src/drivers/driver_nl80211_scan.c

   1 /*
   2  * Driver interaction with Linux nl80211/cfg80211 - Scanning
   3  * Copyright(c) 2015 Intel Deutschland GmbH
   4  * Copyright (c) 2002-2014, Jouni Malinen <j@w1.fi>
   5  * Copyright (c) 2007, Johannes Berg <johannes@sipsolutions.net>
   6  * Copyright (c) 2009-2010, Atheros Communications
   7  *
   8  * This software may be distributed under the terms of the BSD license.
   9  * See README for more details.
  10  */
  11
  12 #include "includes.h"
  13 #include <netlink/genl/genl.h>
  14
  15 #include "utils/common.h"
  16 #include "utils/eloop.h"
  17 #include "common/ieee802_11_defs.h"
  18 #include "common/qca-vendor.h"
  19 #include "driver_nl80211.h"
  20
  21
  22 static int get_noise_for_scan_results(struct nl_msg *msg, void *arg)
  23 {
  24         struct nlattr *tb[NL80211_ATTR_MAX + 1];
  25         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
  26         struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
  27         static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
  28                 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
  29                 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
  30         };
  31         struct wpa_scan_results *scan_results = arg;
  32         struct wpa_scan_res *scan_res;
  33         size_t i;
  34
  35         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
  36                   genlmsg_attrlen(gnlh, 0), NULL);
  37
  38         if (!tb[NL80211_ATTR_SURVEY_INFO]) {
  39                 wpa_printf(MSG_DEBUG, "nl80211: Survey data missing");
  40                 return NL_SKIP;
  41         }
  42
  43         if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
  44                              tb[NL80211_ATTR_SURVEY_INFO],
  45                              survey_policy)) {
  46                 wpa_printf(MSG_DEBUG, "nl80211: Failed to parse nested "
  47                            "attributes");
  48                 return NL_SKIP;
  49         }
  50
  51         if (!sinfo[NL80211_SURVEY_INFO_NOISE])
  52                 return NL_SKIP;
  53
  54         if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY])
  55                 return NL_SKIP;
  56
  57         for (i = 0; i < scan_results->num; ++i) {
  58                 scan_res = scan_results->res[i];
  59                 if (!scan_res)
  60                         continue;
  61                 if ((int) nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]) !=
  62                     scan_res->freq)
  63                         continue;
  64                 if (!(scan_res->flags & WPA_SCAN_NOISE_INVALID))
  65                         continue;
  66                 scan_res->noise = (s8)
  67                         nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
  68                 scan_res->flags &= ~WPA_SCAN_NOISE_INVALID;
  69         }
  70
  71         return NL_SKIP;
  72 }
  73
  74
  75 static int nl80211_get_noise_for_scan_results(
  76         struct wpa_driver_nl80211_data *drv,
  77         struct wpa_scan_results *scan_res)
  78 {
  79         struct nl_msg *msg;
  80
  81         msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_GET_SURVEY);
  82         return send_and_recv_msgs(drv, msg, get_noise_for_scan_results,
  83                                   scan_res);
  84 }
  85
  86
  87 /**
  88  * wpa_driver_nl80211_scan_timeout - Scan timeout to report scan completion
  89  * @eloop_ctx: Driver private data
  90  * @timeout_ctx: ctx argument given to wpa_driver_nl80211_init()
  91  *
  92  * This function can be used as registered timeout when starting a scan to
  93  * generate a scan completed event if the driver does not report this.
  94  */
  95 void wpa_driver_nl80211_scan_timeout(void *eloop_ctx, void *timeout_ctx)
  96 {
  97         struct wpa_driver_nl80211_data *drv = eloop_ctx;
  98         if (drv->ap_scan_as_station != NL80211_IFTYPE_UNSPECIFIED) {
  99                 wpa_driver_nl80211_set_mode(drv->first_bss,
 100                                             drv->ap_scan_as_station);
 101                 drv->ap_scan_as_station = NL80211_IFTYPE_UNSPECIFIED;
 102         }
 103         wpa_printf(MSG_DEBUG, "Scan timeout - try to get results");
 104         wpa_supplicant_event(timeout_ctx, EVENT_SCAN_RESULTS, NULL);
 105 }
 106
 107
 108 static struct nl_msg *
 109 nl80211_scan_common(struct i802_bss *bss, u8 cmd,
 110                     struct wpa_driver_scan_params *params)
 111 {
 112         struct wpa_driver_nl80211_data *drv = bss->drv;
 113         struct nl_msg *msg;
 114         size_t i;
 115         u32 scan_flags = 0;
 116
 117         msg = nl80211_cmd_msg(bss, 0, cmd);
 118         if (!msg)
 119                 return NULL;
 120
 121         if (params->num_ssids) {
 122                 struct nlattr *ssids;
 123
 124                 ssids = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
 125                 if (ssids == NULL)
 126                         goto fail;
 127                 for (i = 0; i < params->num_ssids; i++) {
 128                         wpa_hexdump_ascii(MSG_MSGDUMP, "nl80211: Scan SSID",
 129                                           params->ssids[i].ssid,
 130                                           params->ssids[i].ssid_len);
 131                         if (nla_put(msg, i + 1, params->ssids[i].ssid_len,
 132                                     params->ssids[i].ssid))
 133                                 goto fail;
 134                 }
 135                 nla_nest_end(msg, ssids);
 136         } else {
 137                 wpa_printf(MSG_DEBUG, "nl80211: Passive scan requested");
