1 /*
2 * Driver interaction with Linux nl80211/cfg80211 - Scanning
3 * Copyright(c) 2015 Intel Deutschland GmbH
4 * Copyright (c) 2002-2014, Jouni Malinen <j@w1.fi>
5 * Copyright (c) 2007, Johannes Berg <johannes@sipsolutions.net>
6 * Copyright (c) 2009-2010, Atheros Communications
7 *
8 * This software may be distributed under the terms of the BSD license.
9 * See README for more details.
10 */
11
12 #include "includes.h"
13 #include <time.h>
14 #include <netlink/genl/genl.h>
15
16 #include "utils/common.h"
17 #include "utils/eloop.h"
18 #include "common/ieee802_11_defs.h"
19 #include "common/ieee802_11_common.h"
20 #include "common/qca-vendor.h"
21 #include "driver_nl80211.h"
22
23
24 #define MAX_NL80211_NOISE_FREQS 50
25
26 struct nl80211_noise_info {
27 u32 freq[MAX_NL80211_NOISE_FREQS];
28 s8 noise[MAX_NL80211_NOISE_FREQS];
29 unsigned int count;
30 };
31
get_noise_for_scan_results(struct nl_msg * msg,void * arg)32 static int get_noise_for_scan_results(struct nl_msg *msg, void *arg)
33 {
34 struct nlattr *tb[NL80211_ATTR_MAX + 1];
35 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
36 struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
37 static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
38 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
39 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
40 };
41 struct nl80211_noise_info *info = arg;
42
43 if (info->count >= MAX_NL80211_NOISE_FREQS)
44 return NL_STOP;
45
46 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
47 genlmsg_attrlen(gnlh, 0), NULL);
48
49 if (!tb[NL80211_ATTR_SURVEY_INFO]) {
50 wpa_printf(MSG_DEBUG, "nl80211: Survey data missing");
51 return NL_SKIP;
52 }
53
54 if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
55 tb[NL80211_ATTR_SURVEY_INFO],
56 survey_policy)) {
57 wpa_printf(MSG_DEBUG, "nl80211: Failed to parse nested "
58 "attributes");
59 return NL_SKIP;
60 }
61
62 if (!sinfo[NL80211_SURVEY_INFO_NOISE])
63 return NL_SKIP;
64
65 if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY])
66 return NL_SKIP;
67
68 info->freq[info->count] =
69 nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]);
70 info->noise[info->count] =
71 (s8) nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
72 info->count++;
73
74 return NL_SKIP;
75 }
76
77
nl80211_get_noise_for_scan_results(struct wpa_driver_nl80211_data * drv,struct nl80211_noise_info * info)78 static int nl80211_get_noise_for_scan_results(
79 struct wpa_driver_nl80211_data *drv, struct nl80211_noise_info *info)
80 {
81 struct nl_msg *msg;
82
83 os_memset(info, 0, sizeof(*info));
84 msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_GET_SURVEY);
85 return send_and_recv_msgs(drv, msg, get_noise_for_scan_results, info);
86 }
87
88
nl80211_abort_scan(struct i802_bss * bss)89 static int nl80211_abort_scan(struct i802_bss *bss)
90 {
91 int ret;
92 struct nl_msg *msg;
93 struct wpa_driver_nl80211_data *drv = bss->drv;
94
95 wpa_printf(MSG_DEBUG, "nl80211: Abort scan");
96 msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_ABORT_SCAN);
97 ret = send_and_recv_msgs(drv, msg, NULL, NULL);
98 if (ret) {
99 wpa_printf(MSG_DEBUG, "nl80211: Abort scan failed: ret=%d (%s)",
100 ret, strerror(-ret));
101 }
102 return ret;
103 }
104
105
106 #ifdef CONFIG_DRIVER_NL80211_QCA
nl80211_abort_vendor_scan(struct wpa_driver_nl80211_data * drv,u64 scan_cookie)107 static int nl80211_abort_vendor_scan(struct wpa_driver_nl80211_data *drv,
108 u64 scan_cookie)
109 {
110 struct nl_msg *msg;
111 struct nlattr *params;
112 int ret;
113
114 wpa_printf(MSG_DEBUG, "nl80211: Abort vendor scan with cookie 0x%llx",
115 (long long unsigned int) scan_cookie);
116
117 msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR);
118 if (!msg ||
119 nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
120 nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
121 QCA_NL80211_VENDOR_SUBCMD_ABORT_SCAN) ||
122 !(params = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
123 nla_put_u64(msg, QCA_WLAN_VENDOR_ATTR_SCAN_COOKIE, scan_cookie))
124 goto fail;
125
126 nla_nest_end(msg, params);
127
128 ret = send_and_recv_msgs(drv, msg, NULL, NULL);
129 msg = NULL;
130 if (ret) {
131 wpa_printf(MSG_INFO,
132 "nl80211: Aborting vendor scan with cookie 0x%llx failed: ret=%d (%s)",
133 (long long unsigned int) scan_cookie, ret,
134 strerror(-ret));
135 goto fail;
136 }
137 return 0;
138 fail:
139 nlmsg_free(msg);
140 return -1;
141 }
142 #endif /* CONFIG_DRIVER_NL80211_QCA */
143
144
145 /**
146 * wpa_driver_nl80211_scan_timeout - Scan timeout to report scan completion
147 * @eloop_ctx: Driver private data
148 * @timeout_ctx: ctx argument given to wpa_driver_nl80211_init()
149 *
150 * This function can be used as registered timeout when starting a scan to
151 * generate a scan completed event if the driver does not report this.
