src/drivers/driver_nl80211_scan.c

   1 /*
   2  * Driver interaction with Linux nl80211/cfg80211 - Scanning
   3  * Copyright (c) 2002-2014, Jouni Malinen <j@w1.fi>
   4  * Copyright (c) 2007, Johannes Berg <johannes@sipsolutions.net>
   5  * Copyright (c) 2009-2010, Atheros Communications
   6  *
   7  * This software may be distributed under the terms of the BSD license.
   8  * See README for more details.
   9  */
  10
  11 #include "includes.h"
  12 #include <netlink/genl/genl.h>
  13
  14 #include "utils/common.h"
  15 #include "utils/eloop.h"
  16 #include "common/ieee802_11_defs.h"
  17 #include "common/qca-vendor.h"
  18 #include "driver_nl80211.h"
  19
  20
  21 static int get_noise_for_scan_results(struct nl_msg *msg, void *arg)
  22 {
  23         struct nlattr *tb[NL80211_ATTR_MAX + 1];
  24         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
  25         struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
  26         static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
  27                 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
  28                 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
  29         };
  30         struct wpa_scan_results *scan_results = arg;
  31         struct wpa_scan_res *scan_res;
  32         size_t i;
  33
  34         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
  35                   genlmsg_attrlen(gnlh, 0), NULL);
  36
  37         if (!tb[NL80211_ATTR_SURVEY_INFO]) {
  38                 wpa_printf(MSG_DEBUG, "nl80211: Survey data missing");
  39                 return NL_SKIP;
  40         }
  41
  42         if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
  43                              tb[NL80211_ATTR_SURVEY_INFO],
  44                              survey_policy)) {
  45                 wpa_printf(MSG_DEBUG, "nl80211: Failed to parse nested "
  46                            "attributes");
  47                 return NL_SKIP;
  48         }
  49
  50         if (!sinfo[NL80211_SURVEY_INFO_NOISE])
  51                 return NL_SKIP;
  52
  53         if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY])
  54                 return NL_SKIP;
  55
  56         for (i = 0; i < scan_results->num; ++i) {
  57                 scan_res = scan_results->res[i];
  58                 if (!scan_res)
  59                         continue;
  60                 if ((int) nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]) !=
  61                     scan_res->freq)
  62                         continue;
  63                 if (!(scan_res->flags & WPA_SCAN_NOISE_INVALID))
  64                         continue;
  65                 scan_res->noise = (s8)
  66                         nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
  67                 scan_res->flags &= ~WPA_SCAN_NOISE_INVALID;
  68         }
  69
  70         return NL_SKIP;
  71 }
  72
  73
  74 static int nl80211_get_noise_for_scan_results(
  75         struct wpa_driver_nl80211_data *drv,
  76         struct wpa_scan_results *scan_res)
  77 {
  78         struct nl_msg *msg;
  79
  80         msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_GET_SURVEY);
  81         return send_and_recv_msgs(drv, msg, get_noise_for_scan_results,
  82                                   scan_res);
  83 }
  84
  85
  86 /**
  87  * wpa_driver_nl80211_scan_timeout - Scan timeout to report scan completion
  88  * @eloop_ctx: Driver private data
  89  * @timeout_ctx: ctx argument given to wpa_driver_nl80211_init()
  90  *
  91  * This function can be used as registered timeout when starting a scan to
  92  * generate a scan completed event if the driver does not report this.
  93  */
  94 void wpa_driver_nl80211_scan_timeout(void *eloop_ctx, void *timeout_ctx)
  95 {
  96         struct wpa_driver_nl80211_data *drv = eloop_ctx;
  97         if (drv->ap_scan_as_station != NL80211_IFTYPE_UNSPECIFIED) {
  98                 wpa_driver_nl80211_set_mode(drv->first_bss,
  99                                             drv->ap_scan_as_station);
 100                 drv->ap_scan_as_station = NL80211_IFTYPE_UNSPECIFIED;
 101         }
 102         wpa_printf(MSG_DEBUG, "Scan timeout - try to get results");
 103         wpa_supplicant_event(timeout_ctx, EVENT_SCAN_RESULTS, NULL);
 104 }
 105
 106
 107 static struct nl_msg *
 108 nl80211_scan_common(struct i802_bss *bss, u8 cmd,
 109                     struct wpa_driver_scan_params *params)
 110 {
 111         struct wpa_driver_nl80211_data *drv = bss->drv;
 112         struct nl_msg *msg;
 113         size_t i;
 114         u32 scan_flags = 0;
 115
 116         msg = nl80211_cmd_msg(bss, 0, cmd);
 117         if (!msg)
 118                 return NULL;
 119
 120         if (params->num_ssids) {
 121                 struct nlattr *ssids;
 122
 123                 ssids = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
 124                 if (ssids == NULL)
 125                         goto fail;
 126                 for (i = 0; i < params->num_ssids; i++) {
 127                         wpa_hexdump_ascii(MSG_MSGDUMP, "nl80211: Scan SSID",