 138         }
 139
 140         if (params->extra_ies) {
 141                 wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan extra IEs",
 142                             params->extra_ies, params->extra_ies_len);
 143                 if (nla_put(msg, NL80211_ATTR_IE, params->extra_ies_len,
 144                             params->extra_ies))
 145                         goto fail;
 146         }
 147
 148         if (params->freqs) {
 149                 struct nlattr *freqs;
 150                 freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
 151                 if (freqs == NULL)
 152                         goto fail;
 153                 for (i = 0; params->freqs[i]; i++) {
 154                         wpa_printf(MSG_MSGDUMP, "nl80211: Scan frequency %u "
 155                                    "MHz", params->freqs[i]);
 156                         if (nla_put_u32(msg, i + 1, params->freqs[i]))
 157                                 goto fail;
 158                 }
 159                 nla_nest_end(msg, freqs);
 160         }
 161
 162         os_free(drv->filter_ssids);
 163         drv->filter_ssids = params->filter_ssids;
 164         params->filter_ssids = NULL;
 165         drv->num_filter_ssids = params->num_filter_ssids;
 166
 167         if (params->only_new_results) {
 168                 wpa_printf(MSG_DEBUG, "nl80211: Add NL80211_SCAN_FLAG_FLUSH");
 169                 scan_flags |= NL80211_SCAN_FLAG_FLUSH;
 170         }
 171
 172         if (params->low_priority && drv->have_low_prio_scan) {
 173                 wpa_printf(MSG_DEBUG,
 174                            "nl80211: Add NL80211_SCAN_FLAG_LOW_PRIORITY");
 175                 scan_flags |= NL80211_SCAN_FLAG_LOW_PRIORITY;
 176         }
 177
 178         if (params->mac_addr_rand) {
 179                 wpa_printf(MSG_DEBUG,
 180                            "nl80211: Add NL80211_SCAN_FLAG_RANDOM_ADDR");
 181                 scan_flags |= NL80211_SCAN_FLAG_RANDOM_ADDR;
 182
 183                 if (params->mac_addr) {
 184                         wpa_printf(MSG_DEBUG, "nl80211: MAC address: " MACSTR,
 185                                    MAC2STR(params->mac_addr));
 186                         if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
 187                                     params->mac_addr))
 188                                 goto fail;
 189                 }
 190
 191                 if (params->mac_addr_mask) {
 192                         wpa_printf(MSG_DEBUG, "nl80211: MAC address mask: "
 193                                    MACSTR, MAC2STR(params->mac_addr_mask));
 194                         if (nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN,
 195                                     params->mac_addr_mask))
 196                                 goto fail;
 197                 }
 198         }
 199
 200         if (scan_flags &&
 201             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, scan_flags))
 202                 goto fail;
 203
 204         return msg;
 205
 206 fail:
 207         nlmsg_free(msg);
 208         return NULL;
 209 }
 210
 211
 212 /**
 213  * wpa_driver_nl80211_scan - Request the driver to initiate scan
 214  * @bss: Pointer to private driver data from wpa_driver_nl80211_init()
 215  * @params: Scan parameters
 216  * Returns: 0 on success, -1 on failure
 217  */
 218 int wpa_driver_nl80211_scan(struct i802_bss *bss,
 219                             struct wpa_driver_scan_params *params)
 220 {
 221         struct wpa_driver_nl80211_data *drv = bss->drv;
 222         int ret = -1, timeout;
 223         struct nl_msg *msg = NULL;
 224
 225         wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: scan request");
 226         drv->scan_for_auth = 0;
 227
 228         if (TEST_FAIL())
 229                 return -1;
 230
 231         msg = nl80211_scan_common(bss, NL80211_CMD_TRIGGER_SCAN, params);
 232         if (!msg)
 233                 return -1;
 234
 235         if (params->p2p_probe) {
 236                 struct nlattr *rates;
 237
 238                 wpa_printf(MSG_DEBUG, "nl80211: P2P probe - mask SuppRates");
 239
 240                 rates = nla_nest_start(msg, NL80211_ATTR_SCAN_SUPP_RATES);
 241                 if (rates == NULL)
 242                         goto fail;
 243
 244                 /*
 245                  * Remove 2.4 GHz rates 1, 2, 5.5, 11 Mbps from supported rates
 246                  * by masking out everything else apart from the OFDM rates 6,
 247                  * 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS rates. All 5 GHz
 248                  * rates are left enabled.
 249                  */
 250                 if (nla_put(msg, NL80211_BAND_2GHZ, 8,
 251                             "\x0c\x12\x18\x24\x30\x48\x60\x6c"))
 252                         goto fail;
 253                 nla_nest_end(msg, rates);
 254
 255                 if (nla_put_flag(msg, NL80211_ATTR_TX_NO_CCK_RATE))
 256                         goto fail;
 257         }
 258
 259         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
 260         msg = NULL;
 261         if (ret) {
 262                 wpa_printf(MSG_DEBUG, "nl80211: Scan trigger failed: ret=%d "
 263                            "(%s)", ret, strerror(-ret));
 264                 if (drv->hostapd && is_ap_interface(drv->nlmode)) {
 265                         enum nl80211_iftype old_mode = drv->nlmode;
 266
 267                         /*
 268                          * mac80211 does not allow scan requests in AP mode, so
 269                          * try to do this in station mode.
