src/drivers/driver_nl80211_scan.c

   1 /*
   2  * Driver interaction with Linux nl80211/cfg80211 - Scanning
   3  * Copyright(c) 2015 Intel Deutschland GmbH
   4  * Copyright (c) 2002-2014, Jouni Malinen <j@w1.fi>
   5  * Copyright (c) 2007, Johannes Berg <johannes@sipsolutions.net>
   6  * Copyright (c) 2009-2010, Atheros Communications
   7  *
   8  * This software may be distributed under the terms of the BSD license.
   9  * See README for more details.
  10  */
  11
  12 #include "includes.h"
  13 #include <netlink/genl/genl.h>
  14
  15 #include "utils/common.h"
  16 #include "utils/eloop.h"
  17 #include "common/ieee802_11_defs.h"
  18 #include "common/ieee802_11_common.h"
  19 #include "common/qca-vendor.h"
  20 #include "driver_nl80211.h"
  21
  22
  23 static int get_noise_for_scan_results(struct nl_msg *msg, void *arg)
  24 {
  25         struct nlattr *tb[NL80211_ATTR_MAX + 1];
  26         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
  27         struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
  28         static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
  29                 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
  30                 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
  31         };
  32         struct wpa_scan_results *scan_results = arg;
  33         struct wpa_scan_res *scan_res;
  34         size_t i;
  35
  36         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
  37                   genlmsg_attrlen(gnlh, 0), NULL);
  38
  39         if (!tb[NL80211_ATTR_SURVEY_INFO]) {
  40                 wpa_printf(MSG_DEBUG, "nl80211: Survey data missing");
  41                 return NL_SKIP;
  42         }
  43
  44         if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
  45                              tb[NL80211_ATTR_SURVEY_INFO],
  46                              survey_policy)) {
  47                 wpa_printf(MSG_DEBUG, "nl80211: Failed to parse nested "
  48                            "attributes");
  49                 return NL_SKIP;
  50         }
  51
  52         if (!sinfo[NL80211_SURVEY_INFO_NOISE])
  53                 return NL_SKIP;
  54
  55         if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY])
  56                 return NL_SKIP;
  57
  58         for (i = 0; i < scan_results->num; ++i) {
  59                 scan_res = scan_results->res[i];
  60                 if (!scan_res)
  61                         continue;
  62                 if ((int) nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]) !=
  63                     scan_res->freq)
  64                         continue;
  65                 if (!(scan_res->flags & WPA_SCAN_NOISE_INVALID))
  66                         continue;
  67                 scan_res->noise = (s8)
  68                         nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
  69                 scan_res->flags &= ~WPA_SCAN_NOISE_INVALID;
  70         }
  71
  72         return NL_SKIP;
  73 }
  74
  75
  76 static int nl80211_get_noise_for_scan_results(
  77         struct wpa_driver_nl80211_data *drv,
  78         struct wpa_scan_results *scan_res)
  79 {
  80         struct nl_msg *msg;
  81
  82         msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_GET_SURVEY);
  83         return send_and_recv_msgs(drv, msg, get_noise_for_scan_results,
  84                                   scan_res);
  85 }
  86
  87
  88 /**
  89  * wpa_driver_nl80211_scan_timeout - Scan timeout to report scan completion
  90  * @eloop_ctx: Driver private data
  91  * @timeout_ctx: ctx argument given to wpa_driver_nl80211_init()
  92  *
  93  * This function can be used as registered timeout when starting a scan to
  94  * generate a scan completed event if the driver does not report this.
  95  */
  96 void wpa_driver_nl80211_scan_timeout(void *eloop_ctx, void *timeout_ctx)
  97 {
  98         struct wpa_driver_nl80211_data *drv = eloop_ctx;
  99         if (drv->ap_scan_as_station != NL80211_IFTYPE_UNSPECIFIED) {
 100                 wpa_driver_nl80211_set_mode(drv->first_bss,
 101                                             drv->ap_scan_as_station);
 102                 drv->ap_scan_as_station = NL80211_IFTYPE_UNSPECIFIED;
 103         }
 104         wpa_printf(MSG_DEBUG, "Scan timeout - try to get results");
 105         wpa_supplicant_event(timeout_ctx, EVENT_SCAN_RESULTS, NULL);
 106 }
 107
 108
 109 static struct nl_msg *
 110 nl80211_scan_common(struct i802_bss *bss, u8 cmd,
 111                     struct wpa_driver_scan_params *params)
 112 {
 113         struct wpa_driver_nl80211_data *drv = bss->drv;
 114         struct nl_msg *msg;
 115         size_t i;
 116         u32 scan_flags = 0;
 117
 118         msg = nl80211_cmd_msg(bss, 0, cmd);
 119         if (!msg)
 120                 return NULL;
 121
 122         if (params->num_ssids) {
 123                 struct nlattr *ssids;
 124
 125                 ssids = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
 126                 if (ssids == NULL)
 127                         goto fail;
 128                 for (i = 0; i < params->num_ssids; i++) {
 129                         wpa_hexdump_ascii(MSG_MSGDUMP, "nl80211: Scan SSID",
 130                                           params->ssids[i].ssid,
 131                                           params->ssids[i].ssid_len);
 132                         if (nla_put(msg, i + 1, params->ssids[i].ssid_len,
 133                                     params->ssids[i].ssid))
 134                                 goto fail;
 135                 }
 136                 nla_nest_end(msg, ssids);
 137         } else {