 128                                           params->ssids[i].ssid,
 129                                           params->ssids[i].ssid_len);
 130                         if (nla_put(msg, i + 1, params->ssids[i].ssid_len,
 131                                     params->ssids[i].ssid))
 132                                 goto fail;
 133                 }
 134                 nla_nest_end(msg, ssids);
 135         }
 136
 137         if (params->extra_ies) {
 138                 wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan extra IEs",
 139                             params->extra_ies, params->extra_ies_len);
 140                 if (nla_put(msg, NL80211_ATTR_IE, params->extra_ies_len,
 141                             params->extra_ies))
 142                         goto fail;
 143         }
 144
 145         if (params->freqs) {
 146                 struct nlattr *freqs;
 147                 freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
 148                 if (freqs == NULL)
 149                         goto fail;
 150                 for (i = 0; params->freqs[i]; i++) {
 151                         wpa_printf(MSG_MSGDUMP, "nl80211: Scan frequency %u "
 152                                    "MHz", params->freqs[i]);
 153                         if (nla_put_u32(msg, i + 1, params->freqs[i]))
 154                                 goto fail;
 155                 }
 156                 nla_nest_end(msg, freqs);
 157         }
 158
 159         os_free(drv->filter_ssids);
 160         drv->filter_ssids = params->filter_ssids;
 161         params->filter_ssids = NULL;
 162         drv->num_filter_ssids = params->num_filter_ssids;
 163
 164         if (params->only_new_results) {
 165                 wpa_printf(MSG_DEBUG, "nl80211: Add NL80211_SCAN_FLAG_FLUSH");
 166                 scan_flags |= NL80211_SCAN_FLAG_FLUSH;
 167         }
 168
 169         if (params->low_priority && drv->have_low_prio_scan) {
 170                 wpa_printf(MSG_DEBUG,
 171                            "nl80211: Add NL80211_SCAN_FLAG_LOW_PRIORITY");
 172                 scan_flags |= NL80211_SCAN_FLAG_LOW_PRIORITY;
 173         }
 174
 175         if (params->mac_addr_rand) {
 176                 wpa_printf(MSG_DEBUG,
 177                            "nl80211: Add NL80211_SCAN_FLAG_RANDOM_ADDR");
 178                 scan_flags |= NL80211_SCAN_FLAG_RANDOM_ADDR;
 179
 180                 if (params->mac_addr) {
 181                         wpa_printf(MSG_DEBUG, "nl80211: MAC address: " MACSTR,
 182                                    MAC2STR(params->mac_addr));
 183                         if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
 184                                     params->mac_addr))
 185                                 goto fail;
 186                 }
 187
 188                 if (params->mac_addr_mask) {
 189                         wpa_printf(MSG_DEBUG, "nl80211: MAC address mask: "
 190                                    MACSTR, MAC2STR(params->mac_addr_mask));
 191                         if (nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN,
 192                                     params->mac_addr_mask))
 193                                 goto fail;
 194                 }
 195         }
 196
 197         if (scan_flags &&
 198             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, scan_flags))
 199                 goto fail;
 200
 201         return msg;
 202
 203 fail:
 204         nlmsg_free(msg);
 205         return NULL;
 206 }
 207
 208
 209 /**
 210  * wpa_driver_nl80211_scan - Request the driver to initiate scan
 211  * @bss: Pointer to private driver data from wpa_driver_nl80211_init()
 212  * @params: Scan parameters
 213  * Returns: 0 on success, -1 on failure
 214  */
 215 int wpa_driver_nl80211_scan(struct i802_bss *bss,
 216                             struct wpa_driver_scan_params *params)
 217 {
 218         struct wpa_driver_nl80211_data *drv = bss->drv;
 219         int ret = -1, timeout;
 220         struct nl_msg *msg = NULL;
 221
 222         wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: scan request");
 223         drv->scan_for_auth = 0;
 224
 225         if (TEST_FAIL())
 226                 return -1;
 227
 228         msg = nl80211_scan_common(bss, NL80211_CMD_TRIGGER_SCAN, params);
 229         if (!msg)
 230                 return -1;
 231
 232         if (params->p2p_probe) {
 233                 struct nlattr *rates;
 234
 235                 wpa_printf(MSG_DEBUG, "nl80211: P2P probe - mask SuppRates");
 236
 237                 rates = nla_nest_start(msg, NL80211_ATTR_SCAN_SUPP_RATES);
 238                 if (rates == NULL)
 239                         goto fail;
 240
 241                 /*
 242                  * Remove 2.4 GHz rates 1, 2, 5.5, 11 Mbps from supported rates
 243                  * by masking out everything else apart from the OFDM rates 6,
 244                  * 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS rates. All 5 GHz
 245                  * rates are left enabled.
