1 /*
2 * Driver interaction with Linux nl80211/cfg80211 - Scanning
3 * Copyright(c) 2015 Intel Deutschland GmbH
4 * Copyright (c) 2002-2014, Jouni Malinen <j@w1.fi>
5 * Copyright (c) 2007, Johannes Berg <johannes@sipsolutions.net>
6 * Copyright (c) 2009-2010, Atheros Communications
7 *
8 * This software may be distributed under the terms of the BSD license.
9 * See README for more details.
10 */
11
12 #include "includes.h"
13 #include <time.h>
14 #include <netlink/genl/genl.h>
15
16 #include "utils/common.h"
17 #include "utils/eloop.h"
18 #include "common/ieee802_11_defs.h"
19 #include "common/ieee802_11_common.h"
20 #include "common/qca-vendor.h"
21 #include "driver_nl80211.h"
22
23
24 #define MAX_NL80211_NOISE_FREQS 100
25
26 struct nl80211_noise_info {
27 u32 freq[MAX_NL80211_NOISE_FREQS];
28 s8 noise[MAX_NL80211_NOISE_FREQS];
29 unsigned int count;
30 };
31
get_noise_for_scan_results(struct nl_msg * msg,void * arg)32 static int get_noise_for_scan_results(struct nl_msg *msg, void *arg)
33 {
34 struct nlattr *tb[NL80211_ATTR_MAX + 1];
35 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
36 struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
37 static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
38 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
39 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
40 };
41 struct nl80211_noise_info *info = arg;
42
43 if (info->count >= MAX_NL80211_NOISE_FREQS)
44 return NL_SKIP;
45
46 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
47 genlmsg_attrlen(gnlh, 0), NULL);
48
49 if (!tb[NL80211_ATTR_SURVEY_INFO]) {
50 wpa_printf(MSG_DEBUG, "nl80211: Survey data missing");
51 return NL_SKIP;
52 }
53
54 if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
55 tb[NL80211_ATTR_SURVEY_INFO],
56 survey_policy)) {
57 wpa_printf(MSG_DEBUG, "nl80211: Failed to parse nested "
58 "attributes");
59 return NL_SKIP;
60 }
61
62 if (!sinfo[NL80211_SURVEY_INFO_NOISE])
63 return NL_SKIP;
64
65 if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY])
66 return NL_SKIP;
67
68 info->freq[info->count] =
69 nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]);
70 info->noise[info->count] =
71 (s8) nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
72 info->count++;
73
74 return NL_SKIP;
75 }
76
77
nl80211_get_noise_for_scan_results(struct wpa_driver_nl80211_data * drv,struct nl80211_noise_info * info)78 static int nl80211_get_noise_for_scan_results(
79 struct wpa_driver_nl80211_data *drv, struct nl80211_noise_info *info)
80 {
81 struct nl_msg *msg;
82
83 os_memset(info, 0, sizeof(*info));
84 msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_GET_SURVEY);
85 return send_and_recv_msgs(drv, msg, get_noise_for_scan_results, info,
86 NULL, NULL);
87 }
88
89
nl80211_abort_scan(struct i802_bss * bss)90 static int nl80211_abort_scan(struct i802_bss *bss)
91 {
92 int ret;
93 struct nl_msg *msg;
94 struct wpa_driver_nl80211_data *drv = bss->drv;
95
96 wpa_printf(MSG_DEBUG, "nl80211: Abort scan");
97 msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_ABORT_SCAN);
98 ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
99 if (ret) {
100 wpa_printf(MSG_DEBUG, "nl80211: Abort scan failed: ret=%d (%s)",
101 ret, strerror(-ret));
102 }
103 return ret;
104 }
105
106
107 #ifdef CONFIG_DRIVER_NL80211_QCA
nl80211_abort_vendor_scan(struct wpa_driver_nl80211_data * drv,u64 scan_cookie)108 static int nl80211_abort_vendor_scan(struct wpa_driver_nl80211_data *drv,
109 u64 scan_cookie)
110 {
111 struct nl_msg *msg;
112 struct nlattr *params;
113 int ret;
114
115 wpa_printf(MSG_DEBUG, "nl80211: Abort vendor scan with cookie 0x%llx",
116 (long long unsigned int) scan_cookie);
117
118 msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR);
119 if (!msg ||
120 nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
121 nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
122 QCA_NL80211_VENDOR_SUBCMD_ABORT_SCAN) ||
123 !(params = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
124 nla_put_u64(msg, QCA_WLAN_VENDOR_ATTR_SCAN_COOKIE, scan_cookie))
125 goto fail;
126
127 nla_nest_end(msg, params);
128
129 ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
130 msg = NULL;
131 if (ret) {
132 wpa_printf(MSG_INFO,
133 "nl80211: Aborting vendor scan with cookie 0x%llx failed: ret=%d (%s)",
134 (long long unsigned int) scan_cookie, ret,
135 strerror(-ret));
136 goto fail;
137 }
138 return 0;
139 fail:
140 nlmsg_free(msg);
141 return -1;
142 }
143 #endif /* CONFIG_DRIVER_NL80211_QCA */
144
145
146 /**
147 * wpa_driver_nl80211_scan_timeout - Scan timeout to report scan completion
148 * @eloop_ctx: Driver private data
149 * @timeout_ctx: ctx argument given to wpa_driver_nl80211_init()
150 *
151 * This function can be used as registered timeout when starting a scan to
152 * generate a scan completed event if the driver does not report this.
