src/drivers/driver_nl80211.c

   1 /*
   2  * Driver interaction with Linux nl80211/cfg80211
   3  * Copyright (c) 2002-2015, Jouni Malinen <j@w1.fi>
   4  * Copyright (c) 2003-2004, Instant802 Networks, Inc.
   5  * Copyright (c) 2005-2006, Devicescape Software, Inc.
   6  * Copyright (c) 2007, Johannes Berg <johannes@sipsolutions.net>
   7  * Copyright (c) 2009-2010, Atheros Communications
   8  *
   9  * This software may be distributed under the terms of the BSD license.
  10  * See README for more details.
  11  */
  12
  13 #include "includes.h"
  14 #include <sys/types.h>
  15 #include <fcntl.h>
  16 #include <net/if.h>
  17 #include <netlink/genl/genl.h>
  18 #include <netlink/genl/ctrl.h>
  19 #ifdef CONFIG_LIBNL3_ROUTE
  20 #include <netlink/route/neighbour.h>
  21 #endif /* CONFIG_LIBNL3_ROUTE */
  22 #include <linux/rtnetlink.h>
  23 #include <netpacket/packet.h>
  24 #include <linux/errqueue.h>
  25
  26 #include "common.h"
  27 #include "eloop.h"
  28 #include "common/qca-vendor.h"
  29 #include "common/qca-vendor-attr.h"
  30 #include "common/ieee802_11_defs.h"
  31 #include "common/ieee802_11_common.h"
  32 #include "l2_packet/l2_packet.h"
  33 #include "netlink.h"
  34 #include "linux_defines.h"
  35 #include "linux_ioctl.h"
  36 #include "radiotap.h"
  37 #include "radiotap_iter.h"
  38 #include "rfkill.h"
  39 #include "driver_nl80211.h"
  40
  41
  42 #ifndef CONFIG_LIBNL20
  43 /*
  44  * libnl 1.1 has a bug, it tries to allocate socket numbers densely
  45  * but when you free a socket again it will mess up its bitmap and
  46  * and use the wrong number the next time it needs a socket ID.
  47  * Therefore, we wrap the handle alloc/destroy and add our own pid
  48  * accounting.
  49  */
  50 static uint32_t port_bitmap[32] = { 0 };
  51
  52 static struct nl_handle *nl80211_handle_alloc(void *cb)
  53 {
  54         struct nl_handle *handle;
  55         uint32_t pid = getpid() & 0x3FFFFF;
  56         int i;
  57
  58         handle = nl_handle_alloc_cb(cb);
  59
  60         for (i = 0; i < 1024; i++) {
  61                 if (port_bitmap[i / 32] & (1 << (i % 32)))
  62                         continue;
  63                 port_bitmap[i / 32] |= 1 << (i % 32);
  64                 pid += i << 22;
  65                 break;
  66         }
  67
  68         nl_socket_set_local_port(handle, pid);
  69
  70         return handle;
  71 }
  72
  73 static void nl80211_handle_destroy(struct nl_handle *handle)
  74 {
  75         uint32_t port = nl_socket_get_local_port(handle);
  76
  77         port >>= 22;
  78         port_bitmap[port / 32] &= ~(1 << (port % 32));
  79
  80         nl_handle_destroy(handle);
  81 }
  82 #endif /* CONFIG_LIBNL20 */
  83
  84
  85 #ifdef ANDROID
  86 /* system/core/libnl_2 does not include nl_socket_set_nonblocking() */
  87 #undef nl_socket_set_nonblocking
  88 #define nl_socket_set_nonblocking(h) android_nl_socket_set_nonblocking(h)
  89
  90 #define genl_ctrl_resolve android_genl_ctrl_resolve
  91 #endif /* ANDROID */
  92
  93
  94 static struct nl_handle * nl_create_handle(struct nl_cb *cb, const char *dbg)
  95 {
  96         struct nl_handle *handle;
  97
  98         handle = nl80211_handle_alloc(cb);
  99         if (handle == NULL) {
 100                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate netlink "
 101                            "callbacks (%s)", dbg);
 102                 return NULL;
 103         }
 104
 105         if (genl_connect(handle)) {
 106                 wpa_printf(MSG_ERROR, "nl80211: Failed to connect to generic "
 107                            "netlink (%s)", dbg);
 108                 nl80211_handle_destroy(handle);
 109                 return NULL;
 110         }
 111
 112         return handle;
 113 }
 114
 115
 116 static void nl_destroy_handles(struct nl_handle **handle)
 117 {
 118         if (*handle == NULL)
 119                 return;
 120         nl80211_handle_destroy(*handle);
 121         *handle = NULL;
 122 }
 123
 124
 125 #if __WORDSIZE == 64
 126 #define ELOOP_SOCKET_INVALID    (intptr_t) 0x8888888888888889ULL
 127 #else
 128 #define ELOOP_SOCKET_INVALID    (intptr_t) 0x88888889ULL
 129 #endif
 130
 131 static void nl80211_register_eloop_read(struct nl_handle **handle,
 132                                         eloop_sock_handler handler,
 133                                         void *eloop_data)
 134 {
 135 #ifdef CONFIG_LIBNL20
 136         /*
 137          * libnl uses a pretty small buffer (32 kB that gets converted to 64 kB)
 138          * by default. It is possible to hit that limit in some cases where
 139          * operations are blocked, e.g., with a burst of Deauthentication frames
 140          * to hostapd and STA entry deletion. Try to increase the buffer to make
 141          * this less likely to occur.
 142          */
 143         if (nl_socket_set_buffer_size(*handle, 262144, 0) < 0) {
 144                 wpa_printf(MSG_DEBUG,
 145                            "nl80211: Could not set nl_socket RX buffer size: %s",
 146                            strerror(errno));
 147                 /* continue anyway with the default (smaller) buffer */
 148         }
 149 #endif /* CONFIG_LIBNL20 */
 150
 151         nl_socket_set_nonblocking(*handle);
 152         eloop_register_read_sock(nl_socket_get_fd(*handle), handler,
 153                                  eloop_data, *handle);
 154         *handle = (void *) (((intptr_t) *handle) ^ ELOOP_SOCKET_INVALID);
 155 }
 156
 157
 158 static void nl80211_destroy_eloop_handle(struct nl_handle **handle)
 159 {
 160         *handle = (void *) (((intptr_t) *handle) ^ ELOOP_SOCKET_INVALID);
 161         eloop_unregister_read_sock(nl_socket_get_fd(*handle));
 162         nl_destroy_handles(handle);
 163 }
 164
 165
 166 static void nl80211_global_deinit(void *priv);
 167 static void nl80211_check_global(struct nl80211_global *global);
 168
 169 static void wpa_driver_nl80211_deinit(struct i802_bss *bss);
 170 static int wpa_driver_nl80211_set_mode_ibss(struct i802_bss *bss,
 171                                             struct hostapd_freq_params *freq);
 172
 173 static int
 174 wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv,
 175                                    const u8 *set_addr, int first,
 176                                    const char *driver_params);
 177 static int nl80211_send_frame_cmd(struct i802_bss *bss,
 178                                   unsigned int freq, unsigned int wait,
 179                                   const u8 *buf, size_t buf_len, u64 *cookie,
 180                                   int no_cck, int no_ack, int offchanok);
 181 static int wpa_driver_nl80211_probe_req_report(struct i802_bss *bss,
 182                                                int report);
 183
 184 static void add_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx);
 185 static void del_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx);
 186 static int have_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx);
 187
 188 static int nl80211_set_channel(struct i802_bss *bss,
 189                                struct hostapd_freq_params *freq, int set_chan);
 190 static int nl80211_disable_11b_rates(struct wpa_driver_nl80211_data *drv,
 191                                      int ifindex, int disabled);
 192
 193 static int nl80211_leave_ibss(struct wpa_driver_nl80211_data *drv,
 194                               int reset_mode);
 195
 196 static int i802_set_iface_flags(struct i802_bss *bss, int up);
 197 static int nl80211_set_param(void *priv, const char *param);
 198
 199
 200 /* Converts nl80211_chan_width to a common format */
 201 enum chan_width convert2width(int width)
 202 {
 203         switch (width) {
 204         case NL80211_CHAN_WIDTH_20_NOHT:
 205                 return CHAN_WIDTH_20_NOHT;
 206         case NL80211_CHAN_WIDTH_20:
 207                 return CHAN_WIDTH_20;
 208         case NL80211_CHAN_WIDTH_40:
 209                 return CHAN_WIDTH_40;
 210         case NL80211_CHAN_WIDTH_80:
 211                 return CHAN_WIDTH_80;
 212         case NL80211_CHAN_WIDTH_80P80:
 213                 return CHAN_WIDTH_80P80;
 214         case NL80211_CHAN_WIDTH_160:
 215                 return CHAN_WIDTH_160;
 216         }
 217         return CHAN_WIDTH_UNKNOWN;
 218 }
 219
 220
 221 int is_ap_interface(enum nl80211_iftype nlmode)
 222 {
 223         return nlmode == NL80211_IFTYPE_AP ||
 224                 nlmode == NL80211_IFTYPE_P2P_GO;
 225 }
 226
 227
 228 int is_sta_interface(enum nl80211_iftype nlmode)
 229 {
 230         return nlmode == NL80211_IFTYPE_STATION ||
 231                 nlmode == NL80211_IFTYPE_P2P_CLIENT;
 232 }
 233
 234
 235 static int is_p2p_net_interface(enum nl80211_iftype nlmode)
 236 {
 237         return nlmode == NL80211_IFTYPE_P2P_CLIENT ||
 238                 nlmode == NL80211_IFTYPE_P2P_GO;
 239 }
 240
 241
 242 struct i802_bss * get_bss_ifindex(struct wpa_driver_nl80211_data *drv,
 243                                   int ifindex)
 244 {
 245         struct i802_bss *bss;
 246
 247         for (bss = drv->first_bss; bss; bss = bss->next) {
 248                 if (bss->ifindex == ifindex)
 249                         return bss;
 250         }
 251
 252         return NULL;
 253 }
 254
 255
 256 static int is_mesh_interface(enum nl80211_iftype nlmode)
 257 {
 258         return nlmode == NL80211_IFTYPE_MESH_POINT;
 259 }
 260
 261
 262 void nl80211_mark_disconnected(struct wpa_driver_nl80211_data *drv)
 263 {
 264         if (drv->associated)
 265                 os_memcpy(drv->prev_bssid, drv->bssid, ETH_ALEN);
 266         drv->associated = 0;
 267         os_memset(drv->bssid, 0, ETH_ALEN);
 268 }
 269
 270
 271 /* nl80211 code */
 272 static int ack_handler(struct nl_msg *msg, void *arg)
 273 {
 274         int *err = arg;
 275         *err = 0;
 276         return NL_STOP;
 277 }
 278
 279 static int finish_handler(struct nl_msg *msg, void *arg)
 280 {
 281         int *ret = arg;
 282         *ret = 0;
 283         return NL_SKIP;
 284 }
 285
 286 static int error_handler(struct sockaddr_nl *nla, struct nlmsgerr *err,
 287                          void *arg)
 288 {
 289         int *ret = arg;
 290         *ret = err->error;
 291         return NL_SKIP;
 292 }
 293
 294
 295 static int no_seq_check(struct nl_msg *msg, void *arg)
 296 {
 297         return NL_OK;
 298 }
 299
 300
 301 static void nl80211_nlmsg_clear(struct nl_msg *msg)
 302 {
 303         /*
 304          * Clear nlmsg data, e.g., to make sure key material is not left in
 305          * heap memory for unnecessarily long time.
 306          */
 307         if (msg) {
 308                 struct nlmsghdr *hdr = nlmsg_hdr(msg);
 309                 void *data = nlmsg_data(hdr);
 310                 /*
 311                  * This would use nlmsg_datalen() or the older nlmsg_len() if
 312                  * only libnl were to maintain a stable API.. Neither will work
 313                  * with all released versions, so just calculate the length
 314                  * here.
 315                  */
 316                 int len = hdr->nlmsg_len - NLMSG_HDRLEN;
 317
 318                 os_memset(data, 0, len);
 319         }
 320 }
 321
 322
 323 static int send_and_recv(struct nl80211_global *global,
 324                          struct nl_handle *nl_handle, struct nl_msg *msg,
 325                          int (*valid_handler)(struct nl_msg *, void *),
 326                          void *valid_data)
 327 {
 328         struct nl_cb *cb;
 329         int err = -ENOMEM;
 330
 331         if (!msg)
 332                 return -ENOMEM;
 333
 334         cb = nl_cb_clone(global->nl_cb);
 335         if (!cb)
 336                 goto out;
 337
 338         err = nl_send_auto_complete(nl_handle, msg);
 339         if (err < 0)
 340                 goto out;
 341
 342         err = 1;
 343
 344         nl_cb_err(cb, NL_CB_CUSTOM, error_handler, &err);
 345         nl_cb_set(cb, NL_CB_FINISH, NL_CB_CUSTOM, finish_handler, &err);
 346         nl_cb_set(cb, NL_CB_ACK, NL_CB_CUSTOM, ack_handler, &err);
 347
 348         if (valid_handler)
 349                 nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM,
 350                           valid_handler, valid_data);
 351
 352         while (err > 0) {
 353                 int res = nl_recvmsgs(nl_handle, cb);
 354                 if (res < 0) {
 355                         wpa_printf(MSG_INFO,
 356                                    "nl80211: %s->nl_recvmsgs failed: %d",
 357                                    __func__, res);
 358                 }
 359         }
 360  out:
 361         nl_cb_put(cb);
 362         if (!valid_handler && valid_data == (void *) -1)
 363                 nl80211_nlmsg_clear(msg);
 364         nlmsg_free(msg);
 365         return err;
 366 }
 367
 368
 369 int send_and_recv_msgs(struct wpa_driver_nl80211_data *drv,
 370                        struct nl_msg *msg,
 371                        int (*valid_handler)(struct nl_msg *, void *),
 372                        void *valid_data)
 373 {
 374         return send_and_recv(drv->global, drv->global->nl, msg,
 375                              valid_handler, valid_data);
 376 }
 377
 378
 379 struct family_data {
 380         const char *group;
 381         int id;
 382 };
 383
 384
 385 static int family_handler(struct nl_msg *msg, void *arg)
 386 {
 387         struct family_data *res = arg;
 388         struct nlattr *tb[CTRL_ATTR_MAX + 1];
 389         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 390         struct nlattr *mcgrp;
 391         int i;
 392
 393         nla_parse(tb, CTRL_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 394                   genlmsg_attrlen(gnlh, 0), NULL);
 395         if (!tb[CTRL_ATTR_MCAST_GROUPS])
 396                 return NL_SKIP;
 397
 398         nla_for_each_nested(mcgrp, tb[CTRL_ATTR_MCAST_GROUPS], i) {
 399                 struct nlattr *tb2[CTRL_ATTR_MCAST_GRP_MAX + 1];
 400                 nla_parse(tb2, CTRL_ATTR_MCAST_GRP_MAX, nla_data(mcgrp),
 401                           nla_len(mcgrp), NULL);
 402                 if (!tb2[CTRL_ATTR_MCAST_GRP_NAME] ||
 403                     !tb2[CTRL_ATTR_MCAST_GRP_ID] ||
 404                     os_strncmp(nla_data(tb2[CTRL_ATTR_MCAST_GRP_NAME]),
 405                                res->group,
 406                                nla_len(tb2[CTRL_ATTR_MCAST_GRP_NAME])) != 0)
 407                         continue;
 408                 res->id = nla_get_u32(tb2[CTRL_ATTR_MCAST_GRP_ID]);
 409                 break;
 410         };
 411
 412         return NL_SKIP;
 413 }
 414
 415
 416 static int nl_get_multicast_id(struct nl80211_global *global,
 417                                const char *family, const char *group)
 418 {
 419         struct nl_msg *msg;
 420         int ret;
 421         struct family_data res = { group, -ENOENT };
 422
 423         msg = nlmsg_alloc();
 424         if (!msg)
 425                 return -ENOMEM;
 426         if (!genlmsg_put(msg, 0, 0, genl_ctrl_resolve(global->nl, "nlctrl"),
 427                          0, 0, CTRL_CMD_GETFAMILY, 0) ||
 428             nla_put_string(msg, CTRL_ATTR_FAMILY_NAME, family)) {
 429                 nlmsg_free(msg);
 430                 return -1;
 431         }
 432
 433         ret = send_and_recv(global, global->nl, msg, family_handler, &res);
 434         if (ret == 0)
 435                 ret = res.id;
 436         return ret;
 437 }
 438
 439
 440 void * nl80211_cmd(struct wpa_driver_nl80211_data *drv,
 441                    struct nl_msg *msg, int flags, uint8_t cmd)
 442 {
 443         return genlmsg_put(msg, 0, 0, drv->global->nl80211_id,
 444                            0, flags, cmd, 0);
 445 }
 446
 447
 448 static int nl80211_set_iface_id(struct nl_msg *msg, struct i802_bss *bss)
 449 {
 450         if (bss->wdev_id_set)
 451                 return nla_put_u64(msg, NL80211_ATTR_WDEV, bss->wdev_id);
 452         return nla_put_u32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
 453 }
 454
 455
 456 struct nl_msg * nl80211_cmd_msg(struct i802_bss *bss, int flags, uint8_t cmd)
 457 {
 458         struct nl_msg *msg;
 459
 460         msg = nlmsg_alloc();
 461         if (!msg)
 462                 return NULL;
 463
 464         if (!nl80211_cmd(bss->drv, msg, flags, cmd) ||
 465             nl80211_set_iface_id(msg, bss) < 0) {
 466                 nlmsg_free(msg);
 467                 return NULL;
 468         }
 469
 470         return msg;
 471 }
 472
 473
 474 static struct nl_msg *
 475 nl80211_ifindex_msg(struct wpa_driver_nl80211_data *drv, int ifindex,
 476                     int flags, uint8_t cmd)
 477 {
 478         struct nl_msg *msg;
 479
 480         msg = nlmsg_alloc();
 481         if (!msg)
 482                 return NULL;
 483
 484         if (!nl80211_cmd(drv, msg, flags, cmd) ||
 485             nla_put_u32(msg, NL80211_ATTR_IFINDEX, ifindex)) {
 486                 nlmsg_free(msg);
 487                 return NULL;
 488         }
 489
 490         return msg;
 491 }
 492
 493
 494 struct nl_msg * nl80211_drv_msg(struct wpa_driver_nl80211_data *drv, int flags,
 495                                 uint8_t cmd)
 496 {
 497         return nl80211_ifindex_msg(drv, drv->ifindex, flags, cmd);
 498 }
 499
 500
 501 struct nl_msg * nl80211_bss_msg(struct i802_bss *bss, int flags, uint8_t cmd)
 502 {
 503         return nl80211_ifindex_msg(bss->drv, bss->ifindex, flags, cmd);
 504 }
 505
 506
 507 struct wiphy_idx_data {
 508         int wiphy_idx;
 509         enum nl80211_iftype nlmode;
 510         u8 *macaddr;
 511 };
 512
 513
 514 static int netdev_info_handler(struct nl_msg *msg, void *arg)
 515 {
 516         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 517         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 518         struct wiphy_idx_data *info = arg;
 519
 520         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 521                   genlmsg_attrlen(gnlh, 0), NULL);
 522
 523         if (tb[NL80211_ATTR_WIPHY])
 524                 info->wiphy_idx = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
 525
 526         if (tb[NL80211_ATTR_IFTYPE])
 527                 info->nlmode = nla_get_u32(tb[NL80211_ATTR_IFTYPE]);
 528
 529         if (tb[NL80211_ATTR_MAC] && info->macaddr)
 530                 os_memcpy(info->macaddr, nla_data(tb[NL80211_ATTR_MAC]),
 531                           ETH_ALEN);
 532
 533         return NL_SKIP;
 534 }
 535
 536
 537 int nl80211_get_wiphy_index(struct i802_bss *bss)
 538 {
 539         struct nl_msg *msg;
 540         struct wiphy_idx_data data = {
 541                 .wiphy_idx = -1,
 542                 .macaddr = NULL,
 543         };
 544
 545         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_GET_INTERFACE)))
 546                 return -1;
 547
 548         if (send_and_recv_msgs(bss->drv, msg, netdev_info_handler, &data) == 0)
 549                 return data.wiphy_idx;
 550         return -1;
 551 }
 552
 553
 554 static enum nl80211_iftype nl80211_get_ifmode(struct i802_bss *bss)
 555 {
 556         struct nl_msg *msg;
 557         struct wiphy_idx_data data = {
 558                 .nlmode = NL80211_IFTYPE_UNSPECIFIED,
 559                 .macaddr = NULL,
 560         };
 561
 562         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_GET_INTERFACE)))
 563                 return NL80211_IFTYPE_UNSPECIFIED;
 564
 565         if (send_and_recv_msgs(bss->drv, msg, netdev_info_handler, &data) == 0)
 566                 return data.nlmode;
 567         return NL80211_IFTYPE_UNSPECIFIED;
 568 }
 569
 570
 571 static int nl80211_get_macaddr(struct i802_bss *bss)
 572 {
 573         struct nl_msg *msg;
 574         struct wiphy_idx_data data = {
 575                 .macaddr = bss->addr,
 576         };
 577
 578         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_GET_INTERFACE)))
 579                 return -1;
 580
 581         return send_and_recv_msgs(bss->drv, msg, netdev_info_handler, &data);
 582 }
 583
 584
 585 static int nl80211_register_beacons(struct wpa_driver_nl80211_data *drv,
 586                                     struct nl80211_wiphy_data *w)
 587 {
 588         struct nl_msg *msg;
 589         int ret;
 590
 591         msg = nlmsg_alloc();
 592         if (!msg)
 593                 return -1;
 594
 595         if (!nl80211_cmd(drv, msg, 0, NL80211_CMD_REGISTER_BEACONS) ||
 596             nla_put_u32(msg, NL80211_ATTR_WIPHY, w->wiphy_idx)) {
 597                 nlmsg_free(msg);
 598                 return -1;
 599         }
 600
 601         ret = send_and_recv(drv->global, w->nl_beacons, msg, NULL, NULL);
 602         if (ret) {
 603                 wpa_printf(MSG_DEBUG, "nl80211: Register beacons command "
 604                            "failed: ret=%d (%s)",
 605                            ret, strerror(-ret));
 606         }
 607         return ret;
 608 }
 609
 610
 611 static void nl80211_recv_beacons(int sock, void *eloop_ctx, void *handle)
 612 {
 613         struct nl80211_wiphy_data *w = eloop_ctx;
 614         int res;
 615
 616         wpa_printf(MSG_EXCESSIVE, "nl80211: Beacon event message available");
 617
 618         res = nl_recvmsgs(handle, w->nl_cb);
 619         if (res < 0) {
 620                 wpa_printf(MSG_INFO, "nl80211: %s->nl_recvmsgs failed: %d",
 621                            __func__, res);
 622         }
 623 }
 624
 625
 626 static int process_beacon_event(struct nl_msg *msg, void *arg)
 627 {
 628         struct nl80211_wiphy_data *w = arg;
 629         struct wpa_driver_nl80211_data *drv;
 630         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 631         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 632         union wpa_event_data event;
 633
 634         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 635                   genlmsg_attrlen(gnlh, 0), NULL);
 636
 637         if (gnlh->cmd != NL80211_CMD_FRAME) {
 638                 wpa_printf(MSG_DEBUG, "nl80211: Unexpected beacon event? (%d)",
 639                            gnlh->cmd);
 640                 return NL_SKIP;
 641         }
 642
 643         if (!tb[NL80211_ATTR_FRAME])
 644                 return NL_SKIP;
 645
 646         dl_list_for_each(drv, &w->drvs, struct wpa_driver_nl80211_data,
 647                          wiphy_list) {
 648                 os_memset(&event, 0, sizeof(event));
 649                 event.rx_mgmt.frame = nla_data(tb[NL80211_ATTR_FRAME]);
 650                 event.rx_mgmt.frame_len = nla_len(tb[NL80211_ATTR_FRAME]);
 651                 wpa_supplicant_event(drv->ctx, EVENT_RX_MGMT, &event);
 652         }
 653
 654         return NL_SKIP;
 655 }
 656
 657
 658 static struct nl80211_wiphy_data *
 659 nl80211_get_wiphy_data_ap(struct i802_bss *bss)
 660 {
 661         static DEFINE_DL_LIST(nl80211_wiphys);
 662         struct nl80211_wiphy_data *w;
 663         int wiphy_idx, found = 0;
 664         struct i802_bss *tmp_bss;
 665
 666         if (bss->wiphy_data != NULL)
 667                 return bss->wiphy_data;
 668
 669         wiphy_idx = nl80211_get_wiphy_index(bss);
 670
 671         dl_list_for_each(w, &nl80211_wiphys, struct nl80211_wiphy_data, list) {
 672                 if (w->wiphy_idx == wiphy_idx)
 673                         goto add;
 674         }
 675
 676         /* alloc new one */
 677         w = os_zalloc(sizeof(*w));
 678         if (w == NULL)
 679                 return NULL;
 680         w->wiphy_idx = wiphy_idx;
 681         dl_list_init(&w->bsss);
 682         dl_list_init(&w->drvs);
 683
 684         w->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
 685         if (!w->nl_cb) {
 686                 os_free(w);
 687                 return NULL;
 688         }
 689         nl_cb_set(w->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM, no_seq_check, NULL);
 690         nl_cb_set(w->nl_cb, NL_CB_VALID, NL_CB_CUSTOM, process_beacon_event,
 691                   w);
 692
 693         w->nl_beacons = nl_create_handle(bss->drv->global->nl_cb,
 694                                          "wiphy beacons");
 695         if (w->nl_beacons == NULL) {
 696                 os_free(w);
 697                 return NULL;
 698         }
 699
 700         if (nl80211_register_beacons(bss->drv, w)) {
 701                 nl_destroy_handles(&w->nl_beacons);
 702                 os_free(w);
 703                 return NULL;
 704         }
 705
 706         nl80211_register_eloop_read(&w->nl_beacons, nl80211_recv_beacons, w);
 707
 708         dl_list_add(&nl80211_wiphys, &w->list);
 709
 710 add:
 711         /* drv entry for this bss already there? */
 712         dl_list_for_each(tmp_bss, &w->bsss, struct i802_bss, wiphy_list) {
 713                 if (tmp_bss->drv == bss->drv) {
 714                         found = 1;
 715                         break;
 716                 }
 717         }
 718         /* if not add it */
 719         if (!found)
 720                 dl_list_add(&w->drvs, &bss->drv->wiphy_list);
 721
 722         dl_list_add(&w->bsss, &bss->wiphy_list);
 723         bss->wiphy_data = w;
 724         return w;
 725 }
 726
 727
 728 static void nl80211_put_wiphy_data_ap(struct i802_bss *bss)
 729 {
 730         struct nl80211_wiphy_data *w = bss->wiphy_data;
 731         struct i802_bss *tmp_bss;
 732         int found = 0;
 733
 734         if (w == NULL)
 735                 return;
 736         bss->wiphy_data = NULL;
 737         dl_list_del(&bss->wiphy_list);
 738
 739         /* still any for this drv present? */
 740         dl_list_for_each(tmp_bss, &w->bsss, struct i802_bss, wiphy_list) {
 741                 if (tmp_bss->drv == bss->drv) {
 742                         found = 1;
 743                         break;
 744                 }
 745         }
 746         /* if not remove it */
 747         if (!found)
 748                 dl_list_del(&bss->drv->wiphy_list);
 749
 750         if (!dl_list_empty(&w->bsss))
 751                 return;
 752
 753         nl80211_destroy_eloop_handle(&w->nl_beacons);
 754
 755         nl_cb_put(w->nl_cb);
 756         dl_list_del(&w->list);
 757         os_free(w);
 758 }
 759
 760
 761 static int wpa_driver_nl80211_get_bssid(void *priv, u8 *bssid)
 762 {
 763         struct i802_bss *bss = priv;
 764         struct wpa_driver_nl80211_data *drv = bss->drv;
 765         if (!drv->associated)
 766                 return -1;
 767         os_memcpy(bssid, drv->bssid, ETH_ALEN);
 768         return 0;
 769 }
 770
 771
 772 static int wpa_driver_nl80211_get_ssid(void *priv, u8 *ssid)
 773 {
 774         struct i802_bss *bss = priv;
 775         struct wpa_driver_nl80211_data *drv = bss->drv;
 776         if (!drv->associated)
 777                 return -1;
 778         os_memcpy(ssid, drv->ssid, drv->ssid_len);
 779         return drv->ssid_len;
 780 }
 781
 782
 783 static void wpa_driver_nl80211_event_newlink(
 784         struct wpa_driver_nl80211_data *drv, const char *ifname)
 785 {
 786         union wpa_event_data event;
 787
 788         if (os_strcmp(drv->first_bss->ifname, ifname) == 0) {
 789                 if (if_nametoindex(drv->first_bss->ifname) == 0) {
 790                         wpa_printf(MSG_DEBUG, "nl80211: Interface %s does not exist - ignore RTM_NEWLINK",
 791                                    drv->first_bss->ifname);
 792                         return;
 793                 }
 794                 if (!drv->if_removed)
 795                         return;
 796                 wpa_printf(MSG_DEBUG, "nl80211: Mark if_removed=0 for %s based on RTM_NEWLINK event",
 797                            drv->first_bss->ifname);
 798                 drv->if_removed = 0;
 799         }
 800
 801         os_memset(&event, 0, sizeof(event));
 802         os_strlcpy(event.interface_status.ifname, ifname,
 803                    sizeof(event.interface_status.ifname));
 804         event.interface_status.ievent = EVENT_INTERFACE_ADDED;
 805         wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_STATUS, &event);
 806 }
 807
 808
 809 static void wpa_driver_nl80211_event_dellink(
 810         struct wpa_driver_nl80211_data *drv, const char *ifname)
 811 {
 812         union wpa_event_data event;
 813
 814         if (os_strcmp(drv->first_bss->ifname, ifname) == 0) {
 815                 if (drv->if_removed) {
 816                         wpa_printf(MSG_DEBUG, "nl80211: if_removed already set - ignore RTM_DELLINK event for %s",
 817                                    ifname);
 818                         return;
 819                 }
 820                 wpa_printf(MSG_DEBUG, "RTM_DELLINK: Interface '%s' removed - mark if_removed=1",
 821                            ifname);
 822                 drv->if_removed = 1;
 823         } else {
 824                 wpa_printf(MSG_DEBUG, "RTM_DELLINK: Interface '%s' removed",
 825                            ifname);
 826         }
 827
 828         os_memset(&event, 0, sizeof(event));
 829         os_strlcpy(event.interface_status.ifname, ifname,
 830                    sizeof(event.interface_status.ifname));
 831         event.interface_status.ievent = EVENT_INTERFACE_REMOVED;
 832         wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_STATUS, &event);
 833 }
 834
 835
 836 static int wpa_driver_nl80211_own_ifname(struct wpa_driver_nl80211_data *drv,
 837                                          u8 *buf, size_t len)
 838 {
 839         int attrlen, rta_len;
 840         struct rtattr *attr;
 841
 842         attrlen = len;
 843         attr = (struct rtattr *) buf;
 844
 845         rta_len = RTA_ALIGN(sizeof(struct rtattr));
 846         while (RTA_OK(attr, attrlen)) {
 847                 if (attr->rta_type == IFLA_IFNAME) {
 848                         if (os_strcmp(((char *) attr) + rta_len,
 849                                       drv->first_bss->ifname) == 0)
 850                                 return 1;
 851                         else
 852                                 break;
 853                 }
 854                 attr = RTA_NEXT(attr, attrlen);
 855         }
 856
 857         return 0;
 858 }
 859
 860
 861 static int wpa_driver_nl80211_own_ifindex(struct wpa_driver_nl80211_data *drv,
 862                                           int ifindex, u8 *buf, size_t len)
 863 {
 864         if (drv->ifindex == ifindex)
 865                 return 1;
 866
 867         if (drv->if_removed && wpa_driver_nl80211_own_ifname(drv, buf, len)) {
 868                 nl80211_check_global(drv->global);
 869                 wpa_printf(MSG_DEBUG, "nl80211: Update ifindex for a removed "
 870                            "interface");
 871                 wpa_driver_nl80211_finish_drv_init(drv, NULL, 0, NULL);
 872                 return 1;
 873         }
 874
 875         return 0;
 876 }
 877
 878
 879 static struct wpa_driver_nl80211_data *
 880 nl80211_find_drv(struct nl80211_global *global, int idx, u8 *buf, size_t len)
 881 {
 882         struct wpa_driver_nl80211_data *drv;
 883         dl_list_for_each(drv, &global->interfaces,
 884                          struct wpa_driver_nl80211_data, list) {
 885                 if (wpa_driver_nl80211_own_ifindex(drv, idx, buf, len) ||
 886                     have_ifidx(drv, idx))
 887                         return drv;
 888         }
 889         return NULL;
 890 }
 891
 892
 893 static void wpa_driver_nl80211_event_rtm_newlink(void *ctx,
 894                                                  struct ifinfomsg *ifi,
 895                                                  u8 *buf, size_t len)
 896 {
 897         struct nl80211_global *global = ctx;
 898         struct wpa_driver_nl80211_data *drv;
 899         int attrlen;
 900         struct rtattr *attr;
 901         u32 brid = 0;
 902         char namebuf[IFNAMSIZ];
 903         char ifname[IFNAMSIZ + 1];
 904         char extra[100], *pos, *end;
 905
 906         drv = nl80211_find_drv(global, ifi->ifi_index, buf, len);
 907         if (!drv) {
 908                 wpa_printf(MSG_DEBUG, "nl80211: Ignore RTM_NEWLINK event for foreign ifindex %d",
 909                            ifi->ifi_index);
 910                 return;
 911         }
 912
 913         extra[0] = '\0';
 914         pos = extra;
 915         end = pos + sizeof(extra);
 916         ifname[0] = '\0';
 917
 918         attrlen = len;
 919         attr = (struct rtattr *) buf;
 920         while (RTA_OK(attr, attrlen)) {
 921                 switch (attr->rta_type) {
 922                 case IFLA_IFNAME:
 923                         if (RTA_PAYLOAD(attr) >= IFNAMSIZ)
 924                                 break;
 925                         os_memcpy(ifname, RTA_DATA(attr), RTA_PAYLOAD(attr));
 926                         ifname[RTA_PAYLOAD(attr)] = '\0';
 927                         break;
 928                 case IFLA_MASTER:
 929                         brid = nla_get_u32((struct nlattr *) attr);
 930                         pos += os_snprintf(pos, end - pos, " master=%u", brid);
 931                         break;
 932                 case IFLA_WIRELESS:
 933                         pos += os_snprintf(pos, end - pos, " wext");
 934                         break;
 935                 case IFLA_OPERSTATE:
 936                         pos += os_snprintf(pos, end - pos, " operstate=%u",
 937                                            nla_get_u32((struct nlattr *) attr));
 938                         break;
 939                 case IFLA_LINKMODE:
 940                         pos += os_snprintf(pos, end - pos, " linkmode=%u",
 941                                            nla_get_u32((struct nlattr *) attr));
 942                         break;
 943                 }
 944                 attr = RTA_NEXT(attr, attrlen);
 945         }
 946         extra[sizeof(extra) - 1] = '\0';
 947
 948         wpa_printf(MSG_DEBUG, "RTM_NEWLINK: ifi_index=%d ifname=%s%s ifi_family=%d ifi_flags=0x%x (%s%s%s%s)",
 949                    ifi->ifi_index, ifname, extra, ifi->ifi_family,
 950                    ifi->ifi_flags,
 951                    (ifi->ifi_flags & IFF_UP) ? "[UP]" : "",
 952                    (ifi->ifi_flags & IFF_RUNNING) ? "[RUNNING]" : "",
 953                    (ifi->ifi_flags & IFF_LOWER_UP) ? "[LOWER_UP]" : "",
 954                    (ifi->ifi_flags & IFF_DORMANT) ? "[DORMANT]" : "");
 955
 956         if (!drv->if_disabled && !(ifi->ifi_flags & IFF_UP)) {
 957                 namebuf[0] = '\0';
 958                 if (if_indextoname(ifi->ifi_index, namebuf) &&
 959                     linux_iface_up(drv->global->ioctl_sock, namebuf) > 0) {
 960                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface down "
 961                                    "event since interface %s is up", namebuf);
 962                         drv->ignore_if_down_event = 0;
 963                         return;
 964                 }
 965                 wpa_printf(MSG_DEBUG, "nl80211: Interface down (%s/%s)",
 966                            namebuf, ifname);
 967                 if (os_strcmp(drv->first_bss->ifname, ifname) != 0) {
 968                         wpa_printf(MSG_DEBUG,
 969                                    "nl80211: Not the main interface (%s) - do not indicate interface down",
 970                                    drv->first_bss->ifname);
 971                 } else if (drv->ignore_if_down_event) {
 972                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface down "
 973                                    "event generated by mode change");
 974                         drv->ignore_if_down_event = 0;
 975                 } else {
 976                         drv->if_disabled = 1;
 977                         wpa_supplicant_event(drv->ctx,
 978                                              EVENT_INTERFACE_DISABLED, NULL);
 979
 980                         /*
 981                          * Try to get drv again, since it may be removed as
 982                          * part of the EVENT_INTERFACE_DISABLED handling for
 983                          * dynamic interfaces
 984                          */
 985                         drv = nl80211_find_drv(global, ifi->ifi_index,
 986                                                buf, len);
 987                         if (!drv)
 988                                 return;
 989                 }
 990         }
 991
 992         if (drv->if_disabled && (ifi->ifi_flags & IFF_UP)) {
 993                 if (if_indextoname(ifi->ifi_index, namebuf) &&
 994                     linux_iface_up(drv->global->ioctl_sock, namebuf) == 0) {
 995                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface up "
 996                                    "event since interface %s is down",
 997                                    namebuf);
 998                 } else if (if_nametoindex(drv->first_bss->ifname) == 0) {
 999                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface up "
1000                                    "event since interface %s does not exist",
1001                                    drv->first_bss->ifname);
1002                 } else if (drv->if_removed) {
1003                         wpa_printf(MSG_DEBUG, "nl80211: Ignore interface up "
1004                                    "event since interface %s is marked "
1005                                    "removed", drv->first_bss->ifname);
1006                 } else {
1007                         struct i802_bss *bss;
1008                         u8 addr[ETH_ALEN];
1009
1010                         /* Re-read MAC address as it may have changed */
1011                         bss = get_bss_ifindex(drv, ifi->ifi_index);
1012                         if (bss &&
1013                             linux_get_ifhwaddr(drv->global->ioctl_sock,
1014                                                bss->ifname, addr) < 0) {
1015                                 wpa_printf(MSG_DEBUG,
1016                                            "nl80211: %s: failed to re-read MAC address",
1017                                            bss->ifname);
1018                         } else if (bss &&
1019                                    os_memcmp(addr, bss->addr, ETH_ALEN) != 0) {
1020                                 wpa_printf(MSG_DEBUG,
1021                                            "nl80211: Own MAC address on ifindex %d (%s) changed from "
1022                                            MACSTR " to " MACSTR,
1023                                            ifi->ifi_index, bss->ifname,
1024                                            MAC2STR(bss->addr),
1025                                            MAC2STR(addr));
1026                                 os_memcpy(bss->addr, addr, ETH_ALEN);
1027                         }
1028
1029                         wpa_printf(MSG_DEBUG, "nl80211: Interface up");
1030                         drv->if_disabled = 0;
1031                         wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_ENABLED,
1032                                              NULL);
1033                 }
1034         }
1035
1036         /*
1037          * Some drivers send the association event before the operup event--in
1038          * this case, lifting operstate in wpa_driver_nl80211_set_operstate()
1039          * fails. This will hit us when wpa_supplicant does not need to do
1040          * IEEE 802.1X authentication
1041          */
1042         if (drv->operstate == 1 &&
1043             (ifi->ifi_flags & (IFF_LOWER_UP | IFF_DORMANT)) == IFF_LOWER_UP &&
1044             !(ifi->ifi_flags & IFF_RUNNING)) {
1045                 wpa_printf(MSG_DEBUG, "nl80211: Set IF_OPER_UP again based on ifi_flags and expected operstate");
1046                 netlink_send_oper_ifla(drv->global->netlink, drv->ifindex,
1047                                        -1, IF_OPER_UP);
1048         }
1049
1050         if (ifname[0])
1051                 wpa_driver_nl80211_event_newlink(drv, ifname);
1052
1053         if (ifi->ifi_family == AF_BRIDGE && brid) {
1054                 struct i802_bss *bss;
1055
1056                 /* device has been added to bridge */
1057                 if (!if_indextoname(brid, namebuf)) {
1058                         wpa_printf(MSG_DEBUG,
1059                                    "nl80211: Could not find bridge ifname for ifindex %u",
1060                                    brid);
1061                         return;
1062                 }
1063                 wpa_printf(MSG_DEBUG, "nl80211: Add ifindex %u for bridge %s",
1064                            brid, namebuf);
1065                 add_ifidx(drv, brid);
1066
1067                 for (bss = drv->first_bss; bss; bss = bss->next) {
1068                         if (os_strcmp(ifname, bss->ifname) == 0) {
1069                                 os_strlcpy(bss->brname, namebuf, IFNAMSIZ);
1070                                 break;
1071                         }
1072                 }
1073         }
1074 }
1075
1076
1077 static void wpa_driver_nl80211_event_rtm_dellink(void *ctx,
1078                                                  struct ifinfomsg *ifi,
1079                                                  u8 *buf, size_t len)
1080 {
1081         struct nl80211_global *global = ctx;
1082         struct wpa_driver_nl80211_data *drv;
1083         int attrlen;
1084         struct rtattr *attr;
1085         u32 brid = 0;
1086         char ifname[IFNAMSIZ + 1];
1087         char extra[100], *pos, *end;
1088
1089         drv = nl80211_find_drv(global, ifi->ifi_index, buf, len);
1090         if (!drv) {
1091                 wpa_printf(MSG_DEBUG, "nl80211: Ignore RTM_DELLINK event for foreign ifindex %d",
1092                            ifi->ifi_index);
1093                 return;
1094         }
1095
1096         extra[0] = '\0';
1097         pos = extra;
1098         end = pos + sizeof(extra);
1099         ifname[0] = '\0';
1100
1101         attrlen = len;
1102         attr = (struct rtattr *) buf;
1103         while (RTA_OK(attr, attrlen)) {
1104                 switch (attr->rta_type) {
1105                 case IFLA_IFNAME:
1106                         if (RTA_PAYLOAD(attr) >= IFNAMSIZ)
1107                                 break;
1108                         os_memcpy(ifname, RTA_DATA(attr), RTA_PAYLOAD(attr));
1109                         ifname[RTA_PAYLOAD(attr)] = '\0';
1110                         break;
1111                 case IFLA_MASTER:
1112                         brid = nla_get_u32((struct nlattr *) attr);
1113                         pos += os_snprintf(pos, end - pos, " master=%u", brid);
1114                         break;
1115                 case IFLA_OPERSTATE:
1116                         pos += os_snprintf(pos, end - pos, " operstate=%u",
1117                                            nla_get_u32((struct nlattr *) attr));
1118                         break;
1119                 case IFLA_LINKMODE:
1120                         pos += os_snprintf(pos, end - pos, " linkmode=%u",
1121                                            nla_get_u32((struct nlattr *) attr));
1122                         break;
1123                 }
1124                 attr = RTA_NEXT(attr, attrlen);
1125         }
1126         extra[sizeof(extra) - 1] = '\0';
1127
1128         wpa_printf(MSG_DEBUG, "RTM_DELLINK: ifi_index=%d ifname=%s%s ifi_family=%d ifi_flags=0x%x (%s%s%s%s)",
1129                    ifi->ifi_index, ifname, extra, ifi->ifi_family,
1130                    ifi->ifi_flags,
1131                    (ifi->ifi_flags & IFF_UP) ? "[UP]" : "",
1132                    (ifi->ifi_flags & IFF_RUNNING) ? "[RUNNING]" : "",
1133                    (ifi->ifi_flags & IFF_LOWER_UP) ? "[LOWER_UP]" : "",
1134                    (ifi->ifi_flags & IFF_DORMANT) ? "[DORMANT]" : "");
1135
1136         if (ifname[0] && (ifi->ifi_family != AF_BRIDGE || !brid))
1137                 wpa_driver_nl80211_event_dellink(drv, ifname);
1138
1139         if (ifi->ifi_family == AF_BRIDGE && brid) {
1140                 /* device has been removed from bridge */
1141                 char namebuf[IFNAMSIZ];
1142
1143                 if (!if_indextoname(brid, namebuf)) {
1144                         wpa_printf(MSG_DEBUG,
1145                                    "nl80211: Could not find bridge ifname for ifindex %u",
1146                                    brid);
1147                 } else {
1148                         wpa_printf(MSG_DEBUG,
1149                                    "nl80211: Remove ifindex %u for bridge %s",
1150                                    brid, namebuf);
1151                 }
1152                 del_ifidx(drv, brid);
1153         }
1154 }
1155
1156
1157 unsigned int nl80211_get_assoc_freq(struct wpa_driver_nl80211_data *drv)
1158 {
1159         struct nl_msg *msg;
1160         int ret;
1161         struct nl80211_bss_info_arg arg;
1162
1163         msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_GET_SCAN);
1164         os_memset(&arg, 0, sizeof(arg));
1165         arg.drv = drv;
1166         ret = send_and_recv_msgs(drv, msg, bss_info_handler, &arg);
1167         if (ret == 0) {
1168                 unsigned int freq = drv->nlmode == NL80211_IFTYPE_ADHOC ?
