1 /*
2 * Driver interaction with Linux nl80211/cfg80211 - Scanning
3 * Copyright(c) 2015 Intel Deutschland GmbH
4 * Copyright (c) 2002-2014, Jouni Malinen <j@w1.fi>
5 * Copyright (c) 2007, Johannes Berg <johannes@sipsolutions.net>
6 * Copyright (c) 2009-2010, Atheros Communications
7 *
8 * This software may be distributed under the terms of the BSD license.
9 * See README for more details.
10 */
11
12 #include "includes.h"
13 #include <time.h>
14 #include <netlink/genl/genl.h>
15
16 #include "utils/common.h"
17 #include "utils/eloop.h"
18 #include "common/ieee802_11_defs.h"
19 #include "common/ieee802_11_common.h"
20 #include "common/qca-vendor.h"
21 #include "driver_nl80211.h"
22
23
24 #define MAX_NL80211_NOISE_FREQS 100
25
26 struct nl80211_noise_info {
27 u32 freq[MAX_NL80211_NOISE_FREQS];
28 s8 noise[MAX_NL80211_NOISE_FREQS];
29 unsigned int count;
30 };
31
get_noise_for_scan_results(struct nl_msg * msg,void * arg)32 static int get_noise_for_scan_results(struct nl_msg *msg, void *arg)
33 {
34 struct nlattr *tb[NL80211_ATTR_MAX + 1];
35 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
36 struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
37 static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
38 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
39 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
40 };
41 struct nl80211_noise_info *info = arg;
42
43 if (info->count >= MAX_NL80211_NOISE_FREQS)
44 return NL_SKIP;
45
46 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
47 genlmsg_attrlen(gnlh, 0), NULL);
48
49 if (!tb[NL80211_ATTR_SURVEY_INFO]) {
50 wpa_printf(MSG_DEBUG, "nl80211: Survey data missing");
51 return NL_SKIP;
52 }
53
54 if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
55 tb[NL80211_ATTR_SURVEY_INFO],
56 survey_policy)) {
57 wpa_printf(MSG_DEBUG, "nl80211: Failed to parse nested "
58 "attributes");
59 return NL_SKIP;
60 }
61
62 if (!sinfo[NL80211_SURVEY_INFO_NOISE])
63 return NL_SKIP;
64
65 if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY])
66 return NL_SKIP;
67
68 info->freq[info->count] =
69 nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]);
70 info->noise[info->count] =
71 (s8) nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
72 info->count++;
73
74 return NL_SKIP;
75 }
76
77
nl80211_get_noise_for_scan_results(struct wpa_driver_nl80211_data * drv,struct nl80211_noise_info * info)78 static int nl80211_get_noise_for_scan_results(
79 struct wpa_driver_nl80211_data *drv, struct nl80211_noise_info *info)
80 {
81 struct nl_msg *msg;
82
83 os_memset(info, 0, sizeof(*info));
84 msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_GET_SURVEY);
85 return send_and_recv_resp(drv, msg, get_noise_for_scan_results, info);
86 }
87
88
nl80211_abort_scan(struct i802_bss * bss)89 static int nl80211_abort_scan(struct i802_bss *bss)
90 {
91 int ret;
92 struct nl_msg *msg;
93 struct wpa_driver_nl80211_data *drv = bss->drv;
94
95 wpa_printf(MSG_DEBUG, "nl80211: Abort scan");
96 msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_ABORT_SCAN);
97 ret = send_and_recv_cmd(drv, msg);
98 if (ret) {
99 wpa_printf(MSG_DEBUG, "nl80211: Abort scan failed: ret=%d (%s)",
100 ret, strerror(-ret));
101 }
102 return ret;
103 }
104
105
106 #ifdef CONFIG_DRIVER_NL80211_QCA
nl80211_abort_vendor_scan(struct wpa_driver_nl80211_data * drv,u64 scan_cookie)107 static int nl80211_abort_vendor_scan(struct wpa_driver_nl80211_data *drv,
108 u64 scan_cookie)
109 {
110 struct nl_msg *msg;
111 struct nlattr *params;
112 int ret;
113
114 wpa_printf(MSG_DEBUG, "nl80211: Abort vendor scan with cookie 0x%llx",
115 (long long unsigned int) scan_cookie);
116
117 msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR);
118 if (!msg ||
119 nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
120 nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
121 QCA_NL80211_VENDOR_SUBCMD_ABORT_SCAN) ||
122 !(params = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) ||
123 nla_put_u64(msg, QCA_WLAN_VENDOR_ATTR_SCAN_COOKIE, scan_cookie))
124 goto fail;
125
126 nla_nest_end(msg, params);
127
128 ret = send_and_recv_cmd(drv, msg);
129 msg = NULL;
130 if (ret) {
131 wpa_printf(MSG_INFO,
132 "nl80211: Aborting vendor scan with cookie 0x%llx failed: ret=%d (%s)",
133 (long long unsigned int) scan_cookie, ret,
134 strerror(-ret));
135 goto fail;
136 }
137 return 0;
138 fail:
139 nlmsg_free(msg);
140 return -1;
141 }
142 #endif /* CONFIG_DRIVER_NL80211_QCA */
143
144
145 /**
146 * wpa_driver_nl80211_scan_timeout - Scan timeout to report scan completion
147 * @eloop_ctx: Driver private data
148 * @timeout_ctx: ctx argument given to wpa_driver_nl80211_init()
149 *
150 * This function can be used as registered timeout when starting a scan to
151 * generate a scan completed event if the driver does not report this.
