1 /*
2 * Driver interaction with Linux nl80211/cfg80211 - Scanning
3 * Copyright(c) 2015 Intel Deutschland GmbH
4 * Copyright (c) 2002-2014, Jouni Malinen <j@w1.fi>
5 * Copyright (c) 2007, Johannes Berg <johannes@sipsolutions.net>
6 * Copyright (c) 2009-2010, Atheros Communications
7 *
8 * This software may be distributed under the terms of the BSD license.
9 * See README for more details.
10 */
11
12 #include "includes.h"
13 #include <time.h>
14 #include <netlink/genl/genl.h>
15
16 #include "utils/common.h"
17 #include "utils/eloop.h"
18 #include "common/ieee802_11_defs.h"
19 #include "common/ieee802_11_common.h"
20 #include "common/qca-vendor.h"
21 #include "driver_nl80211.h"
22
23
24 #define MAX_NL80211_NOISE_FREQS 50
25
26 struct nl80211_noise_info {
27 u32 freq[MAX_NL80211_NOISE_FREQS];
28 s8 noise[MAX_NL80211_NOISE_FREQS];
29 unsigned int count;
30 };
31
get_noise_for_scan_results(struct nl_msg * msg,void * arg)32 static int get_noise_for_scan_results(struct nl_msg *msg, void *arg)
33 {
34 struct nlattr *tb[NL80211_ATTR_MAX + 1];
35 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
36 struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
37 static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
38 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
39 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
40 };
41 struct nl80211_noise_info *info = arg;
42
43 if (info->count >= MAX_NL80211_NOISE_FREQS)
44 return NL_STOP;
45
46 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
47 genlmsg_attrlen(gnlh, 0), NULL);
48
49 if (!tb[NL80211_ATTR_SURVEY_INFO]) {
50 wpa_printf(MSG_DEBUG, "nl80211: Survey data missing");
51 return NL_SKIP;
52 }
53
54 if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
55 tb[NL80211_ATTR_SURVEY_INFO],
56 survey_policy)) {
57 wpa_printf(MSG_DEBUG, "nl80211: Failed to parse nested "
58 "attributes");
59 return NL_SKIP;
60 }
61
62 if (!sinfo[NL80211_SURVEY_INFO_NOISE])
63 return NL_SKIP;
64
65 if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY])
66 return NL_SKIP;
67
68 info->freq[info->count] =
69 nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]);
70 info->noise[info->count] =
71 (s8) nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
72 info->count++;
73
74 return NL_SKIP;
75 }
76
77
nl80211_get_noise_for_scan_results(struct wpa_driver_nl80211_data * drv,struct nl80211_noise_info * info)78 static int nl80211_get_noise_for_scan_results(
79 struct wpa_driver_nl80211_data *drv, struct nl80211_noise_info *info)
80 {
81 struct nl_msg *msg;
82
83 os_memset(info, 0, sizeof(*info));
84 msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_GET_SURVEY);
85 return send_and_recv_msgs(drv, msg, get_noise_for_scan_results, info);
86 }
87
88
nl80211_abort_scan(struct i802_bss * bss)89 static int nl80211_abort_scan(struct i802_bss *bss)
90 {
91 int ret;
92 struct nl_msg *msg;
93 struct wpa_driver_nl80211_data *drv = bss->drv;
94
95 wpa_printf(MSG_DEBUG, "nl80211: Abort scan");
96 msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_ABORT_SCAN);
97 ret = send_and_recv_msgs(drv, msg, NULL, NULL);
98 if (ret) {
99 wpa_printf(MSG_DEBUG, "nl80211: Abort scan failed: ret=%d (%s)",
100 ret, strerror(-ret));
101 }
102 return ret;
103 }
104
105
106 #ifdef CONFIG_DRIVER_NL80211_QCA
nl80211_abort_vendor_scan(struct wpa_driver_nl80211_data * drv,u64 scan_cookie)107 static int nl80211_abort_vendor_scan(struct wpa_driver_nl80211_data *drv,
108 u64 scan_cookie)
109 {
110 struct nl_msg *msg;
111 struct nlattr *params;
112 int ret;
113
114 wpa_printf(MSG_DEBUG, "nl80211: Abort vendor scan with cookie 0x%llx",
115 (long long unsigned int) scan_cookie);
116
117 msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR);
118 if (!msg ||
119 nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
120 nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
121 QCA_NL80211_VENDOR_SUBCMD_ABORT_SCAN) ||
122 !(params = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
123 nla_put_u64(msg, QCA_WLAN_VENDOR_ATTR_SCAN_COOKIE, scan_cookie))
124 goto fail;
125
126 nla_nest_end(msg, params);
127
128 ret = send_and_recv_msgs(drv, msg, NULL, NULL);
129 msg = NULL;
130 if (ret) {
131 wpa_printf(MSG_INFO,
132 "nl80211: Aborting vendor scan with cookie 0x%llx failed: ret=%d (%s)",
133 (long long unsigned int) scan_cookie, ret,
134 strerror(-ret));
135 goto fail;
136 }
137 return 0;
138 fail:
139 nlmsg_free(msg);
140 return -1;
141 }
142 #endif /* CONFIG_DRIVER_NL80211_QCA */
143
144
145 /**
146 * wpa_driver_nl80211_scan_timeout - Scan timeout to report scan completion
147 * @eloop_ctx: Driver private data
148 * @timeout_ctx: ctx argument given to wpa_driver_nl80211_init()
149 *
150 * This function can be used as registered timeout when starting a scan to
151 * generate a scan completed event if the driver does not report this.