 270                          */
 271                         if (wpa_driver_nl80211_set_mode(
 272                                     bss, NL80211_IFTYPE_STATION))
 273                                 goto fail;
 274
 275                         if (wpa_driver_nl80211_scan(bss, params)) {
 276                                 wpa_driver_nl80211_set_mode(bss, old_mode);
 277                                 goto fail;
 278                         }
 279
 280                         /* Restore AP mode when processing scan results */
 281                         drv->ap_scan_as_station = old_mode;
 282                         ret = 0;
 283                 } else
 284                         goto fail;
 285         }
 286
 287         drv->scan_state = SCAN_REQUESTED;
 288         /* Not all drivers generate "scan completed" wireless event, so try to
 289          * read results after a timeout. */
 290         timeout = 10;
 291         if (drv->scan_complete_events) {
 292                 /*
 293                  * The driver seems to deliver events to notify when scan is
 294                  * complete, so use longer timeout to avoid race conditions
 295                  * with scanning and following association request.
 296                  */
 297                 timeout = 30;
 298         }
 299         wpa_printf(MSG_DEBUG, "Scan requested (ret=%d) - scan timeout %d "
 300                    "seconds", ret, timeout);
 301         eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
 302         eloop_register_timeout(timeout, 0, wpa_driver_nl80211_scan_timeout,
 303                                drv, drv->ctx);
 304         drv->last_scan_cmd = NL80211_CMD_TRIGGER_SCAN;
 305
 306 fail:
 307         nlmsg_free(msg);
 308         return ret;
 309 }
 310
 311
 312 static int
 313 nl80211_sched_scan_add_scan_plans(struct wpa_driver_nl80211_data *drv,
 314                                   struct nl_msg *msg,
 315                                   struct wpa_driver_scan_params *params)
 316 {
 317         struct nlattr *plans;
 318         struct sched_scan_plan *scan_plans = params->sched_scan_plans;
 319         unsigned int i;
 320
 321         plans = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
 322         if (!plans)
 323                 return -1;
 324
 325         for (i = 0; i < params->sched_scan_plans_num; i++) {
 326                 struct nlattr *plan = nla_nest_start(msg, i + 1);
 327
 328                 if (!plan)
 329                         return -1;
 330
 331                 if (!scan_plans[i].interval ||
 332                     scan_plans[i].interval >
 333                     drv->capa.max_sched_scan_plan_interval) {
 334                         wpa_printf(MSG_DEBUG,
 335                                    "nl80211: sched scan plan no. %u: Invalid interval: %u",
 336                                    i, scan_plans[i].interval);
 337                         return -1;
 338                 }
 339
 340                 if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
 341                                 scan_plans[i].interval))
 342                         return -1;
 343
 344                 if (scan_plans[i].iterations >
 345                     drv->capa.max_sched_scan_plan_iterations) {
 346                         wpa_printf(MSG_DEBUG,
 347                                    "nl80211: sched scan plan no. %u: Invalid number of iterations: %u",
 348                                    i, scan_plans[i].iterations);
 349                         return -1;
 350                 }
 351
 352                 if (scan_plans[i].iterations &&
 353                     nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
 354                                 scan_plans[i].iterations))
 355                         return -1;
 356
 357                 nla_nest_end(msg, plan);
 358
 359                 /*
 360                  * All the scan plans must specify the number of iterations
 361                  * except the last plan, which will run infinitely. So if the
 362                  * number of iterations is not specified, this ought to be the
 363                  * last scan plan.
 364                  */
 365                 if (!scan_plans[i].iterations)
 366                         break;
 367         }
 368
 369         if (i != params->sched_scan_plans_num - 1) {
 370                 wpa_printf(MSG_DEBUG,
 371                            "nl80211: All sched scan plans but the last must specify number of iterations");
 372                 return -1;
 373         }
 374
 375         nla_nest_end(msg, plans);
 376         return 0;
 377 }
 378
 379
 380 /**
 381  * wpa_driver_nl80211_sched_scan - Initiate a scheduled scan
 382  * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
 383  * @params: Scan parameters
 384  * Returns: 0 on success, -1 on failure or if not supported
 385  */
 386 int wpa_driver_nl80211_sched_scan(void *priv,
 387                                   struct wpa_driver_scan_params *params)
 388 {
 389         struct i802_bss *bss = priv;
 390         struct wpa_driver_nl80211_data *drv = bss->drv;
 391         int ret = -1;
 392         struct nl_msg *msg;
 393         size_t i;
 394
 395         wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: sched_scan request");
 396
 397 #ifdef ANDROID
 398         if (!drv->capa.sched_scan_supported)
 399                 return android_pno_start(bss, params);
 400 #endif /* ANDROID */
 401
 402         if (!params->sched_scan_plans_num ||
 403             params->sched_scan_plans_num > drv->capa.max_sched_scan_plans) {
 404                 wpa_printf(MSG_ERROR,
 405                            "nl80211: Invalid number of sched scan plans: %u",
 406                            params->sched_scan_plans_num);
 407                 return -1;
 408         }
 409
 410         msg = nl80211_scan_common(bss, NL80211_CMD_START_SCHED_SCAN, params);
 411         if (!msg)
 412                 goto fail;
 413
 414         if (drv->capa.max_sched_scan_plan_iterations) {
 415                 if (nl80211_sched_scan_add_scan_plans(drv, msg, params))
 416                         goto fail;
 417         } else {
 418                 if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
 419                                 params->sched_scan_plans[0].interval * 1000))
 420                         goto fail;
 421         }
 422
 423         if ((drv->num_filter_ssids &&
 424             (int) drv->num_filter_ssids <= drv->capa.max_match_sets) ||
 425             params->filter_rssi) {
 426                 struct nlattr *match_sets;
 427                 match_sets = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
 428                 if (match_sets == NULL)
 429                         goto fail;
 430
 431                 for (i = 0; i < drv->num_filter_ssids; i++) {
 432                         struct nlattr *match_set_ssid;
 433                         wpa_hexdump_ascii(MSG_MSGDUMP,
 434                                           "nl80211: Sched scan filter SSID",
 435                                           drv->filter_ssids[i].ssid,
 436                                           drv->filter_ssids[i].ssid_len);
 437
 438                         match_set_ssid = nla_nest_start(msg, i + 1);
 439                         if (match_set_ssid == NULL ||
 440                             nla_put(msg, NL80211_ATTR_SCHED_SCAN_MATCH_SSID,
 441                                     drv->filter_ssids[i].ssid_len,
 442                                     drv->filter_ssids[i].ssid) ||
 443                             (params->filter_rssi &&
 444                              nla_put_u32(msg,
 445                                          NL80211_SCHED_SCAN_MATCH_ATTR_RSSI,
 446                                          params->filter_rssi)))
 447                                 goto fail;
 448
 449                         nla_nest_end(msg, match_set_ssid);
 450                 }
 451
 452                 /*
 453                  * Due to backward compatibility code, newer kernels treat this
 454                  * matchset (with only an RSSI filter) as the default for all
 455                  * other matchsets, unless it's the only one, in which case the
 456                  * matchset will actually allow all SSIDs above the RSSI.
