1 /*
2 * Driver interaction with Linux nl80211/cfg80211 - Scanning
3 * Copyright(c) 2015 Intel Deutschland GmbH
4 * Copyright (c) 2002-2014, Jouni Malinen <j@w1.fi>
5 * Copyright (c) 2007, Johannes Berg <johannes@sipsolutions.net>
6 * Copyright (c) 2009-2010, Atheros Communications
7 *
8 * This software may be distributed under the terms of the BSD license.
9 * See README for more details.
10 */
11
12 #include "includes.h"
13 #include <time.h>
14 #include <netlink/genl/genl.h>
15
16 #include "utils/common.h"
17 #include "utils/eloop.h"
18 #include "common/ieee802_11_defs.h"
19 #include "common/ieee802_11_common.h"
20 #include "common/qca-vendor.h"
21 #include "driver_nl80211.h"
22
23 #ifdef OPEN_HARMONY_P2P_ONEHOP_FIND
24 #include "p2p_onehop_scan_opt.h"
25 #endif
26
27 #define MAX_NL80211_NOISE_FREQS 100
28
29 struct nl80211_noise_info {
30 u32 freq[MAX_NL80211_NOISE_FREQS];
31 s8 noise[MAX_NL80211_NOISE_FREQS];
32 unsigned int count;
33 };
34
get_noise_for_scan_results(struct nl_msg * msg,void * arg)35 static int get_noise_for_scan_results(struct nl_msg *msg, void *arg)
36 {
37 struct nlattr *tb[NL80211_ATTR_MAX + 1];
38 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
39 struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
40 static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
41 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
42 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
43 };
44 struct nl80211_noise_info *info = arg;
45
46 if (info->count >= MAX_NL80211_NOISE_FREQS)
47 return NL_SKIP;
48
49 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
50 genlmsg_attrlen(gnlh, 0), NULL);
51
52 if (!tb[NL80211_ATTR_SURVEY_INFO]) {
53 wpa_printf(MSG_DEBUG, "nl80211: Survey data missing");
54 return NL_SKIP;
55 }
56
57 if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
58 tb[NL80211_ATTR_SURVEY_INFO],
59 survey_policy)) {
60 wpa_printf(MSG_DEBUG, "nl80211: Failed to parse nested "
61 "attributes");
62 return NL_SKIP;
63 }
64
65 if (!sinfo[NL80211_SURVEY_INFO_NOISE])
66 return NL_SKIP;
67
68 if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY])
69 return NL_SKIP;
70
71 info->freq[info->count] =
72 nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]);
73 info->noise[info->count] =
74 (s8) nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
75 info->count++;
76
77 return NL_SKIP;
78 }
79
80
nl80211_get_noise_for_scan_results(struct wpa_driver_nl80211_data * drv,struct nl80211_noise_info * info)81 static int nl80211_get_noise_for_scan_results(
82 struct wpa_driver_nl80211_data *drv, struct nl80211_noise_info *info)
83 {
84 struct nl_msg *msg;
85
86 os_memset(info, 0, sizeof(*info));
87 msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_GET_SURVEY);
88 return send_and_recv_resp(drv, msg, get_noise_for_scan_results, info);
89 }
90
91
nl80211_abort_scan(struct i802_bss * bss)92 static int nl80211_abort_scan(struct i802_bss *bss)
93 {
94 int ret;
95 struct nl_msg *msg;
96 struct wpa_driver_nl80211_data *drv = bss->drv;
97
98 wpa_printf(MSG_DEBUG, "nl80211: Abort scan");
99 msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_ABORT_SCAN);
100 ret = send_and_recv_cmd(drv, msg);
101 if (ret) {
102 wpa_printf(MSG_DEBUG, "nl80211: Abort scan failed: ret=%d (%s)",
103 ret, strerror(-ret));
104 }
105 return ret;
106 }
107
108
109 #ifdef CONFIG_DRIVER_NL80211_QCA
nl80211_abort_vendor_scan(struct wpa_driver_nl80211_data * drv,u64 scan_cookie)110 static int nl80211_abort_vendor_scan(struct wpa_driver_nl80211_data *drv,
111 u64 scan_cookie)
112 {
113 struct nl_msg *msg;
114 struct nlattr *params;
115 int ret;
116
117 wpa_printf(MSG_DEBUG, "nl80211: Abort vendor scan with cookie 0x%llx",
118 (long long unsigned int) scan_cookie);
119
120 msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR);
121 if (!msg ||
122 nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
123 nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
124 QCA_NL80211_VENDOR_SUBCMD_ABORT_SCAN) ||
125 !(params = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
126 nla_put_u64(msg, QCA_WLAN_VENDOR_ATTR_SCAN_COOKIE, scan_cookie))
127 goto fail;
128
129 nla_nest_end(msg, params);
130
131 ret = send_and_recv_cmd(drv, msg);
132 msg = NULL;
133 if (ret) {
134 wpa_printf(MSG_INFO,
135 "nl80211: Aborting vendor scan with cookie 0x%llx failed: ret=%d (%s)",
136 (long long unsigned int) scan_cookie, ret,
137 strerror(-ret));
138 goto fail;
139 }
140 return 0;
141 fail:
142 nlmsg_free(msg);
143 return -1;
144 }
145 #endif /* CONFIG_DRIVER_NL80211_QCA */
146
147
148 /**
149 * wpa_driver_nl80211_scan_timeout - Scan timeout to report scan completion
150 * @eloop_ctx: Driver private data
151 * @timeout_ctx: ctx argument given to wpa_driver_nl80211_init()
152 *
153 * This function can be used as registered timeout when starting a scan to
154 * generate a scan completed event if the driver does not report this.