1169                         arg.ibss_freq : arg.assoc_freq;
1170                 wpa_printf(MSG_DEBUG, "nl80211: Operating frequency for the "
1171                            "associated BSS from scan results: %u MHz", freq);
1172                 if (freq)
1173                         drv->assoc_freq = freq;
1174                 return drv->assoc_freq;
1175         }
1176         wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d "
1177                    "(%s)", ret, strerror(-ret));
1178         return drv->assoc_freq;
1179 }
1180
1181
1182 static int get_link_signal(struct nl_msg *msg, void *arg)
1183 {
1184         struct nlattr *tb[NL80211_ATTR_MAX + 1];
1185         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1186         struct nlattr *sinfo[NL80211_STA_INFO_MAX + 1];
1187         static struct nla_policy policy[NL80211_STA_INFO_MAX + 1] = {
1188                 [NL80211_STA_INFO_SIGNAL] = { .type = NLA_U8 },
1189                 [NL80211_STA_INFO_SIGNAL_AVG] = { .type = NLA_U8 },
1190                 [NL80211_STA_INFO_BEACON_SIGNAL_AVG] = { .type = NLA_U8 },
1191         };
1192         struct nlattr *rinfo[NL80211_RATE_INFO_MAX + 1];
1193         static struct nla_policy rate_policy[NL80211_RATE_INFO_MAX + 1] = {
1194                 [NL80211_RATE_INFO_BITRATE] = { .type = NLA_U16 },
1195                 [NL80211_RATE_INFO_MCS] = { .type = NLA_U8 },
1196                 [NL80211_RATE_INFO_40_MHZ_WIDTH] = { .type = NLA_FLAG },
1197                 [NL80211_RATE_INFO_SHORT_GI] = { .type = NLA_FLAG },
1198         };
1199         struct wpa_signal_info *sig_change = arg;
1200
1201         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1202                   genlmsg_attrlen(gnlh, 0), NULL);
1203         if (!tb[NL80211_ATTR_STA_INFO] ||
1204             nla_parse_nested(sinfo, NL80211_STA_INFO_MAX,
1205                              tb[NL80211_ATTR_STA_INFO], policy))
1206                 return NL_SKIP;
1207         if (!sinfo[NL80211_STA_INFO_SIGNAL])
1208                 return NL_SKIP;
1209
1210         sig_change->current_signal =
1211                 (s8) nla_get_u8(sinfo[NL80211_STA_INFO_SIGNAL]);
1212
1213         if (sinfo[NL80211_STA_INFO_SIGNAL_AVG])
1214                 sig_change->avg_signal =
1215                         (s8) nla_get_u8(sinfo[NL80211_STA_INFO_SIGNAL_AVG]);
1216         else
1217                 sig_change->avg_signal = 0;
1218
1219         if (sinfo[NL80211_STA_INFO_BEACON_SIGNAL_AVG])
1220                 sig_change->avg_beacon_signal =
1221                         (s8)
1222                         nla_get_u8(sinfo[NL80211_STA_INFO_BEACON_SIGNAL_AVG]);
1223         else
1224                 sig_change->avg_beacon_signal = 0;
1225
1226         if (sinfo[NL80211_STA_INFO_TX_BITRATE]) {
1227                 if (nla_parse_nested(rinfo, NL80211_RATE_INFO_MAX,
1228                                      sinfo[NL80211_STA_INFO_TX_BITRATE],
1229                                      rate_policy)) {
1230                         sig_change->current_txrate = 0;
1231                 } else {
1232                         if (rinfo[NL80211_RATE_INFO_BITRATE]) {
1233                                 sig_change->current_txrate =
1234                                         nla_get_u16(rinfo[
1235                                              NL80211_RATE_INFO_BITRATE]) * 100;
1236                         }
1237                 }
1238         }
1239
1240         return NL_SKIP;
1241 }
1242
1243
1244 int nl80211_get_link_signal(struct wpa_driver_nl80211_data *drv,
1245                             struct wpa_signal_info *sig)
1246 {
1247         struct nl_msg *msg;
1248
1249         sig->current_signal = -9999;
1250         sig->current_txrate = 0;
1251
1252         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_GET_STATION)) ||
1253             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, drv->bssid)) {
1254                 nlmsg_free(msg);
1255                 return -ENOBUFS;
1256         }
1257
1258         return send_and_recv_msgs(drv, msg, get_link_signal, sig);
1259 }
1260
1261
1262 static int get_link_noise(struct nl_msg *msg, void *arg)
1263 {
1264         struct nlattr *tb[NL80211_ATTR_MAX + 1];
1265         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1266         struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
1267         static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
1268                 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
1269                 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
1270         };
1271         struct wpa_signal_info *sig_change = arg;
1272
1273         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1274                   genlmsg_attrlen(gnlh, 0), NULL);
1275
1276         if (!tb[NL80211_ATTR_SURVEY_INFO]) {
1277                 wpa_printf(MSG_DEBUG, "nl80211: survey data missing!");
1278                 return NL_SKIP;
1279         }
1280
1281         if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
1282                              tb[NL80211_ATTR_SURVEY_INFO],
1283                              survey_policy)) {
1284                 wpa_printf(MSG_DEBUG, "nl80211: failed to parse nested "
1285                            "attributes!");
1286                 return NL_SKIP;
1287         }
1288
1289         if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY])
1290                 return NL_SKIP;
1291
1292         if (nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]) !=
1293             sig_change->frequency)
1294                 return NL_SKIP;
1295
1296         if (!sinfo[NL80211_SURVEY_INFO_NOISE])
1297                 return NL_SKIP;
1298
1299         sig_change->current_noise =
1300                 (s8) nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
1301
1302         return NL_SKIP;
1303 }
1304
1305
1306 int nl80211_get_link_noise(struct wpa_driver_nl80211_data *drv,
1307                            struct wpa_signal_info *sig_change)
1308 {
1309         struct nl_msg *msg;
1310
1311         sig_change->current_noise = 9999;
1312         sig_change->frequency = drv->assoc_freq;
1313
1314         msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_GET_SURVEY);
1315         return send_and_recv_msgs(drv, msg, get_link_noise, sig_change);
1316 }
1317
1318
1319 static void wpa_driver_nl80211_event_receive(int sock, void *eloop_ctx,
1320                                              void *handle)
1321 {
1322         struct nl_cb *cb = eloop_ctx;
1323         int res;
1324
1325         wpa_printf(MSG_MSGDUMP, "nl80211: Event message available");
1326
1327         res = nl_recvmsgs(handle, cb);
1328         if (res < 0) {
1329                 wpa_printf(MSG_INFO, "nl80211: %s->nl_recvmsgs failed: %d",
1330                            __func__, res);
1331         }
1332 }
1333
1334
1335 /**
1336  * wpa_driver_nl80211_set_country - ask nl80211 to set the regulatory domain
1337  * @priv: driver_nl80211 private data
1338  * @alpha2_arg: country to which to switch to
1339  * Returns: 0 on success, -1 on failure
1340  *
1341  * This asks nl80211 to set the regulatory domain for given
1342  * country ISO / IEC alpha2.
1343  */
1344 static int wpa_driver_nl80211_set_country(void *priv, const char *alpha2_arg)
1345 {
1346         struct i802_bss *bss = priv;
1347         struct wpa_driver_nl80211_data *drv = bss->drv;
1348         char alpha2[3];
1349         struct nl_msg *msg;
1350
1351         msg = nlmsg_alloc();
1352         if (!msg)
1353                 return -ENOMEM;
1354
1355         alpha2[0] = alpha2_arg[0];
1356         alpha2[1] = alpha2_arg[1];
1357         alpha2[2] = '\0';
1358
1359         if (!nl80211_cmd(drv, msg, 0, NL80211_CMD_REQ_SET_REG) ||
1360             nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, alpha2)) {
1361                 nlmsg_free(msg);
1362                 return -EINVAL;
1363         }
1364         if (send_and_recv_msgs(drv, msg, NULL, NULL))
1365                 return -EINVAL;
1366         return 0;
1367 }
1368
1369
1370 static int nl80211_get_country(struct nl_msg *msg, void *arg)
1371 {
1372         char *alpha2 = arg;
1373         struct nlattr *tb_msg[NL80211_ATTR_MAX + 1];
1374         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1375
1376         nla_parse(tb_msg, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1377                   genlmsg_attrlen(gnlh, 0), NULL);
1378         if (!tb_msg[NL80211_ATTR_REG_ALPHA2]) {
1379                 wpa_printf(MSG_DEBUG, "nl80211: No country information available");
1380                 return NL_SKIP;
1381         }
1382         os_strlcpy(alpha2, nla_data(tb_msg[NL80211_ATTR_REG_ALPHA2]), 3);
1383         return NL_SKIP;
1384 }
1385
1386
1387 static int wpa_driver_nl80211_get_country(void *priv, char *alpha2)
1388 {
1389         struct i802_bss *bss = priv;
1390         struct wpa_driver_nl80211_data *drv = bss->drv;
1391         struct nl_msg *msg;
1392         int ret;
1393
1394         msg = nlmsg_alloc();
1395         if (!msg)
1396                 return -ENOMEM;
1397
1398         nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_REG);
1399         alpha2[0] = '\0';
1400         ret = send_and_recv_msgs(drv, msg, nl80211_get_country, alpha2);
1401         if (!alpha2[0])
1402                 ret = -1;
1403
1404         return ret;
1405 }
1406
1407
1408 static int wpa_driver_nl80211_init_nl_global(struct nl80211_global *global)
1409 {
1410         int ret;
1411
1412         global->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
1413         if (global->nl_cb == NULL) {
1414                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate netlink "
1415                            "callbacks");
1416                 return -1;
1417         }
1418
1419         global->nl = nl_create_handle(global->nl_cb, "nl");
1420         if (global->nl == NULL)
1421                 goto err;
1422
1423         global->nl80211_id = genl_ctrl_resolve(global->nl, "nl80211");
1424         if (global->nl80211_id < 0) {
1425                 wpa_printf(MSG_ERROR, "nl80211: 'nl80211' generic netlink not "
1426                            "found");
1427                 goto err;
1428         }
1429
1430         global->nl_event = nl_create_handle(global->nl_cb, "event");
1431         if (global->nl_event == NULL)
1432                 goto err;
1433
1434         ret = nl_get_multicast_id(global, "nl80211", "scan");
1435         if (ret >= 0)
1436                 ret = nl_socket_add_membership(global->nl_event, ret);
1437         if (ret < 0) {
1438                 wpa_printf(MSG_ERROR, "nl80211: Could not add multicast "
1439                            "membership for scan events: %d (%s)",
1440                            ret, strerror(-ret));
1441                 goto err;
1442         }
1443
1444         ret = nl_get_multicast_id(global, "nl80211", "mlme");
1445         if (ret >= 0)
1446                 ret = nl_socket_add_membership(global->nl_event, ret);
1447         if (ret < 0) {
1448                 wpa_printf(MSG_ERROR, "nl80211: Could not add multicast "
1449                            "membership for mlme events: %d (%s)",
1450                            ret, strerror(-ret));
1451                 goto err;
1452         }
1453
1454         ret = nl_get_multicast_id(global, "nl80211", "regulatory");
1455         if (ret >= 0)
1456                 ret = nl_socket_add_membership(global->nl_event, ret);
1457         if (ret < 0) {
1458                 wpa_printf(MSG_DEBUG, "nl80211: Could not add multicast "
1459                            "membership for regulatory events: %d (%s)",
1460                            ret, strerror(-ret));
1461                 /* Continue without regulatory events */
1462         }
1463
1464         ret = nl_get_multicast_id(global, "nl80211", "vendor");
1465         if (ret >= 0)
1466                 ret = nl_socket_add_membership(global->nl_event, ret);
1467         if (ret < 0) {
1468                 wpa_printf(MSG_DEBUG, "nl80211: Could not add multicast "
1469                            "membership for vendor events: %d (%s)",
1470                            ret, strerror(-ret));
1471                 /* Continue without vendor events */
1472         }
1473
1474         nl_cb_set(global->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM,
1475                   no_seq_check, NULL);
1476         nl_cb_set(global->nl_cb, NL_CB_VALID, NL_CB_CUSTOM,
1477                   process_global_event, global);
1478
1479         nl80211_register_eloop_read(&global->nl_event,
1480                                     wpa_driver_nl80211_event_receive,
1481                                     global->nl_cb);
1482
1483         return 0;
1484
1485 err:
1486         nl_destroy_handles(&global->nl_event);
1487         nl_destroy_handles(&global->nl);
1488         nl_cb_put(global->nl_cb);
1489         global->nl_cb = NULL;
1490         return -1;
1491 }
1492
1493
1494 static void nl80211_check_global(struct nl80211_global *global)
1495 {
1496         struct nl_handle *handle;
1497         const char *groups[] = { "scan", "mlme", "regulatory", "vendor", NULL };
1498         int ret;
1499         unsigned int i;
1500
1501         /*
1502          * Try to re-add memberships to handle case of cfg80211 getting reloaded
1503          * and all registration having been cleared.
1504          */
1505         handle = (void *) (((intptr_t) global->nl_event) ^
1506                            ELOOP_SOCKET_INVALID);
1507
1508         for (i = 0; groups[i]; i++) {
1509                 ret = nl_get_multicast_id(global, "nl80211", groups[i]);
1510                 if (ret >= 0)
1511                         ret = nl_socket_add_membership(handle, ret);
1512                 if (ret < 0) {
1513                         wpa_printf(MSG_INFO,
1514                                    "nl80211: Could not re-add multicast membership for %s events: %d (%s)",
1515                                    groups[i], ret, strerror(-ret));
1516                 }
1517         }
1518 }
1519
1520
1521 static void wpa_driver_nl80211_rfkill_blocked(void *ctx)
1522 {
1523         wpa_printf(MSG_DEBUG, "nl80211: RFKILL blocked");
1524         /*
1525          * This may be for any interface; use ifdown event to disable
1526          * interface.
1527          */
1528 }
1529
1530
1531 static void wpa_driver_nl80211_rfkill_unblocked(void *ctx)
1532 {
1533         struct wpa_driver_nl80211_data *drv = ctx;
1534         wpa_printf(MSG_DEBUG, "nl80211: RFKILL unblocked");
1535         if (i802_set_iface_flags(drv->first_bss, 1)) {
1536                 wpa_printf(MSG_DEBUG, "nl80211: Could not set interface UP "
1537                            "after rfkill unblock");
1538                 return;
1539         }
1540         /* rtnetlink ifup handler will report interface as enabled */
1541 }
1542
1543
1544 static void wpa_driver_nl80211_handle_eapol_tx_status(int sock,
1545                                                       void *eloop_ctx,
1546                                                       void *handle)
1547 {
1548         struct wpa_driver_nl80211_data *drv = eloop_ctx;
1549         u8 data[2048];
1550         struct msghdr msg;
1551         struct iovec entry;
1552         u8 control[512];
1553         struct cmsghdr *cmsg;
1554         int res, found_ee = 0, found_wifi = 0, acked = 0;
1555         union wpa_event_data event;
1556
1557         memset(&msg, 0, sizeof(msg));
1558         msg.msg_iov = &entry;
1559         msg.msg_iovlen = 1;
1560         entry.iov_base = data;
1561         entry.iov_len = sizeof(data);
1562         msg.msg_control = &control;
1563         msg.msg_controllen = sizeof(control);
1564
1565         res = recvmsg(sock, &msg, MSG_ERRQUEUE);
1566         /* if error or not fitting 802.3 header, return */
1567         if (res < 14)
1568                 return;
1569
1570         for (cmsg = CMSG_FIRSTHDR(&msg); cmsg; cmsg = CMSG_NXTHDR(&msg, cmsg))
1571         {
1572                 if (cmsg->cmsg_level == SOL_SOCKET &&
1573                     cmsg->cmsg_type == SCM_WIFI_STATUS) {
1574                         int *ack;
1575
1576                         found_wifi = 1;
1577                         ack = (void *)CMSG_DATA(cmsg);
1578                         acked = *ack;
1579                 }
1580
1581                 if (cmsg->cmsg_level == SOL_PACKET &&
1582                     cmsg->cmsg_type == PACKET_TX_TIMESTAMP) {
1583                         struct sock_extended_err *err =
1584                                 (struct sock_extended_err *)CMSG_DATA(cmsg);
1585
1586                         if (err->ee_origin == SO_EE_ORIGIN_TXSTATUS)
1587                                 found_ee = 1;
1588                 }
1589         }
1590
1591         if (!found_ee || !found_wifi)
1592                 return;
1593
1594         memset(&event, 0, sizeof(event));
1595         event.eapol_tx_status.dst = data;
1596         event.eapol_tx_status.data = data + 14;
1597         event.eapol_tx_status.data_len = res - 14;
1598         event.eapol_tx_status.ack = acked;
1599         wpa_supplicant_event(drv->ctx, EVENT_EAPOL_TX_STATUS, &event);
1600 }
1601
1602
1603 static int nl80211_init_bss(struct i802_bss *bss)
1604 {
1605         bss->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
1606         if (!bss->nl_cb)
1607                 return -1;
1608
1609         nl_cb_set(bss->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM,
1610                   no_seq_check, NULL);
1611         nl_cb_set(bss->nl_cb, NL_CB_VALID, NL_CB_CUSTOM,
1612                   process_bss_event, bss);
1613
1614         return 0;
1615 }
1616
1617
1618 static void nl80211_destroy_bss(struct i802_bss *bss)
1619 {
1620         nl_cb_put(bss->nl_cb);
1621         bss->nl_cb = NULL;
1622 }
1623
1624
1625 static void * wpa_driver_nl80211_drv_init(void *ctx, const char *ifname,
1626                                           void *global_priv, int hostapd,
1627                                           const u8 *set_addr,
1628                                           const char *driver_params)
1629 {
1630         struct wpa_driver_nl80211_data *drv;
1631         struct rfkill_config *rcfg;
1632         struct i802_bss *bss;
1633
1634         if (global_priv == NULL)
1635                 return NULL;
1636         drv = os_zalloc(sizeof(*drv));
1637         if (drv == NULL)
1638                 return NULL;
1639         drv->global = global_priv;
1640         drv->ctx = ctx;
1641         drv->hostapd = !!hostapd;
1642         drv->eapol_sock = -1;
1643
1644         /*
1645          * There is no driver capability flag for this, so assume it is
1646          * supported and disable this on first attempt to use if the driver
1647          * rejects the command due to missing support.
1648          */
1649         drv->set_rekey_offload = 1;
1650
1651         drv->num_if_indices = sizeof(drv->default_if_indices) / sizeof(int);
1652         drv->if_indices = drv->default_if_indices;
1653
1654         drv->first_bss = os_zalloc(sizeof(*drv->first_bss));
1655         if (!drv->first_bss) {
1656                 os_free(drv);
1657                 return NULL;
1658         }
1659         bss = drv->first_bss;
1660         bss->drv = drv;
1661         bss->ctx = ctx;
1662
1663         os_strlcpy(bss->ifname, ifname, sizeof(bss->ifname));
1664         drv->monitor_ifidx = -1;
1665         drv->monitor_sock = -1;
1666         drv->eapol_tx_sock = -1;
1667         drv->ap_scan_as_station = NL80211_IFTYPE_UNSPECIFIED;
1668
1669         if (nl80211_init_bss(bss))
1670                 goto failed;
1671
1672         rcfg = os_zalloc(sizeof(*rcfg));
1673         if (rcfg == NULL)
1674                 goto failed;
1675         rcfg->ctx = drv;
1676         os_strlcpy(rcfg->ifname, ifname, sizeof(rcfg->ifname));
1677         rcfg->blocked_cb = wpa_driver_nl80211_rfkill_blocked;
1678         rcfg->unblocked_cb = wpa_driver_nl80211_rfkill_unblocked;
1679         drv->rfkill = rfkill_init(rcfg);
1680         if (drv->rfkill == NULL) {
1681                 wpa_printf(MSG_DEBUG, "nl80211: RFKILL status not available");
1682                 os_free(rcfg);
1683         }
1684
1685         if (linux_iface_up(drv->global->ioctl_sock, ifname) > 0)
1686                 drv->start_iface_up = 1;
1687
1688         if (wpa_driver_nl80211_finish_drv_init(drv, set_addr, 1, driver_params))
1689                 goto failed;
1690
1691         drv->eapol_tx_sock = socket(PF_PACKET, SOCK_DGRAM, 0);
1692         if (drv->eapol_tx_sock < 0)
1693                 goto failed;
1694
1695         if (drv->data_tx_status) {
1696                 int enabled = 1;
1697
1698                 if (setsockopt(drv->eapol_tx_sock, SOL_SOCKET, SO_WIFI_STATUS,
1699                                &enabled, sizeof(enabled)) < 0) {
1700                         wpa_printf(MSG_DEBUG,
1701                                 "nl80211: wifi status sockopt failed\n");
1702                         drv->data_tx_status = 0;
1703                         if (!drv->use_monitor)
1704                                 drv->capa.flags &=
1705                                         ~WPA_DRIVER_FLAGS_EAPOL_TX_STATUS;
1706                 } else {
1707                         eloop_register_read_sock(drv->eapol_tx_sock,
1708                                 wpa_driver_nl80211_handle_eapol_tx_status,
1709                                 drv, NULL);
1710                 }
1711         }
1712
1713         if (drv->global) {
1714                 nl80211_check_global(drv->global);
1715                 dl_list_add(&drv->global->interfaces, &drv->list);
1716                 drv->in_interface_list = 1;
1717         }
1718
1719         return bss;
1720
1721 failed:
1722         wpa_driver_nl80211_deinit(bss);
1723         return NULL;
1724 }
1725
1726
1727 /**
1728  * wpa_driver_nl80211_init - Initialize nl80211 driver interface
1729  * @ctx: context to be used when calling wpa_supplicant functions,
1730  * e.g., wpa_supplicant_event()
1731  * @ifname: interface name, e.g., wlan0
1732  * @global_priv: private driver global data from global_init()
1733  * Returns: Pointer to private data, %NULL on failure
1734  */
1735 static void * wpa_driver_nl80211_init(void *ctx, const char *ifname,
1736                                       void *global_priv)
1737 {
1738         return wpa_driver_nl80211_drv_init(ctx, ifname, global_priv, 0, NULL,
1739                                            NULL);
1740 }
1741
1742
1743 static int nl80211_register_frame(struct i802_bss *bss,
1744                                   struct nl_handle *nl_handle,
1745                                   u16 type, const u8 *match, size_t match_len)
1746 {
1747         struct wpa_driver_nl80211_data *drv = bss->drv;
1748         struct nl_msg *msg;
1749         int ret;
1750         char buf[30];
1751
1752         buf[0] = '\0';
1753         wpa_snprintf_hex(buf, sizeof(buf), match, match_len);
1754         wpa_printf(MSG_DEBUG, "nl80211: Register frame type=0x%x (%s) nl_handle=%p match=%s",
1755                    type, fc2str(type), nl_handle, buf);
1756
1757         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_REGISTER_ACTION)) ||
1758             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE, type) ||
1759             nla_put(msg, NL80211_ATTR_FRAME_MATCH, match_len, match)) {
1760                 nlmsg_free(msg);
1761                 return -1;
1762         }
1763
1764         ret = send_and_recv(drv->global, nl_handle, msg, NULL, NULL);
1765         if (ret) {
1766                 wpa_printf(MSG_DEBUG, "nl80211: Register frame command "
1767                            "failed (type=%u): ret=%d (%s)",
1768                            type, ret, strerror(-ret));
1769                 wpa_hexdump(MSG_DEBUG, "nl80211: Register frame match",
1770                             match, match_len);
1771         }
1772         return ret;
1773 }
1774
1775
1776 static int nl80211_alloc_mgmt_handle(struct i802_bss *bss)
1777 {
1778         if (bss->nl_mgmt) {
1779                 wpa_printf(MSG_DEBUG, "nl80211: Mgmt reporting "
1780                            "already on! (nl_mgmt=%p)", bss->nl_mgmt);
1781                 return -1;
1782         }
1783
1784         bss->nl_mgmt = nl_create_handle(bss->nl_cb, "mgmt");
1785         if (bss->nl_mgmt == NULL)
1786                 return -1;
1787
1788         return 0;
1789 }
1790
1791
1792 static void nl80211_mgmt_handle_register_eloop(struct i802_bss *bss)
1793 {
1794         nl80211_register_eloop_read(&bss->nl_mgmt,
1795                                     wpa_driver_nl80211_event_receive,
1796                                     bss->nl_cb);
1797 }
1798
1799
1800 static int nl80211_register_action_frame(struct i802_bss *bss,
1801                                          const u8 *match, size_t match_len)
1802 {
1803         u16 type = (WLAN_FC_TYPE_MGMT << 2) | (WLAN_FC_STYPE_ACTION << 4);
1804         return nl80211_register_frame(bss, bss->nl_mgmt,
1805                                       type, match, match_len);
1806 }
1807
1808
1809 static int nl80211_mgmt_subscribe_non_ap(struct i802_bss *bss)
1810 {
1811         struct wpa_driver_nl80211_data *drv = bss->drv;
1812         int ret = 0;
1813
1814         if (nl80211_alloc_mgmt_handle(bss))
1815                 return -1;
1816         wpa_printf(MSG_DEBUG, "nl80211: Subscribe to mgmt frames with non-AP "
1817                    "handle %p", bss->nl_mgmt);
1818
1819         if (drv->nlmode == NL80211_IFTYPE_ADHOC) {
1820                 u16 type = (WLAN_FC_TYPE_MGMT << 2) | (WLAN_FC_STYPE_AUTH << 4);
1821
1822                 /* register for any AUTH message */
1823                 nl80211_register_frame(bss, bss->nl_mgmt, type, NULL, 0);
1824         }
1825
1826 #ifdef CONFIG_INTERWORKING
1827         /* QoS Map Configure */
1828         if (nl80211_register_action_frame(bss, (u8 *) "\x01\x04", 2) < 0)
1829                 ret = -1;
1830 #endif /* CONFIG_INTERWORKING */
1831 #if defined(CONFIG_P2P) || defined(CONFIG_INTERWORKING)
1832         /* GAS Initial Request */
1833         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0a", 2) < 0)
1834                 ret = -1;
1835         /* GAS Initial Response */
1836         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0b", 2) < 0)
1837                 ret = -1;
1838         /* GAS Comeback Request */
1839         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0c", 2) < 0)
1840                 ret = -1;
1841         /* GAS Comeback Response */
1842         if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0d", 2) < 0)
1843                 ret = -1;
1844         /* Protected GAS Initial Request */
1845         if (nl80211_register_action_frame(bss, (u8 *) "\x09\x0a", 2) < 0)
1846                 ret = -1;
1847         /* Protected GAS Initial Response */
1848         if (nl80211_register_action_frame(bss, (u8 *) "\x09\x0b", 2) < 0)
1849                 ret = -1;
1850         /* Protected GAS Comeback Request */
1851         if (nl80211_register_action_frame(bss, (u8 *) "\x09\x0c", 2) < 0)
1852                 ret = -1;
1853         /* Protected GAS Comeback Response */
1854         if (nl80211_register_action_frame(bss, (u8 *) "\x09\x0d", 2) < 0)
1855                 ret = -1;
1856 #endif /* CONFIG_P2P || CONFIG_INTERWORKING */
1857 #ifdef CONFIG_P2P
1858         /* P2P Public Action */
1859         if (nl80211_register_action_frame(bss,
1860                                           (u8 *) "\x04\x09\x50\x6f\x9a\x09",
1861                                           6) < 0)
1862                 ret = -1;
1863         /* P2P Action */
1864         if (nl80211_register_action_frame(bss,
1865                                           (u8 *) "\x7f\x50\x6f\x9a\x09",
1866                                           5) < 0)
1867                 ret = -1;
1868 #endif /* CONFIG_P2P */
1869 #ifdef CONFIG_IEEE80211W
1870         /* SA Query Response */
1871         if (nl80211_register_action_frame(bss, (u8 *) "\x08\x01", 2) < 0)
1872                 ret = -1;
1873 #endif /* CONFIG_IEEE80211W */
1874 #ifdef CONFIG_TDLS
1875         if ((drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT)) {
1876                 /* TDLS Discovery Response */
1877                 if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0e", 2) <
1878                     0)
1879                         ret = -1;
1880         }
1881 #endif /* CONFIG_TDLS */
1882
1883         /* FT Action frames */
1884         if (nl80211_register_action_frame(bss, (u8 *) "\x06", 1) < 0)
1885                 ret = -1;
1886         else
1887                 drv->capa.key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_FT |
1888                         WPA_DRIVER_CAPA_KEY_MGMT_FT_PSK;
1889
1890         /* WNM - BSS Transition Management Request */
1891         if (nl80211_register_action_frame(bss, (u8 *) "\x0a\x07", 2) < 0)
1892                 ret = -1;
1893         /* WNM-Sleep Mode Response */
1894         if (nl80211_register_action_frame(bss, (u8 *) "\x0a\x11", 2) < 0)
1895                 ret = -1;
1896
1897 #ifdef CONFIG_HS20
1898         /* WNM-Notification */
1899         if (nl80211_register_action_frame(bss, (u8 *) "\x0a\x1a", 2) < 0)
1900                 ret = -1;
1901 #endif /* CONFIG_HS20 */
1902
1903         /* WMM-AC ADDTS Response */
1904         if (nl80211_register_action_frame(bss, (u8 *) "\x11\x01", 2) < 0)
1905                 ret = -1;
1906
1907         /* WMM-AC DELTS */
1908         if (nl80211_register_action_frame(bss, (u8 *) "\x11\x02", 2) < 0)
1909                 ret = -1;
1910
1911         /* Radio Measurement - Neighbor Report Response */
1912         if (nl80211_register_action_frame(bss, (u8 *) "\x05\x05", 2) < 0)
1913                 ret = -1;
1914
1915         /* Radio Measurement - Link Measurement Request */
1916         if ((drv->capa.rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION) &&
1917             (nl80211_register_action_frame(bss, (u8 *) "\x05\x02", 2) < 0))
1918                 ret = -1;
1919
1920         nl80211_mgmt_handle_register_eloop(bss);
1921
1922         return ret;
1923 }
1924
1925
1926 static int nl80211_mgmt_subscribe_mesh(struct i802_bss *bss)
1927 {
1928         int ret = 0;
1929
1930         if (nl80211_alloc_mgmt_handle(bss))
1931                 return -1;
1932
1933         wpa_printf(MSG_DEBUG,
1934                    "nl80211: Subscribe to mgmt frames with mesh handle %p",
1935                    bss->nl_mgmt);
1936
1937         /* Auth frames for mesh SAE */
1938         if (nl80211_register_frame(bss, bss->nl_mgmt,
1939                                    (WLAN_FC_TYPE_MGMT << 2) |
1940                                    (WLAN_FC_STYPE_AUTH << 4),
1941                                    NULL, 0) < 0)
1942                 ret = -1;
1943
1944         /* Mesh peering open */
1945         if (nl80211_register_action_frame(bss, (u8 *) "\x0f\x01", 2) < 0)
1946                 ret = -1;
1947         /* Mesh peering confirm */
1948         if (nl80211_register_action_frame(bss, (u8 *) "\x0f\x02", 2) < 0)
1949                 ret = -1;
1950         /* Mesh peering close */
1951         if (nl80211_register_action_frame(bss, (u8 *) "\x0f\x03", 2) < 0)
1952                 ret = -1;
1953
1954         nl80211_mgmt_handle_register_eloop(bss);
1955
1956         return ret;
1957 }
1958
1959
1960 static int nl80211_register_spurious_class3(struct i802_bss *bss)
1961 {
1962         struct nl_msg *msg;
1963         int ret;
1964
1965         msg = nl80211_bss_msg(bss, 0, NL80211_CMD_UNEXPECTED_FRAME);
1966         ret = send_and_recv(bss->drv->global, bss->nl_mgmt, msg, NULL, NULL);
1967         if (ret) {
1968                 wpa_printf(MSG_DEBUG, "nl80211: Register spurious class3 "
1969                            "failed: ret=%d (%s)",
1970                            ret, strerror(-ret));
1971         }
1972         return ret;
1973 }
1974
1975
1976 static int nl80211_mgmt_subscribe_ap(struct i802_bss *bss)
1977 {
1978         static const int stypes[] = {
1979                 WLAN_FC_STYPE_AUTH,
1980                 WLAN_FC_STYPE_ASSOC_REQ,
1981                 WLAN_FC_STYPE_REASSOC_REQ,
1982                 WLAN_FC_STYPE_DISASSOC,
1983                 WLAN_FC_STYPE_DEAUTH,
1984                 WLAN_FC_STYPE_ACTION,
1985                 WLAN_FC_STYPE_PROBE_REQ,
1986 /* Beacon doesn't work as mac80211 doesn't currently allow
1987  * it, but it wouldn't really be the right thing anyway as
1988  * it isn't per interface ... maybe just dump the scan
1989  * results periodically for OLBC?
1990  */
1991                 /* WLAN_FC_STYPE_BEACON, */
1992         };
1993         unsigned int i;
1994
1995         if (nl80211_alloc_mgmt_handle(bss))
1996                 return -1;
1997         wpa_printf(MSG_DEBUG, "nl80211: Subscribe to mgmt frames with AP "
1998                    "handle %p", bss->nl_mgmt);
1999
2000         for (i = 0; i < ARRAY_SIZE(stypes); i++) {
2001                 if (nl80211_register_frame(bss, bss->nl_mgmt,
2002                                            (WLAN_FC_TYPE_MGMT << 2) |
2003                                            (stypes[i] << 4),
2004                                            NULL, 0) < 0) {
2005                         goto out_err;
2006                 }
2007         }
2008
2009         if (nl80211_register_spurious_class3(bss))
2010                 goto out_err;
2011
2012         if (nl80211_get_wiphy_data_ap(bss) == NULL)
2013                 goto out_err;
2014
2015         nl80211_mgmt_handle_register_eloop(bss);
2016         return 0;
2017
2018 out_err:
2019         nl_destroy_handles(&bss->nl_mgmt);
2020         return -1;
2021 }
2022
2023
2024 static int nl80211_mgmt_subscribe_ap_dev_sme(struct i802_bss *bss)
2025 {
2026         if (nl80211_alloc_mgmt_handle(bss))
2027                 return -1;
2028         wpa_printf(MSG_DEBUG, "nl80211: Subscribe to mgmt frames with AP "
2029                    "handle %p (device SME)", bss->nl_mgmt);
2030
2031         if (nl80211_register_frame(bss, bss->nl_mgmt,
2032                                    (WLAN_FC_TYPE_MGMT << 2) |
2033                                    (WLAN_FC_STYPE_ACTION << 4),
2034                                    NULL, 0) < 0)
2035                 goto out_err;
2036
2037         nl80211_mgmt_handle_register_eloop(bss);
2038         return 0;
2039
2040 out_err:
2041         nl_destroy_handles(&bss->nl_mgmt);
2042         return -1;
2043 }
2044
2045
2046 static void nl80211_mgmt_unsubscribe(struct i802_bss *bss, const char *reason)
2047 {
2048         if (bss->nl_mgmt == NULL)
2049                 return;
2050         wpa_printf(MSG_DEBUG, "nl80211: Unsubscribe mgmt frames handle %p "
2051                    "(%s)", bss->nl_mgmt, reason);
2052         nl80211_destroy_eloop_handle(&bss->nl_mgmt);
2053
2054         nl80211_put_wiphy_data_ap(bss);
2055 }
2056
2057
2058 static void wpa_driver_nl80211_send_rfkill(void *eloop_ctx, void *timeout_ctx)
2059 {
2060         wpa_supplicant_event(timeout_ctx, EVENT_INTERFACE_DISABLED, NULL);
2061 }
2062
2063
2064 static void nl80211_del_p2pdev(struct i802_bss *bss)
2065 {
2066         struct nl_msg *msg;
2067         int ret;
2068
2069         msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_DEL_INTERFACE);
2070         ret = send_and_recv_msgs(bss->drv, msg, NULL, NULL);
2071
2072         wpa_printf(MSG_DEBUG, "nl80211: Delete P2P Device %s (0x%llx): %s",
2073                    bss->ifname, (long long unsigned int) bss->wdev_id,
2074                    strerror(-ret));
2075 }
2076
2077
2078 static int nl80211_set_p2pdev(struct i802_bss *bss, int start)
2079 {
2080         struct nl_msg *msg;
2081         int ret;
2082
2083         msg = nl80211_cmd_msg(bss, 0, start ? NL80211_CMD_START_P2P_DEVICE :
2084                               NL80211_CMD_STOP_P2P_DEVICE);
2085         ret = send_and_recv_msgs(bss->drv, msg, NULL, NULL);
2086
2087         wpa_printf(MSG_DEBUG, "nl80211: %s P2P Device %s (0x%llx): %s",
2088                    start ? "Start" : "Stop",
2089                    bss->ifname, (long long unsigned int) bss->wdev_id,
2090                    strerror(-ret));
2091         return ret;
2092 }
2093
2094
2095 static int i802_set_iface_flags(struct i802_bss *bss, int up)
2096 {
2097         enum nl80211_iftype nlmode;
2098
2099         nlmode = nl80211_get_ifmode(bss);
2100         if (nlmode != NL80211_IFTYPE_P2P_DEVICE) {
2101                 return linux_set_iface_flags(bss->drv->global->ioctl_sock,
2102                                              bss->ifname, up);
2103         }
2104
2105         /* P2P Device has start/stop which is equivalent */
2106         return nl80211_set_p2pdev(bss, up);
2107 }
2108
2109
2110 #ifdef CONFIG_TESTING_OPTIONS
2111 static int qca_vendor_test_cmd_handler(struct nl_msg *msg, void *arg)
2112 {
2113         /* struct wpa_driver_nl80211_data *drv = arg; */
2114         struct nlattr *tb[NL80211_ATTR_MAX + 1];
2115         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
2116
2117
2118         wpa_printf(MSG_DEBUG,
2119                    "nl80211: QCA vendor test command response received");
2120
2121         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
2122                   genlmsg_attrlen(gnlh, 0), NULL);
2123         if (!tb[NL80211_ATTR_VENDOR_DATA]) {
2124                 wpa_printf(MSG_DEBUG, "nl80211: No vendor data attribute");
2125                 return NL_SKIP;
2126         }
2127
2128         wpa_hexdump(MSG_DEBUG,
2129                     "nl80211: Received QCA vendor test command response",
2130                     nla_data(tb[NL80211_ATTR_VENDOR_DATA]),
2131                     nla_len(tb[NL80211_ATTR_VENDOR_DATA]));
2132
2133         return NL_SKIP;
2134 }
2135 #endif /* CONFIG_TESTING_OPTIONS */
2136
2137
2138 static void qca_vendor_test(struct wpa_driver_nl80211_data *drv)
2139 {
2140 #ifdef CONFIG_TESTING_OPTIONS
2141         struct nl_msg *msg;
2142         struct nlattr *params;
2143         int ret;
2144
2145         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
2146             nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
2147             nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
2148                         QCA_NL80211_VENDOR_SUBCMD_TEST) ||
2149             !(params = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
2150             nla_put_u32(msg, QCA_WLAN_VENDOR_ATTR_TEST, 123)) {
2151                 nlmsg_free(msg);
2152                 return;
2153         }
2154         nla_nest_end(msg, params);
2155
2156         ret = send_and_recv_msgs(drv, msg, qca_vendor_test_cmd_handler, drv);
2157         wpa_printf(MSG_DEBUG,
2158                    "nl80211: QCA vendor test command returned %d (%s)",
2159                    ret, strerror(-ret));
2160 #endif /* CONFIG_TESTING_OPTIONS */
2161 }
2162
2163
2164 static int
2165 wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv,
2166                                    const u8 *set_addr, int first,
2167                                    const char *driver_params)
2168 {
2169         struct i802_bss *bss = drv->first_bss;
2170         int send_rfkill_event = 0;
2171         enum nl80211_iftype nlmode;
2172
2173         drv->ifindex = if_nametoindex(bss->ifname);
2174         bss->ifindex = drv->ifindex;
2175         bss->wdev_id = drv->global->if_add_wdevid;
2176         bss->wdev_id_set = drv->global->if_add_wdevid_set;
2177
2178         bss->if_dynamic = drv->ifindex == drv->global->if_add_ifindex;
2179         bss->if_dynamic = bss->if_dynamic || drv->global->if_add_wdevid_set;
2180         drv->global->if_add_wdevid_set = 0;
2181
2182         if (!bss->if_dynamic && nl80211_get_ifmode(bss) == NL80211_IFTYPE_AP)
2183                 bss->static_ap = 1;
2184
2185         if (wpa_driver_nl80211_capa(drv))
2186                 return -1;
2187
2188         if (driver_params && nl80211_set_param(bss, driver_params) < 0)
2189                 return -1;
2190
2191         wpa_printf(MSG_DEBUG, "nl80211: interface %s in phy %s",
2192                    bss->ifname, drv->phyname);
2193
2194         if (set_addr &&
2195             (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 0) ||
2196              linux_set_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
2197                                 set_addr)))
2198                 return -1;
2199
2200         if (first && nl80211_get_ifmode(bss) == NL80211_IFTYPE_AP)
2201                 drv->start_mode_ap = 1;
2202
2203         if (drv->hostapd || bss->static_ap)
2204                 nlmode = NL80211_IFTYPE_AP;
2205         else if (bss->if_dynamic)
2206                 nlmode = nl80211_get_ifmode(bss);
2207         else
2208                 nlmode = NL80211_IFTYPE_STATION;
2209
2210         if (wpa_driver_nl80211_set_mode(bss, nlmode) < 0) {
2211                 wpa_printf(MSG_ERROR, "nl80211: Could not configure driver mode");
2212                 return -1;
2213         }
2214
2215         if (nlmode == NL80211_IFTYPE_P2P_DEVICE)
2216                 nl80211_get_macaddr(bss);
2217
2218         if (!rfkill_is_blocked(drv->rfkill)) {
2219                 int ret = i802_set_iface_flags(bss, 1);
2220                 if (ret) {
2221                         wpa_printf(MSG_ERROR, "nl80211: Could not set "
2222                                    "interface '%s' UP", bss->ifname);
2223                         return ret;
2224                 }
2225                 if (nlmode == NL80211_IFTYPE_P2P_DEVICE)
2226                         return ret;
2227         } else {
2228                 wpa_printf(MSG_DEBUG, "nl80211: Could not yet enable "
2229                            "interface '%s' due to rfkill", bss->ifname);
2230                 if (nlmode == NL80211_IFTYPE_P2P_DEVICE)
2231                         return 0;
2232                 drv->if_disabled = 1;
2233                 send_rfkill_event = 1;
2234         }
2235
2236         if (!drv->hostapd)
2237                 netlink_send_oper_ifla(drv->global->netlink, drv->ifindex,
2238                                        1, IF_OPER_DORMANT);
2239
2240         if (linux_get_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
2241                                bss->addr))
2242                 return -1;
2243         os_memcpy(drv->perm_addr, bss->addr, ETH_ALEN);
2244
2245         if (send_rfkill_event) {
2246                 eloop_register_timeout(0, 0, wpa_driver_nl80211_send_rfkill,
2247                                        drv, drv->ctx);
2248         }
2249
2250         if (drv->vendor_cmd_test_avail)
2251                 qca_vendor_test(drv);
2252
2253         return 0;
2254 }
2255
2256
2257 static int wpa_driver_nl80211_del_beacon(struct wpa_driver_nl80211_data *drv)
2258 {
2259         struct nl_msg *msg;
2260
2261         wpa_printf(MSG_DEBUG, "nl80211: Remove beacon (ifindex=%d)",
2262                    drv->ifindex);
2263         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_DEL_BEACON);
2264         return send_and_recv_msgs(drv, msg, NULL, NULL);
2265 }
2266
2267
2268 /**
2269  * wpa_driver_nl80211_deinit - Deinitialize nl80211 driver interface
2270  * @bss: Pointer to private nl80211 data from wpa_driver_nl80211_init()
2271  *
2272  * Shut down driver interface and processing of driver events. Free
2273  * private data buffer if one was allocated in wpa_driver_nl80211_init().