 457                  */
 458                 if (params->filter_rssi) {
 459                         struct nlattr *match_set_rssi;
 460                         match_set_rssi = nla_nest_start(msg, 0);
 461                         if (match_set_rssi == NULL ||
 462                             nla_put_u32(msg, NL80211_SCHED_SCAN_MATCH_ATTR_RSSI,
 463                                         params->filter_rssi))
 464                                 goto fail;
 465                         wpa_printf(MSG_MSGDUMP,
 466                                    "nl80211: Sched scan RSSI filter %d dBm",
 467                                    params->filter_rssi);
 468                         nla_nest_end(msg, match_set_rssi);
 469                 }
 470
 471                 nla_nest_end(msg, match_sets);
 472         }
 473
 474         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
 475
 476         /* TODO: if we get an error here, we should fall back to normal scan */
 477
 478         msg = NULL;
 479         if (ret) {
 480                 wpa_printf(MSG_DEBUG, "nl80211: Sched scan start failed: "
 481                            "ret=%d (%s)", ret, strerror(-ret));
 482                 goto fail;
 483         }
 484
 485         wpa_printf(MSG_DEBUG, "nl80211: Sched scan requested (ret=%d)", ret);
 486
 487 fail:
 488         nlmsg_free(msg);
 489         return ret;
 490 }
 491
 492
 493 /**
 494  * wpa_driver_nl80211_stop_sched_scan - Stop a scheduled scan
 495  * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
 496  * Returns: 0 on success, -1 on failure or if not supported
 497  */
 498 int wpa_driver_nl80211_stop_sched_scan(void *priv)
 499 {
 500         struct i802_bss *bss = priv;
 501         struct wpa_driver_nl80211_data *drv = bss->drv;
 502         int ret;
 503         struct nl_msg *msg;
 504
 505 #ifdef ANDROID
 506         if (!drv->capa.sched_scan_supported)
 507                 return android_pno_stop(bss);
 508 #endif /* ANDROID */
 509
 510         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_STOP_SCHED_SCAN);
 511         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
 512         if (ret) {
 513                 wpa_printf(MSG_DEBUG,
 514                            "nl80211: Sched scan stop failed: ret=%d (%s)",
 515                            ret, strerror(-ret));
 516         } else {
 517                 wpa_printf(MSG_DEBUG,
 518                            "nl80211: Sched scan stop sent");
 519         }
 520
 521         return ret;
 522 }
 523
 524
 525 const u8 * nl80211_get_ie(const u8 *ies, size_t ies_len, u8 ie)
 526 {
 527         const u8 *end, *pos;
 528
 529         if (ies == NULL)
 530                 return NULL;
 531
 532         pos = ies;
 533         end = ies + ies_len;
 534
 535         while (end - pos > 1) {
 536                 if (2 + pos[1] > end - pos)
 537                         break;
 538                 if (pos[0] == ie)
 539                         return pos;
 540                 pos += 2 + pos[1];
 541         }
 542
 543         return NULL;
 544 }
 545
 546
 547 static int nl80211_scan_filtered(struct wpa_driver_nl80211_data *drv,
 548                                  const u8 *ie, size_t ie_len)
 549 {
 550         const u8 *ssid;
 551         size_t i;
 552
 553         if (drv->filter_ssids == NULL)
 554                 return 0;
 555
 556         ssid = nl80211_get_ie(ie, ie_len, WLAN_EID_SSID);
 557         if (ssid == NULL)
 558                 return 1;
 559
 560         for (i = 0; i < drv->num_filter_ssids; i++) {
 561                 if (ssid[1] == drv->filter_ssids[i].ssid_len &&
 562                     os_memcmp(ssid + 2, drv->filter_ssids[i].ssid, ssid[1]) ==
 563                     0)
 564                         return 0;
 565         }
 566
 567         return 1;
 568 }
 569
 570
 571 int bss_info_handler(struct nl_msg *msg, void *arg)
 572 {
 573         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 574         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 575         struct nlattr *bss[NL80211_BSS_MAX + 1];
 576         static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = {
 577                 [NL80211_BSS_BSSID] = { .type = NLA_UNSPEC },
 578                 [NL80211_BSS_FREQUENCY] = { .type = NLA_U32 },
 579                 [NL80211_BSS_TSF] = { .type = NLA_U64 },
 580                 [NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 },
 581                 [NL80211_BSS_CAPABILITY] = { .type = NLA_U16 },
 582                 [NL80211_BSS_INFORMATION_ELEMENTS] = { .type = NLA_UNSPEC },
 583                 [NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 },
 584                 [NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 },
 585                 [NL80211_BSS_STATUS] = { .type = NLA_U32 },
 586                 [NL80211_BSS_SEEN_MS_AGO] = { .type = NLA_U32 },
 587                 [NL80211_BSS_BEACON_IES] = { .type = NLA_UNSPEC },
 588         };
 589         struct nl80211_bss_info_arg *_arg = arg;
 590         struct wpa_scan_results *res = _arg->res;
 591         struct wpa_scan_res **tmp;
 592         struct wpa_scan_res *r;
 593         const u8 *ie, *beacon_ie;
 594         size_t ie_len, beacon_ie_len;
 595         u8 *pos;
 596         size_t i;
 597
 598         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 599                   genlmsg_attrlen(gnlh, 0), NULL);
 600         if (!tb[NL80211_ATTR_BSS])
 601                 return NL_SKIP;
