1 /*
2 * Driver interaction with Linux nl80211/cfg80211 - Scanning
3 * Copyright(c) 2015 Intel Deutschland GmbH
4 * Copyright (c) 2002-2014, Jouni Malinen <j@w1.fi>
5 * Copyright (c) 2007, Johannes Berg <johannes@sipsolutions.net>
6 * Copyright (c) 2009-2010, Atheros Communications
7 *
8 * This software may be distributed under the terms of the BSD license.
9 * See README for more details.
10 */
11
12 #include "includes.h"
13 #include <time.h>
14 #include <netlink/genl/genl.h>
15
16 #include "utils/common.h"
17 #include "utils/eloop.h"
18 #include "common/ieee802_11_defs.h"
19 #include "common/ieee802_11_common.h"
20 #include "common/qca-vendor.h"
21 #include "driver_nl80211.h"
22
23
24 #define MAX_NL80211_NOISE_FREQS 50
25
26 struct nl80211_noise_info {
27 u32 freq[MAX_NL80211_NOISE_FREQS];
28 s8 noise[MAX_NL80211_NOISE_FREQS];
29 unsigned int count;
30 };
31
get_noise_for_scan_results(struct nl_msg * msg,void * arg)32 static int get_noise_for_scan_results(struct nl_msg *msg, void *arg)
33 {
34 struct nlattr *tb[NL80211_ATTR_MAX + 1];
35 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
36 struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
37 static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
38 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
39 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
40 };
41 struct nl80211_noise_info *info = arg;
42
43 if (info->count >= MAX_NL80211_NOISE_FREQS)
44 return NL_STOP;
45
46 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
47 genlmsg_attrlen(gnlh, 0), NULL);
48
49 if (!tb[NL80211_ATTR_SURVEY_INFO]) {
50 wpa_printf(MSG_DEBUG, "nl80211: Survey data missing");
51 return NL_SKIP;
52 }
53
54 if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
55 tb[NL80211_ATTR_SURVEY_INFO],
56 survey_policy)) {
57 wpa_printf(MSG_DEBUG, "nl80211: Failed to parse nested "
58 "attributes");
59 return NL_SKIP;
60 }
61
62 if (!sinfo[NL80211_SURVEY_INFO_NOISE])
63 return NL_SKIP;
64
65 if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY])
66 return NL_SKIP;
67
68 info->freq[info->count] =
69 nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]);
70 info->noise[info->count] =
71 (s8) nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
72 info->count++;
73
74 return NL_SKIP;
75 }
76
77
nl80211_get_noise_for_scan_results(struct wpa_driver_nl80211_data * drv,struct nl80211_noise_info * info)78 static int nl80211_get_noise_for_scan_results(
79 struct wpa_driver_nl80211_data *drv, struct nl80211_noise_info *info)
80 {
81 struct nl_msg *msg;
82
83 os_memset(info, 0, sizeof(*info));
84 msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_GET_SURVEY);
85 return send_and_recv_msgs(drv, msg, get_noise_for_scan_results, info,
86 NULL, NULL);
87 }
88
89
nl80211_abort_scan(struct i802_bss * bss)90 static int nl80211_abort_scan(struct i802_bss *bss)
91 {
92 int ret;
93 struct nl_msg *msg;
94 struct wpa_driver_nl80211_data *drv = bss->drv;
95
96 wpa_printf(MSG_DEBUG, "nl80211: Abort scan");
97 msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_ABORT_SCAN);
98 ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
99 if (ret) {
100 wpa_printf(MSG_DEBUG, "nl80211: Abort scan failed: ret=%d (%s)",
101 ret, strerror(-ret));
102 }
103 return ret;
104 }
105
106
107 #ifdef CONFIG_DRIVER_NL80211_QCA
nl80211_abort_vendor_scan(struct wpa_driver_nl80211_data * drv,u64 scan_cookie)108 static int nl80211_abort_vendor_scan(struct wpa_driver_nl80211_data *drv,
109 u64 scan_cookie)
110 {
111 struct nl_msg *msg;
112 struct nlattr *params;
113 int ret;
114
115 wpa_printf(MSG_DEBUG, "nl80211: Abort vendor scan with cookie 0x%llx",
116 (long long unsigned int) scan_cookie);
117
118 msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR);
119 if (!msg ||
120 nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
121 nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
122 QCA_NL80211_VENDOR_SUBCMD_ABORT_SCAN) ||
123 !(params = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
124 nla_put_u64(msg, QCA_WLAN_VENDOR_ATTR_SCAN_COOKIE, scan_cookie))
125 goto fail;
126
127 nla_nest_end(msg, params);
128
129 ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
130 msg = NULL;
131 if (ret) {
132 wpa_printf(MSG_INFO,
133 "nl80211: Aborting vendor scan with cookie 0x%llx failed: ret=%d (%s)",
134 (long long unsigned int) scan_cookie, ret,
135 strerror(-ret));
136 goto fail;
137 }
138 return 0;
139 fail:
140 nlmsg_free(msg);
141 return -1;
142 }
143 #endif /* CONFIG_DRIVER_NL80211_QCA */
144
145
146 /**
147 * wpa_driver_nl80211_scan_timeout - Scan timeout to report scan completion
148 * @eloop_ctx: Driver private data
149 * @timeout_ctx: ctx argument given to wpa_driver_nl80211_init()
150 *
151 * This function can be used as registered timeout when starting a scan to
152 * generate a scan completed event if the driver does not report this.