155 */
wpa_driver_nl80211_scan_timeout(void * eloop_ctx,void * timeout_ctx)156 void wpa_driver_nl80211_scan_timeout(void *eloop_ctx, void *timeout_ctx)
157 {
158 struct wpa_driver_nl80211_data *drv = eloop_ctx;
159
160 wpa_printf(MSG_DEBUG, "nl80211: Scan timeout - try to abort it");
161 #ifdef CONFIG_DRIVER_NL80211_QCA
162 if (drv->vendor_scan_cookie &&
163 nl80211_abort_vendor_scan(drv, drv->vendor_scan_cookie) == 0)
164 return;
165 #endif /* CONFIG_DRIVER_NL80211_QCA */
166 if (!drv->vendor_scan_cookie &&
167 nl80211_abort_scan(drv->first_bss) == 0)
168 return;
169
170 wpa_printf(MSG_DEBUG, "nl80211: Failed to abort scan");
171
172 if (drv->ap_scan_as_station != NL80211_IFTYPE_UNSPECIFIED)
173 nl80211_restore_ap_mode(drv->first_bss);
174
175 wpa_printf(MSG_DEBUG, "nl80211: Try to get scan results");
176 wpa_supplicant_event(timeout_ctx, EVENT_SCAN_RESULTS, NULL);
177 }
178
179
180 static struct nl_msg *
nl80211_scan_common(struct i802_bss * bss,u8 cmd,struct wpa_driver_scan_params * params)181 nl80211_scan_common(struct i802_bss *bss, u8 cmd,
182 struct wpa_driver_scan_params *params)
183 {
184 struct wpa_driver_nl80211_data *drv = bss->drv;
185 struct nl_msg *msg;
186 size_t i;
187 u32 scan_flags = 0;
188
189 msg = nl80211_cmd_msg(bss, 0, cmd);
190 if (!msg)
191 return NULL;
192
193 if (params->num_ssids) {
194 struct nlattr *ssids;
195
196 ssids = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
197 if (ssids == NULL)
198 goto fail;
199 for (i = 0; i < params->num_ssids; i++) {
200 wpa_printf(MSG_MSGDUMP, "nl80211: Scan SSID %s",
201 anonymize_ssid(wpa_ssid_txt(params->ssids[i].ssid,
202 params->ssids[i].ssid_len)));
203 if (nla_put(msg, i + 1, params->ssids[i].ssid_len,
204 params->ssids[i].ssid))
205 goto fail;
206 }
207 nla_nest_end(msg, ssids);
208
209 /*
210 * If allowed, scan for 6 GHz APs that are reported by other
211 * APs. Note that if the flag is not set and 6 GHz channels are
212 * to be scanned, it is highly likely that non-PSC channels
213 * would be scanned passively (due to the Probe Request frame
214 * transmission restrictions mandated in IEEE Std 802.11ax-2021,
215 * 26.17.2.3 (Scanning in the 6 GHz band). Passive scanning of
216 * all non-PSC channels would take a significant amount of time.
217 */
218 if (!params->non_coloc_6ghz) {
219 wpa_printf(MSG_DEBUG,
220 "nl80211: Scan co-located APs on 6 GHz");
221 scan_flags |= NL80211_SCAN_FLAG_COLOCATED_6GHZ;
222 }
223 } else {
224 wpa_printf(MSG_EXCESSIVE, "nl80211: Passive scan requested");
225 }
226
227 if (params->extra_ies) {
228 wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan extra IEs",
229 params->extra_ies, params->extra_ies_len);
230 if (nla_put(msg, NL80211_ATTR_IE, params->extra_ies_len,
231 params->extra_ies))
232 goto fail;
233 }
234
235 if (params->freqs) {
236 struct nlattr *freqs;
237 freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
238 if (freqs == NULL)
239 goto fail;
240 for (i = 0; params->freqs[i]; i++) {
241 wpa_printf(MSG_MSGDUMP, "nl80211: Scan frequency %u "
242 "MHz", params->freqs[i]);
243 if (nla_put_u32(msg, i + 1, params->freqs[i]))
244 goto fail;
245 }
246 nla_nest_end(msg, freqs);
247 }
248
249 os_free(drv->filter_ssids);
250 drv->filter_ssids = params->filter_ssids;
251 params->filter_ssids = NULL;
252 drv->num_filter_ssids = params->num_filter_ssids;
253
254 if (!drv->hostapd && is_ap_interface(drv->nlmode)) {
255 wpa_printf(MSG_DEBUG, "nl80211: Add NL80211_SCAN_FLAG_AP");
256 scan_flags |= NL80211_SCAN_FLAG_AP;
257 }
258
259 if (params->only_new_results) {
260 wpa_printf(MSG_DEBUG, "nl80211: Add NL80211_SCAN_FLAG_FLUSH");
261 scan_flags |= NL80211_SCAN_FLAG_FLUSH;
262 }
263
264 if (params->low_priority && drv->have_low_prio_scan) {
265 wpa_printf(MSG_DEBUG,
266 "nl80211: Add NL80211_SCAN_FLAG_LOW_PRIORITY");
267 scan_flags |= NL80211_SCAN_FLAG_LOW_PRIORITY;
268 }
269
270 if (params->mac_addr_rand) {
271 wpa_printf(MSG_DEBUG,
272 "nl80211: Add NL80211_SCAN_FLAG_RANDOM_ADDR");
273 scan_flags |= NL80211_SCAN_FLAG_RANDOM_ADDR;
274
275 if (params->mac_addr) {
276 wpa_printf(MSG_DEBUG, "nl80211: MAC address: " MACSTR_SEC,
277 MAC2STR_SEC(params->mac_addr));
278 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
279 params->mac_addr))
280 goto fail;
281 }
282
283 if (params->mac_addr_mask) {
284 wpa_printf(MSG_DEBUG, "nl80211: MAC address mask: "
285 MACSTR_SEC, MAC2STR_SEC(params->mac_addr_mask));
286 if (nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN,
287 params->mac_addr_mask))
288 goto fail;
289 }
290 }
291
292 if (params->duration) {
293 if (!(drv->capa.rrm_flags &
294 WPA_DRIVER_FLAGS_SUPPORT_SET_SCAN_DWELL) ||
295 nla_put_u16(msg, NL80211_ATTR_MEASUREMENT_DURATION,
296 params->duration))
297 goto fail;
298
299 if (params->duration_mandatory &&
300 nla_put_flag(msg,
301 NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY))
302 goto fail;
303 }
304
305 if (params->oce_scan) {
306 wpa_printf(MSG_DEBUG,
307 "nl80211: Add NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME");
308 wpa_printf(MSG_DEBUG,
309 "nl80211: Add NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP");
310 wpa_printf(MSG_DEBUG,
311 "nl80211: Add NL80211_SCAN_FLAG_OCE_PROBE_REQ_MIN_TX_RATE");
312 wpa_printf(MSG_DEBUG,
313 "nl80211: Add NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION");
314 scan_flags |= NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME |
315 NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP |
316 NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE |
317 NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION;
318 }
319
320 if (params->min_probe_req_content) {
321 if (drv->capa.flags2 & WPA_DRIVER_FLAGS2_SCAN_MIN_PREQ)
322 scan_flags |= NL80211_SCAN_FLAG_MIN_PREQ_CONTENT;
323 else
324 wpa_printf(MSG_DEBUG,
325 "nl80211: NL80211_SCAN_FLAG_MIN_PREQ_CONTENT not supported");
326 }
327
328 #ifdef OPEN_HARMONY_P2P_ONEHOP_FIND
329 p2p_set_onehop_scan_param(&scan_flags, bss);
330 #endif
331
332 if (scan_flags &&
333 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, scan_flags))
334 goto fail;
335
336 return msg;
337
338 fail:
339 nlmsg_free(msg);
340 return NULL;
341 }
342
343
344 /**
345 * wpa_driver_nl80211_scan - Request the driver to initiate scan
346 * @bss: Pointer to private driver data from wpa_driver_nl80211_init()
347 * @params: Scan parameters
348 * Returns: 0 on success, -1 on failure
349 */
wpa_driver_nl80211_scan(struct i802_bss * bss,struct wpa_driver_scan_params * params)350 int wpa_driver_nl80211_scan(struct i802_bss *bss,
351 struct wpa_driver_scan_params *params)
352 {
353 struct wpa_driver_nl80211_data *drv = bss->drv;
354 int ret = -1, timeout;
355 struct nl_msg *msg = NULL;
356
357 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: scan request");
358 drv->scan_for_auth = 0;
359
360 if (TEST_FAIL())
361 return -1;
362
363 msg = nl80211_scan_common(bss, NL80211_CMD_TRIGGER_SCAN, params);
364 if (!msg)
365 return -1;
366
367 if (params->p2p_probe) {
368 struct nlattr *rates;
369
370 wpa_printf(MSG_EXCESSIVE, "nl80211: P2P probe - mask SuppRates");
371
372 rates = nla_nest_start(msg, NL80211_ATTR_SCAN_SUPP_RATES);
373 if (rates == NULL)
374 goto fail;
375
376 /*
377 * Remove 2.4 GHz rates 1, 2, 5.5, 11 Mbps from supported rates
378 * by masking out everything else apart from the OFDM rates 6,
379 * 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS rates. All 5 GHz
380 * rates are left enabled.