152 */
wpa_driver_nl80211_scan_timeout(void * eloop_ctx,void * timeout_ctx)153 void wpa_driver_nl80211_scan_timeout(void *eloop_ctx, void *timeout_ctx)
154 {
155 struct wpa_driver_nl80211_data *drv = eloop_ctx;
156
157 wpa_printf(MSG_DEBUG, "nl80211: Scan timeout - try to abort it");
158 #ifdef CONFIG_DRIVER_NL80211_QCA
159 if (drv->vendor_scan_cookie &&
160 nl80211_abort_vendor_scan(drv, drv->vendor_scan_cookie) == 0)
161 return;
162 #endif /* CONFIG_DRIVER_NL80211_QCA */
163 if (!drv->vendor_scan_cookie &&
164 nl80211_abort_scan(drv->first_bss) == 0)
165 return;
166
167 wpa_printf(MSG_DEBUG, "nl80211: Failed to abort scan");
168
169 if (drv->ap_scan_as_station != NL80211_IFTYPE_UNSPECIFIED)
170 nl80211_restore_ap_mode(drv->first_bss);
171
172 wpa_printf(MSG_DEBUG, "nl80211: Try to get scan results");
173 wpa_supplicant_event(timeout_ctx, EVENT_SCAN_RESULTS, NULL);
174 }
175
176
177 static struct nl_msg *
nl80211_scan_common(struct i802_bss * bss,u8 cmd,struct wpa_driver_scan_params * params)178 nl80211_scan_common(struct i802_bss *bss, u8 cmd,
179 struct wpa_driver_scan_params *params)
180 {
181 struct wpa_driver_nl80211_data *drv = bss->drv;
182 struct nl_msg *msg;
183 size_t i;
184 u32 scan_flags = 0;
185
186 msg = nl80211_cmd_msg(bss, 0, cmd);
187 if (!msg)
188 return NULL;
189
190 if (params->num_ssids) {
191 struct nlattr *ssids;
192
193 ssids = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
194 if (ssids == NULL)
195 goto fail;
196 for (i = 0; i < params->num_ssids; i++) {
197 wpa_printf(MSG_MSGDUMP, "nl80211: Scan SSID %s",
198 wpa_ssid_txt(params->ssids[i].ssid,
199 params->ssids[i].ssid_len));
200 if (nla_put(msg, i + 1, params->ssids[i].ssid_len,
201 params->ssids[i].ssid))
202 goto fail;
203 }
204 nla_nest_end(msg, ssids);
205
206 /*
207 * If allowed, scan for 6 GHz APs that are reported by other
208 * APs. Note that if the flag is not set and 6 GHz channels are
209 * to be scanned, it is highly likely that non-PSC channels
210 * would be scanned passively (due to the Probe Request frame
211 * transmission restrictions mandated in IEEE Std 802.11ax-2021,
212 * 26.17.2.3 (Scanning in the 6 GHz band). Passive scanning of
213 * all non-PSC channels would take a significant amount of time.