153 */
wpa_driver_nl80211_scan_timeout(void * eloop_ctx,void * timeout_ctx)154 void wpa_driver_nl80211_scan_timeout(void *eloop_ctx, void *timeout_ctx)
155 {
156 struct wpa_driver_nl80211_data *drv = eloop_ctx;
157
158 wpa_printf(MSG_DEBUG, "nl80211: Scan timeout - try to abort it");
159 #ifdef CONFIG_DRIVER_NL80211_QCA
160 if (drv->vendor_scan_cookie &&
161 nl80211_abort_vendor_scan(drv, drv->vendor_scan_cookie) == 0)
162 return;
163 #endif /* CONFIG_DRIVER_NL80211_QCA */
164 if (!drv->vendor_scan_cookie &&
165 nl80211_abort_scan(drv->first_bss) == 0)
166 return;
167
168 wpa_printf(MSG_DEBUG, "nl80211: Failed to abort scan");
169
170 if (drv->ap_scan_as_station != NL80211_IFTYPE_UNSPECIFIED)
171 nl80211_restore_ap_mode(drv->first_bss);
172
173 wpa_printf(MSG_DEBUG, "nl80211: Try to get scan results");
174 wpa_supplicant_event(timeout_ctx, EVENT_SCAN_RESULTS, NULL);
175 }
176
177
178 static struct nl_msg *
nl80211_scan_common(struct i802_bss * bss,u8 cmd,struct wpa_driver_scan_params * params)179 nl80211_scan_common(struct i802_bss *bss, u8 cmd,
180 struct wpa_driver_scan_params *params)
181 {
182 struct wpa_driver_nl80211_data *drv = bss->drv;
183 struct nl_msg *msg;
184 size_t i;
185 u32 scan_flags = 0;
186
187 msg = nl80211_cmd_msg(bss, 0, cmd);
188 if (!msg)
189 return NULL;
190
191 if (params->num_ssids) {
192 struct nlattr *ssids;
193
194 ssids = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
195 if (ssids == NULL)
196 goto fail;
197 for (i = 0; i < params->num_ssids; i++) {
198 wpa_printf(MSG_MSGDUMP, "nl80211: Scan SSID %s",
199 wpa_ssid_txt(params->ssids[i].ssid,
200 params->ssids[i].ssid_len));
201 if (nla_put(msg, i + 1, params->ssids[i].ssid_len,
202 params->ssids[i].ssid))
203 goto fail;
204 }
205 nla_nest_end(msg, ssids);
206 } else {
207 wpa_printf(MSG_DEBUG, "nl80211: Passive scan requested");
208 }
209
210 if (params->extra_ies) {
211 wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan extra IEs",
212 params->extra_ies, params->extra_ies_len);
213 if (nla_put(msg, NL80211_ATTR_IE, params->extra_ies_len,
214 params->extra_ies))
215 goto fail;
216 }
217
218 if (params->freqs) {
219 struct nlattr *freqs;
220 freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
221 if (freqs == NULL)
222 goto fail;
223 for (i = 0; params->freqs[i]; i++) {
224 wpa_printf(MSG_MSGDUMP, "nl80211: Scan frequency %u "
225 "MHz", params->freqs[i]);
226 if (nla_put_u32(msg, i + 1, params->freqs[i]))
227 goto fail;
228 }
229 nla_nest_end(msg, freqs);
230 }
231
232 os_free(drv->filter_ssids);
233 drv->filter_ssids = params->filter_ssids;
234 params->filter_ssids = NULL;
235 drv->num_filter_ssids = params->num_filter_ssids;
236
237 if (!drv->hostapd && is_ap_interface(drv->nlmode)) {
238 wpa_printf(MSG_DEBUG, "nl80211: Add NL80211_SCAN_FLAG_AP");
239 scan_flags |= NL80211_SCAN_FLAG_AP;
240 }
241
242 if (params->only_new_results) {
243 wpa_printf(MSG_DEBUG, "nl80211: Add NL80211_SCAN_FLAG_FLUSH");
244 scan_flags |= NL80211_SCAN_FLAG_FLUSH;
245 }
246
247 if (params->low_priority && drv->have_low_prio_scan) {
248 wpa_printf(MSG_DEBUG,
249 "nl80211: Add NL80211_SCAN_FLAG_LOW_PRIORITY");
250 scan_flags |= NL80211_SCAN_FLAG_LOW_PRIORITY;
251 }
252
253 if (params->mac_addr_rand) {
254 wpa_printf(MSG_DEBUG,
255 "nl80211: Add NL80211_SCAN_FLAG_RANDOM_ADDR");
256 scan_flags |= NL80211_SCAN_FLAG_RANDOM_ADDR;
257
258 if (params->mac_addr) {
259 wpa_printf(MSG_DEBUG, "nl80211: MAC address: " MACSTR,
260 MAC2STR(params->mac_addr));
261 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
262 params->mac_addr))
263 goto fail;
264 }
265
266 if (params->mac_addr_mask) {
267 wpa_printf(MSG_DEBUG, "nl80211: MAC address mask: "
268 MACSTR, MAC2STR(params->mac_addr_mask));
269 if (nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN,
270 params->mac_addr_mask))
271 goto fail;
272 }
273 }
274
275 if (params->duration) {
276 if (!(drv->capa.rrm_flags &
277 WPA_DRIVER_FLAGS_SUPPORT_SET_SCAN_DWELL) ||
278 nla_put_u16(msg, NL80211_ATTR_MEASUREMENT_DURATION,
279 params->duration))
280 goto fail;
281
282 if (params->duration_mandatory &&
283 nla_put_flag(msg,
284 NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY))
285 goto fail;
286 }
287
288 if (params->oce_scan) {
289 wpa_printf(MSG_DEBUG,
290 "nl80211: Add NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME");
291 wpa_printf(MSG_DEBUG,
292 "nl80211: Add NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP");
293 wpa_printf(MSG_DEBUG,
294 "nl80211: Add NL80211_SCAN_FLAG_OCE_PROBE_REQ_MIN_TX_RATE");
295 wpa_printf(MSG_DEBUG,
296 "nl80211: Add NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION");
297 scan_flags |= NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME |
298 NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP |
299 NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE |
300 NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION;
301 }
302
303 if (scan_flags &&
304 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, scan_flags))
305 goto fail;
306
307 return msg;
308
309 fail:
310 nlmsg_free(msg);
311 return NULL;
312 }
313
314
315 /**
316 * wpa_driver_nl80211_scan - Request the driver to initiate scan
317 * @bss: Pointer to private driver data from wpa_driver_nl80211_init()
318 * @params: Scan parameters
319 * Returns: 0 on success, -1 on failure
320 */
wpa_driver_nl80211_scan(struct i802_bss * bss,struct wpa_driver_scan_params * params)321 int wpa_driver_nl80211_scan(struct i802_bss *bss,
322 struct wpa_driver_scan_params *params)
323 {
324 struct wpa_driver_nl80211_data *drv = bss->drv;
325 int ret = -1, timeout;
326 struct nl_msg *msg = NULL;
327
328 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: scan request");
329 drv->scan_for_auth = 0;
330
331 if (TEST_FAIL())
332 return -1;
333
334 msg = nl80211_scan_common(bss, NL80211_CMD_TRIGGER_SCAN, params);
335 if (!msg)
336 return -1;
337
338 if (params->p2p_probe) {
339 struct nlattr *rates;
340
341 wpa_printf(MSG_DEBUG, "nl80211: P2P probe - mask SuppRates");
342
343 rates = nla_nest_start(msg, NL80211_ATTR_SCAN_SUPP_RATES);
344 if (rates == NULL)
345 goto fail;
346
347 /*
348 * Remove 2.4 GHz rates 1, 2, 5.5, 11 Mbps from supported rates
349 * by masking out everything else apart from the OFDM rates 6,
350 * 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS rates. All 5 GHz
351 * rates are left enabled.
