * IEs", params->wpa_ie, params->wpa_ie_len);
4816         if (params->wpa_ie &&
4817             nla_put(msg, NL80211_ATTR_IE, params->wpa_ie_len, params->wpa_ie))
4818                 return -1;
4819
4820         if (params->wpa_proto) {
4821                 enum nl80211_wpa_versions ver = 0;
4822
4823                 if (params->wpa_proto & WPA_PROTO_WPA)
4824                         ver |= NL80211_WPA_VERSION_1;
4825                 if (params->wpa_proto & WPA_PROTO_RSN)
4826                         ver |= NL80211_WPA_VERSION_2;
4827
4828                 wpa_printf(MSG_DEBUG, "  * WPA Versions 0x%x", ver);
4829                 if (nla_put_u32(msg, NL80211_ATTR_WPA_VERSIONS, ver))
4830                         return -1;
4831         }
4832
4833         if (params->pairwise_suite != WPA_CIPHER_NONE) {
4834                 u32 cipher = wpa_cipher_to_cipher_suite(params->pairwise_suite);
4835                 wpa_printf(MSG_DEBUG, "  * pairwise=0x%x", cipher);
4836                 if (nla_put_u32(msg, NL80211_ATTR_CIPHER_SUITES_PAIRWISE,
4837                                 cipher))
4838                         return -1;
4839         }
4840
4841         if (params->group_suite == WPA_CIPHER_GTK_NOT_USED &&
4842             !(drv->capa.enc & WPA_DRIVER_CAPA_ENC_GTK_NOT_USED)) {
4843                 /*
4844                  * This is likely to work even though many drivers do not
4845                  * advertise support for operations without GTK.
4846                  */
4847                 wpa_printf(MSG_DEBUG, "  * skip group cipher configuration for GTK_NOT_USED due to missing driver support advertisement");
4848         } else if (params->group_suite != WPA_CIPHER_NONE) {
4849                 u32 cipher = wpa_cipher_to_cipher_suite(params->group_suite);
4850                 wpa_printf(MSG_DEBUG, "  * group=0x%x", cipher);
4851                 if (nla_put_u32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP, cipher))
4852                         return -1;
4853         }
4854
4855         if (params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
4856             params->key_mgmt_suite == WPA_KEY_MGMT_PSK ||
4857             params->key_mgmt_suite == WPA_KEY_MGMT_FT_IEEE8021X ||
4858             params->key_mgmt_suite == WPA_KEY_MGMT_FT_PSK ||
4859             params->key_mgmt_suite == WPA_KEY_MGMT_CCKM ||
4860             params->key_mgmt_suite == WPA_KEY_MGMT_OSEN ||
4861             params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
4862             params->key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256 ||
4863             params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B ||
4864             params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) {
4865                 int mgmt = WLAN_AKM_SUITE_PSK;
4866
4867                 switch (params->key_mgmt_suite) {
4868                 case WPA_KEY_MGMT_CCKM:
4869                         mgmt = WLAN_AKM_SUITE_CCKM;
4870                         break;
4871                 case WPA_KEY_MGMT_IEEE8021X:
4872                         mgmt = WLAN_AKM_SUITE_8021X;
4873                         break;
4874                 case WPA_KEY_MGMT_FT_IEEE8021X:
4875                         mgmt = WLAN_AKM_SUITE_FT_8021X;
4876                         break;
4877                 case WPA_KEY_MGMT_FT_PSK:
4878                         mgmt = WLAN_AKM_SUITE_FT_PSK;
4879                         break;
4880                 case WPA_KEY_MGMT_IEEE8021X_SHA256:
4881                         mgmt = WLAN_AKM_SUITE_8021X_SHA256;
4882                         break;
4883                 case WPA_KEY_MGMT_PSK_SHA256:
4884                         mgmt = WLAN_AKM_SUITE_PSK_SHA256;
4885                         break;
4886                 case WPA_KEY_MGMT_OSEN:
4887                         mgmt = WLAN_AKM_SUITE_OSEN;
4888                         break;
4889                 case WPA_KEY_MGMT_IEEE8021X_SUITE_B:
4890                         mgmt = WLAN_AKM_SUITE_8021X_SUITE_B;
4891                         break;
4892                 case WPA_KEY_MGMT_IEEE8021X_SUITE_B_192:
4893                         mgmt = WLAN_AKM_SUITE_8021X_SUITE_B_192;
4894                         break;
4895                 case WPA_KEY_MGMT_PSK:
4896                 default:
4897                         mgmt = WLAN_AKM_SUITE_PSK;
4898                         break;
4899                 }
4900                 wpa_printf(MSG_DEBUG, "  * akm=0x%x", mgmt);
4901                 if (nla_put_u32(msg, NL80211_ATTR_AKM_SUITES, mgmt))
4902                         return -1;
4903         }
4904
4905         if (nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT))
4906                 return -1;
4907
4908         if (params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_NO_WPA &&
4909             (params->pairwise_suite == WPA_CIPHER_NONE ||
4910              params->pairwise_suite == WPA_CIPHER_WEP104 ||
4911              params->pairwise_suite == WPA_CIPHER_WEP40) &&
4912             (nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, ETH_P_PAE) ||
4913              nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT)))
4914                 return -1;
4915
4916         if (params->mgmt_frame_protection == MGMT_FRAME_PROTECTION_REQUIRED &&
4917             nla_put_u32(msg, NL80211_ATTR_USE_MFP, NL80211_MFP_REQUIRED))
4918                 return -1;
4919
4920         if (params->rrm_used) {
4921                 u32 drv_rrm_flags = drv->capa.rrm_flags;
4922                 if ((!((drv_rrm_flags &
4923                         WPA_DRIVER_FLAGS_DS_PARAM_SET_IE_IN_PROBES) &&
4924                        (drv_rrm_flags & WPA_DRIVER_FLAGS_QUIET)) &&
4925                      !(drv_rrm_flags & WPA_DRIVER_FLAGS_SUPPORT_RRM)) ||
4926                     nla_put_flag(msg, NL80211_ATTR_USE_RRM))
4927                         return -1;
4928         }
4929
4930         if (nl80211_ht_vht_overrides(msg, params) < 0)
4931                 return -1;
4932
4933         if (params->p2p)
4934                 wpa_printf(MSG_DEBUG, "  * P2P group");
4935
4936         if (params->pbss) {
4937                 wpa_printf(MSG_DEBUG, "  * PBSS");
4938                 if (nla_put_flag(msg, NL80211_ATTR_PBSS))
4939                         return -1;
4940         }
4941
4942         drv->connect_reassoc = 0;
4943         if (params->prev_bssid) {
4944                 wpa_printf(MSG_DEBUG, "  * prev_bssid=" MACSTR,
4945                            MAC2STR(params->prev_bssid));
4946                 if (nla_put(msg, NL80211_ATTR_PREV_BSSID, ETH_ALEN,
4947                             params->prev_bssid))
4948                         return -1;
4949                 drv->connect_reassoc = 1;
4950         }
4951
4952         return 0;
4953 }
4954
4955
4956 static int wpa_driver_nl80211_try_connect(
4957         struct wpa_driver_nl80211_data *drv,
4958         struct wpa_driver_associate_params *params)
4959 {
4960         struct nl_msg *msg;
4961         enum nl80211_auth_type type;
4962         int ret;
4963         int algs;
4964
4965 #ifdef CONFIG_DRIVER_NL80211_QCA
4966         if (params->req_key_mgmt_offload && params->psk &&
4967             (params->key_mgmt_suite == WPA_KEY_MGMT_PSK ||
4968              params->key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256 ||
4969              params->key_mgmt_suite == WPA_KEY_MGMT_FT_PSK)) {
4970                 wpa_printf(MSG_DEBUG, "nl80211: Key management set PSK");
4971                 ret = issue_key_mgmt_set_key(drv, params->psk, 32);
4972                 if (ret)
4973                         return ret;
4974         }
4975 #endif /* CONFIG_DRIVER_NL80211_QCA */
4976
4977         wpa_printf(MSG_DEBUG, "nl80211: Connect (ifindex=%d)", drv->ifindex);
4978         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_CONNECT);
4979         if (!msg)
4980                 return -1;
4981
4982         ret = nl80211_connect_common(drv, params, msg);
4983         if (ret)
4984                 goto fail;
4985
4986         algs = 0;
4987         if (params->auth_alg & WPA_AUTH_ALG_OPEN)
4988                 algs++;
4989         if (params->auth_alg & WPA_AUTH_ALG_SHARED)
4990                 algs++;
4991         if (params->auth_alg & WPA_AUTH_ALG_LEAP)
4992                 algs++;
4993         if (algs > 1) {
4994                 wpa_printf(MSG_DEBUG, "  * Leave out Auth Type for automatic "
4995                            "selection");
4996                 goto skip_auth_type;
4997         }
4998
4999         if (params->auth_alg & WPA_AUTH_ALG_OPEN)
5000                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
5001         else if (params->auth_alg & WPA_AUTH_ALG_SHARED)
5002                 type = NL80211_AUTHTYPE_SHARED_KEY;
5003         else if (params->auth_alg & WPA_AUTH_ALG_LEAP)
5004                 type = NL80211_AUTHTYPE_NETWORK_EAP;
5005         else if (params->auth_alg & WPA_AUTH_ALG_FT)
5006                 type = NL80211_AUTHTYPE_FT;
5007         else
5008                 goto fail;
5009
5010         wpa_printf(MSG_DEBUG, "  * Auth Type %d", type);
5011         if (nla_put_u32(msg, NL80211_ATTR_AUTH_TYPE, type))
5012                 goto fail;
5013
5014 skip_auth_type:
5015         ret = nl80211_set_conn_keys(params, msg);
5016         if (ret)
5017                 goto fail;
5018
5019         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5020         msg = NULL;
5021         if (ret) {
5022                 wpa_printf(MSG_DEBUG, "nl80211: MLME connect failed: ret=%d "
5023                            "(%s)", ret, strerror(-ret));
5024         } else {
5025                 wpa_printf(MSG_DEBUG,
5026                            "nl80211: Connect request send successfully");
5027         }
5028
5029 fail:
5030         nlmsg_free(msg);
5031         return ret;
5032
5033 }
5034
5035
5036 static int wpa_driver_nl80211_connect(
5037         struct wpa_driver_nl80211_data *drv,
5038         struct wpa_driver_associate_params *params)
5039 {
5040         int ret;
5041
5042         /* Store the connection attempted bssid for future use */
5043         if (params->bssid)
5044                 os_memcpy(drv->auth_attempt_bssid, params->bssid, ETH_ALEN);
5045         else
5046                 os_memset(drv->auth_attempt_bssid, 0, ETH_ALEN);
5047
5048         ret = wpa_driver_nl80211_try_connect(drv, params);
5049         if (ret == -EALREADY) {
5050                 /*
5051                  * cfg80211 does not currently accept new connections if
5052                  * we are already connected. As a workaround, force
5053                  * disconnection and try again.
5054                  */
5055                 wpa_printf(MSG_DEBUG, "nl80211: Explicitly "
5056                            "disconnecting before reassociation "
5057                            "attempt");
5058                 if (wpa_driver_nl80211_disconnect(
5059                             drv, WLAN_REASON_PREV_AUTH_NOT_VALID))
5060                         return -1;
5061                 ret = wpa_driver_nl80211_try_connect(drv, params);
5062         }
5063         return ret;
5064 }
5065
5066
5067 static int wpa_driver_nl80211_associate(
5068         void *priv, struct wpa_driver_associate_params *params)
5069 {
5070         struct i802_bss *bss = priv;
5071         struct wpa_driver_nl80211_data *drv = bss->drv;
5072         int ret = -1;
5073         struct nl_msg *msg;
5074
5075         nl80211_unmask_11b_rates(bss);
5076
5077         if (params->mode == IEEE80211_MODE_AP)
5078                 return wpa_driver_nl80211_ap(drv, params);
5079
5080         if (params->mode == IEEE80211_MODE_IBSS)
5081                 return wpa_driver_nl80211_ibss(drv, params);
5082
5083         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME)) {
5084                 enum nl80211_iftype nlmode = params->p2p ?
5085                         NL80211_IFTYPE_P2P_CLIENT : NL80211_IFTYPE_STATION;
5086
5087                 if (wpa_driver_nl80211_set_mode(priv, nlmode) < 0)
5088                         return -1;
5089                 return wpa_driver_nl80211_connect(drv, params);
5090         }
5091
5092         nl80211_mark_disconnected(drv);
5093
5094         wpa_printf(MSG_DEBUG, "nl80211: Associate (ifindex=%d)",
5095                    drv->ifindex);
5096         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_ASSOCIATE);
5097         if (!msg)
5098                 return -1;
5099
5100         ret = nl80211_connect_common(drv, params, msg);
5101         if (ret)
5102                 goto fail;
5103
5104         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5105         msg = NULL;
5106         if (ret) {
5107                 wpa_dbg(drv->ctx, MSG_DEBUG,
5108                         "nl80211: MLME command failed (assoc): ret=%d (%s)",
5109                         ret, strerror(-ret));
5110                 nl80211_dump_scan(drv);
5111         } else {
5112                 wpa_printf(MSG_DEBUG,
5113                            "nl80211: Association request send successfully");
5114         }
5115
5116 fail:
5117         nlmsg_free(msg);
5118         return ret;
5119 }
5120
5121
5122 static int nl80211_set_mode(struct wpa_driver_nl80211_data *drv,
5123                             int ifindex, enum nl80211_iftype mode)
5124 {
5125         struct nl_msg *msg;
5126         int ret = -ENOBUFS;
5127
5128         wpa_printf(MSG_DEBUG, "nl80211: Set mode ifindex %d iftype %d (%s)",
5129                    ifindex, mode, nl80211_iftype_str(mode));
5130
5131         msg = nl80211_cmd_msg(drv->first_bss, 0, NL80211_CMD_SET_INTERFACE);
5132         if (!msg || nla_put_u32(msg, NL80211_ATTR_IFTYPE, mode))
5133                 goto fail;
5134
5135         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5136         msg = NULL;
5137         if (!ret)
5138                 return 0;
5139 fail:
5140         nlmsg_free(msg);
5141         wpa_printf(MSG_DEBUG, "nl80211: Failed to set interface %d to mode %d:"
5142                    " %d (%s)", ifindex, mode, ret, strerror(-ret));
5143         return ret;
5144 }
5145
5146
5147 static int wpa_driver_nl80211_set_mode_impl(
5148                 struct i802_bss *bss,
5149                 enum nl80211_iftype nlmode,
5150                 struct hostapd_freq_params *desired_freq_params)
5151 {
5152         struct wpa_driver_nl80211_data *drv = bss->drv;
5153         int ret = -1;
5154         int i;
5155         int was_ap = is_ap_interface(drv->nlmode);
5156         int res;
5157         int mode_switch_res;
5158
5159         if (TEST_FAIL())
5160                 return -1;
5161
5162         mode_switch_res = nl80211_set_mode(drv, drv->ifindex, nlmode);
5163         if (mode_switch_res && nlmode == nl80211_get_ifmode(bss))
5164                 mode_switch_res = 0;
5165
5166         if (mode_switch_res == 0) {
5167                 drv->nlmode = nlmode;
5168                 ret = 0;
5169                 goto done;
5170         }
5171
5172         if (mode_switch_res == -ENODEV)
5173                 return -1;
5174
5175         if (nlmode == drv->nlmode) {
5176                 wpa_printf(MSG_DEBUG, "nl80211: Interface already in "
5177                            "requested mode - ignore error");
5178                 ret = 0;
5179                 goto done; /* Already in the requested mode */
5180         }
5181
5182         /* mac80211 doesn't allow mode changes while the device is up, so
5183          * take the device down, try to set the mode again, and bring the
5184          * device back up.
5185          */
5186         wpa_printf(MSG_DEBUG, "nl80211: Try mode change after setting "
5187                    "interface down");
5188         for (i = 0; i < 10; i++) {
5189                 res = i802_set_iface_flags(bss, 0);
5190                 if (res == -EACCES || res == -ENODEV)
5191                         break;
5192                 if (res != 0) {
5193                         wpa_printf(MSG_DEBUG, "nl80211: Failed to set "
5194                                    "interface down");
5195                         os_sleep(0, 100000);
5196                         continue;
5197                 }
5198
5199                 /*
5200                  * Setting the mode will fail for some drivers if the phy is
5201                  * on a frequency that the mode is disallowed in.
5202                  */
5203                 if (desired_freq_params) {
5204                         res = nl80211_set_channel(bss, desired_freq_params, 0);
5205                         if (res) {
5206                                 wpa_printf(MSG_DEBUG,
5207                                            "nl80211: Failed to set frequency on interface");
5208                         }
5209                 }
5210
5211                 /* Try to set the mode again while the interface is down */
5212                 mode_switch_res = nl80211_set_mode(drv, drv->ifindex, nlmode);
5213                 if (mode_switch_res == -EBUSY) {
5214                         wpa_printf(MSG_DEBUG,
5215                                    "nl80211: Delaying mode set while interface going down");
5216                         os_sleep(0, 100000);
5217                         continue;
5218                 }
5219                 ret = mode_switch_res;
5220                 break;
5221         }
5222
5223         if (!ret) {
5224                 wpa_printf(MSG_DEBUG, "nl80211: Mode change succeeded while "
5225                            "interface is down");
5226                 drv->nlmode = nlmode;
5227                 drv->ignore_if_down_event = 1;
5228         }
5229
5230         /* Bring the interface back up */
5231         res = linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 1);
5232         if (res != 0) {
5233                 wpa_printf(MSG_DEBUG,
5234                            "nl80211: Failed to set interface up after switching mode");
5235                 ret = -1;
5236         }
5237
5238 done:
5239         if (ret) {
5240                 wpa_printf(MSG_DEBUG, "nl80211: Interface mode change to %d "
5241                            "from %d failed", nlmode, drv->nlmode);
5242                 return ret;
5243         }
5244
5245         if (is_p2p_net_interface(nlmode)) {
5246                 wpa_printf(MSG_DEBUG,
5247                            "nl80211: Interface %s mode change to P2P - disable 11b rates",
5248                            bss->ifname);
5249                 nl80211_disable_11b_rates(drv, drv->ifindex, 1);
5250         } else if (drv->disabled_11b_rates) {
5251                 wpa_printf(MSG_DEBUG,
5252                            "nl80211: Interface %s mode changed to non-P2P - re-enable 11b rates",
5253                            bss->ifname);
5254                 nl80211_disable_11b_rates(drv, drv->ifindex, 0);
5255         }
5256
5257         if (is_ap_interface(nlmode)) {
5258                 nl80211_mgmt_unsubscribe(bss, "start AP");
5259                 /* Setup additional AP mode functionality if needed */
5260                 if (nl80211_setup_ap(bss))
5261                         return -1;
5262         } else if (was_ap) {
5263                 /* Remove additional AP mode functionality */
5264                 nl80211_teardown_ap(bss);
5265         } else {
5266                 nl80211_mgmt_unsubscribe(bss, "mode change");
5267         }
5268
5269         if (is_mesh_interface(nlmode) &&
5270             nl80211_mgmt_subscribe_mesh(bss))
5271                 return -1;
5272
5273         if (!bss->in_deinit && !is_ap_interface(nlmode) &&
5274             !is_mesh_interface(nlmode) &&
5275             nl80211_mgmt_subscribe_non_ap(bss) < 0)
5276                 wpa_printf(MSG_DEBUG, "nl80211: Failed to register Action "
5277                            "frame processing - ignore for now");
5278
5279         return 0;
5280 }
5281
5282
5283 int wpa_driver_nl80211_set_mode(struct i802_bss *bss,
5284                                 enum nl80211_iftype nlmode)
5285 {
5286         return wpa_driver_nl80211_set_mode_impl(bss, nlmode, NULL);
5287 }
5288
5289
5290 static int wpa_driver_nl80211_set_mode_ibss(struct i802_bss *bss,
5291                                             struct hostapd_freq_params *freq)
5292 {
5293         return wpa_driver_nl80211_set_mode_impl(bss, NL80211_IFTYPE_ADHOC,
5294                                                 freq);
5295 }
5296
5297
5298 static int wpa_driver_nl80211_get_capa(void *priv,
5299                                        struct wpa_driver_capa *capa)
5300 {
5301         struct i802_bss *bss = priv;
5302         struct wpa_driver_nl80211_data *drv = bss->drv;
5303
5304         if (!drv->has_capability)
5305                 return -1;
5306         os_memcpy(capa, &drv->capa, sizeof(*capa));
5307         if (drv->extended_capa && drv->extended_capa_mask) {
5308                 capa->extended_capa = drv->extended_capa;
5309                 capa->extended_capa_mask = drv->extended_capa_mask;
5310                 capa->extended_capa_len = drv->extended_capa_len;
5311         }
5312
5313         return 0;
5314 }
5315
5316
5317 static int wpa_driver_nl80211_set_operstate(void *priv, int state)
5318 {
5319         struct i802_bss *bss = priv;
5320         struct wpa_driver_nl80211_data *drv = bss->drv;
5321
5322         wpa_printf(MSG_DEBUG, "nl80211: Set %s operstate %d->%d (%s)",
5323                    bss->ifname, drv->operstate, state,
5324                    state ? "UP" : "DORMANT");
5325         drv->operstate = state;
5326         return netlink_send_oper_ifla(drv->global->netlink, drv->ifindex, -1,
5327                                       state ? IF_OPER_UP : IF_OPER_DORMANT);
5328 }
5329
5330
5331 static int wpa_driver_nl80211_set_supp_port(void *priv, int authorized)
5332 {
5333         struct i802_bss *bss = priv;
5334         struct wpa_driver_nl80211_data *drv = bss->drv;
5335         struct nl_msg *msg;
5336         struct nl80211_sta_flag_update upd;
5337         int ret;
5338
5339         if (!drv->associated && is_zero_ether_addr(drv->bssid) && !authorized) {
5340                 wpa_printf(MSG_DEBUG, "nl80211: Skip set_supp_port(unauthorized) while not associated");
5341                 return 0;
5342         }
5343
5344         wpa_printf(MSG_DEBUG, "nl80211: Set supplicant port %sauthorized for "
5345                    MACSTR, authorized ? "" : "un", MAC2STR(drv->bssid));
5346
5347         os_memset(&upd, 0, sizeof(upd));
5348         upd.mask = BIT(NL80211_STA_FLAG_AUTHORIZED);
5349         if (authorized)
5350                 upd.set = BIT(NL80211_STA_FLAG_AUTHORIZED);
5351
5352         if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_SET_STATION)) ||
5353             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, drv->bssid) ||
5354             nla_put(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd)) {
5355                 nlmsg_free(msg);
5356                 return -ENOBUFS;
5357         }
5358
5359         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5360         if (!ret)
5361                 return 0;
5362         wpa_printf(MSG_DEBUG, "nl80211: Failed to set STA flag: %d (%s)",
5363                    ret, strerror(-ret));
5364         return ret;
5365 }
5366
5367
5368 /* Set kernel driver on given frequency (MHz) */
5369 static int i802_set_freq(void *priv, struct hostapd_freq_params *freq)
5370 {
5371         struct i802_bss *bss = priv;
5372         return nl80211_set_channel(bss, freq, 0);
5373 }
5374
5375
5376 static inline int min_int(int a, int b)
5377 {
5378         if (a < b)
5379                 return a;
5380         return b;
5381 }
5382
5383
5384 static int get_key_handler(struct nl_msg *msg, void *arg)
5385 {
5386         struct nlattr *tb[NL80211_ATTR_MAX + 1];
5387         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
5388
5389         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
5390                   genlmsg_attrlen(gnlh, 0), NULL);
5391
5392         /*
5393          * TODO: validate the key index and mac address!
