src/drivers/driver_nl80211_scan.c

   1 /*
   2  * Driver interaction with Linux nl80211/cfg80211 - Scanning
   3  * Copyright(c) 2015 Intel Deutschland GmbH
   4  * Copyright (c) 2002-2014, Jouni Malinen <j@w1.fi>
   5  * Copyright (c) 2007, Johannes Berg <johannes@sipsolutions.net>
   6  * Copyright (c) 2009-2010, Atheros Communications
   7  *
   8  * This software may be distributed under the terms of the BSD license.
   9  * See README for more details.
  10  */
  11
  12 #include "includes.h"
  13 #include <netlink/genl/genl.h>
  14
  15 #include "utils/common.h"
  16 #include "utils/eloop.h"
  17 #include "common/ieee802_11_defs.h"
  18 #include "common/ieee802_11_common.h"
  19 #include "common/qca-vendor.h"
  20 #include "driver_nl80211.h"
  21
  22
  23 static int get_noise_for_scan_results(struct nl_msg *msg, void *arg)
  24 {
  25         struct nlattr *tb[NL80211_ATTR_MAX + 1];
  26         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
  27         struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
  28         static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
  29                 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
  30                 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
  31         };
  32         struct wpa_scan_results *scan_results = arg;
  33         struct wpa_scan_res *scan_res;
  34         size_t i;
  35
  36         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
  37                   genlmsg_attrlen(gnlh, 0), NULL);
  38
  39         if (!tb[NL80211_ATTR_SURVEY_INFO]) {
  40                 wpa_printf(MSG_DEBUG, "nl80211: Survey data missing");
  41                 return NL_SKIP;
  42         }
  43
  44         if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
  45                              tb[NL80211_ATTR_SURVEY_INFO],
  46                              survey_policy)) {
  47                 wpa_printf(MSG_DEBUG, "nl80211: Failed to parse nested "
  48                            "attributes");
  49                 return NL_SKIP;
  50         }
  51
  52         if (!sinfo[NL80211_SURVEY_INFO_NOISE])
  53                 return NL_SKIP;
  54
  55         if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY])
  56                 return NL_SKIP;
  57
  58         for (i = 0; i < scan_results->num; ++i) {
  59                 scan_res = scan_results->res[i];
  60                 if (!scan_res)
  61                         continue;
  62                 if ((int) nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]) !=
  63                     scan_res->freq)
  64                         continue;
  65                 if (!(scan_res->flags & WPA_SCAN_NOISE_INVALID))
  66                         continue;
  67                 scan_res->noise = (s8)
  68                         nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
  69                 scan_res->flags &= ~WPA_SCAN_NOISE_INVALID;
  70         }
  71
  72         return NL_SKIP;
  73 }
  74
  75
  76 static int nl80211_get_noise_for_scan_results(
  77         struct wpa_driver_nl80211_data *drv,
  78         struct wpa_scan_results *scan_res)
  79 {
  80         struct nl_msg *msg;
  81
  82         msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_GET_SURVEY);
  83         return send_and_recv_msgs(drv, msg, get_noise_for_scan_results,
  84                                   scan_res);
  85 }
  86
  87
  88 /**
  89  * wpa_driver_nl80211_scan_timeout - Scan timeout to report scan completion
  90  * @eloop_ctx: Driver private data
  91  * @timeout_ctx: ctx argument given to wpa_driver_nl80211_init()
  92  *
  93  * This function can be used as registered timeout when starting a scan to
  94  * generate a scan completed event if the driver does not report this.
  95  */
  96 void wpa_driver_nl80211_scan_timeout(void *eloop_ctx, void *timeout_ctx)
  97 {
  98         struct wpa_driver_nl80211_data *drv = eloop_ctx;
  99         if (drv->ap_scan_as_station != NL80211_IFTYPE_UNSPECIFIED) {
 100                 wpa_driver_nl80211_set_mode(drv->first_bss,
 101                                             drv->ap_scan_as_station);
 102                 drv->ap_scan_as_station = NL80211_IFTYPE_UNSPECIFIED;
 103         }
 104         wpa_printf(MSG_DEBUG, "Scan timeout - try to get results");
 105         wpa_supplicant_event(timeout_ctx, EVENT_SCAN_RESULTS, NULL);
 106 }
 107
 108
 109 static struct nl_msg *
 110 nl80211_scan_common(struct i802_bss *bss, u8 cmd,
 111                     struct wpa_driver_scan_params *params)
 112 {
 113         struct wpa_driver_nl80211_data *drv = bss->drv;
 114         struct nl_msg *msg;
 115         size_t i;
 116         u32 scan_flags = 0;
 117
 118         msg = nl80211_cmd_msg(bss, 0, cmd);
 119         if (!msg)
 120                 return NULL;
 121
 122         if (params->num_ssids) {
 123                 struct nlattr *ssids;
 124
 125                 ssids = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
 126                 if (ssids == NULL)
 127                         goto fail;
 128                 for (i = 0; i < params->num_ssids; i++) {
 129                         wpa_hexdump_ascii(MSG_MSGDUMP, "nl80211: Scan SSID",
 130                                           params->ssids[i].ssid,
 131                                           params->ssids[i].ssid_len);
 132                         if (nla_put(msg, i + 1, params->ssids[i].ssid_len,
 133                                     params->ssids[i].ssid))
 134                                 goto fail;
 135                 }
 136                 nla_nest_end(msg, ssids);
 137         } else {
 138                 wpa_printf(MSG_DEBUG, "nl80211: Passive scan requested");
 139         }
 140
 141         if (params->extra_ies) {
 142                 wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan extra IEs",