153 */
wpa_driver_nl80211_scan_timeout(void * eloop_ctx,void * timeout_ctx)154 void wpa_driver_nl80211_scan_timeout(void *eloop_ctx, void *timeout_ctx)
155 {
156 struct wpa_driver_nl80211_data *drv = eloop_ctx;
157
158 wpa_printf(MSG_DEBUG, "nl80211: Scan timeout - try to abort it");
159 #ifdef CONFIG_DRIVER_NL80211_QCA
160 if (drv->vendor_scan_cookie &&
161 nl80211_abort_vendor_scan(drv, drv->vendor_scan_cookie) == 0)
162 return;
163 #endif /* CONFIG_DRIVER_NL80211_QCA */
164 if (!drv->vendor_scan_cookie &&
165 nl80211_abort_scan(drv->first_bss) == 0)
166 return;
167
168 wpa_printf(MSG_DEBUG, "nl80211: Failed to abort scan");
169
170 if (drv->ap_scan_as_station != NL80211_IFTYPE_UNSPECIFIED)
171 nl80211_restore_ap_mode(drv->first_bss);
172
173 wpa_printf(MSG_DEBUG, "nl80211: Try to get scan results");
174 wpa_supplicant_event(timeout_ctx, EVENT_SCAN_RESULTS, NULL);
175 }
176
177
178 static struct nl_msg *
nl80211_scan_common(struct i802_bss * bss,u8 cmd,struct wpa_driver_scan_params * params)179 nl80211_scan_common(struct i802_bss *bss, u8 cmd,
180 struct wpa_driver_scan_params *params)
181 {
182 struct wpa_driver_nl80211_data *drv = bss->drv;
183 struct nl_msg *msg;
184 size_t i;
185 u32 scan_flags = 0;
186
187 msg = nl80211_cmd_msg(bss, 0, cmd);
188 if (!msg)
189 return NULL;
190
191 if (params->num_ssids) {
192 struct nlattr *ssids;
193
194 ssids = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
195 if (ssids == NULL)
196 goto fail;
197 for (i = 0; i < params->num_ssids; i++) {
198 wpa_printf(MSG_MSGDUMP, "nl80211: Scan SSID %s",
199 wpa_ssid_txt(params->ssids[i].ssid,
200 params->ssids[i].ssid_len));
201 if (nla_put(msg, i + 1, params->ssids[i].ssid_len,
202 params->ssids[i].ssid))
203 goto fail;
204 }
205 nla_nest_end(msg, ssids);
206
207 /*
208 * If allowed, scan for 6 GHz APs that are reported by other
209 * APs. Note that if the flag is not set and 6 GHz channels are
210 * to be scanned, it is highly likely that non-PSC channels
211 * would be scanned passively (due to the Probe Request frame
212 * transmission restrictions mandated in IEEE Std 802.11ax-2021,
213 * 26.17.2.3 (Scanning in the 6 GHz band). Passive scanning of
214 * all non-PSC channels would take a significant amount of time.
215 */
216 if (!params->non_coloc_6ghz) {
217 wpa_printf(MSG_DEBUG,
218 "nl80211: Scan co-located APs on 6 GHz");
219 scan_flags |= NL80211_SCAN_FLAG_COLOCATED_6GHZ;
220 }
221 } else {
222 wpa_printf(MSG_DEBUG, "nl80211: Passive scan requested");
223 }
224
225 if (params->extra_ies) {
226 wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan extra IEs",
227 params->extra_ies, params->extra_ies_len);
228 if (nla_put(msg, NL80211_ATTR_IE, params->extra_ies_len,
229 params->extra_ies))
230 goto fail;
231 }
232
233 if (params->freqs) {
234 struct nlattr *freqs;
235 freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
236 if (freqs == NULL)
237 goto fail;
238 for (i = 0; params->freqs[i]; i++) {
239 wpa_printf(MSG_MSGDUMP, "nl80211: Scan frequency %u "
240 "MHz", params->freqs[i]);
241 if (nla_put_u32(msg, i + 1, params->freqs[i]))
242 goto fail;
243 }
244 nla_nest_end(msg, freqs);
245 }
246
247 os_free(drv->filter_ssids);
248 drv->filter_ssids = params->filter_ssids;
249 params->filter_ssids = NULL;
250 drv->num_filter_ssids = params->num_filter_ssids;
251
252 if (!drv->hostapd && is_ap_interface(drv->nlmode)) {
253 wpa_printf(MSG_DEBUG, "nl80211: Add NL80211_SCAN_FLAG_AP");
254 scan_flags |= NL80211_SCAN_FLAG_AP;
255 }
256
257 if (params->only_new_results) {
258 wpa_printf(MSG_DEBUG, "nl80211: Add NL80211_SCAN_FLAG_FLUSH");
259 scan_flags |= NL80211_SCAN_FLAG_FLUSH;
260 }
261
262 if (params->low_priority && drv->have_low_prio_scan) {
263 wpa_printf(MSG_DEBUG,
264 "nl80211: Add NL80211_SCAN_FLAG_LOW_PRIORITY");
265 scan_flags |= NL80211_SCAN_FLAG_LOW_PRIORITY;
266 }
267
268 if (params->mac_addr_rand) {
269 wpa_printf(MSG_DEBUG,
270 "nl80211: Add NL80211_SCAN_FLAG_RANDOM_ADDR");
271 scan_flags |= NL80211_SCAN_FLAG_RANDOM_ADDR;
272
273 if (params->mac_addr) {
274 wpa_printf(MSG_DEBUG, "nl80211: MAC address: " MACSTR,
275 MAC2STR(params->mac_addr));
276 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
277 params->mac_addr))
278 goto fail;
279 }
280
281 if (params->mac_addr_mask) {
282 wpa_printf(MSG_DEBUG, "nl80211: MAC address mask: "
283 MACSTR, MAC2STR(params->mac_addr_mask));
284 if (nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN,
285 params->mac_addr_mask))
286 goto fail;
287 }
288 }
289
290 if (params->duration) {
291 if (!(drv->capa.rrm_flags &
292 WPA_DRIVER_FLAGS_SUPPORT_SET_SCAN_DWELL) ||
293 nla_put_u16(msg, NL80211_ATTR_MEASUREMENT_DURATION,
294 params->duration))
295 goto fail;
296
297 if (params->duration_mandatory &&
298 nla_put_flag(msg,
299 NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY))
300 goto fail;
301 }
302
303 if (params->oce_scan) {
304 wpa_printf(MSG_DEBUG,
305 "nl80211: Add NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME");
306 wpa_printf(MSG_DEBUG,
307 "nl80211: Add NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP");
308 wpa_printf(MSG_DEBUG,
309 "nl80211: Add NL80211_SCAN_FLAG_OCE_PROBE_REQ_MIN_TX_RATE");
310 wpa_printf(MSG_DEBUG,
311 "nl80211: Add NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION");
312 scan_flags |= NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME |
313 NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP |
314 NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE |
315 NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION;
316 }
317
318 if (params->min_probe_req_content) {
319 if (drv->capa.flags2 & WPA_DRIVER_FLAGS2_SCAN_MIN_PREQ)
320 scan_flags |= NL80211_SCAN_FLAG_MIN_PREQ_CONTENT;
321 else
322 wpa_printf(MSG_DEBUG,
323 "nl80211: NL80211_SCAN_FLAG_MIN_PREQ_CONTENT not supported");
324 }
325
326 if (scan_flags &&
327 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, scan_flags))
328 goto fail;
329
330 return msg;
331
332 fail:
333 nlmsg_free(msg);
334 return NULL;
335 }
336
337
338 /**
339 * wpa_driver_nl80211_scan - Request the driver to initiate scan
340 * @bss: Pointer to private driver data from wpa_driver_nl80211_init()
341 * @params: Scan parameters
342 * Returns: 0 on success, -1 on failure
343 */
wpa_driver_nl80211_scan(struct i802_bss * bss,struct wpa_driver_scan_params * params)344 int wpa_driver_nl80211_scan(struct i802_bss *bss,
345 struct wpa_driver_scan_params *params)
346 {
347 struct wpa_driver_nl80211_data *drv = bss->drv;
348 int ret = -1, timeout;
349 struct nl_msg *msg = NULL;
350
351 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: scan request");
352 drv->scan_for_auth = 0;
353
354 if (TEST_FAIL())
355 return -1;
356
357 msg = nl80211_scan_common(bss, NL80211_CMD_TRIGGER_SCAN, params);
358 if (!msg)
359 return -1;
360
361 if (params->p2p_probe) {
362 struct nlattr *rates;
363
364 wpa_printf(MSG_DEBUG, "nl80211: P2P probe - mask SuppRates");
365
366 rates = nla_nest_start(msg, NL80211_ATTR_SCAN_SUPP_RATES);
367 if (rates == NULL)
368 goto fail;
369
370 /*
371 * Remove 2.4 GHz rates 1, 2, 5.5, 11 Mbps from supported rates
372 * by masking out everything else apart from the OFDM rates 6,
373 * 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS rates. All 5 GHz
374 * rates are left enabled.