5394          * Otherwise, there's a race condition as soon as
5395          * the kernel starts sending key notifications.
5396          */
5397
5398         if (tb[NL80211_ATTR_KEY_SEQ])
5399                 memcpy(arg, nla_data(tb[NL80211_ATTR_KEY_SEQ]),
5400                        min_int(nla_len(tb[NL80211_ATTR_KEY_SEQ]), 6));
5401         return NL_SKIP;
5402 }
5403
5404
5405 static int i802_get_seqnum(const char *iface, void *priv, const u8 *addr,
5406                            int idx, u8 *seq)
5407 {
5408         struct i802_bss *bss = priv;
5409         struct wpa_driver_nl80211_data *drv = bss->drv;
5410         struct nl_msg *msg;
5411
5412         msg = nl80211_ifindex_msg(drv, if_nametoindex(iface), 0,
5413                                   NL80211_CMD_GET_KEY);
5414         if (!msg ||
5415             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
5416             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, idx)) {
5417                 nlmsg_free(msg);
5418                 return -ENOBUFS;
5419         }
5420
5421         memset(seq, 0, 6);
5422
5423         return send_and_recv_msgs(drv, msg, get_key_handler, seq);
5424 }
5425
5426
5427 static int i802_set_rts(void *priv, int rts)
5428 {
5429         struct i802_bss *bss = priv;
5430         struct wpa_driver_nl80211_data *drv = bss->drv;
5431         struct nl_msg *msg;
5432         int ret;
5433         u32 val;
5434
5435         if (rts >= 2347)
5436                 val = (u32) -1;
5437         else
5438                 val = rts;
5439
5440         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_SET_WIPHY)) ||
5441             nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD, val)) {
5442                 nlmsg_free(msg);
5443                 return -ENOBUFS;
5444         }
5445
5446         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5447         if (!ret)
5448                 return 0;
5449         wpa_printf(MSG_DEBUG, "nl80211: Failed to set RTS threshold %d: "
5450                    "%d (%s)", rts, ret, strerror(-ret));
5451         return ret;
5452 }
5453
5454
5455 static int i802_set_frag(void *priv, int frag)
5456 {
5457         struct i802_bss *bss = priv;
5458         struct wpa_driver_nl80211_data *drv = bss->drv;
5459         struct nl_msg *msg;
5460         int ret;
5461         u32 val;
5462
5463         if (frag >= 2346)
5464                 val = (u32) -1;
5465         else
5466                 val = frag;
5467
5468         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_SET_WIPHY)) ||
5469             nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD, val)) {
5470                 nlmsg_free(msg);
5471                 return -ENOBUFS;
5472         }
5473
5474         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5475         if (!ret)
5476                 return 0;
5477         wpa_printf(MSG_DEBUG, "nl80211: Failed to set fragmentation threshold "
5478                    "%d: %d (%s)", frag, ret, strerror(-ret));
5479         return ret;
5480 }
5481
5482
5483 static int i802_flush(void *priv)
5484 {
5485         struct i802_bss *bss = priv;
5486         struct nl_msg *msg;
5487         int res;
5488
5489         wpa_printf(MSG_DEBUG, "nl80211: flush -> DEL_STATION %s (all)",
5490                    bss->ifname);
5491
5492         /*
5493          * XXX: FIX! this needs to flush all VLANs too
5494          */
5495         msg = nl80211_bss_msg(bss, 0, NL80211_CMD_DEL_STATION);
5496         res = send_and_recv_msgs(bss->drv, msg, NULL, NULL);
5497         if (res) {
5498                 wpa_printf(MSG_DEBUG, "nl80211: Station flush failed: ret=%d "
5499                            "(%s)", res, strerror(-res));
5500         }
5501         return res;
5502 }
5503
5504
5505 static int get_sta_handler(struct nl_msg *msg, void *arg)
5506 {
5507         struct nlattr *tb[NL80211_ATTR_MAX + 1];
5508         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
5509         struct hostap_sta_driver_data *data = arg;
5510         struct nlattr *stats[NL80211_STA_INFO_MAX + 1];
5511         static struct nla_policy stats_policy[NL80211_STA_INFO_MAX + 1] = {
5512                 [NL80211_STA_INFO_INACTIVE_TIME] = { .type = NLA_U32 },
5513                 [NL80211_STA_INFO_RX_BYTES] = { .type = NLA_U32 },
5514                 [NL80211_STA_INFO_TX_BYTES] = { .type = NLA_U32 },
5515                 [NL80211_STA_INFO_RX_PACKETS] = { .type = NLA_U32 },
5516                 [NL80211_STA_INFO_TX_PACKETS] = { .type = NLA_U32 },
5517                 [NL80211_STA_INFO_TX_FAILED] = { .type = NLA_U32 },
5518                 [NL80211_STA_INFO_RX_BYTES64] = { .type = NLA_U64 },
5519                 [NL80211_STA_INFO_TX_BYTES64] = { .type = NLA_U64 },
5520         };
5521
5522         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
5523                   genlmsg_attrlen(gnlh, 0), NULL);
5524
5525         /*
5526          * TODO: validate the interface and mac address!
5527          * Otherwise, there's a race condition as soon as
5528          * the kernel starts sending station notifications.
5529          */
5530
5531         if (!tb[NL80211_ATTR_STA_INFO]) {
5532                 wpa_printf(MSG_DEBUG, "sta stats missing!");
5533                 return NL_SKIP;
5534         }
5535         if (nla_parse_nested(stats, NL80211_STA_INFO_MAX,
5536                              tb[NL80211_ATTR_STA_INFO],
5537                              stats_policy)) {
5538                 wpa_printf(MSG_DEBUG, "failed to parse nested attributes!");
5539                 return NL_SKIP;
5540         }
5541
5542         if (stats[NL80211_STA_INFO_INACTIVE_TIME])
5543                 data->inactive_msec =
5544                         nla_get_u32(stats[NL80211_STA_INFO_INACTIVE_TIME]);
5545         /* For backwards compatibility, fetch the 32-bit counters first. */
5546         if (stats[NL80211_STA_INFO_RX_BYTES])
5547                 data->rx_bytes = nla_get_u32(stats[NL80211_STA_INFO_RX_BYTES]);
5548         if (stats[NL80211_STA_INFO_TX_BYTES])
5549                 data->tx_bytes = nla_get_u32(stats[NL80211_STA_INFO_TX_BYTES]);
5550         if (stats[NL80211_STA_INFO_RX_BYTES64] &&
5551             stats[NL80211_STA_INFO_TX_BYTES64]) {
5552                 /*
5553                  * The driver supports 64-bit counters, so use them to override
5554                  * the 32-bit values.
5555                  */
5556                 data->rx_bytes =
5557                         nla_get_u64(stats[NL80211_STA_INFO_RX_BYTES64]);
5558                 data->tx_bytes =
5559                         nla_get_u64(stats[NL80211_STA_INFO_TX_BYTES64]);
5560                 data->bytes_64bit = 1;
5561         }
5562         if (stats[NL80211_STA_INFO_RX_PACKETS])
5563                 data->rx_packets =
5564                         nla_get_u32(stats[NL80211_STA_INFO_RX_PACKETS]);
5565         if (stats[NL80211_STA_INFO_TX_PACKETS])
5566                 data->tx_packets =
5567                         nla_get_u32(stats[NL80211_STA_INFO_TX_PACKETS]);
5568         if (stats[NL80211_STA_INFO_TX_FAILED])
5569                 data->tx_retry_failed =
5570                         nla_get_u32(stats[NL80211_STA_INFO_TX_FAILED]);
5571
5572         return NL_SKIP;
5573 }
5574
5575 static int i802_read_sta_data(struct i802_bss *bss,
5576                               struct hostap_sta_driver_data *data,
5577                               const u8 *addr)
5578 {
5579         struct nl_msg *msg;
5580
5581         os_memset(data, 0, sizeof(*data));
5582
5583         if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_GET_STATION)) ||
5584             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) {
5585                 nlmsg_free(msg);
5586                 return -ENOBUFS;
5587         }
5588
5589         return send_and_recv_msgs(bss->drv, msg, get_sta_handler, data);
5590 }
5591
5592
5593 static int i802_set_tx_queue_params(void *priv, int queue, int aifs,
5594                                     int cw_min, int cw_max, int burst_time)
5595 {
5596         struct i802_bss *bss = priv;
5597         struct wpa_driver_nl80211_data *drv = bss->drv;
5598         struct nl_msg *msg;
5599         struct nlattr *txq, *params;
5600
5601         msg = nl80211_bss_msg(bss, 0, NL80211_CMD_SET_WIPHY);
5602         if (!msg)
5603                 return -1;
5604
5605         txq = nla_nest_start(msg, NL80211_ATTR_WIPHY_TXQ_PARAMS);
5606         if (!txq)
5607                 goto fail;
5608
5609         /* We are only sending parameters for a single TXQ at a time */
5610         params = nla_nest_start(msg, 1);
5611         if (!params)
5612                 goto fail;
5613
5614         switch (queue) {
5615         case 0:
5616                 if (nla_put_u8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_VO))
5617                         goto fail;
5618                 break;
5619         case 1:
5620                 if (nla_put_u8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_VI))
5621                         goto fail;
5622                 break;
5623         case 2:
5624                 if (nla_put_u8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_BE))
5625                         goto fail;
5626                 break;
5627         case 3:
5628                 if (nla_put_u8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_BK))
5629                         goto fail;
5630                 break;
5631         }
5632         /* Burst time is configured in units of 0.1 msec and TXOP parameter in
5633          * 32 usec, so need to convert the value here. */
5634         if (nla_put_u16(msg, NL80211_TXQ_ATTR_TXOP,
5635                         (burst_time * 100 + 16) / 32) ||
5636             nla_put_u16(msg, NL80211_TXQ_ATTR_CWMIN, cw_min) ||
5637             nla_put_u16(msg, NL80211_TXQ_ATTR_CWMAX, cw_max) ||
5638             nla_put_u8(msg, NL80211_TXQ_ATTR_AIFS, aifs))
5639                 goto fail;
5640
5641         nla_nest_end(msg, params);
5642
5643         nla_nest_end(msg, txq);
5644
5645         if (send_and_recv_msgs(drv, msg, NULL, NULL) == 0)
5646                 return 0;
5647         msg = NULL;
5648 fail:
5649         nlmsg_free(msg);
5650         return -1;
5651 }
5652
5653
5654 static int i802_set_sta_vlan(struct i802_bss *bss, const u8 *addr,
5655                              const char *ifname, int vlan_id)
5656 {
5657         struct wpa_driver_nl80211_data *drv = bss->drv;
5658         struct nl_msg *msg;
5659         int ret;
5660
5661         wpa_printf(MSG_DEBUG, "nl80211: %s[%d]: set_sta_vlan(" MACSTR
5662                    ", ifname=%s[%d], vlan_id=%d)",
5663                    bss->ifname, if_nametoindex(bss->ifname),
5664                    MAC2STR(addr), ifname, if_nametoindex(ifname), vlan_id);
5665         if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_SET_STATION)) ||
5666             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
5667             nla_put_u32(msg, NL80211_ATTR_STA_VLAN, if_nametoindex(ifname))) {
5668                 nlmsg_free(msg);
5669                 return -ENOBUFS;
5670         }
5671
5672         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5673         if (ret < 0) {
5674                 wpa_printf(MSG_ERROR, "nl80211: NL80211_ATTR_STA_VLAN (addr="
5675                            MACSTR " ifname=%s vlan_id=%d) failed: %d (%s)",
5676                            MAC2STR(addr), ifname, vlan_id, ret,
5677                            strerror(-ret));
5678         }
5679         return ret;
5680 }
5681
5682
5683 static int i802_get_inact_sec(void *priv, const u8 *addr)
5684 {
5685         struct hostap_sta_driver_data data;
5686         int ret;
5687
5688         data.inactive_msec = (unsigned long) -1;
5689         ret = i802_read_sta_data(priv, &data, addr);
5690         if (ret == -ENOENT)
5691                 return -ENOENT;
5692         if (ret || data.inactive_msec == (unsigned long) -1)
5693                 return -1;
5694         return data.inactive_msec / 1000;
5695 }
5696
5697
5698 static int i802_sta_clear_stats(void *priv, const u8 *addr)
5699 {
5700 #if 0
5701         /* TODO */
5702 #endif
5703         return 0;
5704 }
5705
5706
5707 static int i802_sta_deauth(void *priv, const u8 *own_addr, const u8 *addr,
5708                            int reason)
5709 {
5710         struct i802_bss *bss = priv;
5711         struct wpa_driver_nl80211_data *drv = bss->drv;
5712         struct ieee80211_mgmt mgmt;
5713
5714         if (is_mesh_interface(drv->nlmode))
5715                 return -1;
5716
5717         if (drv->device_ap_sme)
5718                 return wpa_driver_nl80211_sta_remove(bss, addr, 1, reason);
5719
5720         memset(&mgmt, 0, sizeof(mgmt));
5721         mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
5722                                           WLAN_FC_STYPE_DEAUTH);
5723         memcpy(mgmt.da, addr, ETH_ALEN);
5724         memcpy(mgmt.sa, own_addr, ETH_ALEN);
5725         memcpy(mgmt.bssid, own_addr, ETH_ALEN);
5726         mgmt.u.deauth.reason_code = host_to_le16(reason);
5727         return wpa_driver_nl80211_send_mlme(bss, (u8 *) &mgmt,
5728                                             IEEE80211_HDRLEN +
5729                                             sizeof(mgmt.u.deauth), 0, 0, 0, 0,
5730                                             0, NULL, 0);
5731 }
5732
5733
5734 static int i802_sta_disassoc(void *priv, const u8 *own_addr, const u8 *addr,
5735                              int reason)
5736 {
5737         struct i802_bss *bss = priv;
5738         struct wpa_driver_nl80211_data *drv = bss->drv;
5739         struct ieee80211_mgmt mgmt;
5740
5741         if (is_mesh_interface(drv->nlmode))
5742                 return -1;
5743
5744         if (drv->device_ap_sme)
5745                 return wpa_driver_nl80211_sta_remove(bss, addr, 0, reason);
5746
5747         memset(&mgmt, 0, sizeof(mgmt));
5748         mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
5749                                           WLAN_FC_STYPE_DISASSOC);
5750         memcpy(mgmt.da, addr, ETH_ALEN);
5751         memcpy(mgmt.sa, own_addr, ETH_ALEN);
5752         memcpy(mgmt.bssid, own_addr, ETH_ALEN);
5753         mgmt.u.disassoc.reason_code = host_to_le16(reason);
5754         return wpa_driver_nl80211_send_mlme(bss, (u8 *) &mgmt,
5755                                             IEEE80211_HDRLEN +
5756                                             sizeof(mgmt.u.disassoc), 0, 0, 0, 0,
5757                                             0, NULL, 0);
5758 }
5759
5760
5761 static void dump_ifidx(struct wpa_driver_nl80211_data *drv)
5762 {
5763         char buf[200], *pos, *end;
5764         int i, res;
5765
5766         pos = buf;
5767         end = pos + sizeof(buf);
5768
5769         for (i = 0; i < drv->num_if_indices; i++) {
5770                 if (!drv->if_indices[i])
5771                         continue;
5772                 res = os_snprintf(pos, end - pos, " %d(%d)",
5773                                   drv->if_indices[i],
5774                                   drv->if_indices_reason[i]);
5775                 if (os_snprintf_error(end - pos, res))
5776                         break;
5777                 pos += res;
5778         }
5779         *pos = '\0';
5780
5781         wpa_printf(MSG_DEBUG, "nl80211: if_indices[%d]:%s",
5782                    drv->num_if_indices, buf);
5783 }
5784
5785
5786 static void add_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx,
5787                       int ifidx_reason)
5788 {
5789         int i;
5790         int *old, *old_reason;
5791
5792         wpa_printf(MSG_DEBUG,
5793                    "nl80211: Add own interface ifindex %d (ifidx_reason %d)",
5794                    ifidx, ifidx_reason);
5795         if (have_ifidx(drv, ifidx, ifidx_reason)) {
5796                 wpa_printf(MSG_DEBUG, "nl80211: ifindex %d already in the list",
5797                            ifidx);
5798                 return;
5799         }
5800         for (i = 0; i < drv->num_if_indices; i++) {
5801                 if (drv->if_indices[i] == 0) {
5802                         drv->if_indices[i] = ifidx;
5803                         drv->if_indices_reason[i] = ifidx_reason;
5804                         dump_ifidx(drv);
5805                         return;
5806                 }
5807         }
5808
5809         if (drv->if_indices != drv->default_if_indices)
5810                 old = drv->if_indices;
5811         else
5812                 old = NULL;
5813
5814         if (drv->if_indices_reason != drv->default_if_indices_reason)
5815                 old_reason = drv->if_indices_reason;
5816         else
5817                 old_reason = NULL;
5818
5819         drv->if_indices = os_realloc_array(old, drv->num_if_indices + 1,
5820                                            sizeof(int));
5821         drv->if_indices_reason = os_realloc_array(old_reason,
5822                                                   drv->num_if_indices + 1,
5823                                                   sizeof(int));
5824         if (!drv->if_indices) {
5825                 if (!old)
5826                         drv->if_indices = drv->default_if_indices;
5827                 else
5828                         drv->if_indices = old;
5829         }
5830         if (!drv->if_indices_reason) {
5831                 if (!old_reason)
5832                         drv->if_indices_reason = drv->default_if_indices_reason;
5833                 else
5834                         drv->if_indices_reason = old_reason;
5835         }
5836         if (!drv->if_indices || !drv->if_indices_reason) {
5837                 wpa_printf(MSG_ERROR, "Failed to reallocate memory for "
5838                            "interfaces");
5839                 wpa_printf(MSG_ERROR, "Ignoring EAPOL on interface %d", ifidx);
5840                 return;
5841         }
5842         if (!old)
5843                 os_memcpy(drv->if_indices, drv->default_if_indices,
5844                           sizeof(drv->default_if_indices));
5845         if (!old_reason)
5846                 os_memcpy(drv->if_indices_reason,
5847                           drv->default_if_indices_reason,
5848                           sizeof(drv->default_if_indices_reason));
5849         drv->if_indices[drv->num_if_indices] = ifidx;
5850         drv->if_indices_reason[drv->num_if_indices] = ifidx_reason;
5851         drv->num_if_indices++;
5852         dump_ifidx(drv);
5853 }
5854
5855
5856 static void del_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx,
5857                       int ifidx_reason)
5858 {
5859         int i;
5860
5861         for (i = 0; i < drv->num_if_indices; i++) {
5862                 if ((drv->if_indices[i] == ifidx || ifidx == IFIDX_ANY) &&
5863                     (drv->if_indices_reason[i] == ifidx_reason ||
5864                      ifidx_reason == IFIDX_ANY)) {
5865                         drv->if_indices[i] = 0;
5866                         break;
5867                 }
5868         }
5869         dump_ifidx(drv);
5870 }
5871
5872
5873 static int have_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx,
5874                       int ifidx_reason)
5875 {
5876         int i;
5877
5878         for (i = 0; i < drv->num_if_indices; i++)
5879                 if (drv->if_indices[i] == ifidx &&
5880                     (drv->if_indices_reason[i] == ifidx_reason ||
5881                      ifidx_reason == IFIDX_ANY))
5882                         return 1;
5883
5884         return 0;
5885 }
5886
5887
5888 static int i802_set_wds_sta(void *priv, const u8 *addr, int aid, int val,
5889                             const char *bridge_ifname, char *ifname_wds)
5890 {
5891         struct i802_bss *bss = priv;
5892         struct wpa_driver_nl80211_data *drv = bss->drv;
5893         char name[IFNAMSIZ + 1];
5894
5895         os_snprintf(name, sizeof(name), "%s.sta%d", bss->ifname, aid);
5896         if (ifname_wds)
5897                 os_strlcpy(ifname_wds, name, IFNAMSIZ + 1);
5898
5899         wpa_printf(MSG_DEBUG, "nl80211: Set WDS STA addr=" MACSTR
5900                    " aid=%d val=%d name=%s", MAC2STR(addr), aid, val, name);
5901         if (val) {
5902                 if (!if_nametoindex(name)) {
5903                         if (nl80211_create_iface(drv, name,
5904                                                  NL80211_IFTYPE_AP_VLAN,
5905                                                  bss->addr, 1, NULL, NULL, 0) <
5906                             0)
5907                                 return -1;
5908                         if (bridge_ifname &&
5909                             linux_br_add_if(drv->global->ioctl_sock,
5910                                             bridge_ifname, name) < 0)
5911                                 return -1;
5912                 }
5913                 if (linux_set_iface_flags(drv->global->ioctl_sock, name, 1)) {
5914                         wpa_printf(MSG_ERROR, "nl80211: Failed to set WDS STA "
5915                                    "interface %s up", name);
5916                 }
5917                 return i802_set_sta_vlan(priv, addr, name, 0);
5918         } else {
5919                 if (bridge_ifname)
5920                         linux_br_del_if(drv->global->ioctl_sock, bridge_ifname,
5921                                         name);
5922
5923                 i802_set_sta_vlan(priv, addr, bss->ifname, 0);
5924                 nl80211_remove_iface(drv, if_nametoindex(name));
5925                 return 0;
5926         }
5927 }
5928
5929
5930 static void handle_eapol(int sock, void *eloop_ctx, void *sock_ctx)
5931 {
5932         struct wpa_driver_nl80211_data *drv = eloop_ctx;
5933         struct sockaddr_ll lladdr;
5934         unsigned char buf[3000];
5935         int len;
5936         socklen_t fromlen = sizeof(lladdr);
5937
5938         len = recvfrom(sock, buf, sizeof(buf), 0,
5939                        (struct sockaddr *)&lladdr, &fromlen);
5940         if (len < 0) {
5941                 wpa_printf(MSG_ERROR, "nl80211: EAPOL recv failed: %s",
5942                            strerror(errno));
5943                 return;
5944         }
5945
5946         if (have_ifidx(drv, lladdr.sll_ifindex, IFIDX_ANY))
5947                 drv_event_eapol_rx(drv->ctx, lladdr.sll_addr, buf, len);
5948 }
5949
5950
5951 static int i802_check_bridge(struct wpa_driver_nl80211_data *drv,
5952                              struct i802_bss *bss,
5953                              const char *brname, const char *ifname)
5954 {
5955         int br_ifindex;
5956         char in_br[IFNAMSIZ];
5957
5958         os_strlcpy(bss->brname, brname, IFNAMSIZ);
5959         br_ifindex = if_nametoindex(brname);
5960         if (br_ifindex == 0) {
5961                 /*
5962                  * Bridge was configured, but the bridge device does
5963                  * not exist. Try to add it now.