 138                 wpa_printf(MSG_DEBUG, "nl80211: Passive scan requested");
 139         }
 140
 141         if (params->extra_ies) {
 142                 wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan extra IEs",
 143                             params->extra_ies, params->extra_ies_len);
 144                 if (nla_put(msg, NL80211_ATTR_IE, params->extra_ies_len,
 145                             params->extra_ies))
 146                         goto fail;
 147         }
 148
 149         if (params->freqs) {
 150                 struct nlattr *freqs;
 151                 freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
 152                 if (freqs == NULL)
 153                         goto fail;
 154                 for (i = 0; params->freqs[i]; i++) {
 155                         wpa_printf(MSG_MSGDUMP, "nl80211: Scan frequency %u "
 156                                    "MHz", params->freqs[i]);
 157                         if (nla_put_u32(msg, i + 1, params->freqs[i]))
 158                                 goto fail;
 159                 }
 160                 nla_nest_end(msg, freqs);
 161         }
 162
 163         os_free(drv->filter_ssids);
 164         drv->filter_ssids = params->filter_ssids;
 165         params->filter_ssids = NULL;
 166         drv->num_filter_ssids = params->num_filter_ssids;
 167
 168         if (params->only_new_results) {
 169                 wpa_printf(MSG_DEBUG, "nl80211: Add NL80211_SCAN_FLAG_FLUSH");
 170                 scan_flags |= NL80211_SCAN_FLAG_FLUSH;
 171         }
 172
 173         if (params->low_priority && drv->have_low_prio_scan) {
 174                 wpa_printf(MSG_DEBUG,
 175                            "nl80211: Add NL80211_SCAN_FLAG_LOW_PRIORITY");
 176                 scan_flags |= NL80211_SCAN_FLAG_LOW_PRIORITY;
 177         }
 178
 179         if (params->mac_addr_rand) {
 180                 wpa_printf(MSG_DEBUG,
 181                            "nl80211: Add NL80211_SCAN_FLAG_RANDOM_ADDR");
 182                 scan_flags |= NL80211_SCAN_FLAG_RANDOM_ADDR;
 183
 184                 if (params->mac_addr) {
 185                         wpa_printf(MSG_DEBUG, "nl80211: MAC address: " MACSTR,
 186                                    MAC2STR(params->mac_addr));
 187                         if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
 188                                     params->mac_addr))
 189                                 goto fail;
 190                 }
 191
 192                 if (params->mac_addr_mask) {
 193                         wpa_printf(MSG_DEBUG, "nl80211: MAC address mask: "
 194                                    MACSTR, MAC2STR(params->mac_addr_mask));
 195                         if (nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN,
 196                                     params->mac_addr_mask))
 197                                 goto fail;
 198                 }
 199         }
 200
 201         if (scan_flags &&
 202             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, scan_flags))
 203                 goto fail;
 204
 205         return msg;
 206
 207 fail:
 208         nlmsg_free(msg);
 209         return NULL;
 210 }
 211
 212
 213 /**
 214  * wpa_driver_nl80211_scan - Request the driver to initiate scan
 215  * @bss: Pointer to private driver data from wpa_driver_nl80211_init()
 216  * @params: Scan parameters
 217  * Returns: 0 on success, -1 on failure
 218  */
 219 int wpa_driver_nl80211_scan(struct i802_bss *bss,
 220                             struct wpa_driver_scan_params *params)
 221 {
 222         struct wpa_driver_nl80211_data *drv = bss->drv;
 223         int ret = -1, timeout;
 224         struct nl_msg *msg = NULL;
 225
 226         wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: scan request");
 227         drv->scan_for_auth = 0;
 228
 229         if (TEST_FAIL())
 230                 return -1;
 231
 232         msg = nl80211_scan_common(bss, NL80211_CMD_TRIGGER_SCAN, params);
 233         if (!msg)
 234                 return -1;
 235
 236         if (params->p2p_probe) {
 237                 struct nlattr *rates;
 238
 239                 wpa_printf(MSG_DEBUG, "nl80211: P2P probe - mask SuppRates");
 240
 241                 rates = nla_nest_start(msg, NL80211_ATTR_SCAN_SUPP_RATES);
 242                 if (rates == NULL)
 243                         goto fail;
 244
 245                 /*
 246                  * Remove 2.4 GHz rates 1, 2, 5.5, 11 Mbps from supported rates
 247                  * by masking out everything else apart from the OFDM rates 6,
 248                  * 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS rates. All 5 GHz
 249                  * rates are left enabled.
 250                  */
 251                 if (nla_put(msg, NL80211_BAND_2GHZ, 8,
 252                             "\x0c\x12\x18\x24\x30\x48\x60\x6c"))
 253                         goto fail;
 254                 nla_nest_end(msg, rates);
 255
 256                 if (nla_put_flag(msg, NL80211_ATTR_TX_NO_CCK_RATE))
 257                         goto fail;
 258         }
 259
 260         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
 261         msg = NULL;
 262         if (ret) {
 263                 wpa_printf(MSG_DEBUG, "nl80211: Scan trigger failed: ret=%d "
 264                            "(%s)", ret, strerror(-ret));
 265                 if (drv->hostapd && is_ap_interface(drv->nlmode)) {
 266                         enum nl80211_iftype old_mode = drv->nlmode;
 267
 268                         /*
 269                          * mac80211 does not allow scan requests in AP mode, so
 270                          * try to do this in station mode.