381 */
382 if (nla_put(msg, NL80211_BAND_2GHZ, 8,
383 "\x0c\x12\x18\x24\x30\x48\x60\x6c"))
384 goto fail;
385 nla_nest_end(msg, rates);
386
387 if (nla_put_flag(msg, NL80211_ATTR_TX_NO_CCK_RATE))
388 goto fail;
389 }
390
391 if (params->bssid) {
392 wpa_printf(MSG_DEBUG, "nl80211: Scan for a specific BSSID: "
393 MACSTR_SEC, MAC2STR_SEC(params->bssid));
394 if (nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid))
395 goto fail;
396 /* NL80211_ATTR_MAC was used for this purpose initially and the
397 * NL80211_ATTR_BSSID was added in 2016 when MAC address
398 * randomization was added. For compatibility with older kernel
399 * versions, add the NL80211_ATTR_MAC attribute as well when
400 * the conflicting functionality is not in use. */
401 if (!params->mac_addr_rand &&
402 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid))
403 goto fail;
404 }
405
406 ret = send_and_recv_cmd(drv, msg);
407 msg = NULL;
408 if (ret) {
409 wpa_printf(MSG_INFO, "nl80211: Scan trigger failed: ret=%d "
410 "(%s)", ret, strerror(-ret));
411 if (drv->hostapd && is_ap_interface(drv->nlmode)) {
412 /*
413 * mac80211 does not allow scan requests in AP mode, so
414 * try to do this in station mode.
415 */
416 drv->ap_scan_as_station = drv->nlmode;
417 if (wpa_driver_nl80211_set_mode(
418 bss, NL80211_IFTYPE_STATION) ||
419 wpa_driver_nl80211_scan(bss, params)) {
420 nl80211_restore_ap_mode(bss);
421 goto fail;
422 }
423
424 ret = 0;
425 } else
426 goto fail;
427 }
428
429 drv->scan_state = SCAN_REQUESTED;
430 /* Not all drivers generate "scan completed" wireless event, so try to
431 * read results after a timeout. */
432 timeout = drv->uses_6ghz ? 20 : 10;
433 if (drv->uses_s1g)
434 timeout += 5;
435 if (drv->scan_complete_events) {
436 /*
437 * The driver seems to deliver events to notify when scan is
438 * complete, so use longer timeout to avoid race conditions
439 * with scanning and following association request.
440 */
441 timeout = 30;
442 }
443 wpa_printf(MSG_INFO, "Scan requested (ret=%d) - scan timeout %d "
444 "seconds", ret, timeout);
445 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
446 eloop_register_timeout(timeout, 0, wpa_driver_nl80211_scan_timeout,
447 drv, drv->ctx);
448 drv->last_scan_cmd = NL80211_CMD_TRIGGER_SCAN;
449
450 fail:
451 nlmsg_free(msg);
452 return ret;
453 }
454
455
456 static int
nl80211_sched_scan_add_scan_plans(struct wpa_driver_nl80211_data * drv,struct nl_msg * msg,struct wpa_driver_scan_params * params)457 nl80211_sched_scan_add_scan_plans(struct wpa_driver_nl80211_data *drv,
458 struct nl_msg *msg,
459 struct wpa_driver_scan_params *params)
460 {
461 struct nlattr *plans;
462 struct sched_scan_plan *scan_plans = params->sched_scan_plans;
463 unsigned int i;
464
465 plans = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
466 if (!plans)
467 return -1;
468
469 for (i = 0; i < params->sched_scan_plans_num; i++) {
470 struct nlattr *plan = nla_nest_start(msg, i + 1);
471
472 if (!plan)
473 return -1;
474
475 if (!scan_plans[i].interval ||
476 scan_plans[i].interval >
477 drv->capa.max_sched_scan_plan_interval) {
478 wpa_printf(MSG_DEBUG,
479 "nl80211: sched scan plan no. %u: Invalid interval: %u",
480 i, scan_plans[i].interval);
481 return -1;
482 }
483
484 if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
485 scan_plans[i].interval))
486 return -1;
487
488 if (scan_plans[i].iterations >
489 drv->capa.max_sched_scan_plan_iterations) {
490 wpa_printf(MSG_DEBUG,
491 "nl80211: sched scan plan no. %u: Invalid number of iterations: %u",
492 i, scan_plans[i].iterations);
493 return -1;
494 }
495
496 if (scan_plans[i].iterations &&
497 nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
498 scan_plans[i].iterations))
499 return -1;
500
501 nla_nest_end(msg, plan);
502
503 /*
504 * All the scan plans must specify the number of iterations
505 * except the last plan, which will run infinitely. So if the
506 * number of iterations is not specified, this ought to be the
507 * last scan plan.