5964                  */
5965                 if (linux_br_add(drv->global->ioctl_sock, brname) < 0) {
5966                         wpa_printf(MSG_ERROR, "nl80211: Failed to add the "
5967                                    "bridge interface %s: %s",
5968                                    brname, strerror(errno));
5969                         return -1;
5970                 }
5971                 bss->added_bridge = 1;
5972                 br_ifindex = if_nametoindex(brname);
5973                 add_ifidx(drv, br_ifindex, drv->ifindex);
5974         }
5975         bss->br_ifindex = br_ifindex;
5976
5977         if (linux_br_get(in_br, ifname) == 0) {
5978                 if (os_strcmp(in_br, brname) == 0)
5979                         return 0; /* already in the bridge */
5980
5981                 wpa_printf(MSG_DEBUG, "nl80211: Removing interface %s from "
5982                            "bridge %s", ifname, in_br);
5983                 if (linux_br_del_if(drv->global->ioctl_sock, in_br, ifname) <
5984                     0) {
5985                         wpa_printf(MSG_ERROR, "nl80211: Failed to "
5986                                    "remove interface %s from bridge "
5987                                    "%s: %s",
5988                                    ifname, brname, strerror(errno));
5989                         return -1;
5990                 }
5991         }
5992
5993         wpa_printf(MSG_DEBUG, "nl80211: Adding interface %s into bridge %s",
5994                    ifname, brname);
5995         if (linux_br_add_if(drv->global->ioctl_sock, brname, ifname) < 0) {
5996                 wpa_printf(MSG_ERROR, "nl80211: Failed to add interface %s "
5997                            "into bridge %s: %s",
5998                            ifname, brname, strerror(errno));
5999                 return -1;
6000         }
6001         bss->added_if_into_bridge = 1;
6002
6003         return 0;
6004 }
6005
6006
6007 static void *i802_init(struct hostapd_data *hapd,
6008                        struct wpa_init_params *params)
6009 {
6010         struct wpa_driver_nl80211_data *drv;
6011         struct i802_bss *bss;
6012         size_t i;
6013         char master_ifname[IFNAMSIZ];
6014         int ifindex, br_ifindex = 0;
6015         int br_added = 0;
6016
6017         bss = wpa_driver_nl80211_drv_init(hapd, params->ifname,
6018                                           params->global_priv, 1,
6019                                           params->bssid, params->driver_params);
6020         if (bss == NULL)
6021                 return NULL;
6022
6023         drv = bss->drv;
6024
6025         if (linux_br_get(master_ifname, params->ifname) == 0) {
6026                 wpa_printf(MSG_DEBUG, "nl80211: Interface %s is in bridge %s",
6027                            params->ifname, master_ifname);
6028                 br_ifindex = if_nametoindex(master_ifname);
6029                 os_strlcpy(bss->brname, master_ifname, IFNAMSIZ);
6030         } else if ((params->num_bridge == 0 || !params->bridge[0]) &&
6031                    linux_master_get(master_ifname, params->ifname) == 0) {
6032                 wpa_printf(MSG_DEBUG, "nl80211: Interface %s is in master %s",
6033                         params->ifname, master_ifname);
6034                 /* start listening for EAPOL on the master interface */
6035                 add_ifidx(drv, if_nametoindex(master_ifname), drv->ifindex);
6036
6037                 /* check if master itself is under bridge */
6038                 if (linux_br_get(master_ifname, master_ifname) == 0) {
6039                         wpa_printf(MSG_DEBUG, "nl80211: which is in bridge %s",
6040                                    master_ifname);
6041                         br_ifindex = if_nametoindex(master_ifname);
6042                         os_strlcpy(bss->brname, master_ifname, IFNAMSIZ);
6043                 }
6044         } else {
6045                 master_ifname[0] = '\0';
6046         }
6047
6048         bss->br_ifindex = br_ifindex;
6049
6050         for (i = 0; i < params->num_bridge; i++) {
6051                 if (params->bridge[i]) {
6052                         ifindex = if_nametoindex(params->bridge[i]);
6053                         if (ifindex)
6054                                 add_ifidx(drv, ifindex, drv->ifindex);
6055                         if (ifindex == br_ifindex)
6056                                 br_added = 1;
6057                 }
6058         }
6059
6060         /* start listening for EAPOL on the default AP interface */
6061         add_ifidx(drv, drv->ifindex, IFIDX_ANY);
6062
6063         if (params->num_bridge && params->bridge[0]) {
6064                 if (i802_check_bridge(drv, bss, params->bridge[0],
6065                                       params->ifname) < 0)
6066                         goto failed;
6067                 if (os_strcmp(params->bridge[0], master_ifname) != 0)
6068                         br_added = 1;
6069         }
6070
6071         if (!br_added && br_ifindex &&
6072             (params->num_bridge == 0 || !params->bridge[0]))
6073                 add_ifidx(drv, br_ifindex, drv->ifindex);
6074
6075 #ifdef CONFIG_LIBNL3_ROUTE
6076         if (bss->added_if_into_bridge) {
6077                 drv->rtnl_sk = nl_socket_alloc();
6078                 if (drv->rtnl_sk == NULL) {
6079                         wpa_printf(MSG_ERROR, "nl80211: Failed to allocate nl_sock");
6080                         goto failed;
6081                 }
6082
6083                 if (nl_connect(drv->rtnl_sk, NETLINK_ROUTE)) {
6084                         wpa_printf(MSG_ERROR, "nl80211: Failed to connect nl_sock to NETLINK_ROUTE: %s",
6085                                    strerror(errno));
6086                         goto failed;
6087                 }
6088         }
6089 #endif /* CONFIG_LIBNL3_ROUTE */
6090
6091         drv->eapol_sock = socket(PF_PACKET, SOCK_DGRAM, htons(ETH_P_PAE));
6092         if (drv->eapol_sock < 0) {
6093                 wpa_printf(MSG_ERROR, "nl80211: socket(PF_PACKET, SOCK_DGRAM, ETH_P_PAE) failed: %s",
6094                            strerror(errno));
6095                 goto failed;
6096         }
6097
6098         if (eloop_register_read_sock(drv->eapol_sock, handle_eapol, drv, NULL))
6099         {
6100                 wpa_printf(MSG_INFO, "nl80211: Could not register read socket for eapol");
6101                 goto failed;
6102         }
6103
6104         if (linux_get_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
6105                                params->own_addr))
6106                 goto failed;
6107         os_memcpy(drv->perm_addr, params->own_addr, ETH_ALEN);
6108
6109         memcpy(bss->addr, params->own_addr, ETH_ALEN);
6110
6111         return bss;
6112
6113 failed:
6114         wpa_driver_nl80211_deinit(bss);
6115         return NULL;
6116 }
6117
6118
6119 static void i802_deinit(void *priv)
6120 {
6121         struct i802_bss *bss = priv;
6122         wpa_driver_nl80211_deinit(bss);
6123 }
6124
6125
6126 static enum nl80211_iftype wpa_driver_nl80211_if_type(
6127         enum wpa_driver_if_type type)
6128 {
6129         switch (type) {
6130         case WPA_IF_STATION:
6131                 return NL80211_IFTYPE_STATION;
6132         case WPA_IF_P2P_CLIENT:
6133         case WPA_IF_P2P_GROUP:
6134                 return NL80211_IFTYPE_P2P_CLIENT;
6135         case WPA_IF_AP_VLAN:
6136                 return NL80211_IFTYPE_AP_VLAN;
6137         case WPA_IF_AP_BSS:
6138                 return NL80211_IFTYPE_AP;
6139         case WPA_IF_P2P_GO:
6140                 return NL80211_IFTYPE_P2P_GO;
6141         case WPA_IF_P2P_DEVICE:
6142                 return NL80211_IFTYPE_P2P_DEVICE;
6143         case WPA_IF_MESH:
6144                 return NL80211_IFTYPE_MESH_POINT;
6145         default:
6146                 return -1;
6147         }
6148 }
6149
6150
6151 static int nl80211_addr_in_use(struct nl80211_global *global, const u8 *addr)
6152 {
6153         struct wpa_driver_nl80211_data *drv;
6154         dl_list_for_each(drv, &global->interfaces,
6155                          struct wpa_driver_nl80211_data, list) {
6156                 if (os_memcmp(addr, drv->first_bss->addr, ETH_ALEN) == 0)
6157                         return 1;
6158         }
6159         return 0;
6160 }
6161
6162
6163 static int nl80211_vif_addr(struct wpa_driver_nl80211_data *drv, u8 *new_addr)
6164 {
6165         unsigned int idx;
6166
6167         if (!drv->global)
6168                 return -1;
6169
6170         os_memcpy(new_addr, drv->first_bss->addr, ETH_ALEN);
6171         for (idx = 0; idx < 64; idx++) {
6172                 new_addr[0] = drv->first_bss->addr[0] | 0x02;
6173                 new_addr[0] ^= idx << 2;
6174                 if (!nl80211_addr_in_use(drv->global, new_addr))
6175                         break;
6176         }
6177         if (idx == 64)
6178                 return -1;
6179
6180         wpa_printf(MSG_DEBUG, "nl80211: Assigned new virtual interface address "
6181                    MACSTR, MAC2STR(new_addr));
6182
6183         return 0;
6184 }
6185
6186
6187 struct wdev_info {
6188         u64 wdev_id;
6189         int wdev_id_set;
6190         u8 macaddr[ETH_ALEN];
6191 };
6192
6193 static int nl80211_wdev_handler(struct nl_msg *msg, void *arg)
6194 {
6195         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
6196         struct nlattr *tb[NL80211_ATTR_MAX + 1];
6197         struct wdev_info *wi = arg;
6198
6199         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
6200                   genlmsg_attrlen(gnlh, 0), NULL);
6201         if (tb[NL80211_ATTR_WDEV]) {
6202                 wi->wdev_id = nla_get_u64(tb[NL80211_ATTR_WDEV]);
6203                 wi->wdev_id_set = 1;
6204         }
6205
6206         if (tb[NL80211_ATTR_MAC])
6207                 os_memcpy(wi->macaddr, nla_data(tb[NL80211_ATTR_MAC]),
6208                           ETH_ALEN);
6209
6210         return NL_SKIP;
6211 }
6212
6213
6214 static int wpa_driver_nl80211_if_add(void *priv, enum wpa_driver_if_type type,
6215                                      const char *ifname, const u8 *addr,
6216                                      void *bss_ctx, void **drv_priv,
6217                                      char *force_ifname, u8 *if_addr,
6218                                      const char *bridge, int use_existing,
6219                                      int setup_ap)
6220 {
6221         enum nl80211_iftype nlmode;
6222         struct i802_bss *bss = priv;
6223         struct wpa_driver_nl80211_data *drv = bss->drv;
6224         int ifidx;
6225         int added = 1;
6226
6227         if (addr)
6228                 os_memcpy(if_addr, addr, ETH_ALEN);
6229         nlmode = wpa_driver_nl80211_if_type(type);
6230         if (nlmode == NL80211_IFTYPE_P2P_DEVICE) {
6231                 struct wdev_info p2pdev_info;
6232
6233                 os_memset(&p2pdev_info, 0, sizeof(p2pdev_info));
6234                 ifidx = nl80211_create_iface(drv, ifname, nlmode, addr,
6235                                              0, nl80211_wdev_handler,
6236                                              &p2pdev_info, use_existing);
6237                 if (!p2pdev_info.wdev_id_set || ifidx != 0) {
6238                         wpa_printf(MSG_ERROR, "nl80211: Failed to create a P2P Device interface %s",
6239                                    ifname);
6240                         return -1;
6241                 }
6242
6243                 drv->global->if_add_wdevid = p2pdev_info.wdev_id;
6244                 drv->global->if_add_wdevid_set = p2pdev_info.wdev_id_set;
6245                 if (!is_zero_ether_addr(p2pdev_info.macaddr))
6246                         os_memcpy(if_addr, p2pdev_info.macaddr, ETH_ALEN);
6247                 wpa_printf(MSG_DEBUG, "nl80211: New P2P Device interface %s (0x%llx) created",
6248                            ifname,
6249                            (long long unsigned int) p2pdev_info.wdev_id);
6250         } else {
6251                 ifidx = nl80211_create_iface(drv, ifname, nlmode, addr,
6252                                              0, NULL, NULL, use_existing);
6253                 if (use_existing && ifidx == -ENFILE) {
6254                         added = 0;
6255                         ifidx = if_nametoindex(ifname);
6256                 } else if (ifidx < 0) {
6257                         return -1;
6258                 }
6259         }
6260
6261         if (!addr) {
6262                 if (nlmode == NL80211_IFTYPE_P2P_DEVICE)
6263                         os_memcpy(if_addr, bss->addr, ETH_ALEN);
6264                 else if (linux_get_ifhwaddr(drv->global->ioctl_sock,
6265                                             ifname, if_addr) < 0) {
6266                         if (added)
6267                                 nl80211_remove_iface(drv, ifidx);
6268                         return -1;
6269                 }
6270         }
6271
6272         if (!addr &&
6273             (type == WPA_IF_P2P_CLIENT || type == WPA_IF_P2P_GROUP ||
6274              type == WPA_IF_P2P_GO || type == WPA_IF_MESH ||
6275              type == WPA_IF_STATION)) {
6276                 /* Enforce unique address */
6277                 u8 new_addr[ETH_ALEN];
6278
6279                 if (linux_get_ifhwaddr(drv->global->ioctl_sock, ifname,
6280                                        new_addr) < 0) {
6281                         if (added)
6282                                 nl80211_remove_iface(drv, ifidx);
6283                         return -1;
6284                 }
6285                 if (nl80211_addr_in_use(drv->global, new_addr)) {
6286                         wpa_printf(MSG_DEBUG, "nl80211: Allocate new address "
6287                                    "for interface %s type %d", ifname, type);
6288                         if (nl80211_vif_addr(drv, new_addr) < 0) {
6289                                 if (added)
6290                                         nl80211_remove_iface(drv, ifidx);
6291                                 return -1;
6292                         }
6293                         if (linux_set_ifhwaddr(drv->global->ioctl_sock, ifname,
6294                                                new_addr) < 0) {
6295                                 if (added)
6296                                         nl80211_remove_iface(drv, ifidx);
6297                                 return -1;
6298                         }
6299                 }
6300                 os_memcpy(if_addr, new_addr, ETH_ALEN);
6301         }
6302
6303         if (type == WPA_IF_AP_BSS && setup_ap) {
6304                 struct i802_bss *new_bss = os_zalloc(sizeof(*new_bss));
6305                 if (new_bss == NULL) {
6306                         if (added)
6307                                 nl80211_remove_iface(drv, ifidx);
6308                         return -1;
6309                 }
6310
6311                 if (bridge &&
6312                     i802_check_bridge(drv, new_bss, bridge, ifname) < 0) {
6313                         wpa_printf(MSG_ERROR, "nl80211: Failed to add the new "
6314                                    "interface %s to a bridge %s",
6315                                    ifname, bridge);
6316                         if (added)
6317                                 nl80211_remove_iface(drv, ifidx);
6318                         os_free(new_bss);
6319                         return -1;
6320                 }
6321
6322                 if (linux_set_iface_flags(drv->global->ioctl_sock, ifname, 1))
6323                 {
6324                         if (added)
6325                                 nl80211_remove_iface(drv, ifidx);
6326                         os_free(new_bss);
6327                         return -1;
6328                 }
6329                 os_strlcpy(new_bss->ifname, ifname, IFNAMSIZ);
6330                 os_memcpy(new_bss->addr, if_addr, ETH_ALEN);
6331                 new_bss->ifindex = ifidx;
6332                 new_bss->drv = drv;
6333                 new_bss->next = drv->first_bss->next;
6334                 new_bss->freq = drv->first_bss->freq;
6335                 new_bss->ctx = bss_ctx;
6336                 new_bss->added_if = added;
6337                 drv->first_bss->next = new_bss;
6338                 if (drv_priv)
6339                         *drv_priv = new_bss;
6340                 nl80211_init_bss(new_bss);
6341
6342                 /* Subscribe management frames for this WPA_IF_AP_BSS */
6343                 if (nl80211_setup_ap(new_bss))
6344                         return -1;
6345         }
6346
6347         if (drv->global)
6348                 drv->global->if_add_ifindex = ifidx;
6349
6350         /*
6351          * Some virtual interfaces need to process EAPOL packets and events on
6352          * the parent interface. This is used mainly with hostapd.
6353          */
6354         if (ifidx > 0 &&
6355             (drv->hostapd ||
6356              nlmode == NL80211_IFTYPE_AP_VLAN ||
6357              nlmode == NL80211_IFTYPE_WDS ||
6358              nlmode == NL80211_IFTYPE_MONITOR))
6359                 add_ifidx(drv, ifidx, IFIDX_ANY);
6360
6361         return 0;
6362 }
6363
6364
6365 static int wpa_driver_nl80211_if_remove(struct i802_bss *bss,
6366                                         enum wpa_driver_if_type type,
6367                                         const char *ifname)
6368 {
6369         struct wpa_driver_nl80211_data *drv = bss->drv;
6370         int ifindex = if_nametoindex(ifname);
6371
6372         wpa_printf(MSG_DEBUG, "nl80211: %s(type=%d ifname=%s) ifindex=%d added_if=%d",
6373                    __func__, type, ifname, ifindex, bss->added_if);
6374         if (ifindex > 0 && (bss->added_if || bss->ifindex != ifindex))
6375                 nl80211_remove_iface(drv, ifindex);
6376         else if (ifindex > 0 && !bss->added_if) {
6377                 struct wpa_driver_nl80211_data *drv2;
6378                 dl_list_for_each(drv2, &drv->global->interfaces,
6379                                  struct wpa_driver_nl80211_data, list) {
6380                         del_ifidx(drv2, ifindex, IFIDX_ANY);
6381                         del_ifidx(drv2, IFIDX_ANY, ifindex);
6382                 }
6383         }
6384
6385         if (type != WPA_IF_AP_BSS)
6386                 return 0;
6387
6388         if (bss->added_if_into_bridge) {
6389                 if (linux_br_del_if(drv->global->ioctl_sock, bss->brname,
6390                                     bss->ifname) < 0)
6391                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
6392                                    "interface %s from bridge %s: %s",
6393                                    bss->ifname, bss->brname, strerror(errno));
6394         }
6395         if (bss->added_bridge) {
6396                 if (linux_br_del(drv->global->ioctl_sock, bss->brname) < 0)
6397                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
6398                                    "bridge %s: %s",
6399                                    bss->brname, strerror(errno));
6400         }
6401
6402         if (bss != drv->first_bss) {
6403                 struct i802_bss *tbss;
6404
6405                 wpa_printf(MSG_DEBUG, "nl80211: Not the first BSS - remove it");
6406                 for (tbss = drv->first_bss; tbss; tbss = tbss->next) {
6407                         if (tbss->next == bss) {
6408                                 tbss->next = bss->next;
6409                                 /* Unsubscribe management frames */
6410                                 nl80211_teardown_ap(bss);
6411                                 nl80211_destroy_bss(bss);
6412                                 if (!bss->added_if)
6413                                         i802_set_iface_flags(bss, 0);
6414                                 os_free(bss);
6415                                 bss = NULL;
6416                                 break;
6417                         }
6418                 }
6419                 if (bss)
6420                         wpa_printf(MSG_INFO, "nl80211: %s - could not find "
6421                                    "BSS %p in the list", __func__, bss);
6422         } else {
6423                 wpa_printf(MSG_DEBUG, "nl80211: First BSS - reassign context");
6424                 nl80211_teardown_ap(bss);
6425                 if (!bss->added_if && !drv->first_bss->next)
6426                         wpa_driver_nl80211_del_beacon(drv);
6427                 nl80211_destroy_bss(bss);
6428                 if (!bss->added_if)
6429                         i802_set_iface_flags(bss, 0);
6430                 if (drv->first_bss->next) {
6431                         drv->first_bss = drv->first_bss->next;
6432                         drv->ctx = drv->first_bss->ctx;
6433                         os_free(bss);
6434                 } else {
6435                         wpa_printf(MSG_DEBUG, "nl80211: No second BSS to reassign context to");
6436                 }
6437         }
6438
6439         return 0;
6440 }
6441
6442
6443 static int cookie_handler(struct nl_msg *msg, void *arg)
6444 {
6445         struct nlattr *tb[NL80211_ATTR_MAX + 1];
6446         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
6447         u64 *cookie = arg;
6448         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
6449                   genlmsg_attrlen(gnlh, 0), NULL);
6450         if (tb[NL80211_ATTR_COOKIE])
6451                 *cookie = nla_get_u64(tb[NL80211_ATTR_COOKIE]);
6452         return NL_SKIP;
6453 }
6454
6455
6456 static int nl80211_send_frame_cmd(struct i802_bss *bss,
6457                                   unsigned int freq, unsigned int wait,
6458                                   const u8 *buf, size_t buf_len,
6459                                   u64 *cookie_out, int no_cck, int no_ack,
6460                                   int offchanok, const u16 *csa_offs,
6461                                   size_t csa_offs_len)
6462 {
6463         struct wpa_driver_nl80211_data *drv = bss->drv;
6464         struct nl_msg *msg;
6465         u64 cookie;
6466         int ret = -1;
6467
6468         wpa_printf(MSG_MSGDUMP, "nl80211: CMD_FRAME freq=%u wait=%u no_cck=%d "
6469                    "no_ack=%d offchanok=%d",
6470                    freq, wait, no_cck, no_ack, offchanok);
6471         wpa_hexdump(MSG_MSGDUMP, "CMD_FRAME", buf, buf_len);
6472
6473         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_FRAME)) ||
6474             (freq && nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
6475             (wait && nla_put_u32(msg, NL80211_ATTR_DURATION, wait)) ||
6476             (offchanok && ((drv->capa.flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX) ||
6477                            drv->test_use_roc_tx) &&
6478              nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK)) ||
6479             (no_cck && nla_put_flag(msg, NL80211_ATTR_TX_NO_CCK_RATE)) ||
6480             (no_ack && nla_put_flag(msg, NL80211_ATTR_DONT_WAIT_FOR_ACK)) ||
6481             (csa_offs && nla_put(msg, NL80211_ATTR_CSA_C_OFFSETS_TX,
6482                                  csa_offs_len * sizeof(u16), csa_offs)) ||
6483             nla_put(msg, NL80211_ATTR_FRAME, buf_len, buf))
6484                 goto fail;
6485
6486         cookie = 0;
6487         ret = send_and_recv_msgs(drv, msg, cookie_handler, &cookie);
6488         msg = NULL;
6489         if (ret) {
6490                 wpa_printf(MSG_DEBUG, "nl80211: Frame command failed: ret=%d "
6491                            "(%s) (freq=%u wait=%u)", ret, strerror(-ret),
6492                            freq, wait);
6493         } else {
6494                 wpa_printf(MSG_MSGDUMP, "nl80211: Frame TX command accepted%s; "
6495                            "cookie 0x%llx", no_ack ? " (no ACK)" : "",
6496                            (long long unsigned int) cookie);
6497
6498                 if (cookie_out)
6499                         *cookie_out = no_ack ? (u64) -1 : cookie;
6500
6501                 if (drv->num_send_action_cookies == MAX_SEND_ACTION_COOKIES) {
6502                         wpa_printf(MSG_DEBUG,
6503                                    "nl80211: Drop oldest pending send action cookie 0x%llx",
6504                                    (long long unsigned int)
6505                                    drv->send_action_cookies[0]);
6506                         os_memmove(&drv->send_action_cookies[0],
6507                                    &drv->send_action_cookies[1],
6508                                    (MAX_SEND_ACTION_COOKIES - 1) *
6509                                    sizeof(u64));
6510                         drv->num_send_action_cookies--;
6511                 }
6512                 drv->send_action_cookies[drv->num_send_action_cookies] = cookie;
6513                 drv->num_send_action_cookies++;
6514         }
6515
6516 fail:
6517         nlmsg_free(msg);
6518         return ret;
6519 }
6520
6521
6522 static int wpa_driver_nl80211_send_action(struct i802_bss *bss,
6523                                           unsigned int freq,
6524                                           unsigned int wait_time,
6525                                           const u8 *dst, const u8 *src,
6526                                           const u8 *bssid,
6527                                           const u8 *data, size_t data_len,
6528                                           int no_cck)
6529 {
6530         struct wpa_driver_nl80211_data *drv = bss->drv;
6531         int ret = -1;
6532         u8 *buf;
6533         struct ieee80211_hdr *hdr;
6534
6535         wpa_printf(MSG_DEBUG, "nl80211: Send Action frame (ifindex=%d, "
6536                    "freq=%u MHz wait=%d ms no_cck=%d)",
6537                    drv->ifindex, freq, wait_time, no_cck);
6538
6539         buf = os_zalloc(24 + data_len);
6540         if (buf == NULL)
6541                 return ret;
6542         os_memcpy(buf + 24, data, data_len);
6543         hdr = (struct ieee80211_hdr *) buf;
6544         hdr->frame_control =
6545                 IEEE80211_FC(WLAN_FC_TYPE_MGMT, WLAN_FC_STYPE_ACTION);
6546         os_memcpy(hdr->addr1, dst, ETH_ALEN);
6547         os_memcpy(hdr->addr2, src, ETH_ALEN);
6548         os_memcpy(hdr->addr3, bssid, ETH_ALEN);
6549
6550         if (is_ap_interface(drv->nlmode) &&
6551             (!(drv->capa.flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX) ||
6552              (int) freq == bss->freq || drv->device_ap_sme ||
6553              !drv->use_monitor))
6554                 ret = wpa_driver_nl80211_send_mlme(bss, buf, 24 + data_len,
6555                                                    0, freq, no_cck, 1,
6556                                                    wait_time, NULL, 0);
6557         else
6558                 ret = nl80211_send_frame_cmd(bss, freq, wait_time, buf,
6559                                              24 + data_len,
6560                                              &drv->send_action_cookie,
6561                                              no_cck, 0, 1, NULL, 0);
6562
6563         os_free(buf);
6564         return ret;
6565 }
6566
6567
6568 static void nl80211_frame_wait_cancel(struct i802_bss *bss, u64 cookie)
6569 {
6570         struct wpa_driver_nl80211_data *drv = bss->drv;
6571         struct nl_msg *msg;
6572         int ret;
6573
6574         wpa_printf(MSG_DEBUG, "nl80211: Cancel TX frame wait: cookie=0x%llx",
6575                    (long long unsigned int) cookie);
6576         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_FRAME_WAIT_CANCEL)) ||
6577             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie)) {
6578                 nlmsg_free(msg);
6579                 return;
6580         }
6581
6582         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
6583         if (ret)
6584                 wpa_printf(MSG_DEBUG, "nl80211: wait cancel failed: ret=%d "
6585                            "(%s)", ret, strerror(-ret));
6586 }
6587
6588
6589 static void wpa_driver_nl80211_send_action_cancel_wait(void *priv)
6590 {
6591         struct i802_bss *bss = priv;
6592         struct wpa_driver_nl80211_data *drv = bss->drv;
6593         unsigned int i;
6594         u64 cookie;
6595
6596         /* Cancel the last pending TX cookie */
6597         nl80211_frame_wait_cancel(bss, drv->send_action_cookie);
6598
6599         /*
6600          * Cancel the other pending TX cookies, if any. This is needed since
6601          * the driver may keep a list of all pending offchannel TX operations
6602          * and free up the radio only once they have expired or cancelled.