352 */
353 if (nla_put(msg, NL80211_BAND_2GHZ, 8,
354 "\x0c\x12\x18\x24\x30\x48\x60\x6c"))
355 goto fail;
356 nla_nest_end(msg, rates);
357
358 if (nla_put_flag(msg, NL80211_ATTR_TX_NO_CCK_RATE))
359 goto fail;
360 }
361
362 if (params->bssid) {
363 wpa_printf(MSG_DEBUG, "nl80211: Scan for a specific BSSID: "
364 MACSTR, MAC2STR(params->bssid));
365 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid))
366 goto fail;
367 }
368
369 ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
370 msg = NULL;
371 if (ret) {
372 wpa_printf(MSG_DEBUG, "nl80211: Scan trigger failed: ret=%d "
373 "(%s)", ret, strerror(-ret));
374 if (drv->hostapd && is_ap_interface(drv->nlmode)) {
375 enum nl80211_iftype old_mode = drv->nlmode;
376
377 /*
378 * mac80211 does not allow scan requests in AP mode, so
379 * try to do this in station mode.
380 */
381 if (wpa_driver_nl80211_set_mode(
382 bss, NL80211_IFTYPE_STATION))
383 goto fail;
384
385 if (wpa_driver_nl80211_scan(bss, params)) {
386 wpa_driver_nl80211_set_mode(bss, old_mode);
387 goto fail;
388 }
389
390 /* Restore AP mode when processing scan results */
391 drv->ap_scan_as_station = old_mode;
392 ret = 0;
393 } else
394 goto fail;
395 }
396
397 drv->scan_state = SCAN_REQUESTED;
398 /* Not all drivers generate "scan completed" wireless event, so try to
399 * read results after a timeout. */
400 timeout = 10;
401 if (drv->scan_complete_events) {
402 /*
403 * The driver seems to deliver events to notify when scan is
404 * complete, so use longer timeout to avoid race conditions
405 * with scanning and following association request.
406 */
407 timeout = 30;
408 }
409 wpa_printf(MSG_DEBUG, "Scan requested (ret=%d) - scan timeout %d "
410 "seconds", ret, timeout);
411 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
412 eloop_register_timeout(timeout, 0, wpa_driver_nl80211_scan_timeout,
413 drv, drv->ctx);
414 drv->last_scan_cmd = NL80211_CMD_TRIGGER_SCAN;
415
416 fail:
417 nlmsg_free(msg);
418 return ret;
419 }
420
421
422 static int
nl80211_sched_scan_add_scan_plans(struct wpa_driver_nl80211_data * drv,struct nl_msg * msg,struct wpa_driver_scan_params * params)423 nl80211_sched_scan_add_scan_plans(struct wpa_driver_nl80211_data *drv,
424 struct nl_msg *msg,
425 struct wpa_driver_scan_params *params)
426 {
427 struct nlattr *plans;
428 struct sched_scan_plan *scan_plans = params->sched_scan_plans;
429 unsigned int i;
430
431 plans = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
432 if (!plans)
433 return -1;
434
435 for (i = 0; i < params->sched_scan_plans_num; i++) {
436 struct nlattr *plan = nla_nest_start(msg, i + 1);
437
438 if (!plan)
439 return -1;
440
441 if (!scan_plans[i].interval ||
442 scan_plans[i].interval >
443 drv->capa.max_sched_scan_plan_interval) {
444 wpa_printf(MSG_DEBUG,
445 "nl80211: sched scan plan no. %u: Invalid interval: %u",
446 i, scan_plans[i].interval);
447 return -1;
448 }
449
450 if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
451 scan_plans[i].interval))
452 return -1;
453
454 if (scan_plans[i].iterations >
455 drv->capa.max_sched_scan_plan_iterations) {
456 wpa_printf(MSG_DEBUG,
457 "nl80211: sched scan plan no. %u: Invalid number of iterations: %u",
458 i, scan_plans[i].iterations);
459 return -1;
460 }
461
462 if (scan_plans[i].iterations &&
463 nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
464 scan_plans[i].iterations))
465 return -1;
466
467 nla_nest_end(msg, plan);
468
469 /*
470 * All the scan plans must specify the number of iterations
471 * except the last plan, which will run infinitely. So if the
472 * number of iterations is not specified, this ought to be the
473 * last scan plan.