 246                  */
 247                 if (nla_put(msg, NL80211_BAND_2GHZ, 8,
 248                             "\x0c\x12\x18\x24\x30\x48\x60\x6c"))
 249                         goto fail;
 250                 nla_nest_end(msg, rates);
 251
 252                 if (nla_put_flag(msg, NL80211_ATTR_TX_NO_CCK_RATE))
 253                         goto fail;
 254         }
 255
 256         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
 257         msg = NULL;
 258         if (ret) {
 259                 wpa_printf(MSG_DEBUG, "nl80211: Scan trigger failed: ret=%d "
 260                            "(%s)", ret, strerror(-ret));
 261                 if (drv->hostapd && is_ap_interface(drv->nlmode)) {
 262                         enum nl80211_iftype old_mode = drv->nlmode;
 263
 264                         /*
 265                          * mac80211 does not allow scan requests in AP mode, so
 266                          * try to do this in station mode.
 267                          */
 268                         if (wpa_driver_nl80211_set_mode(
 269                                     bss, NL80211_IFTYPE_STATION))
 270                                 goto fail;
 271
 272                         if (wpa_driver_nl80211_scan(bss, params)) {
 273                                 wpa_driver_nl80211_set_mode(bss, old_mode);
 274                                 goto fail;
 275                         }
 276
 277                         /* Restore AP mode when processing scan results */
 278                         drv->ap_scan_as_station = old_mode;
 279                         ret = 0;
 280                 } else
 281                         goto fail;
 282         }
 283
 284         drv->scan_state = SCAN_REQUESTED;
 285         /* Not all drivers generate "scan completed" wireless event, so try to
 286          * read results after a timeout. */
 287         timeout = 10;
 288         if (drv->scan_complete_events) {
 289                 /*
 290                  * The driver seems to deliver events to notify when scan is
 291                  * complete, so use longer timeout to avoid race conditions
 292                  * with scanning and following association request.
 293                  */
 294                 timeout = 30;
 295         }
 296         wpa_printf(MSG_DEBUG, "Scan requested (ret=%d) - scan timeout %d "
 297                    "seconds", ret, timeout);
 298         eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
 299         eloop_register_timeout(timeout, 0, wpa_driver_nl80211_scan_timeout,
 300                                drv, drv->ctx);
 301
 302 fail:
 303         nlmsg_free(msg);
 304         return ret;
 305 }
 306
 307
 308 /**
 309  * wpa_driver_nl80211_sched_scan - Initiate a scheduled scan
 310  * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
 311  * @params: Scan parameters
 312  * @interval: Interval between scan cycles in milliseconds
 313  * Returns: 0 on success, -1 on failure or if not supported
 314  */
 315 int wpa_driver_nl80211_sched_scan(void *priv,
 316                                   struct wpa_driver_scan_params *params,
 317                                   u32 interval)
 318 {
 319         struct i802_bss *bss = priv;
 320         struct wpa_driver_nl80211_data *drv = bss->drv;
 321         int ret = -1;
 322         struct nl_msg *msg;
 323         size_t i;
 324
 325         wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: sched_scan request");
 326
 327 #ifdef ANDROID
 328         if (!drv->capa.sched_scan_supported)
 329                 return android_pno_start(bss, params);
 330 #endif /* ANDROID */
 331
 332         msg = nl80211_scan_common(bss, NL80211_CMD_START_SCHED_SCAN, params);
 333         if (!msg ||
 334             nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL, interval))
 335                 goto fail;
 336
 337         if ((drv->num_filter_ssids &&
 338             (int) drv->num_filter_ssids <= drv->capa.max_match_sets) ||
 339             params->filter_rssi) {
 340                 struct nlattr *match_sets;
 341                 match_sets = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
 342                 if (match_sets == NULL)
 343                         goto fail;
 344
 345                 for (i = 0; i < drv->num_filter_ssids; i++) {
 346                         struct nlattr *match_set_ssid;
 347                         wpa_hexdump_ascii(MSG_MSGDUMP,
 348                                           "nl80211: Sched scan filter SSID",
 349                                           drv->filter_ssids[i].ssid,
 350                                           drv->filter_ssids[i].ssid_len);
 351
 352                         match_set_ssid = nla_nest_start(msg, i + 1);
 353                         if (match_set_ssid == NULL ||
 354                             nla_put(msg, NL80211_ATTR_SCHED_SCAN_MATCH_SSID,
 355                                     drv->filter_ssids[i].ssid_len,
 356                                     drv->filter_ssids[i].ssid) ||
 357                             (params->filter_rssi &&
 358                              nla_put_u32(msg,
 359                                          NL80211_SCHED_SCAN_MATCH_ATTR_RSSI,
 360                                          params->filter_rssi)))
 361                                 goto fail;
 362
 363                         nla_nest_end(msg, match_set_ssid);
 364                 }
 365
 366                 /*
 367                  * Due to backward compatibility code, newer kernels treat this
 368                  * matchset (with only an RSSI filter) as the default for all
 369                  * other matchsets, unless it's the only one, in which case the
 370                  * matchset will actually allow all SSIDs above the RSSI.