6603          */
6604         for (i = drv->num_send_action_cookies; i > 0; i--) {
6605                 cookie = drv->send_action_cookies[i - 1];
6606                 if (cookie != drv->send_action_cookie)
6607                         nl80211_frame_wait_cancel(bss, cookie);
6608         }
6609         drv->num_send_action_cookies = 0;
6610 }
6611
6612
6613 static int wpa_driver_nl80211_remain_on_channel(void *priv, unsigned int freq,
6614                                                 unsigned int duration)
6615 {
6616         struct i802_bss *bss = priv;
6617         struct wpa_driver_nl80211_data *drv = bss->drv;
6618         struct nl_msg *msg;
6619         int ret;
6620         u64 cookie;
6621
6622         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_REMAIN_ON_CHANNEL)) ||
6623             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
6624             nla_put_u32(msg, NL80211_ATTR_DURATION, duration)) {
6625                 nlmsg_free(msg);
6626                 return -1;
6627         }
6628
6629         cookie = 0;
6630         ret = send_and_recv_msgs(drv, msg, cookie_handler, &cookie);
6631         if (ret == 0) {
6632                 wpa_printf(MSG_DEBUG, "nl80211: Remain-on-channel cookie "
6633                            "0x%llx for freq=%u MHz duration=%u",
6634                            (long long unsigned int) cookie, freq, duration);
6635                 drv->remain_on_chan_cookie = cookie;
6636                 drv->pending_remain_on_chan = 1;
6637                 return 0;
6638         }
6639         wpa_printf(MSG_DEBUG, "nl80211: Failed to request remain-on-channel "
6640                    "(freq=%d duration=%u): %d (%s)",
6641                    freq, duration, ret, strerror(-ret));
6642         return -1;
6643 }
6644
6645
6646 static int wpa_driver_nl80211_cancel_remain_on_channel(void *priv)
6647 {
6648         struct i802_bss *bss = priv;
6649         struct wpa_driver_nl80211_data *drv = bss->drv;
6650         struct nl_msg *msg;
6651         int ret;
6652
6653         if (!drv->pending_remain_on_chan) {
6654                 wpa_printf(MSG_DEBUG, "nl80211: No pending remain-on-channel "
6655                            "to cancel");
6656                 return -1;
6657         }
6658
6659         wpa_printf(MSG_DEBUG, "nl80211: Cancel remain-on-channel with cookie "
6660                    "0x%llx",
6661                    (long long unsigned int) drv->remain_on_chan_cookie);
6662
6663         msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL);
6664         if (!msg ||
6665             nla_put_u64(msg, NL80211_ATTR_COOKIE, drv->remain_on_chan_cookie)) {
6666                 nlmsg_free(msg);
6667                 return -1;
6668         }
6669
6670         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
6671         if (ret == 0)
6672                 return 0;
6673         wpa_printf(MSG_DEBUG, "nl80211: Failed to cancel remain-on-channel: "
6674                    "%d (%s)", ret, strerror(-ret));
6675         return -1;
6676 }
6677
6678
6679 static int wpa_driver_nl80211_probe_req_report(struct i802_bss *bss, int report)
6680 {
6681         struct wpa_driver_nl80211_data *drv = bss->drv;
6682
6683         if (!report) {
6684                 if (bss->nl_preq && drv->device_ap_sme &&
6685                     is_ap_interface(drv->nlmode) && !bss->in_deinit &&
6686                     !bss->static_ap) {
6687                         /*
6688                          * Do not disable Probe Request reporting that was
6689                          * enabled in nl80211_setup_ap().
6690                          */
6691                         wpa_printf(MSG_DEBUG, "nl80211: Skip disabling of "
6692                                    "Probe Request reporting nl_preq=%p while "
6693                                    "in AP mode", bss->nl_preq);
6694                 } else if (bss->nl_preq) {
6695                         wpa_printf(MSG_DEBUG, "nl80211: Disable Probe Request "
6696                                    "reporting nl_preq=%p", bss->nl_preq);
6697                         nl80211_destroy_eloop_handle(&bss->nl_preq);
6698                 }
6699                 return 0;
6700         }
6701
6702         if (bss->nl_preq) {
6703                 wpa_printf(MSG_DEBUG, "nl80211: Probe Request reporting "
6704                            "already on! nl_preq=%p", bss->nl_preq);
6705                 return 0;
6706         }
6707
6708         bss->nl_preq = nl_create_handle(drv->global->nl_cb, "preq");
6709         if (bss->nl_preq == NULL)
6710                 return -1;
6711         wpa_printf(MSG_DEBUG, "nl80211: Enable Probe Request "
6712                    "reporting nl_preq=%p", bss->nl_preq);
6713
6714         if (nl80211_register_frame(bss, bss->nl_preq,
6715                                    (WLAN_FC_TYPE_MGMT << 2) |
6716                                    (WLAN_FC_STYPE_PROBE_REQ << 4),
6717                                    NULL, 0) < 0)
6718                 goto out_err;
6719
6720         nl80211_register_eloop_read(&bss->nl_preq,
6721                                     wpa_driver_nl80211_event_receive,
6722                                     bss->nl_cb);
6723
6724         return 0;
6725
6726  out_err:
6727         nl_destroy_handles(&bss->nl_preq);
6728         return -1;
6729 }
6730
6731
6732 static int nl80211_disable_11b_rates(struct wpa_driver_nl80211_data *drv,
6733                                      int ifindex, int disabled)
6734 {
6735         struct nl_msg *msg;
6736         struct nlattr *bands, *band;
6737         int ret;
6738
6739         wpa_printf(MSG_DEBUG,
6740                    "nl80211: NL80211_CMD_SET_TX_BITRATE_MASK (ifindex=%d %s)",
6741                    ifindex, disabled ? "NL80211_TXRATE_LEGACY=OFDM-only" :
6742                    "no NL80211_TXRATE_LEGACY constraint");
6743
6744         msg = nl80211_ifindex_msg(drv, ifindex, 0,
6745                                   NL80211_CMD_SET_TX_BITRATE_MASK);
6746         if (!msg)
6747                 return -1;
6748
6749         bands = nla_nest_start(msg, NL80211_ATTR_TX_RATES);
6750         if (!bands)
6751                 goto fail;
6752
6753         /*
6754          * Disable 2 GHz rates 1, 2, 5.5, 11 Mbps by masking out everything
6755          * else apart from 6, 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS
6756          * rates. All 5 GHz rates are left enabled.
6757          */
6758         band = nla_nest_start(msg, NL80211_BAND_2GHZ);
6759         if (!band ||
6760             (disabled && nla_put(msg, NL80211_TXRATE_LEGACY, 8,
6761                                  "\x0c\x12\x18\x24\x30\x48\x60\x6c")))
6762                 goto fail;
6763         nla_nest_end(msg, band);
6764
6765         nla_nest_end(msg, bands);
6766
6767         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
6768         if (ret) {
6769                 wpa_printf(MSG_DEBUG, "nl80211: Set TX rates failed: ret=%d "
6770                            "(%s)", ret, strerror(-ret));
6771         } else
6772                 drv->disabled_11b_rates = disabled;
6773
6774         return ret;
6775
6776 fail:
6777         nlmsg_free(msg);
6778         return -1;
6779 }
6780
6781
6782 static int wpa_driver_nl80211_deinit_ap(void *priv)
6783 {
6784         struct i802_bss *bss = priv;
6785         struct wpa_driver_nl80211_data *drv = bss->drv;
6786         if (!is_ap_interface(drv->nlmode))
6787                 return -1;
6788         wpa_driver_nl80211_del_beacon(drv);
6789         bss->beacon_set = 0;
6790
6791         /*
6792          * If the P2P GO interface was dynamically added, then it is
6793          * possible that the interface change to station is not possible.
6794          */
6795         if (drv->nlmode == NL80211_IFTYPE_P2P_GO && bss->if_dynamic)
6796                 return 0;
6797
6798         return wpa_driver_nl80211_set_mode(priv, NL80211_IFTYPE_STATION);
6799 }
6800
6801
6802 static int wpa_driver_nl80211_stop_ap(void *priv)
6803 {
6804         struct i802_bss *bss = priv;
6805         struct wpa_driver_nl80211_data *drv = bss->drv;
6806         if (!is_ap_interface(drv->nlmode))
6807                 return -1;
6808         wpa_driver_nl80211_del_beacon(drv);
6809         bss->beacon_set = 0;
6810         return 0;
6811 }
6812
6813
6814 static int wpa_driver_nl80211_deinit_p2p_cli(void *priv)
6815 {
6816         struct i802_bss *bss = priv;
6817         struct wpa_driver_nl80211_data *drv = bss->drv;
6818         if (drv->nlmode != NL80211_IFTYPE_P2P_CLIENT)
6819                 return -1;
6820
6821         /*
6822          * If the P2P Client interface was dynamically added, then it is
6823          * possible that the interface change to station is not possible.
6824          */
6825         if (bss->if_dynamic)
6826                 return 0;
6827
6828         return wpa_driver_nl80211_set_mode(priv, NL80211_IFTYPE_STATION);
6829 }
6830
6831
6832 static void wpa_driver_nl80211_resume(void *priv)
6833 {
6834         struct i802_bss *bss = priv;
6835         enum nl80211_iftype nlmode = nl80211_get_ifmode(bss);
6836
6837         if (i802_set_iface_flags(bss, 1))
6838                 wpa_printf(MSG_DEBUG, "nl80211: Failed to set interface up on resume event");
6839
6840         if (is_p2p_net_interface(nlmode))
6841                 nl80211_disable_11b_rates(bss->drv, bss->drv->ifindex, 1);
6842 }
6843
6844
6845 static int nl80211_signal_monitor(void *priv, int threshold, int hysteresis)
6846 {
6847         struct i802_bss *bss = priv;
6848         struct wpa_driver_nl80211_data *drv = bss->drv;
6849         struct nl_msg *msg;
6850         struct nlattr *cqm;
6851
6852         wpa_printf(MSG_DEBUG, "nl80211: Signal monitor threshold=%d "
6853                    "hysteresis=%d", threshold, hysteresis);
6854
6855         if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_SET_CQM)) ||
6856             !(cqm = nla_nest_start(msg, NL80211_ATTR_CQM)) ||
6857             nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THOLD, threshold) ||
6858             nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_HYST, hysteresis)) {
6859                 nlmsg_free(msg);
6860                 return -1;
6861         }
6862         nla_nest_end(msg, cqm);
6863
6864         return send_and_recv_msgs(drv, msg, NULL, NULL);
6865 }
6866
6867
6868 static int get_channel_width(struct nl_msg *msg, void *arg)
6869 {
6870         struct nlattr *tb[NL80211_ATTR_MAX + 1];
6871         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
6872         struct wpa_signal_info *sig_change = arg;
6873
6874         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
6875                   genlmsg_attrlen(gnlh, 0), NULL);
6876
6877         sig_change->center_frq1 = -1;
6878         sig_change->center_frq2 = -1;
6879         sig_change->chanwidth = CHAN_WIDTH_UNKNOWN;
6880
6881         if (tb[NL80211_ATTR_CHANNEL_WIDTH]) {
6882                 sig_change->chanwidth = convert2width(
6883                         nla_get_u32(tb[NL80211_ATTR_CHANNEL_WIDTH]));
6884                 if (tb[NL80211_ATTR_CENTER_FREQ1])
6885                         sig_change->center_frq1 =
6886                                 nla_get_u32(tb[NL80211_ATTR_CENTER_FREQ1]);
6887                 if (tb[NL80211_ATTR_CENTER_FREQ2])
6888                         sig_change->center_frq2 =
6889                                 nla_get_u32(tb[NL80211_ATTR_CENTER_FREQ2]);
6890         }
6891
6892         return NL_SKIP;
6893 }
6894
6895
6896 static int nl80211_get_channel_width(struct wpa_driver_nl80211_data *drv,
6897                                      struct wpa_signal_info *sig)
6898 {
6899         struct nl_msg *msg;
6900
6901         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_GET_INTERFACE);
6902         return send_and_recv_msgs(drv, msg, get_channel_width, sig);
6903 }
6904
6905
6906 static int nl80211_signal_poll(void *priv, struct wpa_signal_info *si)
6907 {
6908         struct i802_bss *bss = priv;
6909         struct wpa_driver_nl80211_data *drv = bss->drv;
6910         int res;
6911
6912         os_memset(si, 0, sizeof(*si));
6913         res = nl80211_get_link_signal(drv, si);
6914         if (res) {
6915                 if (drv->nlmode != NL80211_IFTYPE_ADHOC &&
6916                     drv->nlmode != NL80211_IFTYPE_MESH_POINT)
6917                         return res;
6918                 si->current_signal = 0;
6919         }
6920
6921         res = nl80211_get_channel_width(drv, si);
6922         if (res != 0)
6923                 return res;
6924
6925         return nl80211_get_link_noise(drv, si);
6926 }
6927
6928
6929 static int nl80211_send_frame(void *priv, const u8 *data, size_t data_len,
6930                               int encrypt)
6931 {
6932         struct i802_bss *bss = priv;
6933         return wpa_driver_nl80211_send_frame(bss, data, data_len, encrypt, 0,
6934                                              0, 0, 0, 0, NULL, 0);
6935 }
6936
6937
6938 static int nl80211_set_param(void *priv, const char *param)
6939 {
6940         if (param == NULL)
6941                 return 0;
6942         wpa_printf(MSG_DEBUG, "nl80211: driver param='%s'", param);
6943
6944 #ifdef CONFIG_P2P
6945         if (os_strstr(param, "use_p2p_group_interface=1")) {
6946                 struct i802_bss *bss = priv;
6947                 struct wpa_driver_nl80211_data *drv = bss->drv;
6948
6949                 wpa_printf(MSG_DEBUG, "nl80211: Use separate P2P group "
6950                            "interface");
6951                 drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_CONCURRENT;
6952                 drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_MGMT_AND_NON_P2P;
6953         }
6954 #endif /* CONFIG_P2P */
6955
6956         if (os_strstr(param, "use_monitor=1")) {
6957                 struct i802_bss *bss = priv;
6958                 struct wpa_driver_nl80211_data *drv = bss->drv;
6959                 drv->use_monitor = 1;
6960         }
6961
6962         if (os_strstr(param, "force_connect_cmd=1")) {
6963                 struct i802_bss *bss = priv;
6964                 struct wpa_driver_nl80211_data *drv = bss->drv;
6965                 drv->capa.flags &= ~WPA_DRIVER_FLAGS_SME;
6966                 drv->force_connect_cmd = 1;
6967         }
6968
6969         if (os_strstr(param, "no_offchannel_tx=1")) {
6970                 struct i802_bss *bss = priv;
6971                 struct wpa_driver_nl80211_data *drv = bss->drv;
6972                 drv->capa.flags &= ~WPA_DRIVER_FLAGS_OFFCHANNEL_TX;
6973                 drv->test_use_roc_tx = 1;
6974         }
6975
6976         return 0;
6977 }
6978
6979
6980 static void * nl80211_global_init(void *ctx)
6981 {
6982         struct nl80211_global *global;
6983         struct netlink_config *cfg;
6984
6985         global = os_zalloc(sizeof(*global));
6986         if (global == NULL)
6987                 return NULL;
6988         global->ctx = ctx;
6989         global->ioctl_sock = -1;
6990         dl_list_init(&global->interfaces);
6991         global->if_add_ifindex = -1;
6992
6993         cfg = os_zalloc(sizeof(*cfg));
6994         if (cfg == NULL)
6995                 goto err;
6996
6997         cfg->ctx = global;
6998         cfg->newlink_cb = wpa_driver_nl80211_event_rtm_newlink;
6999         cfg->dellink_cb = wpa_driver_nl80211_event_rtm_dellink;
7000         global->netlink = netlink_init(cfg);
7001         if (global->netlink == NULL) {
7002                 os_free(cfg);
7003                 goto err;
7004         }
7005
7006         if (wpa_driver_nl80211_init_nl_global(global) < 0)
7007                 goto err;
7008
7009         global->ioctl_sock = socket(PF_INET, SOCK_DGRAM, 0);
7010         if (global->ioctl_sock < 0) {
7011                 wpa_printf(MSG_ERROR, "nl80211: socket(PF_INET,SOCK_DGRAM) failed: %s",
7012                            strerror(errno));
7013                 goto err;
7014         }
7015
7016         return global;
7017
7018 err:
7019         nl80211_global_deinit(global);
7020         return NULL;
7021 }
7022
7023
7024 static void nl80211_global_deinit(void *priv)
7025 {
7026         struct nl80211_global *global = priv;
7027         if (global == NULL)
7028                 return;
7029         if (!dl_list_empty(&global->interfaces)) {
7030                 wpa_printf(MSG_ERROR, "nl80211: %u interface(s) remain at "
7031                            "nl80211_global_deinit",
7032                            dl_list_len(&global->interfaces));
7033         }
7034
7035         if (global->netlink)
7036                 netlink_deinit(global->netlink);
7037
7038         nl_destroy_handles(&global->nl);
7039
7040         if (global->nl_event)
7041                 nl80211_destroy_eloop_handle(&global->nl_event);
7042
7043         nl_cb_put(global->nl_cb);
7044
7045         if (global->ioctl_sock >= 0)
7046                 close(global->ioctl_sock);
7047
7048         os_free(global);
7049 }
7050
7051
7052 static const char * nl80211_get_radio_name(void *priv)
7053 {
7054         struct i802_bss *bss = priv;
7055         struct wpa_driver_nl80211_data *drv = bss->drv;
7056         return drv->phyname;
7057 }
7058
7059
7060 static int nl80211_pmkid(struct i802_bss *bss, int cmd, const u8 *bssid,
7061                          const u8 *pmkid)
7062 {
7063         struct nl_msg *msg;
7064
7065         if (!(msg = nl80211_bss_msg(bss, 0, cmd)) ||
7066             (pmkid && nla_put(msg, NL80211_ATTR_PMKID, 16, pmkid)) ||
7067             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))) {
7068                 nlmsg_free(msg);
7069                 return -ENOBUFS;
7070         }
7071
7072         return send_and_recv_msgs(bss->drv, msg, NULL, NULL);
7073 }
7074
7075
7076 static int nl80211_add_pmkid(void *priv, const u8 *bssid, const u8 *pmkid)
7077 {
7078         struct i802_bss *bss = priv;
7079         wpa_printf(MSG_DEBUG, "nl80211: Add PMKID for " MACSTR, MAC2STR(bssid));
7080         return nl80211_pmkid(bss, NL80211_CMD_SET_PMKSA, bssid, pmkid);
7081 }
7082
7083
7084 static int nl80211_remove_pmkid(void *priv, const u8 *bssid, const u8 *pmkid)
7085 {
7086         struct i802_bss *bss = priv;
7087         wpa_printf(MSG_DEBUG, "nl80211: Delete PMKID for " MACSTR,
7088                    MAC2STR(bssid));
7089         return nl80211_pmkid(bss, NL80211_CMD_DEL_PMKSA, bssid, pmkid);
7090 }
7091
7092
7093 static int nl80211_flush_pmkid(void *priv)
7094 {
7095         struct i802_bss *bss = priv;
7096         wpa_printf(MSG_DEBUG, "nl80211: Flush PMKIDs");
7097         return nl80211_pmkid(bss, NL80211_CMD_FLUSH_PMKSA, NULL, NULL);
7098 }
7099
7100
7101 static void clean_survey_results(struct survey_results *survey_results)
7102 {
7103         struct freq_survey *survey, *tmp;
7104
7105         if (dl_list_empty(&survey_results->survey_list))
7106                 return;
7107
7108         dl_list_for_each_safe(survey, tmp, &survey_results->survey_list,
7109                               struct freq_survey, list) {
7110                 dl_list_del(&survey->list);
7111                 os_free(survey);
7112         }
7113 }
7114
7115
7116 static void add_survey(struct nlattr **sinfo, u32 ifidx,
7117                        struct dl_list *survey_list)
7118 {
7119         struct freq_survey *survey;
7120
7121         survey = os_zalloc(sizeof(struct freq_survey));
7122         if  (!survey)
7123                 return;
7124
7125         survey->ifidx = ifidx;
7126         survey->freq = nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]);
7127         survey->filled = 0;
7128
7129         if (sinfo[NL80211_SURVEY_INFO_NOISE]) {
7130                 survey->nf = (int8_t)
7131                         nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
7132                 survey->filled |= SURVEY_HAS_NF;
7133         }
7134
7135         if (sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME]) {
7136                 survey->channel_time =
7137                         nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME]);
7138                 survey->filled |= SURVEY_HAS_CHAN_TIME;
7139         }
7140
7141         if (sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY]) {
7142                 survey->channel_time_busy =
7143                         nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY]);
7144                 survey->filled |= SURVEY_HAS_CHAN_TIME_BUSY;
7145         }
7146
7147         if (sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_RX]) {
7148                 survey->channel_time_rx =
7149                         nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_RX]);
7150                 survey->filled |= SURVEY_HAS_CHAN_TIME_RX;
7151         }
7152
7153         if (sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_TX]) {
7154                 survey->channel_time_tx =
7155                         nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_TX]);
7156                 survey->filled |= SURVEY_HAS_CHAN_TIME_TX;
7157         }
7158
7159         wpa_printf(MSG_DEBUG, "nl80211: Freq survey dump event (freq=%d MHz noise=%d channel_time=%ld busy_time=%ld tx_time=%ld rx_time=%ld filled=%04x)",
7160                    survey->freq,
7161                    survey->nf,
7162                    (unsigned long int) survey->channel_time,
7163                    (unsigned long int) survey->channel_time_busy,
7164                    (unsigned long int) survey->channel_time_tx,
7165                    (unsigned long int) survey->channel_time_rx,
7166                    survey->filled);
7167
7168         dl_list_add_tail(survey_list, &survey->list);
7169 }
7170
7171
7172 static int check_survey_ok(struct nlattr **sinfo, u32 surveyed_freq,
7173                            unsigned int freq_filter)
7174 {
7175         if (!freq_filter)
7176                 return 1;
7177
7178         return freq_filter == surveyed_freq;
7179 }
7180
7181
7182 static int survey_handler(struct nl_msg *msg, void *arg)
7183 {
7184         struct nlattr *tb[NL80211_ATTR_MAX + 1];
7185         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
7186         struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
7187         struct survey_results *survey_results;
7188         u32 surveyed_freq = 0;
7189         u32 ifidx;
7190
7191         static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
7192                 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
7193                 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
7194         };
7195
7196         survey_results = (struct survey_results *) arg;
7197
7198         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
7199                   genlmsg_attrlen(gnlh, 0), NULL);
7200
7201         if (!tb[NL80211_ATTR_IFINDEX])
7202                 return NL_SKIP;
7203
7204         ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
7205
7206         if (!tb[NL80211_ATTR_SURVEY_INFO])
7207                 return NL_SKIP;
7208
7209         if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
7210                              tb[NL80211_ATTR_SURVEY_INFO],
7211                              survey_policy))
7212                 return NL_SKIP;
7213