375 */
376 if (nla_put(msg, NL80211_BAND_2GHZ, 8,
377 "\x0c\x12\x18\x24\x30\x48\x60\x6c"))
378 goto fail;
379 nla_nest_end(msg, rates);
380
381 if (nla_put_flag(msg, NL80211_ATTR_TX_NO_CCK_RATE))
382 goto fail;
383 }
384
385 if (params->bssid) {
386 wpa_printf(MSG_DEBUG, "nl80211: Scan for a specific BSSID: "
387 MACSTR, MAC2STR(params->bssid));
388 if (nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid))
389 goto fail;
390 /* NL80211_ATTR_MAC was used for this purpose initially and the
391 * NL80211_ATTR_BSSID was added in 2016 when MAC address
392 * randomization was added. For compatibility with older kernel
393 * versions, add the NL80211_ATTR_MAC attribute as well when
394 * the conflicting functionality is not in use. */
395 if (!params->mac_addr_rand &&
396 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid))
397 goto fail;
398 }
399
400 ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
401 msg = NULL;
402 if (ret) {
403 wpa_printf(MSG_DEBUG, "nl80211: Scan trigger failed: ret=%d "
404 "(%s)", ret, strerror(-ret));
405 if (drv->hostapd && is_ap_interface(drv->nlmode)) {
406 enum nl80211_iftype old_mode = drv->nlmode;
407
408 /*
409 * mac80211 does not allow scan requests in AP mode, so
410 * try to do this in station mode.
411 */
412 if (wpa_driver_nl80211_set_mode(
413 bss, NL80211_IFTYPE_STATION))
414 goto fail;
415
416 if (wpa_driver_nl80211_scan(bss, params)) {
417 wpa_driver_nl80211_set_mode(bss, old_mode);
418 goto fail;
419 }
420
421 /* Restore AP mode when processing scan results */
422 drv->ap_scan_as_station = old_mode;
423 ret = 0;
424 } else
425 goto fail;
426 }
427
428 drv->scan_state = SCAN_REQUESTED;
429 /* Not all drivers generate "scan completed" wireless event, so try to
430 * read results after a timeout. */
431 timeout = drv->uses_6ghz ? 15 : 10;
432 if (drv->scan_complete_events) {
433 /*
434 * The driver seems to deliver events to notify when scan is
435 * complete, so use longer timeout to avoid race conditions
436 * with scanning and following association request.
437 */
438 timeout = 30;
439 }
440 wpa_printf(MSG_DEBUG, "Scan requested (ret=%d) - scan timeout %d "
441 "seconds", ret, timeout);
442 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
443 eloop_register_timeout(timeout, 0, wpa_driver_nl80211_scan_timeout,
444 drv, drv->ctx);
445 drv->last_scan_cmd = NL80211_CMD_TRIGGER_SCAN;
446
447 fail:
448 nlmsg_free(msg);
449 return ret;
450 }
451
452
453 static int
nl80211_sched_scan_add_scan_plans(struct wpa_driver_nl80211_data * drv,struct nl_msg * msg,struct wpa_driver_scan_params * params)454 nl80211_sched_scan_add_scan_plans(struct wpa_driver_nl80211_data *drv,
455 struct nl_msg *msg,
456 struct wpa_driver_scan_params *params)
457 {
458 struct nlattr *plans;
459 struct sched_scan_plan *scan_plans = params->sched_scan_plans;
460 unsigned int i;
461
462 plans = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
463 if (!plans)
464 return -1;
465
466 for (i = 0; i < params->sched_scan_plans_num; i++) {
467 struct nlattr *plan = nla_nest_start(msg, i + 1);
468
469 if (!plan)
470 return -1;
471
472 if (!scan_plans[i].interval ||
473 scan_plans[i].interval >
474 drv->capa.max_sched_scan_plan_interval) {
475 wpa_printf(MSG_DEBUG,
476 "nl80211: sched scan plan no. %u: Invalid interval: %u",
477 i, scan_plans[i].interval);
478 return -1;
479 }
480
481 if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
482 scan_plans[i].interval))
483 return -1;
484
485 if (scan_plans[i].iterations >
486 drv->capa.max_sched_scan_plan_iterations) {
487 wpa_printf(MSG_DEBUG,
488 "nl80211: sched scan plan no. %u: Invalid number of iterations: %u",
489 i, scan_plans[i].iterations);
490 return -1;
491 }
492
493 if (scan_plans[i].iterations &&
494 nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
495 scan_plans[i].iterations))
496 return -1;
497
498 nla_nest_end(msg, plan);
499
500 /*
501 * All the scan plans must specify the number of iterations
502 * except the last plan, which will run infinitely. So if the
503 * number of iterations is not specified, this ought to be the
504 * last scan plan.