152 */
wpa_driver_nl80211_scan_timeout(void * eloop_ctx,void * timeout_ctx)153 void wpa_driver_nl80211_scan_timeout(void *eloop_ctx, void *timeout_ctx)
154 {
155 struct wpa_driver_nl80211_data *drv = eloop_ctx;
156
157 wpa_printf(MSG_DEBUG, "nl80211: Scan timeout - try to abort it");
158 #ifdef CONFIG_DRIVER_NL80211_QCA
159 if (drv->vendor_scan_cookie &&
160 nl80211_abort_vendor_scan(drv, drv->vendor_scan_cookie) == 0)
161 return;
162 #endif /* CONFIG_DRIVER_NL80211_QCA */
163 if (!drv->vendor_scan_cookie &&
164 nl80211_abort_scan(drv->first_bss) == 0)
165 return;
166
167 wpa_printf(MSG_DEBUG, "nl80211: Failed to abort scan");
168
169 if (drv->ap_scan_as_station != NL80211_IFTYPE_UNSPECIFIED) {
170 wpa_driver_nl80211_set_mode(drv->first_bss,
171 drv->ap_scan_as_station);
172 drv->ap_scan_as_station = NL80211_IFTYPE_UNSPECIFIED;
173 }
174
175 wpa_printf(MSG_DEBUG, "nl80211: Try to get scan results");
176 wpa_supplicant_event(timeout_ctx, EVENT_SCAN_RESULTS, NULL);
177 }
178
179
180 static struct nl_msg *
nl80211_scan_common(struct i802_bss * bss,u8 cmd,struct wpa_driver_scan_params * params)181 nl80211_scan_common(struct i802_bss *bss, u8 cmd,
182 struct wpa_driver_scan_params *params)
183 {
184 struct wpa_driver_nl80211_data *drv = bss->drv;
185 struct nl_msg *msg;
186 size_t i;
187 u32 scan_flags = 0;
188
189 msg = nl80211_cmd_msg(bss, 0, cmd);
190 if (!msg)
191 return NULL;
192
193 if (params->num_ssids) {
194 struct nlattr *ssids;
195
196 ssids = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
197 if (ssids == NULL)
198 goto fail;
199 for (i = 0; i < params->num_ssids; i++) {
200 wpa_hexdump_ascii(MSG_MSGDUMP, "nl80211: Scan SSID",
201 params->ssids[i].ssid,
202 params->ssids[i].ssid_len);
203 if (nla_put(msg, i + 1, params->ssids[i].ssid_len,
204 params->ssids[i].ssid))
205 goto fail;
206 }
207 nla_nest_end(msg, ssids);
208 } else {
209 wpa_printf(MSG_DEBUG, "nl80211: Passive scan requested");
210 }
211
212 if (params->extra_ies) {
213 wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan extra IEs",
214 params->extra_ies, params->extra_ies_len);
215 if (nla_put(msg, NL80211_ATTR_IE, params->extra_ies_len,
216 params->extra_ies))
217 goto fail;
218 }
219
220 if (params->freqs) {
221 struct nlattr *freqs;
222 freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
223 if (freqs == NULL)
224 goto fail;
225 for (i = 0; params->freqs[i]; i++) {
226 wpa_printf(MSG_MSGDUMP, "nl80211: Scan frequency %u "
227 "MHz", params->freqs[i]);
228 if (nla_put_u32(msg, i + 1, params->freqs[i]))
229 goto fail;
230 }
231 nla_nest_end(msg, freqs);
232 }
233
234 os_free(drv->filter_ssids);
235 drv->filter_ssids = params->filter_ssids;
236 params->filter_ssids = NULL;
237 drv->num_filter_ssids = params->num_filter_ssids;
238
239 if (params->only_new_results) {
240 wpa_printf(MSG_DEBUG, "nl80211: Add NL80211_SCAN_FLAG_FLUSH");
241 scan_flags |= NL80211_SCAN_FLAG_FLUSH;
242 }
243
244 if (params->low_priority && drv->have_low_prio_scan) {
245 wpa_printf(MSG_DEBUG,
246 "nl80211: Add NL80211_SCAN_FLAG_LOW_PRIORITY");
247 scan_flags |= NL80211_SCAN_FLAG_LOW_PRIORITY;
248 }
249
250 if (params->mac_addr_rand) {
251 wpa_printf(MSG_DEBUG,
252 "nl80211: Add NL80211_SCAN_FLAG_RANDOM_ADDR");
253 scan_flags |= NL80211_SCAN_FLAG_RANDOM_ADDR;
254
255 if (params->mac_addr) {
256 wpa_printf(MSG_DEBUG, "nl80211: MAC address: " MACSTR,
257 MAC2STR(params->mac_addr));
258 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
259 params->mac_addr))
260 goto fail;
261 }
262
263 if (params->mac_addr_mask) {
264 wpa_printf(MSG_DEBUG, "nl80211: MAC address mask: "
265 MACSTR, MAC2STR(params->mac_addr_mask));
266 if (nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN,
267 params->mac_addr_mask))
268 goto fail;
269 }
270 }
271
272 if (params->duration) {
273 if (!(drv->capa.rrm_flags &
274 WPA_DRIVER_FLAGS_SUPPORT_SET_SCAN_DWELL) ||
275 nla_put_u16(msg, NL80211_ATTR_MEASUREMENT_DURATION,
276 params->duration))
277 goto fail;
278
279 if (params->duration_mandatory &&
280 nla_put_flag(msg,
281 NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY))
282 goto fail;
283 }
284
285 if (scan_flags &&
286 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, scan_flags))
287 goto fail;
288
289 return msg;
290
291 fail:
292 nlmsg_free(msg);
293 return NULL;
294 }
295
296
297 /**
298 * wpa_driver_nl80211_scan - Request the driver to initiate scan
299 * @bss: Pointer to private driver data from wpa_driver_nl80211_init()
300 * @params: Scan parameters
301 * Returns: 0 on success, -1 on failure
302 */
wpa_driver_nl80211_scan(struct i802_bss * bss,struct wpa_driver_scan_params * params)303 int wpa_driver_nl80211_scan(struct i802_bss *bss,
304 struct wpa_driver_scan_params *params)
305 {
306 struct wpa_driver_nl80211_data *drv = bss->drv;
307 int ret = -1, timeout;
308 struct nl_msg *msg = NULL;
309
310 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: scan request");
311 drv->scan_for_auth = 0;
312
313 if (TEST_FAIL())
314 return -1;
315
316 msg = nl80211_scan_common(bss, NL80211_CMD_TRIGGER_SCAN, params);
317 if (!msg)
318 return -1;
319
320 if (params->p2p_probe) {
321 struct nlattr *rates;
322
323 wpa_printf(MSG_DEBUG, "nl80211: P2P probe - mask SuppRates");
324
325 rates = nla_nest_start(msg, NL80211_ATTR_SCAN_SUPP_RATES);
326 if (rates == NULL)
327 goto fail;
328
329 /*
330 * Remove 2.4 GHz rates 1, 2, 5.5, 11 Mbps from supported rates
331 * by masking out everything else apart from the OFDM rates 6,
332 * 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS rates. All 5 GHz
333 * rates are left enabled.