7214         if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY]) {
7215                 wpa_printf(MSG_ERROR, "nl80211: Invalid survey data");
7216                 return NL_SKIP;
7217         }
7218
7219         surveyed_freq = nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]);
7220
7221         if (!check_survey_ok(sinfo, surveyed_freq,
7222                              survey_results->freq_filter))
7223                 return NL_SKIP;
7224
7225         if (survey_results->freq_filter &&
7226             survey_results->freq_filter != surveyed_freq) {
7227                 wpa_printf(MSG_EXCESSIVE, "nl80211: Ignoring survey data for freq %d MHz",
7228                            surveyed_freq);
7229                 return NL_SKIP;
7230         }
7231
7232         add_survey(sinfo, ifidx, &survey_results->survey_list);
7233
7234         return NL_SKIP;
7235 }
7236
7237
7238 static int wpa_driver_nl80211_get_survey(void *priv, unsigned int freq)
7239 {
7240         struct i802_bss *bss = priv;
7241         struct wpa_driver_nl80211_data *drv = bss->drv;
7242         struct nl_msg *msg;
7243         int err;
7244         union wpa_event_data data;
7245         struct survey_results *survey_results;
7246
7247         os_memset(&data, 0, sizeof(data));
7248         survey_results = &data.survey_results;
7249
7250         dl_list_init(&survey_results->survey_list);
7251
7252         msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_GET_SURVEY);
7253         if (!msg)
7254                 return -ENOBUFS;
7255
7256         if (freq)
7257                 data.survey_results.freq_filter = freq;
7258
7259         do {
7260                 wpa_printf(MSG_DEBUG, "nl80211: Fetch survey data");
7261                 err = send_and_recv_msgs(drv, msg, survey_handler,
7262                                          survey_results);
7263         } while (err > 0);
7264
7265         if (err)
7266                 wpa_printf(MSG_ERROR, "nl80211: Failed to process survey data");
7267         else
7268                 wpa_supplicant_event(drv->ctx, EVENT_SURVEY, &data);
7269
7270         clean_survey_results(survey_results);
7271         return err;
7272 }
7273
7274
7275 static void nl80211_set_rekey_info(void *priv, const u8 *kek, size_t kek_len,
7276                                    const u8 *kck, size_t kck_len,
7277                                    const u8 *replay_ctr)
7278 {
7279         struct i802_bss *bss = priv;
7280         struct wpa_driver_nl80211_data *drv = bss->drv;
7281         struct nlattr *replay_nested;
7282         struct nl_msg *msg;
7283         int ret;
7284
7285         if (!drv->set_rekey_offload)
7286                 return;
7287
7288         wpa_printf(MSG_DEBUG, "nl80211: Set rekey offload");
7289         if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_SET_REKEY_OFFLOAD)) ||
7290             !(replay_nested = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA)) ||
7291             nla_put(msg, NL80211_REKEY_DATA_KEK, kek_len, kek) ||
7292             nla_put(msg, NL80211_REKEY_DATA_KCK, kck_len, kck) ||
7293             nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR, NL80211_REPLAY_CTR_LEN,
7294                     replay_ctr)) {
7295                 nl80211_nlmsg_clear(msg);
7296                 nlmsg_free(msg);
7297                 return;
7298         }
7299
7300         nla_nest_end(msg, replay_nested);
7301
7302         ret = send_and_recv_msgs(drv, msg, NULL, (void *) -1);
7303         if (ret == -EOPNOTSUPP) {
7304                 wpa_printf(MSG_DEBUG,
7305                            "nl80211: Driver does not support rekey offload");
7306                 drv->set_rekey_offload = 0;
7307         }
7308 }
7309
7310
7311 static void nl80211_send_null_frame(struct i802_bss *bss, const u8 *own_addr,
7312                                     const u8 *addr, int qos)
7313 {
7314         /* send data frame to poll STA and check whether
7315          * this frame is ACKed */
7316         struct {
7317                 struct ieee80211_hdr hdr;
7318                 u16 qos_ctl;
7319         } STRUCT_PACKED nulldata;
7320         size_t size;
7321
7322         /* Send data frame to poll STA and check whether this frame is ACKed */
7323
7324         os_memset(&nulldata, 0, sizeof(nulldata));
7325
7326         if (qos) {
7327                 nulldata.hdr.frame_control =
7328                         IEEE80211_FC(WLAN_FC_TYPE_DATA,
7329                                      WLAN_FC_STYPE_QOS_NULL);
7330                 size = sizeof(nulldata);
7331         } else {
7332                 nulldata.hdr.frame_control =
7333                         IEEE80211_FC(WLAN_FC_TYPE_DATA,
7334                                      WLAN_FC_STYPE_NULLFUNC);
7335                 size = sizeof(struct ieee80211_hdr);
7336         }
7337
7338         nulldata.hdr.frame_control |= host_to_le16(WLAN_FC_FROMDS);
7339         os_memcpy(nulldata.hdr.IEEE80211_DA_FROMDS, addr, ETH_ALEN);
7340         os_memcpy(nulldata.hdr.IEEE80211_BSSID_FROMDS, own_addr, ETH_ALEN);
7341         os_memcpy(nulldata.hdr.IEEE80211_SA_FROMDS, own_addr, ETH_ALEN);
7342
7343         if (wpa_driver_nl80211_send_mlme(bss, (u8 *) &nulldata, size, 0, 0, 0,
7344                                          0, 0, NULL, 0) < 0)
7345                 wpa_printf(MSG_DEBUG, "nl80211_send_null_frame: Failed to "
7346                            "send poll frame");
7347 }
7348
7349 static void nl80211_poll_client(void *priv, const u8 *own_addr, const u8 *addr,
7350                                 int qos)
7351 {
7352         struct i802_bss *bss = priv;
7353         struct wpa_driver_nl80211_data *drv = bss->drv;
7354         struct nl_msg *msg;
7355         int ret;
7356
7357         if (!drv->poll_command_supported) {
7358                 nl80211_send_null_frame(bss, own_addr, addr, qos);
7359                 return;
7360         }
7361
7362         if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_PROBE_CLIENT)) ||
7363             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) {
7364                 nlmsg_free(msg);
7365                 return;
7366         }
7367
7368         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7369         if (ret < 0) {
7370                 wpa_printf(MSG_DEBUG, "nl80211: Client probe request for "
7371                            MACSTR " failed: ret=%d (%s)",
7372                            MAC2STR(addr), ret, strerror(-ret));
7373         }
7374 }
7375
7376
7377 static int nl80211_set_power_save(struct i802_bss *bss, int enabled)
7378 {
7379         struct nl_msg *msg;
7380
7381         if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_SET_POWER_SAVE)) ||
7382             nla_put_u32(msg, NL80211_ATTR_PS_STATE,
7383                         enabled ? NL80211_PS_ENABLED : NL80211_PS_DISABLED)) {
7384                 nlmsg_free(msg);
7385                 return -ENOBUFS;
7386         }
7387         return send_and_recv_msgs(bss->drv, msg, NULL, NULL);
7388 }
7389
7390
7391 static int nl80211_set_p2p_powersave(void *priv, int legacy_ps, int opp_ps,
7392                                      int ctwindow)
7393 {
7394         struct i802_bss *bss = priv;
7395
7396         wpa_printf(MSG_DEBUG, "nl80211: set_p2p_powersave (legacy_ps=%d "
7397                    "opp_ps=%d ctwindow=%d)", legacy_ps, opp_ps, ctwindow);
7398
7399         if (opp_ps != -1 || ctwindow != -1) {
7400 #ifdef ANDROID_P2P
7401                 wpa_driver_set_p2p_ps(priv, legacy_ps, opp_ps, ctwindow);
7402 #else /* ANDROID_P2P */
7403                 return -1; /* Not yet supported */
7404 #endif /* ANDROID_P2P */
7405         }
7406
7407         if (legacy_ps == -1)
7408                 return 0;
7409         if (legacy_ps != 0 && legacy_ps != 1)
7410                 return -1; /* Not yet supported */
7411
7412         return nl80211_set_power_save(bss, legacy_ps);
7413 }
7414
7415
7416 static int nl80211_start_radar_detection(void *priv,
7417                                          struct hostapd_freq_params *freq)
7418 {
7419         struct i802_bss *bss = priv;
7420         struct wpa_driver_nl80211_data *drv = bss->drv;
7421         struct nl_msg *msg;
7422         int ret;
7423
7424         wpa_printf(MSG_DEBUG, "nl80211: Start radar detection (CAC) %d MHz (ht_enabled=%d, vht_enabled=%d, bandwidth=%d MHz, cf1=%d MHz, cf2=%d MHz)",
7425                    freq->freq, freq->ht_enabled, freq->vht_enabled,
7426                    freq->bandwidth, freq->center_freq1, freq->center_freq2);
7427
7428         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_RADAR)) {
7429                 wpa_printf(MSG_DEBUG, "nl80211: Driver does not support radar "
7430                            "detection");
7431                 return -1;
7432         }
7433
7434         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_RADAR_DETECT)) ||
7435             nl80211_put_freq_params(msg, freq) < 0) {
7436                 nlmsg_free(msg);
7437                 return -1;
7438         }
7439
7440         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7441         if (ret == 0)
7442                 return 0;
7443         wpa_printf(MSG_DEBUG, "nl80211: Failed to start radar detection: "
7444                    "%d (%s)", ret, strerror(-ret));
7445         return -1;
7446 }
7447
7448 #ifdef CONFIG_TDLS
7449
7450 static int nl80211_send_tdls_mgmt(void *priv, const u8 *dst, u8 action_code,
7451                                   u8 dialog_token, u16 status_code,
7452                                   u32 peer_capab, int initiator, const u8 *buf,
7453                                   size_t len)
7454 {
7455         struct i802_bss *bss = priv;
7456         struct wpa_driver_nl80211_data *drv = bss->drv;
7457         struct nl_msg *msg;
7458
7459         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT))
7460                 return -EOPNOTSUPP;
7461
7462         if (!dst)
7463                 return -EINVAL;
7464
7465         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_TDLS_MGMT)) ||
7466             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
7467             nla_put_u8(msg, NL80211_ATTR_TDLS_ACTION, action_code) ||
7468             nla_put_u8(msg, NL80211_ATTR_TDLS_DIALOG_TOKEN, dialog_token) ||
7469             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status_code))
7470                 goto fail;
7471         if (peer_capab) {
7472                 /*
7473                  * The internal enum tdls_peer_capability definition is
7474                  * currently identical with the nl80211 enum
7475                  * nl80211_tdls_peer_capability, so no conversion is needed
7476                  * here.
7477                  */
7478                 if (nla_put_u32(msg, NL80211_ATTR_TDLS_PEER_CAPABILITY,
7479                                 peer_capab))
7480                         goto fail;
7481         }
7482         if ((initiator &&
7483              nla_put_flag(msg, NL80211_ATTR_TDLS_INITIATOR)) ||
7484             nla_put(msg, NL80211_ATTR_IE, len, buf))
7485                 goto fail;
7486
7487         return send_and_recv_msgs(drv, msg, NULL, NULL);
7488
7489 fail:
7490         nlmsg_free(msg);
7491         return -ENOBUFS;
7492 }
7493
7494
7495 static int nl80211_tdls_oper(void *priv, enum tdls_oper oper, const u8 *peer)
7496 {
7497         struct i802_bss *bss = priv;
7498         struct wpa_driver_nl80211_data *drv = bss->drv;
7499         struct nl_msg *msg;
7500         enum nl80211_tdls_operation nl80211_oper;
7501
7502         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT))
7503                 return -EOPNOTSUPP;
7504
7505         switch (oper) {
7506         case TDLS_DISCOVERY_REQ:
7507                 nl80211_oper = NL80211_TDLS_DISCOVERY_REQ;
7508                 break;
7509         case TDLS_SETUP:
7510                 nl80211_oper = NL80211_TDLS_SETUP;
7511                 break;
7512         case TDLS_TEARDOWN:
7513                 nl80211_oper = NL80211_TDLS_TEARDOWN;
7514                 break;
7515         case TDLS_ENABLE_LINK:
7516                 nl80211_oper = NL80211_TDLS_ENABLE_LINK;
7517                 break;
7518         case TDLS_DISABLE_LINK:
7519                 nl80211_oper = NL80211_TDLS_DISABLE_LINK;
7520                 break;
7521         case TDLS_ENABLE:
7522                 return 0;
7523         case TDLS_DISABLE:
7524                 return 0;
7525         default:
7526                 return -EINVAL;
7527         }
7528
7529         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_TDLS_OPER)) ||
7530             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, nl80211_oper) ||
7531             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer)) {
7532                 nlmsg_free(msg);
7533                 return -ENOBUFS;
7534         }
7535
7536         return send_and_recv_msgs(drv, msg, NULL, NULL);
7537 }
7538
7539
7540 static int
7541 nl80211_tdls_enable_channel_switch(void *priv, const u8 *addr, u8 oper_class,
7542                                    const struct hostapd_freq_params *params)
7543 {
7544         struct i802_bss *bss = priv;
7545         struct wpa_driver_nl80211_data *drv = bss->drv;
7546         struct nl_msg *msg;
7547         int ret = -ENOBUFS;
7548
7549         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT) ||
7550             !(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_CHANNEL_SWITCH))
7551                 return -EOPNOTSUPP;
7552
7553         wpa_printf(MSG_DEBUG, "nl80211: Enable TDLS channel switch " MACSTR
7554                    " oper_class=%u freq=%u",
7555                    MAC2STR(addr), oper_class, params->freq);
7556         msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_TDLS_CHANNEL_SWITCH);
7557         if (!msg ||
7558             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
7559             nla_put_u8(msg, NL80211_ATTR_OPER_CLASS, oper_class) ||
7560             (ret = nl80211_put_freq_params(msg, params))) {
7561                 nlmsg_free(msg);
7562                 wpa_printf(MSG_DEBUG, "nl80211: Could not build TDLS chan switch");
7563                 return ret;
7564         }
7565
7566         return send_and_recv_msgs(drv, msg, NULL, NULL);
7567 }
7568
7569
7570 static int
7571 nl80211_tdls_disable_channel_switch(void *priv, const u8 *addr)
7572 {
7573         struct i802_bss *bss = priv;
7574         struct wpa_driver_nl80211_data *drv = bss->drv;
7575         struct nl_msg *msg;
7576
7577         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT) ||
7578             !(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_CHANNEL_SWITCH))
7579                 return -EOPNOTSUPP;
7580
7581         wpa_printf(MSG_DEBUG, "nl80211: Disable TDLS channel switch " MACSTR,
7582                    MAC2STR(addr));
7583         msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH);
7584         if (!msg ||
7585             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) {
7586                 nlmsg_free(msg);
7587                 wpa_printf(MSG_DEBUG,
7588                            "nl80211: Could not build TDLS cancel chan switch");
7589                 return -ENOBUFS;
7590         }
7591
7592         return send_and_recv_msgs(drv, msg, NULL, NULL);
7593 }
7594
7595 #endif /* CONFIG TDLS */
7596
7597
7598 static int driver_nl80211_set_key(const char *ifname, void *priv,
7599                                   enum wpa_alg alg, const u8 *addr,
7600                                   int key_idx, int set_tx,
7601                                   const u8 *seq, size_t seq_len,
7602                                   const u8 *key, size_t key_len)
7603 {
7604         struct i802_bss *bss = priv;
7605         return wpa_driver_nl80211_set_key(ifname, bss, alg, addr, key_idx,
7606                                           set_tx, seq, seq_len, key, key_len);
7607 }
7608
7609
7610 static int driver_nl80211_scan2(void *priv,
7611                                 struct wpa_driver_scan_params *params)
7612 {
7613         struct i802_bss *bss = priv;
7614 #ifdef CONFIG_DRIVER_NL80211_QCA
7615         struct wpa_driver_nl80211_data *drv = bss->drv;
7616
7617         /*
7618          * Do a vendor specific scan if possible. If only_new_results is
7619          * set, do a normal scan since a kernel (cfg80211) BSS cache flush
7620          * cannot be achieved through a vendor scan. The below condition may
7621          * need to be modified if new scan flags are added in the future whose
7622          * functionality can only be achieved through a normal scan.
7623          */
7624         if (drv->scan_vendor_cmd_avail && !params->only_new_results)
7625                 return wpa_driver_nl80211_vendor_scan(bss, params);
7626 #endif /* CONFIG_DRIVER_NL80211_QCA */
7627         return wpa_driver_nl80211_scan(bss, params);
7628 }
7629
7630
7631 static int driver_nl80211_deauthenticate(void *priv, const u8 *addr,
7632                                          int reason_code)
7633 {
7634         struct i802_bss *bss = priv;
7635         return wpa_driver_nl80211_deauthenticate(bss, addr, reason_code);
7636 }
7637
7638
7639 static int driver_nl80211_authenticate(void *priv,
7640                                        struct wpa_driver_auth_params *params)
7641 {
7642         struct i802_bss *bss = priv;
7643         return wpa_driver_nl80211_authenticate(bss, params);
7644 }
7645
7646
7647 static void driver_nl80211_deinit(void *priv)
7648 {
7649         struct i802_bss *bss = priv;
7650         wpa_driver_nl80211_deinit(bss);
7651 }
7652
7653
7654 static int driver_nl80211_if_remove(void *priv, enum wpa_driver_if_type type,
7655                                     const char *ifname)
7656 {
7657         struct i802_bss *bss = priv;
7658         return wpa_driver_nl80211_if_remove(bss, type, ifname);
7659 }
7660
7661
7662 static int driver_nl80211_send_mlme(void *priv, const u8 *data,
7663                                     size_t data_len, int noack,
7664                                     unsigned int freq,
7665                                     const u16 *csa_offs, size_t csa_offs_len)
7666 {
7667         struct i802_bss *bss = priv;
7668         return wpa_driver_nl80211_send_mlme(bss, data, data_len, noack,
7669                                             freq, 0, 0, 0, csa_offs,
7670                                             csa_offs_len);
7671 }
7672
7673
7674 static int driver_nl80211_sta_remove(void *priv, const u8 *addr)
7675 {
7676         struct i802_bss *bss = priv;
7677         return wpa_driver_nl80211_sta_remove(bss, addr, -1, 0);
7678 }
7679
7680
7681 static int driver_nl80211_set_sta_vlan(void *priv, const u8 *addr,
7682                                        const char *ifname, int vlan_id)
7683 {
7684         struct i802_bss *bss = priv;
7685         return i802_set_sta_vlan(bss, addr, ifname, vlan_id);
7686 }
7687
7688
7689 static int driver_nl80211_read_sta_data(void *priv,
7690                                         struct hostap_sta_driver_data *data,
7691                                         const u8 *addr)
7692 {
7693         struct i802_bss *bss = priv;
7694         return i802_read_sta_data(bss, data, addr);
7695 }
7696
7697
7698 static int driver_nl80211_send_action(void *priv, unsigned int freq,
7699                                       unsigned int wait_time,
7700                                       const u8 *dst, const u8 *src,
7701                                       const u8 *bssid,
7702                                       const u8 *data, size_t data_len,
7703                                       int no_cck)
7704 {
7705         struct i802_bss *bss = priv;
7706         return wpa_driver_nl80211_send_action(bss, freq, wait_time, dst, src,
7707                                               bssid, data, data_len, no_cck);
7708 }
7709
7710
7711 static int driver_nl80211_probe_req_report(void *priv, int report)
7712 {
7713         struct i802_bss *bss = priv;
7714         return wpa_driver_nl80211_probe_req_report(bss, report);
7715 }
7716
7717
7718 static int wpa_driver_nl80211_update_ft_ies(void *priv, const u8 *md,
7719                                             const u8 *ies, size_t ies_len)
7720 {
7721         int ret;
7722         struct nl_msg *msg;
7723         struct i802_bss *bss = priv;
7724         struct wpa_driver_nl80211_data *drv = bss->drv;
7725         u16 mdid = WPA_GET_LE16(md);
7726
7727         wpa_printf(MSG_DEBUG, "nl80211: Updating FT IEs");
7728         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_UPDATE_FT_IES)) ||
7729             nla_put(msg, NL80211_ATTR_IE, ies_len, ies) ||
7730             nla_put_u16(msg, NL80211_ATTR_MDID, mdid)) {
7731                 nlmsg_free(msg);
7732                 return -ENOBUFS;
7733         }
7734
7735         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7736         if (ret) {
7737                 wpa_printf(MSG_DEBUG, "nl80211: update_ft_ies failed "
7738                            "err=%d (%s)", ret, strerror(-ret));
7739         }
7740
7741         return ret;
7742 }
7743
7744
7745 static const u8 * wpa_driver_nl80211_get_macaddr(void *priv)
7746 {
7747         struct i802_bss *bss = priv;
7748         struct wpa_driver_nl80211_data *drv = bss->drv;
7749
7750         if (drv->nlmode != NL80211_IFTYPE_P2P_DEVICE)
7751                 return NULL;
7752
7753         return bss->addr;
7754 }
7755
7756
7757 static const char * scan_state_str(enum scan_states scan_state)
7758 {
7759         switch (scan_state) {
7760         case NO_SCAN:
7761                 return "NO_SCAN";
7762         case SCAN_REQUESTED:
7763                 return "SCAN_REQUESTED";
7764         case SCAN_STARTED:
7765                 return "SCAN_STARTED";
7766         case SCAN_COMPLETED:
7767                 return "SCAN_COMPLETED";
7768         case SCAN_ABORTED:
7769                 return "SCAN_ABORTED";
7770         case SCHED_SCAN_STARTED:
7771                 return "SCHED_SCAN_STARTED";
7772         case SCHED_SCAN_STOPPED:
7773                 return "SCHED_SCAN_STOPPED";
7774         case SCHED_SCAN_RESULTS:
7775                 return "SCHED_SCAN_RESULTS";
7776         }
7777
7778         return "??";
7779 }
7780
7781
7782 static int wpa_driver_nl80211_status(void *priv, char *buf, size_t buflen)
7783 {
7784         struct i802_bss *bss = priv;
7785         struct wpa_driver_nl80211_data *drv = bss->drv;
7786         int res;
7787         char *pos, *end;
7788
7789         pos = buf;
7790         end = buf + buflen;
7791
7792         res = os_snprintf(pos, end - pos,
7793                           "ifindex=%d\n"
7794                           "ifname=%s\n"
7795                           "brname=%s\n"
7796                           "addr=" MACSTR "\n"
7797                           "freq=%d\n"
7798                           "%s%s%s%s%s",
7799                           bss->ifindex,
7800                           bss->ifname,
7801                           bss->brname,
7802                           MAC2STR(bss->addr),
7803                           bss->freq,
7804                           bss->beacon_set ? "beacon_set=1\n" : "",
7805                           bss->added_if_into_bridge ?