474 */
475 if (!scan_plans[i].iterations)
476 break;
477 }
478
479 if (i != params->sched_scan_plans_num - 1) {
480 wpa_printf(MSG_DEBUG,
481 "nl80211: All sched scan plans but the last must specify number of iterations");
482 return -1;
483 }
484
485 nla_nest_end(msg, plans);
486 return 0;
487 }
488
489
490 /**
491 * wpa_driver_nl80211_sched_scan - Initiate a scheduled scan
492 * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
493 * @params: Scan parameters
494 * Returns: 0 on success, -1 on failure or if not supported
495 */
wpa_driver_nl80211_sched_scan(void * priv,struct wpa_driver_scan_params * params)496 int wpa_driver_nl80211_sched_scan(void *priv,
497 struct wpa_driver_scan_params *params)
498 {
499 struct i802_bss *bss = priv;
500 struct wpa_driver_nl80211_data *drv = bss->drv;
501 int ret = -1;
502 struct nl_msg *msg;
503 size_t i;
504
505 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: sched_scan request");
506
507 #ifdef ANDROID
508 if (!drv->capa.sched_scan_supported)
509 return android_pno_start(bss, params);
510 #endif /* ANDROID */
511
512 if (!params->sched_scan_plans_num ||
513 params->sched_scan_plans_num > drv->capa.max_sched_scan_plans) {
514 wpa_printf(MSG_ERROR,
515 "nl80211: Invalid number of sched scan plans: %u",
516 params->sched_scan_plans_num);
517 return -1;
518 }
519
520 msg = nl80211_scan_common(bss, NL80211_CMD_START_SCHED_SCAN, params);
521 if (!msg)
522 goto fail;
523
524 if (drv->capa.max_sched_scan_plan_iterations) {
525 if (nl80211_sched_scan_add_scan_plans(drv, msg, params))
526 goto fail;
527 } else {
528 if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
529 params->sched_scan_plans[0].interval * 1000))
530 goto fail;
531 }
532
533 if ((drv->num_filter_ssids &&
534 (int) drv->num_filter_ssids <= drv->capa.max_match_sets) ||
535 params->filter_rssi) {
536 struct nlattr *match_sets;
537 match_sets = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
538 if (match_sets == NULL)
539 goto fail;
540
541 for (i = 0; i < drv->num_filter_ssids; i++) {
542 struct nlattr *match_set_ssid;
543 wpa_printf(MSG_MSGDUMP,
544 "nl80211: Sched scan filter SSID %s",
545 wpa_ssid_txt(drv->filter_ssids[i].ssid,
546 drv->filter_ssids[i].ssid_len));
547
548 match_set_ssid = nla_nest_start(msg, i + 1);
549 if (match_set_ssid == NULL ||
550 nla_put(msg, NL80211_ATTR_SCHED_SCAN_MATCH_SSID,
551 drv->filter_ssids[i].ssid_len,
552 drv->filter_ssids[i].ssid) ||
553 (params->filter_rssi &&
554 nla_put_u32(msg,
555 NL80211_SCHED_SCAN_MATCH_ATTR_RSSI,
556 params->filter_rssi)))
557 goto fail;
558
559 nla_nest_end(msg, match_set_ssid);
560 }
561
562 /*
563 * Due to backward compatibility code, newer kernels treat this
564 * matchset (with only an RSSI filter) as the default for all
565 * other matchsets, unless it's the only one, in which case the
566 * matchset will actually allow all SSIDs above the RSSI.
567 */
568 if (params->filter_rssi) {
569 struct nlattr *match_set_rssi;
570 match_set_rssi = nla_nest_start(msg, 0);
571 if (match_set_rssi == NULL ||
572 nla_put_u32(msg, NL80211_SCHED_SCAN_MATCH_ATTR_RSSI,
573 params->filter_rssi))
574 goto fail;
575 wpa_printf(MSG_MSGDUMP,
576 "nl80211: Sched scan RSSI filter %d dBm",
577 params->filter_rssi);
578 nla_nest_end(msg, match_set_rssi);
579 }
580
581 nla_nest_end(msg, match_sets);
582 }
583
584 if (params->relative_rssi_set) {
585 struct nl80211_bss_select_rssi_adjust rssi_adjust;
586
587 os_memset(&rssi_adjust, 0, sizeof(rssi_adjust));
588 wpa_printf(MSG_DEBUG, "nl80211: Relative RSSI: %d",
589 params->relative_rssi);
590 if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
591 params->relative_rssi))
592 goto fail;
593
594 if (params->relative_adjust_rssi) {
595 int pref_band_set = 1;
596
597 switch (params->relative_adjust_band) {
598 case WPA_SETBAND_5G:
599 rssi_adjust.band = NL80211_BAND_5GHZ;
600 break;
601 case WPA_SETBAND_2G:
602 rssi_adjust.band = NL80211_BAND_2GHZ;
603 break;
604 default:
605 pref_band_set = 0;
606 break;
607 }
608 rssi_adjust.delta = params->relative_adjust_rssi;
609
610 if (pref_band_set &&
611 nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
612 sizeof(rssi_adjust), &rssi_adjust))
613 goto fail;
614 }
615 }
616
617 if (params->sched_scan_start_delay &&
618 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY,
619 params->sched_scan_start_delay))
620 goto fail;
621
622 ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
623
624 /* TODO: if we get an error here, we should fall back to normal scan */
625
626 msg = NULL;
627 if (ret) {
628 wpa_printf(MSG_DEBUG, "nl80211: Sched scan start failed: "
629 "ret=%d (%s)", ret, strerror(-ret));
630 goto fail;
631 }
632
633 wpa_printf(MSG_DEBUG, "nl80211: Sched scan requested (ret=%d)", ret);
634
635 fail:
636 nlmsg_free(msg);
637 return ret;
638 }
639
640
641 /**
642 * wpa_driver_nl80211_stop_sched_scan - Stop a scheduled scan
643 * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
644 * Returns: 0 on success, -1 on failure or if not supported
645 */
wpa_driver_nl80211_stop_sched_scan(void * priv)646 int wpa_driver_nl80211_stop_sched_scan(void *priv)
647 {
648 struct i802_bss *bss = priv;
649 struct wpa_driver_nl80211_data *drv = bss->drv;