 143                             params->extra_ies, params->extra_ies_len);
 144                 if (nla_put(msg, NL80211_ATTR_IE, params->extra_ies_len,
 145                             params->extra_ies))
 146                         goto fail;
 147         }
 148
 149         if (params->freqs) {
 150                 struct nlattr *freqs;
 151                 freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
 152                 if (freqs == NULL)
 153                         goto fail;
 154                 for (i = 0; params->freqs[i]; i++) {
 155                         wpa_printf(MSG_MSGDUMP, "nl80211: Scan frequency %u "
 156                                    "MHz", params->freqs[i]);
 157                         if (nla_put_u32(msg, i + 1, params->freqs[i]))
 158                                 goto fail;
 159                 }
 160                 nla_nest_end(msg, freqs);
 161         }
 162
 163         os_free(drv->filter_ssids);
 164         drv->filter_ssids = params->filter_ssids;
 165         params->filter_ssids = NULL;
 166         drv->num_filter_ssids = params->num_filter_ssids;
 167
 168         if (params->only_new_results) {
 169                 wpa_printf(MSG_DEBUG, "nl80211: Add NL80211_SCAN_FLAG_FLUSH");
 170                 scan_flags |= NL80211_SCAN_FLAG_FLUSH;
 171         }
 172
 173         if (params->low_priority && drv->have_low_prio_scan) {
 174                 wpa_printf(MSG_DEBUG,
 175                            "nl80211: Add NL80211_SCAN_FLAG_LOW_PRIORITY");
 176                 scan_flags |= NL80211_SCAN_FLAG_LOW_PRIORITY;
 177         }
 178
 179         if (params->mac_addr_rand) {
 180                 wpa_printf(MSG_DEBUG,
 181                            "nl80211: Add NL80211_SCAN_FLAG_RANDOM_ADDR");
 182                 scan_flags |= NL80211_SCAN_FLAG_RANDOM_ADDR;
 183
 184                 if (params->mac_addr) {
 185                         wpa_printf(MSG_DEBUG, "nl80211: MAC address: " MACSTR,
 186                                    MAC2STR(params->mac_addr));
 187                         if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
 188                                     params->mac_addr))
 189                                 goto fail;
 190                 }
 191
 192                 if (params->mac_addr_mask) {
 193                         wpa_printf(MSG_DEBUG, "nl80211: MAC address mask: "
 194                                    MACSTR, MAC2STR(params->mac_addr_mask));
 195                         if (nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN,
 196                                     params->mac_addr_mask))
 197                                 goto fail;
 198                 }
 199         }
 200
 201         if (scan_flags &&
 202             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, scan_flags))
 203                 goto fail;
 204
 205         return msg;
 206
 207 fail:
 208         nlmsg_free(msg);
 209         return NULL;
 210 }
 211
 212
 213 /**
 214  * wpa_driver_nl80211_scan - Request the driver to initiate scan
 215  * @bss: Pointer to private driver data from wpa_driver_nl80211_init()
 216  * @params: Scan parameters
 217  * Returns: 0 on success, -1 on failure
 218  */
 219 int wpa_driver_nl80211_scan(struct i802_bss *bss,
 220                             struct wpa_driver_scan_params *params)
 221 {
 222         struct wpa_driver_nl80211_data *drv = bss->drv;
 223         int ret = -1, timeout;
 224         struct nl_msg *msg = NULL;
 225
 226         wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: scan request");
 227         drv->scan_for_auth = 0;
 228
 229         if (TEST_FAIL())
 230                 return -1;
 231
 232         msg = nl80211_scan_common(bss, NL80211_CMD_TRIGGER_SCAN, params);
 233         if (!msg)
 234                 return -1;
 235
 236         if (params->p2p_probe) {
 237                 struct nlattr *rates;
 238
 239                 wpa_printf(MSG_DEBUG, "nl80211: P2P probe - mask SuppRates");
 240
 241                 rates = nla_nest_start(msg, NL80211_ATTR_SCAN_SUPP_RATES);
 242                 if (rates == NULL)
 243                         goto fail;
 244
 245                 /*
 246                  * Remove 2.4 GHz rates 1, 2, 5.5, 11 Mbps from supported rates
 247                  * by masking out everything else apart from the OFDM rates 6,
 248                  * 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS rates. All 5 GHz
 249                  * rates are left enabled.
 250                  */
 251                 if (nla_put(msg, NL80211_BAND_2GHZ, 8,
 252                             "\x0c\x12\x18\x24\x30\x48\x60\x6c"))
 253                         goto fail;
 254                 nla_nest_end(msg, rates);
 255
 256                 if (nla_put_flag(msg, NL80211_ATTR_TX_NO_CCK_RATE))
 257                         goto fail;
 258         }
 259
 260         if (params->bssid) {
 261                 wpa_printf(MSG_DEBUG, "nl80211: Scan for a specific BSSID: "
 262                            MACSTR, MAC2STR(params->bssid));
 263                 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid))
 264                         goto fail;
 265         }
 266
 267         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
 268         msg = NULL;
 269         if (ret) {
 270                 wpa_printf(MSG_DEBUG, "nl80211: Scan trigger failed: ret=%d "
 271                            "(%s)", ret, strerror(-ret));
 272                 if (drv->hostapd && is_ap_interface(drv->nlmode)) {
 273                         enum nl80211_iftype old_mode = drv->nlmode;
 274
 275                         /*
 276                          * mac80211 does not allow scan requests in AP mode, so
 277                          * try to do this in station mode.