 371                  */
 372                 if (params->filter_rssi) {
 373                         struct nlattr *match_set_rssi;
 374                         match_set_rssi = nla_nest_start(msg, 0);
 375                         if (match_set_rssi == NULL ||
 376                             nla_put_u32(msg, NL80211_SCHED_SCAN_MATCH_ATTR_RSSI,
 377                                         params->filter_rssi))
 378                                 goto fail;
 379                         wpa_printf(MSG_MSGDUMP,
 380                                    "nl80211: Sched scan RSSI filter %d dBm",
 381                                    params->filter_rssi);
 382                         nla_nest_end(msg, match_set_rssi);
 383                 }
 384
 385                 nla_nest_end(msg, match_sets);
 386         }
 387
 388         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
 389
 390         /* TODO: if we get an error here, we should fall back to normal scan */
 391
 392         msg = NULL;
 393         if (ret) {
 394                 wpa_printf(MSG_DEBUG, "nl80211: Sched scan start failed: "
 395                            "ret=%d (%s)", ret, strerror(-ret));
 396                 goto fail;
 397         }
 398
 399         wpa_printf(MSG_DEBUG, "nl80211: Sched scan requested (ret=%d) - "
 400                    "scan interval %d msec", ret, interval);
 401
 402 fail:
 403         nlmsg_free(msg);
 404         return ret;
 405 }
 406
 407
 408 /**
 409  * wpa_driver_nl80211_stop_sched_scan - Stop a scheduled scan
 410  * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
 411  * Returns: 0 on success, -1 on failure or if not supported
 412  */
 413 int wpa_driver_nl80211_stop_sched_scan(void *priv)
 414 {
 415         struct i802_bss *bss = priv;
 416         struct wpa_driver_nl80211_data *drv = bss->drv;
 417         int ret;
 418         struct nl_msg *msg;
 419
 420 #ifdef ANDROID
 421         if (!drv->capa.sched_scan_supported)
 422                 return android_pno_stop(bss);
 423 #endif /* ANDROID */
 424
 425         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_STOP_SCHED_SCAN);
 426         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
 427         if (ret) {
 428                 wpa_printf(MSG_DEBUG,
 429                            "nl80211: Sched scan stop failed: ret=%d (%s)",
 430                            ret, strerror(-ret));
 431         } else {
 432                 wpa_printf(MSG_DEBUG,
 433                            "nl80211: Sched scan stop sent");
 434         }
 435
 436         return ret;
 437 }
 438
 439
 440 const u8 * nl80211_get_ie(const u8 *ies, size_t ies_len, u8 ie)
 441 {
 442         const u8 *end, *pos;
 443
 444         if (ies == NULL)
 445                 return NULL;
 446
 447         pos = ies;
 448         end = ies + ies_len;
 449
 450         while (pos + 1 < end) {
 451                 if (pos + 2 + pos[1] > end)
 452                         break;
 453                 if (pos[0] == ie)
 454                         return pos;
 455                 pos += 2 + pos[1];
 456         }
 457
 458         return NULL;
 459 }
 460
 461
 462 static int nl80211_scan_filtered(struct wpa_driver_nl80211_data *drv,
 463                                  const u8 *ie, size_t ie_len)
 464 {
 465         const u8 *ssid;
 466         size_t i;
 467
 468         if (drv->filter_ssids == NULL)
 469                 return 0;
 470
 471         ssid = nl80211_get_ie(ie, ie_len, WLAN_EID_SSID);
 472         if (ssid == NULL)
 473                 return 1;
 474
 475         for (i = 0; i < drv->num_filter_ssids; i++) {
 476                 if (ssid[1] == drv->filter_ssids[i].ssid_len &&
 477                     os_memcmp(ssid + 2, drv->filter_ssids[i].ssid, ssid[1]) ==
 478                     0)
 479                         return 0;
 480         }
 481
 482         return 1;
 483 }
 484
 485
 486 int bss_info_handler(struct nl_msg *msg, void *arg)
 487 {
 488         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 489         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 490         struct nlattr *bss[NL80211_BSS_MAX + 1];
 491         static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = {
 492                 [NL80211_BSS_BSSID] = { .type = NLA_UNSPEC },
 493                 [NL80211_BSS_FREQUENCY] = { .type = NLA_U32 },
 494                 [NL80211_BSS_TSF] = { .type = NLA_U64 },
 495                 [NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 },
 496                 [NL80211_BSS_CAPABILITY] = { .type = NLA_U16 },
 497                 [NL80211_BSS_INFORMATION_ELEMENTS] = { .type = NLA_UNSPEC },
 498                 [NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 },
 499                 [NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 },
 500                 [NL80211_BSS_STATUS] = { .type = NLA_U32 },
 501                 [NL80211_BSS_SEEN_MS_AGO] = { .type = NLA_U32 },
 502                 [NL80211_BSS_BEACON_IES] = { .type = NLA_UNSPEC },
 503         };
 504         struct nl80211_bss_info_arg *_arg = arg;
 505         struct wpa_scan_results *res = _arg->res;
 506         struct wpa_scan_res **tmp;
 507         struct wpa_scan_res *r;
 508         const u8 *ie, *beacon_ie;
 509         size_t ie_len, beacon_ie_len;
 510         u8 *pos;
 511         size_t i;
 512
 513         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 514                   genlmsg_attrlen(gnlh, 0), NULL);
 515         if (!tb[NL80211_ATTR_BSS])
 516                 return NL_SKIP;