2274  */
2275 static void wpa_driver_nl80211_deinit(struct i802_bss *bss)
2276 {
2277         struct wpa_driver_nl80211_data *drv = bss->drv;
2278
2279         wpa_printf(MSG_INFO, "nl80211: deinit ifname=%s disabled_11b_rates=%d",
2280                    bss->ifname, drv->disabled_11b_rates);
2281
2282         bss->in_deinit = 1;
2283         if (drv->data_tx_status)
2284                 eloop_unregister_read_sock(drv->eapol_tx_sock);
2285         if (drv->eapol_tx_sock >= 0)
2286                 close(drv->eapol_tx_sock);
2287
2288         if (bss->nl_preq)
2289                 wpa_driver_nl80211_probe_req_report(bss, 0);
2290         if (bss->added_if_into_bridge) {
2291                 if (linux_br_del_if(drv->global->ioctl_sock, bss->brname,
2292                                     bss->ifname) < 0)
2293                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
2294                                    "interface %s from bridge %s: %s",
2295                                    bss->ifname, bss->brname, strerror(errno));
2296                 if (drv->rtnl_sk)
2297                         nl80211_handle_destroy(drv->rtnl_sk);
2298         }
2299         if (bss->added_bridge) {
2300                 if (linux_set_iface_flags(drv->global->ioctl_sock, bss->brname,
2301                                           0) < 0)
2302                         wpa_printf(MSG_INFO,
2303                                    "nl80211: Could not set bridge %s down",
2304                                    bss->brname);
2305                 if (linux_br_del(drv->global->ioctl_sock, bss->brname) < 0)
2306                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
2307                                    "bridge %s: %s",
2308                                    bss->brname, strerror(errno));
2309         }
2310
2311         nl80211_remove_monitor_interface(drv);
2312
2313         if (is_ap_interface(drv->nlmode))
2314                 wpa_driver_nl80211_del_beacon(drv);
2315
2316         if (drv->eapol_sock >= 0) {
2317                 eloop_unregister_read_sock(drv->eapol_sock);
2318                 close(drv->eapol_sock);
2319         }
2320
2321         if (drv->if_indices != drv->default_if_indices)
2322                 os_free(drv->if_indices);
2323
2324         if (drv->disabled_11b_rates)
2325                 nl80211_disable_11b_rates(drv, drv->ifindex, 0);
2326
2327         netlink_send_oper_ifla(drv->global->netlink, drv->ifindex, 0,
2328                                IF_OPER_UP);
2329         eloop_cancel_timeout(wpa_driver_nl80211_send_rfkill, drv, drv->ctx);
2330         rfkill_deinit(drv->rfkill);
2331
2332         eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
2333
2334         if (!drv->start_iface_up)
2335                 (void) i802_set_iface_flags(bss, 0);
2336
2337         if (drv->addr_changed) {
2338                 if (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname,
2339                                           0) < 0) {
2340                         wpa_printf(MSG_DEBUG,
2341                                    "nl80211: Could not set interface down to restore permanent MAC address");
2342                 }
2343                 if (linux_set_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
2344                                        drv->perm_addr) < 0) {
2345                         wpa_printf(MSG_DEBUG,
2346                                    "nl80211: Could not restore permanent MAC address");
2347                 }
2348         }
2349
2350         if (drv->nlmode != NL80211_IFTYPE_P2P_DEVICE) {
2351                 if (!drv->hostapd || !drv->start_mode_ap)
2352                         wpa_driver_nl80211_set_mode(bss,
2353                                                     NL80211_IFTYPE_STATION);
2354                 nl80211_mgmt_unsubscribe(bss, "deinit");
2355         } else {
2356                 nl80211_mgmt_unsubscribe(bss, "deinit");
2357                 nl80211_del_p2pdev(bss);
2358         }
2359
2360         nl80211_destroy_bss(drv->first_bss);
2361
2362         os_free(drv->filter_ssids);
2363
2364         os_free(drv->auth_ie);
2365
2366         if (drv->in_interface_list)
2367                 dl_list_del(&drv->list);
2368
2369         os_free(drv->extended_capa);
2370         os_free(drv->extended_capa_mask);
2371         os_free(drv->first_bss);
2372         os_free(drv);
2373 }
2374
2375
2376 static u32 wpa_alg_to_cipher_suite(enum wpa_alg alg, size_t key_len)
2377 {
2378         switch (alg) {
2379         case WPA_ALG_WEP:
2380                 if (key_len == 5)
2381                         return WLAN_CIPHER_SUITE_WEP40;
2382                 return WLAN_CIPHER_SUITE_WEP104;
2383         case WPA_ALG_TKIP:
2384                 return WLAN_CIPHER_SUITE_TKIP;
2385         case WPA_ALG_CCMP:
2386                 return WLAN_CIPHER_SUITE_CCMP;
2387         case WPA_ALG_GCMP:
2388                 return WLAN_CIPHER_SUITE_GCMP;
2389         case WPA_ALG_CCMP_256:
2390                 return WLAN_CIPHER_SUITE_CCMP_256;
2391         case WPA_ALG_GCMP_256:
2392                 return WLAN_CIPHER_SUITE_GCMP_256;
2393         case WPA_ALG_IGTK:
2394                 return WLAN_CIPHER_SUITE_AES_CMAC;
2395         case WPA_ALG_BIP_GMAC_128:
2396                 return WLAN_CIPHER_SUITE_BIP_GMAC_128;
2397         case WPA_ALG_BIP_GMAC_256:
2398                 return WLAN_CIPHER_SUITE_BIP_GMAC_256;
2399         case WPA_ALG_BIP_CMAC_256:
2400                 return WLAN_CIPHER_SUITE_BIP_CMAC_256;
2401         case WPA_ALG_SMS4:
2402                 return WLAN_CIPHER_SUITE_SMS4;
2403         case WPA_ALG_KRK:
2404                 return WLAN_CIPHER_SUITE_KRK;
2405         case WPA_ALG_NONE:
2406         case WPA_ALG_PMK:
2407                 wpa_printf(MSG_ERROR, "nl80211: Unexpected encryption algorithm %d",
2408                            alg);
2409                 return 0;
2410         }
2411
2412         wpa_printf(MSG_ERROR, "nl80211: Unsupported encryption algorithm %d",
2413                    alg);
2414         return 0;
2415 }
2416
2417
2418 static u32 wpa_cipher_to_cipher_suite(unsigned int cipher)
2419 {
2420         switch (cipher) {
2421         case WPA_CIPHER_CCMP_256:
2422                 return WLAN_CIPHER_SUITE_CCMP_256;
2423         case WPA_CIPHER_GCMP_256:
2424                 return WLAN_CIPHER_SUITE_GCMP_256;
2425         case WPA_CIPHER_CCMP:
2426                 return WLAN_CIPHER_SUITE_CCMP;
2427         case WPA_CIPHER_GCMP:
2428                 return WLAN_CIPHER_SUITE_GCMP;
2429         case WPA_CIPHER_TKIP:
2430                 return WLAN_CIPHER_SUITE_TKIP;
2431         case WPA_CIPHER_WEP104:
2432                 return WLAN_CIPHER_SUITE_WEP104;
2433         case WPA_CIPHER_WEP40:
2434                 return WLAN_CIPHER_SUITE_WEP40;
2435         case WPA_CIPHER_GTK_NOT_USED:
2436                 return WLAN_CIPHER_SUITE_NO_GROUP_ADDR;
2437         }
2438
2439         return 0;
2440 }
2441
2442
2443 static int wpa_cipher_to_cipher_suites(unsigned int ciphers, u32 suites[],
2444                                        int max_suites)
2445 {
2446         int num_suites = 0;
2447
2448         if (num_suites < max_suites && ciphers & WPA_CIPHER_CCMP_256)
2449                 suites[num_suites++] = WLAN_CIPHER_SUITE_CCMP_256;
2450         if (num_suites < max_suites && ciphers & WPA_CIPHER_GCMP_256)
2451                 suites[num_suites++] = WLAN_CIPHER_SUITE_GCMP_256;
2452         if (num_suites < max_suites && ciphers & WPA_CIPHER_CCMP)
2453                 suites[num_suites++] = WLAN_CIPHER_SUITE_CCMP;
2454         if (num_suites < max_suites && ciphers & WPA_CIPHER_GCMP)
2455                 suites[num_suites++] = WLAN_CIPHER_SUITE_GCMP;
2456         if (num_suites < max_suites && ciphers & WPA_CIPHER_TKIP)
2457                 suites[num_suites++] = WLAN_CIPHER_SUITE_TKIP;
2458         if (num_suites < max_suites && ciphers & WPA_CIPHER_WEP104)
2459                 suites[num_suites++] = WLAN_CIPHER_SUITE_WEP104;
2460         if (num_suites < max_suites && ciphers & WPA_CIPHER_WEP40)
2461                 suites[num_suites++] = WLAN_CIPHER_SUITE_WEP40;
2462
2463         return num_suites;
2464 }
2465
2466
2467 static int issue_key_mgmt_set_key(struct wpa_driver_nl80211_data *drv,
2468                                   const u8 *key, size_t key_len)
2469 {
2470         struct nl_msg *msg;
2471         int ret;
2472
2473         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_KEY_MGMT_OFFLOAD))
2474                 return 0;
2475
2476         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
2477             nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
2478             nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
2479                         QCA_NL80211_VENDOR_SUBCMD_KEY_MGMT_SET_KEY) ||
2480             nla_put(msg, NL80211_ATTR_VENDOR_DATA, key_len, key)) {
2481                 nl80211_nlmsg_clear(msg);
2482                 nlmsg_free(msg);
2483                 return -1;
2484         }
2485         ret = send_and_recv_msgs(drv, msg, NULL, (void *) -1);
2486         if (ret) {
2487                 wpa_printf(MSG_DEBUG,
2488                            "nl80211: Key management set key failed: ret=%d (%s)",
2489                            ret, strerror(-ret));
2490         }
2491
2492         return ret;
2493 }
2494
2495
2496 static int wpa_driver_nl80211_set_key(const char *ifname, struct i802_bss *bss,
2497                                       enum wpa_alg alg, const u8 *addr,
2498                                       int key_idx, int set_tx,
2499                                       const u8 *seq, size_t seq_len,
2500                                       const u8 *key, size_t key_len)
2501 {
2502         struct wpa_driver_nl80211_data *drv = bss->drv;
2503         int ifindex;
2504         struct nl_msg *msg;
2505         int ret;
2506         int tdls = 0;
2507
2508         /* Ignore for P2P Device */
2509         if (drv->nlmode == NL80211_IFTYPE_P2P_DEVICE)
2510                 return 0;
2511
2512         ifindex = if_nametoindex(ifname);
2513         wpa_printf(MSG_DEBUG, "%s: ifindex=%d (%s) alg=%d addr=%p key_idx=%d "
2514                    "set_tx=%d seq_len=%lu key_len=%lu",
2515                    __func__, ifindex, ifname, alg, addr, key_idx, set_tx,
2516                    (unsigned long) seq_len, (unsigned long) key_len);
2517 #ifdef CONFIG_TDLS
2518         if (key_idx == -1) {
2519                 key_idx = 0;
2520                 tdls = 1;
2521         }
2522 #endif /* CONFIG_TDLS */
2523
2524         if (alg == WPA_ALG_PMK &&
2525             (drv->capa.flags & WPA_DRIVER_FLAGS_KEY_MGMT_OFFLOAD)) {
2526                 wpa_printf(MSG_DEBUG, "%s: calling issue_key_mgmt_set_key",
2527                            __func__);
2528                 ret = issue_key_mgmt_set_key(drv, key, key_len);
2529                 return ret;
2530         }
2531
2532         if (alg == WPA_ALG_NONE) {
2533                 msg = nl80211_ifindex_msg(drv, ifindex, 0, NL80211_CMD_DEL_KEY);
2534                 if (!msg)
2535                         return -ENOBUFS;
2536         } else {
2537                 msg = nl80211_ifindex_msg(drv, ifindex, 0, NL80211_CMD_NEW_KEY);
2538                 if (!msg ||
2539                     nla_put(msg, NL80211_ATTR_KEY_DATA, key_len, key) ||
2540                     nla_put_u32(msg, NL80211_ATTR_KEY_CIPHER,
2541                                 wpa_alg_to_cipher_suite(alg, key_len)))
2542                         goto fail;
2543                 wpa_hexdump_key(MSG_DEBUG, "nl80211: KEY_DATA", key, key_len);
2544         }
2545
2546         if (seq && seq_len) {
2547                 if (nla_put(msg, NL80211_ATTR_KEY_SEQ, seq_len, seq))
2548                         goto fail;
2549                 wpa_hexdump(MSG_DEBUG, "nl80211: KEY_SEQ", seq, seq_len);
2550         }
2551
2552         if (addr && !is_broadcast_ether_addr(addr)) {
2553                 wpa_printf(MSG_DEBUG, "   addr=" MACSTR, MAC2STR(addr));
2554                 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
2555                         goto fail;
2556
2557                 if (alg != WPA_ALG_WEP && key_idx && !set_tx) {
2558                         wpa_printf(MSG_DEBUG, "   RSN IBSS RX GTK");
2559                         if (nla_put_u32(msg, NL80211_ATTR_KEY_TYPE,
2560                                         NL80211_KEYTYPE_GROUP))
2561                                 goto fail;
2562                 }
2563         } else if (addr && is_broadcast_ether_addr(addr)) {
2564                 struct nlattr *types;
2565
2566                 wpa_printf(MSG_DEBUG, "   broadcast key");
2567
2568                 types = nla_nest_start(msg, NL80211_ATTR_KEY_DEFAULT_TYPES);
2569                 if (!types ||
2570                     nla_put_flag(msg, NL80211_KEY_DEFAULT_TYPE_MULTICAST))
2571                         goto fail;
2572                 nla_nest_end(msg, types);
2573         }
2574         if (nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2575                 goto fail;
2576
2577         ret = send_and_recv_msgs(drv, msg, NULL, key ? (void *) -1 : NULL);
2578         if ((ret == -ENOENT || ret == -ENOLINK) && alg == WPA_ALG_NONE)
2579                 ret = 0;
2580         if (ret)
2581                 wpa_printf(MSG_DEBUG, "nl80211: set_key failed; err=%d %s)",
2582                            ret, strerror(-ret));
2583
2584         /*
2585          * If we failed or don't need to set the default TX key (below),
2586          * we're done here.
2587          */
2588         if (ret || !set_tx || alg == WPA_ALG_NONE || tdls)
2589                 return ret;
2590         if (is_ap_interface(drv->nlmode) && addr &&
2591             !is_broadcast_ether_addr(addr))
2592                 return ret;
2593
2594         msg = nl80211_ifindex_msg(drv, ifindex, 0, NL80211_CMD_SET_KEY);
2595         if (!msg ||
2596             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx) ||
2597             nla_put_flag(msg, (alg == WPA_ALG_IGTK ||
2598                                alg == WPA_ALG_BIP_GMAC_128 ||
2599                                alg == WPA_ALG_BIP_GMAC_256 ||
2600                                alg == WPA_ALG_BIP_CMAC_256) ?
2601                          NL80211_ATTR_KEY_DEFAULT_MGMT :
2602                          NL80211_ATTR_KEY_DEFAULT))
2603                 goto fail;
2604         if (addr && is_broadcast_ether_addr(addr)) {
2605                 struct nlattr *types;
2606
2607                 types = nla_nest_start(msg, NL80211_ATTR_KEY_DEFAULT_TYPES);
2608                 if (!types ||
2609                     nla_put_flag(msg, NL80211_KEY_DEFAULT_TYPE_MULTICAST))
2610                         goto fail;
2611                 nla_nest_end(msg, types);
2612         } else if (addr) {
2613                 struct nlattr *types;
2614
2615                 types = nla_nest_start(msg, NL80211_ATTR_KEY_DEFAULT_TYPES);
2616                 if (!types ||
2617                     nla_put_flag(msg, NL80211_KEY_DEFAULT_TYPE_UNICAST))
2618                         goto fail;
2619                 nla_nest_end(msg, types);
2620         }
2621
2622         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
2623         if (ret == -ENOENT)
2624                 ret = 0;
2625         if (ret)
2626                 wpa_printf(MSG_DEBUG, "nl80211: set_key default failed; "
2627                            "err=%d %s)", ret, strerror(-ret));
2628         return ret;
2629
2630 fail:
2631         nl80211_nlmsg_clear(msg);
2632         nlmsg_free(msg);
2633         return -ENOBUFS;
2634 }
2635
2636
2637 static int nl_add_key(struct nl_msg *msg, enum wpa_alg alg,
2638                       int key_idx, int defkey,
2639                       const u8 *seq, size_t seq_len,
2640                       const u8 *key, size_t key_len)
2641 {
2642         struct nlattr *key_attr = nla_nest_start(msg, NL80211_ATTR_KEY);
2643         if (!key_attr)
2644                 return -1;
2645
2646         if (defkey && alg == WPA_ALG_IGTK) {
2647                 if (nla_put_flag(msg, NL80211_KEY_DEFAULT_MGMT))
2648                         return -1;
2649         } else if (defkey) {
2650                 if (nla_put_flag(msg, NL80211_KEY_DEFAULT))
2651                         return -1;
2652         }
2653
2654         if (nla_put_u8(msg, NL80211_KEY_IDX, key_idx) ||
2655             nla_put_u32(msg, NL80211_KEY_CIPHER,
2656                         wpa_alg_to_cipher_suite(alg, key_len)) ||
2657             (seq && seq_len &&
2658              nla_put(msg, NL80211_KEY_SEQ, seq_len, seq)) ||
2659             nla_put(msg, NL80211_KEY_DATA, key_len, key))
2660                 return -1;
2661
2662         nla_nest_end(msg, key_attr);
2663
2664         return 0;
2665 }
2666
2667
2668 static int nl80211_set_conn_keys(struct wpa_driver_associate_params *params,
2669                                  struct nl_msg *msg)
2670 {
2671         int i, privacy = 0;
2672         struct nlattr *nl_keys, *nl_key;
2673
2674         for (i = 0; i < 4; i++) {
2675                 if (!params->wep_key[i])
2676                         continue;
2677                 privacy = 1;
2678                 break;
2679         }
2680         if (params->wps == WPS_MODE_PRIVACY)
2681                 privacy = 1;
2682         if (params->pairwise_suite &&
2683             params->pairwise_suite != WPA_CIPHER_NONE)
2684                 privacy = 1;
2685
2686         if (!privacy)
2687                 return 0;
2688
2689         if (nla_put_flag(msg, NL80211_ATTR_PRIVACY))
2690                 return -ENOBUFS;
2691
2692         nl_keys = nla_nest_start(msg, NL80211_ATTR_KEYS);
2693         if (!nl_keys)
2694                 return -ENOBUFS;
2695
2696         for (i = 0; i < 4; i++) {
2697                 if (!params->wep_key[i])
2698                         continue;
2699
2700                 nl_key = nla_nest_start(msg, i);
2701                 if (!nl_key ||
2702                     nla_put(msg, NL80211_KEY_DATA, params->wep_key_len[i],
2703                             params->wep_key[i]) ||
2704                     nla_put_u32(msg, NL80211_KEY_CIPHER,
2705                                 params->wep_key_len[i] == 5 ?
2706                                 WLAN_CIPHER_SUITE_WEP40 :
2707                                 WLAN_CIPHER_SUITE_WEP104) ||
2708                     nla_put_u8(msg, NL80211_KEY_IDX, i) ||
2709                     (i == params->wep_tx_keyidx &&
2710                      nla_put_flag(msg, NL80211_KEY_DEFAULT)))
2711                         return -ENOBUFS;
2712
2713                 nla_nest_end(msg, nl_key);
2714         }
2715         nla_nest_end(msg, nl_keys);
2716
2717         return 0;
2718 }
2719
2720
2721 int wpa_driver_nl80211_mlme(struct wpa_driver_nl80211_data *drv,
2722                             const u8 *addr, int cmd, u16 reason_code,
2723                             int local_state_change)
2724 {
2725         int ret;
2726         struct nl_msg *msg;
2727
2728         if (!(msg = nl80211_drv_msg(drv, 0, cmd)) ||
2729             nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code) ||
2730             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
2731             (local_state_change &&
2732              nla_put_flag(msg, NL80211_ATTR_LOCAL_STATE_CHANGE))) {
2733                 nlmsg_free(msg);
2734                 return -1;
2735         }
2736
2737         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
2738         if (ret) {
2739                 wpa_dbg(drv->ctx, MSG_DEBUG,
2740                         "nl80211: MLME command failed: reason=%u ret=%d (%s)",
2741                         reason_code, ret, strerror(-ret));
2742         }
2743         return ret;
2744 }
2745
2746
2747 static int wpa_driver_nl80211_disconnect(struct wpa_driver_nl80211_data *drv,
2748                                          int reason_code)
2749 {
2750         int ret;
2751
2752         wpa_printf(MSG_DEBUG, "%s(reason_code=%d)", __func__, reason_code);
2753         nl80211_mark_disconnected(drv);
2754         /* Disconnect command doesn't need BSSID - it uses cached value */
2755         ret = wpa_driver_nl80211_mlme(drv, NULL, NL80211_CMD_DISCONNECT,
2756                                       reason_code, 0);
2757         /*
2758          * For locally generated disconnect, supplicant already generates a
2759          * DEAUTH event, so ignore the event from NL80211.
2760          */
2761         drv->ignore_next_local_disconnect = ret == 0;
2762
2763         return ret;
2764 }
2765
2766
2767 static int wpa_driver_nl80211_deauthenticate(struct i802_bss *bss,
2768                                              const u8 *addr, int reason_code)
2769 {
2770         struct wpa_driver_nl80211_data *drv = bss->drv;
2771         int ret;
2772
2773         if (drv->nlmode == NL80211_IFTYPE_ADHOC) {
2774                 nl80211_mark_disconnected(drv);
2775                 return nl80211_leave_ibss(drv, 1);
2776         }
2777         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME))
2778                 return wpa_driver_nl80211_disconnect(drv, reason_code);
2779         wpa_printf(MSG_DEBUG, "%s(addr=" MACSTR " reason_code=%d)",
2780                    __func__, MAC2STR(addr), reason_code);
2781         nl80211_mark_disconnected(drv);
2782         ret = wpa_driver_nl80211_mlme(drv, addr, NL80211_CMD_DEAUTHENTICATE,
2783                                       reason_code, 0);
2784         /*
2785          * For locally generated deauthenticate, supplicant already generates a
2786          * DEAUTH event, so ignore the event from NL80211.
2787          */
2788         drv->ignore_next_local_deauth = ret == 0;
2789         return ret;
2790 }
2791
2792
2793 static void nl80211_copy_auth_params(struct wpa_driver_nl80211_data *drv,
2794                                      struct wpa_driver_auth_params *params)
2795 {
2796         int i;
2797
2798         drv->auth_freq = params->freq;
2799         drv->auth_alg = params->auth_alg;
2800         drv->auth_wep_tx_keyidx = params->wep_tx_keyidx;
2801         drv->auth_local_state_change = params->local_state_change;
2802         drv->auth_p2p = params->p2p;
2803
2804         if (params->bssid)
2805                 os_memcpy(drv->auth_bssid_, params->bssid, ETH_ALEN);
2806         else
2807                 os_memset(drv->auth_bssid_, 0, ETH_ALEN);
2808
2809         if (params->ssid) {
2810                 os_memcpy(drv->auth_ssid, params->ssid, params->ssid_len);
2811                 drv->auth_ssid_len = params->ssid_len;
2812         } else
2813                 drv->auth_ssid_len = 0;
2814
2815
2816         os_free(drv->auth_ie);
2817         drv->auth_ie = NULL;
2818         drv->auth_ie_len = 0;
2819         if (params->ie) {
2820                 drv->auth_ie = os_malloc(params->ie_len);
2821                 if (drv->auth_ie) {
2822                         os_memcpy(drv->auth_ie, params->ie, params->ie_len);
2823                         drv->auth_ie_len = params->ie_len;
2824                 }
2825         }
2826
2827         for (i = 0; i < 4; i++) {
2828                 if (params->wep_key[i] && params->wep_key_len[i] &&
2829                     params->wep_key_len[i] <= 16) {
2830                         os_memcpy(drv->auth_wep_key[i], params->wep_key[i],
2831                                   params->wep_key_len[i]);
2832                         drv->auth_wep_key_len[i] = params->wep_key_len[i];
2833                 } else
2834                         drv->auth_wep_key_len[i] = 0;
2835         }
2836 }
2837
2838
2839 static void nl80211_unmask_11b_rates(struct i802_bss *bss)
2840 {
2841         struct wpa_driver_nl80211_data *drv = bss->drv;
2842
2843         if (is_p2p_net_interface(drv->nlmode) || !drv->disabled_11b_rates)
2844                 return;
2845
2846         /*
2847          * Looks like we failed to unmask 11b rates previously. This could
2848          * happen, e.g., if the interface was down at the point in time when a
2849          * P2P group was terminated.
2850          */
2851         wpa_printf(MSG_DEBUG,
2852                    "nl80211: Interface %s mode is for non-P2P, but 11b rates were disabled - re-enable them",
2853                    bss->ifname);
2854         nl80211_disable_11b_rates(drv, drv->ifindex, 0);
2855 }
2856
2857
2858 static int wpa_driver_nl80211_authenticate(
2859         struct i802_bss *bss, struct wpa_driver_auth_params *params)
2860 {
2861         struct wpa_driver_nl80211_data *drv = bss->drv;
2862         int ret = -1, i;
2863         struct nl_msg *msg;
2864         enum nl80211_auth_type type;
2865         enum nl80211_iftype nlmode;
2866         int count = 0;
2867         int is_retry;
2868
2869         nl80211_unmask_11b_rates(bss);
2870
2871         is_retry = drv->retry_auth;
2872         drv->retry_auth = 0;
2873         drv->ignore_deauth_event = 0;
2874
2875         nl80211_mark_disconnected(drv);
2876         os_memset(drv->auth_bssid, 0, ETH_ALEN);
2877         if (params->bssid)
2878                 os_memcpy(drv->auth_attempt_bssid, params->bssid, ETH_ALEN);
2879         else
2880                 os_memset(drv->auth_attempt_bssid, 0, ETH_ALEN);
2881         /* FIX: IBSS mode */
2882         nlmode = params->p2p ?
2883                 NL80211_IFTYPE_P2P_CLIENT : NL80211_IFTYPE_STATION;
2884         if (drv->nlmode != nlmode &&
2885             wpa_driver_nl80211_set_mode(bss, nlmode) < 0)
2886                 return -1;
2887
2888 retry:
2889         wpa_printf(MSG_DEBUG, "nl80211: Authenticate (ifindex=%d)",
2890                    drv->ifindex);
2891
2892         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_AUTHENTICATE);
2893         if (!msg)
2894                 goto fail;
2895
2896         for (i = 0; i < 4; i++) {
2897                 if (!params->wep_key[i])
2898                         continue;
2899                 wpa_driver_nl80211_set_key(bss->ifname, bss, WPA_ALG_WEP,
2900                                            NULL, i,
2901                                            i == params->wep_tx_keyidx, NULL, 0,
2902                                            params->wep_key[i],
2903                                            params->wep_key_len[i]);
2904                 if (params->wep_tx_keyidx != i)
2905                         continue;
2906                 if (nl_add_key(msg, WPA_ALG_WEP, i, 1, NULL, 0,
2907                                params->wep_key[i], params->wep_key_len[i]))
2908                         goto fail;
2909         }
2910
2911         if (params->bssid) {
2912                 wpa_printf(MSG_DEBUG, "  * bssid=" MACSTR,
2913                            MAC2STR(params->bssid));
2914                 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid))
2915                         goto fail;
2916         }
2917         if (params->freq) {
2918                 wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq);
2919                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq))
2920                         goto fail;
2921         }
2922         if (params->ssid) {
2923                 wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
2924                                   params->ssid, params->ssid_len);
2925                 if (nla_put(msg, NL80211_ATTR_SSID, params->ssid_len,
2926                             params->ssid))
2927                         goto fail;
2928         }
2929         wpa_hexdump(MSG_DEBUG, "  * IEs", params->ie, params->ie_len);
2930         if (params->ie &&
2931             nla_put(msg, NL80211_ATTR_IE, params->ie_len, params->ie))
2932                 goto fail;
2933         if (params->sae_data) {
2934                 wpa_hexdump(MSG_DEBUG, "  * SAE data", params->sae_data,
2935                             params->sae_data_len);
2936                 if (nla_put(msg, NL80211_ATTR_SAE_DATA, params->sae_data_len,
2937                             params->sae_data))
2938                         goto fail;
2939         }
2940         if (params->auth_alg & WPA_AUTH_ALG_OPEN)
2941                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
2942         else if (params->auth_alg & WPA_AUTH_ALG_SHARED)
2943                 type = NL80211_AUTHTYPE_SHARED_KEY;
2944         else if (params->auth_alg & WPA_AUTH_ALG_LEAP)
2945                 type = NL80211_AUTHTYPE_NETWORK_EAP;
2946         else if (params->auth_alg & WPA_AUTH_ALG_FT)
2947                 type = NL80211_AUTHTYPE_FT;
2948         else if (params->auth_alg & WPA_AUTH_ALG_SAE)
2949                 type = NL80211_AUTHTYPE_SAE;
2950         else
2951                 goto fail;
2952         wpa_printf(MSG_DEBUG, "  * Auth Type %d", type);
2953         if (nla_put_u32(msg, NL80211_ATTR_AUTH_TYPE, type))
2954                 goto fail;
2955         if (params->local_state_change) {
2956                 wpa_printf(MSG_DEBUG, "  * Local state change only");
2957                 if (nla_put_flag(msg, NL80211_ATTR_LOCAL_STATE_CHANGE))
2958                         goto fail;
2959         }
2960
2961         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
2962         msg = NULL;
2963         if (ret) {
2964                 wpa_dbg(drv->ctx, MSG_DEBUG,
2965                         "nl80211: MLME command failed (auth): ret=%d (%s)",
2966                         ret, strerror(-ret));
2967                 count++;
2968                 if (ret == -EALREADY && count == 1 && params->bssid &&
2969                     !params->local_state_change) {
2970                         /*
2971                          * mac80211 does not currently accept new
2972                          * authentication if we are already authenticated. As a
2973                          * workaround, force deauthentication and try again.
2974                          */
2975                         wpa_printf(MSG_DEBUG, "nl80211: Retry authentication "
2976                                    "after forced deauthentication");
2977                         drv->ignore_deauth_event = 1;
2978                         wpa_driver_nl80211_deauthenticate(
2979                                 bss, params->bssid,
2980                                 WLAN_REASON_PREV_AUTH_NOT_VALID);
2981                         nlmsg_free(msg);
2982                         goto retry;
2983                 }
2984
2985                 if (ret == -ENOENT && params->freq && !is_retry) {
2986                         /*
2987                          * cfg80211 has likely expired the BSS entry even
2988                          * though it was previously available in our internal
2989                          * BSS table. To recover quickly, start a single
2990                          * channel scan on the specified channel.
2991                          */
2992                         struct wpa_driver_scan_params scan;
2993                         int freqs[2];
2994
2995                         os_memset(&scan, 0, sizeof(scan));
2996                         scan.num_ssids = 1;
2997                         if (params->ssid) {
2998                                 scan.ssids[0].ssid = params->ssid;
2999                                 scan.ssids[0].ssid_len = params->ssid_len;
3000                         }
3001                         freqs[0] = params->freq;
3002                         freqs[1] = 0;
3003                         scan.freqs = freqs;
3004                         wpa_printf(MSG_DEBUG, "nl80211: Trigger single "
3005                                    "channel scan to refresh cfg80211 BSS "
3006                                    "entry");
3007                         ret = wpa_driver_nl80211_scan(bss, &scan);
3008                         if (ret == 0) {
3009                                 nl80211_copy_auth_params(drv, params);
3010                                 drv->scan_for_auth = 1;
3011                         }
3012                 } else if (is_retry) {
3013                         /*
3014                          * Need to indicate this with an event since the return
3015                          * value from the retry is not delivered to core code.
3016                          */
3017                         union wpa_event_data event;
3018                         wpa_printf(MSG_DEBUG, "nl80211: Authentication retry "
3019                                    "failed");
3020                         os_memset(&event, 0, sizeof(event));
3021                         os_memcpy(event.timeout_event.addr, drv->auth_bssid_,
3022                                   ETH_ALEN);
3023                         wpa_supplicant_event(drv->ctx, EVENT_AUTH_TIMED_OUT,
3024                                              &event);
3025                 }
3026         } else {
3027                 wpa_printf(MSG_DEBUG,
3028                            "nl80211: Authentication request send successfully");
3029         }
3030
3031 fail:
3032         nlmsg_free(msg);
3033         return ret;
3034 }
3035
3036
3037 int wpa_driver_nl80211_authenticate_retry(struct wpa_driver_nl80211_data *drv)
3038 {
3039         struct wpa_driver_auth_params params;
3040         struct i802_bss *bss = drv->first_bss;
3041         int i;
3042
3043         wpa_printf(MSG_DEBUG, "nl80211: Try to authenticate again");
3044
3045         os_memset(&params, 0, sizeof(params));
3046         params.freq = drv->auth_freq;
3047         params.auth_alg = drv->auth_alg;
3048         params.wep_tx_keyidx = drv->auth_wep_tx_keyidx;
3049         params.local_state_change = drv->auth_local_state_change;
3050         params.p2p = drv->auth_p2p;
3051
3052         if (!is_zero_ether_addr(drv->auth_bssid_))
3053                 params.bssid = drv->auth_bssid_;
3054
3055         if (drv->auth_ssid_len) {
3056                 params.ssid = drv->auth_ssid;
3057                 params.ssid_len = drv->auth_ssid_len;
3058         }
3059
3060         params.ie = drv->auth_ie;
3061         params.ie_len = drv->auth_ie_len;
3062
3063         for (i = 0; i < 4; i++) {
3064                 if (drv->auth_wep_key_len[i]) {
3065                         params.wep_key[i] = drv->auth_wep_key[i];
3066                         params.wep_key_len[i] = drv->auth_wep_key_len[i];
3067                 }
3068         }
3069
3070         drv->retry_auth = 1;
3071         return wpa_driver_nl80211_authenticate(bss, &params);
3072 }
3073
3074
3075 static int wpa_driver_nl80211_send_frame(struct i802_bss *bss,
3076                                          const void *data, size_t len,
3077                                          int encrypt, int noack,
3078                                          unsigned int freq, int no_cck,
3079                                          int offchanok, unsigned int wait_time)
3080 {
3081         struct wpa_driver_nl80211_data *drv = bss->drv;
3082         u64 cookie;
3083         int res;
3084
3085         if (freq == 0 && drv->nlmode == NL80211_IFTYPE_ADHOC) {
3086                 freq = nl80211_get_assoc_freq(drv);
3087                 wpa_printf(MSG_DEBUG,
3088                            "nl80211: send_frame - Use assoc_freq=%u for IBSS",
3089                            freq);
3090         }
3091         if (freq == 0) {
3092                 wpa_printf(MSG_DEBUG, "nl80211: send_frame - Use bss->freq=%u",
3093                            bss->freq);
3094                 freq = bss->freq;
3095         }
3096
3097         if (drv->use_monitor) {
3098                 wpa_printf(MSG_DEBUG, "nl80211: send_frame(freq=%u bss->freq=%u) -> send_monitor",
3099                            freq, bss->freq);
3100                 return nl80211_send_monitor(drv, data, len, encrypt, noack);
3101         }
3102
3103         wpa_printf(MSG_DEBUG, "nl80211: send_frame -> send_frame_cmd");
3104         res = nl80211_send_frame_cmd(bss, freq, wait_time, data, len,
3105                                      &cookie, no_cck, noack, offchanok);
3106         if (res == 0 && !noack) {
3107                 const struct ieee80211_mgmt *mgmt;
3108                 u16 fc;
3109
3110                 mgmt = (const struct ieee80211_mgmt *) data;
3111                 fc = le_to_host16(mgmt->frame_control);
3112                 if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
3113                     WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_ACTION) {
3114                         wpa_printf(MSG_MSGDUMP,
3115                                    "nl80211: Update send_action_cookie from 0x%llx to 0x%llx",
3116                                    (long long unsigned int)
3117                                    drv->send_action_cookie,
3118                                    (long long unsigned int) cookie);
3119                         drv->send_action_cookie = cookie;
3120                 }
3121         }
3122
3123         return res;
3124 }
3125
3126
3127 static int wpa_driver_nl80211_send_mlme(struct i802_bss *bss, const u8 *data,
3128                                         size_t data_len, int noack,
3129                                         unsigned int freq, int no_cck,
3130                                         int offchanok,
3131                                         unsigned int wait_time)
3132 {
3133         struct wpa_driver_nl80211_data *drv = bss->drv;
3134         struct ieee80211_mgmt *mgmt;
3135         int encrypt = 1;
3136         u16 fc;
3137
3138         mgmt = (struct ieee80211_mgmt *) data;
3139         fc = le_to_host16(mgmt->frame_control);
3140         wpa_printf(MSG_DEBUG, "nl80211: send_mlme - da= " MACSTR
3141                    " noack=%d freq=%u no_cck=%d offchanok=%d wait_time=%u fc=0x%x (%s) nlmode=%d",
3142                    MAC2STR(mgmt->da), noack, freq, no_cck, offchanok, wait_time,
3143                    fc, fc2str(fc), drv->nlmode);
3144
3145         if ((is_sta_interface(drv->nlmode) ||
3146              drv->nlmode == NL80211_IFTYPE_P2P_DEVICE) &&
3147             WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
3148             WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_PROBE_RESP) {
3149                 /*
3150                  * The use of last_mgmt_freq is a bit of a hack,
3151                  * but it works due to the single-threaded nature
3152                  * of wpa_supplicant.
3153                  */
3154                 if (freq == 0) {
3155                         wpa_printf(MSG_DEBUG, "nl80211: Use last_mgmt_freq=%d",
3156                                    drv->last_mgmt_freq);
3157                         freq = drv->last_mgmt_freq;
3158                 }
3159                 return nl80211_send_frame_cmd(bss, freq, 0,
3160                                               data, data_len, NULL, 1, noack,
3161                                               1);
3162         }
3163
3164         if (drv->device_ap_sme && is_ap_interface(drv->nlmode)) {
3165                 if (freq == 0) {
3166                         wpa_printf(MSG_DEBUG, "nl80211: Use bss->freq=%d",
3167                                    bss->freq);
3168                         freq = bss->freq;
3169                 }
3170                 return nl80211_send_frame_cmd(bss, freq,
3171                                               (int) freq == bss->freq ? 0 :
3172                                               wait_time,
3173                                               data, data_len,
3174                                               &drv->send_action_cookie,
3175                                               no_cck, noack, offchanok);
3176         }
3177
3178         if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
3179             WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_AUTH) {
3180                 /*
3181                  * Only one of the authentication frame types is encrypted.
3182                  * In order for static WEP encryption to work properly (i.e.,
3183                  * to not encrypt the frame), we need to tell mac80211 about
3184                  * the frames that must not be encrypted.