334 */
335 if (nla_put(msg, NL80211_BAND_2GHZ, 8,
336 "\x0c\x12\x18\x24\x30\x48\x60\x6c"))
337 goto fail;
338 nla_nest_end(msg, rates);
339
340 if (nla_put_flag(msg, NL80211_ATTR_TX_NO_CCK_RATE))
341 goto fail;
342 }
343
344 if (params->bssid) {
345 wpa_printf(MSG_DEBUG, "nl80211: Scan for a specific BSSID: "
346 MACSTR, MAC2STR(params->bssid));
347 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid))
348 goto fail;
349 }
350
351 ret = send_and_recv_msgs(drv, msg, NULL, NULL);
352 msg = NULL;
353 if (ret) {
354 wpa_printf(MSG_DEBUG, "nl80211: Scan trigger failed: ret=%d "
355 "(%s)", ret, strerror(-ret));
356 if (drv->hostapd && is_ap_interface(drv->nlmode)) {
357 enum nl80211_iftype old_mode = drv->nlmode;
358
359 /*
360 * mac80211 does not allow scan requests in AP mode, so
361 * try to do this in station mode.
362 */
363 if (wpa_driver_nl80211_set_mode(
364 bss, NL80211_IFTYPE_STATION))
365 goto fail;
366
367 if (wpa_driver_nl80211_scan(bss, params)) {
368 wpa_driver_nl80211_set_mode(bss, old_mode);
369 goto fail;
370 }
371
372 /* Restore AP mode when processing scan results */
373 drv->ap_scan_as_station = old_mode;
374 ret = 0;
375 } else
376 goto fail;
377 }
378
379 drv->scan_state = SCAN_REQUESTED;
380 /* Not all drivers generate "scan completed" wireless event, so try to
381 * read results after a timeout. */
382 timeout = 10;
383 if (drv->scan_complete_events) {
384 /*
385 * The driver seems to deliver events to notify when scan is
386 * complete, so use longer timeout to avoid race conditions
387 * with scanning and following association request.
388 */
389 timeout = 30;
390 }
391 wpa_printf(MSG_DEBUG, "Scan requested (ret=%d) - scan timeout %d "
392 "seconds", ret, timeout);
393 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
394 eloop_register_timeout(timeout, 0, wpa_driver_nl80211_scan_timeout,
395 drv, drv->ctx);
396 drv->last_scan_cmd = NL80211_CMD_TRIGGER_SCAN;
397
398 fail:
399 nlmsg_free(msg);
400 return ret;
401 }
402
403
404 static int
nl80211_sched_scan_add_scan_plans(struct wpa_driver_nl80211_data * drv,struct nl_msg * msg,struct wpa_driver_scan_params * params)405 nl80211_sched_scan_add_scan_plans(struct wpa_driver_nl80211_data *drv,
406 struct nl_msg *msg,
407 struct wpa_driver_scan_params *params)
408 {
409 struct nlattr *plans;
410 struct sched_scan_plan *scan_plans = params->sched_scan_plans;
411 unsigned int i;
412
413 plans = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
414 if (!plans)
415 return -1;
416
417 for (i = 0; i < params->sched_scan_plans_num; i++) {
418 struct nlattr *plan = nla_nest_start(msg, i + 1);
419
420 if (!plan)
421 return -1;
422
423 if (!scan_plans[i].interval ||
424 scan_plans[i].interval >
425 drv->capa.max_sched_scan_plan_interval) {
426 wpa_printf(MSG_DEBUG,
427 "nl80211: sched scan plan no. %u: Invalid interval: %u",
428 i, scan_plans[i].interval);
429 return -1;
430 }
431
432 if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
433 scan_plans[i].interval))
434 return -1;
435
436 if (scan_plans[i].iterations >
437 drv->capa.max_sched_scan_plan_iterations) {
438 wpa_printf(MSG_DEBUG,
439 "nl80211: sched scan plan no. %u: Invalid number of iterations: %u",
440 i, scan_plans[i].iterations);
441 return -1;
442 }
443
444 if (scan_plans[i].iterations &&
445 nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
446 scan_plans[i].iterations))
447 return -1;
448
449 nla_nest_end(msg, plan);
450
451 /*
452 * All the scan plans must specify the number of iterations
453 * except the last plan, which will run infinitely. So if the
454 * number of iterations is not specified, this ought to be the
455 * last scan plan.
456 */
457 if (!scan_plans[i].iterations)
458 break;
459 }
460
461 if (i != params->sched_scan_plans_num - 1) {
462 wpa_printf(MSG_DEBUG,
463 "nl80211: All sched scan plans but the last must specify number of iterations");
464 return -1;
465 }
466
467 nla_nest_end(msg, plans);
468 return 0;
469 }
470
471
472 /**
473 * wpa_driver_nl80211_sched_scan - Initiate a scheduled scan
474 * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
475 * @params: Scan parameters
476 * Returns: 0 on success, -1 on failure or if not supported
477 */
wpa_driver_nl80211_sched_scan(void * priv,struct wpa_driver_scan_params * params)478 int wpa_driver_nl80211_sched_scan(void *priv,
479 struct wpa_driver_scan_params *params)
480 {
481 struct i802_bss *bss = priv;
482 struct wpa_driver_nl80211_data *drv = bss->drv;
483 int ret = -1;
484 struct nl_msg *msg;
485 size_t i;
486
487 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: sched_scan request");
488
489 #ifdef ANDROID
490 if (!drv->capa.sched_scan_supported)
491 return android_pno_start(bss, params);
492 #endif /* ANDROID */
493
494 if (!params->sched_scan_plans_num ||
495 params->sched_scan_plans_num > drv->capa.max_sched_scan_plans) {
496 wpa_printf(MSG_ERROR,
497 "nl80211: Invalid number of sched scan plans: %u",
498 params->sched_scan_plans_num);
499 return -1;
500 }
501
502 msg = nl80211_scan_common(bss, NL80211_CMD_START_SCHED_SCAN, params);
503 if (!msg)
504 goto fail;
505
506 if (drv->capa.max_sched_scan_plan_iterations) {
507 if (nl80211_sched_scan_add_scan_plans(drv, msg, params))
508 goto fail;
509 } else {
510 if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
511 params->sched_scan_plans[0].interval * 1000))
512 goto fail;
513 }
514
515 if ((drv->num_filter_ssids &&
516 (int) drv->num_filter_ssids <= drv->capa.max_match_sets) ||
517 params->filter_rssi) {
518 struct nlattr *match_sets;
519 match_sets = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
520 if (match_sets == NULL)
521 goto fail;
522
523 for (i = 0; i < drv->num_filter_ssids; i++) {
524 struct nlattr *match_set_ssid;
525 wpa_hexdump_ascii(MSG_MSGDUMP,
526 "nl80211: Sched scan filter SSID",
527 drv->filter_ssids[i].ssid,
528 drv->filter_ssids[i].ssid_len);
529
530 match_set_ssid = nla_nest_start(msg, i + 1);
531 if (match_set_ssid == NULL ||
532 nla_put(msg, NL80211_ATTR_SCHED_SCAN_MATCH_SSID,
533 drv->filter_ssids[i].ssid_len,
534 drv->filter_ssids[i].ssid) ||
535 (params->filter_rssi &&
536 nla_put_u32(msg,
537 NL80211_SCHED_SCAN_MATCH_ATTR_RSSI,
538 params->filter_rssi)))
539 goto fail;
540
541 nla_nest_end(msg, match_set_ssid);
542 }
543
544 /*
545 * Due to backward compatibility code, newer kernels treat this
546 * matchset (with only an RSSI filter) as the default for all
547 * other matchsets, unless it's the only one, in which case the
548 * matchset will actually allow all SSIDs above the RSSI.