214 */
215 if (!params->non_coloc_6ghz) {
216 wpa_printf(MSG_DEBUG,
217 "nl80211: Scan co-located APs on 6 GHz");
218 scan_flags |= NL80211_SCAN_FLAG_COLOCATED_6GHZ;
219 }
220 } else {
221 wpa_printf(MSG_DEBUG, "nl80211: Passive scan requested");
222 }
223
224 if (params->extra_ies) {
225 wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan extra IEs",
226 params->extra_ies, params->extra_ies_len);
227 if (nla_put(msg, NL80211_ATTR_IE, params->extra_ies_len,
228 params->extra_ies))
229 goto fail;
230 }
231
232 if (params->freqs) {
233 struct nlattr *freqs;
234 freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
235 if (freqs == NULL)
236 goto fail;
237 for (i = 0; params->freqs[i]; i++) {
238 wpa_printf(MSG_MSGDUMP, "nl80211: Scan frequency %u "
239 "MHz", params->freqs[i]);
240 if (nla_put_u32(msg, i + 1, params->freqs[i]))
241 goto fail;
242 }
243 nla_nest_end(msg, freqs);
244 }
245
246 os_free(drv->filter_ssids);
247 drv->filter_ssids = params->filter_ssids;
248 params->filter_ssids = NULL;
249 drv->num_filter_ssids = params->num_filter_ssids;
250
251 if (!drv->hostapd && is_ap_interface(drv->nlmode)) {
252 wpa_printf(MSG_DEBUG, "nl80211: Add NL80211_SCAN_FLAG_AP");
253 scan_flags |= NL80211_SCAN_FLAG_AP;
254 }
255
256 if (params->only_new_results) {
257 wpa_printf(MSG_DEBUG, "nl80211: Add NL80211_SCAN_FLAG_FLUSH");
258 scan_flags |= NL80211_SCAN_FLAG_FLUSH;
259 }
260
261 if (params->low_priority && drv->have_low_prio_scan) {
262 wpa_printf(MSG_DEBUG,
263 "nl80211: Add NL80211_SCAN_FLAG_LOW_PRIORITY");
264 scan_flags |= NL80211_SCAN_FLAG_LOW_PRIORITY;
265 }
266
267 if (params->mac_addr_rand) {
268 wpa_printf(MSG_DEBUG,
269 "nl80211: Add NL80211_SCAN_FLAG_RANDOM_ADDR");
270 scan_flags |= NL80211_SCAN_FLAG_RANDOM_ADDR;
271
272 if (params->mac_addr) {
273 wpa_printf(MSG_DEBUG, "nl80211: MAC address: " MACSTR,
274 MAC2STR(params->mac_addr));
275 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
276 params->mac_addr))
277 goto fail;
278 }
279
280 if (params->mac_addr_mask) {
281 wpa_printf(MSG_DEBUG, "nl80211: MAC address mask: "
282 MACSTR, MAC2STR(params->mac_addr_mask));
283 if (nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN,
284 params->mac_addr_mask))
285 goto fail;
286 }
287 }
288
289 if (params->duration) {
290 if (!(drv->capa.rrm_flags &
291 WPA_DRIVER_FLAGS_SUPPORT_SET_SCAN_DWELL) ||
292 nla_put_u16(msg, NL80211_ATTR_MEASUREMENT_DURATION,
293 params->duration))
294 goto fail;
295
296 if (params->duration_mandatory &&
297 nla_put_flag(msg,
298 NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY))
299 goto fail;
300 }
301
302 if (params->oce_scan) {
303 wpa_printf(MSG_DEBUG,
304 "nl80211: Add NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME");
305 wpa_printf(MSG_DEBUG,
306 "nl80211: Add NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP");
307 wpa_printf(MSG_DEBUG,
308 "nl80211: Add NL80211_SCAN_FLAG_OCE_PROBE_REQ_MIN_TX_RATE");
309 wpa_printf(MSG_DEBUG,
310 "nl80211: Add NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION");
311 scan_flags |= NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME |
312 NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP |
313 NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE |
314 NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION;
315 }
316
317 if (params->min_probe_req_content) {
318 if (drv->capa.flags2 & WPA_DRIVER_FLAGS2_SCAN_MIN_PREQ)
319 scan_flags |= NL80211_SCAN_FLAG_MIN_PREQ_CONTENT;
320 else