 278                          */
 279                         if (wpa_driver_nl80211_set_mode(
 280                                     bss, NL80211_IFTYPE_STATION))
 281                                 goto fail;
 282
 283                         if (wpa_driver_nl80211_scan(bss, params)) {
 284                                 wpa_driver_nl80211_set_mode(bss, old_mode);
 285                                 goto fail;
 286                         }
 287
 288                         /* Restore AP mode when processing scan results */
 289                         drv->ap_scan_as_station = old_mode;
 290                         ret = 0;
 291                 } else
 292                         goto fail;
 293         }
 294
 295         drv->scan_state = SCAN_REQUESTED;
 296         /* Not all drivers generate "scan completed" wireless event, so try to
 297          * read results after a timeout. */
 298         timeout = 10;
 299         if (drv->scan_complete_events) {
 300                 /*
 301                  * The driver seems to deliver events to notify when scan is
 302                  * complete, so use longer timeout to avoid race conditions
 303                  * with scanning and following association request.
 304                  */
 305                 timeout = 30;
 306         }
 307         wpa_printf(MSG_DEBUG, "Scan requested (ret=%d) - scan timeout %d "
 308                    "seconds", ret, timeout);
 309         eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
 310         eloop_register_timeout(timeout, 0, wpa_driver_nl80211_scan_timeout,
 311                                drv, drv->ctx);
 312         drv->last_scan_cmd = NL80211_CMD_TRIGGER_SCAN;
 313
 314 fail:
 315         nlmsg_free(msg);
 316         return ret;
 317 }
 318
 319
 320 static int
 321 nl80211_sched_scan_add_scan_plans(struct wpa_driver_nl80211_data *drv,
 322                                   struct nl_msg *msg,
 323                                   struct wpa_driver_scan_params *params)
 324 {
 325         struct nlattr *plans;
 326         struct sched_scan_plan *scan_plans = params->sched_scan_plans;
 327         unsigned int i;
 328
 329         plans = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
 330         if (!plans)
 331                 return -1;
 332
 333         for (i = 0; i < params->sched_scan_plans_num; i++) {
 334                 struct nlattr *plan = nla_nest_start(msg, i + 1);
 335
 336                 if (!plan)
 337                         return -1;
 338
 339                 if (!scan_plans[i].interval ||
 340                     scan_plans[i].interval >
 341                     drv->capa.max_sched_scan_plan_interval) {
 342                         wpa_printf(MSG_DEBUG,
 343                                    "nl80211: sched scan plan no. %u: Invalid interval: %u",
 344                                    i, scan_plans[i].interval);
 345                         return -1;
 346                 }
 347
 348                 if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
 349                                 scan_plans[i].interval))
 350                         return -1;
 351
 352                 if (scan_plans[i].iterations >
 353                     drv->capa.max_sched_scan_plan_iterations) {
 354                         wpa_printf(MSG_DEBUG,
 355                                    "nl80211: sched scan plan no. %u: Invalid number of iterations: %u",
 356                                    i, scan_plans[i].iterations);
 357                         return -1;
 358                 }
 359
 360                 if (scan_plans[i].iterations &&
 361                     nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
 362                                 scan_plans[i].iterations))
 363                         return -1;
 364
 365                 nla_nest_end(msg, plan);
 366
 367                 /*
 368                  * All the scan plans must specify the number of iterations
 369                  * except the last plan, which will run infinitely. So if the
 370                  * number of iterations is not specified, this ought to be the
 371                  * last scan plan.
 372                  */
 373                 if (!scan_plans[i].iterations)
 374                         break;
 375         }
 376
 377         if (i != params->sched_scan_plans_num - 1) {
 378                 wpa_printf(MSG_DEBUG,
 379                            "nl80211: All sched scan plans but the last must specify number of iterations");
 380                 return -1;
 381         }
 382
 383         nla_nest_end(msg, plans);
 384         return 0;
 385 }
 386
 387
 388 /**
 389  * wpa_driver_nl80211_sched_scan - Initiate a scheduled scan
 390  * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
 391  * @params: Scan parameters
 392  * Returns: 0 on success, -1 on failure or if not supported
 393  */
 394 int wpa_driver_nl80211_sched_scan(void *priv,
 395                                   struct wpa_driver_scan_params *params)
 396 {
 397         struct i802_bss *bss = priv;
 398         struct wpa_driver_nl80211_data *drv = bss->drv;
 399         int ret = -1;
 400         struct nl_msg *msg;
 401         size_t i;
 402
 403         wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: sched_scan request");
 404
 405 #ifdef ANDROID
 406         if (!drv->capa.sched_scan_supported)
 407                 return android_pno_start(bss, params);
 408 #endif /* ANDROID */
 409
 410         if (!params->sched_scan_plans_num ||
 411             params->sched_scan_plans_num > drv->capa.max_sched_scan_plans) {
 412                 wpa_printf(MSG_ERROR,
 413                            "nl80211: Invalid number of sched scan plans: %u",
 414                            params->sched_scan_plans_num);
 415                 return -1;
 416         }
 417
 418         msg = nl80211_scan_common(bss, NL80211_CMD_START_SCHED_SCAN, params);
 419         if (!msg)
 420                 goto fail;
 421
 422         if (drv->capa.max_sched_scan_plan_iterations) {
 423                 if (nl80211_sched_scan_add_scan_plans(drv, msg, params))
 424                         goto fail;
 425         } else {
 426                 if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
 427                                 params->sched_scan_plans[0].interval * 1000))
 428                         goto fail;
 429         }
 430
 431         if ((drv->num_filter_ssids &&
 432             (int) drv->num_filter_ssids <= drv->capa.max_match_sets) ||
 433             params->filter_rssi) {
 434                 struct nlattr *match_sets;
 435                 match_sets = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
 436                 if (match_sets == NULL)
 437                         goto fail;
 438
 439                 for (i = 0; i < drv->num_filter_ssids; i++) {
 440                         struct nlattr *match_set_ssid;
 441                         wpa_hexdump_ascii(MSG_MSGDUMP,
 442                                           "nl80211: Sched scan filter SSID",
 443                                           drv->filter_ssids[i].ssid,
 444                                           drv->filter_ssids[i].ssid_len);
 445
 446                         match_set_ssid = nla_nest_start(msg, i + 1);
 447                         if (match_set_ssid == NULL ||
 448                             nla_put(msg, NL80211_ATTR_SCHED_SCAN_MATCH_SSID,
 449                                     drv->filter_ssids[i].ssid_len,
 450                                     drv->filter_ssids[i].ssid) ||
 451                             (params->filter_rssi &&
 452                              nla_put_u32(msg,
 453                                          NL80211_SCHED_SCAN_MATCH_ATTR_RSSI,
 454                                          params->filter_rssi)))
 455                                 goto fail;
 456
 457                         nla_nest_end(msg, match_set_ssid);
 458                 }
 459
 460                 /*
 461                  * Due to backward compatibility code, newer kernels treat this
 462                  * matchset (with only an RSSI filter) as the default for all
 463                  * other matchsets, unless it's the only one, in which case the
 464                  * matchset will actually allow all SSIDs above the RSSI.