 271                          */
 272                         if (wpa_driver_nl80211_set_mode(
 273                                     bss, NL80211_IFTYPE_STATION))
 274                                 goto fail;
 275
 276                         if (wpa_driver_nl80211_scan(bss, params)) {
 277                                 wpa_driver_nl80211_set_mode(bss, old_mode);
 278                                 goto fail;
 279                         }
 280
 281                         /* Restore AP mode when processing scan results */
 282                         drv->ap_scan_as_station = old_mode;
 283                         ret = 0;
 284                 } else
 285                         goto fail;
 286         }
 287
 288         drv->scan_state = SCAN_REQUESTED;
 289         /* Not all drivers generate "scan completed" wireless event, so try to
 290          * read results after a timeout. */
 291         timeout = 10;
 292         if (drv->scan_complete_events) {
 293                 /*
 294                  * The driver seems to deliver events to notify when scan is
 295                  * complete, so use longer timeout to avoid race conditions
 296                  * with scanning and following association request.
 297                  */
 298                 timeout = 30;
 299         }
 300         wpa_printf(MSG_DEBUG, "Scan requested (ret=%d) - scan timeout %d "
 301                    "seconds", ret, timeout);
 302         eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
 303         eloop_register_timeout(timeout, 0, wpa_driver_nl80211_scan_timeout,
 304                                drv, drv->ctx);
 305         drv->last_scan_cmd = NL80211_CMD_TRIGGER_SCAN;
 306
 307 fail:
 308         nlmsg_free(msg);
 309         return ret;
 310 }
 311
 312
 313 static int
 314 nl80211_sched_scan_add_scan_plans(struct wpa_driver_nl80211_data *drv,
 315                                   struct nl_msg *msg,
 316                                   struct wpa_driver_scan_params *params)
 317 {
 318         struct nlattr *plans;
 319         struct sched_scan_plan *scan_plans = params->sched_scan_plans;
 320         unsigned int i;
 321
 322         plans = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
 323         if (!plans)
 324                 return -1;
 325
 326         for (i = 0; i < params->sched_scan_plans_num; i++) {
 327                 struct nlattr *plan = nla_nest_start(msg, i + 1);
 328
 329                 if (!plan)
 330                         return -1;
 331
 332                 if (!scan_plans[i].interval ||
 333                     scan_plans[i].interval >
 334                     drv->capa.max_sched_scan_plan_interval) {
 335                         wpa_printf(MSG_DEBUG,
 336                                    "nl80211: sched scan plan no. %u: Invalid interval: %u",
 337                                    i, scan_plans[i].interval);
 338                         return -1;
 339                 }
 340
 341                 if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
 342                                 scan_plans[i].interval))
 343                         return -1;
 344
 345                 if (scan_plans[i].iterations >
 346                     drv->capa.max_sched_scan_plan_iterations) {
 347                         wpa_printf(MSG_DEBUG,
 348                                    "nl80211: sched scan plan no. %u: Invalid number of iterations: %u",
 349                                    i, scan_plans[i].iterations);
 350                         return -1;
 351                 }
 352
 353                 if (scan_plans[i].iterations &&
 354                     nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
 355                                 scan_plans[i].iterations))
 356                         return -1;
 357
 358                 nla_nest_end(msg, plan);
 359
 360                 /*
 361                  * All the scan plans must specify the number of iterations
 362                  * except the last plan, which will run infinitely. So if the
 363                  * number of iterations is not specified, this ought to be the
 364                  * last scan plan.
 365                  */
 366                 if (!scan_plans[i].iterations)
 367                         break;
 368         }
 369
 370         if (i != params->sched_scan_plans_num - 1) {
 371                 wpa_printf(MSG_DEBUG,
 372                            "nl80211: All sched scan plans but the last must specify number of iterations");
 373                 return -1;
 374         }
 375
 376         nla_nest_end(msg, plans);
 377         return 0;
 378 }
 379
 380
 381 /**
 382  * wpa_driver_nl80211_sched_scan - Initiate a scheduled scan
 383  * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
 384  * @params: Scan parameters
 385  * Returns: 0 on success, -1 on failure or if not supported
 386  */
 387 int wpa_driver_nl80211_sched_scan(void *priv,
 388                                   struct wpa_driver_scan_params *params)
 389 {
 390         struct i802_bss *bss = priv;
 391         struct wpa_driver_nl80211_data *drv = bss->drv;
 392         int ret = -1;
 393         struct nl_msg *msg;
 394         size_t i;
 395
 396         wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: sched_scan request");
 397
 398 #ifdef ANDROID
 399         if (!drv->capa.sched_scan_supported)
 400                 return android_pno_start(bss, params);
 401 #endif /* ANDROID */
 402
 403         if (!params->sched_scan_plans_num ||
 404             params->sched_scan_plans_num > drv->capa.max_sched_scan_plans) {
 405                 wpa_printf(MSG_ERROR,
 406                            "nl80211: Invalid number of sched scan plans: %u",
 407                            params->sched_scan_plans_num);
 408                 return -1;
 409         }
 410
 411         msg = nl80211_scan_common(bss, NL80211_CMD_START_SCHED_SCAN, params);
 412         if (!msg)
 413                 goto fail;
 414
 415         if (drv->capa.max_sched_scan_plan_iterations) {
 416                 if (nl80211_sched_scan_add_scan_plans(drv, msg, params))
 417                         goto fail;
 418         } else {
 419                 if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
 420                                 params->sched_scan_plans[0].interval * 1000))
 421                         goto fail;
 422         }
 423
 424         if ((drv->num_filter_ssids &&
 425             (int) drv->num_filter_ssids <= drv->capa.max_match_sets) ||
 426             params->filter_rssi) {
 427                 struct nlattr *match_sets;
 428                 match_sets = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
 429                 if (match_sets == NULL)
 430                         goto fail;
 431
 432                 for (i = 0; i < drv->num_filter_ssids; i++) {
 433                         struct nlattr *match_set_ssid;
 434                         wpa_hexdump_ascii(MSG_MSGDUMP,
 435                                           "nl80211: Sched scan filter SSID",
 436                                           drv->filter_ssids[i].ssid,
 437                                           drv->filter_ssids[i].ssid_len);
 438
 439                         match_set_ssid = nla_nest_start(msg, i + 1);
 440                         if (match_set_ssid == NULL ||
 441                             nla_put(msg, NL80211_ATTR_SCHED_SCAN_MATCH_SSID,
 442                                     drv->filter_ssids[i].ssid_len,
 443                                     drv->filter_ssids[i].ssid) ||
 444                             (params->filter_rssi &&
 445                              nla_put_u32(msg,
 446                                          NL80211_SCHED_SCAN_MATCH_ATTR_RSSI,
 447                                          params->filter_rssi)))
 448                                 goto fail;
 449
 450                         nla_nest_end(msg, match_set_ssid);
 451                 }
 452
 453                 /*
 454                  * Due to backward compatibility code, newer kernels treat this
 455                  * matchset (with only an RSSI filter) as the default for all
 456                  * other matchsets, unless it's the only one, in which case the
 457                  * matchset will actually allow all SSIDs above the RSSI.