549 */
550 if (params->filter_rssi) {
551 struct nlattr *match_set_rssi;
552 match_set_rssi = nla_nest_start(msg, 0);
553 if (match_set_rssi == NULL ||
554 nla_put_u32(msg, NL80211_SCHED_SCAN_MATCH_ATTR_RSSI,
555 params->filter_rssi))
556 goto fail;
557 wpa_printf(MSG_MSGDUMP,
558 "nl80211: Sched scan RSSI filter %d dBm",
559 params->filter_rssi);
560 nla_nest_end(msg, match_set_rssi);
561 }
562
563 nla_nest_end(msg, match_sets);
564 }
565
566 if (params->relative_rssi_set) {
567 struct nl80211_bss_select_rssi_adjust rssi_adjust;
568
569 os_memset(&rssi_adjust, 0, sizeof(rssi_adjust));
570 wpa_printf(MSG_DEBUG, "nl80211: Relative RSSI: %d",
571 params->relative_rssi);
572 if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
573 params->relative_rssi))
574 goto fail;
575
576 if (params->relative_adjust_rssi) {
577 int pref_band_set = 1;
578
579 switch (params->relative_adjust_band) {
580 case WPA_SETBAND_5G:
581 rssi_adjust.band = NL80211_BAND_5GHZ;
582 break;
583 case WPA_SETBAND_2G:
584 rssi_adjust.band = NL80211_BAND_2GHZ;
585 break;
586 default:
587 pref_band_set = 0;
588 break;
589 }
590 rssi_adjust.delta = params->relative_adjust_rssi;
591
592 if (pref_band_set &&
593 nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
594 sizeof(rssi_adjust), &rssi_adjust))
595 goto fail;
596 }
597 }
598
599 if (params->sched_scan_start_delay &&
600 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY,
601 params->sched_scan_start_delay))
602 goto fail;
603
604 ret = send_and_recv_msgs(drv, msg, NULL, NULL);
605
606 /* TODO: if we get an error here, we should fall back to normal scan */
607
608 msg = NULL;
609 if (ret) {
610 wpa_printf(MSG_DEBUG, "nl80211: Sched scan start failed: "
611 "ret=%d (%s)", ret, strerror(-ret));
612 goto fail;
613 }
614
615 wpa_printf(MSG_DEBUG, "nl80211: Sched scan requested (ret=%d)", ret);
616
617 fail:
618 nlmsg_free(msg);
619 return ret;
620 }
621
622
623 /**
624 * wpa_driver_nl80211_stop_sched_scan - Stop a scheduled scan
625 * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
626 * Returns: 0 on success, -1 on failure or if not supported
627 */
wpa_driver_nl80211_stop_sched_scan(void * priv)628 int wpa_driver_nl80211_stop_sched_scan(void *priv)
629 {
630 struct i802_bss *bss = priv;
631 struct wpa_driver_nl80211_data *drv = bss->drv;
632 int ret;
633 struct nl_msg *msg;
634
635 #ifdef ANDROID
636 if (!drv->capa.sched_scan_supported)
637 return android_pno_stop(bss);
638 #endif /* ANDROID */
639
640 msg = nl80211_drv_msg(drv, 0, NL80211_CMD_STOP_SCHED_SCAN);
641 ret = send_and_recv_msgs(drv, msg, NULL, NULL);
642 if (ret) {
643 wpa_printf(MSG_DEBUG,
644 "nl80211: Sched scan stop failed: ret=%d (%s)",
645 ret, strerror(-ret));
646 } else {
647 wpa_printf(MSG_DEBUG,
648 "nl80211: Sched scan stop sent");
649 }
650
651 return ret;
652 }
653
654
nl80211_scan_filtered(struct wpa_driver_nl80211_data * drv,const u8 * ie,size_t ie_len)655 static int nl80211_scan_filtered(struct wpa_driver_nl80211_data *drv,
656 const u8 *ie, size_t ie_len)
657 {
658 const u8 *ssid;
659 size_t i;
660
661 if (drv->filter_ssids == NULL)
662 return 0;
663
664 ssid = get_ie(ie, ie_len, WLAN_EID_SSID);
665 if (ssid == NULL)
666 return 1;
667
668 for (i = 0; i < drv->num_filter_ssids; i++) {
669 if (ssid[1] == drv->filter_ssids[i].ssid_len &&
670 os_memcmp(ssid + 2, drv->filter_ssids[i].ssid, ssid[1]) ==
671 0)
672 return 0;
673 }
674
675 return 1;
676 }
677
678
679 static struct wpa_scan_res *
nl80211_parse_bss_info(struct wpa_driver_nl80211_data * drv,struct nl_msg * msg)680 nl80211_parse_bss_info(struct wpa_driver_nl80211_data *drv,
681 struct nl_msg *msg)
682 {
683 struct nlattr *tb[NL80211_ATTR_MAX + 1];
684 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
685 struct nlattr *bss[NL80211_BSS_MAX + 1];
686 static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = {
687 [NL80211_BSS_BSSID] = { .type = NLA_UNSPEC },
688 [NL80211_BSS_FREQUENCY] = { .type = NLA_U32 },
689 [NL80211_BSS_TSF] = { .type = NLA_U64 },
690 [NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 },
691 [NL80211_BSS_CAPABILITY] = { .type = NLA_U16 },
692 [NL80211_BSS_INFORMATION_ELEMENTS] = { .type = NLA_UNSPEC },
693 [NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 },
694 [NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 },
695 [NL80211_BSS_STATUS] = { .type = NLA_U32 },
696 [NL80211_BSS_SEEN_MS_AGO] = { .type = NLA_U32 },
697 [NL80211_BSS_BEACON_IES] = { .type = NLA_UNSPEC },
698 [NL80211_BSS_PARENT_TSF] = { .type = NLA_U64 },