 465                  */
 466                 if (params->filter_rssi) {
 467                         struct nlattr *match_set_rssi;
 468                         match_set_rssi = nla_nest_start(msg, 0);
 469                         if (match_set_rssi == NULL ||
 470                             nla_put_u32(msg, NL80211_SCHED_SCAN_MATCH_ATTR_RSSI,
 471                                         params->filter_rssi))
 472                                 goto fail;
 473                         wpa_printf(MSG_MSGDUMP,
 474                                    "nl80211: Sched scan RSSI filter %d dBm",
 475                                    params->filter_rssi);
 476                         nla_nest_end(msg, match_set_rssi);
 477                 }
 478
 479                 nla_nest_end(msg, match_sets);
 480         }
 481
 482         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
 483
 484         /* TODO: if we get an error here, we should fall back to normal scan */
 485
 486         msg = NULL;
 487         if (ret) {
 488                 wpa_printf(MSG_DEBUG, "nl80211: Sched scan start failed: "
 489                            "ret=%d (%s)", ret, strerror(-ret));
 490                 goto fail;
 491         }
 492
 493         wpa_printf(MSG_DEBUG, "nl80211: Sched scan requested (ret=%d)", ret);
 494
 495 fail:
 496         nlmsg_free(msg);
 497         return ret;
 498 }
 499
 500
 501 /**
 502  * wpa_driver_nl80211_stop_sched_scan - Stop a scheduled scan
 503  * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
 504  * Returns: 0 on success, -1 on failure or if not supported
 505  */
 506 int wpa_driver_nl80211_stop_sched_scan(void *priv)
 507 {
 508         struct i802_bss *bss = priv;
 509         struct wpa_driver_nl80211_data *drv = bss->drv;
 510         int ret;
 511         struct nl_msg *msg;
 512
 513 #ifdef ANDROID
 514         if (!drv->capa.sched_scan_supported)
 515                 return android_pno_stop(bss);
 516 #endif /* ANDROID */
 517
 518         msg = nl80211_drv_msg(drv, 0, NL80211_CMD_STOP_SCHED_SCAN);
 519         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
 520         if (ret) {
 521                 wpa_printf(MSG_DEBUG,
 522                            "nl80211: Sched scan stop failed: ret=%d (%s)",
 523                            ret, strerror(-ret));
 524         } else {
 525                 wpa_printf(MSG_DEBUG,
 526                            "nl80211: Sched scan stop sent");
 527         }
 528
 529         return ret;
 530 }
 531
 532
 533 static int nl80211_scan_filtered(struct wpa_driver_nl80211_data *drv,
 534                                  const u8 *ie, size_t ie_len)
 535 {
 536         const u8 *ssid;
 537         size_t i;
 538
 539         if (drv->filter_ssids == NULL)
 540                 return 0;
 541
 542         ssid = get_ie(ie, ie_len, WLAN_EID_SSID);
 543         if (ssid == NULL)
 544                 return 1;
 545
 546         for (i = 0; i < drv->num_filter_ssids; i++) {
 547                 if (ssid[1] == drv->filter_ssids[i].ssid_len &&
 548                     os_memcmp(ssid + 2, drv->filter_ssids[i].ssid, ssid[1]) ==
 549                     0)
 550                         return 0;
 551         }
 552
 553         return 1;
 554 }
 555
 556
 557 int bss_info_handler(struct nl_msg *msg, void *arg)
 558 {
 559         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 560         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 561         struct nlattr *bss[NL80211_BSS_MAX + 1];
 562         static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = {
 563                 [NL80211_BSS_BSSID] = { .type = NLA_UNSPEC },
 564                 [NL80211_BSS_FREQUENCY] = { .type = NLA_U32 },
 565                 [NL80211_BSS_TSF] = { .type = NLA_U64 },
 566                 [NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 },
 567                 [NL80211_BSS_CAPABILITY] = { .type = NLA_U16 },
 568                 [NL80211_BSS_INFORMATION_ELEMENTS] = { .type = NLA_UNSPEC },
 569                 [NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 },
 570                 [NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 },
 571                 [NL80211_BSS_STATUS] = { .type = NLA_U32 },
 572                 [NL80211_BSS_SEEN_MS_AGO] = { .type = NLA_U32 },
 573                 [NL80211_BSS_BEACON_IES] = { .type = NLA_UNSPEC },
 574         };
 575         struct nl80211_bss_info_arg *_arg = arg;
 576         struct wpa_scan_results *res = _arg->res;
 577         struct wpa_scan_res **tmp;
 578         struct wpa_scan_res *r;
 579         const u8 *ie, *beacon_ie;
 580         size_t ie_len, beacon_ie_len;
 581         u8 *pos;
 582         size_t i;
 583
 584         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 585                   genlmsg_attrlen(gnlh, 0), NULL);
 586         if (!tb[NL80211_ATTR_BSS])
 587                 return NL_SKIP;
 588         if (nla_parse_nested(bss, NL80211_BSS_MAX, tb[NL80211_ATTR_BSS],
 589                              bss_policy))
 590                 return NL_SKIP;
 591         if (bss[NL80211_BSS_STATUS]) {
 592                 enum nl80211_bss_status status;
 593                 status = nla_get_u32(bss[NL80211_BSS_STATUS]);