 458                  */
 459                 if (params->filter_rssi) {
 460                         struct nlattr *match_set_rssi;
 461                         match_set_rssi = nla_nest_start(msg, 0);
 462                         if (match_set_rssi == NULL ||
 463                             nla_put_u32(msg, NL80211_SCHED_SCAN_MATCH_ATTR_RSSI,
 464                                         params->filter_rssi))
 465                                 goto fail;
 466                         wpa_printf(MSG_MSGDUMP,
 467                                    "nl80211: Sched scan RSSI filter %d dBm",
 468                                    params->filter_rssi);
 469                         nla_nest_end(msg, match_set_rssi);
 470                 }
 471
 472                 nla_nest_end(msg, match_sets);
 473         }
 474
 475         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
 476
 477         /* TODO: if we get an error here, we should fall back to normal scan */
 478
 479         msg = NULL;
 480         if (ret) {
 481                 wpa_printf(MSG_DEBUG, "nl80211: Sched scan start failed: "
 482                            "ret=%d (%s)", ret, strerror(-ret));
 483                 goto fail;
 484         }
 485
 486         wpa_printf(MSG_DEBUG, "nl80211: Sched scan requested (ret=%d)", ret);
 487
 488 fail:
 489         nlmsg_free(msg);
 490         return ret;
 491 }
 492
 493
 494 /**
 495  * wpa_driver_nl80211_stop_sched_scan - Stop a scheduled scan
 496  * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
 497  * Returns: 0 on success, -1 on failure or if not supported
 498  */
 499 int wpa_driver_nl80211_stop_sched_scan(void *priv)
 500 {
 501         struct i802_bss *bss = priv;
 502         struct wpa_driver_nl80211_data *drv = bss->drv;
 503         int ret;
 504         struct nl_msg *msg;
 505
 506 #ifdef ANDROID
 507         if (!drv->capa.sched_scan_supported)
 508                 return android_pno_stop(bss);
 509 #endif /* ANDROID */
 510
 511         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_STOP_SCHED_SCAN);
 512         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
 513         if (ret) {
 514                 wpa_printf(MSG_DEBUG,
 515                            "nl80211: Sched scan stop failed: ret=%d (%s)",
 516                            ret, strerror(-ret));
 517         } else {
 518                 wpa_printf(MSG_DEBUG,
 519                            "nl80211: Sched scan stop sent");
 520         }
 521
 522         return ret;
 523 }
 524
 525
 526 static int nl80211_scan_filtered(struct wpa_driver_nl80211_data *drv,
 527                                  const u8 *ie, size_t ie_len)
 528 {
 529         const u8 *ssid;
 530         size_t i;
 531
 532         if (drv->filter_ssids == NULL)
 533                 return 0;
 534
 535         ssid = get_ie(ie, ie_len, WLAN_EID_SSID);
 536         if (ssid == NULL)
 537                 return 1;
 538
 539         for (i = 0; i < drv->num_filter_ssids; i++) {
 540                 if (ssid[1] == drv->filter_ssids[i].ssid_len &&
 541                     os_memcmp(ssid + 2, drv->filter_ssids[i].ssid, ssid[1]) ==
 542                     0)
 543                         return 0;
 544         }
 545
 546         return 1;
 547 }
 548
 549
 550 int bss_info_handler(struct nl_msg *msg, void *arg)
 551 {
 552         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 553         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 554         struct nlattr *bss[NL80211_BSS_MAX + 1];
 555         static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = {
 556                 [NL80211_BSS_BSSID] = { .type = NLA_UNSPEC },
 557                 [NL80211_BSS_FREQUENCY] = { .type = NLA_U32 },
 558                 [NL80211_BSS_TSF] = { .type = NLA_U64 },
 559                 [NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 },
 560                 [NL80211_BSS_CAPABILITY] = { .type = NLA_U16 },
 561                 [NL80211_BSS_INFORMATION_ELEMENTS] = { .type = NLA_UNSPEC },
 562                 [NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 },
 563                 [NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 },
 564                 [NL80211_BSS_STATUS] = { .type = NLA_U32 },
 565                 [NL80211_BSS_SEEN_MS_AGO] = { .type = NLA_U32 },
 566                 [NL80211_BSS_BEACON_IES] = { .type = NLA_UNSPEC },
 567         };
 568         struct nl80211_bss_info_arg *_arg = arg;
 569         struct wpa_scan_results *res = _arg->res;
 570         struct wpa_scan_res **tmp;
 571         struct wpa_scan_res *r;
 572         const u8 *ie, *beacon_ie;
 573         size_t ie_len, beacon_ie_len;
 574         u8 *pos;
 575         size_t i;
 576
 577         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 578                   genlmsg_attrlen(gnlh, 0), NULL);
 579         if (!tb[NL80211_ATTR_BSS])
 580                 return NL_SKIP;
 581         if (nla_parse_nested(bss, NL80211_BSS_MAX, tb[NL80211_ATTR_BSS],
 582                              bss_policy))
 583                 return NL_SKIP;
 584         if (bss[NL80211_BSS_STATUS]) {
 585                 enum nl80211_bss_status status;
 586                 status = nla_get_u32(bss[NL80211_BSS_STATUS]);