 517         if (nla_parse_nested(bss, NL80211_BSS_MAX, tb[NL80211_ATTR_BSS],
 518                              bss_policy))
 519                 return NL_SKIP;
 520         if (bss[NL80211_BSS_STATUS]) {
 521                 enum nl80211_bss_status status;
 522                 status = nla_get_u32(bss[NL80211_BSS_STATUS]);
 523                 if (status == NL80211_BSS_STATUS_ASSOCIATED &&
 524                     bss[NL80211_BSS_FREQUENCY]) {
 525                         _arg->assoc_freq =
 526                                 nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
 527                         wpa_printf(MSG_DEBUG, "nl80211: Associated on %u MHz",
 528                                    _arg->assoc_freq);
 529                 }
 530                 if (status == NL80211_BSS_STATUS_IBSS_JOINED &&
 531                     bss[NL80211_BSS_FREQUENCY]) {
 532                         _arg->ibss_freq =
 533                                 nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
 534                         wpa_printf(MSG_DEBUG, "nl80211: IBSS-joined on %u MHz",
 535                                    _arg->ibss_freq);
 536                 }
 537                 if (status == NL80211_BSS_STATUS_ASSOCIATED &&
 538                     bss[NL80211_BSS_BSSID]) {
 539                         os_memcpy(_arg->assoc_bssid,
 540                                   nla_data(bss[NL80211_BSS_BSSID]), ETH_ALEN);
 541                         wpa_printf(MSG_DEBUG, "nl80211: Associated with "
 542                                    MACSTR, MAC2STR(_arg->assoc_bssid));
 543                 }
 544         }
 545         if (!res)
 546                 return NL_SKIP;
 547         if (bss[NL80211_BSS_INFORMATION_ELEMENTS]) {
 548                 ie = nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
 549                 ie_len = nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
 550         } else {
 551                 ie = NULL;
 552                 ie_len = 0;
 553         }
 554         if (bss[NL80211_BSS_BEACON_IES]) {
 555                 beacon_ie = nla_data(bss[NL80211_BSS_BEACON_IES]);
 556                 beacon_ie_len = nla_len(bss[NL80211_BSS_BEACON_IES]);
 557         } else {
 558                 beacon_ie = NULL;
 559                 beacon_ie_len = 0;
 560         }
 561
 562         if (nl80211_scan_filtered(_arg->drv, ie ? ie : beacon_ie,
 563                                   ie ? ie_len : beacon_ie_len))
 564                 return NL_SKIP;
 565
 566         r = os_zalloc(sizeof(*r) + ie_len + beacon_ie_len);
 567         if (r == NULL)
 568                 return NL_SKIP;
 569         if (bss[NL80211_BSS_BSSID])
 570                 os_memcpy(r->bssid, nla_data(bss[NL80211_BSS_BSSID]),
 571                           ETH_ALEN);
 572         if (bss[NL80211_BSS_FREQUENCY])
 573                 r->freq = nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
 574         if (bss[NL80211_BSS_BEACON_INTERVAL])
 575                 r->beacon_int = nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]);
 576         if (bss[NL80211_BSS_CAPABILITY])
 577                 r->caps = nla_get_u16(bss[NL80211_BSS_CAPABILITY]);
 578         r->flags |= WPA_SCAN_NOISE_INVALID;
 579         if (bss[NL80211_BSS_SIGNAL_MBM]) {
 580                 r->level = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]);
 581                 r->level /= 100; /* mBm to dBm */
 582                 r->flags |= WPA_SCAN_LEVEL_DBM | WPA_SCAN_QUAL_INVALID;
 583         } else if (bss[NL80211_BSS_SIGNAL_UNSPEC]) {
 584                 r->level = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]);
 585                 r->flags |= WPA_SCAN_QUAL_INVALID;
 586         } else
 587                 r->flags |= WPA_SCAN_LEVEL_INVALID | WPA_SCAN_QUAL_INVALID;
 588         if (bss[NL80211_BSS_TSF])
 589                 r->tsf = nla_get_u64(bss[NL80211_BSS_TSF]);
 590         if (bss[NL80211_BSS_BEACON_TSF]) {
 591                 u64 tsf = nla_get_u64(bss[NL80211_BSS_BEACON_TSF]);
 592                 if (tsf > r->tsf)
 593                         r->tsf = tsf;
 594         }
 595         if (bss[NL80211_BSS_SEEN_MS_AGO])
 596                 r->age = nla_get_u32(bss[NL80211_BSS_SEEN_MS_AGO]);
 597         r->ie_len = ie_len;
 598         pos = (u8 *) (r + 1);
 599         if (ie) {
 600                 os_memcpy(pos, ie, ie_len);
 601                 pos += ie_len;
 602         }
 603         r->beacon_ie_len = beacon_ie_len;
 604         if (beacon_ie)
 605                 os_memcpy(pos, beacon_ie, beacon_ie_len);
 606
 607         if (bss[NL80211_BSS_STATUS]) {
 608                 enum nl80211_bss_status status;
 609                 status = nla_get_u32(bss[NL80211_BSS_STATUS]);
 610                 switch (status) {
 611                 case NL80211_BSS_STATUS_ASSOCIATED:
 612                         r->flags |= WPA_SCAN_ASSOCIATED;
 613                         break;
 614                 default:
 615                         break;
 616                 }
 617         }
 618
 619         /*
 620          * cfg80211 maintains separate BSS table entries for APs if the same
 621          * BSSID,SSID pair is seen on multiple channels. wpa_supplicant does
 622          * not use frequency as a separate key in the BSS table, so filter out
 623          * duplicated entries. Prefer associated BSS entry in such a case in
 624          * order to get the correct frequency into the BSS table. Similarly,
 625          * prefer newer entries over older.