699 [NL80211_BSS_PARENT_BSSID] = { .type = NLA_UNSPEC },
700 [NL80211_BSS_LAST_SEEN_BOOTTIME] = { .type = NLA_U64 },
701 };
702 struct wpa_scan_res *r;
703 const u8 *ie, *beacon_ie;
704 size_t ie_len, beacon_ie_len;
705 u8 *pos;
706
707 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
708 genlmsg_attrlen(gnlh, 0), NULL);
709 if (!tb[NL80211_ATTR_BSS])
710 return NULL;
711 if (nla_parse_nested(bss, NL80211_BSS_MAX, tb[NL80211_ATTR_BSS],
712 bss_policy))
713 return NULL;
714 if (bss[NL80211_BSS_INFORMATION_ELEMENTS]) {
715 ie = nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
716 ie_len = nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
717 } else {
718 ie = NULL;
719 ie_len = 0;
720 }
721 if (bss[NL80211_BSS_BEACON_IES]) {
722 beacon_ie = nla_data(bss[NL80211_BSS_BEACON_IES]);
723 beacon_ie_len = nla_len(bss[NL80211_BSS_BEACON_IES]);
724 } else {
725 beacon_ie = NULL;
726 beacon_ie_len = 0;
727 }
728
729 if (nl80211_scan_filtered(drv, ie ? ie : beacon_ie,
730 ie ? ie_len : beacon_ie_len))
731 return NULL;
732
733 r = os_zalloc(sizeof(*r) + ie_len + beacon_ie_len);
734 if (r == NULL)
735 return NULL;
736 if (bss[NL80211_BSS_BSSID])
737 os_memcpy(r->bssid, nla_data(bss[NL80211_BSS_BSSID]),
738 ETH_ALEN);
739 if (bss[NL80211_BSS_FREQUENCY])
740 r->freq = nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
741 if (bss[NL80211_BSS_BEACON_INTERVAL])
742 r->beacon_int = nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]);
743 if (bss[NL80211_BSS_CAPABILITY])
744 r->caps = nla_get_u16(bss[NL80211_BSS_CAPABILITY]);
745 r->flags |= WPA_SCAN_NOISE_INVALID;
746 if (bss[NL80211_BSS_SIGNAL_MBM]) {
747 r->level = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]);
748 r->level /= 100; /* mBm to dBm */
749 r->flags |= WPA_SCAN_LEVEL_DBM | WPA_SCAN_QUAL_INVALID;
750 } else if (bss[NL80211_BSS_SIGNAL_UNSPEC]) {
751 r->level = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]);
752 r->flags |= WPA_SCAN_QUAL_INVALID;
753 } else
754 r->flags |= WPA_SCAN_LEVEL_INVALID | WPA_SCAN_QUAL_INVALID;
755 if (bss[NL80211_BSS_TSF])
756 r->tsf = nla_get_u64(bss[NL80211_BSS_TSF]);
757 if (bss[NL80211_BSS_BEACON_TSF]) {
758 u64 tsf = nla_get_u64(bss[NL80211_BSS_BEACON_TSF]);
759 if (tsf > r->tsf)
760 r->tsf = tsf;
761 }
762 if (bss[NL80211_BSS_SEEN_MS_AGO])
763 r->age = nla_get_u32(bss[NL80211_BSS_SEEN_MS_AGO]);
764 if (bss[NL80211_BSS_LAST_SEEN_BOOTTIME]) {
765 u64 boottime;
766 struct timespec ts;
767
768 #ifndef CLOCK_BOOTTIME
769 #define CLOCK_BOOTTIME 7
770 #endif
771 if (clock_gettime(CLOCK_BOOTTIME, &ts) == 0) {
772 /* Use more accurate boottime information to update the
773 * scan result age since the driver reports this and
774 * CLOCK_BOOTTIME is available. */
775 boottime = nla_get_u64(
776 bss[NL80211_BSS_LAST_SEEN_BOOTTIME]);
777 r->age = ((u64) ts.tv_sec * 1000000000 +
778 ts.tv_nsec - boottime) / 1000000;
779 }
780 }
781 r->ie_len = ie_len;
782 pos = (u8 *) (r + 1);
783 if (ie) {
784 os_memcpy(pos, ie, ie_len);
785 pos += ie_len;
786 }
787 r->beacon_ie_len = beacon_ie_len;
788 if (beacon_ie)
789 os_memcpy(pos, beacon_ie, beacon_ie_len);
790
791 if (bss[NL80211_BSS_STATUS]) {
792 enum nl80211_bss_status status;
793 status = nla_get_u32(bss[NL80211_BSS_STATUS]);
794 switch (status) {
795 case NL80211_BSS_STATUS_ASSOCIATED:
796 r->flags |= WPA_SCAN_ASSOCIATED;
797 break;
798 default:
799 break;
800 }
801 }
802
803 if (bss[NL80211_BSS_PARENT_TSF] && bss[NL80211_BSS_PARENT_BSSID]) {
804 r->parent_tsf = nla_get_u64(bss[NL80211_BSS_PARENT_TSF]);
805 os_memcpy(r->tsf_bssid, nla_data(bss[NL80211_BSS_PARENT_BSSID]),
806 ETH_ALEN);
807 }
808
809 return r;
810 }
811
812
813 struct nl80211_bss_info_arg {
814 struct wpa_driver_nl80211_data *drv;
815 struct wpa_scan_results *res;
816 };
817
bss_info_handler(struct nl_msg * msg,void * arg)818 static int bss_info_handler(struct nl_msg *msg, void *arg)
819 {
820 struct nl80211_bss_info_arg *_arg = arg;
821 struct wpa_scan_results *res = _arg->res;
822 struct wpa_scan_res **tmp;
823 struct wpa_scan_res *r;
824
825 r = nl80211_parse_bss_info(_arg->drv, msg);
826 if (!r)
827 return NL_SKIP;
828
829 if (!res) {
830 os_free(r);
831 return NL_SKIP;
832 }
833 tmp = os_realloc_array(res->res, res->num + 1,
834 sizeof(struct wpa_scan_res *));
835 if (tmp == NULL) {
836 os_free(r);
837 return NL_SKIP;
838 }
839 tmp[res->num++] = r;
840 res->res = tmp;
841
842 return NL_SKIP;
843 }
844
845
clear_state_mismatch(struct wpa_driver_nl80211_data * drv,const u8 * addr)846 static void clear_state_mismatch(struct wpa_driver_nl80211_data *drv,