3185                  */
3186                 u16 auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
3187                 u16 auth_trans = le_to_host16(mgmt->u.auth.auth_transaction);
3188                 if (auth_alg != WLAN_AUTH_SHARED_KEY || auth_trans != 3)
3189                         encrypt = 0;
3190         }
3191
3192         wpa_printf(MSG_DEBUG, "nl80211: send_mlme -> send_frame");
3193         return wpa_driver_nl80211_send_frame(bss, data, data_len, encrypt,
3194                                              noack, freq, no_cck, offchanok,
3195                                              wait_time);
3196 }
3197
3198
3199 static int nl80211_put_basic_rates(struct nl_msg *msg, const int *basic_rates)
3200 {
3201         u8 rates[NL80211_MAX_SUPP_RATES];
3202         u8 rates_len = 0;
3203         int i;
3204
3205         if (!basic_rates)
3206                 return 0;
3207
3208         for (i = 0; i < NL80211_MAX_SUPP_RATES && basic_rates[i] >= 0; i++)
3209                 rates[rates_len++] = basic_rates[i] / 5;
3210
3211         return nla_put(msg, NL80211_ATTR_BSS_BASIC_RATES, rates_len, rates);
3212 }
3213
3214
3215 static int nl80211_set_bss(struct i802_bss *bss, int cts, int preamble,
3216                            int slot, int ht_opmode, int ap_isolate,
3217                            const int *basic_rates)
3218 {
3219         struct wpa_driver_nl80211_data *drv = bss->drv;
3220         struct nl_msg *msg;
3221
3222         if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_SET_BSS)) ||
3223             (cts >= 0 &&
3224              nla_put_u8(msg, NL80211_ATTR_BSS_CTS_PROT, cts)) ||
3225             (preamble >= 0 &&
3226              nla_put_u8(msg, NL80211_ATTR_BSS_SHORT_PREAMBLE, preamble)) ||
3227             (slot >= 0 &&
3228              nla_put_u8(msg, NL80211_ATTR_BSS_SHORT_SLOT_TIME, slot)) ||
3229             (ht_opmode >= 0 &&
3230              nla_put_u16(msg, NL80211_ATTR_BSS_HT_OPMODE, ht_opmode)) ||
3231             (ap_isolate >= 0 &&
3232              nla_put_u8(msg, NL80211_ATTR_AP_ISOLATE, ap_isolate)) ||
3233             nl80211_put_basic_rates(msg, basic_rates)) {
3234                 nlmsg_free(msg);
3235                 return -ENOBUFS;
3236         }
3237
3238         return send_and_recv_msgs(drv, msg, NULL, NULL);
3239 }
3240
3241
3242 static int wpa_driver_nl80211_set_acl(void *priv,
3243                                       struct hostapd_acl_params *params)
3244 {
3245         struct i802_bss *bss = priv;
3246         struct wpa_driver_nl80211_data *drv = bss->drv;
3247         struct nl_msg *msg;
3248         struct nlattr *acl;
3249         unsigned int i;
3250         int ret;
3251
3252         if (!(drv->capa.max_acl_mac_addrs))
3253                 return -ENOTSUP;
3254
3255         if (params->num_mac_acl > drv->capa.max_acl_mac_addrs)
3256                 return -ENOTSUP;
3257
3258         wpa_printf(MSG_DEBUG, "nl80211: Set %s ACL (num_mac_acl=%u)",
3259                    params->acl_policy ? "Accept" : "Deny", params->num_mac_acl);
3260
3261         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_SET_MAC_ACL)) ||
3262             nla_put_u32(msg, NL80211_ATTR_ACL_POLICY, params->acl_policy ?
3263                         NL80211_ACL_POLICY_DENY_UNLESS_LISTED :
3264                         NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED) ||
3265             (acl = nla_nest_start(msg, NL80211_ATTR_MAC_ADDRS)) == NULL) {
3266                 nlmsg_free(msg);
3267                 return -ENOMEM;
3268         }
3269
3270         for (i = 0; i < params->num_mac_acl; i++) {
3271                 if (nla_put(msg, i + 1, ETH_ALEN, params->mac_acl[i].addr)) {
3272                         nlmsg_free(msg);
3273                         return -ENOMEM;
3274                 }
3275         }
3276
3277         nla_nest_end(msg, acl);
3278
3279         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3280         if (ret) {
3281                 wpa_printf(MSG_DEBUG, "nl80211: Failed to set MAC ACL: %d (%s)",
3282                            ret, strerror(-ret));
3283         }
3284
3285         return ret;
3286 }
3287
3288
3289 static int nl80211_put_beacon_int(struct nl_msg *msg, int beacon_int)
3290 {
3291         if (beacon_int > 0) {
3292                 wpa_printf(MSG_DEBUG, "  * beacon_int=%d", beacon_int);
3293                 return nla_put_u32(msg, NL80211_ATTR_BEACON_INTERVAL,
3294                                    beacon_int);
3295         }
3296
3297         return 0;
3298 }
3299
3300
3301 static int wpa_driver_nl80211_set_ap(void *priv,
3302                                      struct wpa_driver_ap_params *params)
3303 {
3304         struct i802_bss *bss = priv;
3305         struct wpa_driver_nl80211_data *drv = bss->drv;
3306         struct nl_msg *msg;
3307         u8 cmd = NL80211_CMD_NEW_BEACON;
3308         int ret;
3309         int beacon_set;
3310         int num_suites;
3311         int smps_mode;
3312         u32 suites[10], suite;
3313         u32 ver;
3314
3315         beacon_set = params->reenable ? 0 : bss->beacon_set;
3316
3317         wpa_printf(MSG_DEBUG, "nl80211: Set beacon (beacon_set=%d)",
3318                    beacon_set);
3319         if (beacon_set)
3320                 cmd = NL80211_CMD_SET_BEACON;
3321
3322         wpa_hexdump(MSG_DEBUG, "nl80211: Beacon head",
3323                     params->head, params->head_len);
3324         wpa_hexdump(MSG_DEBUG, "nl80211: Beacon tail",
3325                     params->tail, params->tail_len);
3326         wpa_printf(MSG_DEBUG, "nl80211: ifindex=%d", bss->ifindex);
3327         wpa_printf(MSG_DEBUG, "nl80211: beacon_int=%d", params->beacon_int);
3328         wpa_printf(MSG_DEBUG, "nl80211: dtim_period=%d", params->dtim_period);
3329         wpa_hexdump_ascii(MSG_DEBUG, "nl80211: ssid",
3330                           params->ssid, params->ssid_len);
3331         if (!(msg = nl80211_bss_msg(bss, 0, cmd)) ||
3332             nla_put(msg, NL80211_ATTR_BEACON_HEAD, params->head_len,
3333                     params->head) ||
3334             nla_put(msg, NL80211_ATTR_BEACON_TAIL, params->tail_len,
3335                     params->tail) ||
3336             nl80211_put_beacon_int(msg, params->beacon_int) ||
3337             nla_put_u32(msg, NL80211_ATTR_DTIM_PERIOD, params->dtim_period) ||
3338             nla_put(msg, NL80211_ATTR_SSID, params->ssid_len, params->ssid))
3339                 goto fail;
3340         if (params->proberesp && params->proberesp_len) {
3341                 wpa_hexdump(MSG_DEBUG, "nl80211: proberesp (offload)",
3342                             params->proberesp, params->proberesp_len);
3343                 if (nla_put(msg, NL80211_ATTR_PROBE_RESP, params->proberesp_len,
3344                             params->proberesp))
3345                         goto fail;
3346         }
3347         switch (params->hide_ssid) {
3348         case NO_SSID_HIDING:
3349                 wpa_printf(MSG_DEBUG, "nl80211: hidden SSID not in use");
3350                 if (nla_put_u32(msg, NL80211_ATTR_HIDDEN_SSID,
3351                                 NL80211_HIDDEN_SSID_NOT_IN_USE))
3352                         goto fail;
3353                 break;
3354         case HIDDEN_SSID_ZERO_LEN:
3355                 wpa_printf(MSG_DEBUG, "nl80211: hidden SSID zero len");
3356                 if (nla_put_u32(msg, NL80211_ATTR_HIDDEN_SSID,
3357                                 NL80211_HIDDEN_SSID_ZERO_LEN))
3358                         goto fail;
3359                 break;
3360         case HIDDEN_SSID_ZERO_CONTENTS:
3361                 wpa_printf(MSG_DEBUG, "nl80211: hidden SSID zero contents");
3362                 if (nla_put_u32(msg, NL80211_ATTR_HIDDEN_SSID,
3363                                 NL80211_HIDDEN_SSID_ZERO_CONTENTS))
3364                         goto fail;
3365                 break;
3366         }
3367         wpa_printf(MSG_DEBUG, "nl80211: privacy=%d", params->privacy);
3368         if (params->privacy &&
3369             nla_put_flag(msg, NL80211_ATTR_PRIVACY))
3370                 goto fail;
3371         wpa_printf(MSG_DEBUG, "nl80211: auth_algs=0x%x", params->auth_algs);
3372         if ((params->auth_algs & (WPA_AUTH_ALG_OPEN | WPA_AUTH_ALG_SHARED)) ==
3373             (WPA_AUTH_ALG_OPEN | WPA_AUTH_ALG_SHARED)) {
3374                 /* Leave out the attribute */
3375         } else if (params->auth_algs & WPA_AUTH_ALG_SHARED) {
3376                 if (nla_put_u32(msg, NL80211_ATTR_AUTH_TYPE,
3377                                 NL80211_AUTHTYPE_SHARED_KEY))
3378                         goto fail;
3379         } else {
3380                 if (nla_put_u32(msg, NL80211_ATTR_AUTH_TYPE,
3381                                 NL80211_AUTHTYPE_OPEN_SYSTEM))
3382                         goto fail;
3383         }
3384
3385         wpa_printf(MSG_DEBUG, "nl80211: wpa_version=0x%x", params->wpa_version);
3386         ver = 0;
3387         if (params->wpa_version & WPA_PROTO_WPA)
3388                 ver |= NL80211_WPA_VERSION_1;
3389         if (params->wpa_version & WPA_PROTO_RSN)
3390                 ver |= NL80211_WPA_VERSION_2;
3391         if (ver &&
3392             nla_put_u32(msg, NL80211_ATTR_WPA_VERSIONS, ver))
3393                 goto fail;
3394
3395         wpa_printf(MSG_DEBUG, "nl80211: key_mgmt_suites=0x%x",
3396                    params->key_mgmt_suites);
3397         num_suites = 0;
3398         if (params->key_mgmt_suites & WPA_KEY_MGMT_IEEE8021X)
3399                 suites[num_suites++] = WLAN_AKM_SUITE_8021X;
3400         if (params->key_mgmt_suites & WPA_KEY_MGMT_PSK)
3401                 suites[num_suites++] = WLAN_AKM_SUITE_PSK;
3402         if (num_suites &&
3403             nla_put(msg, NL80211_ATTR_AKM_SUITES, num_suites * sizeof(u32),
3404                     suites))
3405                 goto fail;
3406
3407         if (params->key_mgmt_suites & WPA_KEY_MGMT_IEEE8021X_NO_WPA &&
3408             params->pairwise_ciphers & (WPA_CIPHER_WEP104 | WPA_CIPHER_WEP40) &&
3409             nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT))
3410                 goto fail;
3411
3412         wpa_printf(MSG_DEBUG, "nl80211: pairwise_ciphers=0x%x",
3413                    params->pairwise_ciphers);
3414         num_suites = wpa_cipher_to_cipher_suites(params->pairwise_ciphers,
3415                                                  suites, ARRAY_SIZE(suites));
3416         if (num_suites &&
3417             nla_put(msg, NL80211_ATTR_CIPHER_SUITES_PAIRWISE,
3418                     num_suites * sizeof(u32), suites))
3419                 goto fail;
3420
3421         wpa_printf(MSG_DEBUG, "nl80211: group_cipher=0x%x",
3422                    params->group_cipher);
3423         suite = wpa_cipher_to_cipher_suite(params->group_cipher);
3424         if (suite &&
3425             nla_put_u32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP, suite))
3426                 goto fail;
3427
3428         switch (params->smps_mode) {
3429         case HT_CAP_INFO_SMPS_DYNAMIC:
3430                 wpa_printf(MSG_DEBUG, "nl80211: SMPS mode - dynamic");
3431                 smps_mode = NL80211_SMPS_DYNAMIC;
3432                 break;
3433         case HT_CAP_INFO_SMPS_STATIC:
3434                 wpa_printf(MSG_DEBUG, "nl80211: SMPS mode - static");
3435                 smps_mode = NL80211_SMPS_STATIC;
3436                 break;
3437         default:
3438                 /* invalid - fallback to smps off */
3439         case HT_CAP_INFO_SMPS_DISABLED:
3440                 wpa_printf(MSG_DEBUG, "nl80211: SMPS mode - off");
3441                 smps_mode = NL80211_SMPS_OFF;
3442                 break;
3443         }
3444         if (nla_put_u32(msg, NL80211_ATTR_SMPS_MODE, smps_mode))
3445                 goto fail;
3446
3447         if (params->beacon_ies) {
3448                 wpa_hexdump_buf(MSG_DEBUG, "nl80211: beacon_ies",
3449                                 params->beacon_ies);
3450                 if (nla_put(msg, NL80211_ATTR_IE,
3451                             wpabuf_len(params->beacon_ies),
3452                             wpabuf_head(params->beacon_ies)))
3453                         goto fail;
3454         }
3455         if (params->proberesp_ies) {
3456                 wpa_hexdump_buf(MSG_DEBUG, "nl80211: proberesp_ies",
3457                                 params->proberesp_ies);
3458                 if (nla_put(msg, NL80211_ATTR_IE_PROBE_RESP,
3459                             wpabuf_len(params->proberesp_ies),
3460                             wpabuf_head(params->proberesp_ies)))
3461                         goto fail;
3462         }
3463         if (params->assocresp_ies) {
3464                 wpa_hexdump_buf(MSG_DEBUG, "nl80211: assocresp_ies",
3465                                 params->assocresp_ies);
3466                 if (nla_put(msg, NL80211_ATTR_IE_ASSOC_RESP,
3467                             wpabuf_len(params->assocresp_ies),
3468                             wpabuf_head(params->assocresp_ies)))
3469                         goto fail;
3470         }
3471
3472         if (drv->capa.flags & WPA_DRIVER_FLAGS_INACTIVITY_TIMER)  {
3473                 wpa_printf(MSG_DEBUG, "nl80211: ap_max_inactivity=%d",
3474                            params->ap_max_inactivity);
3475                 if (nla_put_u16(msg, NL80211_ATTR_INACTIVITY_TIMEOUT,
3476                                 params->ap_max_inactivity))
3477                         goto fail;
3478         }
3479
3480 #ifdef CONFIG_P2P
3481         if (params->p2p_go_ctwindow > 0) {
3482                 if (drv->p2p_go_ctwindow_supported) {
3483                         wpa_printf(MSG_DEBUG, "nl80211: P2P GO ctwindow=%d",
3484                                    params->p2p_go_ctwindow);
3485                         if (nla_put_u8(msg, NL80211_ATTR_P2P_CTWINDOW,
3486                                        params->p2p_go_ctwindow))
3487                                 goto fail;
3488                 } else {
3489                         wpa_printf(MSG_INFO,
3490                                    "nl80211: Driver does not support CTWindow configuration - ignore this parameter");
3491                 }
3492         }
3493 #endif /* CONFIG_P2P */
3494
3495         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3496         if (ret) {
3497                 wpa_printf(MSG_DEBUG, "nl80211: Beacon set failed: %d (%s)",
3498                            ret, strerror(-ret));
3499         } else {
3500                 bss->beacon_set = 1;
3501                 nl80211_set_bss(bss, params->cts_protect, params->preamble,
3502                                 params->short_slot_time, params->ht_opmode,
3503                                 params->isolate, params->basic_rates);
3504                 if (beacon_set && params->freq &&
3505                     params->freq->bandwidth != bss->bandwidth) {
3506                         wpa_printf(MSG_DEBUG,
3507                                    "nl80211: Update BSS %s bandwidth: %d -> %d",
3508                                    bss->ifname, bss->bandwidth,
3509                                    params->freq->bandwidth);
3510                         ret = nl80211_set_channel(bss, params->freq, 1);
3511                         if (ret) {
3512                                 wpa_printf(MSG_DEBUG,
3513                                            "nl80211: Frequency set failed: %d (%s)",
3514                                            ret, strerror(-ret));
3515                         } else {
3516                                 wpa_printf(MSG_DEBUG,
3517                                            "nl80211: Frequency set succeeded for ht2040 coex");
3518                                 bss->bandwidth = params->freq->bandwidth;
3519                         }
3520                 } else if (!beacon_set) {
3521                         /*
3522                          * cfg80211 updates the driver on frequence change in AP
3523                          * mode only at the point when beaconing is started, so
3524                          * set the initial value here.
3525                          */
3526                         bss->bandwidth = params->freq->bandwidth;
3527                 }
3528         }
3529         return ret;
3530 fail:
3531         nlmsg_free(msg);
3532         return -ENOBUFS;
3533 }
3534
3535
3536 static int nl80211_put_freq_params(struct nl_msg *msg,
3537                                    const struct hostapd_freq_params *freq)
3538 {
3539         wpa_printf(MSG_DEBUG, "  * freq=%d", freq->freq);
3540         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq->freq))
3541                 return -ENOBUFS;
3542
3543         wpa_printf(MSG_DEBUG, "  * vht_enabled=%d", freq->vht_enabled);
3544         wpa_printf(MSG_DEBUG, "  * ht_enabled=%d", freq->ht_enabled);
3545
3546         if (freq->vht_enabled) {
3547                 enum nl80211_chan_width cw;
3548
3549                 wpa_printf(MSG_DEBUG, "  * bandwidth=%d", freq->bandwidth);
3550                 switch (freq->bandwidth) {
3551                 case 20:
3552                         cw = NL80211_CHAN_WIDTH_20;
3553                         break;
3554                 case 40:
3555                         cw = NL80211_CHAN_WIDTH_40;
3556                         break;
3557                 case 80:
3558                         if (freq->center_freq2)
3559                                 cw = NL80211_CHAN_WIDTH_80P80;
3560                         else
3561                                 cw = NL80211_CHAN_WIDTH_80;
3562                         break;
3563                 case 160:
3564                         cw = NL80211_CHAN_WIDTH_160;
3565                         break;
3566                 default:
3567                         return -EINVAL;
3568                 }
3569
3570                 wpa_printf(MSG_DEBUG, "  * channel_width=%d", cw);
3571                 wpa_printf(MSG_DEBUG, "  * center_freq1=%d",
3572                            freq->center_freq1);
3573                 wpa_printf(MSG_DEBUG, "  * center_freq2=%d",
3574                            freq->center_freq2);
3575                 if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, cw) ||
3576                     nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1,
3577                                 freq->center_freq1) ||
3578                     (freq->center_freq2 &&
3579                      nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2,
3580                                  freq->center_freq2)))
3581                         return -ENOBUFS;
3582         } else if (freq->ht_enabled) {
3583                 enum nl80211_channel_type ct;
3584
3585                 wpa_printf(MSG_DEBUG, "  * sec_channel_offset=%d",
3586                            freq->sec_channel_offset);
3587                 switch (freq->sec_channel_offset) {
3588                 case -1:
3589                         ct = NL80211_CHAN_HT40MINUS;
3590                         break;
3591                 case 1:
3592                         ct = NL80211_CHAN_HT40PLUS;
3593                         break;
3594                 default:
3595                         ct = NL80211_CHAN_HT20;
3596                         break;
3597                 }
3598
3599                 wpa_printf(MSG_DEBUG, "  * channel_type=%d", ct);
3600                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, ct))
3601                         return -ENOBUFS;
3602         }
3603         return 0;
3604 }
3605
3606
3607 static int nl80211_set_channel(struct i802_bss *bss,
3608                                struct hostapd_freq_params *freq, int set_chan)
3609 {
3610         struct wpa_driver_nl80211_data *drv = bss->drv;
3611         struct nl_msg *msg;
3612         int ret;
3613
3614         wpa_printf(MSG_DEBUG,
3615                    "nl80211: Set freq %d (ht_enabled=%d, vht_enabled=%d, bandwidth=%d MHz, cf1=%d MHz, cf2=%d MHz)",
3616                    freq->freq, freq->ht_enabled, freq->vht_enabled,
3617                    freq->bandwidth, freq->center_freq1, freq->center_freq2);
3618
3619         msg = nl80211_drv_msg(drv, 0, set_chan ? NL80211_CMD_SET_CHANNEL :
3620                               NL80211_CMD_SET_WIPHY);
3621         if (!msg || nl80211_put_freq_params(msg, freq) < 0) {
3622                 nlmsg_free(msg);
3623                 return -1;
3624         }
3625
3626         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3627         if (ret == 0) {
3628                 bss->freq = freq->freq;
3629                 return 0;
3630         }
3631         wpa_printf(MSG_DEBUG, "nl80211: Failed to set channel (freq=%d): "
3632                    "%d (%s)", freq->freq, ret, strerror(-ret));
3633         return -1;
3634 }
3635
3636
3637 static u32 sta_flags_nl80211(int flags)
3638 {
3639         u32 f = 0;
3640
3641         if (flags & WPA_STA_AUTHORIZED)
3642                 f |= BIT(NL80211_STA_FLAG_AUTHORIZED);
3643         if (flags & WPA_STA_WMM)
3644                 f |= BIT(NL80211_STA_FLAG_WME);
3645         if (flags & WPA_STA_SHORT_PREAMBLE)
3646                 f |= BIT(NL80211_STA_FLAG_SHORT_PREAMBLE);
3647         if (flags & WPA_STA_MFP)
3648                 f |= BIT(NL80211_STA_FLAG_MFP);
3649         if (flags & WPA_STA_TDLS_PEER)
3650                 f |= BIT(NL80211_STA_FLAG_TDLS_PEER);
3651         if (flags & WPA_STA_AUTHENTICATED)
3652                 f |= BIT(NL80211_STA_FLAG_AUTHENTICATED);
3653
3654         return f;
3655 }
3656
3657
3658 #ifdef CONFIG_MESH
3659 static u32 sta_plink_state_nl80211(enum mesh_plink_state state)
3660 {
3661         switch (state) {
3662         case PLINK_LISTEN:
3663                 return NL80211_PLINK_LISTEN;
3664         case PLINK_OPEN_SENT:
3665                 return NL80211_PLINK_OPN_SNT;
3666         case PLINK_OPEN_RCVD:
3667                 return NL80211_PLINK_OPN_RCVD;
3668         case PLINK_CNF_RCVD:
3669                 return NL80211_PLINK_CNF_RCVD;
3670         case PLINK_ESTAB:
3671                 return NL80211_PLINK_ESTAB;
3672         case PLINK_HOLDING:
3673                 return NL80211_PLINK_HOLDING;
3674         case PLINK_BLOCKED:
3675                 return NL80211_PLINK_BLOCKED;
3676         default:
3677                 wpa_printf(MSG_ERROR, "nl80211: Invalid mesh plink state %d",
3678                            state);
3679         }
3680         return -1;
3681 }
3682 #endif /* CONFIG_MESH */
3683
3684
3685 static int wpa_driver_nl80211_sta_add(void *priv,
3686                                       struct hostapd_sta_add_params *params)
3687 {
3688         struct i802_bss *bss = priv;
3689         struct wpa_driver_nl80211_data *drv = bss->drv;
3690         struct nl_msg *msg;
3691         struct nl80211_sta_flag_update upd;
3692         int ret = -ENOBUFS;
3693
3694         if ((params->flags & WPA_STA_TDLS_PEER) &&
3695             !(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT))
3696                 return -EOPNOTSUPP;
3697
3698         wpa_printf(MSG_DEBUG, "nl80211: %s STA " MACSTR,
3699                    params->set ? "Set" : "Add", MAC2STR(params->addr));
3700         msg = nl80211_bss_msg(bss, 0, params->set ? NL80211_CMD_SET_STATION :
3701                               NL80211_CMD_NEW_STATION);
3702         if (!msg || nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, params->addr))
3703                 goto fail;
3704
3705         if (!params->set || (params->flags & WPA_STA_TDLS_PEER)) {
3706                 wpa_hexdump(MSG_DEBUG, "  * supported rates",
3707                             params->supp_rates, params->supp_rates_len);
3708                 wpa_printf(MSG_DEBUG, "  * capability=0x%x",
3709                            params->capability);
3710                 if (nla_put(msg, NL80211_ATTR_STA_SUPPORTED_RATES,
3711                             params->supp_rates_len, params->supp_rates) ||
3712                     nla_put_u16(msg, NL80211_ATTR_STA_CAPABILITY,
3713                                 params->capability))
3714                         goto fail;
3715
3716                 if (params->ht_capabilities) {
3717                         wpa_hexdump(MSG_DEBUG, "  * ht_capabilities",
3718                                     (u8 *) params->ht_capabilities,
3719                                     sizeof(*params->ht_capabilities));
3720                         if (nla_put(msg, NL80211_ATTR_HT_CAPABILITY,
3721                                     sizeof(*params->ht_capabilities),
3722                                     params->ht_capabilities))
3723                                 goto fail;
3724                 }
3725
3726                 if (params->vht_capabilities) {
3727                         wpa_hexdump(MSG_DEBUG, "  * vht_capabilities",
3728                                     (u8 *) params->vht_capabilities,
3729                                     sizeof(*params->vht_capabilities));
3730                         if (nla_put(msg, NL80211_ATTR_VHT_CAPABILITY,
3731                                     sizeof(*params->vht_capabilities),
3732                                     params->vht_capabilities))
3733                                 goto fail;
3734                 }
3735
3736                 if (params->ext_capab) {
3737                         wpa_hexdump(MSG_DEBUG, "  * ext_capab",
3738                                     params->ext_capab, params->ext_capab_len);
3739                         if (nla_put(msg, NL80211_ATTR_STA_EXT_CAPABILITY,
3740                                     params->ext_capab_len, params->ext_capab))
3741                                 goto fail;
3742                 }
3743         }
3744         if (!params->set) {
3745                 if (params->aid) {
3746                         wpa_printf(MSG_DEBUG, "  * aid=%u", params->aid);
3747                         if (nla_put_u16(msg, NL80211_ATTR_STA_AID, params->aid))
3748                                 goto fail;
3749                 } else {
3750                         /*
3751                          * cfg80211 validates that AID is non-zero, so we have
3752                          * to make this a non-zero value for the TDLS case where
3753                          * a dummy STA entry is used for now.
3754                          */
3755                         wpa_printf(MSG_DEBUG, "  * aid=1 (TDLS workaround)");
3756                         if (nla_put_u16(msg, NL80211_ATTR_STA_AID, 1))
3757                                 goto fail;
3758                 }
3759                 wpa_printf(MSG_DEBUG, "  * listen_interval=%u",
3760                            params->listen_interval);
3761                 if (nla_put_u16(msg, NL80211_ATTR_STA_LISTEN_INTERVAL,
3762                                 params->listen_interval))
3763                         goto fail;
3764         } else if (params->aid && (params->flags & WPA_STA_TDLS_PEER)) {
3765                 wpa_printf(MSG_DEBUG, "  * peer_aid=%u", params->aid);
3766                 if (nla_put_u16(msg, NL80211_ATTR_PEER_AID, params->aid))
3767                         goto fail;
3768         }
3769
3770         if (params->vht_opmode_enabled) {
3771                 wpa_printf(MSG_DEBUG, "  * opmode=%u", params->vht_opmode);
3772                 if (nla_put_u8(msg, NL80211_ATTR_OPMODE_NOTIF,
3773                                params->vht_opmode))
3774                         goto fail;
3775         }
3776
3777         if (params->supp_channels) {
3778                 wpa_hexdump(MSG_DEBUG, "  * supported channels",
3779                             params->supp_channels, params->supp_channels_len);
3780                 if (nla_put(msg, NL80211_ATTR_STA_SUPPORTED_CHANNELS,
3781                             params->supp_channels_len, params->supp_channels))
3782                         goto fail;
3783         }
3784
3785         if (params->supp_oper_classes) {
3786                 wpa_hexdump(MSG_DEBUG, "  * supported operating classes",
3787                             params->supp_oper_classes,
3788                             params->supp_oper_classes_len);
3789                 if (nla_put(msg, NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES,
3790                             params->supp_oper_classes_len,
3791                             params->supp_oper_classes))
3792                         goto fail;
3793         }
3794
3795         os_memset(&upd, 0, sizeof(upd));
3796         upd.set = sta_flags_nl80211(params->flags);
3797         upd.mask = upd.set | sta_flags_nl80211(params->flags_mask);
3798         wpa_printf(MSG_DEBUG, "  * flags set=0x%x mask=0x%x",
3799                    upd.set, upd.mask);
3800         if (nla_put(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd))
3801                 goto fail;
3802
3803 #ifdef CONFIG_MESH
3804         if (params->plink_state &&
3805             nla_put_u8(msg, NL80211_ATTR_STA_PLINK_STATE,
3806                        sta_plink_state_nl80211(params->plink_state)))
3807                 goto fail;
3808 #endif /* CONFIG_MESH */
3809
3810         if (params->flags & WPA_STA_WMM) {
3811                 struct nlattr *wme = nla_nest_start(msg, NL80211_ATTR_STA_WME);
3812
3813                 wpa_printf(MSG_DEBUG, "  * qosinfo=0x%x", params->qosinfo);
3814                 if (!wme ||
3815                     nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
3816                                params->qosinfo & WMM_QOSINFO_STA_AC_MASK) ||
3817                     nla_put_u8(msg, NL80211_STA_WME_MAX_SP,
3818                                (params->qosinfo >> WMM_QOSINFO_STA_SP_SHIFT) &
3819                                WMM_QOSINFO_STA_SP_MASK))
3820                         goto fail;
3821                 nla_nest_end(msg, wme);
3822         }
3823
3824         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3825         msg = NULL;
3826         if (ret)
3827                 wpa_printf(MSG_DEBUG, "nl80211: NL80211_CMD_%s_STATION "
3828                            "result: %d (%s)", params->set ? "SET" : "NEW", ret,
3829                            strerror(-ret));
3830         if (ret == -EEXIST)
3831                 ret = 0;
3832 fail:
3833         nlmsg_free(msg);
3834         return ret;
3835 }
3836
3837
3838 static void rtnl_neigh_delete_fdb_entry(struct i802_bss *bss, const u8 *addr)
3839 {
3840 #ifdef CONFIG_LIBNL3_ROUTE
3841         struct wpa_driver_nl80211_data *drv = bss->drv;
3842         struct rtnl_neigh *rn;
3843         struct nl_addr *nl_addr;
3844         int err;
3845
3846         rn = rtnl_neigh_alloc();
3847         if (!rn)
3848                 return;
3849
3850         rtnl_neigh_set_family(rn, AF_BRIDGE);
3851         rtnl_neigh_set_ifindex(rn, bss->ifindex);
3852         nl_addr = nl_addr_build(AF_BRIDGE, (void *) addr, ETH_ALEN);
3853         if (!nl_addr) {
3854                 rtnl_neigh_put(rn);
3855                 return;
3856         }
3857         rtnl_neigh_set_lladdr(rn, nl_addr);
3858
3859         err = rtnl_neigh_delete(drv->rtnl_sk, rn, 0);
3860         if (err < 0) {
3861                 wpa_printf(MSG_DEBUG, "nl80211: bridge FDB entry delete for "
3862                            MACSTR " ifindex=%d failed: %s", MAC2STR(addr),
3863                            bss->ifindex, nl_geterror(err));
3864         } else {
3865                 wpa_printf(MSG_DEBUG, "nl80211: deleted bridge FDB entry for "
3866                            MACSTR, MAC2STR(addr));
3867         }
3868
3869         nl_addr_put(nl_addr);
3870         rtnl_neigh_put(rn);
3871 #endif /* CONFIG_LIBNL3_ROUTE */
3872 }
3873
3874
3875 static int wpa_driver_nl80211_sta_remove(struct i802_bss *bss, const u8 *addr,
3876                                          int deauth, u16 reason_code)
3877 {
3878         struct wpa_driver_nl80211_data *drv = bss->drv;
3879         struct nl_msg *msg;
3880         int ret;
3881
3882         if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_DEL_STATION)) ||
3883             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
3884             (deauth == 0 &&
3885              nla_put_u8(msg, NL80211_ATTR_MGMT_SUBTYPE,
3886                         WLAN_FC_STYPE_DISASSOC)) ||
3887             (deauth == 1 &&
3888              nla_put_u8(msg, NL80211_ATTR_MGMT_SUBTYPE,
3889                         WLAN_FC_STYPE_DEAUTH)) ||
3890             (reason_code &&
3891              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code))) {
3892                 nlmsg_free(msg);
3893                 return -ENOBUFS;
3894         }
3895
3896         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3897         wpa_printf(MSG_DEBUG, "nl80211: sta_remove -> DEL_STATION %s " MACSTR
3898                    " --> %d (%s)",
3899                    bss->ifname, MAC2STR(addr), ret, strerror(-ret));
3900
3901         if (drv->rtnl_sk)
3902                 rtnl_neigh_delete_fdb_entry(bss, addr);
3903
3904         if (ret == -ENOENT)
3905                 return 0;
3906         return ret;
3907 }
3908
3909
3910 void nl80211_remove_iface(struct wpa_driver_nl80211_data *drv, int ifidx)
3911 {
3912         struct nl_msg *msg;
3913         struct wpa_driver_nl80211_data *drv2;
3914
3915         wpa_printf(MSG_DEBUG, "nl80211: Remove interface ifindex=%d", ifidx);
3916
3917         /* stop listening for EAPOL on this interface */
3918         dl_list_for_each(drv2, &drv->global->interfaces,
3919                          struct wpa_driver_nl80211_data, list)
3920                 del_ifidx(drv2, ifidx);
3921
3922         msg = nl80211_ifindex_msg(drv, ifidx, 0, NL80211_CMD_DEL_INTERFACE);
3923         if (send_and_recv_msgs(drv, msg, NULL, NULL) == 0)
3924                 return;
3925         wpa_printf(MSG_ERROR, "Failed to remove interface (ifidx=%d)", ifidx);
3926 }
3927
3928
3929 static const char * nl80211_iftype_str(enum nl80211_iftype mode)
3930 {
3931         switch (mode) {
3932         case NL80211_IFTYPE_ADHOC:
3933                 return "ADHOC";
3934         case NL80211_IFTYPE_STATION:
3935                 return "STATION";
3936         case NL80211_IFTYPE_AP:
3937                 return "AP";
3938         case NL80211_IFTYPE_AP_VLAN:
3939                 return "AP_VLAN";
3940         case NL80211_IFTYPE_WDS:
3941                 return "WDS";
3942         case NL80211_IFTYPE_MONITOR:
3943                 return "MONITOR";
3944         case NL80211_IFTYPE_MESH_POINT:
3945                 return "MESH_POINT";
3946         case NL80211_IFTYPE_P2P_CLIENT:
3947                 return "P2P_CLIENT";
3948         case NL80211_IFTYPE_P2P_GO:
3949                 return "P2P_GO";
3950         case NL80211_IFTYPE_P2P_DEVICE:
3951                 return "P2P_DEVICE";
3952         default:
3953                 return "unknown";
3954         }
3955 }
3956
3957
3958 static int nl80211_create_iface_once(struct wpa_driver_nl80211_data *drv,
3959                                      const char *ifname,
3960                                      enum nl80211_iftype iftype,
3961                                      const u8 *addr, int wds,
3962                                      int (*handler)(struct nl_msg *, void *),
3963                                      void *arg)
3964 {
3965         struct nl_msg *msg;
3966         int ifidx;
3967         int ret = -ENOBUFS;
3968
3969         wpa_printf(MSG_DEBUG, "nl80211: Create interface iftype %d (%s)",
3970                    iftype, nl80211_iftype_str(iftype));
3971
3972         msg = nl80211_cmd_msg(drv->first_bss, 0, NL80211_CMD_NEW_INTERFACE);
3973         if (!msg ||
3974             nla_put_string(msg, NL80211_ATTR_IFNAME, ifname) ||
3975             nla_put_u32(msg, NL80211_ATTR_IFTYPE, iftype))
3976                 goto fail;
3977
3978         if (iftype == NL80211_IFTYPE_MONITOR) {
3979                 struct nlattr *flags;
3980
3981                 flags = nla_nest_start(msg, NL80211_ATTR_MNTR_FLAGS);
3982                 if (!flags ||
3983                     nla_put_flag(msg, NL80211_MNTR_FLAG_COOK_FRAMES))
3984                         goto fail;
3985
3986                 nla_nest_end(msg, flags);
3987         } else if (wds) {
3988                 if (nla_put_u8(msg, NL80211_ATTR_4ADDR, wds))
3989                         goto fail;
3990         }
3991
3992         /*
3993          * Tell cfg80211 that the interface belongs to the socket that created
3994          * it, and the interface should be deleted when the socket is closed.
3995          */
3996         if (nla_put_flag(msg, NL80211_ATTR_IFACE_SOCKET_OWNER))
3997                 goto fail;
3998
3999         ret = send_and_recv_msgs(drv, msg, handler, arg);
4000         msg = NULL;
4001         if (ret) {
4002         fail:
4003                 nlmsg_free(msg);
4004                 wpa_printf(MSG_ERROR, "Failed to create interface %s: %d (%s)",
4005                            ifname, ret, strerror(-ret));
4006                 return ret;
4007         }
4008
4009         if (iftype == NL80211_IFTYPE_P2P_DEVICE)
4010                 return 0;
4011
4012         ifidx = if_nametoindex(ifname);
4013         wpa_printf(MSG_DEBUG, "nl80211: New interface %s created: ifindex=%d",
4014                    ifname, ifidx);
4015
4016         if (ifidx <= 0)
4017                 return -1;
4018
4019         /*
4020          * Some virtual interfaces need to process EAPOL packets and events on
4021          * the parent interface. This is used mainly with hostapd.
4022          */
4023         if (drv->hostapd ||
4024             iftype == NL80211_IFTYPE_AP_VLAN ||
4025             iftype == NL80211_IFTYPE_WDS ||
4026             iftype == NL80211_IFTYPE_MONITOR) {
4027                 /* start listening for EAPOL on this interface */
4028                 add_ifidx(drv, ifidx);
4029         }
4030
4031         if (addr && iftype != NL80211_IFTYPE_MONITOR &&
4032             linux_set_ifhwaddr(drv->global->ioctl_sock, ifname, addr)) {
4033                 nl80211_remove_iface(drv, ifidx);
4034                 return -1;
4035         }
4036
4037         return ifidx;
4038 }
4039
4040
4041 int nl80211_create_iface(struct wpa_driver_nl80211_data *drv,
4042                          const char *ifname, enum nl80211_iftype iftype,
4043                          const u8 *addr, int wds,
4044                          int (*handler)(struct nl_msg *, void *),
4045                          void *arg, int use_existing)
4046 {
4047         int ret;
4048
4049         ret = nl80211_create_iface_once(drv, ifname, iftype, addr, wds, handler,
4050                                         arg);
4051
4052         /* if error occurred and interface exists already */
4053         if (ret == -ENFILE && if_nametoindex(ifname)) {
4054                 if (use_existing) {
4055                         wpa_printf(MSG_DEBUG, "nl80211: Continue using existing interface %s",
4056                                    ifname);
4057                         if (addr && iftype != NL80211_IFTYPE_MONITOR &&
4058                             linux_set_ifhwaddr(drv->global->ioctl_sock, ifname,
4059                                                addr) < 0 &&
4060                             (linux_set_iface_flags(drv->global->ioctl_sock,
4061                                                    ifname, 0) < 0 ||
4062                              linux_set_ifhwaddr(drv->global->ioctl_sock, ifname,
4063                                                 addr) < 0 ||
4064                              linux_set_iface_flags(drv->global->ioctl_sock,
4065                                                    ifname, 1) < 0))
4066                                         return -1;
4067                         return -ENFILE;
4068                 }
4069                 wpa_printf(MSG_INFO, "Try to remove and re-create %s", ifname);
4070
4071                 /* Try to remove the interface that was already there. */
4072                 nl80211_remove_iface(drv, if_nametoindex(ifname));
4073
4074                 /* Try to create the interface again */
4075                 ret = nl80211_create_iface_once(drv, ifname, iftype, addr,
4076                                                 wds, handler, arg);
4077         }
4078
4079         if (ret >= 0 && is_p2p_net_interface(iftype)) {
4080                 wpa_printf(MSG_DEBUG,
4081                            "nl80211: Interface %s created for P2P - disable 11b rates",
4082                            ifname);
4083                 nl80211_disable_11b_rates(drv, ret, 1);
4084         }
4085
4086         return ret;
4087 }
4088
4089
4090 static int nl80211_setup_ap(struct i802_bss *bss)
4091 {
4092         struct wpa_driver_nl80211_data *drv = bss->drv;
4093
4094         wpa_printf(MSG_DEBUG, "nl80211: Setup AP(%s) - device_ap_sme=%d use_monitor=%d",
4095                    bss->ifname, drv->device_ap_sme, drv->use_monitor);
4096
4097         /*
4098          * Disable Probe Request reporting unless we need it in this way for
4099          * devices that include the AP SME, in the other case (unless using
4100          * monitor iface) we'll get it through the nl_mgmt socket instead.