505 */
506 if (!scan_plans[i].iterations)
507 break;
508 }
509
510 if (i != params->sched_scan_plans_num - 1) {
511 wpa_printf(MSG_DEBUG,
512 "nl80211: All sched scan plans but the last must specify number of iterations");
513 return -1;
514 }
515
516 nla_nest_end(msg, plans);
517 return 0;
518 }
519
520
521 /**
522 * wpa_driver_nl80211_sched_scan - Initiate a scheduled scan
523 * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
524 * @params: Scan parameters
525 * Returns: 0 on success, -1 on failure or if not supported
526 */
wpa_driver_nl80211_sched_scan(void * priv,struct wpa_driver_scan_params * params)527 int wpa_driver_nl80211_sched_scan(void *priv,
528 struct wpa_driver_scan_params *params)
529 {
530 struct i802_bss *bss = priv;
531 struct wpa_driver_nl80211_data *drv = bss->drv;
532 int ret = -1;
533 struct nl_msg *msg;
534 size_t i;
535
536 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: sched_scan request");
537
538 #ifdef ANDROID
539 if (!drv->capa.sched_scan_supported)
540 return android_pno_start(bss, params);
541 #endif /* ANDROID */
542
543 if (!params->sched_scan_plans_num ||
544 params->sched_scan_plans_num > drv->capa.max_sched_scan_plans) {
545 wpa_printf(MSG_ERROR,
546 "nl80211: Invalid number of sched scan plans: %u",
547 params->sched_scan_plans_num);
548 return -1;
549 }
550
551 msg = nl80211_scan_common(bss, NL80211_CMD_START_SCHED_SCAN, params);
552 if (!msg)
553 goto fail;
554
555 if (drv->capa.max_sched_scan_plan_iterations) {
556 if (nl80211_sched_scan_add_scan_plans(drv, msg, params))
557 goto fail;
558 } else {
559 if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
560 params->sched_scan_plans[0].interval * 1000))
561 goto fail;
562 }
563
564 if ((drv->num_filter_ssids &&
565 (int) drv->num_filter_ssids <= drv->capa.max_match_sets) ||
566 params->filter_rssi) {
567 struct nlattr *match_sets;
568 match_sets = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
569 if (match_sets == NULL)
570 goto fail;
571
572 for (i = 0; i < drv->num_filter_ssids; i++) {
573 struct nlattr *match_set_ssid;
574 wpa_printf(MSG_MSGDUMP,
575 "nl80211: Sched scan filter SSID %s",
576 wpa_ssid_txt(drv->filter_ssids[i].ssid,
577 drv->filter_ssids[i].ssid_len));
578
579 match_set_ssid = nla_nest_start(msg, i + 1);
580 if (match_set_ssid == NULL ||
581 nla_put(msg, NL80211_ATTR_SCHED_SCAN_MATCH_SSID,
582 drv->filter_ssids[i].ssid_len,
583 drv->filter_ssids[i].ssid) ||
584 (params->filter_rssi &&
585 nla_put_u32(msg,
586 NL80211_SCHED_SCAN_MATCH_ATTR_RSSI,
587 params->filter_rssi)))
588 goto fail;
589
590 nla_nest_end(msg, match_set_ssid);
591 }
592
593 /*
594 * Due to backward compatibility code, newer kernels treat this
595 * matchset (with only an RSSI filter) as the default for all
596 * other matchsets, unless it's the only one, in which case the
597 * matchset will actually allow all SSIDs above the RSSI.
598 */
599 if (params->filter_rssi) {
600 struct nlattr *match_set_rssi;
601 match_set_rssi = nla_nest_start(msg, 0);
602 if (match_set_rssi == NULL ||
603 nla_put_u32(msg, NL80211_SCHED_SCAN_MATCH_ATTR_RSSI,
604 params->filter_rssi))
605 goto fail;
606 wpa_printf(MSG_MSGDUMP,
607 "nl80211: Sched scan RSSI filter %d dBm",
608 params->filter_rssi);
609 nla_nest_end(msg, match_set_rssi);
610 }
611
612 nla_nest_end(msg, match_sets);
613 }
614
615 if (params->relative_rssi_set) {
616 struct nl80211_bss_select_rssi_adjust rssi_adjust;
617
618 os_memset(&rssi_adjust, 0, sizeof(rssi_adjust));
619 wpa_printf(MSG_DEBUG, "nl80211: Relative RSSI: %d",
620 params->relative_rssi);
621 if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
622 params->relative_rssi))
623 goto fail;
624
625 if (params->relative_adjust_rssi) {
626 int pref_band_set = 1;
627
628 switch (params->relative_adjust_band) {
629 case WPA_SETBAND_5G:
630 rssi_adjust.band = NL80211_BAND_5GHZ;
631 break;
632 case WPA_SETBAND_2G:
633 rssi_adjust.band = NL80211_BAND_2GHZ;
634 break;
635 default:
636 pref_band_set = 0;
637 break;
638 }
639 rssi_adjust.delta = params->relative_adjust_rssi;
640
641 if (pref_band_set &&
642 nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
643 sizeof(rssi_adjust), &rssi_adjust))
644 goto fail;
645 }
646 }
647
648 if (params->sched_scan_start_delay &&
649 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY,
650 params->sched_scan_start_delay))
651 goto fail;
652
653 ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
654
655 /* TODO: if we get an error here, we should fall back to normal scan */
656
657 msg = NULL;
658 if (ret) {
659 wpa_printf(MSG_DEBUG, "nl80211: Sched scan start failed: "
660 "ret=%d (%s)", ret, strerror(-ret));
661 goto fail;
662 }
663
664 wpa_printf(MSG_DEBUG, "nl80211: Sched scan requested (ret=%d)", ret);
665
666 fail:
667 nlmsg_free(msg);
668 return ret;
669 }
670
671
672 /**
673 * wpa_driver_nl80211_stop_sched_scan - Stop a scheduled scan
674 * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
675 * Returns: 0 on success, -1 on failure or if not supported
676 */
wpa_driver_nl80211_stop_sched_scan(void * priv)677 int wpa_driver_nl80211_stop_sched_scan(void *priv)
678 {
679 struct i802_bss *bss = priv;
680 struct wpa_driver_nl80211_data *drv = bss->drv;
681 int ret;
682 struct nl_msg *msg;
683
684 #ifdef ANDROID