650 int ret;
651 struct nl_msg *msg;
652
653 #ifdef ANDROID
654 if (!drv->capa.sched_scan_supported)
655 return android_pno_stop(bss);
656 #endif /* ANDROID */
657
658 msg = nl80211_drv_msg(drv, 0, NL80211_CMD_STOP_SCHED_SCAN);
659 ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
660 if (ret) {
661 wpa_printf(MSG_DEBUG,
662 "nl80211: Sched scan stop failed: ret=%d (%s)",
663 ret, strerror(-ret));
664 } else {
665 wpa_printf(MSG_DEBUG,
666 "nl80211: Sched scan stop sent");
667 }
668
669 return ret;
670 }
671
672
nl80211_scan_filtered(struct wpa_driver_nl80211_data * drv,const u8 * ie,size_t ie_len)673 static int nl80211_scan_filtered(struct wpa_driver_nl80211_data *drv,
674 const u8 *ie, size_t ie_len)
675 {
676 const u8 *ssid;
677 size_t i;
678
679 if (drv->filter_ssids == NULL)
680 return 0;
681
682 ssid = get_ie(ie, ie_len, WLAN_EID_SSID);
683 if (ssid == NULL)
684 return 1;
685
686 for (i = 0; i < drv->num_filter_ssids; i++) {
687 if (ssid[1] == drv->filter_ssids[i].ssid_len &&
688 os_memcmp(ssid + 2, drv->filter_ssids[i].ssid, ssid[1]) ==
689 0)
690 return 0;
691 }
692
693 return 1;
694 }
695
696
697 static struct wpa_scan_res *
nl80211_parse_bss_info(struct wpa_driver_nl80211_data * drv,struct nl_msg * msg)698 nl80211_parse_bss_info(struct wpa_driver_nl80211_data *drv,
699 struct nl_msg *msg)
700 {
701 struct nlattr *tb[NL80211_ATTR_MAX + 1];
702 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
703 struct nlattr *bss[NL80211_BSS_MAX + 1];
704 static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = {
705 [NL80211_BSS_BSSID] = { .type = NLA_UNSPEC },
706 [NL80211_BSS_FREQUENCY] = { .type = NLA_U32 },
707 [NL80211_BSS_TSF] = { .type = NLA_U64 },
708 [NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 },
709 [NL80211_BSS_CAPABILITY] = { .type = NLA_U16 },
710 [NL80211_BSS_INFORMATION_ELEMENTS] = { .type = NLA_UNSPEC },
711 [NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 },
712 [NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 },
713 [NL80211_BSS_STATUS] = { .type = NLA_U32 },
714 [NL80211_BSS_SEEN_MS_AGO] = { .type = NLA_U32 },
715 [NL80211_BSS_BEACON_IES] = { .type = NLA_UNSPEC },
716 [NL80211_BSS_BEACON_TSF] = { .type = NLA_U64 },
717 [NL80211_BSS_PARENT_TSF] = { .type = NLA_U64 },
718 [NL80211_BSS_PARENT_BSSID] = { .type = NLA_UNSPEC },
719 [NL80211_BSS_LAST_SEEN_BOOTTIME] = { .type = NLA_U64 },
720 };
721 struct wpa_scan_res *r;
722 const u8 *ie, *beacon_ie;
723 size_t ie_len, beacon_ie_len;
724 u8 *pos;
725
726 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
727 genlmsg_attrlen(gnlh, 0), NULL);
728 if (!tb[NL80211_ATTR_BSS])
729 return NULL;
730 if (nla_parse_nested(bss, NL80211_BSS_MAX, tb[NL80211_ATTR_BSS],
731 bss_policy))
732 return NULL;
733 if (bss[NL80211_BSS_INFORMATION_ELEMENTS]) {
734 ie = nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
735 ie_len = nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
736 } else {
737 ie = NULL;
738 ie_len = 0;
739 }
740 if (bss[NL80211_BSS_BEACON_IES]) {
741 beacon_ie = nla_data(bss[NL80211_BSS_BEACON_IES]);
742 beacon_ie_len = nla_len(bss[NL80211_BSS_BEACON_IES]);
743 } else {
744 beacon_ie = NULL;
745 beacon_ie_len = 0;
746 }
747
748 if (nl80211_scan_filtered(drv, ie ? ie : beacon_ie,
749 ie ? ie_len : beacon_ie_len))
750 return NULL;
751
752 r = os_zalloc(sizeof(*r) + ie_len + beacon_ie_len);
753 if (r == NULL)
754 return NULL;
755 if (bss[NL80211_BSS_BSSID])
756 os_memcpy(r->bssid, nla_data(bss[NL80211_BSS_BSSID]),
757 ETH_ALEN);
758 if (bss[NL80211_BSS_FREQUENCY])
759 r->freq = nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
760 if (bss[NL80211_BSS_BEACON_INTERVAL])
761 r->beacon_int = nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]);
762 if (bss[NL80211_BSS_CAPABILITY])
763 r->caps = nla_get_u16(bss[NL80211_BSS_CAPABILITY]);
764 r->flags |= WPA_SCAN_NOISE_INVALID;
765 if (bss[NL80211_BSS_SIGNAL_MBM]) {
766 r->level = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]);
767 r->level /= 100; /* mBm to dBm */
768 r->flags |= WPA_SCAN_LEVEL_DBM | WPA_SCAN_QUAL_INVALID;
769 } else if (bss[NL80211_BSS_SIGNAL_UNSPEC]) {
770 r->level = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]);
771 r->flags |= WPA_SCAN_QUAL_INVALID;
772 } else
773 r->flags |= WPA_SCAN_LEVEL_INVALID | WPA_SCAN_QUAL_INVALID;
774 if (bss[NL80211_BSS_TSF])
775 r->tsf = nla_get_u64(bss[NL80211_BSS_TSF]);
776 if (bss[NL80211_BSS_BEACON_TSF]) {
777 u64 tsf = nla_get_u64(bss[NL80211_BSS_BEACON_TSF]);
778 if (tsf > r->tsf) {
779 r->tsf = tsf;
780 r->beacon_newer = true;
781 }
782 }
783 if (bss[NL80211_BSS_SEEN_MS_AGO])
784 r->age = nla_get_u32(bss[NL80211_BSS_SEEN_MS_AGO]);
785 if (bss[NL80211_BSS_LAST_SEEN_BOOTTIME]) {
786 u64 boottime;
787 struct timespec ts;
788
789 #ifndef CLOCK_BOOTTIME
790 #define CLOCK_BOOTTIME 7
791 #endif
792 if (clock_gettime(CLOCK_BOOTTIME, &ts) == 0) {
793 /* Use more accurate boottime information to update the
794 * scan result age since the driver reports this and
795 * CLOCK_BOOTTIME is available. */
796 boottime = nla_get_u64(
797 bss[NL80211_BSS_LAST_SEEN_BOOTTIME]);
798 r->age = ((u64) ts.tv_sec * 1000000000 +
799 ts.tv_nsec - boottime) / 1000000;
800 }
801 }
802 r->ie_len = ie_len;