 602         if (nla_parse_nested(bss, NL80211_BSS_MAX, tb[NL80211_ATTR_BSS],
 603                              bss_policy))
 604                 return NL_SKIP;
 605         if (bss[NL80211_BSS_STATUS]) {
 606                 enum nl80211_bss_status status;
 607                 status = nla_get_u32(bss[NL80211_BSS_STATUS]);
 608                 if (status == NL80211_BSS_STATUS_ASSOCIATED &&
 609                     bss[NL80211_BSS_FREQUENCY]) {
 610                         _arg->assoc_freq =
 611                                 nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
 612                         wpa_printf(MSG_DEBUG, "nl80211: Associated on %u MHz",
 613                                    _arg->assoc_freq);
 614                 }
 615                 if (status == NL80211_BSS_STATUS_IBSS_JOINED &&
 616                     bss[NL80211_BSS_FREQUENCY]) {
 617                         _arg->ibss_freq =
 618                                 nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
 619                         wpa_printf(MSG_DEBUG, "nl80211: IBSS-joined on %u MHz",
 620                                    _arg->ibss_freq);
 621                 }
 622                 if (status == NL80211_BSS_STATUS_ASSOCIATED &&
 623                     bss[NL80211_BSS_BSSID]) {
 624                         os_memcpy(_arg->assoc_bssid,
 625                                   nla_data(bss[NL80211_BSS_BSSID]), ETH_ALEN);
 626                         wpa_printf(MSG_DEBUG, "nl80211: Associated with "
 627                                    MACSTR, MAC2STR(_arg->assoc_bssid));
 628                 }
 629         }
 630         if (!res)
 631                 return NL_SKIP;
 632         if (bss[NL80211_BSS_INFORMATION_ELEMENTS]) {
 633                 ie = nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
 634                 ie_len = nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
 635         } else {
 636                 ie = NULL;
 637                 ie_len = 0;
 638         }
 639         if (bss[NL80211_BSS_BEACON_IES]) {
 640                 beacon_ie = nla_data(bss[NL80211_BSS_BEACON_IES]);
 641                 beacon_ie_len = nla_len(bss[NL80211_BSS_BEACON_IES]);
 642         } else {
 643                 beacon_ie = NULL;
 644                 beacon_ie_len = 0;
 645         }
 646
 647         if (nl80211_scan_filtered(_arg->drv, ie ? ie : beacon_ie,
 648                                   ie ? ie_len : beacon_ie_len))
 649                 return NL_SKIP;
 650
 651         r = os_zalloc(sizeof(*r) + ie_len + beacon_ie_len);
 652         if (r == NULL)
 653                 return NL_SKIP;
 654         if (bss[NL80211_BSS_BSSID])
 655                 os_memcpy(r->bssid, nla_data(bss[NL80211_BSS_BSSID]),
 656                           ETH_ALEN);
 657         if (bss[NL80211_BSS_FREQUENCY])
 658                 r->freq = nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
 659         if (bss[NL80211_BSS_BEACON_INTERVAL])
 660                 r->beacon_int = nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]);
 661         if (bss[NL80211_BSS_CAPABILITY])
 662                 r->caps = nla_get_u16(bss[NL80211_BSS_CAPABILITY]);
 663         r->flags |= WPA_SCAN_NOISE_INVALID;
 664         if (bss[NL80211_BSS_SIGNAL_MBM]) {
 665                 r->level = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]);
 666                 r->level /= 100; /* mBm to dBm */
 667                 r->flags |= WPA_SCAN_LEVEL_DBM | WPA_SCAN_QUAL_INVALID;
 668         } else if (bss[NL80211_BSS_SIGNAL_UNSPEC]) {
 669                 r->level = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]);
 670                 r->flags |= WPA_SCAN_QUAL_INVALID;
 671         } else
 672                 r->flags |= WPA_SCAN_LEVEL_INVALID | WPA_SCAN_QUAL_INVALID;
 673         if (bss[NL80211_BSS_TSF])
 674                 r->tsf = nla_get_u64(bss[NL80211_BSS_TSF]);
 675         if (bss[NL80211_BSS_BEACON_TSF]) {
 676                 u64 tsf = nla_get_u64(bss[NL80211_BSS_BEACON_TSF]);
 677                 if (tsf > r->tsf)
 678                         r->tsf = tsf;
 679         }
 680         if (bss[NL80211_BSS_SEEN_MS_AGO])
 681                 r->age = nla_get_u32(bss[NL80211_BSS_SEEN_MS_AGO]);
 682         r->ie_len = ie_len;
 683         pos = (u8 *) (r + 1);
 684         if (ie) {
 685                 os_memcpy(pos, ie, ie_len);
 686                 pos += ie_len;
 687         }
 688         r->beacon_ie_len = beacon_ie_len;
 689         if (beacon_ie)
 690                 os_memcpy(pos, beacon_ie, beacon_ie_len);
 691
 692         if (bss[NL80211_BSS_STATUS]) {
 693                 enum nl80211_bss_status status;
 694                 status = nla_get_u32(bss[NL80211_BSS_STATUS]);
 695                 switch (status) {
 696                 case NL80211_BSS_STATUS_ASSOCIATED:
 697                         r->flags |= WPA_SCAN_ASSOCIATED;
 698                         break;
 699                 default:
 700                         break;
 701                 }
 702         }
 703
 704         /*
 705          * cfg80211 maintains separate BSS table entries for APs if the same
 706          * BSSID,SSID pair is seen on multiple channels. wpa_supplicant does
 707          * not use frequency as a separate key in the BSS table, so filter out
 708          * duplicated entries. Prefer associated BSS entry in such a case in
 709          * order to get the correct frequency into the BSS table. Similarly,
 710          * prefer newer entries over older.