 587                 if (status == NL80211_BSS_STATUS_ASSOCIATED &&
 588                     bss[NL80211_BSS_FREQUENCY]) {
 589                         _arg->assoc_freq =
 590                                 nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
 591                         wpa_printf(MSG_DEBUG, "nl80211: Associated on %u MHz",
 592                                    _arg->assoc_freq);
 593                 }
 594                 if (status == NL80211_BSS_STATUS_IBSS_JOINED &&
 595                     bss[NL80211_BSS_FREQUENCY]) {
 596                         _arg->ibss_freq =
 597                                 nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
 598                         wpa_printf(MSG_DEBUG, "nl80211: IBSS-joined on %u MHz",
 599                                    _arg->ibss_freq);
 600                 }
 601                 if (status == NL80211_BSS_STATUS_ASSOCIATED &&
 602                     bss[NL80211_BSS_BSSID]) {
 603                         os_memcpy(_arg->assoc_bssid,
 604                                   nla_data(bss[NL80211_BSS_BSSID]), ETH_ALEN);
 605                         wpa_printf(MSG_DEBUG, "nl80211: Associated with "
 606                                    MACSTR, MAC2STR(_arg->assoc_bssid));
 607                 }
 608         }
 609         if (!res)
 610                 return NL_SKIP;
 611         if (bss[NL80211_BSS_INFORMATION_ELEMENTS]) {
 612                 ie = nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
 613                 ie_len = nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
 614         } else {
 615                 ie = NULL;
 616                 ie_len = 0;
 617         }
 618         if (bss[NL80211_BSS_BEACON_IES]) {
 619                 beacon_ie = nla_data(bss[NL80211_BSS_BEACON_IES]);
 620                 beacon_ie_len = nla_len(bss[NL80211_BSS_BEACON_IES]);
 621         } else {
 622                 beacon_ie = NULL;
 623                 beacon_ie_len = 0;
 624         }
 625
 626         if (nl80211_scan_filtered(_arg->drv, ie ? ie : beacon_ie,
 627                                   ie ? ie_len : beacon_ie_len))
 628                 return NL_SKIP;
 629
 630         r = os_zalloc(sizeof(*r) + ie_len + beacon_ie_len);
 631         if (r == NULL)
 632                 return NL_SKIP;
 633         if (bss[NL80211_BSS_BSSID])
 634                 os_memcpy(r->bssid, nla_data(bss[NL80211_BSS_BSSID]),
 635                           ETH_ALEN);
 636         if (bss[NL80211_BSS_FREQUENCY])
 637                 r->freq = nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
 638         if (bss[NL80211_BSS_BEACON_INTERVAL])
 639                 r->beacon_int = nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]);
 640         if (bss[NL80211_BSS_CAPABILITY])
 641                 r->caps = nla_get_u16(bss[NL80211_BSS_CAPABILITY]);
 642         r->flags |= WPA_SCAN_NOISE_INVALID;
 643         if (bss[NL80211_BSS_SIGNAL_MBM]) {
 644                 r->level = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]);
 645                 r->level /= 100; /* mBm to dBm */
 646                 r->flags |= WPA_SCAN_LEVEL_DBM | WPA_SCAN_QUAL_INVALID;
 647         } else if (bss[NL80211_BSS_SIGNAL_UNSPEC]) {
 648                 r->level = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]);
 649                 r->flags |= WPA_SCAN_QUAL_INVALID;
 650         } else
 651                 r->flags |= WPA_SCAN_LEVEL_INVALID | WPA_SCAN_QUAL_INVALID;
 652         if (bss[NL80211_BSS_TSF])
 653                 r->tsf = nla_get_u64(bss[NL80211_BSS_TSF]);
 654         if (bss[NL80211_BSS_BEACON_TSF]) {
 655                 u64 tsf = nla_get_u64(bss[NL80211_BSS_BEACON_TSF]);
 656                 if (tsf > r->tsf)
 657                         r->tsf = tsf;
 658         }
 659         if (bss[NL80211_BSS_SEEN_MS_AGO])
 660                 r->age = nla_get_u32(bss[NL80211_BSS_SEEN_MS_AGO]);
 661         r->ie_len = ie_len;
 662         pos = (u8 *) (r + 1);
 663         if (ie) {
 664                 os_memcpy(pos, ie, ie_len);
 665                 pos += ie_len;
 666         }
 667         r->beacon_ie_len = beacon_ie_len;
 668         if (beacon_ie)
 669                 os_memcpy(pos, beacon_ie, beacon_ie_len);
 670
 671         if (bss[NL80211_BSS_STATUS]) {
 672                 enum nl80211_bss_status status;
 673                 status = nla_get_u32(bss[NL80211_BSS_STATUS]);
 674                 switch (status) {
 675                 case NL80211_BSS_STATUS_ASSOCIATED:
 676                         r->flags |= WPA_SCAN_ASSOCIATED;
 677                         break;
 678                 default:
 679                         break;
 680                 }
 681         }
 682
 683         /*
 684          * cfg80211 maintains separate BSS table entries for APs if the same
 685          * BSSID,SSID pair is seen on multiple channels. wpa_supplicant does
 686          * not use frequency as a separate key in the BSS table, so filter out
 687          * duplicated entries. Prefer associated BSS entry in such a case in
 688          * order to get the correct frequency into the BSS table. Similarly,
 689          * prefer newer entries over older.