 594                 if (status == NL80211_BSS_STATUS_ASSOCIATED &&
 595                     bss[NL80211_BSS_FREQUENCY]) {
 596                         _arg->assoc_freq =
 597                                 nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
 598                         wpa_printf(MSG_DEBUG, "nl80211: Associated on %u MHz",
 599                                    _arg->assoc_freq);
 600                 }
 601                 if (status == NL80211_BSS_STATUS_IBSS_JOINED &&
 602                     bss[NL80211_BSS_FREQUENCY]) {
 603                         _arg->ibss_freq =
 604                                 nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
 605                         wpa_printf(MSG_DEBUG, "nl80211: IBSS-joined on %u MHz",
 606                                    _arg->ibss_freq);
 607                 }
 608                 if (status == NL80211_BSS_STATUS_ASSOCIATED &&
 609                     bss[NL80211_BSS_BSSID]) {
 610                         os_memcpy(_arg->assoc_bssid,
 611                                   nla_data(bss[NL80211_BSS_BSSID]), ETH_ALEN);
 612                         wpa_printf(MSG_DEBUG, "nl80211: Associated with "
 613                                    MACSTR, MAC2STR(_arg->assoc_bssid));
 614                 }
 615         }
 616         if (!res)
 617                 return NL_SKIP;
 618         if (bss[NL80211_BSS_INFORMATION_ELEMENTS]) {
 619                 ie = nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
 620                 ie_len = nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
 621         } else {
 622                 ie = NULL;
 623                 ie_len = 0;
 624         }
 625         if (bss[NL80211_BSS_BEACON_IES]) {
 626                 beacon_ie = nla_data(bss[NL80211_BSS_BEACON_IES]);
 627                 beacon_ie_len = nla_len(bss[NL80211_BSS_BEACON_IES]);
 628         } else {
 629                 beacon_ie = NULL;
 630                 beacon_ie_len = 0;
 631         }
 632
 633         if (nl80211_scan_filtered(_arg->drv, ie ? ie : beacon_ie,
 634                                   ie ? ie_len : beacon_ie_len))
 635                 return NL_SKIP;
 636
 637         r = os_zalloc(sizeof(*r) + ie_len + beacon_ie_len);
 638         if (r == NULL)
 639                 return NL_SKIP;
 640         if (bss[NL80211_BSS_BSSID])
 641                 os_memcpy(r->bssid, nla_data(bss[NL80211_BSS_BSSID]),
 642                           ETH_ALEN);
 643         if (bss[NL80211_BSS_FREQUENCY])
 644                 r->freq = nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
 645         if (bss[NL80211_BSS_BEACON_INTERVAL])
 646                 r->beacon_int = nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]);
 647         if (bss[NL80211_BSS_CAPABILITY])
 648                 r->caps = nla_get_u16(bss[NL80211_BSS_CAPABILITY]);
 649         r->flags |= WPA_SCAN_NOISE_INVALID;
 650         if (bss[NL80211_BSS_SIGNAL_MBM]) {
 651                 r->level = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]);
 652                 r->level /= 100; /* mBm to dBm */
 653                 r->flags |= WPA_SCAN_LEVEL_DBM | WPA_SCAN_QUAL_INVALID;
 654         } else if (bss[NL80211_BSS_SIGNAL_UNSPEC]) {
 655                 r->level = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]);
 656                 r->flags |= WPA_SCAN_QUAL_INVALID;
 657         } else
 658                 r->flags |= WPA_SCAN_LEVEL_INVALID | WPA_SCAN_QUAL_INVALID;
 659         if (bss[NL80211_BSS_TSF])
 660                 r->tsf = nla_get_u64(bss[NL80211_BSS_TSF]);
 661         if (bss[NL80211_BSS_BEACON_TSF]) {
 662                 u64 tsf = nla_get_u64(bss[NL80211_BSS_BEACON_TSF]);
 663                 if (tsf > r->tsf)
 664                         r->tsf = tsf;
 665         }
 666         if (bss[NL80211_BSS_SEEN_MS_AGO])
 667                 r->age = nla_get_u32(bss[NL80211_BSS_SEEN_MS_AGO]);
 668         r->ie_len = ie_len;
 669         pos = (u8 *) (r + 1);
 670         if (ie) {
 671                 os_memcpy(pos, ie, ie_len);
 672                 pos += ie_len;
 673         }
 674         r->beacon_ie_len = beacon_ie_len;
 675         if (beacon_ie)
 676                 os_memcpy(pos, beacon_ie, beacon_ie_len);
 677
 678         if (bss[NL80211_BSS_STATUS]) {
 679                 enum nl80211_bss_status status;
 680                 status = nla_get_u32(bss[NL80211_BSS_STATUS]);
 681                 switch (status) {
 682                 case NL80211_BSS_STATUS_ASSOCIATED:
 683                         r->flags |= WPA_SCAN_ASSOCIATED;
 684                         break;
 685                 default:
 686                         break;
 687                 }
 688         }
 689
 690         /*
 691          * cfg80211 maintains separate BSS table entries for APs if the same
 692          * BSSID,SSID pair is seen on multiple channels. wpa_supplicant does
 693          * not use frequency as a separate key in the BSS table, so filter out
 694          * duplicated entries. Prefer associated BSS entry in such a case in
 695          * order to get the correct frequency into the BSS table. Similarly,
 696          * prefer newer entries over older.