508 */
509 if (!scan_plans[i].iterations)
510 break;
511 }
512
513 if (i != params->sched_scan_plans_num - 1) {
514 wpa_printf(MSG_DEBUG,
515 "nl80211: All sched scan plans but the last must specify number of iterations");
516 return -1;
517 }
518
519 nla_nest_end(msg, plans);
520 return 0;
521 }
522
523
524 /**
525 * wpa_driver_nl80211_sched_scan - Initiate a scheduled scan
526 * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
527 * @params: Scan parameters
528 * Returns: 0 on success, -1 on failure or if not supported
529 */
wpa_driver_nl80211_sched_scan(void * priv,struct wpa_driver_scan_params * params)530 int wpa_driver_nl80211_sched_scan(void *priv,
531 struct wpa_driver_scan_params *params)
532 {
533 struct i802_bss *bss = priv;
534 struct wpa_driver_nl80211_data *drv = bss->drv;
535 int ret = -1;
536 struct nl_msg *msg;
537 size_t i;
538
539 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: sched_scan request");
540
541 #ifdef ANDROID
542 if (!drv->capa.sched_scan_supported)
543 return android_pno_start(bss, params);
544 #endif /* ANDROID */
545
546 if (!params->sched_scan_plans_num ||
547 params->sched_scan_plans_num > drv->capa.max_sched_scan_plans) {
548 wpa_printf(MSG_ERROR,
549 "nl80211: Invalid number of sched scan plans: %u",
550 params->sched_scan_plans_num);
551 return -1;
552 }
553
554 msg = nl80211_scan_common(bss, NL80211_CMD_START_SCHED_SCAN, params);
555 if (!msg)
556 goto fail;
557
558 if (drv->capa.max_sched_scan_plan_iterations) {
559 if (nl80211_sched_scan_add_scan_plans(drv, msg, params))
560 goto fail;
561 } else {
562 if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
563 params->sched_scan_plans[0].interval * 1000))
564 goto fail;
565 }
566
567 if ((drv->num_filter_ssids &&
568 (int) drv->num_filter_ssids <= drv->capa.max_match_sets) ||
569 params->filter_rssi) {
570 struct nlattr *match_sets;
571 match_sets = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
572 if (match_sets == NULL)
573 goto fail;
574
575 for (i = 0; i < drv->num_filter_ssids; i++) {
576 struct nlattr *match_set_ssid;
577 wpa_printf(MSG_MSGDUMP,
578 "nl80211: Sched scan filter SSID %s",
579 anonymize_ssid(wpa_ssid_txt(drv->filter_ssids[i].ssid,
580 drv->filter_ssids[i].ssid_len)));
581
582 match_set_ssid = nla_nest_start(msg, i + 1);
583 if (match_set_ssid == NULL ||
584 nla_put(msg, NL80211_ATTR_SCHED_SCAN_MATCH_SSID,
585 drv->filter_ssids[i].ssid_len,
586 drv->filter_ssids[i].ssid) ||
587 (params->filter_rssi &&
588 nla_put_u32(msg,
589 NL80211_SCHED_SCAN_MATCH_ATTR_RSSI,
590 params->filter_rssi)))
591 goto fail;
592
593 nla_nest_end(msg, match_set_ssid);
594 }
595
596 /*
597 * Due to backward compatibility code, newer kernels treat this
598 * matchset (with only an RSSI filter) as the default for all
599 * other matchsets, unless it's the only one, in which case the
600 * matchset will actually allow all SSIDs above the RSSI.
601 */
602 if (params->filter_rssi) {
603 struct nlattr *match_set_rssi;
604 match_set_rssi = nla_nest_start(msg, 0);
605 if (match_set_rssi == NULL ||
606 nla_put_u32(msg, NL80211_SCHED_SCAN_MATCH_ATTR_RSSI,
607 params->filter_rssi))
608 goto fail;
609 wpa_printf(MSG_MSGDUMP,
610 "nl80211: Sched scan RSSI filter %d dBm",
611 params->filter_rssi);
612 nla_nest_end(msg, match_set_rssi);
613 }
614
615 nla_nest_end(msg, match_sets);
616 }
617
618 if (params->relative_rssi_set) {
619 struct nl80211_bss_select_rssi_adjust rssi_adjust;
620
621 os_memset(&rssi_adjust, 0, sizeof(rssi_adjust));
622 wpa_printf(MSG_DEBUG, "nl80211: Relative RSSI: %d",
623 params->relative_rssi);
624 if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
625 params->relative_rssi))
626 goto fail;
627
628 if (params->relative_adjust_rssi) {
629 int pref_band_set = 1;
630
631 switch (params->relative_adjust_band) {
632 case WPA_SETBAND_5G:
633 rssi_adjust.band = NL80211_BAND_5GHZ;
634 break;
635 case WPA_SETBAND_2G:
636 rssi_adjust.band = NL80211_BAND_2GHZ;
637 break;
638 default:
639 pref_band_set = 0;
640 break;
641 }
642 rssi_adjust.delta = params->relative_adjust_rssi;
643
644 if (pref_band_set &&
645 nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
646 sizeof(rssi_adjust), &rssi_adjust))
647 goto fail;
648 }
649 }
650
651 if (params->sched_scan_start_delay &&
652 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY,
653 params->sched_scan_start_delay))
654 goto fail;
655
656 ret = send_and_recv_cmd(drv, msg);
657
658 /* TODO: if we get an error here, we should fall back to normal scan */
659
660 msg = NULL;
661 if (ret) {
662 wpa_printf(MSG_DEBUG, "nl80211: Sched scan start failed: "
663 "ret=%d (%s)", ret, strerror(-ret));
664 goto fail;
665 }
666
667 wpa_printf(MSG_DEBUG, "nl80211: Sched scan requested (ret=%d)", ret);
668
669 fail:
670 nlmsg_free(msg);
671 return ret;
672 }
673
674
675 /**
676 * wpa_driver_nl80211_stop_sched_scan - Stop a scheduled scan
677 * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
678 * Returns: 0 on success, -1 on failure or if not supported
679 */
wpa_driver_nl80211_stop_sched_scan(void * priv)680 int wpa_driver_nl80211_stop_sched_scan(void *priv)
681 {
682 struct i802_bss *bss = priv;
683 struct wpa_driver_nl80211_data *drv = bss->drv;
684 int ret;
685 struct nl_msg *msg;
686
687 #ifdef ANDROID
688 if (!drv->capa.sched_scan_supported)
689 return android_pno_stop(bss);
690 #endif /* ANDROID */
691