 690          */
 691         for (i = 0; i < res->num; i++) {
 692                 const u8 *s1, *s2;
 693                 if (os_memcmp(res->res[i]->bssid, r->bssid, ETH_ALEN) != 0)
 694                         continue;
 695
 696                 s1 = get_ie((u8 *) (res->res[i] + 1),
 697                             res->res[i]->ie_len, WLAN_EID_SSID);
 698                 s2 = get_ie((u8 *) (r + 1), r->ie_len, WLAN_EID_SSID);
 699                 if (s1 == NULL || s2 == NULL || s1[1] != s2[1] ||
 700                     os_memcmp(s1, s2, 2 + s1[1]) != 0)
 701                         continue;
 702
 703                 /* Same BSSID,SSID was already included in scan results */
 704                 wpa_printf(MSG_DEBUG, "nl80211: Remove duplicated scan result "
 705                            "for " MACSTR, MAC2STR(r->bssid));
 706
 707                 if (((r->flags & WPA_SCAN_ASSOCIATED) &&
 708                      !(res->res[i]->flags & WPA_SCAN_ASSOCIATED)) ||
 709                     r->age < res->res[i]->age) {
 710                         os_free(res->res[i]);
 711                         res->res[i] = r;
 712                 } else
 713                         os_free(r);
 714                 return NL_SKIP;
 715         }
 716
 717         tmp = os_realloc_array(res->res, res->num + 1,
 718                                sizeof(struct wpa_scan_res *));
 719         if (tmp == NULL) {
 720                 os_free(r);
 721                 return NL_SKIP;
 722         }
 723         tmp[res->num++] = r;
 724         res->res = tmp;
 725
 726         return NL_SKIP;
 727 }
 728
 729
 730 static void clear_state_mismatch(struct wpa_driver_nl80211_data *drv,
 731                                  const u8 *addr)
 732 {
 733         if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) {
 734                 wpa_printf(MSG_DEBUG, "nl80211: Clear possible state "
 735                            "mismatch (" MACSTR ")", MAC2STR(addr));
 736                 wpa_driver_nl80211_mlme(drv, addr,
 737                                         NL80211_CMD_DEAUTHENTICATE,
 738                                         WLAN_REASON_PREV_AUTH_NOT_VALID, 1);
 739         }
 740 }
 741
 742
 743 static void wpa_driver_nl80211_check_bss_status(
 744         struct wpa_driver_nl80211_data *drv, struct wpa_scan_results *res)
 745 {
 746         size_t i;
 747
 748         for (i = 0; i < res->num; i++) {
 749                 struct wpa_scan_res *r = res->res[i];
 750
 751                 if (r->flags & WPA_SCAN_ASSOCIATED) {
 752                         wpa_printf(MSG_DEBUG, "nl80211: Scan results "
 753                                    "indicate BSS status with " MACSTR
 754                                    " as associated",
 755                                    MAC2STR(r->bssid));
 756                         if (is_sta_interface(drv->nlmode) &&
 757                             !drv->associated) {
 758                                 wpa_printf(MSG_DEBUG, "nl80211: Local state "
 759                                            "(not associated) does not match "
 760                                            "with BSS state");
 761                                 clear_state_mismatch(drv, r->bssid);
 762                         } else if (is_sta_interface(drv->nlmode) &&
 763                                    os_memcmp(drv->bssid, r->bssid, ETH_ALEN) !=
 764                                    0) {
 765                                 wpa_printf(MSG_DEBUG, "nl80211: Local state "
 766                                            "(associated with " MACSTR ") does "
 767                                            "not match with BSS state",
 768                                            MAC2STR(drv->bssid));
 769                                 clear_state_mismatch(drv, r->bssid);
 770                                 clear_state_mismatch(drv, drv->bssid);
 771                         }
 772                 }
 773         }
 774 }
 775
 776
 777 static struct wpa_scan_results *
 778 nl80211_get_scan_results(struct wpa_driver_nl80211_data *drv)
 779 {
 780         struct nl_msg *msg;
 781         struct wpa_scan_results *res;
 782         int ret;
 783         struct nl80211_bss_info_arg arg;
 784
 785         res = os_zalloc(sizeof(*res));
 786         if (res == NULL)
 787                 return NULL;
 788         if (!(msg = nl80211_cmd_msg(drv->first_bss, NLM_F_DUMP,
 789                                     NL80211_CMD_GET_SCAN))) {
 790                 wpa_scan_results_free(res);
 791                 return NULL;
 792         }
 793
 794         arg.drv = drv;
 795         arg.res = res;
 796         ret = send_and_recv_msgs(drv, msg, bss_info_handler, &arg);
 797         if (ret == 0) {
 798                 wpa_printf(MSG_DEBUG, "nl80211: Received scan results (%lu "
 799                            "BSSes)", (unsigned long) res->num);
 800                 nl80211_get_noise_for_scan_results(drv, res);
 801                 return res;
 802         }
 803         wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d "
 804                    "(%s)", ret, strerror(-ret));
 805         wpa_scan_results_free(res);
 806         return NULL;