847 const u8 *addr)
848 {
849 if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) {
850 wpa_printf(MSG_DEBUG, "nl80211: Clear possible state "
851 "mismatch (" MACSTR ")", MAC2STR(addr));
852 wpa_driver_nl80211_mlme(drv, addr,
853 NL80211_CMD_DEAUTHENTICATE,
854 WLAN_REASON_PREV_AUTH_NOT_VALID, 1);
855 }
856 }
857
858
nl80211_check_bss_status(struct wpa_driver_nl80211_data * drv,struct wpa_scan_res * r)859 static void nl80211_check_bss_status(struct wpa_driver_nl80211_data *drv,
860 struct wpa_scan_res *r)
861 {
862 if (!(r->flags & WPA_SCAN_ASSOCIATED))
863 return;
864
865 wpa_printf(MSG_DEBUG, "nl80211: Scan results indicate BSS status with "
866 MACSTR " as associated", MAC2STR(r->bssid));
867 if (is_sta_interface(drv->nlmode) && !drv->associated) {
868 wpa_printf(MSG_DEBUG,
869 "nl80211: Local state (not associated) does not match with BSS state");
870 clear_state_mismatch(drv, r->bssid);
871 } else if (is_sta_interface(drv->nlmode) &&
872 os_memcmp(drv->bssid, r->bssid, ETH_ALEN) != 0) {
873 wpa_printf(MSG_DEBUG,
874 "nl80211: Local state (associated with " MACSTR
875 ") does not match with BSS state",
876 MAC2STR(drv->bssid));
877 clear_state_mismatch(drv, r->bssid);
878 clear_state_mismatch(drv, drv->bssid);
879 }
880 }
881
882
wpa_driver_nl80211_check_bss_status(struct wpa_driver_nl80211_data * drv,struct wpa_scan_results * res)883 static void wpa_driver_nl80211_check_bss_status(
884 struct wpa_driver_nl80211_data *drv, struct wpa_scan_results *res)
885 {
886 size_t i;
887
888 for (i = 0; i < res->num; i++)
889 nl80211_check_bss_status(drv, res->res[i]);
890 }
891
892
nl80211_update_scan_res_noise(struct wpa_scan_res * res,struct nl80211_noise_info * info)893 static void nl80211_update_scan_res_noise(struct wpa_scan_res *res,
894 struct nl80211_noise_info *info)
895 {
896 unsigned int i;
897
898 for (i = 0; res && i < info->count; i++) {
899 if ((int) info->freq[i] != res->freq ||
900 !(res->flags & WPA_SCAN_NOISE_INVALID))
901 continue;
902 res->noise = info->noise[i];
903 res->flags &= ~WPA_SCAN_NOISE_INVALID;
904 }
905 }
906
907
908 static struct wpa_scan_results *
nl80211_get_scan_results(struct wpa_driver_nl80211_data * drv)909 nl80211_get_scan_results(struct wpa_driver_nl80211_data *drv)
910 {
911 struct nl_msg *msg;
912 struct wpa_scan_results *res;
913 int ret;
914 struct nl80211_bss_info_arg arg;
915
916 res = os_zalloc(sizeof(*res));
917 if (res == NULL)
918 return NULL;
919 if (!(msg = nl80211_cmd_msg(drv->first_bss, NLM_F_DUMP,
920 NL80211_CMD_GET_SCAN))) {
921 wpa_scan_results_free(res);
922 return NULL;
923 }
924
925 arg.drv = drv;
926 arg.res = res;
927 ret = send_and_recv_msgs(drv, msg, bss_info_handler, &arg);
928 if (ret == 0) {
929 struct nl80211_noise_info info;
930
931 wpa_printf(MSG_DEBUG, "nl80211: Received scan results (%lu "
932 "BSSes)", (unsigned long) res->num);
933 if (nl80211_get_noise_for_scan_results(drv, &info) == 0) {
934 size_t i;
935
936 for (i = 0; i < res->num; ++i)
937 nl80211_update_scan_res_noise(res->res[i],
938 &info);
939 }
940 return res;
941 }
942 wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d "
943 "(%s)", ret, strerror(-ret));
944 wpa_scan_results_free(res);
945 return NULL;
946 }
947
948
949 /**
950 * wpa_driver_nl80211_get_scan_results - Fetch the latest scan results
951 * @priv: Pointer to private wext data from wpa_driver_nl80211_init()
952 * Returns: Scan results on success, -1 on failure
953 */
wpa_driver_nl80211_get_scan_results(void * priv)954 struct wpa_scan_results * wpa_driver_nl80211_get_scan_results(void *priv)
955 {
956 struct i802_bss *bss = priv;
957 struct wpa_driver_nl80211_data *drv = bss->drv;
958 struct wpa_scan_results *res;
959
960 res = nl80211_get_scan_results(drv);
961 if (res)
962 wpa_driver_nl80211_check_bss_status(drv, res);
963 return res;
964 }
965
966
967 struct nl80211_dump_scan_ctx {
968 struct wpa_driver_nl80211_data *drv;
969 int idx;
970 };
971
nl80211_dump_scan_handler(struct nl_msg * msg,void * arg)972 static int nl80211_dump_scan_handler(struct nl_msg *msg, void *arg)
973 {
974 struct nl80211_dump_scan_ctx *ctx = arg;
975 struct wpa_scan_res *r;
976
977 r = nl80211_parse_bss_info(ctx->drv, msg);
978 if (!r)
979 return NL_SKIP;
980 wpa_printf(MSG_DEBUG, "nl80211: %d " MACSTR " %d%s",
981 ctx->idx, MAC2STR(r->bssid), r->freq,
982 r->flags & WPA_SCAN_ASSOCIATED ? " [assoc]" : "");
983 ctx->idx++;
984 os_free(r);
985 return NL_SKIP;
986 }
987
988