152 */
wpa_driver_nl80211_scan_timeout(void * eloop_ctx,void * timeout_ctx)153 void wpa_driver_nl80211_scan_timeout(void *eloop_ctx, void *timeout_ctx)
154 {
155 struct wpa_driver_nl80211_data *drv = eloop_ctx;
156
157 wpa_printf(MSG_DEBUG, "nl80211: Scan timeout - try to abort it");
158 #ifdef CONFIG_DRIVER_NL80211_QCA
159 if (drv->vendor_scan_cookie &&
160 nl80211_abort_vendor_scan(drv, drv->vendor_scan_cookie) == 0)
161 return;
162 #endif /* CONFIG_DRIVER_NL80211_QCA */
163 if (!drv->vendor_scan_cookie &&
164 nl80211_abort_scan(drv->first_bss) == 0)
165 return;
166
167 wpa_printf(MSG_DEBUG, "nl80211: Failed to abort scan");
168
169 if (drv->ap_scan_as_station != NL80211_IFTYPE_UNSPECIFIED) {
170 wpa_driver_nl80211_set_mode(drv->first_bss,
171 drv->ap_scan_as_station);
172 drv->ap_scan_as_station = NL80211_IFTYPE_UNSPECIFIED;
173 }
174
175 wpa_printf(MSG_DEBUG, "nl80211: Try to get scan results");
176 wpa_supplicant_event(timeout_ctx, EVENT_SCAN_RESULTS, NULL);
177 }
178
179
180 static struct nl_msg *
nl80211_scan_common(struct i802_bss * bss,u8 cmd,struct wpa_driver_scan_params * params)181 nl80211_scan_common(struct i802_bss *bss, u8 cmd,
182 struct wpa_driver_scan_params *params)
183 {
184 struct wpa_driver_nl80211_data *drv = bss->drv;
185 struct nl_msg *msg;
186 size_t i;
187 u32 scan_flags = 0;
188
189 msg = nl80211_cmd_msg(bss, 0, cmd);
190 if (!msg)
191 return NULL;
192
193 if (params->num_ssids) {
194 struct nlattr *ssids;
195
196 ssids = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
197 if (ssids == NULL)
198 goto fail;
199 for (i = 0; i < params->num_ssids; i++) {
200 wpa_printf(MSG_MSGDUMP, "nl80211: Scan SSID %s",
201 wpa_ssid_txt(params->ssids[i].ssid,
202 params->ssids[i].ssid_len));
203 if (nla_put(msg, i + 1, params->ssids[i].ssid_len,
204 params->ssids[i].ssid))
205 goto fail;
206 }
207 nla_nest_end(msg, ssids);
208 } else {
209 wpa_printf(MSG_DEBUG, "nl80211: Passive scan requested");
210 }
211
212 if (params->extra_ies) {
213 wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan extra IEs",
214 params->extra_ies, params->extra_ies_len);
215 if (nla_put(msg, NL80211_ATTR_IE, params->extra_ies_len,
216 params->extra_ies))
217 goto fail;
218 }
219
220 if (params->freqs) {
221 struct nlattr *freqs;
222 freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
223 if (freqs == NULL)
224 goto fail;
225 for (i = 0; params->freqs[i]; i++) {
226 wpa_printf(MSG_MSGDUMP, "nl80211: Scan frequency %u "
227 "MHz", params->freqs[i]);
228 if (nla_put_u32(msg, i + 1, params->freqs[i]))
229 goto fail;
230 }
231 nla_nest_end(msg, freqs);
232 }
233
234 os_free(drv->filter_ssids);
235 drv->filter_ssids = params->filter_ssids;
236 params->filter_ssids = NULL;
237 drv->num_filter_ssids = params->num_filter_ssids;
238
239 if (params->only_new_results) {
240 wpa_printf(MSG_DEBUG, "nl80211: Add NL80211_SCAN_FLAG_FLUSH");
241 scan_flags |= NL80211_SCAN_FLAG_FLUSH;
242 }
243
244 if (params->low_priority && drv->have_low_prio_scan) {
245 wpa_printf(MSG_DEBUG,
246 "nl80211: Add NL80211_SCAN_FLAG_LOW_PRIORITY");
247 scan_flags |= NL80211_SCAN_FLAG_LOW_PRIORITY;
248 }
249
250 if (params->mac_addr_rand) {
251 wpa_printf(MSG_DEBUG,
252 "nl80211: Add NL80211_SCAN_FLAG_RANDOM_ADDR");
253 scan_flags |= NL80211_SCAN_FLAG_RANDOM_ADDR;
254
255 if (params->mac_addr) {
256 wpa_printf(MSG_DEBUG, "nl80211: MAC address: " MACSTR,
257 MAC2STR(params->mac_addr));
258 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
259 params->mac_addr))
260 goto fail;
261 }
262
263 if (params->mac_addr_mask) {
264 wpa_printf(MSG_DEBUG, "nl80211: MAC address mask: "
265 MACSTR, MAC2STR(params->mac_addr_mask));
266 if (nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN,
267 params->mac_addr_mask))
268 goto fail;
269 }
270 }
271
272 if (params->duration) {
273 if (!(drv->capa.rrm_flags &
274 WPA_DRIVER_FLAGS_SUPPORT_SET_SCAN_DWELL) ||
275 nla_put_u16(msg, NL80211_ATTR_MEASUREMENT_DURATION,
276 params->duration))
277 goto fail;
278
279 if (params->duration_mandatory &&
280 nla_put_flag(msg,
281 NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY))
282 goto fail;
283 }
284
285 if (params->oce_scan) {
286 wpa_printf(MSG_DEBUG,
287 "nl80211: Add NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME");
288 wpa_printf(MSG_DEBUG,
289 "nl80211: Add NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP");
290 wpa_printf(MSG_DEBUG,
291 "nl80211: Add NL80211_SCAN_FLAG_OCE_PROBE_REQ_MIN_TX_RATE");
292 wpa_printf(MSG_DEBUG,
293 "nl80211: Add NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION");
294 scan_flags |= NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME |
295 NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP |
296 NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE |
297 NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION;
298 }
299
300 if (scan_flags &&
301 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, scan_flags))
302 goto fail;
303
304 return msg;
305
306 fail:
307 nlmsg_free(msg);
308 return NULL;
309 }
310
311
312 /**
313 * wpa_driver_nl80211_scan - Request the driver to initiate scan
314 * @bss: Pointer to private driver data from wpa_driver_nl80211_init()
315 * @params: Scan parameters
316 * Returns: 0 on success, -1 on failure
317 */
wpa_driver_nl80211_scan(struct i802_bss * bss,struct wpa_driver_scan_params * params)318 int wpa_driver_nl80211_scan(struct i802_bss *bss,
319 struct wpa_driver_scan_params *params)
320 {
321 struct wpa_driver_nl80211_data *drv = bss->drv;
322 int ret = -1, timeout;
323 struct nl_msg *msg = NULL;
324
325 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: scan request");
326 drv->scan_for_auth = 0;
327
328 if (TEST_FAIL())
329 return -1;
330
331 msg = nl80211_scan_common(bss, NL80211_CMD_TRIGGER_SCAN, params);
332 if (!msg)
333 return -1;
334
335 if (params->p2p_probe) {
336 struct nlattr *rates;
337
338 wpa_printf(MSG_DEBUG, "nl80211: P2P probe - mask SuppRates");
339
340 rates = nla_nest_start(msg, NL80211_ATTR_SCAN_SUPP_RATES);
341 if (rates == NULL)
342 goto fail;
343
344 /*
345 * Remove 2.4 GHz rates 1, 2, 5.5, 11 Mbps from supported rates
346 * by masking out everything else apart from the OFDM rates 6,
347 * 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS rates. All 5 GHz
348 * rates are left enabled.