4101          */
4102         if (!drv->device_ap_sme)
4103                 wpa_driver_nl80211_probe_req_report(bss, 0);
4104
4105         if (!drv->device_ap_sme && !drv->use_monitor)
4106                 if (nl80211_mgmt_subscribe_ap(bss))
4107                         return -1;
4108
4109         if (drv->device_ap_sme && !drv->use_monitor)
4110                 if (nl80211_mgmt_subscribe_ap_dev_sme(bss))
4111                         return -1;
4112
4113         if (!drv->device_ap_sme && drv->use_monitor &&
4114             nl80211_create_monitor_interface(drv) &&
4115             !drv->device_ap_sme)
4116                 return -1;
4117
4118         if (drv->device_ap_sme &&
4119             wpa_driver_nl80211_probe_req_report(bss, 1) < 0) {
4120                 wpa_printf(MSG_DEBUG, "nl80211: Failed to enable "
4121                            "Probe Request frame reporting in AP mode");
4122                 /* Try to survive without this */
4123         }
4124
4125         return 0;
4126 }
4127
4128
4129 static void nl80211_teardown_ap(struct i802_bss *bss)
4130 {
4131         struct wpa_driver_nl80211_data *drv = bss->drv;
4132
4133         wpa_printf(MSG_DEBUG, "nl80211: Teardown AP(%s) - device_ap_sme=%d use_monitor=%d",
4134                    bss->ifname, drv->device_ap_sme, drv->use_monitor);
4135         if (drv->device_ap_sme) {
4136                 wpa_driver_nl80211_probe_req_report(bss, 0);
4137                 if (!drv->use_monitor)
4138                         nl80211_mgmt_unsubscribe(bss, "AP teardown (dev SME)");
4139         } else if (drv->use_monitor)
4140                 nl80211_remove_monitor_interface(drv);
4141         else
4142                 nl80211_mgmt_unsubscribe(bss, "AP teardown");
4143
4144         bss->beacon_set = 0;
4145 }
4146
4147
4148 static int nl80211_send_eapol_data(struct i802_bss *bss,
4149                                    const u8 *addr, const u8 *data,
4150                                    size_t data_len)
4151 {
4152         struct sockaddr_ll ll;
4153         int ret;
4154
4155         if (bss->drv->eapol_tx_sock < 0) {
4156                 wpa_printf(MSG_DEBUG, "nl80211: No socket to send EAPOL");
4157                 return -1;
4158         }
4159
4160         os_memset(&ll, 0, sizeof(ll));
4161         ll.sll_family = AF_PACKET;
4162         ll.sll_ifindex = bss->ifindex;
4163         ll.sll_protocol = htons(ETH_P_PAE);
4164         ll.sll_halen = ETH_ALEN;
4165         os_memcpy(ll.sll_addr, addr, ETH_ALEN);
4166         ret = sendto(bss->drv->eapol_tx_sock, data, data_len, 0,
4167                      (struct sockaddr *) &ll, sizeof(ll));
4168         if (ret < 0)
4169                 wpa_printf(MSG_ERROR, "nl80211: EAPOL TX: %s",
4170                            strerror(errno));
4171
4172         return ret;
4173 }
4174
4175
4176 static const u8 rfc1042_header[6] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
4177
4178 static int wpa_driver_nl80211_hapd_send_eapol(
4179         void *priv, const u8 *addr, const u8 *data,
4180         size_t data_len, int encrypt, const u8 *own_addr, u32 flags)
4181 {
4182         struct i802_bss *bss = priv;
4183         struct wpa_driver_nl80211_data *drv = bss->drv;
4184         struct ieee80211_hdr *hdr;
4185         size_t len;
4186         u8 *pos;
4187         int res;
4188         int qos = flags & WPA_STA_WMM;
4189
4190         if (drv->device_ap_sme || !drv->use_monitor)
4191                 return nl80211_send_eapol_data(bss, addr, data, data_len);
4192
4193         len = sizeof(*hdr) + (qos ? 2 : 0) + sizeof(rfc1042_header) + 2 +
4194                 data_len;
4195         hdr = os_zalloc(len);
4196         if (hdr == NULL) {
4197                 wpa_printf(MSG_INFO, "nl80211: Failed to allocate EAPOL buffer(len=%lu)",
4198                            (unsigned long) len);
4199                 return -1;
4200         }
4201
4202         hdr->frame_control =
4203                 IEEE80211_FC(WLAN_FC_TYPE_DATA, WLAN_FC_STYPE_DATA);
4204         hdr->frame_control |= host_to_le16(WLAN_FC_FROMDS);
4205         if (encrypt)
4206                 hdr->frame_control |= host_to_le16(WLAN_FC_ISWEP);
4207         if (qos) {
4208                 hdr->frame_control |=
4209                         host_to_le16(WLAN_FC_STYPE_QOS_DATA << 4);
4210         }
4211
4212         memcpy(hdr->IEEE80211_DA_FROMDS, addr, ETH_ALEN);
4213         memcpy(hdr->IEEE80211_BSSID_FROMDS, own_addr, ETH_ALEN);
4214         memcpy(hdr->IEEE80211_SA_FROMDS, own_addr, ETH_ALEN);
4215         pos = (u8 *) (hdr + 1);
4216
4217         if (qos) {
4218                 /* Set highest priority in QoS header */
4219                 pos[0] = 7;
4220                 pos[1] = 0;
4221                 pos += 2;
4222         }
4223
4224         memcpy(pos, rfc1042_header, sizeof(rfc1042_header));
4225         pos += sizeof(rfc1042_header);
4226         WPA_PUT_BE16(pos, ETH_P_PAE);
4227         pos += 2;
4228         memcpy(pos, data, data_len);
4229
4230         res = wpa_driver_nl80211_send_frame(bss, (u8 *) hdr, len, encrypt, 0,
4231                                             0, 0, 0, 0);
4232         if (res < 0) {
4233                 wpa_printf(MSG_ERROR, "i802_send_eapol - packet len: %lu - "
4234                            "failed: %d (%s)",
4235                            (unsigned long) len, errno, strerror(errno));
4236         }
4237         os_free(hdr);
4238
4239         return res;
4240 }
4241
4242
4243 static int wpa_driver_nl80211_sta_set_flags(void *priv, const u8 *addr,
4244                                             int total_flags,
4245                                             int flags_or, int flags_and)
4246 {
4247         struct i802_bss *bss = priv;
4248         struct nl_msg *msg;
4249         struct nlattr *flags;
4250         struct nl80211_sta_flag_update upd;
4251
4252         wpa_printf(MSG_DEBUG, "nl80211: Set STA flags - ifname=%s addr=" MACSTR
4253                    " total_flags=0x%x flags_or=0x%x flags_and=0x%x authorized=%d",
4254                    bss->ifname, MAC2STR(addr), total_flags, flags_or, flags_and,
4255                    !!(total_flags & WPA_STA_AUTHORIZED));
4256
4257         if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_SET_STATION)) ||
4258             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
4259                 goto fail;
4260
4261         /*
4262          * Backwards compatibility version using NL80211_ATTR_STA_FLAGS. This
4263          * can be removed eventually.
4264          */
4265         flags = nla_nest_start(msg, NL80211_ATTR_STA_FLAGS);
4266         if (!flags ||
4267             ((total_flags & WPA_STA_AUTHORIZED) &&
4268              nla_put_flag(msg, NL80211_STA_FLAG_AUTHORIZED)) ||
4269             ((total_flags & WPA_STA_WMM) &&
4270              nla_put_flag(msg, NL80211_STA_FLAG_WME)) ||
4271             ((total_flags & WPA_STA_SHORT_PREAMBLE) &&
4272              nla_put_flag(msg, NL80211_STA_FLAG_SHORT_PREAMBLE)) ||
4273             ((total_flags & WPA_STA_MFP) &&
4274              nla_put_flag(msg, NL80211_STA_FLAG_MFP)) ||
4275             ((total_flags & WPA_STA_TDLS_PEER) &&
4276              nla_put_flag(msg, NL80211_STA_FLAG_TDLS_PEER)))
4277                 goto fail;
4278
4279         nla_nest_end(msg, flags);
4280
4281         os_memset(&upd, 0, sizeof(upd));
4282         upd.mask = sta_flags_nl80211(flags_or | ~flags_and);
4283         upd.set = sta_flags_nl80211(flags_or);
4284         if (nla_put(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd))
4285                 goto fail;
4286
4287         return send_and_recv_msgs(bss->drv, msg, NULL, NULL);
4288 fail:
4289         nlmsg_free(msg);
4290         return -ENOBUFS;
4291 }
4292
4293
4294 static int wpa_driver_nl80211_ap(struct wpa_driver_nl80211_data *drv,
4295                                  struct wpa_driver_associate_params *params)
4296 {
4297         enum nl80211_iftype nlmode, old_mode;
4298
4299         if (params->p2p) {
4300                 wpa_printf(MSG_DEBUG, "nl80211: Setup AP operations for P2P "
4301                            "group (GO)");
4302                 nlmode = NL80211_IFTYPE_P2P_GO;
4303         } else
4304                 nlmode = NL80211_IFTYPE_AP;
4305
4306         old_mode = drv->nlmode;
4307         if (wpa_driver_nl80211_set_mode(drv->first_bss, nlmode)) {
4308                 nl80211_remove_monitor_interface(drv);
4309                 return -1;
4310         }
4311
4312         if (params->freq.freq &&
4313             nl80211_set_channel(drv->first_bss, &params->freq, 0)) {
4314                 if (old_mode != nlmode)
4315                         wpa_driver_nl80211_set_mode(drv->first_bss, old_mode);
4316                 nl80211_remove_monitor_interface(drv);
4317                 return -1;
4318         }
4319
4320         return 0;
4321 }
4322
4323
4324 static int nl80211_leave_ibss(struct wpa_driver_nl80211_data *drv,
4325                               int reset_mode)
4326 {
4327         struct nl_msg *msg;
4328         int ret;
4329
4330         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_LEAVE_IBSS);
4331         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4332         if (ret) {
4333                 wpa_printf(MSG_DEBUG, "nl80211: Leave IBSS failed: ret=%d "
4334                            "(%s)", ret, strerror(-ret));
4335         } else {
4336                 wpa_printf(MSG_DEBUG,
4337                            "nl80211: Leave IBSS request sent successfully");
4338         }
4339
4340         if (reset_mode &&
4341             wpa_driver_nl80211_set_mode(drv->first_bss,
4342                                         NL80211_IFTYPE_STATION)) {
4343                 wpa_printf(MSG_INFO, "nl80211: Failed to set interface into "
4344                            "station mode");
4345         }
4346
4347         return ret;
4348 }
4349
4350
4351 static int nl80211_ht_vht_overrides(struct nl_msg *msg,
4352                                     struct wpa_driver_associate_params *params)
4353 {
4354         if (params->disable_ht && nla_put_flag(msg, NL80211_ATTR_DISABLE_HT))
4355                 return -1;
4356
4357         if (params->htcaps && params->htcaps_mask) {
4358                 int sz = sizeof(struct ieee80211_ht_capabilities);
4359                 wpa_hexdump(MSG_DEBUG, "  * htcaps", params->htcaps, sz);
4360                 wpa_hexdump(MSG_DEBUG, "  * htcaps_mask",
4361                             params->htcaps_mask, sz);
4362                 if (nla_put(msg, NL80211_ATTR_HT_CAPABILITY, sz,
4363                             params->htcaps) ||
4364                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK, sz,
4365                             params->htcaps_mask))
4366                         return -1;
4367         }
4368
4369 #ifdef CONFIG_VHT_OVERRIDES
4370         if (params->disable_vht) {
4371                 wpa_printf(MSG_DEBUG, "  * VHT disabled");
4372                 if (nla_put_flag(msg, NL80211_ATTR_DISABLE_VHT))
4373                         return -1;
4374         }
4375
4376         if (params->vhtcaps && params->vhtcaps_mask) {
4377                 int sz = sizeof(struct ieee80211_vht_capabilities);
4378                 wpa_hexdump(MSG_DEBUG, "  * vhtcaps", params->vhtcaps, sz);
4379                 wpa_hexdump(MSG_DEBUG, "  * vhtcaps_mask",
4380                             params->vhtcaps_mask, sz);
4381                 if (nla_put(msg, NL80211_ATTR_VHT_CAPABILITY, sz,
4382                             params->vhtcaps) ||
4383                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK, sz,
4384                             params->vhtcaps_mask))
4385                         return -1;
4386         }
4387 #endif /* CONFIG_VHT_OVERRIDES */
4388
4389         return 0;
4390 }
4391
4392
4393 static int wpa_driver_nl80211_ibss(struct wpa_driver_nl80211_data *drv,
4394                                    struct wpa_driver_associate_params *params)
4395 {
4396         struct nl_msg *msg;
4397         int ret = -1;
4398         int count = 0;
4399
4400         wpa_printf(MSG_DEBUG, "nl80211: Join IBSS (ifindex=%d)", drv->ifindex);
4401
4402         if (wpa_driver_nl80211_set_mode_ibss(drv->first_bss, &params->freq)) {
4403                 wpa_printf(MSG_INFO, "nl80211: Failed to set interface into "
4404                            "IBSS mode");
4405                 return -1;
4406         }
4407
4408 retry:
4409         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_JOIN_IBSS)) ||
4410             params->ssid == NULL || params->ssid_len > sizeof(drv->ssid))
4411                 goto fail;
4412
4413         wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
4414                           params->ssid, params->ssid_len);
4415         if (nla_put(msg, NL80211_ATTR_SSID, params->ssid_len, params->ssid))
4416                 goto fail;
4417         os_memcpy(drv->ssid, params->ssid, params->ssid_len);
4418         drv->ssid_len = params->ssid_len;
4419
4420         if (nl80211_put_freq_params(msg, &params->freq) < 0 ||
4421             nl80211_put_beacon_int(msg, params->beacon_int))
4422                 goto fail;
4423
4424         ret = nl80211_set_conn_keys(params, msg);
4425         if (ret)
4426                 goto fail;
4427
4428         if (params->bssid && params->fixed_bssid) {
4429                 wpa_printf(MSG_DEBUG, "  * BSSID=" MACSTR,
4430                            MAC2STR(params->bssid));
4431                 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid))
4432                         goto fail;
4433         }
4434
4435         if (params->fixed_freq) {
4436                 wpa_printf(MSG_DEBUG, "  * fixed_freq");
4437                 if (nla_put_flag(msg, NL80211_ATTR_FREQ_FIXED))
4438                         goto fail;
4439         }
4440
4441         if (params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
4442             params->key_mgmt_suite == WPA_KEY_MGMT_PSK ||
4443             params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
4444             params->key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256) {
4445                 wpa_printf(MSG_DEBUG, "  * control port");
4446                 if (nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT))
4447                         goto fail;
4448         }
4449
4450         if (params->wpa_ie) {
4451                 wpa_hexdump(MSG_DEBUG,
4452                             "  * Extra IEs for Beacon/Probe Response frames",
4453                             params->wpa_ie, params->wpa_ie_len);
4454                 if (nla_put(msg, NL80211_ATTR_IE, params->wpa_ie_len,
4455                             params->wpa_ie))
4456                         goto fail;
4457         }
4458
4459         if (nl80211_ht_vht_overrides(msg, params) < 0)
4460                 return -1;
4461
4462         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4463         msg = NULL;
4464         if (ret) {
4465                 wpa_printf(MSG_DEBUG, "nl80211: Join IBSS failed: ret=%d (%s)",
4466                            ret, strerror(-ret));
4467                 count++;
4468                 if (ret == -EALREADY && count == 1) {
4469                         wpa_printf(MSG_DEBUG, "nl80211: Retry IBSS join after "
4470                                    "forced leave");
4471                         nl80211_leave_ibss(drv, 0);
4472                         nlmsg_free(msg);
4473                         goto retry;
4474                 }
4475         } else {
4476                 wpa_printf(MSG_DEBUG,
4477                            "nl80211: Join IBSS request sent successfully");
4478         }
4479
4480 fail:
4481         nlmsg_free(msg);
4482         return ret;
4483 }
4484
4485
4486 static int nl80211_connect_common(struct wpa_driver_nl80211_data *drv,
4487                                   struct wpa_driver_associate_params *params,
4488                                   struct nl_msg *msg)
4489 {
4490         if (params->bssid) {
4491                 wpa_printf(MSG_DEBUG, "  * bssid=" MACSTR,
4492                            MAC2STR(params->bssid));
4493                 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid))
4494                         return -1;
4495         }
4496
4497         if (params->bssid_hint) {
4498                 wpa_printf(MSG_DEBUG, "  * bssid_hint=" MACSTR,
4499                            MAC2STR(params->bssid_hint));
4500                 if (nla_put(msg, NL80211_ATTR_MAC_HINT, ETH_ALEN,
4501                             params->bssid_hint))
4502                         return -1;
4503         }
4504
4505         if (params->freq.freq) {
4506                 wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq.freq);
4507                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
4508                                 params->freq.freq))
4509                         return -1;
4510                 drv->assoc_freq = params->freq.freq;
4511         } else
4512                 drv->assoc_freq = 0;
4513
4514         if (params->freq_hint) {
4515                 wpa_printf(MSG_DEBUG, "  * freq_hint=%d", params->freq_hint);
4516                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_HINT,
4517                                 params->freq_hint))
4518                         return -1;
4519         }
4520
4521         if (params->bg_scan_period >= 0) {
4522                 wpa_printf(MSG_DEBUG, "  * bg scan period=%d",
4523                            params->bg_scan_period);
4524                 if (nla_put_u16(msg, NL80211_ATTR_BG_SCAN_PERIOD,
4525                                 params->bg_scan_period))
4526                         return -1;
4527         }
4528
4529         if (params->ssid) {
4530                 wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
4531                                   params->ssid, params->ssid_len);
4532                 if (nla_put(msg, NL80211_ATTR_SSID, params->ssid_len,
4533                             params->ssid))
4534                         return -1;
4535                 if (params->ssid_len > sizeof(drv->ssid))
4536                         return -1;
4537                 os_memcpy(drv->ssid, params->ssid, params->ssid_len);
4538                 drv->ssid_len = params->ssid_len;
4539         }
4540
4541         wpa_hexdump(MSG_DEBUG, "  * IEs", params->wpa_ie, params->wpa_ie_len);
4542         if (params->wpa_ie &&
4543             nla_put(msg, NL80211_ATTR_IE, params->wpa_ie_len, params->wpa_ie))
4544                 return -1;
4545
4546         if (params->wpa_proto) {
4547                 enum nl80211_wpa_versions ver = 0;
4548
4549                 if (params->wpa_proto & WPA_PROTO_WPA)
4550                         ver |= NL80211_WPA_VERSION_1;
4551                 if (params->wpa_proto & WPA_PROTO_RSN)
4552                         ver |= NL80211_WPA_VERSION_2;
4553
4554                 wpa_printf(MSG_DEBUG, "  * WPA Versions 0x%x", ver);
4555                 if (nla_put_u32(msg, NL80211_ATTR_WPA_VERSIONS, ver))
4556                         return -1;
4557         }
4558
4559         if (params->pairwise_suite != WPA_CIPHER_NONE) {
4560                 u32 cipher = wpa_cipher_to_cipher_suite(params->pairwise_suite);
4561                 wpa_printf(MSG_DEBUG, "  * pairwise=0x%x", cipher);
4562                 if (nla_put_u32(msg, NL80211_ATTR_CIPHER_SUITES_PAIRWISE,
4563                                 cipher))
4564                         return -1;
4565         }
4566
4567         if (params->group_suite == WPA_CIPHER_GTK_NOT_USED &&
4568             !(drv->capa.enc & WPA_DRIVER_CAPA_ENC_GTK_NOT_USED)) {
4569                 /*
4570                  * This is likely to work even though many drivers do not
4571                  * advertise support for operations without GTK.
4572                  */
4573                 wpa_printf(MSG_DEBUG, "  * skip group cipher configuration for GTK_NOT_USED due to missing driver support advertisement");
4574         } else if (params->group_suite != WPA_CIPHER_NONE) {
4575                 u32 cipher = wpa_cipher_to_cipher_suite(params->group_suite);
4576                 wpa_printf(MSG_DEBUG, "  * group=0x%x", cipher);
4577                 if (nla_put_u32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP, cipher))
4578                         return -1;
4579         }
4580
4581         if (params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X ||
4582             params->key_mgmt_suite == WPA_KEY_MGMT_PSK ||
4583             params->key_mgmt_suite == WPA_KEY_MGMT_FT_IEEE8021X ||
4584             params->key_mgmt_suite == WPA_KEY_MGMT_FT_PSK ||
4585             params->key_mgmt_suite == WPA_KEY_MGMT_CCKM ||
4586             params->key_mgmt_suite == WPA_KEY_MGMT_OSEN ||
4587             params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SHA256 ||
4588             params->key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256 ||
4589             params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B ||
4590             params->key_mgmt_suite == WPA_KEY_MGMT_IEEE8021X_SUITE_B_192) {
4591                 int mgmt = WLAN_AKM_SUITE_PSK;
4592
4593                 switch (params->key_mgmt_suite) {
4594                 case WPA_KEY_MGMT_CCKM:
4595                         mgmt = WLAN_AKM_SUITE_CCKM;
4596                         break;
4597                 case WPA_KEY_MGMT_IEEE8021X:
4598                         mgmt = WLAN_AKM_SUITE_8021X;
4599                         break;
4600                 case WPA_KEY_MGMT_FT_IEEE8021X:
4601                         mgmt = WLAN_AKM_SUITE_FT_8021X;
4602                         break;
4603                 case WPA_KEY_MGMT_FT_PSK:
4604                         mgmt = WLAN_AKM_SUITE_FT_PSK;
4605                         break;
4606                 case WPA_KEY_MGMT_IEEE8021X_SHA256:
4607                         mgmt = WLAN_AKM_SUITE_8021X_SHA256;
4608                         break;
4609                 case WPA_KEY_MGMT_PSK_SHA256:
4610                         mgmt = WLAN_AKM_SUITE_PSK_SHA256;
4611                         break;
4612                 case WPA_KEY_MGMT_OSEN:
4613                         mgmt = WLAN_AKM_SUITE_OSEN;
4614                         break;
4615                 case WPA_KEY_MGMT_IEEE8021X_SUITE_B:
4616                         mgmt = WLAN_AKM_SUITE_8021X_SUITE_B;
4617                         break;
4618                 case WPA_KEY_MGMT_IEEE8021X_SUITE_B_192:
4619                         mgmt = WLAN_AKM_SUITE_8021X_SUITE_B_192;
4620                         break;
4621                 case WPA_KEY_MGMT_PSK:
4622                 default:
4623                         mgmt = WLAN_AKM_SUITE_PSK;
4624                         break;
4625                 }
4626                 wpa_printf(MSG_DEBUG, "  * akm=0x%x", mgmt);
4627                 if (nla_put_u32(msg, NL80211_ATTR_AKM_SUITES, mgmt))
4628                         return -1;
4629         }
4630
4631         if (nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT))
4632                 return -1;
4633
4634         if (params->mgmt_frame_protection == MGMT_FRAME_PROTECTION_REQUIRED &&
4635             nla_put_u32(msg, NL80211_ATTR_USE_MFP, NL80211_MFP_REQUIRED))
4636                 return -1;
4637
4638         if (params->rrm_used) {
4639                 u32 drv_rrm_flags = drv->capa.rrm_flags;
4640                 if (!(drv_rrm_flags &
4641                       WPA_DRIVER_FLAGS_DS_PARAM_SET_IE_IN_PROBES) ||
4642                     !(drv_rrm_flags & WPA_DRIVER_FLAGS_QUIET) ||
4643                     nla_put_flag(msg, NL80211_ATTR_USE_RRM))
4644                         return -1;
4645         }
4646
4647         if (nl80211_ht_vht_overrides(msg, params) < 0)
4648                 return -1;
4649
4650         if (params->p2p)
4651                 wpa_printf(MSG_DEBUG, "  * P2P group");
4652
4653         return 0;
4654 }
4655
4656
4657 static int wpa_driver_nl80211_try_connect(
4658         struct wpa_driver_nl80211_data *drv,
4659         struct wpa_driver_associate_params *params)
4660 {
4661         struct nl_msg *msg;
4662         enum nl80211_auth_type type;
4663         int ret;
4664         int algs;
4665
4666         if (params->req_key_mgmt_offload && params->psk &&
4667             (params->key_mgmt_suite == WPA_KEY_MGMT_PSK ||
4668              params->key_mgmt_suite == WPA_KEY_MGMT_PSK_SHA256 ||
4669              params->key_mgmt_suite == WPA_KEY_MGMT_FT_PSK)) {
4670                 wpa_printf(MSG_DEBUG, "nl80211: Key management set PSK");
4671                 ret = issue_key_mgmt_set_key(drv, params->psk, 32);
4672                 if (ret)
4673                         return ret;
4674         }
4675
4676         wpa_printf(MSG_DEBUG, "nl80211: Connect (ifindex=%d)", drv->ifindex);
4677         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_CONNECT);
4678         if (!msg)
4679                 return -1;
4680
4681         ret = nl80211_connect_common(drv, params, msg);
4682         if (ret)
4683                 goto fail;
4684
4685         algs = 0;
4686         if (params->auth_alg & WPA_AUTH_ALG_OPEN)
4687                 algs++;
4688         if (params->auth_alg & WPA_AUTH_ALG_SHARED)
4689                 algs++;
4690         if (params->auth_alg & WPA_AUTH_ALG_LEAP)
4691                 algs++;
4692         if (algs > 1) {
4693                 wpa_printf(MSG_DEBUG, "  * Leave out Auth Type for automatic "
4694                            "selection");
4695                 goto skip_auth_type;
4696         }
4697
4698         if (params->auth_alg & WPA_AUTH_ALG_OPEN)
4699                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
4700         else if (params->auth_alg & WPA_AUTH_ALG_SHARED)
4701                 type = NL80211_AUTHTYPE_SHARED_KEY;
4702         else if (params->auth_alg & WPA_AUTH_ALG_LEAP)
4703                 type = NL80211_AUTHTYPE_NETWORK_EAP;
4704         else if (params->auth_alg & WPA_AUTH_ALG_FT)
4705                 type = NL80211_AUTHTYPE_FT;
4706         else
4707                 goto fail;
4708
4709         wpa_printf(MSG_DEBUG, "  * Auth Type %d", type);
4710         if (nla_put_u32(msg, NL80211_ATTR_AUTH_TYPE, type))
4711                 goto fail;
4712
4713 skip_auth_type:
4714         ret = nl80211_set_conn_keys(params, msg);
4715         if (ret)
4716                 goto fail;
4717
4718         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4719         msg = NULL;
4720         if (ret) {
4721                 wpa_printf(MSG_DEBUG, "nl80211: MLME connect failed: ret=%d "
4722                            "(%s)", ret, strerror(-ret));
4723         } else {
4724                 wpa_printf(MSG_DEBUG,
4725                            "nl80211: Connect request send successfully");
4726         }
4727
4728 fail:
4729         nlmsg_free(msg);
4730         return ret;
4731
4732 }
4733
4734
4735 static int wpa_driver_nl80211_connect(
4736         struct wpa_driver_nl80211_data *drv,
4737         struct wpa_driver_associate_params *params)
4738 {
4739         int ret;
4740
4741         /* Store the connection attempted bssid for future use */
4742         if (params->bssid)
4743                 os_memcpy(drv->auth_attempt_bssid, params->bssid, ETH_ALEN);
4744         else
4745                 os_memset(drv->auth_attempt_bssid, 0, ETH_ALEN);
4746
4747         ret = wpa_driver_nl80211_try_connect(drv, params);
4748         if (ret == -EALREADY) {
4749                 /*
4750                  * cfg80211 does not currently accept new connections if
4751                  * we are already connected. As a workaround, force
4752                  * disconnection and try again.
4753                  */
4754                 wpa_printf(MSG_DEBUG, "nl80211: Explicitly "
4755                            "disconnecting before reassociation "
4756                            "attempt");
4757                 if (wpa_driver_nl80211_disconnect(
4758                             drv, WLAN_REASON_PREV_AUTH_NOT_VALID))
4759                         return -1;
4760                 ret = wpa_driver_nl80211_try_connect(drv, params);
4761         }
4762         return ret;
4763 }
4764
4765
4766 static int wpa_driver_nl80211_associate(
4767         void *priv, struct wpa_driver_associate_params *params)
4768 {
4769         struct i802_bss *bss = priv;
4770         struct wpa_driver_nl80211_data *drv = bss->drv;
4771         int ret = -1;
4772         struct nl_msg *msg;
4773
4774         nl80211_unmask_11b_rates(bss);
4775
4776         if (params->mode == IEEE80211_MODE_AP)
4777                 return wpa_driver_nl80211_ap(drv, params);
4778
4779         if (params->mode == IEEE80211_MODE_IBSS)
4780                 return wpa_driver_nl80211_ibss(drv, params);
4781
4782         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME)) {
4783                 enum nl80211_iftype nlmode = params->p2p ?
4784                         NL80211_IFTYPE_P2P_CLIENT : NL80211_IFTYPE_STATION;
4785
4786                 if (wpa_driver_nl80211_set_mode(priv, nlmode) < 0)
4787                         return -1;
4788                 return wpa_driver_nl80211_connect(drv, params);
4789         }
4790
4791         nl80211_mark_disconnected(drv);
4792
4793         wpa_printf(MSG_DEBUG, "nl80211: Associate (ifindex=%d)",
4794                    drv->ifindex);
4795         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_ASSOCIATE);
4796         if (!msg)
4797                 return -1;
4798
4799         ret = nl80211_connect_common(drv, params, msg);
4800         if (ret)
4801                 goto fail;
4802
4803         if (params->prev_bssid) {
4804                 wpa_printf(MSG_DEBUG, "  * prev_bssid=" MACSTR,
4805                            MAC2STR(params->prev_bssid));
4806                 if (nla_put(msg, NL80211_ATTR_PREV_BSSID, ETH_ALEN,
4807                             params->prev_bssid))
4808                         goto fail;
4809         }
4810
4811         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4812         msg = NULL;
4813         if (ret) {
4814                 wpa_dbg(drv->ctx, MSG_DEBUG,
4815                         "nl80211: MLME command failed (assoc): ret=%d (%s)",
4816                         ret, strerror(-ret));
4817                 nl80211_dump_scan(drv);
4818         } else {
4819                 wpa_printf(MSG_DEBUG,
4820                            "nl80211: Association request send successfully");
4821         }
4822
4823 fail:
4824         nlmsg_free(msg);
4825         return ret;
4826 }
4827
4828
4829 static int nl80211_set_mode(struct wpa_driver_nl80211_data *drv,
4830                             int ifindex, enum nl80211_iftype mode)
4831 {
4832         struct nl_msg *msg;
4833         int ret = -ENOBUFS;
4834
4835         wpa_printf(MSG_DEBUG, "nl80211: Set mode ifindex %d iftype %d (%s)",
4836                    ifindex, mode, nl80211_iftype_str(mode));
4837
4838         msg = nl80211_cmd_msg(drv->first_bss, 0, NL80211_CMD_SET_INTERFACE);
4839         if (!msg || nla_put_u32(msg, NL80211_ATTR_IFTYPE, mode))
4840                 goto fail;
4841
4842         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4843         msg = NULL;
4844         if (!ret)
4845                 return 0;
4846 fail:
4847         nlmsg_free(msg);
4848         wpa_printf(MSG_DEBUG, "nl80211: Failed to set interface %d to mode %d:"
4849                    " %d (%s)", ifindex, mode, ret, strerror(-ret));
4850         return ret;
4851 }
4852
4853
4854 static int wpa_driver_nl80211_set_mode_impl(
4855                 struct i802_bss *bss,
4856                 enum nl80211_iftype nlmode,
4857                 struct hostapd_freq_params *desired_freq_params)
4858 {
4859         struct wpa_driver_nl80211_data *drv = bss->drv;
4860         int ret = -1;
4861         int i;
4862         int was_ap = is_ap_interface(drv->nlmode);
4863         int res;
4864         int mode_switch_res;
4865
4866         mode_switch_res = nl80211_set_mode(drv, drv->ifindex, nlmode);
4867         if (mode_switch_res && nlmode == nl80211_get_ifmode(bss))
4868                 mode_switch_res = 0;
4869
4870         if (mode_switch_res == 0) {
4871                 drv->nlmode = nlmode;
4872                 ret = 0;
4873                 goto done;
4874         }
4875
4876         if (mode_switch_res == -ENODEV)
4877                 return -1;
4878
4879         if (nlmode == drv->nlmode) {
4880                 wpa_printf(MSG_DEBUG, "nl80211: Interface already in "
4881                            "requested mode - ignore error");
4882                 ret = 0;
4883                 goto done; /* Already in the requested mode */
4884         }
4885
4886         /* mac80211 doesn't allow mode changes while the device is up, so
4887          * take the device down, try to set the mode again, and bring the
4888          * device back up.
4889          */
4890         wpa_printf(MSG_DEBUG, "nl80211: Try mode change after setting "
4891                    "interface down");
4892         for (i = 0; i < 10; i++) {
4893                 res = i802_set_iface_flags(bss, 0);
4894                 if (res == -EACCES || res == -ENODEV)
4895                         break;
4896                 if (res != 0) {
4897                         wpa_printf(MSG_DEBUG, "nl80211: Failed to set "
4898                                    "interface down");
4899                         os_sleep(0, 100000);
4900                         continue;
4901                 }
4902
4903                 /*
4904                  * Setting the mode will fail for some drivers if the phy is
4905                  * on a frequency that the mode is disallowed in.
4906                  */
4907                 if (desired_freq_params) {
4908                         res = nl80211_set_channel(bss, desired_freq_params, 0);
4909                         if (res) {
4910                                 wpa_printf(MSG_DEBUG,
4911                                            "nl80211: Failed to set frequency on interface");
4912                         }
4913                 }
4914
4915                 /* Try to set the mode again while the interface is down */
4916                 mode_switch_res = nl80211_set_mode(drv, drv->ifindex, nlmode);
4917                 if (mode_switch_res == -EBUSY) {
4918                         wpa_printf(MSG_DEBUG,
4919                                    "nl80211: Delaying mode set while interface going down");
4920                         os_sleep(0, 100000);
4921                         continue;
4922                 }
4923                 ret = mode_switch_res;
4924                 break;
4925         }
4926
4927         if (!ret) {
4928                 wpa_printf(MSG_DEBUG, "nl80211: Mode change succeeded while "
4929                            "interface is down");
4930                 drv->nlmode = nlmode;
4931                 drv->ignore_if_down_event = 1;
4932         }
4933
4934         /* Bring the interface back up */
4935         res = linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 1);
4936         if (res != 0) {
4937                 wpa_printf(MSG_DEBUG,
4938                            "nl80211: Failed to set interface up after switching mode");
4939                 ret = -1;
4940         }
4941
4942 done:
4943         if (ret) {
4944                 wpa_printf(MSG_DEBUG, "nl80211: Interface mode change to %d "
4945                            "from %d failed", nlmode, drv->nlmode);
4946                 return ret;
4947         }
4948
4949         if (is_p2p_net_interface(nlmode)) {
4950                 wpa_printf(MSG_DEBUG,
4951                            "nl80211: Interface %s mode change to P2P - disable 11b rates",
4952                            bss->ifname);
4953                 nl80211_disable_11b_rates(drv, drv->ifindex, 1);
4954         } else if (drv->disabled_11b_rates) {
4955                 wpa_printf(MSG_DEBUG,
4956                            "nl80211: Interface %s mode changed to non-P2P - re-enable 11b rates",
4957                            bss->ifname);
4958                 nl80211_disable_11b_rates(drv, drv->ifindex, 0);
4959         }
4960
4961         if (is_ap_interface(nlmode)) {
4962                 nl80211_mgmt_unsubscribe(bss, "start AP");
4963                 /* Setup additional AP mode functionality if needed */
4964                 if (nl80211_setup_ap(bss))
4965                         return -1;
4966         } else if (was_ap) {
4967                 /* Remove additional AP mode functionality */
4968                 nl80211_teardown_ap(bss);
4969         } else {
4970                 nl80211_mgmt_unsubscribe(bss, "mode change");
4971         }
4972
4973         if (is_mesh_interface(nlmode) &&
4974             nl80211_mgmt_subscribe_mesh(bss))
4975                 return -1;
4976
4977         if (!bss->in_deinit && !is_ap_interface(nlmode) &&
4978             !is_mesh_interface(nlmode) &&
4979             nl80211_mgmt_subscribe_non_ap(bss) < 0)
4980                 wpa_printf(MSG_DEBUG, "nl80211: Failed to register Action "
4981                            "frame processing - ignore for now");
4982
4983         return 0;
4984 }
4985
4986
4987 int wpa_driver_nl80211_set_mode(struct i802_bss *bss,
4988                                 enum nl80211_iftype nlmode)
4989 {
4990         return wpa_driver_nl80211_set_mode_impl(bss, nlmode, NULL);
4991 }
4992
4993
4994 static int wpa_driver_nl80211_set_mode_ibss(struct i802_bss *bss,
4995                                             struct hostapd_freq_params *freq)
4996 {
4997         return wpa_driver_nl80211_set_mode_impl(bss, NL80211_IFTYPE_ADHOC,
4998                                                 freq);
4999 }
5000
5001
5002 static int wpa_driver_nl80211_get_capa(void *priv,
5003                                        struct wpa_driver_capa *capa)
5004 {
5005         struct i802_bss *bss = priv;
5006         struct wpa_driver_nl80211_data *drv = bss->drv;
5007
5008         if (!drv->has_capability)
5009                 return -1;
5010         os_memcpy(capa, &drv->capa, sizeof(*capa));
5011         if (drv->extended_capa && drv->extended_capa_mask) {
5012                 capa->extended_capa = drv->extended_capa;
5013                 capa->extended_capa_mask = drv->extended_capa_mask;
5014                 capa->extended_capa_len = drv->extended_capa_len;
5015         }
5016
5017         return 0;
5018 }
5019
5020
5021 static int wpa_driver_nl80211_set_operstate(void *priv, int state)
5022 {
5023         struct i802_bss *bss = priv;
5024         struct wpa_driver_nl80211_data *drv = bss->drv;
5025
5026         wpa_printf(MSG_DEBUG, "nl80211: Set %s operstate %d->%d (%s)",
5027                    bss->ifname, drv->operstate, state,
5028                    state ? "UP" : "DORMANT");
5029         drv->operstate = state;
5030         return netlink_send_oper_ifla(drv->global->netlink, drv->ifindex, -1,
5031                                       state ? IF_OPER_UP : IF_OPER_DORMANT);
5032 }
5033
5034
5035 static int wpa_driver_nl80211_set_supp_port(void *priv, int authorized)
5036 {
5037         struct i802_bss *bss = priv;
5038         struct wpa_driver_nl80211_data *drv = bss->drv;
5039         struct nl_msg *msg;
5040         struct nl80211_sta_flag_update upd;
5041         int ret;
5042
5043         if (!drv->associated && is_zero_ether_addr(drv->bssid) && !authorized) {
5044                 wpa_printf(MSG_DEBUG, "nl80211: Skip set_supp_port(unauthorized) while not associated");
5045                 return 0;
5046         }
5047
5048         wpa_printf(MSG_DEBUG, "nl80211: Set supplicant port %sauthorized for "
5049                    MACSTR, authorized ? "" : "un", MAC2STR(drv->bssid));
5050
5051         os_memset(&upd, 0, sizeof(upd));
5052         upd.mask = BIT(NL80211_STA_FLAG_AUTHORIZED);
5053         if (authorized)
5054                 upd.set = BIT(NL80211_STA_FLAG_AUTHORIZED);
5055
5056         if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_SET_STATION)) ||
5057             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, drv->bssid) ||
5058             nla_put(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd)) {
5059                 nlmsg_free(msg);
5060                 return -ENOBUFS;
5061         }
5062
5063         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5064         if (!ret)
5065                 return 0;
5066         wpa_printf(MSG_DEBUG, "nl80211: Failed to set STA flag: %d (%s)",
5067                    ret, strerror(-ret));
5068         return ret;
5069 }
5070
5071
5072 /* Set kernel driver on given frequency (MHz) */
5073 static int i802_set_freq(void *priv, struct hostapd_freq_params *freq)
5074 {
5075         struct i802_bss *bss = priv;
5076         return nl80211_set_channel(bss, freq, 0);
5077 }
5078
5079
5080 static inline int min_int(int a, int b)
5081 {
5082         if (a < b)
5083                 return a;
5084         return b;
5085 }
5086
5087
5088 static int get_key_handler(struct nl_msg *msg, void *arg)
5089 {
5090         struct nlattr *tb[NL80211_ATTR_MAX + 1];
5091         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
5092
5093         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
5094                   genlmsg_attrlen(gnlh, 0), NULL);
5095
5096         /*
5097          * TODO: validate the key index and mac address!
5098          * Otherwise, there's a race condition as soon as
5099          * the kernel starts sending key notifications.
5100          */
5101
5102         if (tb[NL80211_ATTR_KEY_SEQ])
5103                 memcpy(arg, nla_data(tb[NL80211_ATTR_KEY_SEQ]),
5104                        min_int(nla_len(tb[NL80211_ATTR_KEY_SEQ]), 6));
5105         return NL_SKIP;
5106 }
5107
5108
5109 static int i802_get_seqnum(const char *iface, void *priv, const u8 *addr,
5110                            int idx, u8 *seq)
5111 {
5112         struct i802_bss *bss = priv;
5113         struct wpa_driver_nl80211_data *drv = bss->drv;
5114         struct nl_msg *msg;
5115
5116         msg = nl80211_ifindex_msg(drv, if_nametoindex(iface), 0,
5117                                   NL80211_CMD_GET_KEY);
5118         if (!msg ||
5119             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
5120             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, idx)) {
5121                 nlmsg_free(msg);
5122                 return -ENOBUFS;
5123         }
5124
5125         memset(seq, 0, 6);
5126
5127         return send_and_recv_msgs(drv, msg, get_key_handler, seq);
5128 }
5129
5130
5131 static int i802_set_rts(void *priv, int rts)
5132 {
5133         struct i802_bss *bss = priv;
5134         struct wpa_driver_nl80211_data *drv = bss->drv;
5135         struct nl_msg *msg;
5136         int ret;
5137         u32 val;
5138
5139         if (rts >= 2347)
5140                 val = (u32) -1;
5141         else
5142                 val = rts;
5143
5144         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_SET_WIPHY)) ||
5145             nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD, val)) {
5146                 nlmsg_free(msg);
5147                 return -ENOBUFS;
5148         }
5149
5150         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5151         if (!ret)
5152                 return 0;
5153         wpa_printf(MSG_DEBUG, "nl80211: Failed to set RTS threshold %d: "
5154                    "%d (%s)", rts, ret, strerror(-ret));
5155         return ret;
5156 }
5157
5158
5159 static int i802_set_frag(void *priv, int frag)
5160 {
5161         struct i802_bss *bss = priv;
5162         struct wpa_driver_nl80211_data *drv = bss->drv;
5163         struct nl_msg *msg;
5164         int ret;
5165         u32 val;
5166
5167         if (frag >= 2346)
5168                 val = (u32) -1;
5169         else
5170                 val = frag;
5171
5172         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_SET_WIPHY)) ||
5173             nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD, val)) {
5174                 nlmsg_free(msg);
5175                 return -ENOBUFS;
5176         }
5177
5178         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5179         if (!ret)
5180                 return 0;
5181         wpa_printf(MSG_DEBUG, "nl80211: Failed to set fragmentation threshold "
5182                    "%d: %d (%s)", frag, ret, strerror(-ret));
5183         return ret;
5184 }
5185
5186
5187 static int i802_flush(void *priv)
5188 {
5189         struct i802_bss *bss = priv;
5190         struct nl_msg *msg;
5191         int res;
5192
5193         wpa_printf(MSG_DEBUG, "nl80211: flush -> DEL_STATION %s (all)",
5194                    bss->ifname);
5195
5196         /*
5197          * XXX: FIX! this needs to flush all VLANs too
5198          */
5199         msg = nl80211_bss_msg(bss, 0, NL80211_CMD_DEL_STATION);
5200         res = send_and_recv_msgs(bss->drv, msg, NULL, NULL);
5201         if (res) {
5202                 wpa_printf(MSG_DEBUG, "nl80211: Station flush failed: ret=%d "
5203                            "(%s)", res, strerror(-res));
5204         }
5205         return res;
5206 }
5207
5208
5209 static int get_sta_handler(struct nl_msg *msg, void *arg)
5210 {
5211         struct nlattr *tb[NL80211_ATTR_MAX + 1];
5212         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
5213         struct hostap_sta_driver_data *data = arg;
5214         struct nlattr *stats[NL80211_STA_INFO_MAX + 1];
5215         static struct nla_policy stats_policy[NL80211_STA_INFO_MAX + 1] = {
5216                 [NL80211_STA_INFO_INACTIVE_TIME] = { .type = NLA_U32 },
5217                 [NL80211_STA_INFO_RX_BYTES] = { .type = NLA_U32 },
5218                 [NL80211_STA_INFO_TX_BYTES] = { .type = NLA_U32 },
5219                 [NL80211_STA_INFO_RX_PACKETS] = { .type = NLA_U32 },
5220                 [NL80211_STA_INFO_TX_PACKETS] = { .type = NLA_U32 },
5221                 [NL80211_STA_INFO_TX_FAILED] = { .type = NLA_U32 },
5222         };
5223
5224         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
5225                   genlmsg_attrlen(gnlh, 0), NULL);
5226
5227         /*
5228          * TODO: validate the interface and mac address!
5229          * Otherwise, there's a race condition as soon as
5230          * the kernel starts sending station notifications.