7806                           "added_if_into_bridge=1\n" : "",
7807                           bss->added_bridge ? "added_bridge=1\n" : "",
7808                           bss->in_deinit ? "in_deinit=1\n" : "",
7809                           bss->if_dynamic ? "if_dynamic=1\n" : "");
7810         if (os_snprintf_error(end - pos, res))
7811                 return pos - buf;
7812         pos += res;
7813
7814         if (bss->wdev_id_set) {
7815                 res = os_snprintf(pos, end - pos, "wdev_id=%llu\n",
7816                                   (unsigned long long) bss->wdev_id);
7817                 if (os_snprintf_error(end - pos, res))
7818                         return pos - buf;
7819                 pos += res;
7820         }
7821
7822         res = os_snprintf(pos, end - pos,
7823                           "phyname=%s\n"
7824                           "perm_addr=" MACSTR "\n"
7825                           "drv_ifindex=%d\n"
7826                           "operstate=%d\n"
7827                           "scan_state=%s\n"
7828                           "auth_bssid=" MACSTR "\n"
7829                           "auth_attempt_bssid=" MACSTR "\n"
7830                           "bssid=" MACSTR "\n"
7831                           "prev_bssid=" MACSTR "\n"
7832                           "associated=%d\n"
7833                           "assoc_freq=%u\n"
7834                           "monitor_sock=%d\n"
7835                           "monitor_ifidx=%d\n"
7836                           "monitor_refcount=%d\n"
7837                           "last_mgmt_freq=%u\n"
7838                           "eapol_tx_sock=%d\n"
7839                           "%s%s%s%s%s%s%s%s%s%s%s%s%s",
7840                           drv->phyname,
7841                           MAC2STR(drv->perm_addr),
7842                           drv->ifindex,
7843                           drv->operstate,
7844                           scan_state_str(drv->scan_state),
7845                           MAC2STR(drv->auth_bssid),
7846                           MAC2STR(drv->auth_attempt_bssid),
7847                           MAC2STR(drv->bssid),
7848                           MAC2STR(drv->prev_bssid),
7849                           drv->associated,
7850                           drv->assoc_freq,
7851                           drv->monitor_sock,
7852                           drv->monitor_ifidx,
7853                           drv->monitor_refcount,
7854                           drv->last_mgmt_freq,
7855                           drv->eapol_tx_sock,
7856                           drv->ignore_if_down_event ?
7857                           "ignore_if_down_event=1\n" : "",
7858                           drv->scan_complete_events ?
7859                           "scan_complete_events=1\n" : "",
7860                           drv->disabled_11b_rates ?
7861                           "disabled_11b_rates=1\n" : "",
7862                           drv->pending_remain_on_chan ?
7863                           "pending_remain_on_chan=1\n" : "",
7864                           drv->in_interface_list ? "in_interface_list=1\n" : "",
7865                           drv->device_ap_sme ? "device_ap_sme=1\n" : "",
7866                           drv->poll_command_supported ?
7867                           "poll_command_supported=1\n" : "",
7868                           drv->data_tx_status ? "data_tx_status=1\n" : "",
7869                           drv->scan_for_auth ? "scan_for_auth=1\n" : "",
7870                           drv->retry_auth ? "retry_auth=1\n" : "",
7871                           drv->use_monitor ? "use_monitor=1\n" : "",
7872                           drv->ignore_next_local_disconnect ?
7873                           "ignore_next_local_disconnect=1\n" : "",
7874                           drv->ignore_next_local_deauth ?
7875                           "ignore_next_local_deauth=1\n" : "");
7876         if (os_snprintf_error(end - pos, res))
7877                 return pos - buf;
7878         pos += res;
7879
7880         if (drv->has_capability) {
7881                 res = os_snprintf(pos, end - pos,
7882                                   "capa.key_mgmt=0x%x\n"
7883                                   "capa.enc=0x%x\n"
7884                                   "capa.auth=0x%x\n"
7885                                   "capa.flags=0x%llx\n"
7886                                   "capa.rrm_flags=0x%x\n"
7887                                   "capa.max_scan_ssids=%d\n"
7888                                   "capa.max_sched_scan_ssids=%d\n"
7889                                   "capa.sched_scan_supported=%d\n"
7890                                   "capa.max_match_sets=%d\n"
7891                                   "capa.max_remain_on_chan=%u\n"
7892                                   "capa.max_stations=%u\n"
7893                                   "capa.probe_resp_offloads=0x%x\n"
7894                                   "capa.max_acl_mac_addrs=%u\n"
7895                                   "capa.num_multichan_concurrent=%u\n"
7896                                   "capa.mac_addr_rand_sched_scan_supported=%d\n"
7897                                   "capa.mac_addr_rand_scan_supported=%d\n"
7898                                   "capa.conc_capab=%u\n"
7899                                   "capa.max_conc_chan_2_4=%u\n"
7900                                   "capa.max_conc_chan_5_0=%u\n"
7901                                   "capa.max_sched_scan_plans=%u\n"
7902                                   "capa.max_sched_scan_plan_interval=%u\n"
7903                                   "capa.max_sched_scan_plan_iterations=%u\n",
7904                                   drv->capa.key_mgmt,
7905                                   drv->capa.enc,
7906                                   drv->capa.auth,
7907                                   (unsigned long long) drv->capa.flags,
7908                                   drv->capa.rrm_flags,
7909                                   drv->capa.max_scan_ssids,
7910                                   drv->capa.max_sched_scan_ssids,
7911                                   drv->capa.sched_scan_supported,
7912                                   drv->capa.max_match_sets,
7913                                   drv->capa.max_remain_on_chan,
7914                                   drv->capa.max_stations,
7915                                   drv->capa.probe_resp_offloads,
7916                                   drv->capa.max_acl_mac_addrs,
7917                                   drv->capa.num_multichan_concurrent,
7918                                   drv->capa.mac_addr_rand_sched_scan_supported,
7919                                   drv->capa.mac_addr_rand_scan_supported,
7920                                   drv->capa.conc_capab,
7921                                   drv->capa.max_conc_chan_2_4,
7922                                   drv->capa.max_conc_chan_5_0,
7923                                   drv->capa.max_sched_scan_plans,
7924                                   drv->capa.max_sched_scan_plan_interval,
7925                                   drv->capa.max_sched_scan_plan_iterations);
7926                 if (os_snprintf_error(end - pos, res))
7927                         return pos - buf;
7928                 pos += res;
7929         }
7930
7931         return pos - buf;
7932 }
7933
7934
7935 static int set_beacon_data(struct nl_msg *msg, struct beacon_data *settings)
7936 {
7937         if ((settings->head &&
7938              nla_put(msg, NL80211_ATTR_BEACON_HEAD,
7939                      settings->head_len, settings->head)) ||
7940             (settings->tail &&
7941              nla_put(msg, NL80211_ATTR_BEACON_TAIL,
7942                      settings->tail_len, settings->tail)) ||
7943             (settings->beacon_ies &&
7944              nla_put(msg, NL80211_ATTR_IE,
7945                      settings->beacon_ies_len, settings->beacon_ies)) ||
7946             (settings->proberesp_ies &&
7947              nla_put(msg, NL80211_ATTR_IE_PROBE_RESP,
7948                      settings->proberesp_ies_len, settings->proberesp_ies)) ||
7949             (settings->assocresp_ies &&
7950              nla_put(msg, NL80211_ATTR_IE_ASSOC_RESP,
7951                      settings->assocresp_ies_len, settings->assocresp_ies)) ||
7952             (settings->probe_resp &&
7953              nla_put(msg, NL80211_ATTR_PROBE_RESP,
7954                      settings->probe_resp_len, settings->probe_resp)))
7955                 return -ENOBUFS;
7956
7957         return 0;
7958 }
7959
7960
7961 static int nl80211_switch_channel(void *priv, struct csa_settings *settings)
7962 {
7963         struct nl_msg *msg;
7964         struct i802_bss *bss = priv;
7965         struct wpa_driver_nl80211_data *drv = bss->drv;
7966         struct nlattr *beacon_csa;
7967         int ret = -ENOBUFS;
7968         int csa_off_len = 0;
7969         int i;
7970
7971         wpa_printf(MSG_DEBUG, "nl80211: Channel switch request (cs_count=%u block_tx=%u freq=%d width=%d cf1=%d cf2=%d)",
7972                    settings->cs_count, settings->block_tx,
7973                    settings->freq_params.freq, settings->freq_params.bandwidth,
7974                    settings->freq_params.center_freq1,
7975                    settings->freq_params.center_freq2);
7976
7977         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_AP_CSA)) {
7978                 wpa_printf(MSG_DEBUG, "nl80211: Driver does not support channel switch command");
7979                 return -EOPNOTSUPP;
7980         }
7981
7982         if ((drv->nlmode != NL80211_IFTYPE_AP) &&
7983             (drv->nlmode != NL80211_IFTYPE_P2P_GO))
7984                 return -EOPNOTSUPP;
7985
7986         /*
7987          * Remove empty counters, assuming Probe Response and Beacon frame
7988          * counters match. This implementation assumes that there are only two
7989          * counters.
7990          */
7991         if (settings->counter_offset_beacon[0] &&
7992             !settings->counter_offset_beacon[1]) {
7993                 csa_off_len = 1;
7994         } else if (settings->counter_offset_beacon[1] &&
7995                    !settings->counter_offset_beacon[0]) {
7996                 csa_off_len = 1;
7997                 settings->counter_offset_beacon[0] =
7998                         settings->counter_offset_beacon[1];
7999                 settings->counter_offset_presp[0] =
8000                         settings->counter_offset_presp[1];
8001         } else if (settings->counter_offset_beacon[1] &&
8002                    settings->counter_offset_beacon[0]) {
8003                 csa_off_len = 2;
8004         } else {
8005                 wpa_printf(MSG_ERROR, "nl80211: No CSA counters provided");
8006                 return -EINVAL;
8007         }
8008
8009         /* Check CSA counters validity */
8010         if (drv->capa.max_csa_counters &&
8011             csa_off_len > drv->capa.max_csa_counters) {
8012                 wpa_printf(MSG_ERROR,
8013                            "nl80211: Too many CSA counters provided");
8014                 return -EINVAL;
8015         }
8016
8017         if (!settings->beacon_csa.tail)
8018                 return -EINVAL;
8019
8020         for (i = 0; i < csa_off_len; i++) {
8021                 u16 csa_c_off_bcn = settings->counter_offset_beacon[i];
8022                 u16 csa_c_off_presp = settings->counter_offset_presp[i];
8023
8024                 if ((settings->beacon_csa.tail_len <= csa_c_off_bcn) ||
8025                     (settings->beacon_csa.tail[csa_c_off_bcn] !=
8026                      settings->cs_count))
8027                         return -EINVAL;
8028
8029                 if (settings->beacon_csa.probe_resp &&
8030                     ((settings->beacon_csa.probe_resp_len <=
8031                       csa_c_off_presp) ||
8032                      (settings->beacon_csa.probe_resp[csa_c_off_presp] !=
8033                       settings->cs_count)))
8034                         return -EINVAL;
8035         }
8036
8037         if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_CHANNEL_SWITCH)) ||
8038             nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT,
8039                         settings->cs_count) ||
8040             (ret = nl80211_put_freq_params(msg, &settings->freq_params)) ||
8041             (settings->block_tx &&
8042              nla_put_flag(msg, NL80211_ATTR_CH_SWITCH_BLOCK_TX)))
8043                 goto error;
8044
8045         /* beacon_after params */
8046         ret = set_beacon_data(msg, &settings->beacon_after);
8047         if (ret)
8048                 goto error;
8049
8050         /* beacon_csa params */
8051         beacon_csa = nla_nest_start(msg, NL80211_ATTR_CSA_IES);
8052         if (!beacon_csa)
8053                 goto fail;
8054
8055         ret = set_beacon_data(msg, &settings->beacon_csa);
8056         if (ret)
8057                 goto error;
8058
8059         if (nla_put(msg, NL80211_ATTR_CSA_C_OFF_BEACON,
8060                     csa_off_len * sizeof(u16),
8061                     settings->counter_offset_beacon) ||
8062             (settings->beacon_csa.probe_resp &&
8063              nla_put(msg, NL80211_ATTR_CSA_C_OFF_PRESP,
8064                      csa_off_len * sizeof(u16),
8065                      settings->counter_offset_presp)))
8066                 goto fail;
8067
8068         nla_nest_end(msg, beacon_csa);
8069         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8070         if (ret) {
8071                 wpa_printf(MSG_DEBUG, "nl80211: switch_channel failed err=%d (%s)",
8072                            ret, strerror(-ret));
8073         }
8074         return ret;
8075
8076 fail:
8077         ret = -ENOBUFS;
8078 error:
8079         nlmsg_free(msg);
8080         wpa_printf(MSG_DEBUG, "nl80211: Could not build channel switch request");
8081         return ret;
8082 }
8083
8084
8085 static int nl80211_add_ts(void *priv, u8 tsid, const u8 *addr,
8086                           u8 user_priority, u16 admitted_time)
8087 {
8088         struct i802_bss *bss = priv;
8089         struct wpa_driver_nl80211_data *drv = bss->drv;
8090         struct nl_msg *msg;
8091         int ret;
8092
8093         wpa_printf(MSG_DEBUG,
8094                    "nl80211: add_ts request: tsid=%u admitted_time=%u up=%d",
8095                    tsid, admitted_time, user_priority);
8096
8097         if (!is_sta_interface(drv->nlmode))
8098                 return -ENOTSUP;
8099
8100         msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_ADD_TX_TS);
8101         if (!msg ||
8102             nla_put_u8(msg, NL80211_ATTR_TSID, tsid) ||
8103             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
8104             nla_put_u8(msg, NL80211_ATTR_USER_PRIO, user_priority) ||
8105             nla_put_u16(msg, NL80211_ATTR_ADMITTED_TIME, admitted_time)) {
8106                 nlmsg_free(msg);
8107                 return -ENOBUFS;
8108         }
8109
8110         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8111         if (ret)
8112                 wpa_printf(MSG_DEBUG, "nl80211: add_ts failed err=%d (%s)",
8113                            ret, strerror(-ret));
8114         return ret;
8115 }
8116
8117
8118 static int nl80211_del_ts(void *priv, u8 tsid, const u8 *addr)
8119 {
8120         struct i802_bss *bss = priv;
8121         struct wpa_driver_nl80211_data *drv = bss->drv;
8122         struct nl_msg *msg;
8123         int ret;
8124
8125         wpa_printf(MSG_DEBUG, "nl80211: del_ts request: tsid=%u", tsid);
8126
8127         if (!is_sta_interface(drv->nlmode))
8128                 return -ENOTSUP;
8129
8130         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_DEL_TX_TS)) ||
8131             nla_put_u8(msg, NL80211_ATTR_TSID, tsid) ||
8132             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) {
8133                 nlmsg_free(msg);
8134                 return -ENOBUFS;
8135         }
8136
8137         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8138         if (ret)
8139                 wpa_printf(MSG_DEBUG, "nl80211: del_ts failed err=%d (%s)",
8140                            ret, strerror(-ret));
8141         return ret;
8142 }
8143
8144
8145 #ifdef CONFIG_TESTING_OPTIONS
8146 static int cmd_reply_handler(struct nl_msg *msg, void *arg)
8147 {
8148         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
8149         struct wpabuf *buf = arg;
8150
8151         if (!buf)
8152                 return NL_SKIP;
8153
8154         if ((size_t) genlmsg_attrlen(gnlh, 0) > wpabuf_tailroom(buf)) {
8155                 wpa_printf(MSG_INFO, "nl80211: insufficient buffer space for reply");
8156                 return NL_SKIP;
8157         }
8158
8159         wpabuf_put_data(buf, genlmsg_attrdata(gnlh, 0),
8160                         genlmsg_attrlen(gnlh, 0));
8161
8162         return NL_SKIP;
8163 }
8164 #endif /* CONFIG_TESTING_OPTIONS */
8165
8166
8167 static int vendor_reply_handler(struct nl_msg *msg, void *arg)
8168 {
8169         struct nlattr *tb[NL80211_ATTR_MAX + 1];
8170         struct nlattr *nl_vendor_reply, *nl;
8171         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
8172         struct wpabuf *buf = arg;
8173         int rem;
8174
8175         if (!buf)
8176                 return NL_SKIP;
8177
8178         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
8179                   genlmsg_attrlen(gnlh, 0), NULL);
8180         nl_vendor_reply = tb[NL80211_ATTR_VENDOR_DATA];
8181
8182         if (!nl_vendor_reply)
8183                 return NL_SKIP;
8184
8185         if ((size_t) nla_len(nl_vendor_reply) > wpabuf_tailroom(buf)) {
8186                 wpa_printf(MSG_INFO, "nl80211: Vendor command: insufficient buffer space for reply");
8187                 return NL_SKIP;
8188         }
8189
8190         nla_for_each_nested(nl, nl_vendor_reply, rem) {
8191                 wpabuf_put_data(buf, nla_data(nl), nla_len(nl));
8192         }
8193
8194         return NL_SKIP;
8195 }
8196
8197
8198 static int nl80211_vendor_cmd(void *priv, unsigned int vendor_id,
8199                               unsigned int subcmd, const u8 *data,
8200                               size_t data_len, struct wpabuf *buf)
8201 {
8202         struct i802_bss *bss = priv;
8203         struct wpa_driver_nl80211_data *drv = bss->drv;
8204         struct nl_msg *msg;
8205         int ret;
8206
8207 #ifdef CONFIG_TESTING_OPTIONS
8208         if (vendor_id == 0xffffffff) {
8209                 msg = nlmsg_alloc();
8210                 if (!msg)
8211                         return -ENOMEM;
8212
8213                 nl80211_cmd(drv, msg, 0, subcmd);
8214                 if (nlmsg_append(msg, (void *) data, data_len, NLMSG_ALIGNTO) <
8215                     0)
8216                         goto fail;
8217                 ret = send_and_recv_msgs(drv, msg, cmd_reply_handler, buf);
8218                 if (ret)
8219                         wpa_printf(MSG_DEBUG, "nl80211: command failed err=%d",
8220                                    ret);
8221                 return ret;
8222         }
8223 #endif /* CONFIG_TESTING_OPTIONS */
8224
8225         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_VENDOR)) ||
8226             nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, vendor_id) ||
8227             nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, subcmd) ||
8228             (data &&
8229              nla_put(msg, NL80211_ATTR_VENDOR_DATA, data_len, data)))
8230                 goto fail;
8231
8232         ret = send_and_recv_msgs(drv, msg, vendor_reply_handler, buf);
8233         if (ret)
8234                 wpa_printf(MSG_DEBUG, "nl80211: vendor command failed err=%d",
8235                            ret);
8236         return ret;
8237
8238 fail:
8239         nlmsg_free(msg);
8240         return -ENOBUFS;
8241 }
8242
8243
8244 static int nl80211_set_qos_map(void *priv, const u8 *qos_map_set,
8245                                u8 qos_map_set_len)
8246 {
8247         struct i802_bss *bss = priv;
8248         struct wpa_driver_nl80211_data *drv = bss->drv;
8249         struct nl_msg *msg;
8250         int ret;
8251
8252         wpa_hexdump(MSG_DEBUG, "nl80211: Setting QoS Map",
8253                     qos_map_set, qos_map_set_len);
8254
8255         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_SET_QOS_MAP)) ||
8256             nla_put(msg, NL80211_ATTR_QOS_MAP, qos_map_set_len, qos_map_set)) {
8257                 nlmsg_free(msg);
8258                 return -ENOBUFS;
8259         }
8260
8261         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8262         if (ret)
8263                 wpa_printf(MSG_DEBUG, "nl80211: Setting QoS Map failed");
8264
8265         return ret;
8266 }
8267
8268
8269 static int nl80211_set_wowlan(void *priv,
8270                               const struct wowlan_triggers *triggers)
8271 {
8272         struct i802_bss *bss = priv;
8273         struct wpa_driver_nl80211_data *drv = bss->drv;
8274         struct nl_msg *msg;
8275         struct nlattr *wowlan_triggers;
8276         int ret;
8277
8278         wpa_printf(MSG_DEBUG, "nl80211: Setting wowlan");
8279
8280         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_SET_WOWLAN)) ||
8281             !(wowlan_triggers = nla_nest_start(msg,
8282                                                NL80211_ATTR_WOWLAN_TRIGGERS)) ||
8283             (triggers->any &&
8284              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
8285             (triggers->disconnect &&
8286              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
8287             (triggers->magic_pkt &&
8288              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
8289             (triggers->gtk_rekey_failure &&
8290              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
8291             (triggers->eap_identity_req &&
8292              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
8293             (triggers->four_way_handshake &&
8294              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
8295             (triggers->rfkill_release &&
8296              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))) {
8297                 nlmsg_free(msg);
8298                 return -ENOBUFS;
8299         }
8300
8301         nla_nest_end(msg, wowlan_triggers);
8302
8303         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8304         if (ret)
8305                 wpa_printf(MSG_DEBUG, "nl80211: Setting wowlan failed");
8306
8307         return ret;
8308 }
8309
8310
8311 #ifdef CONFIG_DRIVER_NL80211_QCA
8312 static int nl80211_roaming(void *priv, int allowed, const u8 *bssid)
8313 {
8314         struct i802_bss *bss = priv;
8315         struct wpa_driver_nl80211_data *drv = bss->drv;
8316         struct nl_msg *msg;
8317         struct nlattr *params;
8318
8319         wpa_printf(MSG_DEBUG, "nl80211: Roaming policy: allowed=%d", allowed);
8320
8321         if (!drv->roaming_vendor_cmd_avail) {
8322                 wpa_printf(MSG_DEBUG,
8323                            "nl80211: Ignore roaming policy change since driver does not provide command for setting it");
8324                 return -1;
8325         }
8326
8327         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
8328             nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
8329             nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
8330                         QCA_NL80211_VENDOR_SUBCMD_ROAMING) ||
8331             !(params = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
8332             nla_put_u32(msg, QCA_WLAN_VENDOR_ATTR_ROAMING_POLICY,
8333                         allowed ? QCA_ROAMING_ALLOWED_WITHIN_ESS :
8334                         QCA_ROAMING_NOT_ALLOWED) ||
8335             (bssid &&
8336              nla_put(msg, QCA_WLAN_VENDOR_ATTR_MAC_ADDR, ETH_ALEN, bssid))) {
8337                 nlmsg_free(msg);
8338                 return -1;
8339         }
8340         nla_nest_end(msg, params);
8341
8342         return send_and_recv_msgs(drv, msg, NULL, NULL);
8343 }
8344 #endif /* CONFIG_DRIVER_NL80211_QCA */
8345
8346
8347 static int nl80211_set_mac_addr(void *priv, const u8 *addr)
8348 {
8349         struct i802_bss *bss = priv;
8350         struct wpa_driver_nl80211_data *drv = bss->drv;
8351         int new_addr = addr != NULL;
8352
8353         if (TEST_FAIL())
8354                 return -1;
8355
8356         if (!addr)
8357                 addr = drv->perm_addr;
8358
8359         if (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 0) < 0)
8360                 return -1;
8361
8362         if (linux_set_ifhwaddr(drv->global->ioctl_sock, bss->ifname, addr) < 0)
8363         {
8364                 wpa_printf(MSG_DEBUG,
8365                            "nl80211: failed to set_mac_addr for %s to " MACSTR,
8366                            bss->ifname, MAC2STR(addr));
8367                 if (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname,
8368                                           1) < 0) {
8369                         wpa_printf(MSG_DEBUG,
8370                                    "nl80211: Could not restore interface UP after failed set_mac_addr");
8371                 }
8372                 return -1;
8373         }
8374
8375         wpa_printf(MSG_DEBUG, "nl80211: set_mac_addr for %s to " MACSTR,
8376                    bss->ifname, MAC2STR(addr));
8377         drv->addr_changed = new_addr;
8378         os_memcpy(bss->addr, addr, ETH_ALEN);
8379
8380         if (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 1) < 0)
8381         {
8382                 wpa_printf(MSG_DEBUG,
8383                            "nl80211: Could not restore interface UP after set_mac_addr");
8384         }
8385
8386         return 0;
8387 }
8388
8389
8390 #ifdef CONFIG_MESH
8391
8392 static int wpa_driver_nl80211_init_mesh(void *priv)
8393 {
8394         if (wpa_driver_nl80211_set_mode(priv, NL80211_IFTYPE_MESH_POINT)) {
8395                 wpa_printf(MSG_INFO,
8396                            "nl80211: Failed to set interface into mesh mode");
8397                 return -1;
8398         }
8399         return 0;
8400 }
8401
8402
8403 static int nl80211_put_mesh_id(struct nl_msg *msg, const u8 *mesh_id,
8404                                size_t mesh_id_len)
8405 {
8406         if (mesh_id) {
8407                 wpa_hexdump_ascii(MSG_DEBUG, "  * Mesh ID (SSID)",
8408                                   mesh_id, mesh_id_len);
8409                 return nla_put(msg, NL80211_ATTR_MESH_ID, mesh_id_len, mesh_id);
8410         }
8411
8412         return 0;
8413 }
8414
8415
8416 static int nl80211_put_mesh_config(struct nl_msg *msg,
8417                                    struct wpa_driver_mesh_bss_params *params)
8418 {
8419         struct nlattr *container;
8420
8421         container = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
8422         if (!container)
8423                 return -1;
8424
8425         if (nla_put_u32(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
8426                         !!(params->flags &
8427                            WPA_DRIVER_MESH_CONF_FLAG_AUTO_PLINKS)) ||
8428             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
8429                         params->max_peer_links))
8430                 return -1;
8431
8432         /*
8433          * Set NL80211_MESHCONF_PLINK_TIMEOUT even if user mpm is used because
8434          * the timer could disconnect stations even in that case.