692 msg = nl80211_drv_msg(drv, 0, NL80211_CMD_STOP_SCHED_SCAN);
693 ret = send_and_recv_cmd(drv, msg);
694 if (ret) {
695 wpa_printf(MSG_DEBUG,
696 "nl80211: Sched scan stop failed: ret=%d (%s)",
697 ret, strerror(-ret));
698 } else {
699 wpa_printf(MSG_DEBUG,
700 "nl80211: Sched scan stop sent");
701 }
702
703 return ret;
704 }
705
706
nl80211_scan_filtered(struct wpa_driver_nl80211_data * drv,const u8 * ie,size_t ie_len)707 static int nl80211_scan_filtered(struct wpa_driver_nl80211_data *drv,
708 const u8 *ie, size_t ie_len)
709 {
710 const u8 *ssid;
711 size_t i;
712
713 if (drv->filter_ssids == NULL)
714 return 0;
715
716 ssid = get_ie(ie, ie_len, WLAN_EID_SSID);
717 if (ssid == NULL)
718 return 1;
719
720 for (i = 0; i < drv->num_filter_ssids; i++) {
721 if (ssid[1] == drv->filter_ssids[i].ssid_len &&
722 os_memcmp(ssid + 2, drv->filter_ssids[i].ssid, ssid[1]) ==
723 0)
724 return 0;
725 }
726
727 return 1;
728 }
729
730
731 static struct wpa_scan_res *
nl80211_parse_bss_info(struct wpa_driver_nl80211_data * drv,struct nl_msg * msg,const u8 * bssid)732 nl80211_parse_bss_info(struct wpa_driver_nl80211_data *drv,
733 struct nl_msg *msg, const u8 *bssid)
734 {
735 struct nlattr *tb[NL80211_ATTR_MAX + 1];
736 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
737 struct nlattr *bss[NL80211_BSS_MAX + 1];
738 static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = {
739 [NL80211_BSS_BSSID] = { .type = NLA_UNSPEC },
740 [NL80211_BSS_FREQUENCY] = { .type = NLA_U32 },
741 [NL80211_BSS_TSF] = { .type = NLA_U64 },
742 [NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 },
743 [NL80211_BSS_CAPABILITY] = { .type = NLA_U16 },
744 [NL80211_BSS_INFORMATION_ELEMENTS] = { .type = NLA_UNSPEC },
745 [NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 },
746 [NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 },
747 [NL80211_BSS_STATUS] = { .type = NLA_U32 },
748 [NL80211_BSS_SEEN_MS_AGO] = { .type = NLA_U32 },
749 [NL80211_BSS_BEACON_IES] = { .type = NLA_UNSPEC },
750 [NL80211_BSS_BEACON_TSF] = { .type = NLA_U64 },
751 [NL80211_BSS_PARENT_TSF] = { .type = NLA_U64 },
752 [NL80211_BSS_PARENT_BSSID] = { .type = NLA_UNSPEC },
753 [NL80211_BSS_LAST_SEEN_BOOTTIME] = { .type = NLA_U64 },
754 };
755 struct wpa_scan_res *r;
756 const u8 *ie, *beacon_ie;
757 size_t ie_len, beacon_ie_len;
758 u8 *pos;
759
760 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
761 genlmsg_attrlen(gnlh, 0), NULL);
762 if (!tb[NL80211_ATTR_BSS])
763 return NULL;
764 if (nla_parse_nested(bss, NL80211_BSS_MAX, tb[NL80211_ATTR_BSS],
765 bss_policy))
766 return NULL;
767 if (bssid && bss[NL80211_BSS_BSSID] &&
768 !ether_addr_equal(bssid, nla_data(bss[NL80211_BSS_BSSID])))
769 return NULL;
770 if (bss[NL80211_BSS_INFORMATION_ELEMENTS]) {
771 ie = nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
772 ie_len = nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
773 } else {
774 ie = NULL;
775 ie_len = 0;
776 }
777 if (bss[NL80211_BSS_BEACON_IES]) {
778 beacon_ie = nla_data(bss[NL80211_BSS_BEACON_IES]);
779 beacon_ie_len = nla_len(bss[NL80211_BSS_BEACON_IES]);
780 } else {
781 beacon_ie = NULL;
782 beacon_ie_len = 0;
783 }
784
785 if (nl80211_scan_filtered(drv, ie ? ie : beacon_ie,
786 ie ? ie_len : beacon_ie_len))
787 return NULL;
788
789 r = os_zalloc(sizeof(*r) + ie_len + beacon_ie_len);
790 if (r == NULL)
791 return NULL;
792 if (bss[NL80211_BSS_BSSID])
793 os_memcpy(r->bssid, nla_data(bss[NL80211_BSS_BSSID]),
794 ETH_ALEN);
795 if (bss[NL80211_BSS_FREQUENCY])
796 r->freq = nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
797 if (bss[NL80211_BSS_BEACON_INTERVAL])
798 r->beacon_int = nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]);
799 if (bss[NL80211_BSS_CAPABILITY])
800 r->caps = nla_get_u16(bss[NL80211_BSS_CAPABILITY]);
801 r->flags |= WPA_SCAN_NOISE_INVALID;
802 if (bss[NL80211_BSS_SIGNAL_MBM]) {
803 r->level = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]);
804 r->level /= 100; /* mBm to dBm */
805 r->flags |= WPA_SCAN_LEVEL_DBM | WPA_SCAN_QUAL_INVALID;
806 } else if (bss[NL80211_BSS_SIGNAL_UNSPEC]) {
807 r->level = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]);
808 r->flags |= WPA_SCAN_QUAL_INVALID;
809 } else
810 r->flags |= WPA_SCAN_LEVEL_INVALID | WPA_SCAN_QUAL_INVALID;
811 if (bss[NL80211_BSS_TSF])
812 r->tsf = nla_get_u64(bss[NL80211_BSS_TSF]);
813 if (bss[NL80211_BSS_BEACON_TSF]) {
814 u64 tsf = nla_get_u64(bss[NL80211_BSS_BEACON_TSF]);
815 if (tsf > r->tsf) {
816 r->tsf = tsf;
817 r->beacon_newer = true;
818 }
819 }
820 if (bss[NL80211_BSS_SEEN_MS_AGO])
821 r->age = nla_get_u32(bss[NL80211_BSS_SEEN_MS_AGO]);
822 if (bss[NL80211_BSS_LAST_SEEN_BOOTTIME]) {
823 u64 boottime;
824 struct timespec ts;
825
826 #ifndef CLOCK_BOOTTIME
827 #define CLOCK_BOOTTIME 7
828 #endif
829 if (clock_gettime(CLOCK_BOOTTIME, &ts) == 0) {
830 /* Use more accurate boottime information to update the
831 * scan result age since the driver reports this and
832 * CLOCK_BOOTTIME is available. */
833 boottime = nla_get_u64(
834 bss[NL80211_BSS_LAST_SEEN_BOOTTIME]);
835 r->age = ((u64) ts.tv_sec * 1000000000 +
836 ts.tv_nsec - boottime) / 1000000;
837 }
838 }
839 r->ie_len = ie_len;
840 pos = (u8 *) (r + 1);
841 if (ie) {
842 os_memcpy(pos, ie, ie_len);
843 pos += ie_len;
844 }
845 r->beacon_ie_len = beacon_ie_len;
846 if (beacon_ie)
847 os_memcpy(pos, beacon_ie, beacon_ie_len);
848
849 if (bss[NL80211_BSS_STATUS]) {