5231          */
5232
5233         if (!tb[NL80211_ATTR_STA_INFO]) {
5234                 wpa_printf(MSG_DEBUG, "sta stats missing!");
5235                 return NL_SKIP;
5236         }
5237         if (nla_parse_nested(stats, NL80211_STA_INFO_MAX,
5238                              tb[NL80211_ATTR_STA_INFO],
5239                              stats_policy)) {
5240                 wpa_printf(MSG_DEBUG, "failed to parse nested attributes!");
5241                 return NL_SKIP;
5242         }
5243
5244         if (stats[NL80211_STA_INFO_INACTIVE_TIME])
5245                 data->inactive_msec =
5246                         nla_get_u32(stats[NL80211_STA_INFO_INACTIVE_TIME]);
5247         if (stats[NL80211_STA_INFO_RX_BYTES])
5248                 data->rx_bytes = nla_get_u32(stats[NL80211_STA_INFO_RX_BYTES]);
5249         if (stats[NL80211_STA_INFO_TX_BYTES])
5250                 data->tx_bytes = nla_get_u32(stats[NL80211_STA_INFO_TX_BYTES]);
5251         if (stats[NL80211_STA_INFO_RX_PACKETS])
5252                 data->rx_packets =
5253                         nla_get_u32(stats[NL80211_STA_INFO_RX_PACKETS]);
5254         if (stats[NL80211_STA_INFO_TX_PACKETS])
5255                 data->tx_packets =
5256                         nla_get_u32(stats[NL80211_STA_INFO_TX_PACKETS]);
5257         if (stats[NL80211_STA_INFO_TX_FAILED])
5258                 data->tx_retry_failed =
5259                         nla_get_u32(stats[NL80211_STA_INFO_TX_FAILED]);
5260
5261         return NL_SKIP;
5262 }
5263
5264 static int i802_read_sta_data(struct i802_bss *bss,
5265                               struct hostap_sta_driver_data *data,
5266                               const u8 *addr)
5267 {
5268         struct nl_msg *msg;
5269
5270         os_memset(data, 0, sizeof(*data));
5271
5272         if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_GET_STATION)) ||
5273             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) {
5274                 nlmsg_free(msg);
5275                 return -ENOBUFS;
5276         }
5277
5278         return send_and_recv_msgs(bss->drv, msg, get_sta_handler, data);
5279 }
5280
5281
5282 static int i802_set_tx_queue_params(void *priv, int queue, int aifs,
5283                                     int cw_min, int cw_max, int burst_time)
5284 {
5285         struct i802_bss *bss = priv;
5286         struct wpa_driver_nl80211_data *drv = bss->drv;
5287         struct nl_msg *msg;
5288         struct nlattr *txq, *params;
5289
5290         msg = nl80211_bss_msg(bss, 0, NL80211_CMD_SET_WIPHY);
5291         if (!msg)
5292                 return -1;
5293
5294         txq = nla_nest_start(msg, NL80211_ATTR_WIPHY_TXQ_PARAMS);
5295         if (!txq)
5296                 goto fail;
5297
5298         /* We are only sending parameters for a single TXQ at a time */
5299         params = nla_nest_start(msg, 1);
5300         if (!params)
5301                 goto fail;
5302
5303         switch (queue) {
5304         case 0:
5305                 if (nla_put_u8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_VO))
5306                         goto fail;
5307                 break;
5308         case 1:
5309                 if (nla_put_u8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_VI))
5310                         goto fail;
5311                 break;
5312         case 2:
5313                 if (nla_put_u8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_BE))
5314                         goto fail;
5315                 break;
5316         case 3:
5317                 if (nla_put_u8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_BK))
5318                         goto fail;
5319                 break;
5320         }
5321         /* Burst time is configured in units of 0.1 msec and TXOP parameter in
5322          * 32 usec, so need to convert the value here. */
5323         if (nla_put_u16(msg, NL80211_TXQ_ATTR_TXOP,
5324                         (burst_time * 100 + 16) / 32) ||
5325             nla_put_u16(msg, NL80211_TXQ_ATTR_CWMIN, cw_min) ||
5326             nla_put_u16(msg, NL80211_TXQ_ATTR_CWMAX, cw_max) ||
5327             nla_put_u8(msg, NL80211_TXQ_ATTR_AIFS, aifs))
5328                 goto fail;
5329
5330         nla_nest_end(msg, params);
5331
5332         nla_nest_end(msg, txq);
5333
5334         if (send_and_recv_msgs(drv, msg, NULL, NULL) == 0)
5335                 return 0;
5336         msg = NULL;
5337 fail:
5338         nlmsg_free(msg);
5339         return -1;
5340 }
5341
5342
5343 static int i802_set_sta_vlan(struct i802_bss *bss, const u8 *addr,
5344                              const char *ifname, int vlan_id)
5345 {
5346         struct wpa_driver_nl80211_data *drv = bss->drv;
5347         struct nl_msg *msg;
5348         int ret;
5349
5350         wpa_printf(MSG_DEBUG, "nl80211: %s[%d]: set_sta_vlan(" MACSTR
5351                    ", ifname=%s[%d], vlan_id=%d)",
5352                    bss->ifname, if_nametoindex(bss->ifname),
5353                    MAC2STR(addr), ifname, if_nametoindex(ifname), vlan_id);
5354         if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_SET_STATION)) ||
5355             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
5356             nla_put_u32(msg, NL80211_ATTR_STA_VLAN, if_nametoindex(ifname))) {
5357                 nlmsg_free(msg);
5358                 return -ENOBUFS;
5359         }
5360
5361         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5362         if (ret < 0) {
5363                 wpa_printf(MSG_ERROR, "nl80211: NL80211_ATTR_STA_VLAN (addr="
5364                            MACSTR " ifname=%s vlan_id=%d) failed: %d (%s)",
5365                            MAC2STR(addr), ifname, vlan_id, ret,
5366                            strerror(-ret));
5367         }
5368         return ret;
5369 }
5370
5371
5372 static int i802_get_inact_sec(void *priv, const u8 *addr)
5373 {
5374         struct hostap_sta_driver_data data;
5375         int ret;
5376
5377         data.inactive_msec = (unsigned long) -1;
5378         ret = i802_read_sta_data(priv, &data, addr);
5379         if (ret == -ENOENT)
5380                 return -ENOENT;
5381         if (ret || data.inactive_msec == (unsigned long) -1)
5382                 return -1;
5383         return data.inactive_msec / 1000;
5384 }
5385
5386
5387 static int i802_sta_clear_stats(void *priv, const u8 *addr)
5388 {
5389 #if 0
5390         /* TODO */
5391 #endif
5392         return 0;
5393 }
5394
5395
5396 static int i802_sta_deauth(void *priv, const u8 *own_addr, const u8 *addr,
5397                            int reason)
5398 {
5399         struct i802_bss *bss = priv;
5400         struct wpa_driver_nl80211_data *drv = bss->drv;
5401         struct ieee80211_mgmt mgmt;
5402
5403         if (is_mesh_interface(drv->nlmode))
5404                 return -1;
5405
5406         if (drv->device_ap_sme)
5407                 return wpa_driver_nl80211_sta_remove(bss, addr, 1, reason);
5408
5409         memset(&mgmt, 0, sizeof(mgmt));
5410         mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
5411                                           WLAN_FC_STYPE_DEAUTH);
5412         memcpy(mgmt.da, addr, ETH_ALEN);
5413         memcpy(mgmt.sa, own_addr, ETH_ALEN);
5414         memcpy(mgmt.bssid, own_addr, ETH_ALEN);
5415         mgmt.u.deauth.reason_code = host_to_le16(reason);
5416         return wpa_driver_nl80211_send_mlme(bss, (u8 *) &mgmt,
5417                                             IEEE80211_HDRLEN +
5418                                             sizeof(mgmt.u.deauth), 0, 0, 0, 0,
5419                                             0);
5420 }
5421
5422
5423 static int i802_sta_disassoc(void *priv, const u8 *own_addr, const u8 *addr,
5424                              int reason)
5425 {
5426         struct i802_bss *bss = priv;
5427         struct wpa_driver_nl80211_data *drv = bss->drv;
5428         struct ieee80211_mgmt mgmt;
5429
5430         if (is_mesh_interface(drv->nlmode))
5431                 return -1;
5432
5433         if (drv->device_ap_sme)
5434                 return wpa_driver_nl80211_sta_remove(bss, addr, 0, reason);
5435
5436         memset(&mgmt, 0, sizeof(mgmt));
5437         mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
5438                                           WLAN_FC_STYPE_DISASSOC);
5439         memcpy(mgmt.da, addr, ETH_ALEN);
5440         memcpy(mgmt.sa, own_addr, ETH_ALEN);
5441         memcpy(mgmt.bssid, own_addr, ETH_ALEN);
5442         mgmt.u.disassoc.reason_code = host_to_le16(reason);
5443         return wpa_driver_nl80211_send_mlme(bss, (u8 *) &mgmt,
5444                                             IEEE80211_HDRLEN +
5445                                             sizeof(mgmt.u.disassoc), 0, 0, 0, 0,
5446                                             0);
5447 }
5448
5449
5450 static void dump_ifidx(struct wpa_driver_nl80211_data *drv)
5451 {
5452         char buf[200], *pos, *end;
5453         int i, res;
5454
5455         pos = buf;
5456         end = pos + sizeof(buf);
5457
5458         for (i = 0; i < drv->num_if_indices; i++) {
5459                 if (!drv->if_indices[i])
5460                         continue;
5461                 res = os_snprintf(pos, end - pos, " %d", drv->if_indices[i]);
5462                 if (os_snprintf_error(end - pos, res))
5463                         break;
5464                 pos += res;
5465         }
5466         *pos = '\0';
5467
5468         wpa_printf(MSG_DEBUG, "nl80211: if_indices[%d]:%s",
5469                    drv->num_if_indices, buf);
5470 }
5471
5472
5473 static void add_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
5474 {
5475         int i;
5476         int *old;
5477
5478         wpa_printf(MSG_DEBUG, "nl80211: Add own interface ifindex %d",
5479                    ifidx);
5480         if (have_ifidx(drv, ifidx)) {
5481                 wpa_printf(MSG_DEBUG, "nl80211: ifindex %d already in the list",
5482                            ifidx);
5483                 return;
5484         }
5485         for (i = 0; i < drv->num_if_indices; i++) {
5486                 if (drv->if_indices[i] == 0) {
5487                         drv->if_indices[i] = ifidx;
5488                         dump_ifidx(drv);
5489                         return;
5490                 }
5491         }
5492
5493         if (drv->if_indices != drv->default_if_indices)
5494                 old = drv->if_indices;
5495         else
5496                 old = NULL;
5497
5498         drv->if_indices = os_realloc_array(old, drv->num_if_indices + 1,
5499                                            sizeof(int));
5500         if (!drv->if_indices) {
5501                 if (!old)
5502                         drv->if_indices = drv->default_if_indices;
5503                 else
5504                         drv->if_indices = old;
5505                 wpa_printf(MSG_ERROR, "Failed to reallocate memory for "
5506                            "interfaces");
5507                 wpa_printf(MSG_ERROR, "Ignoring EAPOL on interface %d", ifidx);
5508                 return;
5509         } else if (!old)
5510                 os_memcpy(drv->if_indices, drv->default_if_indices,
5511                           sizeof(drv->default_if_indices));
5512         drv->if_indices[drv->num_if_indices] = ifidx;
5513         drv->num_if_indices++;
5514         dump_ifidx(drv);
5515 }
5516
5517
5518 static void del_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
5519 {
5520         int i;
5521
5522         for (i = 0; i < drv->num_if_indices; i++) {
5523                 if (drv->if_indices[i] == ifidx) {
5524                         drv->if_indices[i] = 0;
5525                         break;
5526                 }
5527         }
5528         dump_ifidx(drv);
5529 }
5530
5531
5532 static int have_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
5533 {
5534         int i;
5535
5536         for (i = 0; i < drv->num_if_indices; i++)
5537                 if (drv->if_indices[i] == ifidx)
5538                         return 1;
5539
5540         return 0;
5541 }
5542
5543
5544 static int i802_set_wds_sta(void *priv, const u8 *addr, int aid, int val,
5545                             const char *bridge_ifname, char *ifname_wds)
5546 {
5547         struct i802_bss *bss = priv;
5548         struct wpa_driver_nl80211_data *drv = bss->drv;
5549         char name[IFNAMSIZ + 1];
5550
5551         os_snprintf(name, sizeof(name), "%s.sta%d", bss->ifname, aid);
5552         if (ifname_wds)
5553                 os_strlcpy(ifname_wds, name, IFNAMSIZ + 1);
5554
5555         wpa_printf(MSG_DEBUG, "nl80211: Set WDS STA addr=" MACSTR
5556                    " aid=%d val=%d name=%s", MAC2STR(addr), aid, val, name);
5557         if (val) {
5558                 if (!if_nametoindex(name)) {
5559                         if (nl80211_create_iface(drv, name,
5560                                                  NL80211_IFTYPE_AP_VLAN,
5561                                                  bss->addr, 1, NULL, NULL, 0) <
5562                             0)
5563                                 return -1;
5564                         if (bridge_ifname &&
5565                             linux_br_add_if(drv->global->ioctl_sock,
5566                                             bridge_ifname, name) < 0)
5567                                 return -1;
5568                 }
5569                 if (linux_set_iface_flags(drv->global->ioctl_sock, name, 1)) {
5570                         wpa_printf(MSG_ERROR, "nl80211: Failed to set WDS STA "
5571                                    "interface %s up", name);
5572                 }
5573                 return i802_set_sta_vlan(priv, addr, name, 0);
5574         } else {
5575                 if (bridge_ifname)
5576                         linux_br_del_if(drv->global->ioctl_sock, bridge_ifname,
5577                                         name);
5578
5579                 i802_set_sta_vlan(priv, addr, bss->ifname, 0);
5580                 nl80211_remove_iface(drv, if_nametoindex(name));
5581                 return 0;
5582         }
5583 }
5584
5585
5586 static void handle_eapol(int sock, void *eloop_ctx, void *sock_ctx)
5587 {
5588         struct wpa_driver_nl80211_data *drv = eloop_ctx;
5589         struct sockaddr_ll lladdr;
5590         unsigned char buf[3000];
5591         int len;
5592         socklen_t fromlen = sizeof(lladdr);
5593
5594         len = recvfrom(sock, buf, sizeof(buf), 0,
5595                        (struct sockaddr *)&lladdr, &fromlen);
5596         if (len < 0) {
5597                 wpa_printf(MSG_ERROR, "nl80211: EAPOL recv failed: %s",
5598                            strerror(errno));
5599                 return;
5600         }
5601
5602         if (have_ifidx(drv, lladdr.sll_ifindex))
5603                 drv_event_eapol_rx(drv->ctx, lladdr.sll_addr, buf, len);
5604 }
5605
5606
5607 static int i802_check_bridge(struct wpa_driver_nl80211_data *drv,
5608                              struct i802_bss *bss,
5609                              const char *brname, const char *ifname)
5610 {
5611         int br_ifindex;
5612         char in_br[IFNAMSIZ];
5613
5614         os_strlcpy(bss->brname, brname, IFNAMSIZ);
5615         br_ifindex = if_nametoindex(brname);
5616         if (br_ifindex == 0) {
5617                 /*
5618                  * Bridge was configured, but the bridge device does
5619                  * not exist. Try to add it now.
5620                  */
5621                 if (linux_br_add(drv->global->ioctl_sock, brname) < 0) {
5622                         wpa_printf(MSG_ERROR, "nl80211: Failed to add the "
5623                                    "bridge interface %s: %s",
5624                                    brname, strerror(errno));
5625                         return -1;
5626                 }
5627                 bss->added_bridge = 1;
5628                 br_ifindex = if_nametoindex(brname);
5629                 add_ifidx(drv, br_ifindex);
5630         }
5631         bss->br_ifindex = br_ifindex;
5632
5633         if (linux_br_get(in_br, ifname) == 0) {
5634                 if (os_strcmp(in_br, brname) == 0)
5635                         return 0; /* already in the bridge */
5636
5637                 wpa_printf(MSG_DEBUG, "nl80211: Removing interface %s from "
5638                            "bridge %s", ifname, in_br);
5639                 if (linux_br_del_if(drv->global->ioctl_sock, in_br, ifname) <
5640                     0) {
5641                         wpa_printf(MSG_ERROR, "nl80211: Failed to "
5642                                    "remove interface %s from bridge "
5643                                    "%s: %s",
5644                                    ifname, brname, strerror(errno));
5645                         return -1;
5646                 }
5647         }
5648
5649         wpa_printf(MSG_DEBUG, "nl80211: Adding interface %s into bridge %s",
5650                    ifname, brname);
5651         if (linux_br_add_if(drv->global->ioctl_sock, brname, ifname) < 0) {
5652                 wpa_printf(MSG_ERROR, "nl80211: Failed to add interface %s "
5653                            "into bridge %s: %s",
5654                            ifname, brname, strerror(errno));
5655                 return -1;
5656         }
5657         bss->added_if_into_bridge = 1;
5658
5659         return 0;
5660 }
5661
5662
5663 static void *i802_init(struct hostapd_data *hapd,
5664                        struct wpa_init_params *params)
5665 {
5666         struct wpa_driver_nl80211_data *drv;
5667         struct i802_bss *bss;
5668         size_t i;
5669         char brname[IFNAMSIZ];
5670         int ifindex, br_ifindex;
5671         int br_added = 0;
5672
5673         bss = wpa_driver_nl80211_drv_init(hapd, params->ifname,
5674                                           params->global_priv, 1,
5675                                           params->bssid, params->driver_params);
5676         if (bss == NULL)
5677                 return NULL;
5678
5679         drv = bss->drv;
5680
5681         if (linux_br_get(brname, params->ifname) == 0) {
5682                 wpa_printf(MSG_DEBUG, "nl80211: Interface %s is in bridge %s",
5683                            params->ifname, brname);
5684                 br_ifindex = if_nametoindex(brname);
5685                 os_strlcpy(bss->brname, brname, IFNAMSIZ);
5686         } else {
5687                 brname[0] = '\0';
5688                 br_ifindex = 0;
5689         }
5690         bss->br_ifindex = br_ifindex;
5691
5692         for (i = 0; i < params->num_bridge; i++) {
5693                 if (params->bridge[i]) {
5694                         ifindex = if_nametoindex(params->bridge[i]);
5695                         if (ifindex)
5696                                 add_ifidx(drv, ifindex);
5697                         if (ifindex == br_ifindex)
5698                                 br_added = 1;
5699                 }
5700         }
5701
5702         /* start listening for EAPOL on the default AP interface */
5703         add_ifidx(drv, drv->ifindex);
5704
5705         if (params->num_bridge && params->bridge[0]) {
5706                 if (i802_check_bridge(drv, bss, params->bridge[0],
5707                                       params->ifname) < 0)
5708                         goto failed;
5709                 if (os_strcmp(params->bridge[0], brname) != 0)
5710                         br_added = 1;
5711         }
5712
5713         if (!br_added && br_ifindex &&
5714             (params->num_bridge == 0 || !params->bridge[0]))
5715                 add_ifidx(drv, br_ifindex);
5716
5717 #ifdef CONFIG_LIBNL3_ROUTE
5718         if (bss->added_if_into_bridge) {
5719                 drv->rtnl_sk = nl_socket_alloc();
5720                 if (drv->rtnl_sk == NULL) {
5721                         wpa_printf(MSG_ERROR, "nl80211: Failed to allocate nl_sock");
5722                         goto failed;
5723                 }
5724
5725                 if (nl_connect(drv->rtnl_sk, NETLINK_ROUTE)) {
5726                         wpa_printf(MSG_ERROR, "nl80211: Failed to connect nl_sock to NETLINK_ROUTE: %s",
5727                                    strerror(errno));
5728                         goto failed;
5729                 }
5730         }
5731 #endif /* CONFIG_LIBNL3_ROUTE */
5732
5733         drv->eapol_sock = socket(PF_PACKET, SOCK_DGRAM, htons(ETH_P_PAE));
5734         if (drv->eapol_sock < 0) {
5735                 wpa_printf(MSG_ERROR, "nl80211: socket(PF_PACKET, SOCK_DGRAM, ETH_P_PAE) failed: %s",
5736                            strerror(errno));
5737                 goto failed;
5738         }
5739
5740         if (eloop_register_read_sock(drv->eapol_sock, handle_eapol, drv, NULL))
5741         {
5742                 wpa_printf(MSG_INFO, "nl80211: Could not register read socket for eapol");
5743                 goto failed;
5744         }
5745
5746         if (linux_get_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
5747                                params->own_addr))
5748                 goto failed;
5749         os_memcpy(drv->perm_addr, params->own_addr, ETH_ALEN);
5750
5751         memcpy(bss->addr, params->own_addr, ETH_ALEN);
5752
5753         return bss;
5754
5755 failed:
5756         wpa_driver_nl80211_deinit(bss);
5757         return NULL;
5758 }
5759
5760
5761 static void i802_deinit(void *priv)
5762 {
5763         struct i802_bss *bss = priv;
5764         wpa_driver_nl80211_deinit(bss);
5765 }
5766
5767
5768 static enum nl80211_iftype wpa_driver_nl80211_if_type(
5769         enum wpa_driver_if_type type)
5770 {
5771         switch (type) {
5772         case WPA_IF_STATION:
5773                 return NL80211_IFTYPE_STATION;
5774         case WPA_IF_P2P_CLIENT:
5775         case WPA_IF_P2P_GROUP:
5776                 return NL80211_IFTYPE_P2P_CLIENT;
5777         case WPA_IF_AP_VLAN:
5778                 return NL80211_IFTYPE_AP_VLAN;
5779         case WPA_IF_AP_BSS:
5780                 return NL80211_IFTYPE_AP;
5781         case WPA_IF_P2P_GO:
5782                 return NL80211_IFTYPE_P2P_GO;
5783         case WPA_IF_P2P_DEVICE:
5784                 return NL80211_IFTYPE_P2P_DEVICE;
5785         case WPA_IF_MESH:
5786                 return NL80211_IFTYPE_MESH_POINT;
5787         }
5788         return -1;
5789 }
5790
5791
5792 static int nl80211_addr_in_use(struct nl80211_global *global, const u8 *addr)
5793 {
5794         struct wpa_driver_nl80211_data *drv;
5795         dl_list_for_each(drv, &global->interfaces,
5796                          struct wpa_driver_nl80211_data, list) {
5797                 if (os_memcmp(addr, drv->first_bss->addr, ETH_ALEN) == 0)
5798                         return 1;
5799         }
5800         return 0;
5801 }
5802
5803
5804 static int nl80211_vif_addr(struct wpa_driver_nl80211_data *drv, u8 *new_addr)
5805 {
5806         unsigned int idx;
5807
5808         if (!drv->global)
5809                 return -1;
5810
5811         os_memcpy(new_addr, drv->first_bss->addr, ETH_ALEN);
5812         for (idx = 0; idx < 64; idx++) {
5813                 new_addr[0] = drv->first_bss->addr[0] | 0x02;
5814                 new_addr[0] ^= idx << 2;
5815                 if (!nl80211_addr_in_use(drv->global, new_addr))
5816                         break;
5817         }
5818         if (idx == 64)
5819                 return -1;
5820
5821         wpa_printf(MSG_DEBUG, "nl80211: Assigned new virtual interface address "
5822                    MACSTR, MAC2STR(new_addr));
5823
5824         return 0;
5825 }
5826
5827
5828 struct wdev_info {
5829         u64 wdev_id;
5830         int wdev_id_set;
5831         u8 macaddr[ETH_ALEN];
5832 };
5833
5834 static int nl80211_wdev_handler(struct nl_msg *msg, void *arg)
5835 {
5836         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
5837         struct nlattr *tb[NL80211_ATTR_MAX + 1];
5838         struct wdev_info *wi = arg;
5839
5840         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
5841                   genlmsg_attrlen(gnlh, 0), NULL);
5842         if (tb[NL80211_ATTR_WDEV]) {
5843                 wi->wdev_id = nla_get_u64(tb[NL80211_ATTR_WDEV]);
5844                 wi->wdev_id_set = 1;
5845         }
5846
5847         if (tb[NL80211_ATTR_MAC])
5848                 os_memcpy(wi->macaddr, nla_data(tb[NL80211_ATTR_MAC]),
5849                           ETH_ALEN);
5850
5851         return NL_SKIP;
5852 }
5853
5854
5855 static int wpa_driver_nl80211_if_add(void *priv, enum wpa_driver_if_type type,
5856                                      const char *ifname, const u8 *addr,
5857                                      void *bss_ctx, void **drv_priv,
5858                                      char *force_ifname, u8 *if_addr,
5859                                      const char *bridge, int use_existing)
5860 {
5861         enum nl80211_iftype nlmode;
5862         struct i802_bss *bss = priv;
5863         struct wpa_driver_nl80211_data *drv = bss->drv;
5864         int ifidx;
5865         int added = 1;
5866
5867         if (addr)
5868                 os_memcpy(if_addr, addr, ETH_ALEN);
5869         nlmode = wpa_driver_nl80211_if_type(type);
5870         if (nlmode == NL80211_IFTYPE_P2P_DEVICE) {
5871                 struct wdev_info p2pdev_info;
5872
5873                 os_memset(&p2pdev_info, 0, sizeof(p2pdev_info));
5874                 ifidx = nl80211_create_iface(drv, ifname, nlmode, addr,
5875                                              0, nl80211_wdev_handler,
5876                                              &p2pdev_info, use_existing);
5877                 if (!p2pdev_info.wdev_id_set || ifidx != 0) {
5878                         wpa_printf(MSG_ERROR, "nl80211: Failed to create a P2P Device interface %s",
5879                                    ifname);
5880                         return -1;
5881                 }
5882
5883                 drv->global->if_add_wdevid = p2pdev_info.wdev_id;
5884                 drv->global->if_add_wdevid_set = p2pdev_info.wdev_id_set;
5885                 if (!is_zero_ether_addr(p2pdev_info.macaddr))
5886                         os_memcpy(if_addr, p2pdev_info.macaddr, ETH_ALEN);
5887                 wpa_printf(MSG_DEBUG, "nl80211: New P2P Device interface %s (0x%llx) created",
5888                            ifname,
5889                            (long long unsigned int) p2pdev_info.wdev_id);
5890         } else {
5891                 ifidx = nl80211_create_iface(drv, ifname, nlmode, addr,
5892                                              0, NULL, NULL, use_existing);
5893                 if (use_existing && ifidx == -ENFILE) {
5894                         added = 0;
5895                         ifidx = if_nametoindex(ifname);
5896                 } else if (ifidx < 0) {
5897                         return -1;
5898                 }
5899         }
5900
5901         if (!addr) {
5902                 if (nlmode == NL80211_IFTYPE_P2P_DEVICE)
5903                         os_memcpy(if_addr, bss->addr, ETH_ALEN);
5904                 else if (linux_get_ifhwaddr(drv->global->ioctl_sock,
5905                                             ifname, if_addr) < 0) {
5906                         if (added)
5907                                 nl80211_remove_iface(drv, ifidx);
5908                         return -1;
5909                 }
5910         }
5911
5912         if (!addr &&
5913             (type == WPA_IF_P2P_CLIENT || type == WPA_IF_P2P_GROUP ||
5914              type == WPA_IF_P2P_GO || type == WPA_IF_MESH ||
5915              type == WPA_IF_STATION)) {
5916                 /* Enforce unique address */
5917                 u8 new_addr[ETH_ALEN];
5918
5919                 if (linux_get_ifhwaddr(drv->global->ioctl_sock, ifname,
5920                                        new_addr) < 0) {
5921                         if (added)
5922                                 nl80211_remove_iface(drv, ifidx);
5923                         return -1;
5924                 }
5925                 if (nl80211_addr_in_use(drv->global, new_addr)) {
5926                         wpa_printf(MSG_DEBUG, "nl80211: Allocate new address "
5927                                    "for interface %s type %d", ifname, type);
5928                         if (nl80211_vif_addr(drv, new_addr) < 0) {
5929                                 if (added)
5930                                         nl80211_remove_iface(drv, ifidx);
5931                                 return -1;
5932                         }
5933                         if (linux_set_ifhwaddr(drv->global->ioctl_sock, ifname,
5934                                                new_addr) < 0) {
5935                                 if (added)
5936                                         nl80211_remove_iface(drv, ifidx);
5937                                 return -1;
5938                         }
5939                 }
5940                 os_memcpy(if_addr, new_addr, ETH_ALEN);
5941         }
5942
5943         if (type == WPA_IF_AP_BSS) {
5944                 struct i802_bss *new_bss = os_zalloc(sizeof(*new_bss));
5945                 if (new_bss == NULL) {
5946                         if (added)
5947                                 nl80211_remove_iface(drv, ifidx);
5948                         return -1;
5949                 }
5950
5951                 if (bridge &&
5952                     i802_check_bridge(drv, new_bss, bridge, ifname) < 0) {
5953                         wpa_printf(MSG_ERROR, "nl80211: Failed to add the new "
5954                                    "interface %s to a bridge %s",
5955                                    ifname, bridge);
5956                         if (added)
5957                                 nl80211_remove_iface(drv, ifidx);
5958                         os_free(new_bss);
5959                         return -1;
5960                 }
5961
5962                 if (linux_set_iface_flags(drv->global->ioctl_sock, ifname, 1))
5963                 {
5964                         if (added)
5965                                 nl80211_remove_iface(drv, ifidx);
5966                         os_free(new_bss);
5967                         return -1;
5968                 }
5969                 os_strlcpy(new_bss->ifname, ifname, IFNAMSIZ);
5970                 os_memcpy(new_bss->addr, if_addr, ETH_ALEN);
5971                 new_bss->ifindex = ifidx;
5972                 new_bss->drv = drv;
5973                 new_bss->next = drv->first_bss->next;
5974                 new_bss->freq = drv->first_bss->freq;
5975                 new_bss->ctx = bss_ctx;
5976                 new_bss->added_if = added;
5977                 drv->first_bss->next = new_bss;
5978                 if (drv_priv)
5979                         *drv_priv = new_bss;
5980                 nl80211_init_bss(new_bss);
5981
5982                 /* Subscribe management frames for this WPA_IF_AP_BSS */
5983                 if (nl80211_setup_ap(new_bss))
5984                         return -1;
5985         }
5986
5987         if (drv->global)
5988                 drv->global->if_add_ifindex = ifidx;
5989
5990         /*
5991          * Some virtual interfaces need to process EAPOL packets and events on
5992          * the parent interface. This is used mainly with hostapd.
5993          */
5994         if (ifidx > 0 &&
5995             (drv->hostapd ||
5996              nlmode == NL80211_IFTYPE_AP_VLAN ||
5997              nlmode == NL80211_IFTYPE_WDS ||
5998              nlmode == NL80211_IFTYPE_MONITOR))
5999                 add_ifidx(drv, ifidx);
6000
6001         return 0;
6002 }
6003
6004
6005 static int wpa_driver_nl80211_if_remove(struct i802_bss *bss,
6006                                         enum wpa_driver_if_type type,
6007                                         const char *ifname)
6008 {
6009         struct wpa_driver_nl80211_data *drv = bss->drv;
6010         int ifindex = if_nametoindex(ifname);
6011
6012         wpa_printf(MSG_DEBUG, "nl80211: %s(type=%d ifname=%s) ifindex=%d added_if=%d",
6013                    __func__, type, ifname, ifindex, bss->added_if);
6014         if (ifindex > 0 && (bss->added_if || bss->ifindex != ifindex))
6015                 nl80211_remove_iface(drv, ifindex);
6016         else if (ifindex > 0 && !bss->added_if) {
6017                 struct wpa_driver_nl80211_data *drv2;
6018                 dl_list_for_each(drv2, &drv->global->interfaces,
6019                                  struct wpa_driver_nl80211_data, list)
6020                         del_ifidx(drv2, ifindex);
6021         }
6022
6023         if (type != WPA_IF_AP_BSS)
6024                 return 0;
6025
6026         if (bss->added_if_into_bridge) {
6027                 if (linux_br_del_if(drv->global->ioctl_sock, bss->brname,
6028                                     bss->ifname) < 0)
6029                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
6030                                    "interface %s from bridge %s: %s",
6031                                    bss->ifname, bss->brname, strerror(errno));
6032         }
6033         if (bss->added_bridge) {
6034                 if (linux_br_del(drv->global->ioctl_sock, bss->brname) < 0)
6035                         wpa_printf(MSG_INFO, "nl80211: Failed to remove "
6036                                    "bridge %s: %s",
6037                                    bss->brname, strerror(errno));
6038         }
6039
6040         if (bss != drv->first_bss) {
6041                 struct i802_bss *tbss;
6042
6043                 wpa_printf(MSG_DEBUG, "nl80211: Not the first BSS - remove it");
6044                 for (tbss = drv->first_bss; tbss; tbss = tbss->next) {
6045                         if (tbss->next == bss) {
6046                                 tbss->next = bss->next;
6047                                 /* Unsubscribe management frames */
6048                                 nl80211_teardown_ap(bss);
6049                                 nl80211_destroy_bss(bss);
6050                                 if (!bss->added_if)
6051                                         i802_set_iface_flags(bss, 0);
6052                                 os_free(bss);
6053                                 bss = NULL;
6054                                 break;
6055                         }
6056                 }
6057                 if (bss)
6058                         wpa_printf(MSG_INFO, "nl80211: %s - could not find "
6059                                    "BSS %p in the list", __func__, bss);
6060         } else {
6061                 wpa_printf(MSG_DEBUG, "nl80211: First BSS - reassign context");
6062                 nl80211_teardown_ap(bss);
6063                 if (!bss->added_if && !drv->first_bss->next)
6064                         wpa_driver_nl80211_del_beacon(drv);
6065                 nl80211_destroy_bss(bss);
6066                 if (!bss->added_if)
6067                         i802_set_iface_flags(bss, 0);
6068                 if (drv->first_bss->next) {
6069                         drv->first_bss = drv->first_bss->next;
6070                         drv->ctx = drv->first_bss->ctx;
6071                         os_free(bss);
6072                 } else {
6073                         wpa_printf(MSG_DEBUG, "nl80211: No second BSS to reassign context to");
6074                 }
6075         }
6076
6077         return 0;
6078 }
6079
6080
6081 static int cookie_handler(struct nl_msg *msg, void *arg)
6082 {
6083         struct nlattr *tb[NL80211_ATTR_MAX + 1];
6084         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
6085         u64 *cookie = arg;
6086         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
6087                   genlmsg_attrlen(gnlh, 0), NULL);
6088         if (tb[NL80211_ATTR_COOKIE])
6089                 *cookie = nla_get_u64(tb[NL80211_ATTR_COOKIE]);
6090         return NL_SKIP;
6091 }
6092
6093
6094 static int nl80211_send_frame_cmd(struct i802_bss *bss,
6095                                   unsigned int freq, unsigned int wait,
6096                                   const u8 *buf, size_t buf_len,
6097                                   u64 *cookie_out, int no_cck, int no_ack,
6098                                   int offchanok)
6099 {
6100         struct wpa_driver_nl80211_data *drv = bss->drv;
6101         struct nl_msg *msg;
6102         u64 cookie;
6103         int ret = -1;
6104
6105         wpa_printf(MSG_MSGDUMP, "nl80211: CMD_FRAME freq=%u wait=%u no_cck=%d "
6106                    "no_ack=%d offchanok=%d",
6107                    freq, wait, no_cck, no_ack, offchanok);
6108         wpa_hexdump(MSG_MSGDUMP, "CMD_FRAME", buf, buf_len);
6109
6110         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_FRAME)) ||
6111             (freq && nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
6112             (wait && nla_put_u32(msg, NL80211_ATTR_DURATION, wait)) ||
6113             (offchanok && ((drv->capa.flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX) ||
6114                            drv->test_use_roc_tx) &&
6115              nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK)) ||
6116             (no_cck && nla_put_flag(msg, NL80211_ATTR_TX_NO_CCK_RATE)) ||
6117             (no_ack && nla_put_flag(msg, NL80211_ATTR_DONT_WAIT_FOR_ACK)) ||
6118             nla_put(msg, NL80211_ATTR_FRAME, buf_len, buf))
6119                 goto fail;
6120
6121         cookie = 0;
6122         ret = send_and_recv_msgs(drv, msg, cookie_handler, &cookie);
6123         msg = NULL;
6124         if (ret) {
6125                 wpa_printf(MSG_DEBUG, "nl80211: Frame command failed: ret=%d "
6126                            "(%s) (freq=%u wait=%u)", ret, strerror(-ret),
6127                            freq, wait);
6128         } else {
6129                 wpa_printf(MSG_MSGDUMP, "nl80211: Frame TX command accepted%s; "
6130                            "cookie 0x%llx", no_ack ? " (no ACK)" : "",
6131                            (long long unsigned int) cookie);
6132
6133                 if (cookie_out)
6134                         *cookie_out = no_ack ? (u64) -1 : cookie;
6135         }
6136
6137 fail:
6138         nlmsg_free(msg);
6139         return ret;
6140 }
6141
6142
6143 static int wpa_driver_nl80211_send_action(struct i802_bss *bss,
6144                                           unsigned int freq,
6145                                           unsigned int wait_time,
6146                                           const u8 *dst, const u8 *src,
6147                                           const u8 *bssid,
6148                                           const u8 *data, size_t data_len,
6149                                           int no_cck)
6150 {
6151         struct wpa_driver_nl80211_data *drv = bss->drv;
6152         int ret = -1;
6153         u8 *buf;
6154         struct ieee80211_hdr *hdr;
6155
6156         wpa_printf(MSG_DEBUG, "nl80211: Send Action frame (ifindex=%d, "
6157                    "freq=%u MHz wait=%d ms no_cck=%d)",
6158                    drv->ifindex, freq, wait_time, no_cck);
6159
6160         buf = os_zalloc(24 + data_len);
6161         if (buf == NULL)
6162                 return ret;
6163         os_memcpy(buf + 24, data, data_len);
6164         hdr = (struct ieee80211_hdr *) buf;
6165         hdr->frame_control =
6166                 IEEE80211_FC(WLAN_FC_TYPE_MGMT, WLAN_FC_STYPE_ACTION);
6167         os_memcpy(hdr->addr1, dst, ETH_ALEN);
6168         os_memcpy(hdr->addr2, src, ETH_ALEN);
6169         os_memcpy(hdr->addr3, bssid, ETH_ALEN);
6170
6171         if (is_ap_interface(drv->nlmode) &&
6172             (!(drv->capa.flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX) ||
6173              (int) freq == bss->freq || drv->device_ap_sme ||
6174              !drv->use_monitor))
6175                 ret = wpa_driver_nl80211_send_mlme(bss, buf, 24 + data_len,
6176                                                    0, freq, no_cck, 1,
6177                                                    wait_time);
6178         else
6179                 ret = nl80211_send_frame_cmd(bss, freq, wait_time, buf,
6180                                              24 + data_len,
6181                                              &drv->send_action_cookie,
6182                                              no_cck, 0, 1);
6183
6184         os_free(buf);
6185         return ret;
6186 }
6187
6188
6189 static void wpa_driver_nl80211_send_action_cancel_wait(void *priv)
6190 {
6191         struct i802_bss *bss = priv;
6192         struct wpa_driver_nl80211_data *drv = bss->drv;
6193         struct nl_msg *msg;
6194         int ret;
6195
6196         wpa_printf(MSG_DEBUG, "nl80211: Cancel TX frame wait: cookie=0x%llx",
6197                    (long long unsigned int) drv->send_action_cookie);
6198         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_FRAME_WAIT_CANCEL)) ||
6199             nla_put_u64(msg, NL80211_ATTR_COOKIE, drv->send_action_cookie)) {
6200                 nlmsg_free(msg);
6201                 return;
6202         }
6203
6204         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
6205         if (ret)
6206                 wpa_printf(MSG_DEBUG, "nl80211: wait cancel failed: ret=%d "
6207                            "(%s)", ret, strerror(-ret));
6208 }
6209
6210
6211 static int wpa_driver_nl80211_remain_on_channel(void *priv, unsigned int freq,
6212                                                 unsigned int duration)
6213 {
6214         struct i802_bss *bss = priv;
6215         struct wpa_driver_nl80211_data *drv = bss->drv;
6216         struct nl_msg *msg;
6217         int ret;
6218         u64 cookie;
6219
6220         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_REMAIN_ON_CHANNEL)) ||
6221             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
6222             nla_put_u32(msg, NL80211_ATTR_DURATION, duration)) {
6223                 nlmsg_free(msg);
6224                 return -1;
6225         }
6226
6227         cookie = 0;
6228         ret = send_and_recv_msgs(drv, msg, cookie_handler, &cookie);
6229         if (ret == 0) {
6230                 wpa_printf(MSG_DEBUG, "nl80211: Remain-on-channel cookie "
6231                            "0x%llx for freq=%u MHz duration=%u",
6232                            (long long unsigned int) cookie, freq, duration);
6233                 drv->remain_on_chan_cookie = cookie;
6234                 drv->pending_remain_on_chan = 1;
6235                 return 0;
6236         }
6237         wpa_printf(MSG_DEBUG, "nl80211: Failed to request remain-on-channel "
6238                    "(freq=%d duration=%u): %d (%s)",
6239                    freq, duration, ret, strerror(-ret));
6240         return -1;
6241 }
6242
6243
6244 static int wpa_driver_nl80211_cancel_remain_on_channel(void *priv)
6245 {
6246         struct i802_bss *bss = priv;
6247         struct wpa_driver_nl80211_data *drv = bss->drv;
6248         struct nl_msg *msg;
6249         int ret;
6250
6251         if (!drv->pending_remain_on_chan) {
6252                 wpa_printf(MSG_DEBUG, "nl80211: No pending remain-on-channel "
6253                            "to cancel");
6254                 return -1;
6255         }
6256
6257         wpa_printf(MSG_DEBUG, "nl80211: Cancel remain-on-channel with cookie "
6258                    "0x%llx",
6259                    (long long unsigned int) drv->remain_on_chan_cookie);
6260
6261         msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL);
6262         if (!msg ||
6263             nla_put_u64(msg, NL80211_ATTR_COOKIE, drv->remain_on_chan_cookie)) {
6264                 nlmsg_free(msg);
6265                 return -1;
6266         }
6267
6268         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
6269         if (ret == 0)
6270                 return 0;
6271         wpa_printf(MSG_DEBUG, "nl80211: Failed to cancel remain-on-channel: "
6272                    "%d (%s)", ret, strerror(-ret));
6273         return -1;
6274 }
6275
6276
6277 static int wpa_driver_nl80211_probe_req_report(struct i802_bss *bss, int report)
6278 {
6279         struct wpa_driver_nl80211_data *drv = bss->drv;
6280
6281         if (!report) {
6282                 if (bss->nl_preq && drv->device_ap_sme &&
6283                     is_ap_interface(drv->nlmode) && !bss->in_deinit &&
6284                     !bss->static_ap) {
6285                         /*
6286                          * Do not disable Probe Request reporting that was
6287                          * enabled in nl80211_setup_ap().
6288                          */
6289                         wpa_printf(MSG_DEBUG, "nl80211: Skip disabling of "
6290                                    "Probe Request reporting nl_preq=%p while "
6291                                    "in AP mode", bss->nl_preq);
6292                 } else if (bss->nl_preq) {
6293                         wpa_printf(MSG_DEBUG, "nl80211: Disable Probe Request "
6294                                    "reporting nl_preq=%p", bss->nl_preq);
6295                         nl80211_destroy_eloop_handle(&bss->nl_preq);
6296                 }
6297                 return 0;
6298         }
6299
6300         if (bss->nl_preq) {
6301                 wpa_printf(MSG_DEBUG, "nl80211: Probe Request reporting "
6302                            "already on! nl_preq=%p", bss->nl_preq);
6303                 return 0;
6304         }
6305
6306         bss->nl_preq = nl_create_handle(drv->global->nl_cb, "preq");
6307         if (bss->nl_preq == NULL)
6308                 return -1;
6309         wpa_printf(MSG_DEBUG, "nl80211: Enable Probe Request "
6310                    "reporting nl_preq=%p", bss->nl_preq);
6311
6312         if (nl80211_register_frame(bss, bss->nl_preq,
6313                                    (WLAN_FC_TYPE_MGMT << 2) |
6314                                    (WLAN_FC_STYPE_PROBE_REQ << 4),
6315                                    NULL, 0) < 0)
6316                 goto out_err;
6317
6318         nl80211_register_eloop_read(&bss->nl_preq,
6319                                     wpa_driver_nl80211_event_receive,
6320                                     bss->nl_cb);
6321
6322         return 0;
6323
6324  out_err:
6325         nl_destroy_handles(&bss->nl_preq);
6326         return -1;
6327 }
6328
6329
6330 static int nl80211_disable_11b_rates(struct wpa_driver_nl80211_data *drv,
6331                                      int ifindex, int disabled)
6332 {
6333         struct nl_msg *msg;
6334         struct nlattr *bands, *band;
6335         int ret;
6336
6337         wpa_printf(MSG_DEBUG,
6338                    "nl80211: NL80211_CMD_SET_TX_BITRATE_MASK (ifindex=%d %s)",
6339                    ifindex, disabled ? "NL80211_TXRATE_LEGACY=OFDM-only" :
6340                    "no NL80211_TXRATE_LEGACY constraint");
6341
6342         msg = nl80211_ifindex_msg(drv, ifindex, 0,
6343                                   NL80211_CMD_SET_TX_BITRATE_MASK);
6344         if (!msg)
6345                 return -1;
6346
6347         bands = nla_nest_start(msg, NL80211_ATTR_TX_RATES);
6348         if (!bands)
6349                 goto fail;
6350
6351         /*
6352          * Disable 2 GHz rates 1, 2, 5.5, 11 Mbps by masking out everything
6353          * else apart from 6, 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS
6354          * rates. All 5 GHz rates are left enabled.