 626          */
 627         for (i = 0; i < res->num; i++) {
 628                 const u8 *s1, *s2;
 629                 if (os_memcmp(res->res[i]->bssid, r->bssid, ETH_ALEN) != 0)
 630                         continue;
 631
 632                 s1 = nl80211_get_ie((u8 *) (res->res[i] + 1),
 633                                     res->res[i]->ie_len, WLAN_EID_SSID);
 634                 s2 = nl80211_get_ie((u8 *) (r + 1), r->ie_len, WLAN_EID_SSID);
 635                 if (s1 == NULL || s2 == NULL || s1[1] != s2[1] ||
 636                     os_memcmp(s1, s2, 2 + s1[1]) != 0)
 637                         continue;
 638
 639                 /* Same BSSID,SSID was already included in scan results */
 640                 wpa_printf(MSG_DEBUG, "nl80211: Remove duplicated scan result "
 641                            "for " MACSTR, MAC2STR(r->bssid));
 642
 643                 if (((r->flags & WPA_SCAN_ASSOCIATED) &&
 644                      !(res->res[i]->flags & WPA_SCAN_ASSOCIATED)) ||
 645                     r->age < res->res[i]->age) {
 646                         os_free(res->res[i]);
 647                         res->res[i] = r;
 648                 } else
 649                         os_free(r);
 650                 return NL_SKIP;
 651         }
 652
 653         tmp = os_realloc_array(res->res, res->num + 1,
 654                                sizeof(struct wpa_scan_res *));
 655         if (tmp == NULL) {
 656                 os_free(r);
 657                 return NL_SKIP;
 658         }
 659         tmp[res->num++] = r;
 660         res->res = tmp;
 661
 662         return NL_SKIP;
 663 }
 664
 665
 666 static void clear_state_mismatch(struct wpa_driver_nl80211_data *drv,
 667                                  const u8 *addr)
 668 {
 669         if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) {
 670                 wpa_printf(MSG_DEBUG, "nl80211: Clear possible state "
 671                            "mismatch (" MACSTR ")", MAC2STR(addr));
 672                 wpa_driver_nl80211_mlme(drv, addr,
 673                                         NL80211_CMD_DEAUTHENTICATE,
 674                                         WLAN_REASON_PREV_AUTH_NOT_VALID, 1);
 675         }
 676 }
 677
 678
 679 static void wpa_driver_nl80211_check_bss_status(
 680         struct wpa_driver_nl80211_data *drv, struct wpa_scan_results *res)
 681 {
 682         size_t i;
 683
 684         for (i = 0; i < res->num; i++) {
 685                 struct wpa_scan_res *r = res->res[i];
 686
 687                 if (r->flags & WPA_SCAN_ASSOCIATED) {
 688                         wpa_printf(MSG_DEBUG, "nl80211: Scan results "
 689                                    "indicate BSS status with " MACSTR
 690                                    " as associated",
 691                                    MAC2STR(r->bssid));
 692                         if (is_sta_interface(drv->nlmode) &&
 693                             !drv->associated) {
 694                                 wpa_printf(MSG_DEBUG, "nl80211: Local state "
 695                                            "(not associated) does not match "
 696                                            "with BSS state");
 697                                 clear_state_mismatch(drv, r->bssid);
 698                         } else if (is_sta_interface(drv->nlmode) &&
 699                                    os_memcmp(drv->bssid, r->bssid, ETH_ALEN) !=
 700                                    0) {
 701                                 wpa_printf(MSG_DEBUG, "nl80211: Local state "
 702                                            "(associated with " MACSTR ") does "
 703                                            "not match with BSS state",
 704                                            MAC2STR(drv->bssid));
 705                                 clear_state_mismatch(drv, r->bssid);
 706                                 clear_state_mismatch(drv, drv->bssid);
 707                         }
 708                 }
 709         }
 710 }
 711
 712
 713 static struct wpa_scan_results *
 714 nl80211_get_scan_results(struct wpa_driver_nl80211_data *drv)
 715 {
 716         struct nl_msg *msg;
 717         struct wpa_scan_results *res;
 718         int ret;
 719         struct nl80211_bss_info_arg arg;
 720
 721         res = os_zalloc(sizeof(*res));
 722         if (res == NULL)
 723                 return NULL;
 724         if (!(msg = nl80211_cmd_msg(drv->first_bss, NLM_F_DUMP,
 725                                     NL80211_CMD_GET_SCAN))) {
 726                 wpa_scan_results_free(res);
 727                 return NULL;
 728         }
 729
 730         arg.drv = drv;
 731         arg.res = res;
 732         ret = send_and_recv_msgs(drv, msg, bss_info_handler, &arg);
 733         if (ret == 0) {
 734                 wpa_printf(MSG_DEBUG, "nl80211: Received scan results (%lu "
 735                            "BSSes)", (unsigned long) res->num);