685 if (!drv->capa.sched_scan_supported)
686 return android_pno_stop(bss);
687 #endif /* ANDROID */
688
689 msg = nl80211_drv_msg(drv, 0, NL80211_CMD_STOP_SCHED_SCAN);
690 ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
691 if (ret) {
692 wpa_printf(MSG_DEBUG,
693 "nl80211: Sched scan stop failed: ret=%d (%s)",
694 ret, strerror(-ret));
695 } else {
696 wpa_printf(MSG_DEBUG,
697 "nl80211: Sched scan stop sent");
698 }
699
700 return ret;
701 }
702
703
nl80211_scan_filtered(struct wpa_driver_nl80211_data * drv,const u8 * ie,size_t ie_len)704 static int nl80211_scan_filtered(struct wpa_driver_nl80211_data *drv,
705 const u8 *ie, size_t ie_len)
706 {
707 const u8 *ssid;
708 size_t i;
709
710 if (drv->filter_ssids == NULL)
711 return 0;
712
713 ssid = get_ie(ie, ie_len, WLAN_EID_SSID);
714 if (ssid == NULL)
715 return 1;
716
717 for (i = 0; i < drv->num_filter_ssids; i++) {
718 if (ssid[1] == drv->filter_ssids[i].ssid_len &&
719 os_memcmp(ssid + 2, drv->filter_ssids[i].ssid, ssid[1]) ==
720 0)
721 return 0;
722 }
723
724 return 1;
725 }
726
727
728 static struct wpa_scan_res *
nl80211_parse_bss_info(struct wpa_driver_nl80211_data * drv,struct nl_msg * msg)729 nl80211_parse_bss_info(struct wpa_driver_nl80211_data *drv,
730 struct nl_msg *msg)
731 {
732 struct nlattr *tb[NL80211_ATTR_MAX + 1];
733 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
734 struct nlattr *bss[NL80211_BSS_MAX + 1];
735 static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = {
736 [NL80211_BSS_BSSID] = { .type = NLA_UNSPEC },
737 [NL80211_BSS_FREQUENCY] = { .type = NLA_U32 },
738 [NL80211_BSS_TSF] = { .type = NLA_U64 },
739 [NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 },
740 [NL80211_BSS_CAPABILITY] = { .type = NLA_U16 },
741 [NL80211_BSS_INFORMATION_ELEMENTS] = { .type = NLA_UNSPEC },
742 [NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 },
743 [NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 },
744 [NL80211_BSS_STATUS] = { .type = NLA_U32 },
745 [NL80211_BSS_SEEN_MS_AGO] = { .type = NLA_U32 },
746 [NL80211_BSS_BEACON_IES] = { .type = NLA_UNSPEC },
747 [NL80211_BSS_BEACON_TSF] = { .type = NLA_U64 },
748 [NL80211_BSS_PARENT_TSF] = { .type = NLA_U64 },
749 [NL80211_BSS_PARENT_BSSID] = { .type = NLA_UNSPEC },
750 [NL80211_BSS_LAST_SEEN_BOOTTIME] = { .type = NLA_U64 },
751 };
752 struct wpa_scan_res *r;
753 const u8 *ie, *beacon_ie;
754 size_t ie_len, beacon_ie_len;
755 u8 *pos;
756
757 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
758 genlmsg_attrlen(gnlh, 0), NULL);
759 if (!tb[NL80211_ATTR_BSS])
760 return NULL;
761 if (nla_parse_nested(bss, NL80211_BSS_MAX, tb[NL80211_ATTR_BSS],
762 bss_policy))
763 return NULL;
764 if (bss[NL80211_BSS_INFORMATION_ELEMENTS]) {
765 ie = nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
766 ie_len = nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
767 } else {
768 ie = NULL;
769 ie_len = 0;
770 }
771 if (bss[NL80211_BSS_BEACON_IES]) {
772 beacon_ie = nla_data(bss[NL80211_BSS_BEACON_IES]);
773 beacon_ie_len = nla_len(bss[NL80211_BSS_BEACON_IES]);
774 } else {
775 beacon_ie = NULL;
776 beacon_ie_len = 0;
777 }
778
779 if (nl80211_scan_filtered(drv, ie ? ie : beacon_ie,
780 ie ? ie_len : beacon_ie_len))
781 return NULL;
782
783 r = os_zalloc(sizeof(*r) + ie_len + beacon_ie_len);
784 if (r == NULL)
785 return NULL;
786 if (bss[NL80211_BSS_BSSID])
787 os_memcpy(r->bssid, nla_data(bss[NL80211_BSS_BSSID]),
788 ETH_ALEN);
789 if (bss[NL80211_BSS_FREQUENCY])
790 r->freq = nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
791 if (bss[NL80211_BSS_BEACON_INTERVAL])
792 r->beacon_int = nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]);
793 if (bss[NL80211_BSS_CAPABILITY])
794 r->caps = nla_get_u16(bss[NL80211_BSS_CAPABILITY]);
795 r->flags |= WPA_SCAN_NOISE_INVALID;
796 if (bss[NL80211_BSS_SIGNAL_MBM]) {
797 r->level = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]);
798 r->level /= 100; /* mBm to dBm */
799 r->flags |= WPA_SCAN_LEVEL_DBM | WPA_SCAN_QUAL_INVALID;
800 } else if (bss[NL80211_BSS_SIGNAL_UNSPEC]) {
801 r->level = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]);
802 r->flags |= WPA_SCAN_QUAL_INVALID;
803 } else
804 r->flags |= WPA_SCAN_LEVEL_INVALID | WPA_SCAN_QUAL_INVALID;
805 if (bss[NL80211_BSS_TSF])
806 r->tsf = nla_get_u64(bss[NL80211_BSS_TSF]);
807 if (bss[NL80211_BSS_BEACON_TSF]) {
808 u64 tsf = nla_get_u64(bss[NL80211_BSS_BEACON_TSF]);
809 if (tsf > r->tsf) {
810 r->tsf = tsf;
811 r->beacon_newer = true;
812 }
813 }
814 if (bss[NL80211_BSS_SEEN_MS_AGO])
815 r->age = nla_get_u32(bss[NL80211_BSS_SEEN_MS_AGO]);
816 if (bss[NL80211_BSS_LAST_SEEN_BOOTTIME]) {
817 u64 boottime;
818 struct timespec ts;
819
820 #ifndef CLOCK_BOOTTIME
821 #define CLOCK_BOOTTIME 7
822 #endif
823 if (clock_gettime(CLOCK_BOOTTIME, &ts) == 0) {
824 /* Use more accurate boottime information to update the
825 * scan result age since the driver reports this and
826 * CLOCK_BOOTTIME is available. */
827 boottime = nla_get_u64(
828 bss[NL80211_BSS_LAST_SEEN_BOOTTIME]);
829 r->age = ((u64) ts.tv_sec * 1000000000 +
830 ts.tv_nsec - boottime) / 1000000;
831 }
832 }
833 r->ie_len = ie_len;
834 pos = (u8 *) (r + 1);
835 if (ie) {
836 os_memcpy(pos, ie, ie_len);
837 pos += ie_len;
838 }
839 r->beacon_ie_len = beacon_ie_len;
840 if (beacon_ie)