8435          */
8436         if (nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
8437                         params->peer_link_timeout)) {
8438                 wpa_printf(MSG_ERROR, "nl80211: Failed to set PLINK_TIMEOUT");
8439                 return -1;
8440         }
8441
8442         nla_nest_end(msg, container);
8443
8444         return 0;
8445 }
8446
8447
8448 static int nl80211_join_mesh(struct i802_bss *bss,
8449                              struct wpa_driver_mesh_join_params *params)
8450 {
8451         struct wpa_driver_nl80211_data *drv = bss->drv;
8452         struct nl_msg *msg;
8453         struct nlattr *container;
8454         int ret = -1;
8455
8456         wpa_printf(MSG_DEBUG, "nl80211: mesh join (ifindex=%d)", drv->ifindex);
8457         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_JOIN_MESH);
8458         if (!msg ||
8459             nl80211_put_freq_params(msg, &params->freq) ||
8460             nl80211_put_basic_rates(msg, params->basic_rates) ||
8461             nl80211_put_mesh_id(msg, params->meshid, params->meshid_len) ||
8462             nl80211_put_beacon_int(msg, params->beacon_int) ||
8463             nl80211_put_dtim_period(msg, params->dtim_period))
8464                 goto fail;
8465
8466         wpa_printf(MSG_DEBUG, "  * flags=%08X", params->flags);
8467
8468         container = nla_nest_start(msg, NL80211_ATTR_MESH_SETUP);
8469         if (!container)
8470                 goto fail;
8471
8472         if (params->ies) {
8473                 wpa_hexdump(MSG_DEBUG, "  * IEs", params->ies, params->ie_len);
8474                 if (nla_put(msg, NL80211_MESH_SETUP_IE, params->ie_len,
8475                             params->ies))
8476                         goto fail;
8477         }
8478         /* WPA_DRIVER_MESH_FLAG_OPEN_AUTH is treated as default by nl80211 */
8479         if (params->flags & WPA_DRIVER_MESH_FLAG_SAE_AUTH) {
8480                 if (nla_put_u8(msg, NL80211_MESH_SETUP_AUTH_PROTOCOL, 0x1) ||
8481                     nla_put_flag(msg, NL80211_MESH_SETUP_USERSPACE_AUTH))
8482                         goto fail;
8483         }
8484         if ((params->flags & WPA_DRIVER_MESH_FLAG_AMPE) &&
8485             nla_put_flag(msg, NL80211_MESH_SETUP_USERSPACE_AMPE))
8486                 goto fail;
8487         if ((params->flags & WPA_DRIVER_MESH_FLAG_USER_MPM) &&
8488             nla_put_flag(msg, NL80211_MESH_SETUP_USERSPACE_MPM))
8489                 goto fail;
8490         nla_nest_end(msg, container);
8491
8492         if (nl80211_put_mesh_config(msg, &params->conf) < 0)
8493                 goto fail;
8494
8495         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8496         msg = NULL;
8497         if (ret) {
8498                 wpa_printf(MSG_DEBUG, "nl80211: mesh join failed: ret=%d (%s)",
8499                            ret, strerror(-ret));
8500                 goto fail;
8501         }
8502         ret = 0;
8503         drv->assoc_freq = bss->freq = params->freq.freq;
8504         wpa_printf(MSG_DEBUG, "nl80211: mesh join request send successfully");
8505
8506 fail:
8507         nlmsg_free(msg);
8508         return ret;
8509 }
8510
8511
8512 static int
8513 wpa_driver_nl80211_join_mesh(void *priv,
8514                              struct wpa_driver_mesh_join_params *params)
8515 {
8516         struct i802_bss *bss = priv;
8517         int ret, timeout;
8518
8519         timeout = params->conf.peer_link_timeout;
8520
8521         /* Disable kernel inactivity timer */
8522         if (params->flags & WPA_DRIVER_MESH_FLAG_USER_MPM)
8523                 params->conf.peer_link_timeout = 0;
8524
8525         ret = nl80211_join_mesh(bss, params);
8526         if (ret == -EINVAL && params->conf.peer_link_timeout == 0) {
8527                 wpa_printf(MSG_DEBUG,
8528                            "nl80211: Mesh join retry for peer_link_timeout");
8529                 /*
8530                  * Old kernel does not support setting
8531                  * NL80211_MESHCONF_PLINK_TIMEOUT to zero, so set 60 seconds
8532                  * into future from peer_link_timeout.
8533                  */
8534                 params->conf.peer_link_timeout = timeout + 60;
8535                 ret = nl80211_join_mesh(priv, params);
8536         }
8537
8538         params->conf.peer_link_timeout = timeout;
8539         return ret;
8540 }
8541
8542
8543 static int wpa_driver_nl80211_leave_mesh(void *priv)
8544 {
8545         struct i802_bss *bss = priv;
8546         struct wpa_driver_nl80211_data *drv = bss->drv;
8547         struct nl_msg *msg;
8548         int ret;
8549
8550         wpa_printf(MSG_DEBUG, "nl80211: mesh leave (ifindex=%d)", drv->ifindex);
8551         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_LEAVE_MESH);
8552         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8553         if (ret) {
8554                 wpa_printf(MSG_DEBUG, "nl80211: mesh leave failed: ret=%d (%s)",
8555                            ret, strerror(-ret));
8556         } else {
8557                 wpa_printf(MSG_DEBUG,
8558                            "nl80211: mesh leave request send successfully");
8559         }
8560
8561         if (wpa_driver_nl80211_set_mode(drv->first_bss,
8562                                         NL80211_IFTYPE_STATION)) {
8563                 wpa_printf(MSG_INFO,
8564                            "nl80211: Failed to set interface into station mode");
8565         }
8566         return ret;
8567 }
8568
8569 #endif /* CONFIG_MESH */
8570
8571
8572 static int wpa_driver_br_add_ip_neigh(void *priv, u8 version,
8573                                       const u8 *ipaddr, int prefixlen,
8574                                       const u8 *addr)
8575 {
8576 #ifdef CONFIG_LIBNL3_ROUTE
8577         struct i802_bss *bss = priv;
8578         struct wpa_driver_nl80211_data *drv = bss->drv;
8579         struct rtnl_neigh *rn;
8580         struct nl_addr *nl_ipaddr = NULL;
8581         struct nl_addr *nl_lladdr = NULL;
8582         int family, addrsize;
8583         int res;
8584
8585         if (!ipaddr || prefixlen == 0 || !addr)
8586                 return -EINVAL;
8587
8588         if (bss->br_ifindex == 0) {
8589                 wpa_printf(MSG_DEBUG,
8590                            "nl80211: bridge must be set before adding an ip neigh to it");
8591                 return -1;
8592         }
8593
8594         if (!drv->rtnl_sk) {
8595                 wpa_printf(MSG_DEBUG,
8596                            "nl80211: nl_sock for NETLINK_ROUTE is not initialized");
8597                 return -1;
8598         }
8599
8600         if (version == 4) {
8601                 family = AF_INET;
8602                 addrsize = 4;
8603         } else if (version == 6) {
8604                 family = AF_INET6;
8605                 addrsize = 16;
8606         } else {
8607                 return -EINVAL;
8608         }
8609
8610         rn = rtnl_neigh_alloc();
8611         if (rn == NULL)
8612                 return -ENOMEM;
8613
8614         /* set the destination ip address for neigh */
8615         nl_ipaddr = nl_addr_build(family, (void *) ipaddr, addrsize);
8616         if (nl_ipaddr == NULL) {
8617                 wpa_printf(MSG_DEBUG, "nl80211: nl_ipaddr build failed");
8618                 res = -ENOMEM;
8619                 goto errout;
8620         }
8621         nl_addr_set_prefixlen(nl_ipaddr, prefixlen);
8622         res = rtnl_neigh_set_dst(rn, nl_ipaddr);
8623         if (res) {
8624                 wpa_printf(MSG_DEBUG,
8625                            "nl80211: neigh set destination addr failed");
8626                 goto errout;
8627         }
8628
8629         /* set the corresponding lladdr for neigh */
8630         nl_lladdr = nl_addr_build(AF_BRIDGE, (u8 *) addr, ETH_ALEN);
8631         if (nl_lladdr == NULL) {
8632                 wpa_printf(MSG_DEBUG, "nl80211: neigh set lladdr failed");
8633                 res = -ENOMEM;
8634                 goto errout;
8635         }
8636         rtnl_neigh_set_lladdr(rn, nl_lladdr);
8637
8638         rtnl_neigh_set_ifindex(rn, bss->br_ifindex);
8639         rtnl_neigh_set_state(rn, NUD_PERMANENT);
8640
8641         res = rtnl_neigh_add(drv->rtnl_sk, rn, NLM_F_CREATE);
8642         if (res) {
8643                 wpa_printf(MSG_DEBUG,
8644                            "nl80211: Adding bridge ip neigh failed: %s",
8645                            strerror(errno));
8646         }
8647 errout:
8648         if (nl_lladdr)
8649                 nl_addr_put(nl_lladdr);
8650         if (nl_ipaddr)
8651                 nl_addr_put(nl_ipaddr);
8652         if (rn)
8653                 rtnl_neigh_put(rn);
8654         return res;
8655 #else /* CONFIG_LIBNL3_ROUTE */
8656         return -1;
8657 #endif /* CONFIG_LIBNL3_ROUTE */
8658 }
8659
8660
8661 static int wpa_driver_br_delete_ip_neigh(void *priv, u8 version,
8662                                          const u8 *ipaddr)
8663 {
8664 #ifdef CONFIG_LIBNL3_ROUTE
8665         struct i802_bss *bss = priv;
8666         struct wpa_driver_nl80211_data *drv = bss->drv;
8667         struct rtnl_neigh *rn;
8668         struct nl_addr *nl_ipaddr;
8669         int family, addrsize;
8670         int res;
8671
8672         if (!ipaddr)
8673                 return -EINVAL;
8674
8675         if (version == 4) {
8676                 family = AF_INET;
8677                 addrsize = 4;
8678         } else if (version == 6) {
8679                 family = AF_INET6;
8680                 addrsize = 16;
8681         } else {
8682                 return -EINVAL;
8683         }
8684
8685         if (bss->br_ifindex == 0) {
8686                 wpa_printf(MSG_DEBUG,
8687                            "nl80211: bridge must be set to delete an ip neigh");
8688                 return -1;
8689         }
8690
8691         if (!drv->rtnl_sk) {
8692                 wpa_printf(MSG_DEBUG,
8693                            "nl80211: nl_sock for NETLINK_ROUTE is not initialized");
8694                 return -1;
8695         }
8696
8697         rn = rtnl_neigh_alloc();
8698         if (rn == NULL)
8699                 return -ENOMEM;
8700
8701         /* set the destination ip address for neigh */
8702         nl_ipaddr = nl_addr_build(family, (void *) ipaddr, addrsize);
8703         if (nl_ipaddr == NULL) {
8704                 wpa_printf(MSG_DEBUG, "nl80211: nl_ipaddr build failed");
8705                 res = -ENOMEM;
8706                 goto errout;
8707         }
8708         res = rtnl_neigh_set_dst(rn, nl_ipaddr);
8709         if (res) {
8710                 wpa_printf(MSG_DEBUG,
8711                            "nl80211: neigh set destination addr failed");
8712                 goto errout;
8713         }
8714
8715         rtnl_neigh_set_ifindex(rn, bss->br_ifindex);
8716
8717         res = rtnl_neigh_delete(drv->rtnl_sk, rn, 0);
8718         if (res) {
8719                 wpa_printf(MSG_DEBUG,
8720                            "nl80211: Deleting bridge ip neigh failed: %s",
8721                            strerror(errno));
8722         }
8723 errout:
8724         if (nl_ipaddr)
8725                 nl_addr_put(nl_ipaddr);
8726         if (rn)
8727                 rtnl_neigh_put(rn);
8728         return res;
8729 #else /* CONFIG_LIBNL3_ROUTE */
8730         return -1;
8731 #endif /* CONFIG_LIBNL3_ROUTE */
8732 }
8733
8734
8735 static int linux_write_system_file(const char *path, unsigned int val)
8736 {
8737         char buf[50];
8738         int fd, len;
8739
8740         len = os_snprintf(buf, sizeof(buf), "%u\n", val);
8741         if (os_snprintf_error(sizeof(buf), len))
8742                 return -1;
8743
8744         fd = open(path, O_WRONLY);
8745         if (fd < 0)
8746                 return -1;
8747
8748         if (write(fd, buf, len) < 0) {
8749                 wpa_printf(MSG_DEBUG,
8750                            "nl80211: Failed to write Linux system file: %s with the value of %d",
8751                            path, val);
8752                 close(fd);
8753                 return -1;
8754         }
8755         close(fd);
8756
8757         return 0;
8758 }
8759
8760
8761 static const char * drv_br_port_attr_str(enum drv_br_port_attr attr)
8762 {
8763         switch (attr) {
8764         case DRV_BR_PORT_ATTR_PROXYARP:
8765                 return "proxyarp_wifi";
8766         case DRV_BR_PORT_ATTR_HAIRPIN_MODE:
8767                 return "hairpin_mode";
8768         }
8769
8770         return NULL;
8771 }
8772
8773
8774 static int wpa_driver_br_port_set_attr(void *priv, enum drv_br_port_attr attr,
8775                                        unsigned int val)
8776 {
8777         struct i802_bss *bss = priv;
8778         char path[128];
8779         const char *attr_txt;
8780
8781         attr_txt = drv_br_port_attr_str(attr);
8782         if (attr_txt == NULL)
8783                 return -EINVAL;
8784
8785         os_snprintf(path, sizeof(path), "/sys/class/net/%s/brport/%s",
8786                     bss->ifname, attr_txt);
8787
8788         if (linux_write_system_file(path, val))
8789                 return -1;
8790
8791         return 0;
8792 }
8793
8794
8795 static const char * drv_br_net_param_str(enum drv_br_net_param param)
8796 {
8797         switch (param) {
8798         case DRV_BR_NET_PARAM_GARP_ACCEPT:
8799                 return "arp_accept";
8800         default:
8801                 return NULL;
8802         }
8803 }
8804
8805
8806 static int wpa_driver_br_set_net_param(void *priv, enum drv_br_net_param param,
8807                                        unsigned int val)
8808 {
8809         struct i802_bss *bss = priv;
8810         char path[128];
8811         const char *param_txt;
8812         int ip_version = 4;
8813
8814         if (param == DRV_BR_MULTICAST_SNOOPING) {
8815                 os_snprintf(path, sizeof(path),
8816                             "/sys/devices/virtual/net/%s/bridge/multicast_snooping",
8817                             bss->brname);
8818                 goto set_val;
8819         }
8820
8821         param_txt = drv_br_net_param_str(param);
8822         if (param_txt == NULL)
8823                 return -EINVAL;
8824
8825         switch (param) {
8826                 case DRV_BR_NET_PARAM_GARP_ACCEPT:
8827                         ip_version = 4;
8828                         break;
8829                 default:
8830                         return -EINVAL;
8831         }
8832
8833         os_snprintf(path, sizeof(path), "/proc/sys/net/ipv%d/conf/%s/%s",
8834                     ip_version, bss->brname, param_txt);
8835
8836 set_val:
8837         if (linux_write_system_file(path, val))
8838                 return -1;
8839
8840         return 0;
8841 }
8842
8843
8844 #ifdef CONFIG_DRIVER_NL80211_QCA
8845
8846 static int hw_mode_to_qca_acs(enum hostapd_hw_mode hw_mode)
8847 {
8848         switch (hw_mode) {
8849         case HOSTAPD_MODE_IEEE80211B:
8850                 return QCA_ACS_MODE_IEEE80211B;
8851         case HOSTAPD_MODE_IEEE80211G:
8852                 return QCA_ACS_MODE_IEEE80211G;
8853         case HOSTAPD_MODE_IEEE80211A:
8854                 return QCA_ACS_MODE_IEEE80211A;
8855         case HOSTAPD_MODE_IEEE80211AD:
8856                 return QCA_ACS_MODE_IEEE80211AD;
8857         case HOSTAPD_MODE_IEEE80211ANY:
8858                 return QCA_ACS_MODE_IEEE80211ANY;
8859         default:
8860                 return -1;
8861         }
8862 }
8863
8864
8865 static int add_acs_freq_list(struct nl_msg *msg, const int *freq_list)
8866 {
8867         int i, len, ret;
8868         u32 *freqs;
8869
8870         if (!freq_list)
8871                 return 0;
8872         len = int_array_len(freq_list);
8873         freqs = os_malloc(sizeof(u32) * len);
8874         if (!freqs)
8875                 return -1;
8876         for (i = 0; i < len; i++)
8877                 freqs[i] = freq_list[i];
8878         ret = nla_put(msg, QCA_WLAN_VENDOR_ATTR_ACS_FREQ_LIST,
8879                       sizeof(u32) * len, freqs);
8880         os_free(freqs);
8881         return ret;
8882 }
8883
8884
8885 static int wpa_driver_do_acs(void *priv, struct drv_acs_params *params)
8886 {
8887         struct i802_bss *bss = priv;
8888         struct wpa_driver_nl80211_data *drv = bss->drv;
8889         struct nl_msg *msg;
8890         struct nlattr *data;
8891         int ret;
8892         int mode;
8893
8894         mode = hw_mode_to_qca_acs(params->hw_mode);
8895         if (mode < 0)
8896                 return -1;
8897
8898         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
8899             nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
8900             nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
8901                         QCA_NL80211_VENDOR_SUBCMD_DO_ACS) ||
8902             !(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
8903             nla_put_u8(msg, QCA_WLAN_VENDOR_ATTR_ACS_HW_MODE, mode) ||
8904             (params->ht_enabled &&
8905              nla_put_flag(msg, QCA_WLAN_VENDOR_ATTR_ACS_HT_ENABLED)) ||
8906             (params->ht40_enabled &&
8907              nla_put_flag(msg, QCA_WLAN_VENDOR_ATTR_ACS_HT40_ENABLED)) ||
8908             (params->vht_enabled &&
8909              nla_put_flag(msg, QCA_WLAN_VENDOR_ATTR_ACS_VHT_ENABLED)) ||
8910             nla_put_u16(msg, QCA_WLAN_VENDOR_ATTR_ACS_CHWIDTH,
8911                         params->ch_width) ||
8912             (params->ch_list_len &&
8913              nla_put(msg, QCA_WLAN_VENDOR_ATTR_ACS_CH_LIST, params->ch_list_len,
8914                      params->ch_list)) ||
8915             add_acs_freq_list(msg, params->freq_list)) {
8916                 nlmsg_free(msg);
8917                 return -ENOBUFS;
8918         }
8919         nla_nest_end(msg, data);
8920
8921         wpa_printf(MSG_DEBUG,
8922                    "nl80211: ACS Params: HW_MODE: %d HT: %d HT40: %d VHT: %d BW: %d CH_LIST_LEN: %u",
8923                    params->hw_mode, params->ht_enabled, params->ht40_enabled,
8924                    params->vht_enabled, params->ch_width, params->ch_list_len);
8925
8926         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8927         if (ret) {
8928                 wpa_printf(MSG_DEBUG,
8929                            "nl80211: Failed to invoke driver ACS function: %s",
8930                            strerror(errno));
8931         }
8932         return ret;
8933 }
8934
8935
8936 static int nl80211_set_band(void *priv, enum set_band band)
8937 {
8938         struct i802_bss *bss = priv;
8939         struct wpa_driver_nl80211_data *drv = bss->drv;
8940         struct nl_msg *msg;
8941         struct nlattr *data;
8942         int ret;
8943         enum qca_set_band qca_band;
8944
8945         if (!drv->setband_vendor_cmd_avail)
8946                 return -1;
8947
8948         switch (band) {
8949         case WPA_SETBAND_AUTO:
8950                 qca_band = QCA_SETBAND_AUTO;
8951                 break;
8952         case WPA_SETBAND_5G:
8953                 qca_band = QCA_SETBAND_5G;
8954                 break;
8955         case WPA_SETBAND_2G:
8956                 qca_band = QCA_SETBAND_2G;
8957                 break;
8958         default:
8959                 return -1;
8960         }
8961
8962         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
8963             nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
8964             nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
8965                         QCA_NL80211_VENDOR_SUBCMD_SETBAND) ||
8966             !(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
8967             nla_put_u32(msg, QCA_WLAN_VENDOR_ATTR_SETBAND_VALUE, qca_band)) {
8968                 nlmsg_free(msg);
8969                 return -ENOBUFS;
8970         }
8971         nla_nest_end(msg, data);
8972
8973         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8974         if (ret) {
8975                 wpa_printf(MSG_DEBUG,
8976                            "nl80211: Driver setband function failed: %s",
8977                            strerror(errno));
8978         }
8979         return ret;
8980 }
8981
8982
8983 struct nl80211_pcl {
8984         unsigned int num;
8985         unsigned int *freq_list;
8986 };
8987
8988 static int preferred_freq_info_handler(struct nl_msg *msg, void *arg)
8989 {
8990         struct nlattr *tb[NL80211_ATTR_MAX + 1];
8991         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
8992         struct nl80211_pcl *param = arg;
8993         struct nlattr *nl_vend, *attr;
8994         enum qca_iface_type iface_type;
8995         struct nlattr *tb_vendor[QCA_WLAN_VENDOR_ATTR_MAX + 1];
8996         unsigned int num, max_num;
8997         u32 *freqs;
8998
8999         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
9000                   genlmsg_attrlen(gnlh, 0), NULL);
9001
9002         nl_vend = tb[NL80211_ATTR_VENDOR_DATA];
9003         if (!nl_vend)
9004                 return NL_SKIP;
9005
9006         nla_parse(tb_vendor, QCA_WLAN_VENDOR_ATTR_MAX,
9007                   nla_data(nl_vend), nla_len(nl_vend), NULL);
9008
9009         attr = tb_vendor[
9010                 QCA_WLAN_VENDOR_ATTR_GET_PREFERRED_FREQ_LIST_IFACE_TYPE];
9011         if (!attr) {
9012                 wpa_printf(MSG_ERROR, "nl80211: iface_type couldn't be found");
9013                 param->num = 0;
9014                 return NL_SKIP;
9015         }
9016
9017         iface_type = (enum qca_iface_type) nla_get_u32(attr);
9018         wpa_printf(MSG_DEBUG, "nl80211: Driver returned iface_type=%d",
9019                    iface_type);
9020
9021         attr = tb_vendor[QCA_WLAN_VENDOR_ATTR_GET_PREFERRED_FREQ_LIST];
9022         if (!attr) {
9023                 wpa_printf(MSG_ERROR,
9024                            "nl80211: preferred_freq_list couldn't be found");
9025                 param->num = 0;
9026                 return NL_SKIP;
9027         }
9028
9029         /*
9030          * param->num has the maximum number of entries for which there
9031          * is room in the freq_list provided by the caller.