 711          */
 712         for (i = 0; i < res->num; i++) {
 713                 const u8 *s1, *s2;
 714                 if (os_memcmp(res->res[i]->bssid, r->bssid, ETH_ALEN) != 0)
 715                         continue;
 716
 717                 s1 = nl80211_get_ie((u8 *) (res->res[i] + 1),
 718                                     res->res[i]->ie_len, WLAN_EID_SSID);
 719                 s2 = nl80211_get_ie((u8 *) (r + 1), r->ie_len, WLAN_EID_SSID);
 720                 if (s1 == NULL || s2 == NULL || s1[1] != s2[1] ||
 721                     os_memcmp(s1, s2, 2 + s1[1]) != 0)
 722                         continue;
 723
 724                 /* Same BSSID,SSID was already included in scan results */
 725                 wpa_printf(MSG_DEBUG, "nl80211: Remove duplicated scan result "
 726                            "for " MACSTR, MAC2STR(r->bssid));
 727
 728                 if (((r->flags & WPA_SCAN_ASSOCIATED) &&
 729                      !(res->res[i]->flags & WPA_SCAN_ASSOCIATED)) ||
 730                     r->age < res->res[i]->age) {
 731                         os_free(res->res[i]);
 732                         res->res[i] = r;
 733                 } else
 734                         os_free(r);
 735                 return NL_SKIP;
 736         }
 737
 738         tmp = os_realloc_array(res->res, res->num + 1,
 739                                sizeof(struct wpa_scan_res *));
 740         if (tmp == NULL) {
 741                 os_free(r);
 742                 return NL_SKIP;
 743         }
 744         tmp[res->num++] = r;
 745         res->res = tmp;
 746
 747         return NL_SKIP;
 748 }
 749
 750
 751 static void clear_state_mismatch(struct wpa_driver_nl80211_data *drv,
 752                                  const u8 *addr)
 753 {
 754         if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) {
 755                 wpa_printf(MSG_DEBUG, "nl80211: Clear possible state "
 756                            "mismatch (" MACSTR ")", MAC2STR(addr));
 757                 wpa_driver_nl80211_mlme(drv, addr,
 758                                         NL80211_CMD_DEAUTHENTICATE,
 759                                         WLAN_REASON_PREV_AUTH_NOT_VALID, 1);
 760         }
 761 }
 762
 763
 764 static void wpa_driver_nl80211_check_bss_status(
 765         struct wpa_driver_nl80211_data *drv, struct wpa_scan_results *res)
 766 {
 767         size_t i;
 768
 769         for (i = 0; i < res->num; i++) {
 770                 struct wpa_scan_res *r = res->res[i];
 771
 772                 if (r->flags & WPA_SCAN_ASSOCIATED) {
 773                         wpa_printf(MSG_DEBUG, "nl80211: Scan results "
 774                                    "indicate BSS status with " MACSTR
 775                                    " as associated",
 776                                    MAC2STR(r->bssid));
 777                         if (is_sta_interface(drv->nlmode) &&
 778                             !drv->associated) {
 779                                 wpa_printf(MSG_DEBUG, "nl80211: Local state "
 780                                            "(not associated) does not match "
 781                                            "with BSS state");
 782                                 clear_state_mismatch(drv, r->bssid);
 783                         } else if (is_sta_interface(drv->nlmode) &&
 784                                    os_memcmp(drv->bssid, r->bssid, ETH_ALEN) !=
 785                                    0) {
 786                                 wpa_printf(MSG_DEBUG, "nl80211: Local state "
 787                                            "(associated with " MACSTR ") does "
 788                                            "not match with BSS state",
 789                                            MAC2STR(drv->bssid));
 790                                 clear_state_mismatch(drv, r->bssid);
 791                                 clear_state_mismatch(drv, drv->bssid);
 792                         }
 793                 }
 794         }
 795 }
 796
 797
 798 static struct wpa_scan_results *
 799 nl80211_get_scan_results(struct wpa_driver_nl80211_data *drv)
 800 {
 801         struct nl_msg *msg;
 802         struct wpa_scan_results *res;
 803         int ret;
 804         struct nl80211_bss_info_arg arg;
 805
 806         res = os_zalloc(sizeof(*res));
 807         if (res == NULL)
 808                 return NULL;
 809         if (!(msg = nl80211_cmd_msg(drv->first_bss, NLM_F_DUMP,
 810                                     NL80211_CMD_GET_SCAN))) {
 811                 wpa_scan_results_free(res);
 812                 return NULL;
 813         }
 814
 815         arg.drv = drv;
 816         arg.res = res;
 817         ret = send_and_recv_msgs(drv, msg, bss_info_handler, &arg);
 818         if (ret == 0) {
 819                 wpa_printf(MSG_DEBUG, "nl80211: Received scan results (%lu "
 820                            "BSSes)", (unsigned long) res->num);
 821                 nl80211_get_noise_for_scan_results(drv, res);
 822                 return res;
 823         }
 824         wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d "
 825                    "(%s)", ret, strerror(-ret));
 826         wpa_scan_results_free(res);