349 */
350 if (nla_put(msg, NL80211_BAND_2GHZ, 8,
351 "\x0c\x12\x18\x24\x30\x48\x60\x6c"))
352 goto fail;
353 nla_nest_end(msg, rates);
354
355 if (nla_put_flag(msg, NL80211_ATTR_TX_NO_CCK_RATE))
356 goto fail;
357 }
358
359 if (params->bssid) {
360 wpa_printf(MSG_DEBUG, "nl80211: Scan for a specific BSSID: "
361 MACSTR, MAC2STR(params->bssid));
362 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid))
363 goto fail;
364 }
365
366 ret = send_and_recv_msgs(drv, msg, NULL, NULL);
367 msg = NULL;
368 if (ret) {
369 wpa_printf(MSG_DEBUG, "nl80211: Scan trigger failed: ret=%d "
370 "(%s)", ret, strerror(-ret));
371 if (drv->hostapd && is_ap_interface(drv->nlmode)) {
372 enum nl80211_iftype old_mode = drv->nlmode;
373
374 /*
375 * mac80211 does not allow scan requests in AP mode, so
376 * try to do this in station mode.
377 */
378 if (wpa_driver_nl80211_set_mode(
379 bss, NL80211_IFTYPE_STATION))
380 goto fail;
381
382 if (wpa_driver_nl80211_scan(bss, params)) {
383 wpa_driver_nl80211_set_mode(bss, old_mode);
384 goto fail;
385 }
386
387 /* Restore AP mode when processing scan results */
388 drv->ap_scan_as_station = old_mode;
389 ret = 0;
390 } else
391 goto fail;
392 }
393
394 drv->scan_state = SCAN_REQUESTED;
395 /* Not all drivers generate "scan completed" wireless event, so try to
396 * read results after a timeout. */
397 timeout = 10;
398 if (drv->scan_complete_events) {
399 /*
400 * The driver seems to deliver events to notify when scan is
401 * complete, so use longer timeout to avoid race conditions
402 * with scanning and following association request.
403 */
404 timeout = 30;
405 }
406 wpa_printf(MSG_DEBUG, "Scan requested (ret=%d) - scan timeout %d "
407 "seconds", ret, timeout);
408 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
409 eloop_register_timeout(timeout, 0, wpa_driver_nl80211_scan_timeout,
410 drv, drv->ctx);
411 drv->last_scan_cmd = NL80211_CMD_TRIGGER_SCAN;
412
413 fail:
414 nlmsg_free(msg);
415 return ret;
416 }
417
418
419 static int
nl80211_sched_scan_add_scan_plans(struct wpa_driver_nl80211_data * drv,struct nl_msg * msg,struct wpa_driver_scan_params * params)420 nl80211_sched_scan_add_scan_plans(struct wpa_driver_nl80211_data *drv,
421 struct nl_msg *msg,
422 struct wpa_driver_scan_params *params)
423 {
424 struct nlattr *plans;
425 struct sched_scan_plan *scan_plans = params->sched_scan_plans;
426 unsigned int i;
427
428 plans = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
429 if (!plans)
430 return -1;
431
432 for (i = 0; i < params->sched_scan_plans_num; i++) {
433 struct nlattr *plan = nla_nest_start(msg, i + 1);
434
435 if (!plan)
436 return -1;
437
438 if (!scan_plans[i].interval ||
439 scan_plans[i].interval >
440 drv->capa.max_sched_scan_plan_interval) {
441 wpa_printf(MSG_DEBUG,
442 "nl80211: sched scan plan no. %u: Invalid interval: %u",
443 i, scan_plans[i].interval);
444 return -1;
445 }
446
447 if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
448 scan_plans[i].interval))
449 return -1;
450
451 if (scan_plans[i].iterations >
452 drv->capa.max_sched_scan_plan_iterations) {
453 wpa_printf(MSG_DEBUG,
454 "nl80211: sched scan plan no. %u: Invalid number of iterations: %u",
455 i, scan_plans[i].iterations);
456 return -1;
457 }
458
459 if (scan_plans[i].iterations &&
460 nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
461 scan_plans[i].iterations))
462 return -1;
463
464 nla_nest_end(msg, plan);
465
466 /*
467 * All the scan plans must specify the number of iterations
468 * except the last plan, which will run infinitely. So if the
469 * number of iterations is not specified, this ought to be the
470 * last scan plan.