 697          */
 698         for (i = 0; i < res->num; i++) {
 699                 const u8 *s1, *s2;
 700                 if (os_memcmp(res->res[i]->bssid, r->bssid, ETH_ALEN) != 0)
 701                         continue;
 702
 703                 s1 = get_ie((u8 *) (res->res[i] + 1),
 704                             res->res[i]->ie_len, WLAN_EID_SSID);
 705                 s2 = get_ie((u8 *) (r + 1), r->ie_len, WLAN_EID_SSID);
 706                 if (s1 == NULL || s2 == NULL || s1[1] != s2[1] ||
 707                     os_memcmp(s1, s2, 2 + s1[1]) != 0)
 708                         continue;
 709
 710                 /* Same BSSID,SSID was already included in scan results */
 711                 wpa_printf(MSG_DEBUG, "nl80211: Remove duplicated scan result "
 712                            "for " MACSTR, MAC2STR(r->bssid));
 713
 714                 if (((r->flags & WPA_SCAN_ASSOCIATED) &&
 715                      !(res->res[i]->flags & WPA_SCAN_ASSOCIATED)) ||
 716                     r->age < res->res[i]->age) {
 717                         os_free(res->res[i]);
 718                         res->res[i] = r;
 719                 } else
 720                         os_free(r);
 721                 return NL_SKIP;
 722         }
 723
 724         tmp = os_realloc_array(res->res, res->num + 1,
 725                                sizeof(struct wpa_scan_res *));
 726         if (tmp == NULL) {
 727                 os_free(r);
 728                 return NL_SKIP;
 729         }
 730         tmp[res->num++] = r;
 731         res->res = tmp;
 732
 733         return NL_SKIP;
 734 }
 735
 736
 737 static void clear_state_mismatch(struct wpa_driver_nl80211_data *drv,
 738                                  const u8 *addr)
 739 {
 740         if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) {
 741                 wpa_printf(MSG_DEBUG, "nl80211: Clear possible state "
 742                            "mismatch (" MACSTR ")", MAC2STR(addr));
 743                 wpa_driver_nl80211_mlme(drv, addr,
 744                                         NL80211_CMD_DEAUTHENTICATE,
 745                                         WLAN_REASON_PREV_AUTH_NOT_VALID, 1);
 746         }
 747 }
 748
 749
 750 static void wpa_driver_nl80211_check_bss_status(
 751         struct wpa_driver_nl80211_data *drv, struct wpa_scan_results *res)
 752 {
 753         size_t i;
 754
 755         for (i = 0; i < res->num; i++) {
 756                 struct wpa_scan_res *r = res->res[i];
 757
 758                 if (r->flags & WPA_SCAN_ASSOCIATED) {
 759                         wpa_printf(MSG_DEBUG, "nl80211: Scan results "
 760                                    "indicate BSS status with " MACSTR
 761                                    " as associated",
 762                                    MAC2STR(r->bssid));
 763                         if (is_sta_interface(drv->nlmode) &&
 764                             !drv->associated) {
 765                                 wpa_printf(MSG_DEBUG, "nl80211: Local state "
 766                                            "(not associated) does not match "
 767                                            "with BSS state");
 768                                 clear_state_mismatch(drv, r->bssid);
 769                         } else if (is_sta_interface(drv->nlmode) &&
 770                                    os_memcmp(drv->bssid, r->bssid, ETH_ALEN) !=
 771                                    0) {
 772                                 wpa_printf(MSG_DEBUG, "nl80211: Local state "
 773                                            "(associated with " MACSTR ") does "
 774                                            "not match with BSS state",
 775                                            MAC2STR(drv->bssid));
 776                                 clear_state_mismatch(drv, r->bssid);
 777                                 clear_state_mismatch(drv, drv->bssid);
 778                         }
 779                 }
 780         }
 781 }
 782
 783
 784 static struct wpa_scan_results *
 785 nl80211_get_scan_results(struct wpa_driver_nl80211_data *drv)
 786 {
 787         struct nl_msg *msg;
 788         struct wpa_scan_results *res;
 789         int ret;
 790         struct nl80211_bss_info_arg arg;
 791
 792         res = os_zalloc(sizeof(*res));
 793         if (res == NULL)
 794                 return NULL;
 795         if (!(msg = nl80211_cmd_msg(drv->first_bss, NLM_F_DUMP,
 796                                     NL80211_CMD_GET_SCAN))) {
 797                 wpa_scan_results_free(res);
 798                 return NULL;
 799         }
 800
 801         arg.drv = drv;
 802         arg.res = res;
 803         ret = send_and_recv_msgs(drv, msg, bss_info_handler, &arg);
 804         if (ret == 0) {
 805                 wpa_printf(MSG_DEBUG, "nl80211: Received scan results (%lu "
 806                            "BSSes)", (unsigned long) res->num);
 807                 nl80211_get_noise_for_scan_results(drv, res);
 808                 return res;
 809         }
 810         wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d "
 811                    "(%s)", ret, strerror(-ret));
 812         wpa_scan_results_free(res);
 813         return NULL;