841 os_memcpy(pos, beacon_ie, beacon_ie_len);
842
843 if (bss[NL80211_BSS_STATUS]) {
844 enum nl80211_bss_status status;
845 status = nla_get_u32(bss[NL80211_BSS_STATUS]);
846 switch (status) {
847 case NL80211_BSS_STATUS_ASSOCIATED:
848 r->flags |= WPA_SCAN_ASSOCIATED;
849 break;
850 default:
851 break;
852 }
853 }
854
855 if (bss[NL80211_BSS_PARENT_TSF] && bss[NL80211_BSS_PARENT_BSSID]) {
856 r->parent_tsf = nla_get_u64(bss[NL80211_BSS_PARENT_TSF]);
857 os_memcpy(r->tsf_bssid, nla_data(bss[NL80211_BSS_PARENT_BSSID]),
858 ETH_ALEN);
859 }
860
861 return r;
862 }
863
864
865 struct nl80211_bss_info_arg {
866 struct wpa_driver_nl80211_data *drv;
867 struct wpa_scan_results *res;
868 };
869
bss_info_handler(struct nl_msg * msg,void * arg)870 static int bss_info_handler(struct nl_msg *msg, void *arg)
871 {
872 struct nl80211_bss_info_arg *_arg = arg;
873 struct wpa_scan_results *res = _arg->res;
874 struct wpa_scan_res **tmp;
875 struct wpa_scan_res *r;
876
877 r = nl80211_parse_bss_info(_arg->drv, msg);
878 if (!r)
879 return NL_SKIP;
880
881 if (!res) {
882 os_free(r);
883 return NL_SKIP;
884 }
885 tmp = os_realloc_array(res->res, res->num + 1,
886 sizeof(struct wpa_scan_res *));
887 if (tmp == NULL) {
888 os_free(r);
889 return NL_SKIP;
890 }
891 tmp[res->num++] = r;
892 res->res = tmp;
893
894 return NL_SKIP;
895 }
896
897
clear_state_mismatch(struct wpa_driver_nl80211_data * drv,const u8 * addr)898 static void clear_state_mismatch(struct wpa_driver_nl80211_data *drv,
899 const u8 *addr)
900 {
901 if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) {
902 wpa_printf(MSG_DEBUG, "nl80211: Clear possible state "
903 "mismatch (" MACSTR ")", MAC2STR(addr));
904 wpa_driver_nl80211_mlme(drv, addr,
905 NL80211_CMD_DEAUTHENTICATE,
906 WLAN_REASON_PREV_AUTH_NOT_VALID, 1,
907 drv->first_bss);
908 }
909 }
910
911
nl80211_check_bss_status(struct wpa_driver_nl80211_data * drv,struct wpa_scan_res * r)912 static void nl80211_check_bss_status(struct wpa_driver_nl80211_data *drv,
913 struct wpa_scan_res *r)
914 {
915 if (!(r->flags & WPA_SCAN_ASSOCIATED))
916 return;
917
918 wpa_printf(MSG_DEBUG, "nl80211: Scan results indicate BSS status with "
919 MACSTR " as associated", MAC2STR(r->bssid));
920 if (is_sta_interface(drv->nlmode) && !drv->associated) {
921 wpa_printf(MSG_DEBUG,
922 "nl80211: Local state (not associated) does not match with BSS state");
923 clear_state_mismatch(drv, r->bssid);
924 } else if (is_sta_interface(drv->nlmode) &&
925 os_memcmp(drv->bssid, r->bssid, ETH_ALEN) != 0) {
926 wpa_printf(MSG_DEBUG,
927 "nl80211: Local state (associated with " MACSTR
928 ") does not match with BSS state",
929 MAC2STR(drv->bssid));
930
931 if (os_memcmp(drv->sta_mlo_info.ap_mld_addr, drv->bssid,
932 ETH_ALEN) != 0) {
933 clear_state_mismatch(drv, r->bssid);
934
935 if (!is_zero_ether_addr(drv->sta_mlo_info.ap_mld_addr))
936 clear_state_mismatch(
937 drv, drv->sta_mlo_info.ap_mld_addr);
938 else
939 clear_state_mismatch(drv, drv->bssid);
940
941 } else {
942 wpa_printf(MSG_DEBUG,
943 "nl80211: BSSID is the MLD address");
944 }
945 }
946 }
947
948
wpa_driver_nl80211_check_bss_status(struct wpa_driver_nl80211_data * drv,struct wpa_scan_results * res)949 static void wpa_driver_nl80211_check_bss_status(
950 struct wpa_driver_nl80211_data *drv, struct wpa_scan_results *res)
951 {
952 size_t i;
953
954 for (i = 0; i < res->num; i++)
955 nl80211_check_bss_status(drv, res->res[i]);
956 }
957
958
nl80211_update_scan_res_noise(struct wpa_scan_res * res,struct nl80211_noise_info * info)959 static void nl80211_update_scan_res_noise(struct wpa_scan_res *res,
960 struct nl80211_noise_info *info)
961 {
962 unsigned int i;
963
964 for (i = 0; res && i < info->count; i++) {
965 if ((int) info->freq[i] != res->freq ||
966 !(res->flags & WPA_SCAN_NOISE_INVALID))
967 continue;
968 res->noise = info->noise[i];
969 res->flags &= ~WPA_SCAN_NOISE_INVALID;
970 }
971 }
972
973
974 static struct wpa_scan_results *
nl80211_get_scan_results(struct wpa_driver_nl80211_data * drv)975 nl80211_get_scan_results(struct wpa_driver_nl80211_data *drv)
976 {
977 struct nl_msg *msg;
978 struct wpa_scan_results *res;
979 int ret;
980 struct nl80211_bss_info_arg arg;
981 int count = 0;
982
983 try_again:
984 res = os_zalloc(sizeof(*res));
985 if (res == NULL)
986 return NULL;
987 if (!(msg = nl80211_cmd_msg(drv->first_bss, NLM_F_DUMP,
988 NL80211_CMD_GET_SCAN))) {
989 wpa_scan_results_free(res);
990 return NULL;
991 }
992
993 arg.drv = drv;
994 arg.res = res;
995 ret = send_and_recv_msgs(drv, msg, bss_info_handler, &arg, NULL, NULL);
996 if (ret == -EAGAIN) {
997 count++;
998 if (count >= 10) {
999 wpa_printf(MSG_INFO,
1000 "nl80211: Failed to receive consistent scan result dump");
1001 } else {
1002 wpa_printf(MSG_DEBUG,
1003 "nl80211: Failed to receive consistent scan result dump - try again");
1004 wpa_scan_results_free(res);
1005 goto try_again;
1006 }
1007 }
1008 if (ret == 0) {
1009 struct nl80211_noise_info info;
1010
1011 wpa_printf(MSG_DEBUG, "nl80211: Received scan results (%lu "
1012 "BSSes)", (unsigned long) res->num);
1013 if (nl80211_get_noise_for_scan_results(drv, &info) == 0) {
1014 size_t i;
1015
1016 for (i = 0; i < res->num; ++i)
1017 nl80211_update_scan_res_noise(res->res[i],
1018 &info);
1019 }
1020 return res;