 827         return NULL;
 828 }
 829
 830
 831 /**
 832  * wpa_driver_nl80211_get_scan_results - Fetch the latest scan results
 833  * @priv: Pointer to private wext data from wpa_driver_nl80211_init()
 834  * Returns: Scan results on success, -1 on failure
 835  */
 836 struct wpa_scan_results * wpa_driver_nl80211_get_scan_results(void *priv)
 837 {
 838         struct i802_bss *bss = priv;
 839         struct wpa_driver_nl80211_data *drv = bss->drv;
 840         struct wpa_scan_results *res;
 841
 842         res = nl80211_get_scan_results(drv);
 843         if (res)
 844                 wpa_driver_nl80211_check_bss_status(drv, res);
 845         return res;
 846 }
 847
 848
 849 void nl80211_dump_scan(struct wpa_driver_nl80211_data *drv)
 850 {
 851         struct wpa_scan_results *res;
 852         size_t i;
 853
 854         res = nl80211_get_scan_results(drv);
 855         if (res == NULL) {
 856                 wpa_printf(MSG_DEBUG, "nl80211: Failed to get scan results");
 857                 return;
 858         }
 859
 860         wpa_printf(MSG_DEBUG, "nl80211: Scan result dump");
 861         for (i = 0; i < res->num; i++) {
 862                 struct wpa_scan_res *r = res->res[i];
 863                 wpa_printf(MSG_DEBUG, "nl80211: %d/%d " MACSTR "%s",
 864                            (int) i, (int) res->num, MAC2STR(r->bssid),
 865                            r->flags & WPA_SCAN_ASSOCIATED ? " [assoc]" : "");
 866         }
 867
 868         wpa_scan_results_free(res);
 869 }
 870
 871
 872 int wpa_driver_nl80211_abort_scan(void *priv)
 873 {
 874         struct i802_bss *bss = priv;
 875         struct wpa_driver_nl80211_data *drv = bss->drv;
 876         int ret;
 877         struct nl_msg *msg;
 878
 879         wpa_printf(MSG_DEBUG, "nl80211: Abort scan");
 880         msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_ABORT_SCAN);
 881         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
 882         if (ret) {
 883                 wpa_printf(MSG_DEBUG, "nl80211: Abort scan failed: ret=%d (%s)",
 884                            ret, strerror(-ret));
 885         }
 886
 887         return ret;
 888 }
 889
 890
 891 #ifdef CONFIG_DRIVER_NL80211_QCA
 892
 893 static int scan_cookie_handler(struct nl_msg *msg, void *arg)
 894 {
 895         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 896         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 897         u64 *cookie = arg;
 898
 899         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 900                   genlmsg_attrlen(gnlh, 0), NULL);
 901
 902         if (tb[NL80211_ATTR_VENDOR_DATA]) {
 903                 struct nlattr *nl_vendor = tb[NL80211_ATTR_VENDOR_DATA];
 904                 struct nlattr *tb_vendor[QCA_WLAN_VENDOR_ATTR_SCAN_MAX + 1];
 905
 906                 nla_parse(tb_vendor, QCA_WLAN_VENDOR_ATTR_SCAN_MAX,
 907                           nla_data(nl_vendor), nla_len(nl_vendor), NULL);
 908
 909                 if (tb_vendor[QCA_WLAN_VENDOR_ATTR_SCAN_COOKIE])
 910                         *cookie = nla_get_u64(
 911                                 tb_vendor[QCA_WLAN_VENDOR_ATTR_SCAN_COOKIE]);
 912         }
 913
 914         return NL_SKIP;
 915 }
 916
 917
 918 /**
 919  * wpa_driver_nl80211_vendor_scan - Request the driver to initiate a vendor scan
 920  * @bss: Pointer to private driver data from wpa_driver_nl80211_init()
 921  * @params: Scan parameters
 922  * Returns: 0 on success, -1 on failure
 923  */
 924 int wpa_driver_nl80211_vendor_scan(struct i802_bss *bss,
 925                                    struct wpa_driver_scan_params *params)
 926 {
 927         struct wpa_driver_nl80211_data *drv = bss->drv;
 928         struct nl_msg *msg = NULL;
 929         struct nlattr *attr;
 930         size_t i;
 931         u32 scan_flags = 0;
 932         int ret = -1;
 933         u64 cookie = 0;
 934
 935         wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: vendor scan request");
 936         drv->scan_for_auth = 0;
 937
 938         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
 939             nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
 940             nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
 941                         QCA_NL80211_VENDOR_SUBCMD_TRIGGER_SCAN) )
 942                 goto fail;
 943
 944         attr = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
 945         if (attr == NULL)
 946                 goto fail;
 947
 948         if (params->num_ssids) {
 949                 struct nlattr *ssids;
 950
 951                 ssids = nla_nest_start(msg, QCA_WLAN_VENDOR_ATTR_SCAN_SSIDS);
 952                 if (ssids == NULL)
 953                         goto fail;
 954                 for (i = 0; i < params->num_ssids; i++) {
 955                         wpa_hexdump_ascii(MSG_MSGDUMP, "nl80211: Scan SSID",
 956                                         params->ssids[i].ssid,
 957                                         params->ssids[i].ssid_len);
 958                         if (nla_put(msg, i + 1, params->ssids[i].ssid_len,
 959                                     params->ssids[i].ssid))
 960                                 goto fail;
 961                 }