 814 }
 815
 816
 817 /**
 818  * wpa_driver_nl80211_get_scan_results - Fetch the latest scan results
 819  * @priv: Pointer to private wext data from wpa_driver_nl80211_init()
 820  * Returns: Scan results on success, -1 on failure
 821  */
 822 struct wpa_scan_results * wpa_driver_nl80211_get_scan_results(void *priv)
 823 {
 824         struct i802_bss *bss = priv;
 825         struct wpa_driver_nl80211_data *drv = bss->drv;
 826         struct wpa_scan_results *res;
 827
 828         res = nl80211_get_scan_results(drv);
 829         if (res)
 830                 wpa_driver_nl80211_check_bss_status(drv, res);
 831         return res;
 832 }
 833
 834
 835 void nl80211_dump_scan(struct wpa_driver_nl80211_data *drv)
 836 {
 837         struct wpa_scan_results *res;
 838         size_t i;
 839
 840         res = nl80211_get_scan_results(drv);
 841         if (res == NULL) {
 842                 wpa_printf(MSG_DEBUG, "nl80211: Failed to get scan results");
 843                 return;
 844         }
 845
 846         wpa_printf(MSG_DEBUG, "nl80211: Scan result dump");
 847         for (i = 0; i < res->num; i++) {
 848                 struct wpa_scan_res *r = res->res[i];
 849                 wpa_printf(MSG_DEBUG, "nl80211: %d/%d " MACSTR "%s",
 850                            (int) i, (int) res->num, MAC2STR(r->bssid),
 851                            r->flags & WPA_SCAN_ASSOCIATED ? " [assoc]" : "");
 852         }
 853
 854         wpa_scan_results_free(res);
 855 }
 856
 857
 858 int wpa_driver_nl80211_abort_scan(void *priv)
 859 {
 860         struct i802_bss *bss = priv;
 861         struct wpa_driver_nl80211_data *drv = bss->drv;
 862         int ret;
 863         struct nl_msg *msg;
 864
 865         wpa_printf(MSG_DEBUG, "nl80211: Abort scan");
 866         msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_ABORT_SCAN);
 867         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
 868         if (ret) {
 869                 wpa_printf(MSG_DEBUG, "nl80211: Abort scan failed: ret=%d (%s)",
 870                            ret, strerror(-ret));
 871         }
 872
 873         return ret;
 874 }
 875
 876
 877 #ifdef CONFIG_DRIVER_NL80211_QCA
 878
 879 static int scan_cookie_handler(struct nl_msg *msg, void *arg)
 880 {
 881         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 882         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 883         u64 *cookie = arg;
 884
 885         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 886                   genlmsg_attrlen(gnlh, 0), NULL);
 887
 888         if (tb[NL80211_ATTR_VENDOR_DATA]) {
 889                 struct nlattr *nl_vendor = tb[NL80211_ATTR_VENDOR_DATA];
 890                 struct nlattr *tb_vendor[QCA_WLAN_VENDOR_ATTR_SCAN_MAX + 1];
 891
 892                 nla_parse(tb_vendor, QCA_WLAN_VENDOR_ATTR_SCAN_MAX,
 893                           nla_data(nl_vendor), nla_len(nl_vendor), NULL);
 894
 895                 if (tb_vendor[QCA_WLAN_VENDOR_ATTR_SCAN_COOKIE])
 896                         *cookie = nla_get_u64(
 897                                 tb_vendor[QCA_WLAN_VENDOR_ATTR_SCAN_COOKIE]);
 898         }
 899
 900         return NL_SKIP;
 901 }
 902
 903
 904 /**
 905  * wpa_driver_nl80211_vendor_scan - Request the driver to initiate a vendor scan
 906  * @bss: Pointer to private driver data from wpa_driver_nl80211_init()
 907  * @params: Scan parameters
 908  * Returns: 0 on success, -1 on failure
 909  */
 910 int wpa_driver_nl80211_vendor_scan(struct i802_bss *bss,
 911                                    struct wpa_driver_scan_params *params)
 912 {
 913         struct wpa_driver_nl80211_data *drv = bss->drv;
 914         struct nl_msg *msg = NULL;
 915         struct nlattr *attr;
 916         size_t i;
 917         u32 scan_flags = 0;
 918         int ret = -1;
 919         u64 cookie = 0;
 920
 921         wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: vendor scan request");
 922         drv->scan_for_auth = 0;
 923
 924         if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
 925             nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
 926             nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
 927                         QCA_NL80211_VENDOR_SUBCMD_TRIGGER_SCAN) )
 928                 goto fail;
 929
 930         attr = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
 931         if (attr == NULL)
 932                 goto fail;
 933
 934         if (params->num_ssids) {
 935                 struct nlattr *ssids;
 936
 937                 ssids = nla_nest_start(msg, QCA_WLAN_VENDOR_ATTR_SCAN_SSIDS);
 938                 if (ssids == NULL)
 939                         goto fail;
 940                 for (i = 0; i < params->num_ssids; i++) {
 941                         wpa_hexdump_ascii(MSG_MSGDUMP, "nl80211: Scan SSID",
 942                                         params->ssids[i].ssid,
 943                                         params->ssids[i].ssid_len);
 944                         if (nla_put(msg, i + 1, params->ssids[i].ssid_len,
 945                                     params->ssids[i].ssid))
 946                                 goto fail;
 947                 }