1021 }
1022 wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d "
1023 "(%s)", ret, strerror(-ret));
1024 wpa_scan_results_free(res);
1025 return NULL;
1026 }
1027
1028
1029 /**
1030 * wpa_driver_nl80211_get_scan_results - Fetch the latest scan results
1031 * @priv: Pointer to private wext data from wpa_driver_nl80211_init()
1032 * Returns: Scan results on success, -1 on failure
1033 */
wpa_driver_nl80211_get_scan_results(void * priv)1034 struct wpa_scan_results * wpa_driver_nl80211_get_scan_results(void *priv)
1035 {
1036 struct i802_bss *bss = priv;
1037 struct wpa_driver_nl80211_data *drv = bss->drv;
1038 struct wpa_scan_results *res;
1039
1040 res = nl80211_get_scan_results(drv);
1041 if (res)
1042 wpa_driver_nl80211_check_bss_status(drv, res);
1043 return res;
1044 }
1045
1046
1047 struct nl80211_dump_scan_ctx {
1048 struct wpa_driver_nl80211_data *drv;
1049 int idx;
1050 };
1051
nl80211_dump_scan_handler(struct nl_msg * msg,void * arg)1052 static int nl80211_dump_scan_handler(struct nl_msg *msg, void *arg)
1053 {
1054 struct nl80211_dump_scan_ctx *ctx = arg;
1055 struct wpa_scan_res *r;
1056
1057 r = nl80211_parse_bss_info(ctx->drv, msg);
1058 if (!r)
1059 return NL_SKIP;
1060 wpa_printf(MSG_DEBUG, "nl80211: %d " MACSTR " %d%s",
1061 ctx->idx, MAC2STR(r->bssid), r->freq,
1062 r->flags & WPA_SCAN_ASSOCIATED ? " [assoc]" : "");
1063 ctx->idx++;
1064 os_free(r);
1065 return NL_SKIP;
1066 }
1067
1068
nl80211_dump_scan(struct wpa_driver_nl80211_data * drv)1069 void nl80211_dump_scan(struct wpa_driver_nl80211_data *drv)
1070 {
1071 struct nl_msg *msg;
1072 struct nl80211_dump_scan_ctx ctx;
1073
1074 wpa_printf(MSG_DEBUG, "nl80211: Scan result dump");
1075 ctx.drv = drv;
1076 ctx.idx = 0;
1077 msg = nl80211_cmd_msg(drv->first_bss, NLM_F_DUMP, NL80211_CMD_GET_SCAN);
1078 if (msg)
1079 send_and_recv_msgs(drv, msg, nl80211_dump_scan_handler, &ctx,
1080 NULL, NULL);
1081 }
1082
1083
wpa_driver_nl80211_abort_scan(void * priv,u64 scan_cookie)1084 int wpa_driver_nl80211_abort_scan(void *priv, u64 scan_cookie)
1085 {
1086 struct i802_bss *bss = priv;
1087 #ifdef CONFIG_DRIVER_NL80211_QCA
1088 struct wpa_driver_nl80211_data *drv = bss->drv;
1089
1090 /*
1091 * If scan_cookie is zero, a normal scan through kernel (cfg80211)
1092 * was triggered, hence abort the cfg80211 scan instead of the vendor
1093 * scan.
1094 */
1095 if (drv->scan_vendor_cmd_avail && scan_cookie)
1096 return nl80211_abort_vendor_scan(drv, scan_cookie);
1097 #endif /* CONFIG_DRIVER_NL80211_QCA */
1098 return nl80211_abort_scan(bss);
1099 }
1100
1101
1102 #ifdef CONFIG_DRIVER_NL80211_QCA
1103
scan_cookie_handler(struct nl_msg * msg,void * arg)1104 static int scan_cookie_handler(struct nl_msg *msg, void *arg)
1105 {
1106 struct nlattr *tb[NL80211_ATTR_MAX + 1];
1107 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1108 u64 *cookie = arg;
1109
1110 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1111 genlmsg_attrlen(gnlh, 0), NULL);
1112
1113 if (tb[NL80211_ATTR_VENDOR_DATA]) {
1114 struct nlattr *nl_vendor = tb[NL80211_ATTR_VENDOR_DATA];
1115 struct nlattr *tb_vendor[QCA_WLAN_VENDOR_ATTR_SCAN_MAX + 1];
1116
1117 nla_parse(tb_vendor, QCA_WLAN_VENDOR_ATTR_SCAN_MAX,
1118 nla_data(nl_vendor), nla_len(nl_vendor), NULL);
1119
1120 if (tb_vendor[QCA_WLAN_VENDOR_ATTR_SCAN_COOKIE])
1121 *cookie = nla_get_u64(
1122 tb_vendor[QCA_WLAN_VENDOR_ATTR_SCAN_COOKIE]);
1123 }
1124
1125 return NL_SKIP;
1126 }
1127
1128
1129 /**
1130 * wpa_driver_nl80211_vendor_scan - Request the driver to initiate a vendor scan
1131 * @bss: Pointer to private driver data from wpa_driver_nl80211_init()
1132 * @params: Scan parameters
1133 * Returns: 0 on success, -1 on failure
1134 */
wpa_driver_nl80211_vendor_scan(struct i802_bss * bss,struct wpa_driver_scan_params * params)1135 int wpa_driver_nl80211_vendor_scan(struct i802_bss *bss,
1136 struct wpa_driver_scan_params *params)
1137 {
1138 struct wpa_driver_nl80211_data *drv = bss->drv;
1139 struct nl_msg *msg = NULL;
1140 struct nlattr *attr;
1141 size_t i;
1142 u32 scan_flags = 0;
1143 int ret = -1;
1144 u64 cookie = 0;
1145
1146 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: vendor scan request");
1147 drv->scan_for_auth = 0;
1148
1149 if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
1150 nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
1151 nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
1152 QCA_NL80211_VENDOR_SUBCMD_TRIGGER_SCAN) )
1153 goto fail;
1154
1155 attr = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1156 if (attr == NULL)
1157 goto fail;
1158
1159 if (params->num_ssids) {
1160 struct nlattr *ssids;
1161
1162 ssids = nla_nest_start(msg, QCA_WLAN_VENDOR_ATTR_SCAN_SSIDS);
1163 if (ssids == NULL)
1164 goto fail;
1165 for (i = 0; i < params->num_ssids; i++) {
1166 wpa_printf(MSG_MSGDUMP, "nl80211: Scan SSID %s",
1167 wpa_ssid_txt(params->ssids[i].ssid,
1168 params->ssids[i].ssid_len));
1169 if (nla_put(msg, i + 1, params->ssids[i].ssid_len,
1170 params->ssids[i].ssid))
1171 goto fail;
1172 }
1173 nla_nest_end(msg, ssids);
1174 }
1175
1176 if (params->extra_ies) {
1177 wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan extra IEs",
1178 params->extra_ies, params->extra_ies_len);
1179 if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_SCAN_IE,