803 pos = (u8 *) (r + 1);
804 if (ie) {
805 os_memcpy(pos, ie, ie_len);
806 pos += ie_len;
807 }
808 r->beacon_ie_len = beacon_ie_len;
809 if (beacon_ie)
810 os_memcpy(pos, beacon_ie, beacon_ie_len);
811
812 if (bss[NL80211_BSS_STATUS]) {
813 enum nl80211_bss_status status;
814 status = nla_get_u32(bss[NL80211_BSS_STATUS]);
815 switch (status) {
816 case NL80211_BSS_STATUS_ASSOCIATED:
817 r->flags |= WPA_SCAN_ASSOCIATED;
818 break;
819 default:
820 break;
821 }
822 }
823
824 if (bss[NL80211_BSS_PARENT_TSF] && bss[NL80211_BSS_PARENT_BSSID]) {
825 r->parent_tsf = nla_get_u64(bss[NL80211_BSS_PARENT_TSF]);
826 os_memcpy(r->tsf_bssid, nla_data(bss[NL80211_BSS_PARENT_BSSID]),
827 ETH_ALEN);
828 }
829
830 return r;
831 }
832
833
834 struct nl80211_bss_info_arg {
835 struct wpa_driver_nl80211_data *drv;
836 struct wpa_scan_results *res;
837 };
838
bss_info_handler(struct nl_msg * msg,void * arg)839 static int bss_info_handler(struct nl_msg *msg, void *arg)
840 {
841 struct nl80211_bss_info_arg *_arg = arg;
842 struct wpa_scan_results *res = _arg->res;
843 struct wpa_scan_res **tmp;
844 struct wpa_scan_res *r;
845
846 r = nl80211_parse_bss_info(_arg->drv, msg);
847 if (!r)
848 return NL_SKIP;
849
850 if (!res) {
851 os_free(r);
852 return NL_SKIP;
853 }
854 tmp = os_realloc_array(res->res, res->num + 1,
855 sizeof(struct wpa_scan_res *));
856 if (tmp == NULL) {
857 os_free(r);
858 return NL_SKIP;
859 }
860 tmp[res->num++] = r;
861 res->res = tmp;
862
863 return NL_SKIP;
864 }
865
866
clear_state_mismatch(struct wpa_driver_nl80211_data * drv,const u8 * addr)867 static void clear_state_mismatch(struct wpa_driver_nl80211_data *drv,
868 const u8 *addr)
869 {
870 if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) {
871 wpa_printf(MSG_DEBUG, "nl80211: Clear possible state "
872 "mismatch (" MACSTR ")", MAC2STR(addr));
873 wpa_driver_nl80211_mlme(drv, addr,
874 NL80211_CMD_DEAUTHENTICATE,
875 WLAN_REASON_PREV_AUTH_NOT_VALID, 1,
876 drv->first_bss);
877 }
878 }
879
880
nl80211_check_bss_status(struct wpa_driver_nl80211_data * drv,struct wpa_scan_res * r)881 static void nl80211_check_bss_status(struct wpa_driver_nl80211_data *drv,
882 struct wpa_scan_res *r)
883 {
884 if (!(r->flags & WPA_SCAN_ASSOCIATED))
885 return;
886
887 wpa_printf(MSG_DEBUG, "nl80211: Scan results indicate BSS status with "
888 MACSTR " as associated", MAC2STR(r->bssid));
889 if (is_sta_interface(drv->nlmode) && !drv->associated) {
890 wpa_printf(MSG_DEBUG,
891 "nl80211: Local state (not associated) does not match with BSS state");
892 clear_state_mismatch(drv, r->bssid);
893 } else if (is_sta_interface(drv->nlmode) &&
894 os_memcmp(drv->bssid, r->bssid, ETH_ALEN) != 0) {
895 wpa_printf(MSG_DEBUG,
896 "nl80211: Local state (associated with " MACSTR
897 ") does not match with BSS state",
898 MAC2STR(drv->bssid));
899 clear_state_mismatch(drv, r->bssid);
900 clear_state_mismatch(drv, drv->bssid);
901 }
902 }
903
904
wpa_driver_nl80211_check_bss_status(struct wpa_driver_nl80211_data * drv,struct wpa_scan_results * res)905 static void wpa_driver_nl80211_check_bss_status(
906 struct wpa_driver_nl80211_data *drv, struct wpa_scan_results *res)
907 {
908 size_t i;
909
910 for (i = 0; i < res->num; i++)
911 nl80211_check_bss_status(drv, res->res[i]);
912 }
913
914
nl80211_update_scan_res_noise(struct wpa_scan_res * res,struct nl80211_noise_info * info)915 static void nl80211_update_scan_res_noise(struct wpa_scan_res *res,
916 struct nl80211_noise_info *info)
917 {
918 unsigned int i;
919
920 for (i = 0; res && i < info->count; i++) {
921 if ((int) info->freq[i] != res->freq ||
922 !(res->flags & WPA_SCAN_NOISE_INVALID))
923 continue;
924 res->noise = info->noise[i];
925 res->flags &= ~WPA_SCAN_NOISE_INVALID;
926 }
927 }
928
929
930 static struct wpa_scan_results *
nl80211_get_scan_results(struct wpa_driver_nl80211_data * drv)931 nl80211_get_scan_results(struct wpa_driver_nl80211_data *drv)
932 {
933 struct nl_msg *msg;
934 struct wpa_scan_results *res;
935 int ret;
936 struct nl80211_bss_info_arg arg;
937 int count = 0;
938
939 try_again:
940 res = os_zalloc(sizeof(*res));
941 if (res == NULL)
942 return NULL;
943 if (!(msg = nl80211_cmd_msg(drv->first_bss, NLM_F_DUMP,
944 NL80211_CMD_GET_SCAN))) {
945 wpa_scan_results_free(res);
946 return NULL;
947 }
948
949 arg.drv = drv;
950 arg.res = res;
951 ret = send_and_recv_msgs(drv, msg, bss_info_handler, &arg, NULL, NULL);
952 if (ret == -EAGAIN) {
953 count++;
954 if (count >= 10) {
955 wpa_printf(MSG_INFO,
956 "nl80211: Failed to receive consistent scan result dump");
957 } else {
958 wpa_printf(MSG_DEBUG,
959 "nl80211: Failed to receive consistent scan result dump - try again");
960 wpa_scan_results_free(res);
961 goto try_again;
962 }
963 }
964 if (ret == 0) {
965 struct nl80211_noise_info info;
966
967 wpa_printf(MSG_DEBUG, "nl80211: Received scan results (%lu "
968 "BSSes)", (unsigned long) res->num);
969 if (nl80211_get_noise_for_scan_results(drv, &info) == 0) {
970 size_t i;
971
972 for (i = 0; i < res->num; ++i)
973 nl80211_update_scan_res_noise(res->res[i],
974 &info);
975 }
976 return res;
977 }
978 wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d "
979 "(%s)", ret, strerror(-ret));