471 */
472 if (!scan_plans[i].iterations)
473 break;
474 }
475
476 if (i != params->sched_scan_plans_num - 1) {
477 wpa_printf(MSG_DEBUG,
478 "nl80211: All sched scan plans but the last must specify number of iterations");
479 return -1;
480 }
481
482 nla_nest_end(msg, plans);
483 return 0;
484 }
485
486
487 /**
488 * wpa_driver_nl80211_sched_scan - Initiate a scheduled scan
489 * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
490 * @params: Scan parameters
491 * Returns: 0 on success, -1 on failure or if not supported
492 */
wpa_driver_nl80211_sched_scan(void * priv,struct wpa_driver_scan_params * params)493 int wpa_driver_nl80211_sched_scan(void *priv,
494 struct wpa_driver_scan_params *params)
495 {
496 struct i802_bss *bss = priv;
497 struct wpa_driver_nl80211_data *drv = bss->drv;
498 int ret = -1;
499 struct nl_msg *msg;
500 size_t i;
501
502 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: sched_scan request");
503
504 #ifdef ANDROID
505 if (!drv->capa.sched_scan_supported)
506 return android_pno_start(bss, params);
507 #endif /* ANDROID */
508
509 if (!params->sched_scan_plans_num ||
510 params->sched_scan_plans_num > drv->capa.max_sched_scan_plans) {
511 wpa_printf(MSG_ERROR,
512 "nl80211: Invalid number of sched scan plans: %u",
513 params->sched_scan_plans_num);
514 return -1;
515 }
516
517 msg = nl80211_scan_common(bss, NL80211_CMD_START_SCHED_SCAN, params);
518 if (!msg)
519 goto fail;
520
521 if (drv->capa.max_sched_scan_plan_iterations) {
522 if (nl80211_sched_scan_add_scan_plans(drv, msg, params))
523 goto fail;
524 } else {
525 if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
526 params->sched_scan_plans[0].interval * 1000))
527 goto fail;
528 }
529
530 if ((drv->num_filter_ssids &&
531 (int) drv->num_filter_ssids <= drv->capa.max_match_sets) ||
532 params->filter_rssi) {
533 struct nlattr *match_sets;
534 match_sets = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
535 if (match_sets == NULL)
536 goto fail;
537
538 for (i = 0; i < drv->num_filter_ssids; i++) {
539 struct nlattr *match_set_ssid;
540 wpa_printf(MSG_MSGDUMP,
541 "nl80211: Sched scan filter SSID %s",
542 wpa_ssid_txt(drv->filter_ssids[i].ssid,
543 drv->filter_ssids[i].ssid_len));
544
545 match_set_ssid = nla_nest_start(msg, i + 1);
546 if (match_set_ssid == NULL ||
547 nla_put(msg, NL80211_ATTR_SCHED_SCAN_MATCH_SSID,
548 drv->filter_ssids[i].ssid_len,
549 drv->filter_ssids[i].ssid) ||
550 (params->filter_rssi &&
551 nla_put_u32(msg,
552 NL80211_SCHED_SCAN_MATCH_ATTR_RSSI,
553 params->filter_rssi)))
554 goto fail;
555
556 nla_nest_end(msg, match_set_ssid);
557 }
558
559 /*
560 * Due to backward compatibility code, newer kernels treat this
561 * matchset (with only an RSSI filter) as the default for all
562 * other matchsets, unless it's the only one, in which case the
563 * matchset will actually allow all SSIDs above the RSSI.
564 */
565 if (params->filter_rssi) {
566 struct nlattr *match_set_rssi;
567 match_set_rssi = nla_nest_start(msg, 0);
568 if (match_set_rssi == NULL ||
569 nla_put_u32(msg, NL80211_SCHED_SCAN_MATCH_ATTR_RSSI,
570 params->filter_rssi))
571 goto fail;
572 wpa_printf(MSG_MSGDUMP,
573 "nl80211: Sched scan RSSI filter %d dBm",
574 params->filter_rssi);
575 nla_nest_end(msg, match_set_rssi);
576 }
577
578 nla_nest_end(msg, match_sets);
579 }
580
581 if (params->relative_rssi_set) {
582 struct nl80211_bss_select_rssi_adjust rssi_adjust;
583
584 os_memset(&rssi_adjust, 0, sizeof(rssi_adjust));
585 wpa_printf(MSG_DEBUG, "nl80211: Relative RSSI: %d",
586 params->relative_rssi);
587 if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
588 params->relative_rssi))
589 goto fail;
590
591 if (params->relative_adjust_rssi) {
592 int pref_band_set = 1;
593
594 switch (params->relative_adjust_band) {
595 case WPA_SETBAND_5G:
596 rssi_adjust.band = NL80211_BAND_5GHZ;
597 break;
598 case WPA_SETBAND_2G:
599 rssi_adjust.band = NL80211_BAND_2GHZ;
600 break;
601 default:
602 pref_band_set = 0;
603 break;
604 }
605 rssi_adjust.delta = params->relative_adjust_rssi;
606
607 if (pref_band_set &&
608 nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
609 sizeof(rssi_adjust), &rssi_adjust))
610 goto fail;
611 }
612 }
613
614 if (params->sched_scan_start_delay &&
615 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY,
616 params->sched_scan_start_delay))
617 goto fail;
618
619 ret = send_and_recv_msgs(drv, msg, NULL, NULL);
620
621 /* TODO: if we get an error here, we should fall back to normal scan */
622
623 msg = NULL;
624 if (ret) {
625 wpa_printf(MSG_DEBUG, "nl80211: Sched scan start failed: "
626 "ret=%d (%s)", ret, strerror(-ret));
627 goto fail;
628 }
629
630 wpa_printf(MSG_DEBUG, "nl80211: Sched scan requested (ret=%d)", ret);
631
632 fail:
633 nlmsg_free(msg);
634 return ret;
635 }
636
637
638 /**
639 * wpa_driver_nl80211_stop_sched_scan - Stop a scheduled scan
640 * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
641 * Returns: 0 on success, -1 on failure or if not supported
642 */
wpa_driver_nl80211_stop_sched_scan(void * priv)643 int wpa_driver_nl80211_stop_sched_scan(void *priv)