1180 params->extra_ies_len, params->extra_ies))
1181 goto fail;
1182 }
1183
1184 if (params->freqs) {
1185 struct nlattr *freqs;
1186
1187 freqs = nla_nest_start(msg,
1188 QCA_WLAN_VENDOR_ATTR_SCAN_FREQUENCIES);
1189 if (freqs == NULL)
1190 goto fail;
1191 for (i = 0; params->freqs[i]; i++) {
1192 wpa_printf(MSG_MSGDUMP,
1193 "nl80211: Scan frequency %u MHz",
1194 params->freqs[i]);
1195 if (nla_put_u32(msg, i + 1, params->freqs[i]))
1196 goto fail;
1197 }
1198 nla_nest_end(msg, freqs);
1199 }
1200
1201 os_free(drv->filter_ssids);
1202 drv->filter_ssids = params->filter_ssids;
1203 params->filter_ssids = NULL;
1204 drv->num_filter_ssids = params->num_filter_ssids;
1205
1206 if (params->low_priority && drv->have_low_prio_scan) {
1207 wpa_printf(MSG_DEBUG,
1208 "nl80211: Add NL80211_SCAN_FLAG_LOW_PRIORITY");
1209 scan_flags |= NL80211_SCAN_FLAG_LOW_PRIORITY;
1210 }
1211
1212 if (params->mac_addr_rand) {
1213 wpa_printf(MSG_DEBUG,
1214 "nl80211: Add NL80211_SCAN_FLAG_RANDOM_ADDR");
1215 scan_flags |= NL80211_SCAN_FLAG_RANDOM_ADDR;
1216
1217 if (params->mac_addr) {
1218 wpa_printf(MSG_DEBUG, "nl80211: MAC address: " MACSTR,
1219 MAC2STR(params->mac_addr));
1220 if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_SCAN_MAC,
1221 ETH_ALEN, params->mac_addr))
1222 goto fail;
1223 }
1224
1225 if (params->mac_addr_mask) {
1226 wpa_printf(MSG_DEBUG, "nl80211: MAC address mask: "
1227 MACSTR, MAC2STR(params->mac_addr_mask));
1228 if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_SCAN_MAC_MASK,
1229 ETH_ALEN, params->mac_addr_mask))
1230 goto fail;
1231 }
1232 }
1233
1234 if (scan_flags &&
1235 nla_put_u32(msg, QCA_WLAN_VENDOR_ATTR_SCAN_FLAGS, scan_flags))
1236 goto fail;
1237
1238 if (params->p2p_probe) {
1239 struct nlattr *rates;
1240
1241 wpa_printf(MSG_DEBUG, "nl80211: P2P probe - mask SuppRates");
1242
1243 rates = nla_nest_start(msg,
1244 QCA_WLAN_VENDOR_ATTR_SCAN_SUPP_RATES);
1245 if (rates == NULL)
1246 goto fail;
1247
1248 /*
1249 * Remove 2.4 GHz rates 1, 2, 5.5, 11 Mbps from supported rates
1250 * by masking out everything else apart from the OFDM rates 6,
1251 * 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS rates. All 5 GHz
1252 * rates are left enabled.
1253 */
1254 if (nla_put(msg, NL80211_BAND_2GHZ, 8,
1255 "\x0c\x12\x18\x24\x30\x48\x60\x6c"))
1256 goto fail;
1257 nla_nest_end(msg, rates);
1258
1259 if (nla_put_flag(msg, QCA_WLAN_VENDOR_ATTR_SCAN_TX_NO_CCK_RATE))
1260 goto fail;
1261 }
1262
1263 if (params->bssid) {
1264 wpa_printf(MSG_DEBUG, "nl80211: Scan for a specific BSSID: "
1265 MACSTR, MAC2STR(params->bssid));
1266 if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_SCAN_BSSID, ETH_ALEN,
1267 params->bssid))
1268 goto fail;
1269 }
1270
1271 nla_nest_end(msg, attr);
1272
1273 ret = send_and_recv_msgs(drv, msg, scan_cookie_handler, &cookie,
1274 NULL, NULL);
1275 msg = NULL;
1276 if (ret) {
1277 wpa_printf(MSG_DEBUG,
1278 "nl80211: Vendor scan trigger failed: ret=%d (%s)",
1279 ret, strerror(-ret));
1280 goto fail;
1281 }
1282
1283 drv->vendor_scan_cookie = cookie;
1284 drv->scan_state = SCAN_REQUESTED;
1285 /* Pass the cookie to the caller to help distinguish the scans. */
1286 params->scan_cookie = cookie;
1287
1288 wpa_printf(MSG_DEBUG,
1289 "nl80211: Vendor scan requested (ret=%d) - scan timeout 30 seconds, scan cookie:0x%llx",
1290 ret, (long long unsigned int) cookie);
1291 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
1292 eloop_register_timeout(30, 0, wpa_driver_nl80211_scan_timeout,
1293 drv, drv->ctx);
1294 drv->last_scan_cmd = NL80211_CMD_VENDOR;
1295
1296 fail:
1297 nlmsg_free(msg);
1298 return ret;
1299 }
1300
1301
1302 /**
1303 * nl80211_set_default_scan_ies - Set the scan default IEs to the driver
1304 * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
1305 * @ies: Pointer to IEs buffer
1306 * @ies_len: Length of IEs in bytes
1307 * Returns: 0 on success, -1 on failure
1308 */
nl80211_set_default_scan_ies(void * priv,const u8 * ies,size_t ies_len)1309 int nl80211_set_default_scan_ies(void *priv, const u8 *ies, size_t ies_len)
1310 {
1311 struct i802_bss *bss = priv;
1312 struct wpa_driver_nl80211_data *drv = bss->drv;
1313 struct nl_msg *msg = NULL;
1314 struct nlattr *attr;
1315 int ret = -1;
1316
1317 if (!drv->set_wifi_conf_vendor_cmd_avail)
1318 return -1;
1319
1320 if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
1321 nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
1322 nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
1323 QCA_NL80211_VENDOR_SUBCMD_SET_WIFI_CONFIGURATION))
1324 goto fail;
1325
1326 attr = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1327 if (attr == NULL)
1328 goto fail;
1329
1330 wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan default IEs", ies, ies_len);
1331 if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_CONFIG_SCAN_DEFAULT_IES,
1332 ies_len, ies))
1333 goto fail;
1334
1335 nla_nest_end(msg, attr);
1336
1337 ret = send_and_recv_msgs(drv, msg, NULL, NULL, NULL, NULL);
1338 msg = NULL;
1339 if (ret) {
1340 wpa_printf(MSG_ERROR,
1341 "nl80211: Set scan default IEs failed: ret=%d (%s)",
1342 ret, strerror(-ret));
1343 goto fail;
1344 }
1345
1346 fail:
1347 nlmsg_free(msg);
1348 return ret;
1349 }
1350
1351 #endif /* CONFIG_DRIVER_NL80211_QCA */
1352