980 wpa_scan_results_free(res);
981 return NULL;
982 }
983
984
985 /**
986 * wpa_driver_nl80211_get_scan_results - Fetch the latest scan results
987 * @priv: Pointer to private wext data from wpa_driver_nl80211_init()
988 * Returns: Scan results on success, -1 on failure
989 */
wpa_driver_nl80211_get_scan_results(void * priv)990 struct wpa_scan_results * wpa_driver_nl80211_get_scan_results(void *priv)
991 {
992 struct i802_bss *bss = priv;
993 struct wpa_driver_nl80211_data *drv = bss->drv;
994 struct wpa_scan_results *res;
995
996 res = nl80211_get_scan_results(drv);
997 if (res)
998 wpa_driver_nl80211_check_bss_status(drv, res);
999 return res;
1000 }
1001
1002
1003 struct nl80211_dump_scan_ctx {
1004 struct wpa_driver_nl80211_data *drv;
1005 int idx;
1006 };
1007
nl80211_dump_scan_handler(struct nl_msg * msg,void * arg)1008 static int nl80211_dump_scan_handler(struct nl_msg *msg, void *arg)
1009 {
1010 struct nl80211_dump_scan_ctx *ctx = arg;
1011 struct wpa_scan_res *r;
1012
1013 r = nl80211_parse_bss_info(ctx->drv, msg);
1014 if (!r)
1015 return NL_SKIP;
1016 wpa_printf(MSG_DEBUG, "nl80211: %d " MACSTR " %d%s",
1017 ctx->idx, MAC2STR(r->bssid), r->freq,
1018 r->flags & WPA_SCAN_ASSOCIATED ? " [assoc]" : "");
1019 ctx->idx++;
1020 os_free(r);
1021 return NL_SKIP;
1022 }
1023
1024
nl80211_dump_scan(struct wpa_driver_nl80211_data * drv)1025 void nl80211_dump_scan(struct wpa_driver_nl80211_data *drv)
1026 {
1027 struct nl_msg *msg;
1028 struct nl80211_dump_scan_ctx ctx;
1029
1030 wpa_printf(MSG_DEBUG, "nl80211: Scan result dump");
1031 ctx.drv = drv;
1032 ctx.idx = 0;
1033 msg = nl80211_cmd_msg(drv->first_bss, NLM_F_DUMP, NL80211_CMD_GET_SCAN);
1034 if (msg)
1035 send_and_recv_msgs(drv, msg, nl80211_dump_scan_handler, &ctx,
1036 NULL, NULL);
1037 }
1038
1039
wpa_driver_nl80211_abort_scan(void * priv,u64 scan_cookie)1040 int wpa_driver_nl80211_abort_scan(void *priv, u64 scan_cookie)
1041 {
1042 struct i802_bss *bss = priv;
1043 #ifdef CONFIG_DRIVER_NL80211_QCA
1044 struct wpa_driver_nl80211_data *drv = bss->drv;
1045
1046 /*
1047 * If scan_cookie is zero, a normal scan through kernel (cfg80211)
1048 * was triggered, hence abort the cfg80211 scan instead of the vendor
1049 * scan.
1050 */
1051 if (drv->scan_vendor_cmd_avail && scan_cookie)
1052 return nl80211_abort_vendor_scan(drv, scan_cookie);
1053 #endif /* CONFIG_DRIVER_NL80211_QCA */
1054 return nl80211_abort_scan(bss);
1055 }
1056
1057
1058 #ifdef CONFIG_DRIVER_NL80211_QCA
1059
scan_cookie_handler(struct nl_msg * msg,void * arg)1060 static int scan_cookie_handler(struct nl_msg *msg, void *arg)
1061 {
1062 struct nlattr *tb[NL80211_ATTR_MAX + 1];
1063 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1064 u64 *cookie = arg;
1065
1066 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1067 genlmsg_attrlen(gnlh, 0), NULL);
1068
1069 if (tb[NL80211_ATTR_VENDOR_DATA]) {
1070 struct nlattr *nl_vendor = tb[NL80211_ATTR_VENDOR_DATA];
1071 struct nlattr *tb_vendor[QCA_WLAN_VENDOR_ATTR_SCAN_MAX + 1];
1072
1073 nla_parse(tb_vendor, QCA_WLAN_VENDOR_ATTR_SCAN_MAX,
1074 nla_data(nl_vendor), nla_len(nl_vendor), NULL);
1075
1076 if (tb_vendor[QCA_WLAN_VENDOR_ATTR_SCAN_COOKIE])
1077 *cookie = nla_get_u64(
1078 tb_vendor[QCA_WLAN_VENDOR_ATTR_SCAN_COOKIE]);
1079 }
1080
1081 return NL_SKIP;
1082 }
1083
1084
1085 /**
1086 * wpa_driver_nl80211_vendor_scan - Request the driver to initiate a vendor scan
1087 * @bss: Pointer to private driver data from wpa_driver_nl80211_init()
1088 * @params: Scan parameters
1089 * Returns: 0 on success, -1 on failure
1090 */
wpa_driver_nl80211_vendor_scan(struct i802_bss * bss,struct wpa_driver_scan_params * params)1091 int wpa_driver_nl80211_vendor_scan(struct i802_bss *bss,
1092 struct wpa_driver_scan_params *params)
1093 {
1094 struct wpa_driver_nl80211_data *drv = bss->drv;
1095 struct nl_msg *msg = NULL;
1096 struct nlattr *attr;
1097 size_t i;
1098 u32 scan_flags = 0;
1099 int ret = -1;
1100 u64 cookie = 0;
1101
1102 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: vendor scan request");
1103 drv->scan_for_auth = 0;
1104
1105 if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
1106 nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
1107 nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
1108 QCA_NL80211_VENDOR_SUBCMD_TRIGGER_SCAN) )
1109 goto fail;
1110
1111 attr = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1112 if (attr == NULL)
1113 goto fail;
1114
1115 if (params->num_ssids) {
1116 struct nlattr *ssids;
1117
1118 ssids = nla_nest_start(msg, QCA_WLAN_VENDOR_ATTR_SCAN_SSIDS);
1119 if (ssids == NULL)
1120 goto fail;
1121 for (i = 0; i < params->num_ssids; i++) {
1122 wpa_printf(MSG_MSGDUMP, "nl80211: Scan SSID %s",
1123 wpa_ssid_txt(params->ssids[i].ssid,
1124 params->ssids[i].ssid_len));
1125 if (nla_put(msg, i + 1, params->ssids[i].ssid_len,
1126 params->ssids[i].ssid))
1127 goto fail;
1128 }
1129 nla_nest_end(msg, ssids);
1130 }
1131
1132 if (params->extra_ies) {
1133 wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan extra IEs",
1134 params->extra_ies, params->extra_ies_len);
1135 if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_SCAN_IE,
1136 params->extra_ies_len, params->extra_ies))
1137 goto fail;