644 {
645 struct i802_bss *bss = priv;
646 struct wpa_driver_nl80211_data *drv = bss->drv;
647 int ret;
648 struct nl_msg *msg;
649
650 #ifdef ANDROID
651 if (!drv->capa.sched_scan_supported)
652 return android_pno_stop(bss);
653 #endif /* ANDROID */
654
655 msg = nl80211_drv_msg(drv, 0, NL80211_CMD_STOP_SCHED_SCAN);
656 ret = send_and_recv_msgs(drv, msg, NULL, NULL);
657 if (ret) {
658 wpa_printf(MSG_DEBUG,
659 "nl80211: Sched scan stop failed: ret=%d (%s)",
660 ret, strerror(-ret));
661 } else {
662 wpa_printf(MSG_DEBUG,
663 "nl80211: Sched scan stop sent");
664 }
665
666 return ret;
667 }
668
669
nl80211_scan_filtered(struct wpa_driver_nl80211_data * drv,const u8 * ie,size_t ie_len)670 static int nl80211_scan_filtered(struct wpa_driver_nl80211_data *drv,
671 const u8 *ie, size_t ie_len)
672 {
673 const u8 *ssid;
674 size_t i;
675
676 if (drv->filter_ssids == NULL)
677 return 0;
678
679 ssid = get_ie(ie, ie_len, WLAN_EID_SSID);
680 if (ssid == NULL)
681 return 1;
682
683 for (i = 0; i < drv->num_filter_ssids; i++) {
684 if (ssid[1] == drv->filter_ssids[i].ssid_len &&
685 os_memcmp(ssid + 2, drv->filter_ssids[i].ssid, ssid[1]) ==
686 0)
687 return 0;
688 }
689
690 return 1;
691 }
692
693
694 static struct wpa_scan_res *
nl80211_parse_bss_info(struct wpa_driver_nl80211_data * drv,struct nl_msg * msg)695 nl80211_parse_bss_info(struct wpa_driver_nl80211_data *drv,
696 struct nl_msg *msg)
697 {
698 struct nlattr *tb[NL80211_ATTR_MAX + 1];
699 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
700 struct nlattr *bss[NL80211_BSS_MAX + 1];
701 static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = {
702 [NL80211_BSS_BSSID] = { .type = NLA_UNSPEC },
703 [NL80211_BSS_FREQUENCY] = { .type = NLA_U32 },
704 [NL80211_BSS_TSF] = { .type = NLA_U64 },
705 [NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 },
706 [NL80211_BSS_CAPABILITY] = { .type = NLA_U16 },
707 [NL80211_BSS_INFORMATION_ELEMENTS] = { .type = NLA_UNSPEC },
708 [NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 },
709 [NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 },
710 [NL80211_BSS_STATUS] = { .type = NLA_U32 },
711 [NL80211_BSS_SEEN_MS_AGO] = { .type = NLA_U32 },
712 [NL80211_BSS_BEACON_IES] = { .type = NLA_UNSPEC },
713 [NL80211_BSS_PARENT_TSF] = { .type = NLA_U64 },
714 [NL80211_BSS_PARENT_BSSID] = { .type = NLA_UNSPEC },
715 [NL80211_BSS_LAST_SEEN_BOOTTIME] = { .type = NLA_U64 },
716 };
717 struct wpa_scan_res *r;
718 const u8 *ie, *beacon_ie;
719 size_t ie_len, beacon_ie_len;
720 u8 *pos;
721
722 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
723 genlmsg_attrlen(gnlh, 0), NULL);
724 if (!tb[NL80211_ATTR_BSS])
725 return NULL;
726 if (nla_parse_nested(bss, NL80211_BSS_MAX, tb[NL80211_ATTR_BSS],
727 bss_policy))
728 return NULL;
729 if (bss[NL80211_BSS_INFORMATION_ELEMENTS]) {
730 ie = nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
731 ie_len = nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
732 } else {
733 ie = NULL;
734 ie_len = 0;
735 }
736 if (bss[NL80211_BSS_BEACON_IES]) {
737 beacon_ie = nla_data(bss[NL80211_BSS_BEACON_IES]);
738 beacon_ie_len = nla_len(bss[NL80211_BSS_BEACON_IES]);
739 } else {
740 beacon_ie = NULL;
741 beacon_ie_len = 0;
742 }
743
744 if (nl80211_scan_filtered(drv, ie ? ie : beacon_ie,
745 ie ? ie_len : beacon_ie_len))
746 return NULL;
747
748 r = os_zalloc(sizeof(*r) + ie_len + beacon_ie_len);
749 if (r == NULL)
750 return NULL;
751 if (bss[NL80211_BSS_BSSID])
752 os_memcpy(r->bssid, nla_data(bss[NL80211_BSS_BSSID]),
753 ETH_ALEN);
754 if (bss[NL80211_BSS_FREQUENCY])
755 r->freq = nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
756 if (bss[NL80211_BSS_BEACON_INTERVAL])
757 r->beacon_int = nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]);
758 if (bss[NL80211_BSS_CAPABILITY])
759 r->caps = nla_get_u16(bss[NL80211_BSS_CAPABILITY]);
760 r->flags |= WPA_SCAN_NOISE_INVALID;
761 if (bss[NL80211_BSS_SIGNAL_MBM]) {
762 r->level = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]);
763 r->level /= 100; /* mBm to dBm */
764 r->flags |= WPA_SCAN_LEVEL_DBM | WPA_SCAN_QUAL_INVALID;
765 } else if (bss[NL80211_BSS_SIGNAL_UNSPEC]) {
766 r->level = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]);
767 r->flags |= WPA_SCAN_QUAL_INVALID;
768 } else
769 r->flags |= WPA_SCAN_LEVEL_INVALID | WPA_SCAN_QUAL_INVALID;
770 if (bss[NL80211_BSS_TSF])
771 r->tsf = nla_get_u64(bss[NL80211_BSS_TSF]);
772 if (bss[NL80211_BSS_BEACON_TSF]) {
773 u64 tsf = nla_get_u64(bss[NL80211_BSS_BEACON_TSF]);
774 if (tsf > r->tsf)
775 r->tsf = tsf;
776 }
777 if (bss[NL80211_BSS_SEEN_MS_AGO])
778 r->age = nla_get_u32(bss[NL80211_BSS_SEEN_MS_AGO]);
779 if (bss[NL80211_BSS_LAST_SEEN_BOOTTIME]) {
780 u64 boottime;
781 struct timespec ts;
782
783 #ifndef CLOCK_BOOTTIME
784 #define CLOCK_BOOTTIME 7
785 #endif
786 if (clock_gettime(CLOCK_BOOTTIME, &ts) == 0) {
787 /* Use more accurate boottime information to update the
788 * scan result age since the driver reports this and
789 * CLOCK_BOOTTIME is available. */
790 boottime = nla_get_u64(
791 bss[NL80211_BSS_LAST_SEEN_BOOTTIME]);