850 enum nl80211_bss_status status;
851 status = nla_get_u32(bss[NL80211_BSS_STATUS]);
852 switch (status) {
853 case NL80211_BSS_STATUS_ASSOCIATED:
854 r->flags |= WPA_SCAN_ASSOCIATED;
855 break;
856 default:
857 break;
858 }
859 }
860
861 if (bss[NL80211_BSS_PARENT_TSF] && bss[NL80211_BSS_PARENT_BSSID]) {
862 r->parent_tsf = nla_get_u64(bss[NL80211_BSS_PARENT_TSF]);
863 os_memcpy(r->tsf_bssid, nla_data(bss[NL80211_BSS_PARENT_BSSID]),
864 ETH_ALEN);
865 }
866
867 return r;
868 }
869
870
871 struct nl80211_bss_info_arg {
872 struct wpa_driver_nl80211_data *drv;
873 struct wpa_scan_results *res;
874 const u8 *bssid;
875 };
876
bss_info_handler(struct nl_msg * msg,void * arg)877 static int bss_info_handler(struct nl_msg *msg, void *arg)
878 {
879 struct nl80211_bss_info_arg *_arg = arg;
880 struct wpa_scan_results *res = _arg->res;
881 struct wpa_scan_res **tmp;
882 struct wpa_scan_res *r;
883
884 r = nl80211_parse_bss_info(_arg->drv, msg, _arg->bssid);
885 if (!r)
886 return NL_SKIP;
887
888 if (!res) {
889 os_free(r);
890 return NL_SKIP;
891 }
892 tmp = os_realloc_array(res->res, res->num + 1,
893 sizeof(struct wpa_scan_res *));
894 if (tmp == NULL) {
895 os_free(r);
896 return NL_SKIP;
897 }
898 tmp[res->num++] = r;
899 res->res = tmp;
900
901 return NL_SKIP;
902 }
903
904
clear_state_mismatch(struct wpa_driver_nl80211_data * drv,const u8 * addr)905 static void clear_state_mismatch(struct wpa_driver_nl80211_data *drv,
906 const u8 *addr)
907 {
908 if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) {
909 wpa_printf(MSG_DEBUG, "nl80211: Clear possible state "
910 "mismatch (" MACSTR_SEC ")", MAC2STR_SEC(addr));
911 wpa_driver_nl80211_mlme(drv, addr,
912 NL80211_CMD_DEAUTHENTICATE,
913 WLAN_REASON_PREV_AUTH_NOT_VALID, 1,
914 drv->first_bss);
915 }
916 }
917
918
nl80211_check_bss_status(struct wpa_driver_nl80211_data * drv,struct wpa_scan_res * r)919 static void nl80211_check_bss_status(struct wpa_driver_nl80211_data *drv,
920 struct wpa_scan_res *r)
921 {
922 if (!(r->flags & WPA_SCAN_ASSOCIATED))
923 return;
924
925 wpa_printf(MSG_DEBUG, "nl80211: Scan results indicate BSS status with "
926 MACSTR_SEC " as associated", MAC2STR_SEC(r->bssid));
927 if (is_sta_interface(drv->nlmode) && !drv->associated) {
928 wpa_printf(MSG_DEBUG,
929 "nl80211: Local state (not associated) does not match with BSS state");
930 clear_state_mismatch(drv, r->bssid);
931 } else if (is_sta_interface(drv->nlmode) &&
932 !ether_addr_equal(drv->bssid, r->bssid)) {
933 wpa_printf(MSG_DEBUG,
934 "nl80211: Local state (associated with " MACSTR_SEC
935 ") does not match with BSS state",
936 MAC2STR_SEC(drv->bssid));
937
938 if (!ether_addr_equal(drv->sta_mlo_info.ap_mld_addr,
939 drv->bssid)) {
940 clear_state_mismatch(drv, r->bssid);
941
942 if (!is_zero_ether_addr(drv->sta_mlo_info.ap_mld_addr))
943 clear_state_mismatch(
944 drv, drv->sta_mlo_info.ap_mld_addr);
945 else
946 clear_state_mismatch(drv, drv->bssid);
947
948 } else {
949 wpa_printf(MSG_DEBUG,
950 "nl80211: BSSID is the MLD address");
951 }
952 }
953 }
954
955
wpa_driver_nl80211_check_bss_status(struct wpa_driver_nl80211_data * drv,struct wpa_scan_results * res)956 static void wpa_driver_nl80211_check_bss_status(
957 struct wpa_driver_nl80211_data *drv, struct wpa_scan_results *res)
958 {
959 size_t i;
960
961 for (i = 0; i < res->num; i++)
962 nl80211_check_bss_status(drv, res->res[i]);
963 }
964
965
nl80211_update_scan_res_noise(struct wpa_scan_res * res,struct nl80211_noise_info * info)966 static void nl80211_update_scan_res_noise(struct wpa_scan_res *res,
967 struct nl80211_noise_info *info)
968 {
969 unsigned int i;
970
971 for (i = 0; res && i < info->count; i++) {
972 if ((int) info->freq[i] != res->freq ||
973 !(res->flags & WPA_SCAN_NOISE_INVALID))
974 continue;
975 res->noise = info->noise[i];
976 res->flags &= ~WPA_SCAN_NOISE_INVALID;
977 }
978 }
979
980
981 static struct wpa_scan_results *
nl80211_get_scan_results(struct wpa_driver_nl80211_data * drv,const u8 * bssid)982 nl80211_get_scan_results(struct wpa_driver_nl80211_data *drv, const u8 *bssid)
983 {
984 struct nl_msg *msg;
985 struct wpa_scan_results *res;
986 int ret;
987 struct nl80211_bss_info_arg arg;
988 int count = 0;
989
990 try_again:
991 res = os_zalloc(sizeof(*res));
992 if (res == NULL)
993 return NULL;
994 if (!(msg = nl80211_cmd_msg(drv->first_bss, NLM_F_DUMP,
995 NL80211_CMD_GET_SCAN))) {
996 wpa_scan_results_free(res);
997 return NULL;
998 }
999
1000 arg.drv = drv;
1001 arg.res = res;
1002 arg.bssid = bssid;
1003 ret = send_and_recv_resp(drv, msg, bss_info_handler, &arg);
1004 if (ret == -EAGAIN) {
1005 count++;
1006 if (count >= 10) {
1007 wpa_printf(MSG_INFO,
1008 "nl80211: Failed to receive consistent scan result dump");
1009 } else {
1010 wpa_printf(MSG_INFO,
1011 "nl80211: Failed to receive consistent scan result dump - try again");
1012 wpa_scan_results_free(res);
1013 goto try_again;
1014 }
1015 }
1016 if (ret == 0) {
1017 struct nl80211_noise_info info;
1018
1019 wpa_printf(MSG_INFO, "nl80211: Received scan results (%lu "
1020 "BSSes)", (unsigned long) res->num);
1021 if (nl80211_get_noise_for_scan_results(drv, &info) == 0) {
1022 size_t i;
1023
1024 for (i = 0; i < res->num; ++i)
1025 nl80211_update_scan_res_noise(res->res[i],
1026 &info);
1027 }
1028 return res;
1029 }
1030 wpa_printf(MSG_INFO, "nl80211: Scan result fetch failed: ret=%d "