6355          */
6356         band = nla_nest_start(msg, NL80211_BAND_2GHZ);
6357         if (!band ||
6358             (disabled && nla_put(msg, NL80211_TXRATE_LEGACY, 8,
6359                                  "\x0c\x12\x18\x24\x30\x48\x60\x6c")))
6360                 goto fail;
6361         nla_nest_end(msg, band);
6362
6363         nla_nest_end(msg, bands);
6364
6365         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
6366         if (ret) {
6367                 wpa_printf(MSG_DEBUG, "nl80211: Set TX rates failed: ret=%d "
6368                            "(%s)", ret, strerror(-ret));
6369         } else
6370                 drv->disabled_11b_rates = disabled;
6371
6372         return ret;
6373
6374 fail:
6375         nlmsg_free(msg);
6376         return -1;
6377 }
6378
6379
6380 static int wpa_driver_nl80211_deinit_ap(void *priv)
6381 {
6382         struct i802_bss *bss = priv;
6383         struct wpa_driver_nl80211_data *drv = bss->drv;
6384         if (!is_ap_interface(drv->nlmode))
6385                 return -1;
6386         wpa_driver_nl80211_del_beacon(drv);
6387         bss->beacon_set = 0;
6388
6389         /*
6390          * If the P2P GO interface was dynamically added, then it is
6391          * possible that the interface change to station is not possible.
6392          */
6393         if (drv->nlmode == NL80211_IFTYPE_P2P_GO && bss->if_dynamic)
6394                 return 0;
6395
6396         return wpa_driver_nl80211_set_mode(priv, NL80211_IFTYPE_STATION);
6397 }
6398
6399
6400 static int wpa_driver_nl80211_stop_ap(void *priv)
6401 {
6402         struct i802_bss *bss = priv;
6403         struct wpa_driver_nl80211_data *drv = bss->drv;
6404         if (!is_ap_interface(drv->nlmode))
6405                 return -1;
6406         wpa_driver_nl80211_del_beacon(drv);
6407         bss->beacon_set = 0;
6408         return 0;
6409 }
6410
6411
6412 static int wpa_driver_nl80211_deinit_p2p_cli(void *priv)
6413 {
6414         struct i802_bss *bss = priv;
6415         struct wpa_driver_nl80211_data *drv = bss->drv;
6416         if (drv->nlmode != NL80211_IFTYPE_P2P_CLIENT)
6417                 return -1;
6418
6419         /*
6420          * If the P2P Client interface was dynamically added, then it is
6421          * possible that the interface change to station is not possible.
6422          */
6423         if (bss->if_dynamic)
6424                 return 0;
6425
6426         return wpa_driver_nl80211_set_mode(priv, NL80211_IFTYPE_STATION);
6427 }
6428
6429
6430 static void wpa_driver_nl80211_resume(void *priv)
6431 {
6432         struct i802_bss *bss = priv;
6433
6434         if (i802_set_iface_flags(bss, 1))
6435                 wpa_printf(MSG_DEBUG, "nl80211: Failed to set interface up on resume event");
6436 }
6437
6438
6439 static int nl80211_signal_monitor(void *priv, int threshold, int hysteresis)
6440 {
6441         struct i802_bss *bss = priv;
6442         struct wpa_driver_nl80211_data *drv = bss->drv;
6443         struct nl_msg *msg;
6444         struct nlattr *cqm;
6445
6446         wpa_printf(MSG_DEBUG, "nl80211: Signal monitor threshold=%d "
6447                    "hysteresis=%d", threshold, hysteresis);
6448
6449         if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_SET_CQM)) ||
6450             !(cqm = nla_nest_start(msg, NL80211_ATTR_CQM)) ||
6451             nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THOLD, threshold) ||
6452             nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_HYST, hysteresis)) {
6453                 nlmsg_free(msg);
6454                 return -1;
6455         }
6456         nla_nest_end(msg, cqm);
6457
6458         return send_and_recv_msgs(drv, msg, NULL, NULL);
6459 }
6460
6461
6462 static int get_channel_width(struct nl_msg *msg, void *arg)
6463 {
6464         struct nlattr *tb[NL80211_ATTR_MAX + 1];
6465         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
6466         struct wpa_signal_info *sig_change = arg;
6467
6468         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
6469                   genlmsg_attrlen(gnlh, 0), NULL);
6470
6471         sig_change->center_frq1 = -1;
6472         sig_change->center_frq2 = -1;
6473         sig_change->chanwidth = CHAN_WIDTH_UNKNOWN;
6474
6475         if (tb[NL80211_ATTR_CHANNEL_WIDTH]) {
6476                 sig_change->chanwidth = convert2width(
6477                         nla_get_u32(tb[NL80211_ATTR_CHANNEL_WIDTH]));
6478                 if (tb[NL80211_ATTR_CENTER_FREQ1])
6479                         sig_change->center_frq1 =
6480                                 nla_get_u32(tb[NL80211_ATTR_CENTER_FREQ1]);
6481                 if (tb[NL80211_ATTR_CENTER_FREQ2])
6482                         sig_change->center_frq2 =
6483                                 nla_get_u32(tb[NL80211_ATTR_CENTER_FREQ2]);
6484         }
6485
6486         return NL_SKIP;
6487 }
6488
6489
6490 static int nl80211_get_channel_width(struct wpa_driver_nl80211_data *drv,
6491                                      struct wpa_signal_info *sig)
6492 {
6493         struct nl_msg *msg;
6494
6495         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_GET_INTERFACE);
6496         return send_and_recv_msgs(drv, msg, get_channel_width, sig);
6497 }
6498
6499
6500 static int nl80211_signal_poll(void *priv, struct wpa_signal_info *si)
6501 {
6502         struct i802_bss *bss = priv;
6503         struct wpa_driver_nl80211_data *drv = bss->drv;
6504         int res;
6505
6506         os_memset(si, 0, sizeof(*si));
6507         res = nl80211_get_link_signal(drv, si);
6508         if (res != 0)
6509                 return res;
6510
6511         res = nl80211_get_channel_width(drv, si);
6512         if (res != 0)
6513                 return res;
6514
6515         return nl80211_get_link_noise(drv, si);
6516 }
6517
6518
6519 static int nl80211_send_frame(void *priv, const u8 *data, size_t data_len,
6520                               int encrypt)
6521 {
6522         struct i802_bss *bss = priv;
6523         return wpa_driver_nl80211_send_frame(bss, data, data_len, encrypt, 0,
6524                                              0, 0, 0, 0);
6525 }
6526
6527
6528 static int nl80211_set_param(void *priv, const char *param)
6529 {
6530         wpa_printf(MSG_DEBUG, "nl80211: driver param='%s'", param);
6531         if (param == NULL)
6532                 return 0;
6533
6534 #ifdef CONFIG_P2P
6535         if (os_strstr(param, "use_p2p_group_interface=1")) {
6536                 struct i802_bss *bss = priv;
6537                 struct wpa_driver_nl80211_data *drv = bss->drv;
6538
6539                 wpa_printf(MSG_DEBUG, "nl80211: Use separate P2P group "
6540                            "interface");
6541                 drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_CONCURRENT;
6542                 drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_MGMT_AND_NON_P2P;
6543         }
6544 #endif /* CONFIG_P2P */
6545
6546         if (os_strstr(param, "use_monitor=1")) {
6547                 struct i802_bss *bss = priv;
6548                 struct wpa_driver_nl80211_data *drv = bss->drv;
6549                 drv->use_monitor = 1;
6550         }
6551
6552         if (os_strstr(param, "force_connect_cmd=1")) {
6553                 struct i802_bss *bss = priv;
6554                 struct wpa_driver_nl80211_data *drv = bss->drv;
6555                 drv->capa.flags &= ~WPA_DRIVER_FLAGS_SME;
6556                 drv->force_connect_cmd = 1;
6557         }
6558
6559         if (os_strstr(param, "no_offchannel_tx=1")) {
6560                 struct i802_bss *bss = priv;
6561                 struct wpa_driver_nl80211_data *drv = bss->drv;
6562                 drv->capa.flags &= ~WPA_DRIVER_FLAGS_OFFCHANNEL_TX;
6563                 drv->test_use_roc_tx = 1;
6564         }
6565
6566         return 0;
6567 }
6568
6569
6570 static void * nl80211_global_init(void)
6571 {
6572         struct nl80211_global *global;
6573         struct netlink_config *cfg;
6574
6575         global = os_zalloc(sizeof(*global));
6576         if (global == NULL)
6577                 return NULL;
6578         global->ioctl_sock = -1;
6579         dl_list_init(&global->interfaces);
6580         global->if_add_ifindex = -1;
6581
6582         cfg = os_zalloc(sizeof(*cfg));
6583         if (cfg == NULL)
6584                 goto err;
6585
6586         cfg->ctx = global;
6587         cfg->newlink_cb = wpa_driver_nl80211_event_rtm_newlink;
6588         cfg->dellink_cb = wpa_driver_nl80211_event_rtm_dellink;
6589         global->netlink = netlink_init(cfg);
6590         if (global->netlink == NULL) {
6591                 os_free(cfg);
6592                 goto err;
6593         }
6594
6595         if (wpa_driver_nl80211_init_nl_global(global) < 0)
6596                 goto err;
6597
6598         global->ioctl_sock = socket(PF_INET, SOCK_DGRAM, 0);
6599         if (global->ioctl_sock < 0) {
6600                 wpa_printf(MSG_ERROR, "nl80211: socket(PF_INET,SOCK_DGRAM) failed: %s",
6601                            strerror(errno));
6602                 goto err;
6603         }
6604
6605         return global;
6606
6607 err:
6608         nl80211_global_deinit(global);
6609         return NULL;
6610 }
6611
6612
6613 static void nl80211_global_deinit(void *priv)
6614 {
6615         struct nl80211_global *global = priv;
6616         if (global == NULL)
6617                 return;
6618         if (!dl_list_empty(&global->interfaces)) {
6619                 wpa_printf(MSG_ERROR, "nl80211: %u interface(s) remain at "
6620                            "nl80211_global_deinit",
6621                            dl_list_len(&global->interfaces));
6622         }
6623
6624         if (global->netlink)
6625                 netlink_deinit(global->netlink);
6626
6627         nl_destroy_handles(&global->nl);
6628
6629         if (global->nl_event)
6630                 nl80211_destroy_eloop_handle(&global->nl_event);
6631
6632         nl_cb_put(global->nl_cb);
6633
6634         if (global->ioctl_sock >= 0)
6635                 close(global->ioctl_sock);
6636
6637         os_free(global);
6638 }
6639
6640
6641 static const char * nl80211_get_radio_name(void *priv)
6642 {
6643         struct i802_bss *bss = priv;
6644         struct wpa_driver_nl80211_data *drv = bss->drv;
6645         return drv->phyname;
6646 }
6647
6648
6649 static int nl80211_pmkid(struct i802_bss *bss, int cmd, const u8 *bssid,
6650                          const u8 *pmkid)
6651 {
6652         struct nl_msg *msg;
6653
6654         if (!(msg = nl80211_bss_msg(bss, 0, cmd)) ||
6655             (pmkid && nla_put(msg, NL80211_ATTR_PMKID, 16, pmkid)) ||
6656             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))) {
6657                 nlmsg_free(msg);
6658                 return -ENOBUFS;
6659         }
6660
6661         return send_and_recv_msgs(bss->drv, msg, NULL, NULL);
6662 }
6663
6664
6665 static int nl80211_add_pmkid(void *priv, const u8 *bssid, const u8 *pmkid)
6666 {
6667         struct i802_bss *bss = priv;
6668         wpa_printf(MSG_DEBUG, "nl80211: Add PMKID for " MACSTR, MAC2STR(bssid));
6669         return nl80211_pmkid(bss, NL80211_CMD_SET_PMKSA, bssid, pmkid);
6670 }
6671
6672
6673 static int nl80211_remove_pmkid(void *priv, const u8 *bssid, const u8 *pmkid)
6674 {
6675         struct i802_bss *bss = priv;
6676         wpa_printf(MSG_DEBUG, "nl80211: Delete PMKID for " MACSTR,
6677                    MAC2STR(bssid));
6678         return nl80211_pmkid(bss, NL80211_CMD_DEL_PMKSA, bssid, pmkid);
6679 }
6680
6681
6682 static int nl80211_flush_pmkid(void *priv)
6683 {
6684         struct i802_bss *bss = priv;
6685         wpa_printf(MSG_DEBUG, "nl80211: Flush PMKIDs");
6686         return nl80211_pmkid(bss, NL80211_CMD_FLUSH_PMKSA, NULL, NULL);
6687 }
6688
6689
6690 static void clean_survey_results(struct survey_results *survey_results)
6691 {
6692         struct freq_survey *survey, *tmp;
6693
6694         if (dl_list_empty(&survey_results->survey_list))
6695                 return;
6696
6697         dl_list_for_each_safe(survey, tmp, &survey_results->survey_list,
6698                               struct freq_survey, list) {
6699                 dl_list_del(&survey->list);
6700                 os_free(survey);
6701         }
6702 }
6703
6704
6705 static void add_survey(struct nlattr **sinfo, u32 ifidx,
6706                        struct dl_list *survey_list)
6707 {
6708         struct freq_survey *survey;
6709
6710         survey = os_zalloc(sizeof(struct freq_survey));
6711         if  (!survey)
6712                 return;
6713
6714         survey->ifidx = ifidx;
6715         survey->freq = nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]);
6716         survey->filled = 0;
6717
6718         if (sinfo[NL80211_SURVEY_INFO_NOISE]) {
6719                 survey->nf = (int8_t)
6720                         nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
6721                 survey->filled |= SURVEY_HAS_NF;
6722         }
6723
6724         if (sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME]) {
6725                 survey->channel_time =
6726                         nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME]);
6727                 survey->filled |= SURVEY_HAS_CHAN_TIME;
6728         }
6729
6730         if (sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY]) {
6731                 survey->channel_time_busy =
6732                         nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY]);
6733                 survey->filled |= SURVEY_HAS_CHAN_TIME_BUSY;
6734         }
6735
6736         if (sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_RX]) {
6737                 survey->channel_time_rx =
6738                         nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_RX]);
6739                 survey->filled |= SURVEY_HAS_CHAN_TIME_RX;
6740         }
6741
6742         if (sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_TX]) {
6743                 survey->channel_time_tx =
6744                         nla_get_u64(sinfo[NL80211_SURVEY_INFO_CHANNEL_TIME_TX]);
6745                 survey->filled |= SURVEY_HAS_CHAN_TIME_TX;
6746         }
6747
6748         wpa_printf(MSG_DEBUG, "nl80211: Freq survey dump event (freq=%d MHz noise=%d channel_time=%ld busy_time=%ld tx_time=%ld rx_time=%ld filled=%04x)",
6749                    survey->freq,
6750                    survey->nf,
6751                    (unsigned long int) survey->channel_time,
6752                    (unsigned long int) survey->channel_time_busy,
6753                    (unsigned long int) survey->channel_time_tx,
6754                    (unsigned long int) survey->channel_time_rx,
6755                    survey->filled);
6756
6757         dl_list_add_tail(survey_list, &survey->list);
6758 }
6759
6760
6761 static int check_survey_ok(struct nlattr **sinfo, u32 surveyed_freq,
6762                            unsigned int freq_filter)
6763 {
6764         if (!freq_filter)
6765                 return 1;
6766
6767         return freq_filter == surveyed_freq;
6768 }
6769
6770
6771 static int survey_handler(struct nl_msg *msg, void *arg)
6772 {
6773         struct nlattr *tb[NL80211_ATTR_MAX + 1];
6774         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
6775         struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
6776         struct survey_results *survey_results;
6777         u32 surveyed_freq = 0;
6778         u32 ifidx;
6779
6780         static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
6781                 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
6782                 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
6783         };
6784
6785         survey_results = (struct survey_results *) arg;
6786
6787         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
6788                   genlmsg_attrlen(gnlh, 0), NULL);
6789
6790         if (!tb[NL80211_ATTR_IFINDEX])
6791                 return NL_SKIP;
6792
6793         ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
6794
6795         if (!tb[NL80211_ATTR_SURVEY_INFO])
6796                 return NL_SKIP;
6797
6798         if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
6799                              tb[NL80211_ATTR_SURVEY_INFO],
6800                              survey_policy))
6801                 return NL_SKIP;
6802
6803         if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY]) {
6804                 wpa_printf(MSG_ERROR, "nl80211: Invalid survey data");
6805                 return NL_SKIP;
6806         }
6807
6808         surveyed_freq = nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]);
6809
6810         if (!check_survey_ok(sinfo, surveyed_freq,
6811                              survey_results->freq_filter))
6812                 return NL_SKIP;
6813
6814         if (survey_results->freq_filter &&
6815             survey_results->freq_filter != surveyed_freq) {
6816                 wpa_printf(MSG_EXCESSIVE, "nl80211: Ignoring survey data for freq %d MHz",
6817                            surveyed_freq);
6818                 return NL_SKIP;
6819         }
6820
6821         add_survey(sinfo, ifidx, &survey_results->survey_list);
6822
6823         return NL_SKIP;
6824 }
6825
6826
6827 static int wpa_driver_nl80211_get_survey(void *priv, unsigned int freq)
6828 {
6829         struct i802_bss *bss = priv;
6830         struct wpa_driver_nl80211_data *drv = bss->drv;
6831         struct nl_msg *msg;
6832         int err;
6833         union wpa_event_data data;
6834         struct survey_results *survey_results;
6835
6836         os_memset(&data, 0, sizeof(data));
6837         survey_results = &data.survey_results;
6838
6839         dl_list_init(&survey_results->survey_list);
6840
6841         msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_GET_SURVEY);
6842         if (!msg)
6843                 return -ENOBUFS;
6844
6845         if (freq)
6846                 data.survey_results.freq_filter = freq;
6847
6848         do {
6849                 wpa_printf(MSG_DEBUG, "nl80211: Fetch survey data");
6850                 err = send_and_recv_msgs(drv, msg, survey_handler,
6851                                          survey_results);
6852         } while (err > 0);
6853
6854         if (err)
6855                 wpa_printf(MSG_ERROR, "nl80211: Failed to process survey data");
6856         else
6857                 wpa_supplicant_event(drv->ctx, EVENT_SURVEY, &data);
6858
6859         clean_survey_results(survey_results);
6860         return err;
6861 }
6862
6863
6864 static void nl80211_set_rekey_info(void *priv, const u8 *kek, size_t kek_len,
6865                                    const u8 *kck, size_t kck_len,
6866                                    const u8 *replay_ctr)
6867 {
6868         struct i802_bss *bss = priv;
6869         struct wpa_driver_nl80211_data *drv = bss->drv;
6870         struct nlattr *replay_nested;
6871         struct nl_msg *msg;
6872         int ret;
6873
6874         if (!drv->set_rekey_offload)
6875                 return;
6876
6877         wpa_printf(MSG_DEBUG, "nl80211: Set rekey offload");
6878         if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_SET_REKEY_OFFLOAD)) ||
6879             !(replay_nested = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA)) ||
6880             nla_put(msg, NL80211_REKEY_DATA_KEK, kek_len, kek) ||
6881             nla_put(msg, NL80211_REKEY_DATA_KCK, kck_len, kck) ||
6882             nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR, NL80211_REPLAY_CTR_LEN,
6883                     replay_ctr)) {
6884                 nl80211_nlmsg_clear(msg);
6885                 nlmsg_free(msg);
6886                 return;
6887         }
6888
6889         nla_nest_end(msg, replay_nested);
6890
6891         ret = send_and_recv_msgs(drv, msg, NULL, (void *) -1);
6892         if (ret == -EOPNOTSUPP) {
6893                 wpa_printf(MSG_DEBUG,
6894                            "nl80211: Driver does not support rekey offload");
6895                 drv->set_rekey_offload = 0;
6896         }
6897 }
6898
6899
6900 static void nl80211_send_null_frame(struct i802_bss *bss, const u8 *own_addr,
6901                                     const u8 *addr, int qos)
6902 {
6903         /* send data frame to poll STA and check whether
6904          * this frame is ACKed */
6905         struct {
6906                 struct ieee80211_hdr hdr;
6907                 u16 qos_ctl;
6908         } STRUCT_PACKED nulldata;
6909         size_t size;
6910
6911         /* Send data frame to poll STA and check whether this frame is ACKed */
6912
6913         os_memset(&nulldata, 0, sizeof(nulldata));
6914
6915         if (qos) {
6916                 nulldata.hdr.frame_control =
6917                         IEEE80211_FC(WLAN_FC_TYPE_DATA,
6918                                      WLAN_FC_STYPE_QOS_NULL);
6919                 size = sizeof(nulldata);
6920         } else {
6921                 nulldata.hdr.frame_control =
6922                         IEEE80211_FC(WLAN_FC_TYPE_DATA,
6923                                      WLAN_FC_STYPE_NULLFUNC);
6924                 size = sizeof(struct ieee80211_hdr);
6925         }
6926
6927         nulldata.hdr.frame_control |= host_to_le16(WLAN_FC_FROMDS);
6928         os_memcpy(nulldata.hdr.IEEE80211_DA_FROMDS, addr, ETH_ALEN);
6929         os_memcpy(nulldata.hdr.IEEE80211_BSSID_FROMDS, own_addr, ETH_ALEN);
6930         os_memcpy(nulldata.hdr.IEEE80211_SA_FROMDS, own_addr, ETH_ALEN);
6931
6932         if (wpa_driver_nl80211_send_mlme(bss, (u8 *) &nulldata, size, 0, 0, 0,
6933                                          0, 0) < 0)
6934                 wpa_printf(MSG_DEBUG, "nl80211_send_null_frame: Failed to "
6935                            "send poll frame");
6936 }
6937
6938 static void nl80211_poll_client(void *priv, const u8 *own_addr, const u8 *addr,
6939                                 int qos)
6940 {
6941         struct i802_bss *bss = priv;
6942         struct wpa_driver_nl80211_data *drv = bss->drv;
6943         struct nl_msg *msg;
6944         int ret;
6945
6946         if (!drv->poll_command_supported) {
6947                 nl80211_send_null_frame(bss, own_addr, addr, qos);
6948                 return;
6949         }
6950
6951         if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_PROBE_CLIENT)) ||
6952             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) {
6953                 nlmsg_free(msg);
6954                 return;
6955         }
6956
6957         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
6958         if (ret < 0) {
6959                 wpa_printf(MSG_DEBUG, "nl80211: Client probe request for "
6960                            MACSTR " failed: ret=%d (%s)",
6961                            MAC2STR(addr), ret, strerror(-ret));
6962         }
6963 }
6964
6965
6966 static int nl80211_set_power_save(struct i802_bss *bss, int enabled)
6967 {
6968         struct nl_msg *msg;
6969
6970         if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_SET_POWER_SAVE)) ||
6971             nla_put_u32(msg, NL80211_ATTR_PS_STATE,
6972                         enabled ? NL80211_PS_ENABLED : NL80211_PS_DISABLED)) {
6973                 nlmsg_free(msg);
6974                 return -ENOBUFS;
6975         }
6976         return send_and_recv_msgs(bss->drv, msg, NULL, NULL);
6977 }
6978
6979
6980 static int nl80211_set_p2p_powersave(void *priv, int legacy_ps, int opp_ps,
6981                                      int ctwindow)
6982 {
6983         struct i802_bss *bss = priv;
6984
6985         wpa_printf(MSG_DEBUG, "nl80211: set_p2p_powersave (legacy_ps=%d "
6986                    "opp_ps=%d ctwindow=%d)", legacy_ps, opp_ps, ctwindow);
6987
6988         if (opp_ps != -1 || ctwindow != -1) {
6989 #ifdef ANDROID_P2P
6990                 wpa_driver_set_p2p_ps(priv, legacy_ps, opp_ps, ctwindow);
6991 #else /* ANDROID_P2P */
6992                 return -1; /* Not yet supported */
6993 #endif /* ANDROID_P2P */
6994         }
6995
6996         if (legacy_ps == -1)
6997                 return 0;
6998         if (legacy_ps != 0 && legacy_ps != 1)
6999                 return -1; /* Not yet supported */
7000
7001         return nl80211_set_power_save(bss, legacy_ps);
7002 }
7003
7004
7005 static int nl80211_start_radar_detection(void *priv,
7006                                          struct hostapd_freq_params *freq)
7007 {
7008         struct i802_bss *bss = priv;
7009         struct wpa_driver_nl80211_data *drv = bss->drv;
7010         struct nl_msg *msg;
7011         int ret;
7012
7013         wpa_printf(MSG_DEBUG, "nl80211: Start radar detection (CAC) %d MHz (ht_enabled=%d, vht_enabled=%d, bandwidth=%d MHz, cf1=%d MHz, cf2=%d MHz)",
7014                    freq->freq, freq->ht_enabled, freq->vht_enabled,
7015                    freq->bandwidth, freq->center_freq1, freq->center_freq2);
7016
7017         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_RADAR)) {
7018                 wpa_printf(MSG_DEBUG, "nl80211: Driver does not support radar "
7019                            "detection");
7020                 return -1;
7021         }
7022
7023         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_RADAR_DETECT)) ||
7024             nl80211_put_freq_params(msg, freq) < 0) {
7025                 nlmsg_free(msg);
7026                 return -1;
7027         }
7028
7029         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7030         if (ret == 0)
7031                 return 0;
7032         wpa_printf(MSG_DEBUG, "nl80211: Failed to start radar detection: "
7033                    "%d (%s)", ret, strerror(-ret));
7034         return -1;
7035 }
7036
7037 #ifdef CONFIG_TDLS
7038
7039 static int nl80211_send_tdls_mgmt(void *priv, const u8 *dst, u8 action_code,
7040                                   u8 dialog_token, u16 status_code,
7041                                   u32 peer_capab, int initiator, const u8 *buf,
7042                                   size_t len)
7043 {
7044         struct i802_bss *bss = priv;
7045         struct wpa_driver_nl80211_data *drv = bss->drv;
7046         struct nl_msg *msg;
7047
7048         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT))
7049                 return -EOPNOTSUPP;
7050
7051         if (!dst)
7052                 return -EINVAL;
7053
7054         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_TDLS_MGMT)) ||
7055             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
7056             nla_put_u8(msg, NL80211_ATTR_TDLS_ACTION, action_code) ||
7057             nla_put_u8(msg, NL80211_ATTR_TDLS_DIALOG_TOKEN, dialog_token) ||
7058             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status_code))
7059                 goto fail;
7060         if (peer_capab) {
7061                 /*
7062                  * The internal enum tdls_peer_capability definition is
7063                  * currently identical with the nl80211 enum
7064                  * nl80211_tdls_peer_capability, so no conversion is needed
7065                  * here.
7066                  */
7067                 if (nla_put_u32(msg, NL80211_ATTR_TDLS_PEER_CAPABILITY,
7068                                 peer_capab))
7069                         goto fail;
7070         }
7071         if ((initiator &&
7072              nla_put_flag(msg, NL80211_ATTR_TDLS_INITIATOR)) ||
7073             nla_put(msg, NL80211_ATTR_IE, len, buf))
7074                 goto fail;
7075
7076         return send_and_recv_msgs(drv, msg, NULL, NULL);
7077
7078 fail:
7079         nlmsg_free(msg);
7080         return -ENOBUFS;
7081 }
7082
7083
7084 static int nl80211_tdls_oper(void *priv, enum tdls_oper oper, const u8 *peer)
7085 {
7086         struct i802_bss *bss = priv;
7087         struct wpa_driver_nl80211_data *drv = bss->drv;
7088         struct nl_msg *msg;
7089         enum nl80211_tdls_operation nl80211_oper;
7090
7091         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT))
7092                 return -EOPNOTSUPP;
7093
7094         switch (oper) {
7095         case TDLS_DISCOVERY_REQ:
7096                 nl80211_oper = NL80211_TDLS_DISCOVERY_REQ;
7097                 break;
7098         case TDLS_SETUP:
7099                 nl80211_oper = NL80211_TDLS_SETUP;
7100                 break;
7101         case TDLS_TEARDOWN:
7102                 nl80211_oper = NL80211_TDLS_TEARDOWN;
7103                 break;
7104         case TDLS_ENABLE_LINK:
7105                 nl80211_oper = NL80211_TDLS_ENABLE_LINK;
7106                 break;
7107         case TDLS_DISABLE_LINK:
7108                 nl80211_oper = NL80211_TDLS_DISABLE_LINK;
7109                 break;
7110         case TDLS_ENABLE:
7111                 return 0;
7112         case TDLS_DISABLE:
7113                 return 0;
7114         default:
7115                 return -EINVAL;
7116         }
7117
7118         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_TDLS_OPER)) ||
7119             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, nl80211_oper) ||
7120             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer)) {
7121                 nlmsg_free(msg);
7122                 return -ENOBUFS;
7123         }
7124
7125         return send_and_recv_msgs(drv, msg, NULL, NULL);
7126 }
7127
7128
7129 static int
7130 nl80211_tdls_enable_channel_switch(void *priv, const u8 *addr, u8 oper_class,
7131                                    const struct hostapd_freq_params *params)
7132 {
7133         struct i802_bss *bss = priv;
7134         struct wpa_driver_nl80211_data *drv = bss->drv;
7135         struct nl_msg *msg;
7136         int ret = -ENOBUFS;
7137
7138         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT) ||
7139             !(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_CHANNEL_SWITCH))
7140                 return -EOPNOTSUPP;
7141
7142         wpa_printf(MSG_DEBUG, "nl80211: Enable TDLS channel switch " MACSTR
7143                    " oper_class=%u freq=%u",
7144                    MAC2STR(addr), oper_class, params->freq);
7145         msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_TDLS_CHANNEL_SWITCH);
7146         if (!msg ||
7147             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
7148             nla_put_u8(msg, NL80211_ATTR_OPER_CLASS, oper_class) ||
7149             (ret = nl80211_put_freq_params(msg, params))) {
7150                 nlmsg_free(msg);
7151                 wpa_printf(MSG_DEBUG, "nl80211: Could not build TDLS chan switch");
7152                 return ret;
7153         }
7154
7155         return send_and_recv_msgs(drv, msg, NULL, NULL);
7156 }
7157
7158
7159 static int
7160 nl80211_tdls_disable_channel_switch(void *priv, const u8 *addr)
7161 {
7162         struct i802_bss *bss = priv;
7163         struct wpa_driver_nl80211_data *drv = bss->drv;
7164         struct nl_msg *msg;
7165
7166         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT) ||
7167             !(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_CHANNEL_SWITCH))
7168                 return -EOPNOTSUPP;
7169
7170         wpa_printf(MSG_DEBUG, "nl80211: Disable TDLS channel switch " MACSTR,
7171                    MAC2STR(addr));
7172         msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH);
7173         if (!msg ||
7174             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) {
7175                 nlmsg_free(msg);
7176                 wpa_printf(MSG_DEBUG,
7177                            "nl80211: Could not build TDLS cancel chan switch");
7178                 return -ENOBUFS;
7179         }
7180
7181         return send_and_recv_msgs(drv, msg, NULL, NULL);
7182 }
7183
7184 #endif /* CONFIG TDLS */
7185
7186
7187 static int driver_nl80211_set_key(const char *ifname, void *priv,
7188                                   enum wpa_alg alg, const u8 *addr,
7189                                   int key_idx, int set_tx,
7190                                   const u8 *seq, size_t seq_len,
7191                                   const u8 *key, size_t key_len)
7192 {
7193         struct i802_bss *bss = priv;
7194         return wpa_driver_nl80211_set_key(ifname, bss, alg, addr, key_idx,
7195                                           set_tx, seq, seq_len, key, key_len);
7196 }
7197
7198
7199 static int driver_nl80211_scan2(void *priv,
7200                                 struct wpa_driver_scan_params *params)
7201 {
7202         struct i802_bss *bss = priv;
7203         return wpa_driver_nl80211_scan(bss, params);
7204 }
7205
7206
7207 static int driver_nl80211_deauthenticate(void *priv, const u8 *addr,
7208                                          int reason_code)
7209 {
7210         struct i802_bss *bss = priv;
7211         return wpa_driver_nl80211_deauthenticate(bss, addr, reason_code);
7212 }
7213
7214
7215 static int driver_nl80211_authenticate(void *priv,
7216                                        struct wpa_driver_auth_params *params)
7217 {
7218         struct i802_bss *bss = priv;
7219         return wpa_driver_nl80211_authenticate(bss, params);
7220 }
7221
7222
7223 static void driver_nl80211_deinit(void *priv)
7224 {
7225         struct i802_bss *bss = priv;
7226         wpa_driver_nl80211_deinit(bss);
7227 }
7228
7229
7230 static int driver_nl80211_if_remove(void *priv, enum wpa_driver_if_type type,
7231                                     const char *ifname)
7232 {
7233         struct i802_bss *bss = priv;
7234         return wpa_driver_nl80211_if_remove(bss, type, ifname);
7235 }
7236
7237
7238 static int driver_nl80211_send_mlme(void *priv, const u8 *data,
7239                                     size_t data_len, int noack)
7240 {
7241         struct i802_bss *bss = priv;
7242         return wpa_driver_nl80211_send_mlme(bss, data, data_len, noack,
7243                                             0, 0, 0, 0);
7244 }
7245
7246
7247 static int driver_nl80211_sta_remove(void *priv, const u8 *addr)
7248 {
7249         struct i802_bss *bss = priv;
7250         return wpa_driver_nl80211_sta_remove(bss, addr, -1, 0);
7251 }
7252
7253
7254 static int driver_nl80211_set_sta_vlan(void *priv, const u8 *addr,
7255                                        const char *ifname, int vlan_id)
7256 {
7257         struct i802_bss *bss = priv;
7258         return i802_set_sta_vlan(bss, addr, ifname, vlan_id);
7259 }
7260
7261
7262 static int driver_nl80211_read_sta_data(void *priv,
7263                                         struct hostap_sta_driver_data *data,
7264                                         const u8 *addr)
7265 {
7266         struct i802_bss *bss = priv;
7267         return i802_read_sta_data(bss, data, addr);
7268 }
7269
7270
7271 static int driver_nl80211_send_action(void *priv, unsigned int freq,
7272                                       unsigned int wait_time,
7273                                       const u8 *dst, const u8 *src,
7274                                       const u8 *bssid,
7275                                       const u8 *data, size_t data_len,
7276                                       int no_cck)
7277 {
7278         struct i802_bss *bss = priv;
7279         return wpa_driver_nl80211_send_action(bss, freq, wait_time, dst, src,
7280                                               bssid, data, data_len, no_cck);
7281 }
7282
7283
7284 static int driver_nl80211_probe_req_report(void *priv, int report)
7285 {
7286         struct i802_bss *bss = priv;
7287         return wpa_driver_nl80211_probe_req_report(bss, report);
7288 }
7289
7290
7291 static int wpa_driver_nl80211_update_ft_ies(void *priv, const u8 *md,
7292                                             const u8 *ies, size_t ies_len)
7293 {
7294         int ret;
7295         struct nl_msg *msg;
7296         struct i802_bss *bss = priv;
7297         struct wpa_driver_nl80211_data *drv = bss->drv;
7298         u16 mdid = WPA_GET_LE16(md);
7299
7300         wpa_printf(MSG_DEBUG, "nl80211: Updating FT IEs");
7301         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_UPDATE_FT_IES)) ||
7302             nla_put(msg, NL80211_ATTR_IE, ies_len, ies) ||
7303             nla_put_u16(msg, NL80211_ATTR_MDID, mdid)) {
7304                 nlmsg_free(msg);
7305                 return -ENOBUFS;
7306         }
7307
7308         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7309         if (ret) {
7310                 wpa_printf(MSG_DEBUG, "nl80211: update_ft_ies failed "
7311                            "err=%d (%s)", ret, strerror(-ret));
7312         }
7313
7314         return ret;
7315 }
7316
7317
7318 const u8 * wpa_driver_nl80211_get_macaddr(void *priv)
7319 {
7320         struct i802_bss *bss = priv;
7321         struct wpa_driver_nl80211_data *drv = bss->drv;
7322
7323         if (drv->nlmode != NL80211_IFTYPE_P2P_DEVICE)
7324                 return NULL;
7325
7326         return bss->addr;
7327 }
7328
7329
7330 static const char * scan_state_str(enum scan_states scan_state)
7331 {
7332         switch (scan_state) {
7333         case NO_SCAN:
7334                 return "NO_SCAN";
7335         case SCAN_REQUESTED:
7336                 return "SCAN_REQUESTED";
7337         case SCAN_STARTED:
7338                 return "SCAN_STARTED";
7339         case SCAN_COMPLETED:
7340                 return "SCAN_COMPLETED";
7341         case SCAN_ABORTED:
7342                 return "SCAN_ABORTED";
7343         case SCHED_SCAN_STARTED:
7344                 return "SCHED_SCAN_STARTED";
7345         case SCHED_SCAN_STOPPED:
7346                 return "SCHED_SCAN_STOPPED";
7347         case SCHED_SCAN_RESULTS:
7348                 return "SCHED_SCAN_RESULTS";
7349         }
7350
7351         return "??";
7352 }
7353
7354
7355 static int wpa_driver_nl80211_status(void *priv, char *buf, size_t buflen)
7356 {
7357         struct i802_bss *bss = priv;
7358         struct wpa_driver_nl80211_data *drv = bss->drv;
7359         int res;
7360         char *pos, *end;
7361
7362         pos = buf;
7363         end = buf + buflen;
7364
7365         res = os_snprintf(pos, end - pos,
7366                           "ifindex=%d\n"
7367                           "ifname=%s\n"
7368                           "brname=%s\n"
7369                           "addr=" MACSTR "\n"
7370                           "freq=%d\n"
7371                           "%s%s%s%s%s",
7372                           bss->ifindex,
7373                           bss->ifname,
7374                           bss->brname,
7375                           MAC2STR(bss->addr),
7376                           bss->freq,
7377                           bss->beacon_set ? "beacon_set=1\n" : "",
7378                           bss->added_if_into_bridge ?
7379                           "added_if_into_bridge=1\n" : "",
7380                           bss->added_bridge ? "added_bridge=1\n" : "",
7381                           bss->in_deinit ? "in_deinit=1\n" : "",
7382                           bss->if_dynamic ? "if_dynamic=1\n" : "");
7383         if (os_snprintf_error(end - pos, res))
7384                 return pos - buf;
7385         pos += res;
7386
7387         if (bss->wdev_id_set) {
7388                 res = os_snprintf(pos, end - pos, "wdev_id=%llu\n",
7389                                   (unsigned long long) bss->wdev_id);
7390                 if (os_snprintf_error(end - pos, res))
7391                         return pos - buf;
7392                 pos += res;
7393         }
7394
7395         res = os_snprintf(pos, end - pos,
7396                           "phyname=%s\n"
7397                           "perm_addr=" MACSTR "\n"
7398                           "drv_ifindex=%d\n"
7399                           "operstate=%d\n"
7400                           "scan_state=%s\n"
7401                           "auth_bssid=" MACSTR "\n"
7402                           "auth_attempt_bssid=" MACSTR "\n"
7403                           "bssid=" MACSTR "\n"
7404                           "prev_bssid=" MACSTR "\n"
7405                           "associated=%d\n"
7406                           "assoc_freq=%u\n"
7407                           "monitor_sock=%d\n"
7408                           "monitor_ifidx=%d\n"
7409                           "monitor_refcount=%d\n"
7410                           "last_mgmt_freq=%u\n"
7411                           "eapol_tx_sock=%d\n"
7412                           "%s%s%s%s%s%s%s%s%s%s%s%s%s",
7413                           drv->phyname,
7414                           MAC2STR(drv->perm_addr),
7415                           drv->ifindex,
7416                           drv->operstate,
7417                           scan_state_str(drv->scan_state),
7418                           MAC2STR(drv->auth_bssid),
7419                           MAC2STR(drv->auth_attempt_bssid),
7420                           MAC2STR(drv->bssid),
7421                           MAC2STR(drv->prev_bssid),
7422                           drv->associated,
7423                           drv->assoc_freq,
7424                           drv->monitor_sock,
7425                           drv->monitor_ifidx,
7426                           drv->monitor_refcount,
7427                           drv->last_mgmt_freq,
7428                           drv->eapol_tx_sock,
7429                           drv->ignore_if_down_event ?
7430                           "ignore_if_down_event=1\n" : "",
7431                           drv->scan_complete_events ?
7432                           "scan_complete_events=1\n" : "",
7433                           drv->disabled_11b_rates ?
7434                           "disabled_11b_rates=1\n" : "",
7435                           drv->pending_remain_on_chan ?
7436                           "pending_remain_on_chan=1\n" : "",
7437                           drv->in_interface_list ? "in_interface_list=1\n" : "",
7438                           drv->device_ap_sme ? "device_ap_sme=1\n" : "",
7439                           drv->poll_command_supported ?
7440                           "poll_command_supported=1\n" : "",
7441                           drv->data_tx_status ? "data_tx_status=1\n" : "",
7442                           drv->scan_for_auth ? "scan_for_auth=1\n" : "",
7443                           drv->retry_auth ? "retry_auth=1\n" : "",
7444                           drv->use_monitor ? "use_monitor=1\n" : "",
7445                           drv->ignore_next_local_disconnect ?
7446                           "ignore_next_local_disconnect=1\n" : "",
7447                           drv->ignore_next_local_deauth ?