792 r->age = ((u64) ts.tv_sec * 1000000000 +
793 ts.tv_nsec - boottime) / 1000000;
794 }
795 }
796 r->ie_len = ie_len;
797 pos = (u8 *) (r + 1);
798 if (ie) {
799 os_memcpy(pos, ie, ie_len);
800 pos += ie_len;
801 }
802 r->beacon_ie_len = beacon_ie_len;
803 if (beacon_ie)
804 os_memcpy(pos, beacon_ie, beacon_ie_len);
805
806 if (bss[NL80211_BSS_STATUS]) {
807 enum nl80211_bss_status status;
808 status = nla_get_u32(bss[NL80211_BSS_STATUS]);
809 switch (status) {
810 case NL80211_BSS_STATUS_ASSOCIATED:
811 r->flags |= WPA_SCAN_ASSOCIATED;
812 break;
813 default:
814 break;
815 }
816 }
817
818 if (bss[NL80211_BSS_PARENT_TSF] && bss[NL80211_BSS_PARENT_BSSID]) {
819 r->parent_tsf = nla_get_u64(bss[NL80211_BSS_PARENT_TSF]);
820 os_memcpy(r->tsf_bssid, nla_data(bss[NL80211_BSS_PARENT_BSSID]),
821 ETH_ALEN);
822 }
823
824 return r;
825 }
826
827
828 struct nl80211_bss_info_arg {
829 struct wpa_driver_nl80211_data *drv;
830 struct wpa_scan_results *res;
831 };
832
bss_info_handler(struct nl_msg * msg,void * arg)833 static int bss_info_handler(struct nl_msg *msg, void *arg)
834 {
835 struct nl80211_bss_info_arg *_arg = arg;
836 struct wpa_scan_results *res = _arg->res;
837 struct wpa_scan_res **tmp;
838 struct wpa_scan_res *r;
839
840 r = nl80211_parse_bss_info(_arg->drv, msg);
841 if (!r)
842 return NL_SKIP;
843
844 if (!res) {
845 os_free(r);
846 return NL_SKIP;
847 }
848 tmp = os_realloc_array(res->res, res->num + 1,
849 sizeof(struct wpa_scan_res *));
850 if (tmp == NULL) {
851 os_free(r);
852 return NL_SKIP;
853 }
854 tmp[res->num++] = r;
855 res->res = tmp;
856
857 return NL_SKIP;
858 }
859
860
clear_state_mismatch(struct wpa_driver_nl80211_data * drv,const u8 * addr)861 static void clear_state_mismatch(struct wpa_driver_nl80211_data *drv,
862 const u8 *addr)
863 {
864 if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) {
865 wpa_printf(MSG_DEBUG, "nl80211: Clear possible state "
866 "mismatch (" MACSTR ")", MAC2STR(addr));
867 wpa_driver_nl80211_mlme(drv, addr,
868 NL80211_CMD_DEAUTHENTICATE,
869 WLAN_REASON_PREV_AUTH_NOT_VALID, 1,
870 NULL);
871 }
872 }
873
874
nl80211_check_bss_status(struct wpa_driver_nl80211_data * drv,struct wpa_scan_res * r)875 static void nl80211_check_bss_status(struct wpa_driver_nl80211_data *drv,
876 struct wpa_scan_res *r)
877 {
878 if (!(r->flags & WPA_SCAN_ASSOCIATED))
879 return;
880
881 wpa_printf(MSG_DEBUG, "nl80211: Scan results indicate BSS status with "
882 MACSTR " as associated", MAC2STR(r->bssid));
883 if (is_sta_interface(drv->nlmode) && !drv->associated) {
884 wpa_printf(MSG_DEBUG,
885 "nl80211: Local state (not associated) does not match with BSS state");
886 clear_state_mismatch(drv, r->bssid);
887 } else if (is_sta_interface(drv->nlmode) &&
888 os_memcmp(drv->bssid, r->bssid, ETH_ALEN) != 0) {
889 wpa_printf(MSG_DEBUG,
890 "nl80211: Local state (associated with " MACSTR
891 ") does not match with BSS state",
892 MAC2STR(drv->bssid));
893 clear_state_mismatch(drv, r->bssid);
894 clear_state_mismatch(drv, drv->bssid);
895 }
896 }
897
898
wpa_driver_nl80211_check_bss_status(struct wpa_driver_nl80211_data * drv,struct wpa_scan_results * res)899 static void wpa_driver_nl80211_check_bss_status(
900 struct wpa_driver_nl80211_data *drv, struct wpa_scan_results *res)
901 {
902 size_t i;
903
904 for (i = 0; i < res->num; i++)
905 nl80211_check_bss_status(drv, res->res[i]);
906 }
907
908
nl80211_update_scan_res_noise(struct wpa_scan_res * res,struct nl80211_noise_info * info)909 static void nl80211_update_scan_res_noise(struct wpa_scan_res *res,
910 struct nl80211_noise_info *info)
911 {
912 unsigned int i;
913
914 for (i = 0; res && i < info->count; i++) {
915 if ((int) info->freq[i] != res->freq ||
916 !(res->flags & WPA_SCAN_NOISE_INVALID))
917 continue;
918 res->noise = info->noise[i];
919 res->flags &= ~WPA_SCAN_NOISE_INVALID;
920 }
921 }
922
923
924 static struct wpa_scan_results *
nl80211_get_scan_results(struct wpa_driver_nl80211_data * drv)925 nl80211_get_scan_results(struct wpa_driver_nl80211_data *drv)
926 {
927 struct nl_msg *msg;
928 struct wpa_scan_results *res;
929 int ret;
930 struct nl80211_bss_info_arg arg;
931
932 res = os_zalloc(sizeof(*res));
933 if (res == NULL)
934 return NULL;
935 if (!(msg = nl80211_cmd_msg(drv->first_bss, NLM_F_DUMP,
936 NL80211_CMD_GET_SCAN))) {
937 wpa_scan_results_free(res);
938 return NULL;
939 }
940
941 arg.drv = drv;
942 arg.res = res;
943 ret = send_and_recv_msgs(drv, msg, bss_info_handler, &arg);
944 if (ret == 0) {
945 struct nl80211_noise_info info;
946
947 wpa_printf(MSG_DEBUG, "nl80211: Received scan results (%lu "
948 "BSSes)", (unsigned long) res->num);
949 if (nl80211_get_noise_for_scan_results(drv, &info) == 0) {
950 size_t i;
951
952 for (i = 0; i < res->num; ++i)
953 nl80211_update_scan_res_noise(res->res[i],
954 &info);
955 }
956 return res;
957 }
958 wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d "
959 "(%s)", ret, strerror(-ret));
960 wpa_scan_results_free(res);
961 return NULL;
962 }
963
964
965 /**
966 * wpa_driver_nl80211_get_scan_results - Fetch the latest scan results