1138 }
1139
1140 if (params->freqs) {
1141 struct nlattr *freqs;
1142
1143 freqs = nla_nest_start(msg,
1144 QCA_WLAN_VENDOR_ATTR_SCAN_FREQUENCIES);
1145 if (freqs == NULL)
1146 goto fail;
1147 for (i = 0; params->freqs[i]; i++) {
1148 wpa_printf(MSG_MSGDUMP,
1149 "nl80211: Scan frequency %u MHz",
1150 params->freqs[i]);
1151 if (nla_put_u32(msg, i + 1, params->freqs[i]))
1152 goto fail;
1153 }
1154 nla_nest_end(msg, freqs);
1155 }
1156
1157 os_free(drv->filter_ssids);
1158 drv->filter_ssids = params->filter_ssids;
1159 params->filter_ssids = NULL;
1160 drv->num_filter_ssids = params->num_filter_ssids;
1161
1162 if (params->low_priority && drv->have_low_prio_scan) {
1163 wpa_printf(MSG_DEBUG,
1164 "nl80211: Add NL80211_SCAN_FLAG_LOW_PRIORITY");
1165 scan_flags |= NL80211_SCAN_FLAG_LOW_PRIORITY;
1166 }
1167
1168 if (params->mac_addr_rand) {
1169 wpa_printf(MSG_DEBUG,
1170 "nl80211: Add NL80211_SCAN_FLAG_RANDOM_ADDR");
1171 scan_flags |= NL80211_SCAN_FLAG_RANDOM_ADDR;
1172
1173 if (params->mac_addr) {
1174 wpa_printf(MSG_DEBUG, "nl80211: MAC address: " MACSTR,
1175 MAC2STR(params->mac_addr));
1176 if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_SCAN_MAC,
1177 ETH_ALEN, params->mac_addr))
1178 goto fail;
1179 }
1180
1181 if (params->mac_addr_mask) {
1182 wpa_printf(MSG_DEBUG, "nl80211: MAC address mask: "
1183 MACSTR, MAC2STR(params->mac_addr_mask));
1184 if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_SCAN_MAC_MASK,
1185 ETH_ALEN, params->mac_addr_mask))
1186 goto fail;
1187 }
1188 }
1189
1190 if (scan_flags &&
1191 nla_put_u32(msg, QCA_WLAN_VENDOR_ATTR_SCAN_FLAGS, scan_flags))
1192 goto fail;
1193
1194 if (params->p2p_probe) {
1195 struct nlattr *rates;
1196
1197 wpa_printf(MSG_DEBUG, "nl80211: P2P probe - mask SuppRates");
1198
1199 rates = nla_nest_start(msg,
1200 QCA_WLAN_VENDOR_ATTR_SCAN_SUPP_RATES);
1201 if (rates == NULL)
1202 goto fail;
1203
1204 /*
1205 * Remove 2.4 GHz rates 1, 2, 5.5, 11 Mbps from supported rates
1206 * by masking out everything else apart from the OFDM rates 6,
1207 * 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS rates. All 5 GHz
1208 * rates are left enabled.
1209 */
1210 if (nla_put(msg, NL80211_BAND_2GHZ, 8,
1211 "\x0c\x12\x18\x24\x30\x48\x60\x6c"))
1212 goto fail;
1213 nla_nest_end(msg, rates);
1214
1215 if (nla_put_flag(msg, QCA_WLAN_VENDOR_ATTR_SCAN_TX_NO_CCK_RATE))
1216 goto fail;
1217 }
1218
1219 if (params->bssid) {
1220 wpa_printf(MSG_DEBUG, "nl80211: Scan for a specific BSSID: "
1221 MACSTR, MAC2STR(params->bssid));
1222 if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_SCAN_BSSID, ETH_ALEN,
1223 params->bssid))
1224 goto fail;
1225 }
1226
1227 nla_nest_end(msg, attr);
1228
1229 ret = send_and_recv_msgs(drv, msg, scan_cookie_handler, &cookie,
1230 NULL, NULL);
1231 msg = NULL;
1232 if (ret) {
1233 wpa_printf(MSG_DEBUG,
1234 "nl80211: Vendor scan trigger failed: ret=%d (%s)",
1235 ret, strerror(-ret));
1236 goto fail;
1237 }
1238
1239 drv->vendor_scan_cookie = cookie;
1240 drv->scan_state = SCAN_REQUESTED;
1241 /* Pass the cookie to the caller to help distinguish the scans. */
1242 params->scan_cookie = cookie;
1243
1244 wpa_printf(MSG_DEBUG,
1245 "nl80211: Vendor scan requested (ret=%d) - scan timeout 30 seconds, scan cookie:0x%llx",
1246 ret, (long long unsigned int) cookie);
1247 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
1248 eloop_register_timeout(30, 0, wpa_driver_nl80211_scan_timeout,
1249 drv, drv->ctx);
1250 drv->last_scan_cmd = NL80211_CMD_VENDOR;
1251
1252 fail:
1253 nlmsg_free(msg);
1254 return ret;
1255 }
1256
1257
1258 /**
1259 * nl80211_set_default_scan_ies - Set the scan default IEs to the driver
1260 * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
1261 * @ies: Pointer to IEs buffer
1262 * @ies_len: Length of IEs in bytes
1263 * Returns: 0 on success, -1 on failure
1264 */
nl80211_set_default_scan_ies(void * priv,const u8 * ies,size_t ies_len)1265 int nl80211_set_default_scan_ies(void *priv, const u8 *ies, size_t ies_len)
1266 {
1267 struct i802_bss *bss = priv;
1268 struct wpa_driver_nl80211_data *drv = bss->drv;
1269 struct nl_msg *msg = NULL;
1270 struct nlattr *attr;
1271 int ret = -1;
1272
1273 if (!drv->set_wifi_conf_vendor_cmd_avail)
1274 return -1;
1275
1276 if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
1277 nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
1278 nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
1279 QCA_NL80211_VENDOR_SUBCMD_SET_WIFI_CONFIGURATION))
1280 goto fail;
1281
1282 attr = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1283 if (attr == NULL)
1284 goto fail;
1285
1286 wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan default IEs", ies, ies_len);
1287 if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_CONFIG_SCAN_DEFAULT_IES,
1288 ies_len, ies))
1289 goto fail;
1290
1291 nla_nest_end(msg, attr);
1292
1293 ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
1294 msg = NULL;
1295 if (ret) {
1296 wpa_printf(MSG_ERROR,
1297 "nl80211: Set scan default IEs failed: ret=%d (%s)",
1298 ret, strerror(-ret));
1299 goto fail;
1300 }
1301
1302 fail:
1303 nlmsg_free(msg);
1304 return ret;
1305 }
1306
1307 #endif /* CONFIG_DRIVER_NL80211_QCA */
1308