7448                           "ignore_next_local_deauth=1\n" : "");
7449         if (os_snprintf_error(end - pos, res))
7450                 return pos - buf;
7451         pos += res;
7452
7453         if (drv->has_capability) {
7454                 res = os_snprintf(pos, end - pos,
7455                                   "capa.key_mgmt=0x%x\n"
7456                                   "capa.enc=0x%x\n"
7457                                   "capa.auth=0x%x\n"
7458                                   "capa.flags=0x%llx\n"
7459                                   "capa.rrm_flags=0x%x\n"
7460                                   "capa.max_scan_ssids=%d\n"
7461                                   "capa.max_sched_scan_ssids=%d\n"
7462                                   "capa.sched_scan_supported=%d\n"
7463                                   "capa.max_match_sets=%d\n"
7464                                   "capa.max_remain_on_chan=%u\n"
7465                                   "capa.max_stations=%u\n"
7466                                   "capa.probe_resp_offloads=0x%x\n"
7467                                   "capa.max_acl_mac_addrs=%u\n"
7468                                   "capa.num_multichan_concurrent=%u\n"
7469                                   "capa.mac_addr_rand_sched_scan_supported=%d\n"
7470                                   "capa.mac_addr_rand_scan_supported=%d\n",
7471                                   drv->capa.key_mgmt,
7472                                   drv->capa.enc,
7473                                   drv->capa.auth,
7474                                   (unsigned long long) drv->capa.flags,
7475                                   drv->capa.rrm_flags,
7476                                   drv->capa.max_scan_ssids,
7477                                   drv->capa.max_sched_scan_ssids,
7478                                   drv->capa.sched_scan_supported,
7479                                   drv->capa.max_match_sets,
7480                                   drv->capa.max_remain_on_chan,
7481                                   drv->capa.max_stations,
7482                                   drv->capa.probe_resp_offloads,
7483                                   drv->capa.max_acl_mac_addrs,
7484                                   drv->capa.num_multichan_concurrent,
7485                                   drv->capa.mac_addr_rand_sched_scan_supported,
7486                                   drv->capa.mac_addr_rand_scan_supported);
7487                 if (os_snprintf_error(end - pos, res))
7488                         return pos - buf;
7489                 pos += res;
7490         }
7491
7492         return pos - buf;
7493 }
7494
7495
7496 static int set_beacon_data(struct nl_msg *msg, struct beacon_data *settings)
7497 {
7498         if ((settings->head &&
7499              nla_put(msg, NL80211_ATTR_BEACON_HEAD,
7500                      settings->head_len, settings->head)) ||
7501             (settings->tail &&
7502              nla_put(msg, NL80211_ATTR_BEACON_TAIL,
7503                      settings->tail_len, settings->tail)) ||
7504             (settings->beacon_ies &&
7505              nla_put(msg, NL80211_ATTR_IE,
7506                      settings->beacon_ies_len, settings->beacon_ies)) ||
7507             (settings->proberesp_ies &&
7508              nla_put(msg, NL80211_ATTR_IE_PROBE_RESP,
7509                      settings->proberesp_ies_len, settings->proberesp_ies)) ||
7510             (settings->assocresp_ies &&
7511              nla_put(msg, NL80211_ATTR_IE_ASSOC_RESP,
7512                      settings->assocresp_ies_len, settings->assocresp_ies)) ||
7513             (settings->probe_resp &&
7514              nla_put(msg, NL80211_ATTR_PROBE_RESP,
7515                      settings->probe_resp_len, settings->probe_resp)))
7516                 return -ENOBUFS;
7517
7518         return 0;
7519 }
7520
7521
7522 static int nl80211_switch_channel(void *priv, struct csa_settings *settings)
7523 {
7524         struct nl_msg *msg;
7525         struct i802_bss *bss = priv;
7526         struct wpa_driver_nl80211_data *drv = bss->drv;
7527         struct nlattr *beacon_csa;
7528         int ret = -ENOBUFS;
7529
7530         wpa_printf(MSG_DEBUG, "nl80211: Channel switch request (cs_count=%u block_tx=%u freq=%d width=%d cf1=%d cf2=%d)",
7531                    settings->cs_count, settings->block_tx,
7532                    settings->freq_params.freq, settings->freq_params.bandwidth,
7533                    settings->freq_params.center_freq1,
7534                    settings->freq_params.center_freq2);
7535
7536         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_AP_CSA)) {
7537                 wpa_printf(MSG_DEBUG, "nl80211: Driver does not support channel switch command");
7538                 return -EOPNOTSUPP;
7539         }
7540
7541         if ((drv->nlmode != NL80211_IFTYPE_AP) &&
7542             (drv->nlmode != NL80211_IFTYPE_P2P_GO))
7543                 return -EOPNOTSUPP;
7544
7545         /* check settings validity */
7546         if (!settings->beacon_csa.tail ||
7547             ((settings->beacon_csa.tail_len <=
7548               settings->counter_offset_beacon) ||
7549              (settings->beacon_csa.tail[settings->counter_offset_beacon] !=
7550               settings->cs_count)))
7551                 return -EINVAL;
7552
7553         if (settings->beacon_csa.probe_resp &&
7554             ((settings->beacon_csa.probe_resp_len <=
7555               settings->counter_offset_presp) ||
7556              (settings->beacon_csa.probe_resp[settings->counter_offset_presp] !=
7557               settings->cs_count)))
7558                 return -EINVAL;
7559
7560         if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_CHANNEL_SWITCH)) ||
7561             nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT,
7562                         settings->cs_count) ||
7563             (ret = nl80211_put_freq_params(msg, &settings->freq_params)) ||
7564             (settings->block_tx &&
7565              nla_put_flag(msg, NL80211_ATTR_CH_SWITCH_BLOCK_TX)))
7566                 goto error;
7567
7568         /* beacon_after params */
7569         ret = set_beacon_data(msg, &settings->beacon_after);
7570         if (ret)
7571                 goto error;
7572
7573         /* beacon_csa params */
7574         beacon_csa = nla_nest_start(msg, NL80211_ATTR_CSA_IES);
7575         if (!beacon_csa)
7576                 goto fail;
7577
7578         ret = set_beacon_data(msg, &settings->beacon_csa);
7579         if (ret)
7580                 goto error;
7581
7582         if (nla_put_u16(msg, NL80211_ATTR_CSA_C_OFF_BEACON,
7583                         settings->counter_offset_beacon) ||
7584             (settings->beacon_csa.probe_resp &&
7585              nla_put_u16(msg, NL80211_ATTR_CSA_C_OFF_PRESP,
7586                          settings->counter_offset_presp)))
7587                 goto fail;
7588
7589         nla_nest_end(msg, beacon_csa);
7590         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7591         if (ret) {
7592                 wpa_printf(MSG_DEBUG, "nl80211: switch_channel failed err=%d (%s)",
7593                            ret, strerror(-ret));
7594         }
7595         return ret;
7596
7597 fail:
7598         ret = -ENOBUFS;
7599 error:
7600         nlmsg_free(msg);
7601         wpa_printf(MSG_DEBUG, "nl80211: Could not build channel switch request");
7602         return ret;
7603 }
7604
7605
7606 static int nl80211_add_ts(void *priv, u8 tsid, const u8 *addr,
7607                           u8 user_priority, u16 admitted_time)
7608 {
7609         struct i802_bss *bss = priv;
7610         struct wpa_driver_nl80211_data *drv = bss->drv;
7611         struct nl_msg *msg;
7612         int ret;
7613
7614         wpa_printf(MSG_DEBUG,
7615                    "nl80211: add_ts request: tsid=%u admitted_time=%u up=%d",
7616                    tsid, admitted_time, user_priority);
7617
7618         if (!is_sta_interface(drv->nlmode))
7619                 return -ENOTSUP;
7620
7621         msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_ADD_TX_TS);
7622         if (!msg ||
7623             nla_put_u8(msg, NL80211_ATTR_TSID, tsid) ||
7624             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
7625             nla_put_u8(msg, NL80211_ATTR_USER_PRIO, user_priority) ||
7626             nla_put_u16(msg, NL80211_ATTR_ADMITTED_TIME, admitted_time)) {
7627                 nlmsg_free(msg);
7628                 return -ENOBUFS;
7629         }
7630
7631         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7632         if (ret)
7633                 wpa_printf(MSG_DEBUG, "nl80211: add_ts failed err=%d (%s)",
7634                            ret, strerror(-ret));
7635         return ret;
7636 }
7637
7638
7639 static int nl80211_del_ts(void *priv, u8 tsid, const u8 *addr)
7640 {
7641         struct i802_bss *bss = priv;
7642         struct wpa_driver_nl80211_data *drv = bss->drv;
7643         struct nl_msg *msg;
7644         int ret;
7645
7646         wpa_printf(MSG_DEBUG, "nl80211: del_ts request: tsid=%u", tsid);
7647
7648         if (!is_sta_interface(drv->nlmode))
7649                 return -ENOTSUP;
7650
7651         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_DEL_TX_TS)) ||
7652             nla_put_u8(msg, NL80211_ATTR_TSID, tsid) ||
7653             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) {
7654                 nlmsg_free(msg);
7655                 return -ENOBUFS;
7656         }
7657
7658         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7659         if (ret)
7660                 wpa_printf(MSG_DEBUG, "nl80211: del_ts failed err=%d (%s)",
7661                            ret, strerror(-ret));
7662         return ret;
7663 }
7664
7665
7666 #ifdef CONFIG_TESTING_OPTIONS
7667 static int cmd_reply_handler(struct nl_msg *msg, void *arg)
7668 {
7669         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
7670         struct wpabuf *buf = arg;
7671
7672         if (!buf)
7673                 return NL_SKIP;
7674
7675         if ((size_t) genlmsg_attrlen(gnlh, 0) > wpabuf_tailroom(buf)) {
7676                 wpa_printf(MSG_INFO, "nl80211: insufficient buffer space for reply");
7677                 return NL_SKIP;
7678         }
7679
7680         wpabuf_put_data(buf, genlmsg_attrdata(gnlh, 0),
7681                         genlmsg_attrlen(gnlh, 0));
7682
7683         return NL_SKIP;
7684 }
7685 #endif /* CONFIG_TESTING_OPTIONS */
7686
7687
7688 static int vendor_reply_handler(struct nl_msg *msg, void *arg)
7689 {
7690         struct nlattr *tb[NL80211_ATTR_MAX + 1];
7691         struct nlattr *nl_vendor_reply, *nl;
7692         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
7693         struct wpabuf *buf = arg;
7694         int rem;
7695
7696         if (!buf)
7697                 return NL_SKIP;
7698
7699         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
7700                   genlmsg_attrlen(gnlh, 0), NULL);
7701         nl_vendor_reply = tb[NL80211_ATTR_VENDOR_DATA];
7702
7703         if (!nl_vendor_reply)
7704                 return NL_SKIP;
7705
7706         if ((size_t) nla_len(nl_vendor_reply) > wpabuf_tailroom(buf)) {
7707                 wpa_printf(MSG_INFO, "nl80211: Vendor command: insufficient buffer space for reply");
7708                 return NL_SKIP;
7709         }
7710
7711         nla_for_each_nested(nl, nl_vendor_reply, rem) {
7712                 wpabuf_put_data(buf, nla_data(nl), nla_len(nl));
7713         }
7714
7715         return NL_SKIP;
7716 }
7717
7718
7719 static int nl80211_vendor_cmd(void *priv, unsigned int vendor_id,
7720                               unsigned int subcmd, const u8 *data,
7721                               size_t data_len, struct wpabuf *buf)
7722 {
7723         struct i802_bss *bss = priv;
7724         struct wpa_driver_nl80211_data *drv = bss->drv;
7725         struct nl_msg *msg;
7726         int ret;
7727
7728 #ifdef CONFIG_TESTING_OPTIONS
7729         if (vendor_id == 0xffffffff) {
7730                 msg = nlmsg_alloc();
7731                 if (!msg)
7732                         return -ENOMEM;
7733
7734                 nl80211_cmd(drv, msg, 0, subcmd);
7735                 if (nlmsg_append(msg, (void *) data, data_len, NLMSG_ALIGNTO) <
7736                     0)
7737                         goto fail;
7738                 ret = send_and_recv_msgs(drv, msg, cmd_reply_handler, buf);
7739                 if (ret)
7740                         wpa_printf(MSG_DEBUG, "nl80211: command failed err=%d",
7741                                    ret);
7742                 return ret;
7743         }
7744 #endif /* CONFIG_TESTING_OPTIONS */
7745
7746         if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_VENDOR)) ||
7747             nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, vendor_id) ||
7748             nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, subcmd) ||
7749             (data &&
7750              nla_put(msg, NL80211_ATTR_VENDOR_DATA, data_len, data)))
7751                 goto fail;
7752
7753         ret = send_and_recv_msgs(drv, msg, vendor_reply_handler, buf);
7754         if (ret)
7755                 wpa_printf(MSG_DEBUG, "nl80211: vendor command failed err=%d",
7756                            ret);
7757         return ret;
7758
7759 fail:
7760         nlmsg_free(msg);
7761         return -ENOBUFS;
7762 }
7763
7764
7765 static int nl80211_set_qos_map(void *priv, const u8 *qos_map_set,
7766                                u8 qos_map_set_len)
7767 {
7768         struct i802_bss *bss = priv;
7769         struct wpa_driver_nl80211_data *drv = bss->drv;
7770         struct nl_msg *msg;
7771         int ret;
7772
7773         wpa_hexdump(MSG_DEBUG, "nl80211: Setting QoS Map",
7774                     qos_map_set, qos_map_set_len);
7775
7776         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_SET_QOS_MAP)) ||
7777             nla_put(msg, NL80211_ATTR_QOS_MAP, qos_map_set_len, qos_map_set)) {
7778                 nlmsg_free(msg);
7779                 return -ENOBUFS;
7780         }
7781
7782         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7783         if (ret)
7784                 wpa_printf(MSG_DEBUG, "nl80211: Setting QoS Map failed");
7785
7786         return ret;
7787 }
7788
7789
7790 static int nl80211_set_wowlan(void *priv,
7791                               const struct wowlan_triggers *triggers)
7792 {
7793         struct i802_bss *bss = priv;
7794         struct wpa_driver_nl80211_data *drv = bss->drv;
7795         struct nl_msg *msg;
7796         struct nlattr *wowlan_triggers;
7797         int ret;
7798
7799         wpa_printf(MSG_DEBUG, "nl80211: Setting wowlan");
7800
7801         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_SET_WOWLAN)) ||
7802             !(wowlan_triggers = nla_nest_start(msg,
7803                                                NL80211_ATTR_WOWLAN_TRIGGERS)) ||
7804             (triggers->any &&
7805              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
7806             (triggers->disconnect &&
7807              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
7808             (triggers->magic_pkt &&
7809              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
7810             (triggers->gtk_rekey_failure &&
7811              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
7812             (triggers->eap_identity_req &&
7813              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
7814             (triggers->four_way_handshake &&
7815              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
7816             (triggers->rfkill_release &&
7817              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))) {
7818                 nlmsg_free(msg);
7819                 return -ENOBUFS;
7820         }
7821
7822         nla_nest_end(msg, wowlan_triggers);
7823
7824         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7825         if (ret)
7826                 wpa_printf(MSG_DEBUG, "nl80211: Setting wowlan failed");
7827
7828         return ret;
7829 }
7830
7831
7832 static int nl80211_roaming(void *priv, int allowed, const u8 *bssid)
7833 {
7834         struct i802_bss *bss = priv;
7835         struct wpa_driver_nl80211_data *drv = bss->drv;
7836         struct nl_msg *msg;
7837         struct nlattr *params;
7838
7839         wpa_printf(MSG_DEBUG, "nl80211: Roaming policy: allowed=%d", allowed);
7840
7841         if (!drv->roaming_vendor_cmd_avail) {
7842                 wpa_printf(MSG_DEBUG,
7843                            "nl80211: Ignore roaming policy change since driver does not provide command for setting it");
7844                 return -1;
7845         }
7846
7847         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
7848             nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
7849             nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
7850                         QCA_NL80211_VENDOR_SUBCMD_ROAMING) ||
7851             !(params = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
7852             nla_put_u32(msg, QCA_WLAN_VENDOR_ATTR_ROAMING_POLICY,
7853                         allowed ? QCA_ROAMING_ALLOWED_WITHIN_ESS :
7854                         QCA_ROAMING_NOT_ALLOWED) ||
7855             (bssid &&
7856              nla_put(msg, QCA_WLAN_VENDOR_ATTR_MAC_ADDR, ETH_ALEN, bssid))) {
7857                 nlmsg_free(msg);
7858                 return -1;
7859         }
7860         nla_nest_end(msg, params);
7861
7862         return send_and_recv_msgs(drv, msg, NULL, NULL);
7863 }
7864
7865
7866 static int nl80211_set_mac_addr(void *priv, const u8 *addr)
7867 {
7868         struct i802_bss *bss = priv;
7869         struct wpa_driver_nl80211_data *drv = bss->drv;
7870         int new_addr = addr != NULL;
7871
7872         if (!addr)
7873                 addr = drv->perm_addr;
7874
7875         if (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 0) < 0)
7876                 return -1;
7877
7878         if (linux_set_ifhwaddr(drv->global->ioctl_sock, bss->ifname, addr) < 0)
7879         {
7880                 wpa_printf(MSG_DEBUG,
7881                            "nl80211: failed to set_mac_addr for %s to " MACSTR,
7882                            bss->ifname, MAC2STR(addr));
7883                 if (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname,
7884                                           1) < 0) {
7885                         wpa_printf(MSG_DEBUG,
7886                                    "nl80211: Could not restore interface UP after failed set_mac_addr");
7887                 }
7888                 return -1;
7889         }
7890
7891         wpa_printf(MSG_DEBUG, "nl80211: set_mac_addr for %s to " MACSTR,
7892                    bss->ifname, MAC2STR(addr));
7893         drv->addr_changed = new_addr;
7894         os_memcpy(bss->addr, addr, ETH_ALEN);
7895
7896         if (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 1) < 0)
7897         {
7898                 wpa_printf(MSG_DEBUG,
7899                            "nl80211: Could not restore interface UP after set_mac_addr");
7900         }
7901
7902         return 0;
7903 }
7904
7905
7906 #ifdef CONFIG_MESH
7907
7908 static int wpa_driver_nl80211_init_mesh(void *priv)
7909 {
7910         if (wpa_driver_nl80211_set_mode(priv, NL80211_IFTYPE_MESH_POINT)) {
7911                 wpa_printf(MSG_INFO,
7912                            "nl80211: Failed to set interface into mesh mode");
7913                 return -1;
7914         }
7915         return 0;
7916 }
7917
7918
7919 static int nl80211_put_mesh_id(struct nl_msg *msg, const u8 *mesh_id,
7920                                size_t mesh_id_len)
7921 {
7922         if (mesh_id) {
7923                 wpa_hexdump_ascii(MSG_DEBUG, "  * Mesh ID (SSID)",
7924                                   mesh_id, mesh_id_len);
7925                 return nla_put(msg, NL80211_ATTR_MESH_ID, mesh_id_len, mesh_id);
7926         }
7927
7928         return 0;
7929 }
7930
7931
7932 static int nl80211_join_mesh(struct i802_bss *bss,
7933                              struct wpa_driver_mesh_join_params *params)
7934 {
7935         struct wpa_driver_nl80211_data *drv = bss->drv;
7936         struct nl_msg *msg;
7937         struct nlattr *container;
7938         int ret = -1;
7939
7940         wpa_printf(MSG_DEBUG, "nl80211: mesh join (ifindex=%d)", drv->ifindex);
7941         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_JOIN_MESH);
7942         if (!msg ||
7943             nl80211_put_freq_params(msg, &params->freq) ||
7944             nl80211_put_basic_rates(msg, params->basic_rates) ||
7945             nl80211_put_mesh_id(msg, params->meshid, params->meshid_len) ||
7946             nl80211_put_beacon_int(msg, params->beacon_int))
7947                 goto fail;
7948
7949         wpa_printf(MSG_DEBUG, "  * flags=%08X", params->flags);
7950
7951         container = nla_nest_start(msg, NL80211_ATTR_MESH_SETUP);
7952         if (!container)
7953                 goto fail;
7954
7955         if (params->ies) {
7956                 wpa_hexdump(MSG_DEBUG, "  * IEs", params->ies, params->ie_len);
7957                 if (nla_put(msg, NL80211_MESH_SETUP_IE, params->ie_len,
7958                             params->ies))
7959                         goto fail;
7960         }
7961         /* WPA_DRIVER_MESH_FLAG_OPEN_AUTH is treated as default by nl80211 */
7962         if (params->flags & WPA_DRIVER_MESH_FLAG_SAE_AUTH) {
7963                 if (nla_put_u8(msg, NL80211_MESH_SETUP_AUTH_PROTOCOL, 0x1) ||
7964                     nla_put_flag(msg, NL80211_MESH_SETUP_USERSPACE_AUTH))
7965                         goto fail;
7966         }
7967         if ((params->flags & WPA_DRIVER_MESH_FLAG_AMPE) &&
7968             nla_put_flag(msg, NL80211_MESH_SETUP_USERSPACE_AMPE))
7969                 goto fail;
7970         if ((params->flags & WPA_DRIVER_MESH_FLAG_USER_MPM) &&
7971             nla_put_flag(msg, NL80211_MESH_SETUP_USERSPACE_MPM))
7972                 goto fail;
7973         nla_nest_end(msg, container);
7974
7975         container = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
7976         if (!container)
7977                 goto fail;
7978
7979         if (!(params->conf.flags & WPA_DRIVER_MESH_CONF_FLAG_AUTO_PLINKS) &&
7980             nla_put_u32(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS, 0))
7981                 goto fail;
7982         if ((params->conf.flags & WPA_DRIVER_MESH_FLAG_DRIVER_MPM) &&
7983             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
7984                         params->max_peer_links))
7985                 goto fail;
7986
7987         /*
7988          * Set NL80211_MESHCONF_PLINK_TIMEOUT even if user mpm is used because
7989          * the timer could disconnect stations even in that case.
7990          */
7991         if (nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
7992                         params->conf.peer_link_timeout)) {
7993                 wpa_printf(MSG_ERROR, "nl80211: Failed to set PLINK_TIMEOUT");
7994                 goto fail;
7995         }
7996
7997         nla_nest_end(msg, container);
7998
7999         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8000         msg = NULL;
8001         if (ret) {
8002                 wpa_printf(MSG_DEBUG, "nl80211: mesh join failed: ret=%d (%s)",
8003                            ret, strerror(-ret));
8004                 goto fail;
8005         }
8006         ret = 0;
8007         bss->freq = params->freq.freq;
8008         wpa_printf(MSG_DEBUG, "nl80211: mesh join request send successfully");
8009
8010 fail:
8011         nlmsg_free(msg);
8012         return ret;
8013 }
8014
8015
8016 static int
8017 wpa_driver_nl80211_join_mesh(void *priv,
8018                              struct wpa_driver_mesh_join_params *params)
8019 {
8020         struct i802_bss *bss = priv;
8021         int ret, timeout;
8022
8023         timeout = params->conf.peer_link_timeout;
8024
8025         /* Disable kernel inactivity timer */
8026         if (params->flags & WPA_DRIVER_MESH_FLAG_USER_MPM)
8027                 params->conf.peer_link_timeout = 0;
8028
8029         ret = nl80211_join_mesh(bss, params);
8030         if (ret == -EINVAL && params->conf.peer_link_timeout == 0) {
8031                 wpa_printf(MSG_DEBUG,
8032                            "nl80211: Mesh join retry for peer_link_timeout");
8033                 /*
8034                  * Old kernel does not support setting
8035                  * NL80211_MESHCONF_PLINK_TIMEOUT to zero, so set 60 seconds
8036                  * into future from peer_link_timeout.
8037                  */
8038                 params->conf.peer_link_timeout = timeout + 60;
8039                 ret = nl80211_join_mesh(priv, params);
8040         }
8041
8042         params->conf.peer_link_timeout = timeout;
8043         return ret;
8044 }
8045
8046
8047 static int wpa_driver_nl80211_leave_mesh(void *priv)
8048 {
8049         struct i802_bss *bss = priv;
8050         struct wpa_driver_nl80211_data *drv = bss->drv;
8051         struct nl_msg *msg;
8052         int ret;
8053
8054         wpa_printf(MSG_DEBUG, "nl80211: mesh leave (ifindex=%d)", drv->ifindex);
8055         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_LEAVE_MESH);
8056         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8057         if (ret) {
8058                 wpa_printf(MSG_DEBUG, "nl80211: mesh leave failed: ret=%d (%s)",
8059                            ret, strerror(-ret));
8060         } else {
8061                 wpa_printf(MSG_DEBUG,
8062                            "nl80211: mesh leave request send successfully");
8063         }
8064
8065         if (wpa_driver_nl80211_set_mode(drv->first_bss,
8066                                         NL80211_IFTYPE_STATION)) {
8067                 wpa_printf(MSG_INFO,
8068                            "nl80211: Failed to set interface into station mode");
8069         }
8070         return ret;
8071 }
8072
8073 #endif /* CONFIG_MESH */
8074
8075
8076 static int wpa_driver_br_add_ip_neigh(void *priv, u8 version,
8077                                       const u8 *ipaddr, int prefixlen,
8078                                       const u8 *addr)
8079 {
8080 #ifdef CONFIG_LIBNL3_ROUTE
8081         struct i802_bss *bss = priv;
8082         struct wpa_driver_nl80211_data *drv = bss->drv;
8083         struct rtnl_neigh *rn;
8084         struct nl_addr *nl_ipaddr = NULL;
8085         struct nl_addr *nl_lladdr = NULL;
8086         int family, addrsize;
8087         int res;
8088
8089         if (!ipaddr || prefixlen == 0 || !addr)
8090                 return -EINVAL;
8091
8092         if (bss->br_ifindex == 0) {
8093                 wpa_printf(MSG_DEBUG,
8094                            "nl80211: bridge must be set before adding an ip neigh to it");
8095                 return -1;
8096         }
8097
8098         if (!drv->rtnl_sk) {
8099                 wpa_printf(MSG_DEBUG,
8100                            "nl80211: nl_sock for NETLINK_ROUTE is not initialized");
8101                 return -1;
8102         }
8103
8104         if (version == 4) {
8105                 family = AF_INET;
8106                 addrsize = 4;
8107         } else if (version == 6) {
8108                 family = AF_INET6;
8109                 addrsize = 16;
8110         } else {
8111                 return -EINVAL;
8112         }
8113
8114         rn = rtnl_neigh_alloc();
8115         if (rn == NULL)
8116                 return -ENOMEM;
8117
8118         /* set the destination ip address for neigh */
8119         nl_ipaddr = nl_addr_build(family, (void *) ipaddr, addrsize);
8120         if (nl_ipaddr == NULL) {
8121                 wpa_printf(MSG_DEBUG, "nl80211: nl_ipaddr build failed");
8122                 res = -ENOMEM;
8123                 goto errout;
8124         }
8125         nl_addr_set_prefixlen(nl_ipaddr, prefixlen);
8126         res = rtnl_neigh_set_dst(rn, nl_ipaddr);
8127         if (res) {
8128                 wpa_printf(MSG_DEBUG,
8129                            "nl80211: neigh set destination addr failed");
8130                 goto errout;
8131         }
8132
8133         /* set the corresponding lladdr for neigh */
8134         nl_lladdr = nl_addr_build(AF_BRIDGE, (u8 *) addr, ETH_ALEN);
8135         if (nl_lladdr == NULL) {
8136                 wpa_printf(MSG_DEBUG, "nl80211: neigh set lladdr failed");
8137                 res = -ENOMEM;
8138                 goto errout;
8139         }
8140         rtnl_neigh_set_lladdr(rn, nl_lladdr);
8141
8142         rtnl_neigh_set_ifindex(rn, bss->br_ifindex);
8143         rtnl_neigh_set_state(rn, NUD_PERMANENT);
8144
8145         res = rtnl_neigh_add(drv->rtnl_sk, rn, NLM_F_CREATE);
8146         if (res) {
8147                 wpa_printf(MSG_DEBUG,
8148                            "nl80211: Adding bridge ip neigh failed: %s",
8149                            strerror(errno));
8150         }
8151 errout:
8152         if (nl_lladdr)
8153                 nl_addr_put(nl_lladdr);
8154         if (nl_ipaddr)
8155                 nl_addr_put(nl_ipaddr);
8156         if (rn)
8157                 rtnl_neigh_put(rn);
8158         return res;
8159 #else /* CONFIG_LIBNL3_ROUTE */
8160         return -1;
8161 #endif /* CONFIG_LIBNL3_ROUTE */
8162 }
8163
8164
8165 static int wpa_driver_br_delete_ip_neigh(void *priv, u8 version,
8166                                          const u8 *ipaddr)
8167 {
8168 #ifdef CONFIG_LIBNL3_ROUTE
8169         struct i802_bss *bss = priv;
8170         struct wpa_driver_nl80211_data *drv = bss->drv;
8171         struct rtnl_neigh *rn;
8172         struct nl_addr *nl_ipaddr;
8173         int family, addrsize;
8174         int res;
8175
8176         if (!ipaddr)
8177                 return -EINVAL;
8178
8179         if (version == 4) {
8180                 family = AF_INET;
8181                 addrsize = 4;
8182         } else if (version == 6) {
8183                 family = AF_INET6;
8184                 addrsize = 16;
8185         } else {
8186                 return -EINVAL;
8187         }
8188
8189         if (bss->br_ifindex == 0) {
8190                 wpa_printf(MSG_DEBUG,
8191                            "nl80211: bridge must be set to delete an ip neigh");
8192                 return -1;
8193         }
8194
8195         if (!drv->rtnl_sk) {
8196                 wpa_printf(MSG_DEBUG,
8197                            "nl80211: nl_sock for NETLINK_ROUTE is not initialized");
8198                 return -1;
8199         }
8200
8201         rn = rtnl_neigh_alloc();
8202         if (rn == NULL)
8203                 return -ENOMEM;
8204
8205         /* set the destination ip address for neigh */
8206         nl_ipaddr = nl_addr_build(family, (void *) ipaddr, addrsize);
8207         if (nl_ipaddr == NULL) {
8208                 wpa_printf(MSG_DEBUG, "nl80211: nl_ipaddr build failed");
8209                 res = -ENOMEM;
8210                 goto errout;
8211         }
8212         res = rtnl_neigh_set_dst(rn, nl_ipaddr);
8213         if (res) {
8214                 wpa_printf(MSG_DEBUG,
8215                            "nl80211: neigh set destination addr failed");
8216                 goto errout;
8217         }
8218
8219         rtnl_neigh_set_ifindex(rn, bss->br_ifindex);
8220
8221         res = rtnl_neigh_delete(drv->rtnl_sk, rn, 0);
8222         if (res) {
8223                 wpa_printf(MSG_DEBUG,
8224                            "nl80211: Deleting bridge ip neigh failed: %s",
8225                            strerror(errno));
8226         }
8227 errout:
8228         if (nl_ipaddr)
8229                 nl_addr_put(nl_ipaddr);
8230         if (rn)
8231                 rtnl_neigh_put(rn);
8232         return res;
8233 #else /* CONFIG_LIBNL3_ROUTE */
8234         return -1;
8235 #endif /* CONFIG_LIBNL3_ROUTE */
8236 }
8237
8238
8239 static int linux_write_system_file(const char *path, unsigned int val)
8240 {
8241         char buf[50];
8242         int fd, len;
8243
8244         len = os_snprintf(buf, sizeof(buf), "%u\n", val);
8245         if (os_snprintf_error(sizeof(buf), len))
8246                 return -1;
8247
8248         fd = open(path, O_WRONLY);
8249         if (fd < 0)
8250                 return -1;
8251
8252         if (write(fd, buf, len) < 0) {
8253                 wpa_printf(MSG_DEBUG,
8254                            "nl80211: Failed to write Linux system file: %s with the value of %d",
8255                            path, val);
8256                 close(fd);
8257                 return -1;
8258         }
8259         close(fd);
8260
8261         return 0;
8262 }
8263
8264
8265 static const char * drv_br_port_attr_str(enum drv_br_port_attr attr)
8266 {
8267         switch (attr) {
8268         case DRV_BR_PORT_ATTR_PROXYARP:
8269                 return "proxyarp_wifi";
8270         case DRV_BR_PORT_ATTR_HAIRPIN_MODE:
8271                 return "hairpin_mode";
8272         }
8273
8274         return NULL;
8275 }
8276
8277
8278 static int wpa_driver_br_port_set_attr(void *priv, enum drv_br_port_attr attr,
8279                                        unsigned int val)
8280 {
8281         struct i802_bss *bss = priv;
8282         char path[128];
8283         const char *attr_txt;
8284
8285         attr_txt = drv_br_port_attr_str(attr);
8286         if (attr_txt == NULL)
8287                 return -EINVAL;
8288
8289         os_snprintf(path, sizeof(path), "/sys/class/net/%s/brport/%s",
8290                     bss->ifname, attr_txt);
8291
8292         if (linux_write_system_file(path, val))
8293                 return -1;
8294
8295         return 0;
8296 }
8297
8298
8299 static const char * drv_br_net_param_str(enum drv_br_net_param param)
8300 {
8301         switch (param) {
8302         case DRV_BR_NET_PARAM_GARP_ACCEPT:
8303                 return "arp_accept";
8304         default:
8305                 return NULL;
8306         }
8307 }
8308
8309
8310 static int wpa_driver_br_set_net_param(void *priv, enum drv_br_net_param param,
8311                                        unsigned int val)
8312 {
8313         struct i802_bss *bss = priv;
8314         char path[128];
8315         const char *param_txt;
8316         int ip_version = 4;
8317
8318         if (param == DRV_BR_MULTICAST_SNOOPING) {
8319                 os_snprintf(path, sizeof(path),
8320                             "/sys/devices/virtual/net/%s/bridge/multicast_snooping",
8321                             bss->brname);
8322                 goto set_val;
8323         }
8324
8325         param_txt = drv_br_net_param_str(param);
8326         if (param_txt == NULL)
8327                 return -EINVAL;
8328
8329         switch (param) {
8330                 case DRV_BR_NET_PARAM_GARP_ACCEPT:
8331                         ip_version = 4;
8332                         break;
8333                 default:
8334                         return -EINVAL;
8335         }
8336
8337         os_snprintf(path, sizeof(path), "/proc/sys/net/ipv%d/conf/%s/%s",
8338                     ip_version, bss->brname, param_txt);
8339
8340 set_val:
8341         if (linux_write_system_file(path, val))
8342                 return -1;
8343
8344         return 0;
8345 }
8346
8347
8348 static int hw_mode_to_qca_acs(enum hostapd_hw_mode hw_mode)
8349 {
8350         switch (hw_mode) {
8351         case HOSTAPD_MODE_IEEE80211B:
8352                 return QCA_ACS_MODE_IEEE80211B;
8353         case HOSTAPD_MODE_IEEE80211G:
8354                 return QCA_ACS_MODE_IEEE80211G;
8355         case HOSTAPD_MODE_IEEE80211A:
8356                 return QCA_ACS_MODE_IEEE80211A;
8357         case HOSTAPD_MODE_IEEE80211AD:
8358                 return QCA_ACS_MODE_IEEE80211AD;
8359         default:
8360                 return -1;
8361         }
8362 }
8363
8364
8365 static int wpa_driver_do_acs(void *priv, struct drv_acs_params *params)
8366 {
8367         struct i802_bss *bss = priv;
8368         struct wpa_driver_nl80211_data *drv = bss->drv;
8369         struct nl_msg *msg;
8370         struct nlattr *data;
8371         int ret;
8372         int mode;
8373
8374         mode = hw_mode_to_qca_acs(params->hw_mode);
8375         if (mode < 0)
8376                 return -1;
8377
8378         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
8379             nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
8380             nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
8381                         QCA_NL80211_VENDOR_SUBCMD_DO_ACS) ||
8382             !(data = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
8383             nla_put_u8(msg, QCA_WLAN_VENDOR_ATTR_ACS_HW_MODE, mode) ||
8384             (params->ht_enabled &&
8385              nla_put_flag(msg, QCA_WLAN_VENDOR_ATTR_ACS_HT_ENABLED)) ||
8386             (params->ht40_enabled &&
8387              nla_put_flag(msg, QCA_WLAN_VENDOR_ATTR_ACS_HT40_ENABLED)) ||
8388             (params->vht_enabled &&
8389              nla_put_flag(msg, QCA_WLAN_VENDOR_ATTR_ACS_VHT_ENABLED)) ||
8390             nla_put_u16(msg, QCA_WLAN_VENDOR_ATTR_ACS_CHWIDTH,
8391                         params->ch_width) ||
8392             (params->ch_list_len &&
8393              nla_put(msg, QCA_WLAN_VENDOR_ATTR_ACS_CH_LIST, params->ch_list_len,
8394                      params->ch_list))) {
8395                 nlmsg_free(msg);
8396                 return -ENOBUFS;
8397         }
8398         nla_nest_end(msg, data);
8399
8400         wpa_printf(MSG_DEBUG,
8401                    "nl80211: ACS Params: HW_MODE: %d HT: %d HT40: %d VHT: %d BW: %d CH_LIST_LEN: %u",
8402                    params->hw_mode, params->ht_enabled, params->ht40_enabled,
8403                    params->vht_enabled, params->ch_width, params->ch_list_len);
8404
8405         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8406         if (ret) {
8407                 wpa_printf(MSG_DEBUG,
8408                            "nl80211: Failed to invoke driver ACS function: %s",
8409                            strerror(errno));
8410         }
8411         return ret;
8412 }
8413
8414
8415 const struct wpa_driver_ops wpa_driver_nl80211_ops = {
8416         .name = "nl80211",
8417         .desc = "Linux nl80211/cfg80211",
8418         .get_bssid = wpa_driver_nl80211_get_bssid,
8419         .get_ssid = wpa_driver_nl80211_get_ssid,
8420         .set_key = driver_nl80211_set_key,
8421         .scan2 = driver_nl80211_scan2,
8422         .sched_scan = wpa_driver_nl80211_sched_scan,
8423         .stop_sched_scan = wpa_driver_nl80211_stop_sched_scan,
8424         .get_scan_results2 = wpa_driver_nl80211_get_scan_results,
8425         .deauthenticate = driver_nl80211_deauthenticate,
8426         .authenticate = driver_nl80211_authenticate,
8427         .associate = wpa_driver_nl80211_associate,
8428         .global_init = nl80211_global_init,
8429         .global_deinit = nl80211_global_deinit,
8430         .init2 = wpa_driver_nl80211_init,
8431         .deinit = driver_nl80211_deinit,
8432         .get_capa = wpa_driver_nl80211_get_capa,
8433         .set_operstate = wpa_driver_nl80211_set_operstate,
8434         .set_supp_port = wpa_driver_nl80211_set_supp_port,
8435         .set_country = wpa_driver_nl80211_set_country,
8436         .get_country = wpa_driver_nl80211_get_country,
8437         .set_ap = wpa_driver_nl80211_set_ap,
8438         .set_acl = wpa_driver_nl80211_set_acl,
8439         .if_add = wpa_driver_nl80211_if_add,
8440         .if_remove = driver_nl80211_if_remove,
8441         .send_mlme = driver_nl80211_send_mlme,
8442         .get_hw_feature_data = nl80211_get_hw_feature_data,
8443         .sta_add = wpa_driver_nl80211_sta_add,
8444         .sta_remove = driver_nl80211_sta_remove,
8445         .hapd_send_eapol = wpa_driver_nl80211_hapd_send_eapol,
8446         .sta_set_flags = wpa_driver_nl80211_sta_set_flags,
8447         .hapd_init = i802_init,
8448         .hapd_deinit = i802_deinit,
8449         .set_wds_sta = i802_set_wds_sta,
8450         .get_seqnum = i802_get_seqnum,
8451         .flush = i802_flush,
8452         .get_inact_sec = i802_get_inact_sec,
8453         .sta_clear_stats = i802_sta_clear_stats,
8454         .set_rts = i802_set_rts,
8455         .set_frag = i802_set_frag,
8456         .set_tx_queue_params = i802_set_tx_queue_params,
8457         .set_sta_vlan = driver_nl80211_set_sta_vlan,
8458         .sta_deauth = i802_sta_deauth,
8459         .sta_disassoc = i802_sta_disassoc,
8460         .read_sta_data = driver_nl80211_read_sta_data,
8461         .set_freq = i802_set_freq,
8462         .send_action = driver_nl80211_send_action,
8463         .send_action_cancel_wait = wpa_driver_nl80211_send_action_cancel_wait,
8464         .remain_on_channel = wpa_driver_nl80211_remain_on_channel,
8465         .cancel_remain_on_channel =
8466         wpa_driver_nl80211_cancel_remain_on_channel,
8467         .probe_req_report = driver_nl80211_probe_req_report,
8468         .deinit_ap = wpa_driver_nl80211_deinit_ap,
8469         .deinit_p2p_cli = wpa_driver_nl80211_deinit_p2p_cli,
8470         .resume = wpa_driver_nl80211_resume,
8471         .signal_monitor = nl80211_signal_monitor,
8472         .signal_poll = nl80211_signal_poll,
8473         .send_frame = nl80211_send_frame,
8474         .set_param = nl80211_set_param,
8475         .get_radio_name = nl80211_get_radio_name,
8476         .add_pmkid = nl80211_add_pmkid,
8477         .remove_pmkid = nl80211_remove_pmkid,
8478         .flush_pmkid = nl80211_flush_pmkid,
8479         .set_rekey_info = nl80211_set_rekey_info,
8480         .poll_client = nl80211_poll_client,
8481         .set_p2p_powersave = nl80211_set_p2p_powersave,
8482         .start_dfs_cac = nl80211_start_radar_detection,
8483         .stop_ap = wpa_driver_nl80211_stop_ap,
8484 #ifdef CONFIG_TDLS
8485         .send_tdls_mgmt = nl80211_send_tdls_mgmt,
8486         .tdls_oper = nl80211_tdls_oper,
8487         .tdls_enable_channel_switch = nl80211_tdls_enable_channel_switch,
8488         .tdls_disable_channel_switch = nl80211_tdls_disable_channel_switch,
8489 #endif /* CONFIG_TDLS */
8490         .update_ft_ies = wpa_driver_nl80211_update_ft_ies,
8491         .get_mac_addr = wpa_driver_nl80211_get_macaddr,
8492         .get_survey = wpa_driver_nl80211_get_survey,
8493         .status = wpa_driver_nl80211_status,
8494         .switch_channel = nl80211_switch_channel,
8495 #ifdef ANDROID_P2P
8496         .set_noa = wpa_driver_set_p2p_noa,
8497         .get_noa = wpa_driver_get_p2p_noa,
8498         .set_ap_wps_ie = wpa_driver_set_ap_wps_p2p_ie,
8499 #endif /* ANDROID_P2P */
8500 #ifdef ANDROID
8501         .driver_cmd = wpa_driver_nl80211_driver_cmd,
8502 #endif /* ANDROID */
8503         .vendor_cmd = nl80211_vendor_cmd,
8504         .set_qos_map = nl80211_set_qos_map,
8505         .set_wowlan = nl80211_set_wowlan,
8506         .roaming = nl80211_roaming,
8507         .set_mac_addr = nl80211_set_mac_addr,
8508 #ifdef CONFIG_MESH
8509         .init_mesh = wpa_driver_nl80211_init_mesh,
8510         .join_mesh = wpa_driver_nl80211_join_mesh,
8511         .leave_mesh = wpa_driver_nl80211_leave_mesh,
8512 #endif /* CONFIG_MESH */
8513         .br_add_ip_neigh = wpa_driver_br_add_ip_neigh,
8514         .br_delete_ip_neigh = wpa_driver_br_delete_ip_neigh,
8515         .br_port_set_attr = wpa_driver_br_port_set_attr,
8516         .br_set_net_param = wpa_driver_br_set_net_param,
8517         .add_tx_ts = nl80211_add_ts,
8518         .del_tx_ts = nl80211_del_ts,
8519         .do_acs = wpa_driver_do_acs,
8520 };