9032          */
9033         freqs = nla_data(attr);
9034         max_num = nla_len(attr) / sizeof(u32);
9035         if (max_num > param->num)
9036                 max_num = param->num;
9037         for (num = 0; num < max_num; num++)
9038                 param->freq_list[num] = freqs[num];
9039         param->num = num;
9040
9041         return NL_SKIP;
9042 }
9043
9044
9045 static int nl80211_get_pref_freq_list(void *priv,
9046                                       enum wpa_driver_if_type if_type,
9047                                       unsigned int *num,
9048                                       unsigned int *freq_list)
9049 {
9050         struct i802_bss *bss = priv;
9051         struct wpa_driver_nl80211_data *drv = bss->drv;
9052         struct nl_msg *msg;
9053         int ret;
9054         unsigned int i;
9055         struct nlattr *params;
9056         struct nl80211_pcl param;
9057         enum qca_iface_type iface_type;
9058
9059         if (!drv->get_pref_freq_list)
9060                 return -1;
9061
9062         switch (if_type) {
9063         case WPA_IF_STATION:
9064                 iface_type = QCA_IFACE_TYPE_STA;
9065                 break;
9066         case WPA_IF_AP_BSS:
9067                 iface_type = QCA_IFACE_TYPE_AP;
9068                 break;
9069         case WPA_IF_P2P_GO:
9070                 iface_type = QCA_IFACE_TYPE_P2P_GO;
9071                 break;
9072         case WPA_IF_P2P_CLIENT:
9073                 iface_type = QCA_IFACE_TYPE_P2P_CLIENT;
9074                 break;
9075         case WPA_IF_IBSS:
9076                 iface_type = QCA_IFACE_TYPE_IBSS;
9077                 break;
9078         case WPA_IF_TDLS:
9079                 iface_type = QCA_IFACE_TYPE_TDLS;
9080                 break;
9081         default:
9082                 return -1;
9083         }
9084
9085         param.num = *num;
9086         param.freq_list = freq_list;
9087
9088         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
9089             nla_put_u32(msg, NL80211_ATTR_IFINDEX, drv->ifindex) ||
9090             nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
9091             nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
9092                         QCA_NL80211_VENDOR_SUBCMD_GET_PREFERRED_FREQ_LIST) ||
9093             !(params = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
9094             nla_put_u32(msg,
9095                         QCA_WLAN_VENDOR_ATTR_GET_PREFERRED_FREQ_LIST_IFACE_TYPE,
9096                         iface_type)) {
9097                 wpa_printf(MSG_ERROR,
9098                            "%s: err in adding vendor_cmd and vendor_data",
9099                            __func__);
9100                 nlmsg_free(msg);
9101                 return -1;
9102         }
9103         nla_nest_end(msg, params);
9104
9105         os_memset(freq_list, 0, *num * sizeof(freq_list[0]));
9106         ret = send_and_recv_msgs(drv, msg, preferred_freq_info_handler, &param);
9107         if (ret) {
9108                 wpa_printf(MSG_ERROR,
9109                            "%s: err in send_and_recv_msgs", __func__);
9110                 return ret;
9111         }
9112
9113         *num = param.num;
9114
9115         for (i = 0; i < *num; i++) {
9116                 wpa_printf(MSG_DEBUG, "nl80211: preferred_channel_list[%d]=%d",
9117                            i, freq_list[i]);
9118         }
9119
9120         return 0;
9121 }
9122
9123
9124 static int nl80211_set_prob_oper_freq(void *priv, unsigned int freq)
9125 {
9126         struct i802_bss *bss = priv;
9127         struct wpa_driver_nl80211_data *drv = bss->drv;
9128         struct nl_msg *msg;
9129         int ret;
9130         struct nlattr *params;
9131
9132         if (!drv->set_prob_oper_freq)
9133                 return -1;
9134
9135         wpa_printf(MSG_DEBUG,
9136                    "nl80211: Set P2P probable operating freq %u for ifindex %d",
9137                    freq, bss->ifindex);
9138
9139         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
9140             nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
9141             nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
9142                         QCA_NL80211_VENDOR_SUBCMD_SET_PROBABLE_OPER_CHANNEL) ||
9143             !(params = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
9144             nla_put_u32(msg,
9145                         QCA_WLAN_VENDOR_ATTR_PROBABLE_OPER_CHANNEL_IFACE_TYPE,
9146                         QCA_IFACE_TYPE_P2P_CLIENT) ||
9147             nla_put_u32(msg,
9148                         QCA_WLAN_VENDOR_ATTR_PROBABLE_OPER_CHANNEL_FREQ,
9149                         freq)) {
9150                 wpa_printf(MSG_ERROR,
9151                            "%s: err in adding vendor_cmd and vendor_data",
9152                            __func__);
9153                 nlmsg_free(msg);
9154                 return -1;
9155         }
9156         nla_nest_end(msg, params);
9157
9158         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
9159         msg = NULL;
9160         if (ret) {
9161                 wpa_printf(MSG_ERROR, "%s: err in send_and_recv_msgs",
9162                            __func__);
9163                 return ret;
9164         }
9165         nlmsg_free(msg);
9166         return 0;
9167 }
9168
9169
9170 static int nl80211_p2p_lo_start(void *priv, unsigned int freq,
9171                                 unsigned int period, unsigned int interval,
9172                                 unsigned int count, const u8 *device_types,
9173                                 size_t dev_types_len,
9174                                 const u8 *ies, size_t ies_len)
9175 {
9176         struct i802_bss *bss = priv;
9177         struct wpa_driver_nl80211_data *drv = bss->drv;
9178         struct nl_msg *msg;
9179         struct nlattr *container;
9180         int ret;
9181
9182         wpa_printf(MSG_DEBUG,
9183                    "nl80211: Start P2P Listen offload: freq=%u, period=%u, interval=%u, count=%u",
9184                    freq, period, interval, count);
9185
9186         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_P2P_LISTEN_OFFLOAD))
9187                 return -1;
9188
9189         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
9190             nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
9191             nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
9192                         QCA_NL80211_VENDOR_SUBCMD_P2P_LISTEN_OFFLOAD_START))
9193                 goto fail;
9194
9195         container = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
9196         if (!container)
9197                 goto fail;
9198
9199         if (nla_put_u32(msg, QCA_WLAN_VENDOR_ATTR_P2P_LISTEN_OFFLOAD_CHANNEL,
9200                         freq) ||
9201             nla_put_u32(msg, QCA_WLAN_VENDOR_ATTR_P2P_LISTEN_OFFLOAD_PERIOD,
9202                         period) ||
9203             nla_put_u32(msg, QCA_WLAN_VENDOR_ATTR_P2P_LISTEN_OFFLOAD_INTERVAL,
9204                         interval) ||
9205             nla_put_u32(msg, QCA_WLAN_VENDOR_ATTR_P2P_LISTEN_OFFLOAD_COUNT,
9206                         count) ||
9207             nla_put(msg, QCA_WLAN_VENDOR_ATTR_P2P_LISTEN_OFFLOAD_DEVICE_TYPES,
9208                     dev_types_len, device_types) ||
9209             nla_put(msg, QCA_WLAN_VENDOR_ATTR_P2P_LISTEN_OFFLOAD_VENDOR_IE,
9210                     ies_len, ies))
9211                 goto fail;
9212
9213         nla_nest_end(msg, container);
9214         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
9215         msg = NULL;
9216         if (ret) {
9217                 wpa_printf(MSG_DEBUG,
9218                            "nl80211: Failed to send P2P Listen offload vendor command");
9219                 goto fail;
9220         }
9221
9222         return 0;
9223
9224 fail:
9225         nlmsg_free(msg);
9226         return -1;
9227 }
9228
9229
9230 static int nl80211_p2p_lo_stop(void *priv)
9231 {
9232         struct i802_bss *bss = priv;
9233         struct wpa_driver_nl80211_data *drv = bss->drv;
9234         struct nl_msg *msg;
9235
9236         wpa_printf(MSG_DEBUG, "nl80211: Stop P2P Listen offload");
9237
9238         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_P2P_LISTEN_OFFLOAD))
9239                 return -1;
9240
9241         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
9242             nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
9243             nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
9244                         QCA_NL80211_VENDOR_SUBCMD_P2P_LISTEN_OFFLOAD_STOP)) {
9245                 nlmsg_free(msg);
9246                 return -1;
9247         }
9248
9249         return send_and_recv_msgs(drv, msg, NULL, NULL);
9250 }
9251
9252 #endif /* CONFIG_DRIVER_NL80211_QCA */
9253
9254
9255 static int nl80211_write_to_file(const char *name, unsigned int val)
9256 {
9257         int fd, len;
9258         char tmp[128];
9259
9260         fd = open(name, O_RDWR);
9261         if (fd < 0) {
9262                 wpa_printf(MSG_ERROR, "nl80211: Failed to open %s: %s",
9263                            name, strerror(errno));
9264                 return fd;
9265         }
9266
9267         len = os_snprintf(tmp, sizeof(tmp), "%u\n", val);
9268         len = write(fd, tmp, len);
9269         if (len < 0)
9270                 wpa_printf(MSG_ERROR, "nl80211: Failed to write to %s: %s",
9271                            name, strerror(errno));
9272         close(fd);
9273
9274         return 0;
9275 }
9276
9277
9278 static int nl80211_configure_data_frame_filters(void *priv, u32 filter_flags)
9279 {
9280         struct i802_bss *bss = priv;
9281         char path[128];
9282         int ret;
9283
9284         wpa_printf(MSG_DEBUG, "nl80211: Data frame filter flags=0x%x",
9285                    filter_flags);
9286
9287         /* Configure filtering of unicast frame encrypted using GTK */
9288         ret = os_snprintf(path, sizeof(path),
9289                           "/proc/sys/net/ipv4/conf/%s/drop_unicast_in_l2_multicast",
9290                           bss->ifname);
9291         if (os_snprintf_error(sizeof(path), ret))
9292                 return -1;
9293
9294         ret = nl80211_write_to_file(path,
9295                                     !!(filter_flags &
9296                                        WPA_DATA_FRAME_FILTER_FLAG_GTK));
9297         if (ret) {
9298                 wpa_printf(MSG_ERROR,
9299                            "nl80211: Failed to set IPv4 unicast in multicast filter");
9300                 return ret;
9301         }
9302
9303         os_snprintf(path, sizeof(path),
9304                     "/proc/sys/net/ipv6/conf/%s/drop_unicast_in_l2_multicast",
9305                     bss->ifname);
9306         ret = nl80211_write_to_file(path,
9307                                     !!(filter_flags &
9308                                        WPA_DATA_FRAME_FILTER_FLAG_GTK));
9309
9310         if (ret) {
9311                 wpa_printf(MSG_ERROR,
9312                            "nl80211: Failed to set IPv6 unicast in multicast filter");
9313                 return ret;
9314         }
9315
9316         /* Configure filtering of unicast frame encrypted using GTK */
9317         os_snprintf(path, sizeof(path),
9318                     "/proc/sys/net/ipv4/conf/%s/drop_gratuitous_arp",
9319                     bss->ifname);
9320         ret = nl80211_write_to_file(path,
9321                                     !!(filter_flags &
9322                                        WPA_DATA_FRAME_FILTER_FLAG_ARP));
9323         if (ret) {
9324                 wpa_printf(MSG_ERROR,
9325                            "nl80211: Failed set gratuitous ARP filter");
9326                 return ret;
9327         }
9328
9329         /* Configure filtering of IPv6 NA frames */
9330         os_snprintf(path, sizeof(path),
9331                     "/proc/sys/net/ipv6/conf/%s/drop_unsolicited_na",
9332                     bss->ifname);
9333         ret = nl80211_write_to_file(path,
9334                                     !!(filter_flags &
9335                                        WPA_DATA_FRAME_FILTER_FLAG_NA));
9336         if (ret) {
9337                 wpa_printf(MSG_ERROR,
9338                            "nl80211: Failed to set unsolicited NA filter");
9339                 return ret;
9340         }
9341
9342         return 0;
9343 }
9344
9345
9346 static int nl80211_get_ext_capab(void *priv, enum wpa_driver_if_type type,
9347                                  const u8 **ext_capa, const u8 **ext_capa_mask,
9348                                  unsigned int *ext_capa_len)
9349 {
9350         struct i802_bss *bss = priv;
9351         struct wpa_driver_nl80211_data *drv = bss->drv;
9352         enum nl80211_iftype nlmode;
9353         unsigned int i;
9354
9355         if (!ext_capa || !ext_capa_mask || !ext_capa_len)
9356                 return -1;
9357
9358         nlmode = wpa_driver_nl80211_if_type(type);
9359
9360         /* By default, use the per-radio values */
9361         *ext_capa = drv->extended_capa;
9362         *ext_capa_mask = drv->extended_capa_mask;
9363         *ext_capa_len = drv->extended_capa_len;
9364
9365         /* Replace the default value if a per-interface type value exists */
9366         for (i = 0; i < drv->num_iface_ext_capa; i++) {
9367                 if (nlmode == drv->iface_ext_capa[i].iftype) {
9368                         *ext_capa = drv->iface_ext_capa[i].ext_capa;
9369                         *ext_capa_mask = drv->iface_ext_capa[i].ext_capa_mask;
9370                         *ext_capa_len = drv->iface_ext_capa[i].ext_capa_len;
9371                         break;
9372                 }
9373         }
9374
9375         return 0;
9376 }
9377
9378
9379 const struct wpa_driver_ops wpa_driver_nl80211_ops = {
9380         .name = "nl80211",
9381         .desc = "Linux nl80211/cfg80211",
9382         .get_bssid = wpa_driver_nl80211_get_bssid,
9383         .get_ssid = wpa_driver_nl80211_get_ssid,
9384         .set_key = driver_nl80211_set_key,
9385         .scan2 = driver_nl80211_scan2,
9386         .sched_scan = wpa_driver_nl80211_sched_scan,
9387         .stop_sched_scan = wpa_driver_nl80211_stop_sched_scan,
9388         .get_scan_results2 = wpa_driver_nl80211_get_scan_results,
9389         .abort_scan = wpa_driver_nl80211_abort_scan,
9390         .deauthenticate = driver_nl80211_deauthenticate,
9391         .authenticate = driver_nl80211_authenticate,
9392         .associate = wpa_driver_nl80211_associate,
9393         .global_init = nl80211_global_init,
9394         .global_deinit = nl80211_global_deinit,
9395         .init2 = wpa_driver_nl80211_init,
9396         .deinit = driver_nl80211_deinit,
9397         .get_capa = wpa_driver_nl80211_get_capa,
9398         .set_operstate = wpa_driver_nl80211_set_operstate,
9399         .set_supp_port = wpa_driver_nl80211_set_supp_port,
9400         .set_country = wpa_driver_nl80211_set_country,
9401         .get_country = wpa_driver_nl80211_get_country,
9402         .set_ap = wpa_driver_nl80211_set_ap,
9403         .set_acl = wpa_driver_nl80211_set_acl,
9404         .if_add = wpa_driver_nl80211_if_add,
9405         .if_remove = driver_nl80211_if_remove,
9406         .send_mlme = driver_nl80211_send_mlme,
9407         .get_hw_feature_data = nl80211_get_hw_feature_data,
9408         .sta_add = wpa_driver_nl80211_sta_add,
9409         .sta_remove = driver_nl80211_sta_remove,
9410         .hapd_send_eapol = wpa_driver_nl80211_hapd_send_eapol,
9411         .sta_set_flags = wpa_driver_nl80211_sta_set_flags,
9412         .hapd_init = i802_init,
9413         .hapd_deinit = i802_deinit,
9414         .set_wds_sta = i802_set_wds_sta,
9415         .get_seqnum = i802_get_seqnum,
9416         .flush = i802_flush,
9417         .get_inact_sec = i802_get_inact_sec,
9418         .sta_clear_stats = i802_sta_clear_stats,
9419         .set_rts = i802_set_rts,
9420         .set_frag = i802_set_frag,
9421         .set_tx_queue_params = i802_set_tx_queue_params,
9422         .set_sta_vlan = driver_nl80211_set_sta_vlan,
9423         .sta_deauth = i802_sta_deauth,
9424         .sta_disassoc = i802_sta_disassoc,
9425         .read_sta_data = driver_nl80211_read_sta_data,
9426         .set_freq = i802_set_freq,
9427         .send_action = driver_nl80211_send_action,
9428         .send_action_cancel_wait = wpa_driver_nl80211_send_action_cancel_wait,
9429         .remain_on_channel = wpa_driver_nl80211_remain_on_channel,
9430         .cancel_remain_on_channel =
9431         wpa_driver_nl80211_cancel_remain_on_channel,
9432         .probe_req_report = driver_nl80211_probe_req_report,
9433         .deinit_ap = wpa_driver_nl80211_deinit_ap,
9434         .deinit_p2p_cli = wpa_driver_nl80211_deinit_p2p_cli,
9435         .resume = wpa_driver_nl80211_resume,
9436         .signal_monitor = nl80211_signal_monitor,
9437         .signal_poll = nl80211_signal_poll,
9438         .send_frame = nl80211_send_frame,
9439         .set_param = nl80211_set_param,
9440         .get_radio_name = nl80211_get_radio_name,
9441         .add_pmkid = nl80211_add_pmkid,
9442         .remove_pmkid = nl80211_remove_pmkid,
9443         .flush_pmkid = nl80211_flush_pmkid,
9444         .set_rekey_info = nl80211_set_rekey_info,
9445         .poll_client = nl80211_poll_client,
9446         .set_p2p_powersave = nl80211_set_p2p_powersave,
9447         .start_dfs_cac = nl80211_start_radar_detection,
9448         .stop_ap = wpa_driver_nl80211_stop_ap,
9449 #ifdef CONFIG_TDLS
9450         .send_tdls_mgmt = nl80211_send_tdls_mgmt,
9451         .tdls_oper = nl80211_tdls_oper,
9452         .tdls_enable_channel_switch = nl80211_tdls_enable_channel_switch,
9453         .tdls_disable_channel_switch = nl80211_tdls_disable_channel_switch,
9454 #endif /* CONFIG_TDLS */
9455         .update_ft_ies = wpa_driver_nl80211_update_ft_ies,
9456         .get_mac_addr = wpa_driver_nl80211_get_macaddr,
9457         .get_survey = wpa_driver_nl80211_get_survey,
9458         .status = wpa_driver_nl80211_status,
9459         .switch_channel = nl80211_switch_channel,
9460 #ifdef ANDROID_P2P
9461         .set_noa = wpa_driver_set_p2p_noa,
9462         .get_noa = wpa_driver_get_p2p_noa,
9463         .set_ap_wps_ie = wpa_driver_set_ap_wps_p2p_ie,
9464 #endif /* ANDROID_P2P */
9465 #ifdef ANDROID
9466 #ifndef ANDROID_LIB_STUB
9467         .driver_cmd = wpa_driver_nl80211_driver_cmd,
9468 #endif /* !ANDROID_LIB_STUB */
9469 #endif /* ANDROID */
9470         .vendor_cmd = nl80211_vendor_cmd,
9471         .set_qos_map = nl80211_set_qos_map,
9472         .set_wowlan = nl80211_set_wowlan,
9473         .set_mac_addr = nl80211_set_mac_addr,
9474 #ifdef CONFIG_MESH
9475         .init_mesh = wpa_driver_nl80211_init_mesh,
9476         .join_mesh = wpa_driver_nl80211_join_mesh,
9477         .leave_mesh = wpa_driver_nl80211_leave_mesh,
9478 #endif /* CONFIG_MESH */
9479         .br_add_ip_neigh = wpa_driver_br_add_ip_neigh,
9480         .br_delete_ip_neigh = wpa_driver_br_delete_ip_neigh,
9481         .br_port_set_attr = wpa_driver_br_port_set_attr,
9482         .br_set_net_param = wpa_driver_br_set_net_param,
9483         .add_tx_ts = nl80211_add_ts,
9484         .del_tx_ts = nl80211_del_ts,
9485         .get_ifindex = nl80211_get_ifindex,
9486 #ifdef CONFIG_DRIVER_NL80211_QCA
9487         .roaming = nl80211_roaming,
9488         .do_acs = wpa_driver_do_acs,
9489         .set_band = nl80211_set_band,
9490         .get_pref_freq_list = nl80211_get_pref_freq_list,
9491         .set_prob_oper_freq = nl80211_set_prob_oper_freq,
9492         .p2p_lo_start = nl80211_p2p_lo_start,
9493         .p2p_lo_stop = nl80211_p2p_lo_stop,
9494         .set_default_scan_ies = nl80211_set_default_scan_ies,
9495 #endif /* CONFIG_DRIVER_NL80211_QCA */
9496         .configure_data_frame_filters = nl80211_configure_data_frame_filters,
9497         .get_ext_capab = nl80211_get_ext_capab,
9498 };