967 * @priv: Pointer to private wext data from wpa_driver_nl80211_init()
968 * Returns: Scan results on success, -1 on failure
969 */
wpa_driver_nl80211_get_scan_results(void * priv)970 struct wpa_scan_results * wpa_driver_nl80211_get_scan_results(void *priv)
971 {
972 struct i802_bss *bss = priv;
973 struct wpa_driver_nl80211_data *drv = bss->drv;
974 struct wpa_scan_results *res;
975
976 res = nl80211_get_scan_results(drv);
977 if (res)
978 wpa_driver_nl80211_check_bss_status(drv, res);
979 return res;
980 }
981
982
983 struct nl80211_dump_scan_ctx {
984 struct wpa_driver_nl80211_data *drv;
985 int idx;
986 };
987
nl80211_dump_scan_handler(struct nl_msg * msg,void * arg)988 static int nl80211_dump_scan_handler(struct nl_msg *msg, void *arg)
989 {
990 struct nl80211_dump_scan_ctx *ctx = arg;
991 struct wpa_scan_res *r;
992
993 r = nl80211_parse_bss_info(ctx->drv, msg);
994 if (!r)
995 return NL_SKIP;
996 wpa_printf(MSG_DEBUG, "nl80211: %d " MACSTR " %d%s",
997 ctx->idx, MAC2STR(r->bssid), r->freq,
998 r->flags & WPA_SCAN_ASSOCIATED ? " [assoc]" : "");
999 ctx->idx++;
1000 os_free(r);
1001 return NL_SKIP;
1002 }
1003
1004
nl80211_dump_scan(struct wpa_driver_nl80211_data * drv)1005 void nl80211_dump_scan(struct wpa_driver_nl80211_data *drv)
1006 {
1007 struct nl_msg *msg;
1008 struct nl80211_dump_scan_ctx ctx;
1009
1010 wpa_printf(MSG_DEBUG, "nl80211: Scan result dump");
1011 ctx.drv = drv;
1012 ctx.idx = 0;
1013 msg = nl80211_cmd_msg(drv->first_bss, NLM_F_DUMP, NL80211_CMD_GET_SCAN);
1014 if (msg)
1015 send_and_recv_msgs(drv, msg, nl80211_dump_scan_handler, &ctx);
1016 }
1017
1018
wpa_driver_nl80211_abort_scan(void * priv,u64 scan_cookie)1019 int wpa_driver_nl80211_abort_scan(void *priv, u64 scan_cookie)
1020 {
1021 struct i802_bss *bss = priv;
1022 #ifdef CONFIG_DRIVER_NL80211_QCA
1023 struct wpa_driver_nl80211_data *drv = bss->drv;
1024
1025 /*
1026 * If scan_cookie is zero, a normal scan through kernel (cfg80211)
1027 * was triggered, hence abort the cfg80211 scan instead of the vendor
1028 * scan.
1029 */
1030 if (drv->scan_vendor_cmd_avail && scan_cookie)
1031 return nl80211_abort_vendor_scan(drv, scan_cookie);
1032 #endif /* CONFIG_DRIVER_NL80211_QCA */
1033 return nl80211_abort_scan(bss);
1034 }
1035
1036
1037 #ifdef CONFIG_DRIVER_NL80211_QCA
1038
scan_cookie_handler(struct nl_msg * msg,void * arg)1039 static int scan_cookie_handler(struct nl_msg *msg, void *arg)
1040 {
1041 struct nlattr *tb[NL80211_ATTR_MAX + 1];
1042 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1043 u64 *cookie = arg;
1044
1045 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1046 genlmsg_attrlen(gnlh, 0), NULL);
1047
1048 if (tb[NL80211_ATTR_VENDOR_DATA]) {
1049 struct nlattr *nl_vendor = tb[NL80211_ATTR_VENDOR_DATA];
1050 struct nlattr *tb_vendor[QCA_WLAN_VENDOR_ATTR_SCAN_MAX + 1];
1051
1052 nla_parse(tb_vendor, QCA_WLAN_VENDOR_ATTR_SCAN_MAX,
1053 nla_data(nl_vendor), nla_len(nl_vendor), NULL);
1054
1055 if (tb_vendor[QCA_WLAN_VENDOR_ATTR_SCAN_COOKIE])
1056 *cookie = nla_get_u64(
1057 tb_vendor[QCA_WLAN_VENDOR_ATTR_SCAN_COOKIE]);
1058 }
1059
1060 return NL_SKIP;
1061 }
1062
1063
1064 /**
1065 * wpa_driver_nl80211_vendor_scan - Request the driver to initiate a vendor scan
1066 * @bss: Pointer to private driver data from wpa_driver_nl80211_init()
1067 * @params: Scan parameters
1068 * Returns: 0 on success, -1 on failure
1069 */
wpa_driver_nl80211_vendor_scan(struct i802_bss * bss,struct wpa_driver_scan_params * params)1070 int wpa_driver_nl80211_vendor_scan(struct i802_bss *bss,
1071 struct wpa_driver_scan_params *params)
1072 {
1073 struct wpa_driver_nl80211_data *drv = bss->drv;
1074 struct nl_msg *msg = NULL;
1075 struct nlattr *attr;
1076 size_t i;
1077 u32 scan_flags = 0;
1078 int ret = -1;
1079 u64 cookie = 0;
1080
1081 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: vendor scan request");
1082 drv->scan_for_auth = 0;
1083
1084 if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
1085 nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
1086 nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
1087 QCA_NL80211_VENDOR_SUBCMD_TRIGGER_SCAN) )
1088 goto fail;
1089
1090 attr = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1091 if (attr == NULL)
1092 goto fail;
1093
1094 if (params->num_ssids) {
1095 struct nlattr *ssids;
1096
1097 ssids = nla_nest_start(msg, QCA_WLAN_VENDOR_ATTR_SCAN_SSIDS);
1098 if (ssids == NULL)
1099 goto fail;
1100 for (i = 0; i < params->num_ssids; i++) {
1101 wpa_printf(MSG_MSGDUMP, "nl80211: Scan SSID %s",
1102 wpa_ssid_txt(params->ssids[i].ssid,
1103 params->ssids[i].ssid_len));
1104 if (nla_put(msg, i + 1, params->ssids[i].ssid_len,
1105 params->ssids[i].ssid))
1106 goto fail;
1107 }
1108 nla_nest_end(msg, ssids);
1109 }
1110
1111 if (params->extra_ies) {
1112 wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan extra IEs",
1113 params->extra_ies, params->extra_ies_len);
1114 if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_SCAN_IE,
1115 params->extra_ies_len, params->extra_ies))
1116 goto fail;
1117 }
1118
1119 if (params->freqs) {
1120 struct nlattr *freqs;
1121