321 wpa_printf(MSG_DEBUG,
322 "nl80211: NL80211_SCAN_FLAG_MIN_PREQ_CONTENT not supported");
323 }
324
325 if (scan_flags &&
326 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, scan_flags))
327 goto fail;
328
329 return msg;
330
331 fail:
332 nlmsg_free(msg);
333 return NULL;
334 }
335
336
337 /**
338 * wpa_driver_nl80211_scan - Request the driver to initiate scan
339 * @bss: Pointer to private driver data from wpa_driver_nl80211_init()
340 * @params: Scan parameters
341 * Returns: 0 on success, -1 on failure
342 */
wpa_driver_nl80211_scan(struct i802_bss * bss,struct wpa_driver_scan_params * params)343 int wpa_driver_nl80211_scan(struct i802_bss *bss,
344 struct wpa_driver_scan_params *params)
345 {
346 struct wpa_driver_nl80211_data *drv = bss->drv;
347 int ret = -1, timeout;
348 struct nl_msg *msg = NULL;
349
350 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: scan request");
351 drv->scan_for_auth = 0;
352
353 if (TEST_FAIL())
354 return -1;
355
356 msg = nl80211_scan_common(bss, NL80211_CMD_TRIGGER_SCAN, params);
357 if (!msg)
358 return -1;
359
360 if (params->p2p_probe) {
361 struct nlattr *rates;
362
363 wpa_printf(MSG_DEBUG, "nl80211: P2P probe - mask SuppRates");
364
365 rates = nla_nest_start(msg, NL80211_ATTR_SCAN_SUPP_RATES);
366 if (rates == NULL)
367 goto fail;
368
369 /*
370 * Remove 2.4 GHz rates 1, 2, 5.5, 11 Mbps from supported rates
371 * by masking out everything else apart from the OFDM rates 6,
372 * 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS rates. All 5 GHz
373 * rates are left enabled.
374 */
375 if (nla_put(msg, NL80211_BAND_2GHZ, 8,
376 "\x0c\x12\x18\x24\x30\x48\x60\x6c"))
377 goto fail;
378 nla_nest_end(msg, rates);
379
380 if (nla_put_flag(msg, NL80211_ATTR_TX_NO_CCK_RATE))
381 goto fail;
382 }
383
384 if (params->bssid) {
385 wpa_printf(MSG_DEBUG, "nl80211: Scan for a specific BSSID: "
386 MACSTR, MAC2STR(params->bssid));
387 if (nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid))
388 goto fail;
389 /* NL80211_ATTR_MAC was used for this purpose initially and the
390 * NL80211_ATTR_BSSID was added in 2016 when MAC address
391 * randomization was added. For compatibility with older kernel
392 * versions, add the NL80211_ATTR_MAC attribute as well when
393 * the conflicting functionality is not in use. */
394 if (!params->mac_addr_rand &&
395 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid))
396 goto fail;
397 }
398
399 ret = send_and_recv_cmd(drv, msg);
400 msg = NULL;
401 if (ret) {
402 wpa_printf(MSG_DEBUG, "nl80211: Scan trigger failed: ret=%d "
403 "(%s)", ret, strerror(-ret));
404 if (drv->hostapd && is_ap_interface(drv->nlmode)) {
405 /*
406 * mac80211 does not allow scan requests in AP mode, so
407 * try to do this in station mode.
408 */
409 drv->ap_scan_as_station = drv->nlmode;
410 if (wpa_driver_nl80211_set_mode(
411 bss, NL80211_IFTYPE_STATION) ||
412 wpa_driver_nl80211_scan(bss, params)) {
413 nl80211_restore_ap_mode(bss);
414 goto fail;
415 }
416
417 ret = 0;
418 } else
419 goto fail;
420 }
421
422 drv->scan_state = SCAN_REQUESTED;
423 /* Not all drivers generate "scan completed" wireless event, so try to
424 * read results after a timeout. */
425 timeout = drv->uses_6ghz ? 20 : 10;
426 if (drv->uses_s1g)
427 timeout += 5;
428 if (drv->scan_complete_events) {
429 /*
430 * The driver seems to deliver events to notify when scan is
431 * complete, so use longer timeout to avoid race conditions
432 * with scanning and following association request.