1031 "(%s)", ret, strerror(-ret));
1032 wpa_scan_results_free(res);
1033 return NULL;
1034 }
1035
1036
1037 /**
1038 * wpa_driver_nl80211_get_scan_results - Fetch the latest scan results
1039 * @priv: Pointer to private nl80211 data from wpa_driver_nl80211_init()
1040 * @bssid: Return results only for the specified BSSID, %NULL for all
1041 * Returns: Scan results on success, -1 on failure
1042 */
wpa_driver_nl80211_get_scan_results(void * priv,const u8 * bssid)1043 struct wpa_scan_results * wpa_driver_nl80211_get_scan_results(void *priv,
1044 const u8 *bssid)
1045 {
1046 struct i802_bss *bss = priv;
1047 struct wpa_driver_nl80211_data *drv = bss->drv;
1048 struct wpa_scan_results *res;
1049
1050 res = nl80211_get_scan_results(drv, bssid);
1051 if (res)
1052 wpa_driver_nl80211_check_bss_status(drv, res);
1053 return res;
1054 }
1055
1056
1057 struct nl80211_dump_scan_ctx {
1058 struct wpa_driver_nl80211_data *drv;
1059 int idx;
1060 };
1061
nl80211_dump_scan_handler(struct nl_msg * msg,void * arg)1062 static int nl80211_dump_scan_handler(struct nl_msg *msg, void *arg)
1063 {
1064 struct nl80211_dump_scan_ctx *ctx = arg;
1065 struct wpa_scan_res *r;
1066
1067 r = nl80211_parse_bss_info(ctx->drv, msg, NULL);
1068 if (!r)
1069 return NL_SKIP;
1070 wpa_printf(MSG_DEBUG, "nl80211: %d " MACSTR_SEC " %d%s",
1071 ctx->idx, MAC2STR_SEC(r->bssid), r->freq,
1072 r->flags & WPA_SCAN_ASSOCIATED ? " [assoc]" : "");
1073 ctx->idx++;
1074 os_free(r);
1075 return NL_SKIP;
1076 }
1077
1078
nl80211_dump_scan(struct wpa_driver_nl80211_data * drv)1079 void nl80211_dump_scan(struct wpa_driver_nl80211_data *drv)
1080 {
1081 struct nl_msg *msg;
1082 struct nl80211_dump_scan_ctx ctx;
1083
1084 wpa_printf(MSG_DEBUG, "nl80211: Scan result dump");
1085 ctx.drv = drv;
1086 ctx.idx = 0;
1087 msg = nl80211_cmd_msg(drv->first_bss, NLM_F_DUMP, NL80211_CMD_GET_SCAN);
1088 if (msg)
1089 send_and_recv_resp(drv, msg, nl80211_dump_scan_handler, &ctx);
1090 }
1091
1092
wpa_driver_nl80211_abort_scan(void * priv,u64 scan_cookie)1093 int wpa_driver_nl80211_abort_scan(void *priv, u64 scan_cookie)
1094 {
1095 struct i802_bss *bss = priv;
1096 #ifdef CONFIG_DRIVER_NL80211_QCA
1097 struct wpa_driver_nl80211_data *drv = bss->drv;
1098
1099 /*
1100 * If scan_cookie is zero, a normal scan through kernel (cfg80211)
1101 * was triggered, hence abort the cfg80211 scan instead of the vendor
1102 * scan.
1103 */
1104 if (drv->scan_vendor_cmd_avail && scan_cookie)
1105 return nl80211_abort_vendor_scan(drv, scan_cookie);
1106 #endif /* CONFIG_DRIVER_NL80211_QCA */
1107 return nl80211_abort_scan(bss);
1108 }
1109
1110
1111 #ifdef CONFIG_DRIVER_NL80211_QCA
1112
scan_cookie_handler(struct nl_msg * msg,void * arg)1113 static int scan_cookie_handler(struct nl_msg *msg, void *arg)
1114 {
1115 struct nlattr *tb[NL80211_ATTR_MAX + 1];
1116 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1117 u64 *cookie = arg;
1118
1119 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1120 genlmsg_attrlen(gnlh, 0), NULL);
1121
1122 if (tb[NL80211_ATTR_VENDOR_DATA]) {
1123 struct nlattr *nl_vendor = tb[NL80211_ATTR_VENDOR_DATA];
1124 struct nlattr *tb_vendor[QCA_WLAN_VENDOR_ATTR_SCAN_MAX + 1];
1125
1126 nla_parse(tb_vendor, QCA_WLAN_VENDOR_ATTR_SCAN_MAX,
1127 nla_data(nl_vendor), nla_len(nl_vendor), NULL);
1128
1129 if (tb_vendor[QCA_WLAN_VENDOR_ATTR_SCAN_COOKIE])
1130 *cookie = nla_get_u64(
1131 tb_vendor[QCA_WLAN_VENDOR_ATTR_SCAN_COOKIE]);
1132 }
1133
1134 return NL_SKIP;
1135 }
1136
1137
1138 /**
1139 * wpa_driver_nl80211_vendor_scan - Request the driver to initiate a vendor scan
1140 * @bss: Pointer to private driver data from wpa_driver_nl80211_init()
1141 * @params: Scan parameters
1142 * Returns: 0 on success, -1 on failure
1143 */
wpa_driver_nl80211_vendor_scan(struct i802_bss * bss,struct wpa_driver_scan_params * params)1144 int wpa_driver_nl80211_vendor_scan(struct i802_bss *bss,
1145 struct wpa_driver_scan_params *params)
1146 {
1147 struct wpa_driver_nl80211_data *drv = bss->drv;
1148 struct nl_msg *msg = NULL;
1149 struct nlattr *attr;
1150 size_t i;
1151 u32 scan_flags = 0;
1152 int ret = -1;
1153 u64 cookie = 0;
1154
1155 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: vendor scan request");
1156 drv->scan_for_auth = 0;
1157
1158 if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
1159 nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
1160 nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
1161 QCA_NL80211_VENDOR_SUBCMD_TRIGGER_SCAN) )
1162 goto fail;
1163
1164 attr = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1165 if (attr == NULL)
1166 goto fail;
1167
1168 if (params->num_ssids) {
1169 struct nlattr *ssids;
1170
1171 ssids = nla_nest_start(msg, QCA_WLAN_VENDOR_ATTR_SCAN_SSIDS);
1172 if (ssids == NULL)
1173 goto fail;
1174 for (i = 0; i < params->num_ssids; i++) {
1175 wpa_printf(MSG_MSGDUMP, "nl80211: Scan SSID %s",
1176 anonymize_ssid(wpa_ssid_txt(params->ssids[i].ssid,
1177 params->ssids[i].ssid_len)));
1178 if (nla_put(msg, i + 1, params->ssids[i].ssid_len,
1179 params->ssids[i].ssid))
1180 goto fail;
1181 }
1182 nla_nest_end(msg, ssids);
1183 }
1184
1185 if (params->extra_ies) {
1186 wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan extra IEs",
1187 params->extra_ies, params->extra_ies_len);
1188 if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_SCAN_IE,
1189 params->extra_ies_len, params->extra_ies))