 736                 nl80211_get_noise_for_scan_results(drv, res);
 737                 return res;
 738         }
 739         wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d "
 740                    "(%s)", ret, strerror(-ret));
 741         wpa_scan_results_free(res);
 742         return NULL;
 743 }
 744
 745
 746 /**
 747  * wpa_driver_nl80211_get_scan_results - Fetch the latest scan results
 748  * @priv: Pointer to private wext data from wpa_driver_nl80211_init()
 749  * Returns: Scan results on success, -1 on failure
 750  */
 751 struct wpa_scan_results * wpa_driver_nl80211_get_scan_results(void *priv)
 752 {
 753         struct i802_bss *bss = priv;
 754         struct wpa_driver_nl80211_data *drv = bss->drv;
 755         struct wpa_scan_results *res;
 756
 757         res = nl80211_get_scan_results(drv);
 758         if (res)
 759                 wpa_driver_nl80211_check_bss_status(drv, res);
 760         return res;
 761 }
 762
 763
 764 void nl80211_dump_scan(struct wpa_driver_nl80211_data *drv)
 765 {
 766         struct wpa_scan_results *res;
 767         size_t i;
 768
 769         res = nl80211_get_scan_results(drv);
 770         if (res == NULL) {
 771                 wpa_printf(MSG_DEBUG, "nl80211: Failed to get scan results");
 772                 return;
 773         }
 774
 775         wpa_printf(MSG_DEBUG, "nl80211: Scan result dump");
 776         for (i = 0; i < res->num; i++) {
 777                 struct wpa_scan_res *r = res->res[i];
 778                 wpa_printf(MSG_DEBUG, "nl80211: %d/%d " MACSTR "%s",
 779                            (int) i, (int) res->num, MAC2STR(r->bssid),
 780                            r->flags & WPA_SCAN_ASSOCIATED ? " [assoc]" : "");
 781         }
 782
 783         wpa_scan_results_free(res);
 784 }
 785
 786
 787 static int scan_cookie_handler(struct nl_msg *msg, void *arg)
 788 {
 789         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 790         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 791         u64 *cookie = arg;
 792
 793         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 794                   genlmsg_attrlen(gnlh, 0), NULL);
 795
 796         if (tb[NL80211_ATTR_VENDOR_DATA]) {
 797                 struct nlattr *nl_vendor = tb[NL80211_ATTR_VENDOR_DATA];
 798                 struct nlattr *tb_vendor[QCA_WLAN_VENDOR_ATTR_SCAN_MAX + 1];
 799
 800                 nla_parse(tb_vendor, QCA_WLAN_VENDOR_ATTR_SCAN_MAX,
 801                           nla_data(nl_vendor), nla_len(nl_vendor), NULL);
 802
 803                 if (tb_vendor[QCA_WLAN_VENDOR_ATTR_SCAN_COOKIE])
 804                         *cookie = nla_get_u64(
 805                                 tb_vendor[QCA_WLAN_VENDOR_ATTR_SCAN_COOKIE]);
 806         }
 807
 808         return NL_SKIP;
 809 }
 810
 811
 812 /**
 813  * wpa_driver_nl80211_vendor_scan - Request the driver to initiate a vendor scan
 814  * @bss: Pointer to private driver data from wpa_driver_nl80211_init()
 815  * @params: Scan parameters
 816  * Returns: 0 on success, -1 on failure
 817  */
 818 int wpa_driver_nl80211_vendor_scan(struct i802_bss *bss,
 819                                    struct wpa_driver_scan_params *params)
 820 {
 821         struct wpa_driver_nl80211_data *drv = bss->drv;
 822         struct nl_msg *msg = NULL;
 823         struct nlattr *attr;
 824         size_t i;
 825         u32 scan_flags = 0;
 826         int ret = -1;
 827         u64 cookie = 0;
 828
 829         wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: vendor scan request");
 830         drv->scan_for_auth = 0;
 831
 832         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
 833             nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
 834             nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
 835                         QCA_NL80211_VENDOR_SUBCMD_TRIGGER_SCAN) )
 836                 goto fail;
 837
 838         attr = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
 839         if (attr == NULL)
 840                 goto fail;
 841
 842         if (params->num_ssids) {
 843                 struct nlattr *ssids;
 844
 845                 ssids = nla_nest_start(msg, QCA_WLAN_VENDOR_ATTR_SCAN_SSIDS);
 846                 if (ssids == NULL)
 847                         goto fail;
 848                 for (i = 0; i < params->num_ssids; i++) {
 849                         wpa_hexdump_ascii(MSG_MSGDUMP, "nl80211: Scan SSID",
 850                                         params->ssids[i].ssid,
 851                                         params->ssids[i].ssid_len);
 852                         if (nla_put(msg, i + 1, params->ssids[i].ssid_len,
 853                                     params->ssids[i].ssid))
 854                                 goto fail;
 855                 }
 856                 nla_nest_end(msg, ssids);
 857         }
 858
 859         if (params->extra_ies) {
 860                 wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan extra IEs",