1122 freqs = nla_nest_start(msg,
1123 QCA_WLAN_VENDOR_ATTR_SCAN_FREQUENCIES);
1124 if (freqs == NULL)
1125 goto fail;
1126 for (i = 0; params->freqs[i]; i++) {
1127 wpa_printf(MSG_MSGDUMP,
1128 "nl80211: Scan frequency %u MHz",
1129 params->freqs[i]);
1130 if (nla_put_u32(msg, i + 1, params->freqs[i]))
1131 goto fail;
1132 }
1133 nla_nest_end(msg, freqs);
1134 }
1135
1136 os_free(drv->filter_ssids);
1137 drv->filter_ssids = params->filter_ssids;
1138 params->filter_ssids = NULL;
1139 drv->num_filter_ssids = params->num_filter_ssids;
1140
1141 if (params->low_priority && drv->have_low_prio_scan) {
1142 wpa_printf(MSG_DEBUG,
1143 "nl80211: Add NL80211_SCAN_FLAG_LOW_PRIORITY");
1144 scan_flags |= NL80211_SCAN_FLAG_LOW_PRIORITY;
1145 }
1146
1147 if (params->mac_addr_rand) {
1148 wpa_printf(MSG_DEBUG,
1149 "nl80211: Add NL80211_SCAN_FLAG_RANDOM_ADDR");
1150 scan_flags |= NL80211_SCAN_FLAG_RANDOM_ADDR;
1151
1152 if (params->mac_addr) {
1153 wpa_printf(MSG_DEBUG, "nl80211: MAC address: " MACSTR,
1154 MAC2STR(params->mac_addr));
1155 if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_SCAN_MAC,
1156 ETH_ALEN, params->mac_addr))
1157 goto fail;
1158 }
1159
1160 if (params->mac_addr_mask) {
1161 wpa_printf(MSG_DEBUG, "nl80211: MAC address mask: "
1162 MACSTR, MAC2STR(params->mac_addr_mask));
1163 if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_SCAN_MAC_MASK,
1164 ETH_ALEN, params->mac_addr_mask))
1165 goto fail;
1166 }
1167 }
1168
1169 if (scan_flags &&
1170 nla_put_u32(msg, QCA_WLAN_VENDOR_ATTR_SCAN_FLAGS, scan_flags))
1171 goto fail;
1172
1173 if (params->p2p_probe) {
1174 struct nlattr *rates;
1175
1176 wpa_printf(MSG_DEBUG, "nl80211: P2P probe - mask SuppRates");
1177
1178 rates = nla_nest_start(msg,
1179 QCA_WLAN_VENDOR_ATTR_SCAN_SUPP_RATES);
1180 if (rates == NULL)
1181 goto fail;
1182
1183 /*
1184 * Remove 2.4 GHz rates 1, 2, 5.5, 11 Mbps from supported rates
1185 * by masking out everything else apart from the OFDM rates 6,
1186 * 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS rates. All 5 GHz
1187 * rates are left enabled.
1188 */
1189 if (nla_put(msg, NL80211_BAND_2GHZ, 8,
1190 "\x0c\x12\x18\x24\x30\x48\x60\x6c"))
1191 goto fail;
1192 nla_nest_end(msg, rates);
1193
1194 if (nla_put_flag(msg, QCA_WLAN_VENDOR_ATTR_SCAN_TX_NO_CCK_RATE))
1195 goto fail;
1196 }
1197
1198 if (params->bssid) {
1199 wpa_printf(MSG_DEBUG, "nl80211: Scan for a specific BSSID: "
1200 MACSTR, MAC2STR(params->bssid));
1201 if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_SCAN_BSSID, ETH_ALEN,
1202 params->bssid))
1203 goto fail;
1204 }
1205
1206 nla_nest_end(msg, attr);
1207
1208 ret = send_and_recv_msgs(drv, msg, scan_cookie_handler, &cookie);
1209 msg = NULL;
1210 if (ret) {
1211 wpa_printf(MSG_DEBUG,
1212 "nl80211: Vendor scan trigger failed: ret=%d (%s)",
1213 ret, strerror(-ret));
1214 goto fail;
1215 }
1216
1217 drv->vendor_scan_cookie = cookie;
1218 drv->scan_state = SCAN_REQUESTED;
1219 /* Pass the cookie to the caller to help distinguish the scans. */
1220 params->scan_cookie = cookie;
1221
1222 wpa_printf(MSG_DEBUG,
1223 "nl80211: Vendor scan requested (ret=%d) - scan timeout 30 seconds, scan cookie:0x%llx",
1224 ret, (long long unsigned int) cookie);
1225 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
1226 eloop_register_timeout(30, 0, wpa_driver_nl80211_scan_timeout,
1227 drv, drv->ctx);
1228 drv->last_scan_cmd = NL80211_CMD_VENDOR;
1229
1230 fail:
1231 nlmsg_free(msg);
1232 return ret;
1233 }
1234
1235
1236 /**
1237 * nl80211_set_default_scan_ies - Set the scan default IEs to the driver
1238 * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
1239 * @ies: Pointer to IEs buffer
1240 * @ies_len: Length of IEs in bytes
1241 * Returns: 0 on success, -1 on failure
1242 */
nl80211_set_default_scan_ies(void * priv,const u8 * ies,size_t ies_len)1243 int nl80211_set_default_scan_ies(void *priv, const u8 *ies, size_t ies_len)
1244 {
1245 struct i802_bss *bss = priv;
1246 struct wpa_driver_nl80211_data *drv = bss->drv;
1247 struct nl_msg *msg = NULL;
1248 struct nlattr *attr;
1249 int ret = -1;
1250
1251 if (!drv->set_wifi_conf_vendor_cmd_avail)
1252 return -1;
1253
1254 if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
1255 nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
1256 nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
1257 QCA_NL80211_VENDOR_SUBCMD_SET_WIFI_CONFIGURATION))
1258 goto fail;
1259
1260 attr = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1261 if (attr == NULL)
1262 goto fail;
1263
1264 wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan default IEs", ies, ies_len);
1265 if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_CONFIG_SCAN_DEFAULT_IES,
1266 ies_len, ies))
1267 goto fail;
1268
1269 nla_nest_end(msg, attr);
1270
1271 ret = send_and_recv_msgs(drv, msg, NULL, NULL);
1272 msg = NULL;
1273 if (ret) {
1274 wpa_printf(MSG_ERROR,
1275 "nl80211: Set scan default IEs failed: ret=%d (%s)",
1276 ret, strerror(-ret));
1277 goto fail;
1278 }
1279
1280 fail:
1281 nlmsg_free(msg);
1282 return ret;
1283 }
1284
1285 #endif /* CONFIG_DRIVER_NL80211_QCA */
1286