nl80211_dump_scan(struct wpa_driver_nl80211_data * drv)989 void nl80211_dump_scan(struct wpa_driver_nl80211_data *drv)
990 {
991 struct nl_msg *msg;
992 struct nl80211_dump_scan_ctx ctx;
993
994 wpa_printf(MSG_DEBUG, "nl80211: Scan result dump");
995 ctx.drv = drv;
996 ctx.idx = 0;
997 msg = nl80211_cmd_msg(drv->first_bss, NLM_F_DUMP, NL80211_CMD_GET_SCAN);
998 if (msg)
999 send_and_recv_msgs(drv, msg, nl80211_dump_scan_handler, &ctx);
1000 }
1001
1002
wpa_driver_nl80211_abort_scan(void * priv,u64 scan_cookie)1003 int wpa_driver_nl80211_abort_scan(void *priv, u64 scan_cookie)
1004 {
1005 struct i802_bss *bss = priv;
1006 #ifdef CONFIG_DRIVER_NL80211_QCA
1007 struct wpa_driver_nl80211_data *drv = bss->drv;
1008
1009 /*
1010 * If scan_cookie is zero, a normal scan through kernel (cfg80211)
1011 * was triggered, hence abort the cfg80211 scan instead of the vendor
1012 * scan.
1013 */
1014 if (drv->scan_vendor_cmd_avail && scan_cookie)
1015 return nl80211_abort_vendor_scan(drv, scan_cookie);
1016 #endif /* CONFIG_DRIVER_NL80211_QCA */
1017 return nl80211_abort_scan(bss);
1018 }
1019
1020
1021 #ifdef CONFIG_DRIVER_NL80211_QCA
1022
scan_cookie_handler(struct nl_msg * msg,void * arg)1023 static int scan_cookie_handler(struct nl_msg *msg, void *arg)
1024 {
1025 struct nlattr *tb[NL80211_ATTR_MAX + 1];
1026 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1027 u64 *cookie = arg;
1028
1029 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1030 genlmsg_attrlen(gnlh, 0), NULL);
1031
1032 if (tb[NL80211_ATTR_VENDOR_DATA]) {
1033 struct nlattr *nl_vendor = tb[NL80211_ATTR_VENDOR_DATA];
1034 struct nlattr *tb_vendor[QCA_WLAN_VENDOR_ATTR_SCAN_MAX + 1];
1035
1036 nla_parse(tb_vendor, QCA_WLAN_VENDOR_ATTR_SCAN_MAX,
1037 nla_data(nl_vendor), nla_len(nl_vendor), NULL);
1038
1039 if (tb_vendor[QCA_WLAN_VENDOR_ATTR_SCAN_COOKIE])
1040 *cookie = nla_get_u64(
1041 tb_vendor[QCA_WLAN_VENDOR_ATTR_SCAN_COOKIE]);
1042 }
1043
1044 return NL_SKIP;
1045 }
1046
1047
1048 /**
1049 * wpa_driver_nl80211_vendor_scan - Request the driver to initiate a vendor scan
1050 * @bss: Pointer to private driver data from wpa_driver_nl80211_init()
1051 * @params: Scan parameters
1052 * Returns: 0 on success, -1 on failure
1053 */
wpa_driver_nl80211_vendor_scan(struct i802_bss * bss,struct wpa_driver_scan_params * params)1054 int wpa_driver_nl80211_vendor_scan(struct i802_bss *bss,
1055 struct wpa_driver_scan_params *params)
1056 {
1057 struct wpa_driver_nl80211_data *drv = bss->drv;
1058 struct nl_msg *msg = NULL;
1059 struct nlattr *attr;
1060 size_t i;
1061 u32 scan_flags = 0;
1062 int ret = -1;
1063 u64 cookie = 0;
1064
1065 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: vendor scan request");
1066 drv->scan_for_auth = 0;
1067
1068 if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
1069 nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
1070 nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
1071 QCA_NL80211_VENDOR_SUBCMD_TRIGGER_SCAN) )
1072 goto fail;
1073
1074 attr = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1075 if (attr == NULL)
1076 goto fail;
1077
1078 if (params->num_ssids) {
1079 struct nlattr *ssids;
1080
1081 ssids = nla_nest_start(msg, QCA_WLAN_VENDOR_ATTR_SCAN_SSIDS);
1082 if (ssids == NULL)
1083 goto fail;
1084 for (i = 0; i < params->num_ssids; i++) {
1085 wpa_hexdump_ascii(MSG_MSGDUMP, "nl80211: Scan SSID",
1086 params->ssids[i].ssid,
1087 params->ssids[i].ssid_len);
1088 if (nla_put(msg, i + 1, params->ssids[i].ssid_len,
1089 params->ssids[i].ssid))
1090 goto fail;
1091 }
1092 nla_nest_end(msg, ssids);
1093 }
1094
1095 if (params->extra_ies) {
1096 wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan extra IEs",
1097 params->extra_ies, params->extra_ies_len);
1098 if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_SCAN_IE,
1099 params->extra_ies_len, params->extra_ies))
1100 goto fail;
1101 }
1102
1103 if (params->freqs) {
1104 struct nlattr *freqs;
1105
1106 freqs = nla_nest_start(msg,
1107 QCA_WLAN_VENDOR_ATTR_SCAN_FREQUENCIES);
1108 if (freqs == NULL)
1109 goto fail;
1110 for (i = 0; params->freqs[i]; i++) {
1111 wpa_printf(MSG_MSGDUMP,
1112 "nl80211: Scan frequency %u MHz",
1113 params->freqs[i]);
1114 if (nla_put_u32(msg, i + 1, params->freqs[i]))
1115 goto fail;
1116 }
1117 nla_nest_end(msg, freqs);
1118 }
1119
1120 os_free(drv->filter_ssids);
1121 drv->filter_ssids = params->filter_ssids;
1122 params->filter_ssids = NULL;
1123 drv->num_filter_ssids = params->num_filter_ssids;
1124
1125 if (params->low_priority && drv->have_low_prio_scan) {