 807 }
 808
 809
 810 /**
 811  * wpa_driver_nl80211_get_scan_results - Fetch the latest scan results
 812  * @priv: Pointer to private wext data from wpa_driver_nl80211_init()
 813  * Returns: Scan results on success, -1 on failure
 814  */
 815 struct wpa_scan_results * wpa_driver_nl80211_get_scan_results(void *priv)
 816 {
 817         struct i802_bss *bss = priv;
 818         struct wpa_driver_nl80211_data *drv = bss->drv;
 819         struct wpa_scan_results *res;
 820
 821         res = nl80211_get_scan_results(drv);
 822         if (res)
 823                 wpa_driver_nl80211_check_bss_status(drv, res);
 824         return res;
 825 }
 826
 827
 828 void nl80211_dump_scan(struct wpa_driver_nl80211_data *drv)
 829 {
 830         struct wpa_scan_results *res;
 831         size_t i;
 832
 833         res = nl80211_get_scan_results(drv);
 834         if (res == NULL) {
 835                 wpa_printf(MSG_DEBUG, "nl80211: Failed to get scan results");
 836                 return;
 837         }
 838
 839         wpa_printf(MSG_DEBUG, "nl80211: Scan result dump");
 840         for (i = 0; i < res->num; i++) {
 841                 struct wpa_scan_res *r = res->res[i];
 842                 wpa_printf(MSG_DEBUG, "nl80211: %d/%d " MACSTR "%s",
 843                            (int) i, (int) res->num, MAC2STR(r->bssid),
 844                            r->flags & WPA_SCAN_ASSOCIATED ? " [assoc]" : "");
 845         }
 846
 847         wpa_scan_results_free(res);
 848 }
 849
 850
 851 int wpa_driver_nl80211_abort_scan(void *priv)
 852 {
 853         struct i802_bss *bss = priv;
 854         struct wpa_driver_nl80211_data *drv = bss->drv;
 855         int ret;
 856         struct nl_msg *msg;
 857
 858         wpa_printf(MSG_DEBUG, "nl80211: Abort scan");
 859         msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_ABORT_SCAN);
 860         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
 861         if (ret) {
 862                 wpa_printf(MSG_DEBUG, "nl80211: Abort scan failed: ret=%d (%s)",
 863                            ret, strerror(-ret));
 864         }
 865
 866         return ret;
 867 }
 868
 869
 870 #ifdef CONFIG_DRIVER_NL80211_QCA
 871
 872 static int scan_cookie_handler(struct nl_msg *msg, void *arg)
 873 {
 874         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 875         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 876         u64 *cookie = arg;
 877
 878         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 879                   genlmsg_attrlen(gnlh, 0), NULL);
 880
 881         if (tb[NL80211_ATTR_VENDOR_DATA]) {
 882                 struct nlattr *nl_vendor = tb[NL80211_ATTR_VENDOR_DATA];
 883                 struct nlattr *tb_vendor[QCA_WLAN_VENDOR_ATTR_SCAN_MAX + 1];
 884
 885                 nla_parse(tb_vendor, QCA_WLAN_VENDOR_ATTR_SCAN_MAX,
 886                           nla_data(nl_vendor), nla_len(nl_vendor), NULL);
 887
 888                 if (tb_vendor[QCA_WLAN_VENDOR_ATTR_SCAN_COOKIE])
 889                         *cookie = nla_get_u64(
 890                                 tb_vendor[QCA_WLAN_VENDOR_ATTR_SCAN_COOKIE]);
 891         }
 892
 893         return NL_SKIP;
 894 }
 895
 896
 897 /**
 898  * wpa_driver_nl80211_vendor_scan - Request the driver to initiate a vendor scan
 899  * @bss: Pointer to private driver data from wpa_driver_nl80211_init()
 900  * @params: Scan parameters
 901  * Returns: 0 on success, -1 on failure
 902  */
 903 int wpa_driver_nl80211_vendor_scan(struct i802_bss *bss,
 904                                    struct wpa_driver_scan_params *params)
 905 {
 906         struct wpa_driver_nl80211_data *drv = bss->drv;
 907         struct nl_msg *msg = NULL;
 908         struct nlattr *attr;
 909         size_t i;
 910         u32 scan_flags = 0;
 911         int ret = -1;
 912         u64 cookie = 0;
 913
 914         wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: vendor scan request");
 915         drv->scan_for_auth = 0;
 916
 917         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
 918             nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
 919             nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
 920                         QCA_NL80211_VENDOR_SUBCMD_TRIGGER_SCAN) )
 921                 goto fail;
 922
 923         attr = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
 924         if (attr == NULL)
 925                 goto fail;
 926
 927         if (params->num_ssids) {
 928                 struct nlattr *ssids;
 929
 930                 ssids = nla_nest_start(msg, QCA_WLAN_VENDOR_ATTR_SCAN_SSIDS);
 931                 if (ssids == NULL)
 932                         goto fail;
 933                 for (i = 0; i < params->num_ssids; i++) {
 934                         wpa_hexdump_ascii(MSG_MSGDUMP, "nl80211: Scan SSID",
 935                                         params->ssids[i].ssid,
 936                                         params->ssids[i].ssid_len);
 937                         if (nla_put(msg, i + 1, params->ssids[i].ssid_len,
 938                                     params->ssids[i].ssid))
 939                                 goto fail;
 940                 }