1190 goto fail;
1191 }
1192
1193 if (params->freqs) {
1194 struct nlattr *freqs;
1195
1196 freqs = nla_nest_start(msg,
1197 QCA_WLAN_VENDOR_ATTR_SCAN_FREQUENCIES);
1198 if (freqs == NULL)
1199 goto fail;
1200 for (i = 0; params->freqs[i]; i++) {
1201 wpa_printf(MSG_MSGDUMP,
1202 "nl80211: Scan frequency %u MHz",
1203 params->freqs[i]);
1204 if (nla_put_u32(msg, i + 1, params->freqs[i]))
1205 goto fail;
1206 }
1207 nla_nest_end(msg, freqs);
1208 }
1209
1210 os_free(drv->filter_ssids);
1211 drv->filter_ssids = params->filter_ssids;
1212 params->filter_ssids = NULL;
1213 drv->num_filter_ssids = params->num_filter_ssids;
1214
1215 if (params->low_priority && drv->have_low_prio_scan) {
1216 wpa_printf(MSG_DEBUG,
1217 "nl80211: Add NL80211_SCAN_FLAG_LOW_PRIORITY");
1218 scan_flags |= NL80211_SCAN_FLAG_LOW_PRIORITY;
1219 }
1220
1221 if (params->mac_addr_rand) {
1222 wpa_printf(MSG_DEBUG,
1223 "nl80211: Add NL80211_SCAN_FLAG_RANDOM_ADDR");
1224 scan_flags |= NL80211_SCAN_FLAG_RANDOM_ADDR;
1225
1226 if (params->mac_addr) {
1227 wpa_printf(MSG_DEBUG, "nl80211: MAC address: " MACSTR_SEC,
1228 MAC2STR_SEC(params->mac_addr));
1229 if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_SCAN_MAC,
1230 ETH_ALEN, params->mac_addr))
1231 goto fail;
1232 }
1233
1234 if (params->mac_addr_mask) {
1235 wpa_printf(MSG_DEBUG, "nl80211: MAC address mask: "
1236 MACSTR_SEC, MAC2STR_SEC(params->mac_addr_mask));
1237 if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_SCAN_MAC_MASK,
1238 ETH_ALEN, params->mac_addr_mask))
1239 goto fail;
1240 }
1241 }
1242
1243 if (scan_flags &&
1244 nla_put_u32(msg, QCA_WLAN_VENDOR_ATTR_SCAN_FLAGS, scan_flags))
1245 goto fail;
1246
1247 if (params->p2p_probe) {
1248 struct nlattr *rates;
1249
1250 wpa_printf(MSG_DEBUG, "nl80211: P2P probe - mask SuppRates");
1251
1252 rates = nla_nest_start(msg,
1253 QCA_WLAN_VENDOR_ATTR_SCAN_SUPP_RATES);
1254 if (rates == NULL)
1255 goto fail;
1256
1257 /*
1258 * Remove 2.4 GHz rates 1, 2, 5.5, 11 Mbps from supported rates
1259 * by masking out everything else apart from the OFDM rates 6,
1260 * 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS rates. All 5 GHz
1261 * rates are left enabled.
1262 */
1263 if (nla_put(msg, NL80211_BAND_2GHZ, 8,
1264 "\x0c\x12\x18\x24\x30\x48\x60\x6c"))
1265 goto fail;
1266 nla_nest_end(msg, rates);
1267
1268 if (nla_put_flag(msg, QCA_WLAN_VENDOR_ATTR_SCAN_TX_NO_CCK_RATE))
1269 goto fail;
1270 }
1271
1272 if (params->bssid) {
1273 wpa_printf(MSG_DEBUG, "nl80211: Scan for a specific BSSID: "
1274 MACSTR_SEC, MAC2STR_SEC(params->bssid));
1275 if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_SCAN_BSSID, ETH_ALEN,
1276 params->bssid))
1277 goto fail;
1278 }
1279
1280 if (is_ap_interface(drv->nlmode) &&
1281 params->link_id != NL80211_DRV_LINK_ID_NA &&
1282 nla_put_u8(msg, QCA_WLAN_VENDOR_ATTR_SCAN_LINK_ID, params->link_id))
1283 goto fail;
1284
1285 nla_nest_end(msg, attr);
1286
1287 ret = send_and_recv_resp(drv, msg, scan_cookie_handler, &cookie);
1288 msg = NULL;
1289 if (ret) {
1290 wpa_printf(MSG_DEBUG,
1291 "nl80211: Vendor scan trigger failed: ret=%d (%s)",
1292 ret, strerror(-ret));
1293 goto fail;
1294 }
1295
1296 drv->vendor_scan_cookie = cookie;
1297 drv->scan_state = SCAN_REQUESTED;
1298 /* Pass the cookie to the caller to help distinguish the scans. */
1299 params->scan_cookie = cookie;
1300
1301 wpa_printf(MSG_DEBUG,
1302 "nl80211: Vendor scan requested (ret=%d) - scan timeout 30 seconds, scan cookie:0x%llx",
1303 ret, (long long unsigned int) cookie);
1304 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
1305 eloop_register_timeout(30, 0, wpa_driver_nl80211_scan_timeout,
1306 drv, drv->ctx);
1307 drv->last_scan_cmd = NL80211_CMD_VENDOR;
1308
1309 fail:
1310 nlmsg_free(msg);
1311 return ret;
1312 }
1313
1314
1315 /**
1316 * nl80211_set_default_scan_ies - Set the scan default IEs to the driver
1317 * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
1318 * @ies: Pointer to IEs buffer
1319 * @ies_len: Length of IEs in bytes
1320 * Returns: 0 on success, -1 on failure
1321 */
nl80211_set_default_scan_ies(void * priv,const u8 * ies,size_t ies_len)1322 int nl80211_set_default_scan_ies(void *priv, const u8 *ies, size_t ies_len)
1323 {
1324 struct i802_bss *bss = priv;
1325 struct wpa_driver_nl80211_data *drv = bss->drv;
1326 struct nl_msg *msg = NULL;
1327 struct nlattr *attr;
1328 int ret = -1;
1329
1330 if (!drv->set_wifi_conf_vendor_cmd_avail)
1331 return -1;
1332
1333 if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
1334 nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
1335 nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
1336 QCA_NL80211_VENDOR_SUBCMD_SET_WIFI_CONFIGURATION))
1337 goto fail;
1338
1339 attr = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1340 if (attr == NULL)
1341 goto fail;
1342
1343 wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan default IEs", ies, ies_len);
1344 if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_CONFIG_SCAN_DEFAULT_IES,
1345 ies_len, ies))
1346 goto fail;
1347
1348 nla_nest_end(msg, attr);
1349
1350 ret = send_and_recv_cmd(drv, msg);
1351 msg = NULL;
1352 if (ret) {
1353 wpa_printf(MSG_ERROR,
1354 "nl80211: Set scan default IEs failed: ret=%d (%s)",
1355 ret, strerror(-ret));
1356 goto fail;
1357 }
1358
1359 fail:
1360 nlmsg_free(msg);
1361 return ret;
1362 }
1363
1364 #endif /* CONFIG_DRIVER_NL80211_QCA */
1365