1126 wpa_printf(MSG_DEBUG,
1127 "nl80211: Add NL80211_SCAN_FLAG_LOW_PRIORITY");
1128 scan_flags |= NL80211_SCAN_FLAG_LOW_PRIORITY;
1129 }
1130
1131 if (params->mac_addr_rand) {
1132 wpa_printf(MSG_DEBUG,
1133 "nl80211: Add NL80211_SCAN_FLAG_RANDOM_ADDR");
1134 scan_flags |= NL80211_SCAN_FLAG_RANDOM_ADDR;
1135
1136 if (params->mac_addr) {
1137 wpa_printf(MSG_DEBUG, "nl80211: MAC address: " MACSTR,
1138 MAC2STR(params->mac_addr));
1139 if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_SCAN_MAC,
1140 ETH_ALEN, params->mac_addr))
1141 goto fail;
1142 }
1143
1144 if (params->mac_addr_mask) {
1145 wpa_printf(MSG_DEBUG, "nl80211: MAC address mask: "
1146 MACSTR, MAC2STR(params->mac_addr_mask));
1147 if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_SCAN_MAC_MASK,
1148 ETH_ALEN, params->mac_addr_mask))
1149 goto fail;
1150 }
1151 }
1152
1153 if (scan_flags &&
1154 nla_put_u32(msg, QCA_WLAN_VENDOR_ATTR_SCAN_FLAGS, scan_flags))
1155 goto fail;
1156
1157 if (params->p2p_probe) {
1158 struct nlattr *rates;
1159
1160 wpa_printf(MSG_DEBUG, "nl80211: P2P probe - mask SuppRates");
1161
1162 rates = nla_nest_start(msg,
1163 QCA_WLAN_VENDOR_ATTR_SCAN_SUPP_RATES);
1164 if (rates == NULL)
1165 goto fail;
1166
1167 /*
1168 * Remove 2.4 GHz rates 1, 2, 5.5, 11 Mbps from supported rates
1169 * by masking out everything else apart from the OFDM rates 6,
1170 * 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS rates. All 5 GHz
1171 * rates are left enabled.
1172 */
1173 if (nla_put(msg, NL80211_BAND_2GHZ, 8,
1174 "\x0c\x12\x18\x24\x30\x48\x60\x6c"))
1175 goto fail;
1176 nla_nest_end(msg, rates);
1177
1178 if (nla_put_flag(msg, QCA_WLAN_VENDOR_ATTR_SCAN_TX_NO_CCK_RATE))
1179 goto fail;
1180 }
1181
1182 if (params->bssid) {
1183 wpa_printf(MSG_DEBUG, "nl80211: Scan for a specific BSSID: "
1184 MACSTR, MAC2STR(params->bssid));
1185 if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_SCAN_BSSID, ETH_ALEN,
1186 params->bssid))
1187 goto fail;
1188 }
1189
1190 nla_nest_end(msg, attr);
1191
1192 ret = send_and_recv_msgs(drv, msg, scan_cookie_handler, &cookie);
1193 msg = NULL;
1194 if (ret) {
1195 wpa_printf(MSG_DEBUG,
1196 "nl80211: Vendor scan trigger failed: ret=%d (%s)",
1197 ret, strerror(-ret));
1198 goto fail;
1199 }
1200
1201 drv->vendor_scan_cookie = cookie;
1202 drv->scan_state = SCAN_REQUESTED;
1203 /* Pass the cookie to the caller to help distinguish the scans. */
1204 params->scan_cookie = cookie;
1205
1206 wpa_printf(MSG_DEBUG,
1207 "nl80211: Vendor scan requested (ret=%d) - scan timeout 30 seconds, scan cookie:0x%llx",
1208 ret, (long long unsigned int) cookie);
1209 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
1210 eloop_register_timeout(30, 0, wpa_driver_nl80211_scan_timeout,
1211 drv, drv->ctx);
1212 drv->last_scan_cmd = NL80211_CMD_VENDOR;
1213
1214 fail:
1215 nlmsg_free(msg);
1216 return ret;
1217 }
1218
1219
1220 /**
1221 * nl80211_set_default_scan_ies - Set the scan default IEs to the driver
1222 * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
1223 * @ies: Pointer to IEs buffer
1224 * @ies_len: Length of IEs in bytes
1225 * Returns: 0 on success, -1 on failure
1226 */
nl80211_set_default_scan_ies(void * priv,const u8 * ies,size_t ies_len)1227 int nl80211_set_default_scan_ies(void *priv, const u8 *ies, size_t ies_len)
1228 {
1229 struct i802_bss *bss = priv;
1230 struct wpa_driver_nl80211_data *drv = bss->drv;
1231 struct nl_msg *msg = NULL;
1232 struct nlattr *attr;
1233 int ret = -1;
1234
1235 if (!drv->set_wifi_conf_vendor_cmd_avail)
1236 return -1;
1237
1238 if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
1239 nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
1240 nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
1241 QCA_NL80211_VENDOR_SUBCMD_SET_WIFI_CONFIGURATION))
1242 goto fail;
1243
1244 attr = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1245 if (attr == NULL)
1246 goto fail;
1247
1248 wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan default IEs", ies, ies_len);
1249 if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_CONFIG_SCAN_DEFAULT_IES,
1250 ies_len, ies))
1251 goto fail;
1252
1253 nla_nest_end(msg, attr);
1254
1255 ret = send_and_recv_msgs(drv, msg, NULL, NULL);
1256 msg = NULL;
1257 if (ret) {
1258 wpa_printf(MSG_ERROR,
1259 "nl80211: Set scan default IEs failed: ret=%d (%s)",
1260 ret, strerror(-ret));
1261 goto fail;
1262 }
1263
1264 fail:
1265 nlmsg_free(msg);
1266 return ret;
1267 }
1268
1269 #endif /* CONFIG_DRIVER_NL80211_QCA */
1270