 948                 nla_nest_end(msg, ssids);
 949         }
 950
 951         if (params->extra_ies) {
 952                 wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan extra IEs",
 953                             params->extra_ies, params->extra_ies_len);
 954                 if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_SCAN_IE,
 955                             params->extra_ies_len, params->extra_ies))
 956                         goto fail;
 957         }
 958
 959         if (params->freqs) {
 960                 struct nlattr *freqs;
 961
 962                 freqs = nla_nest_start(msg,
 963                                        QCA_WLAN_VENDOR_ATTR_SCAN_FREQUENCIES);
 964                 if (freqs == NULL)
 965                         goto fail;
 966                 for (i = 0; params->freqs[i]; i++) {
 967                         wpa_printf(MSG_MSGDUMP,
 968                                    "nl80211: Scan frequency %u MHz",
 969                                    params->freqs[i]);
 970                         if (nla_put_u32(msg, i + 1, params->freqs[i]))
 971                                 goto fail;
 972                 }
 973                 nla_nest_end(msg, freqs);
 974         }
 975
 976         os_free(drv->filter_ssids);
 977         drv->filter_ssids = params->filter_ssids;
 978         params->filter_ssids = NULL;
 979         drv->num_filter_ssids = params->num_filter_ssids;
 980
 981         if (params->low_priority && drv->have_low_prio_scan) {
 982                 wpa_printf(MSG_DEBUG,
 983                            "nl80211: Add NL80211_SCAN_FLAG_LOW_PRIORITY");
 984                 scan_flags |= NL80211_SCAN_FLAG_LOW_PRIORITY;
 985         }
 986
 987         if (params->mac_addr_rand) {
 988                 wpa_printf(MSG_DEBUG,
 989                            "nl80211: Add NL80211_SCAN_FLAG_RANDOM_ADDR");
 990                 scan_flags |= NL80211_SCAN_FLAG_RANDOM_ADDR;
 991
 992                 if (params->mac_addr) {
 993                         wpa_printf(MSG_DEBUG, "nl80211: MAC address: " MACSTR,
 994                                    MAC2STR(params->mac_addr));
 995                         if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_SCAN_MAC,
 996                                     ETH_ALEN, params->mac_addr))
 997                                 goto fail;
 998                 }
 999
1000                 if (params->mac_addr_mask) {
1001                         wpa_printf(MSG_DEBUG, "nl80211: MAC address mask: "
1002                                    MACSTR, MAC2STR(params->mac_addr_mask));
1003                         if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_SCAN_MAC_MASK,
1004                                     ETH_ALEN, params->mac_addr_mask))
1005                                 goto fail;
1006                 }
1007         }
1008
1009         if (scan_flags &&
1010             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, scan_flags))
1011                 goto fail;
1012
1013         if (params->p2p_probe) {
1014                 struct nlattr *rates;
1015
1016                 wpa_printf(MSG_DEBUG, "nl80211: P2P probe - mask SuppRates");
1017
1018                 rates = nla_nest_start(msg,
1019                                        QCA_WLAN_VENDOR_ATTR_SCAN_SUPP_RATES);
1020                 if (rates == NULL)
1021                         goto fail;
1022
1023                 /*
1024                  * Remove 2.4 GHz rates 1, 2, 5.5, 11 Mbps from supported rates
1025                  * by masking out everything else apart from the OFDM rates 6,
1026                  * 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS rates. All 5 GHz
1027                  * rates are left enabled.
1028                  */
1029                 if (nla_put(msg, NL80211_BAND_2GHZ, 8,
1030                             "\x0c\x12\x18\x24\x30\x48\x60\x6c"))
1031                         goto fail;
1032                 nla_nest_end(msg, rates);
1033
1034                 if (nla_put_flag(msg, QCA_WLAN_VENDOR_ATTR_SCAN_TX_NO_CCK_RATE))
1035                         goto fail;
1036         }
1037
1038         nla_nest_end(msg, attr);
1039
1040         ret = send_and_recv_msgs(drv, msg, scan_cookie_handler, &cookie);
1041         msg = NULL;
1042         if (ret) {
1043                 wpa_printf(MSG_DEBUG,
1044                            "nl80211: Vendor scan trigger failed: ret=%d (%s)",
1045                            ret, strerror(-ret));
1046                 goto fail;
1047         }
1048
1049         drv->vendor_scan_cookie = cookie;
1050         drv->scan_state = SCAN_REQUESTED;
1051
1052         wpa_printf(MSG_DEBUG,
1053                    "nl80211: Vendor scan requested (ret=%d) - scan timeout 30 seconds, scan cookie:0x%llx",
1054                    ret, (long long unsigned int) cookie);
1055         eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
1056         eloop_register_timeout(30, 0, wpa_driver_nl80211_scan_timeout,
1057                                drv, drv->ctx);
1058         drv->last_scan_cmd = NL80211_CMD_VENDOR;
1059
1060 fail:
1061         nlmsg_free(msg);
1062         return ret;
1063 }
1064
1065 #endif /* CONFIG_DRIVER_NL80211_QCA */