 962                 nla_nest_end(msg, ssids);
 963         }
 964
 965         if (params->extra_ies) {
 966                 wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan extra IEs",
 967                             params->extra_ies, params->extra_ies_len);
 968                 if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_SCAN_IE,
 969                             params->extra_ies_len, params->extra_ies))
 970                         goto fail;
 971         }
 972
 973         if (params->freqs) {
 974                 struct nlattr *freqs;
 975
 976                 freqs = nla_nest_start(msg,
 977                                        QCA_WLAN_VENDOR_ATTR_SCAN_FREQUENCIES);
 978                 if (freqs == NULL)
 979                         goto fail;
 980                 for (i = 0; params->freqs[i]; i++) {
 981                         wpa_printf(MSG_MSGDUMP,
 982                                    "nl80211: Scan frequency %u MHz",
 983                                    params->freqs[i]);
 984                         if (nla_put_u32(msg, i + 1, params->freqs[i]))
 985                                 goto fail;
 986                 }
 987                 nla_nest_end(msg, freqs);
 988         }
 989
 990         os_free(drv->filter_ssids);
 991         drv->filter_ssids = params->filter_ssids;
 992         params->filter_ssids = NULL;
 993         drv->num_filter_ssids = params->num_filter_ssids;
 994
 995         if (params->low_priority && drv->have_low_prio_scan) {
 996                 wpa_printf(MSG_DEBUG,
 997                            "nl80211: Add NL80211_SCAN_FLAG_LOW_PRIORITY");
 998                 scan_flags |= NL80211_SCAN_FLAG_LOW_PRIORITY;
 999         }
1000
1001         if (params->mac_addr_rand) {
1002                 wpa_printf(MSG_DEBUG,
1003                            "nl80211: Add NL80211_SCAN_FLAG_RANDOM_ADDR");
1004                 scan_flags |= NL80211_SCAN_FLAG_RANDOM_ADDR;
1005
1006                 if (params->mac_addr) {
1007                         wpa_printf(MSG_DEBUG, "nl80211: MAC address: " MACSTR,
1008                                    MAC2STR(params->mac_addr));
1009                         if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_SCAN_MAC,
1010                                     ETH_ALEN, params->mac_addr))
1011                                 goto fail;
1012                 }
1013
1014                 if (params->mac_addr_mask) {
1015                         wpa_printf(MSG_DEBUG, "nl80211: MAC address mask: "
1016                                    MACSTR, MAC2STR(params->mac_addr_mask));
1017                         if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_SCAN_MAC_MASK,
1018                                     ETH_ALEN, params->mac_addr_mask))
1019                                 goto fail;
1020                 }
1021         }
1022
1023         if (scan_flags &&
1024             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, scan_flags))
1025                 goto fail;
1026
1027         if (params->p2p_probe) {
1028                 struct nlattr *rates;
1029
1030                 wpa_printf(MSG_DEBUG, "nl80211: P2P probe - mask SuppRates");
1031
1032                 rates = nla_nest_start(msg,
1033                                        QCA_WLAN_VENDOR_ATTR_SCAN_SUPP_RATES);
1034                 if (rates == NULL)
1035                         goto fail;
1036
1037                 /*
1038                  * Remove 2.4 GHz rates 1, 2, 5.5, 11 Mbps from supported rates
1039                  * by masking out everything else apart from the OFDM rates 6,
1040                  * 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS rates. All 5 GHz
1041                  * rates are left enabled.
1042                  */
1043                 if (nla_put(msg, NL80211_BAND_2GHZ, 8,
1044                             "\x0c\x12\x18\x24\x30\x48\x60\x6c"))
1045                         goto fail;
1046                 nla_nest_end(msg, rates);
1047
1048                 if (nla_put_flag(msg, QCA_WLAN_VENDOR_ATTR_SCAN_TX_NO_CCK_RATE))
1049                         goto fail;
1050         }
1051
1052         nla_nest_end(msg, attr);
1053
1054         ret = send_and_recv_msgs(drv, msg, scan_cookie_handler, &cookie);
1055         msg = NULL;
1056         if (ret) {
1057                 wpa_printf(MSG_DEBUG,
1058                            "nl80211: Vendor scan trigger failed: ret=%d (%s)",
1059                            ret, strerror(-ret));
1060                 goto fail;
1061         }
1062
1063         drv->vendor_scan_cookie = cookie;
1064         drv->scan_state = SCAN_REQUESTED;
1065
1066         wpa_printf(MSG_DEBUG,
1067                    "nl80211: Vendor scan requested (ret=%d) - scan timeout 30 seconds, scan cookie:0x%llx",
1068                    ret, (long long unsigned int) cookie);
1069         eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
1070         eloop_register_timeout(30, 0, wpa_driver_nl80211_scan_timeout,
1071                                drv, drv->ctx);
1072         drv->last_scan_cmd = NL80211_CMD_VENDOR;
1073
1074 fail:
1075         nlmsg_free(msg);
1076         return ret;
1077 }
1078
1079 #endif /* CONFIG_DRIVER_NL80211_QCA */