 941                 nla_nest_end(msg, ssids);
 942         }
 943
 944         if (params->extra_ies) {
 945                 wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan extra IEs",
 946                             params->extra_ies, params->extra_ies_len);
 947                 if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_SCAN_IE,
 948                             params->extra_ies_len, params->extra_ies))
 949                         goto fail;
 950         }
 951
 952         if (params->freqs) {
 953                 struct nlattr *freqs;
 954
 955                 freqs = nla_nest_start(msg,
 956                                        QCA_WLAN_VENDOR_ATTR_SCAN_FREQUENCIES);
 957                 if (freqs == NULL)
 958                         goto fail;
 959                 for (i = 0; params->freqs[i]; i++) {
 960                         wpa_printf(MSG_MSGDUMP,
 961                                    "nl80211: Scan frequency %u MHz",
 962                                    params->freqs[i]);
 963                         if (nla_put_u32(msg, i + 1, params->freqs[i]))
 964                                 goto fail;
 965                 }
 966                 nla_nest_end(msg, freqs);
 967         }
 968
 969         os_free(drv->filter_ssids);
 970         drv->filter_ssids = params->filter_ssids;
 971         params->filter_ssids = NULL;
 972         drv->num_filter_ssids = params->num_filter_ssids;
 973
 974         if (params->low_priority && drv->have_low_prio_scan) {
 975                 wpa_printf(MSG_DEBUG,
 976                            "nl80211: Add NL80211_SCAN_FLAG_LOW_PRIORITY");
 977                 scan_flags |= NL80211_SCAN_FLAG_LOW_PRIORITY;
 978         }
 979
 980         if (params->mac_addr_rand) {
 981                 wpa_printf(MSG_DEBUG,
 982                            "nl80211: Add NL80211_SCAN_FLAG_RANDOM_ADDR");
 983                 scan_flags |= NL80211_SCAN_FLAG_RANDOM_ADDR;
 984
 985                 if (params->mac_addr) {
 986                         wpa_printf(MSG_DEBUG, "nl80211: MAC address: " MACSTR,
 987                                    MAC2STR(params->mac_addr));
 988                         if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_SCAN_MAC,
 989                                     ETH_ALEN, params->mac_addr))
 990                                 goto fail;
 991                 }
 992
 993                 if (params->mac_addr_mask) {
 994                         wpa_printf(MSG_DEBUG, "nl80211: MAC address mask: "
 995                                    MACSTR, MAC2STR(params->mac_addr_mask));
 996                         if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_SCAN_MAC_MASK,
 997                                     ETH_ALEN, params->mac_addr_mask))
 998                                 goto fail;
 999                 }
1000         }
1001
1002         if (scan_flags &&
1003             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, scan_flags))
1004                 goto fail;
1005
1006         if (params->p2p_probe) {
1007                 struct nlattr *rates;
1008
1009                 wpa_printf(MSG_DEBUG, "nl80211: P2P probe - mask SuppRates");
1010
1011                 rates = nla_nest_start(msg,
1012                                        QCA_WLAN_VENDOR_ATTR_SCAN_SUPP_RATES);
1013                 if (rates == NULL)
1014                         goto fail;
1015
1016                 /*
1017                  * Remove 2.4 GHz rates 1, 2, 5.5, 11 Mbps from supported rates
1018                  * by masking out everything else apart from the OFDM rates 6,
1019                  * 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS rates. All 5 GHz
1020                  * rates are left enabled.
1021                  */
1022                 if (nla_put(msg, NL80211_BAND_2GHZ, 8,
1023                             "\x0c\x12\x18\x24\x30\x48\x60\x6c"))
1024                         goto fail;
1025                 nla_nest_end(msg, rates);
1026
1027                 if (nla_put_flag(msg, QCA_WLAN_VENDOR_ATTR_SCAN_TX_NO_CCK_RATE))
1028                         goto fail;
1029         }
1030
1031         nla_nest_end(msg, attr);
1032
1033         ret = send_and_recv_msgs(drv, msg, scan_cookie_handler, &cookie);
1034         msg = NULL;
1035         if (ret) {
1036                 wpa_printf(MSG_DEBUG,
1037                            "nl80211: Vendor scan trigger failed: ret=%d (%s)",
1038                            ret, strerror(-ret));
1039                 goto fail;
1040         }
1041
1042         drv->vendor_scan_cookie = cookie;
1043         drv->scan_state = SCAN_REQUESTED;
1044
1045         wpa_printf(MSG_DEBUG,
1046                    "nl80211: Vendor scan requested (ret=%d) - scan timeout 30 seconds, scan cookie:0x%llx",
1047                    ret, (long long unsigned int) cookie);
1048         eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
1049         eloop_register_timeout(30, 0, wpa_driver_nl80211_scan_timeout,
1050                                drv, drv->ctx);
1051         drv->last_scan_cmd = NL80211_CMD_VENDOR;
1052
1053 fail:
1054         nlmsg_free(msg);
1055         return ret;
1056 }
1057
1058 #endif /* CONFIG_DRIVER_NL80211_QCA */