 861                             params->extra_ies, params->extra_ies_len);
 862                 if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_SCAN_IE,
 863                             params->extra_ies_len, params->extra_ies))
 864                         goto fail;
 865         }
 866
 867         if (params->freqs) {
 868                 struct nlattr *freqs;
 869
 870                 freqs = nla_nest_start(msg,
 871                                        QCA_WLAN_VENDOR_ATTR_SCAN_FREQUENCIES);
 872                 if (freqs == NULL)
 873                         goto fail;
 874                 for (i = 0; params->freqs[i]; i++) {
 875                         wpa_printf(MSG_MSGDUMP,
 876                                    "nl80211: Scan frequency %u MHz",
 877                                    params->freqs[i]);
 878                         if (nla_put_u32(msg, i + 1, params->freqs[i]))
 879                                 goto fail;
 880                 }
 881                 nla_nest_end(msg, freqs);
 882         }
 883
 884         os_free(drv->filter_ssids);
 885         drv->filter_ssids = params->filter_ssids;
 886         params->filter_ssids = NULL;
 887         drv->num_filter_ssids = params->num_filter_ssids;
 888
 889         if (params->low_priority && drv->have_low_prio_scan) {
 890                 wpa_printf(MSG_DEBUG,
 891                            "nl80211: Add NL80211_SCAN_FLAG_LOW_PRIORITY");
 892                 scan_flags |= NL80211_SCAN_FLAG_LOW_PRIORITY;
 893         }
 894
 895         if (params->mac_addr_rand) {
 896                 wpa_printf(MSG_DEBUG,
 897                            "nl80211: Add NL80211_SCAN_FLAG_RANDOM_ADDR");
 898                 scan_flags |= NL80211_SCAN_FLAG_RANDOM_ADDR;
 899
 900                 if (params->mac_addr) {
 901                         wpa_printf(MSG_DEBUG, "nl80211: MAC address: " MACSTR,
 902                                    MAC2STR(params->mac_addr));
 903                         if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_SCAN_MAC,
 904                                     ETH_ALEN, params->mac_addr))
 905                                 goto fail;
 906                 }
 907
 908                 if (params->mac_addr_mask) {
 909                         wpa_printf(MSG_DEBUG, "nl80211: MAC address mask: "
 910                                    MACSTR, MAC2STR(params->mac_addr_mask));
 911                         if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_SCAN_MAC_MASK,
 912                                     ETH_ALEN, params->mac_addr_mask))
 913                                 goto fail;
 914                 }
 915         }
 916
 917         if (scan_flags &&
 918             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, scan_flags))
 919                 goto fail;
 920
 921         if (params->p2p_probe) {
 922                 struct nlattr *rates;
 923
 924                 wpa_printf(MSG_DEBUG, "nl80211: P2P probe - mask SuppRates");
 925
 926                 rates = nla_nest_start(msg,
 927                                        QCA_WLAN_VENDOR_ATTR_SCAN_SUPP_RATES);
 928                 if (rates == NULL)
 929                         goto fail;
 930
 931                 /*
 932                  * Remove 2.4 GHz rates 1, 2, 5.5, 11 Mbps from supported rates
 933                  * by masking out everything else apart from the OFDM rates 6,
 934                  * 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS rates. All 5 GHz
 935                  * rates are left enabled.
 936                  */
 937                 if (nla_put(msg, NL80211_BAND_2GHZ, 8,
 938                             "\x0c\x12\x18\x24\x30\x48\x60\x6c"))
 939                         goto fail;
 940                 nla_nest_end(msg, rates);
 941
 942                 if (nla_put_flag(msg, QCA_WLAN_VENDOR_ATTR_SCAN_TX_NO_CCK_RATE))
 943                         goto fail;
 944         }
 945
 946         nla_nest_end(msg, attr);
 947
 948         ret = send_and_recv_msgs(drv, msg, scan_cookie_handler, &cookie);
 949         msg = NULL;
 950         if (ret) {
 951                 wpa_printf(MSG_DEBUG,
 952                            "nl80211: Vendor scan trigger failed: ret=%d (%s)",
 953                            ret, strerror(-ret));
 954                 goto fail;
 955         }
 956
 957         drv->vendor_scan_cookie = cookie;
 958         drv->scan_state = SCAN_REQUESTED;
 959
 960         wpa_printf(MSG_DEBUG,
 961                    "nl80211: Vendor scan requested (ret=%d) - scan timeout 30 seconds, scan cookie:0x%llx",
 962                    ret, (long long unsigned int) cookie);
 963         eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
 964         eloop_register_timeout(30, 0, wpa_driver_nl80211_scan_timeout,
 965                                drv, drv->ctx);
 966
 967 fail:
 968         nlmsg_free(msg);
 969         return ret;
 970 }