433 */
434 timeout = 30;
435 }
436 wpa_printf(MSG_DEBUG, "Scan requested (ret=%d) - scan timeout %d "
437 "seconds", ret, timeout);
438 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
439 eloop_register_timeout(timeout, 0, wpa_driver_nl80211_scan_timeout,
440 drv, drv->ctx);
441 drv->last_scan_cmd = NL80211_CMD_TRIGGER_SCAN;
442
443 fail:
444 nlmsg_free(msg);
445 return ret;
446 }
447
448
449 static int
nl80211_sched_scan_add_scan_plans(struct wpa_driver_nl80211_data * drv,struct nl_msg * msg,struct wpa_driver_scan_params * params)450 nl80211_sched_scan_add_scan_plans(struct wpa_driver_nl80211_data *drv,
451 struct nl_msg *msg,
452 struct wpa_driver_scan_params *params)
453 {
454 struct nlattr *plans;
455 struct sched_scan_plan *scan_plans = params->sched_scan_plans;
456 unsigned int i;
457
458 plans = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
459 if (!plans)
460 return -1;
461
462 for (i = 0; i < params->sched_scan_plans_num; i++) {
463 struct nlattr *plan = nla_nest_start(msg, i + 1);
464
465 if (!plan)
466 return -1;
467
468 if (!scan_plans[i].interval ||
469 scan_plans[i].interval >
470 drv->capa.max_sched_scan_plan_interval) {
471 wpa_printf(MSG_DEBUG,
472 "nl80211: sched scan plan no. %u: Invalid interval: %u",
473 i, scan_plans[i].interval);
474 return -1;
475 }
476
477 if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
478 scan_plans[i].interval))
479 return -1;
480
481 if (scan_plans[i].iterations >
482 drv->capa.max_sched_scan_plan_iterations) {
483 wpa_printf(MSG_DEBUG,
484 "nl80211: sched scan plan no. %u: Invalid number of iterations: %u",
485 i, scan_plans[i].iterations);
486 return -1;
487 }
488
489 if (scan_plans[i].iterations &&
490 nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
491 scan_plans[i].iterations))
492 return -1;
493
494 nla_nest_end(msg, plan);
495
496 /*
497 * All the scan plans must specify the number of iterations
498 * except the last plan, which will run infinitely. So if the
499 * number of iterations is not specified, this ought to be the
500 * last scan plan.
501 */
502 if (!scan_plans[i].iterations)
503 break;
504 }
505
506 if (i != params->sched_scan_plans_num - 1) {
507 wpa_printf(MSG_DEBUG,
508 "nl80211: All sched scan plans but the last must specify number of iterations");
509 return -1;
510 }
511
512 nla_nest_end(msg, plans);
513 return 0;
514 }
515
516
517 /**
518 * wpa_driver_nl80211_sched_scan - Initiate a scheduled scan
519 * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
520 * @params: Scan parameters
521 * Returns: 0 on success, -1 on failure or if not supported
522 */
wpa_driver_nl80211_sched_scan(void * priv,struct wpa_driver_scan_params * params)523 int wpa_driver_nl80211_sched_scan(void *priv,
524 struct wpa_driver_scan_params *params)
525 {
526 struct i802_bss *bss = priv;
527 struct wpa_driver_nl80211_data *drv = bss->drv;
528 int ret = -1;
529 struct nl_msg *msg;
530 size_t i;
531
532 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: sched_scan request");
533
534 #ifdef ANDROID
535 if (!drv->capa.sched_scan_supported)
536 return android_pno_start(bss, params);
537 #endif /* ANDROID */
538
539 if (!params->sched_scan_plans_num ||
540 params->sched_scan_plans_num > drv->capa.max_sched_scan_plans) {
541 wpa_printf(MSG_ERROR,
542 "nl80211: Invalid number of sched scan plans: %u",
543 params->sched_scan_plans_num);
544 return -1;
545 }
546
547 msg = nl80211_scan_common(bss, NL80211_CMD_START_SCHED_SCAN, params);
548 if (!msg)
549 goto fail;
550
551 if (drv->capa.max_sched_scan_plan_iterations) {
552 if (nl80211_sched_scan_add_scan_plans(drv, msg, params))
553 goto fail;
554 } else {
555 if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
556 params->sched_scan_plans[0].interval * 1000))
557 goto fail;
558 }
559
560 if ((drv->num_filter_ssids &&
561 (int) drv->num_filter_ssids <= drv->capa.max_match_sets) ||
562 params->filter_rssi) {
563 struct nlattr *match_sets;
564 match_sets = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
565 if (match_sets == NULL)
566 goto fail;
567
568 for (i = 0; i < drv->num_filter_ssids; i++) {
569 struct nlattr *match_set_ssid;
570 wpa_printf(MSG_MSGDUMP,
571 "nl80211: Sched scan filter SSID %s",
572 wpa_ssid_txt(drv->filter_ssids[i].ssid,
573 drv->filter_ssids[i].ssid_len));
574
575 match_set_ssid = nla_nest_start(msg, i + 1);
576 if (match_set_ssid == NULL ||
577 nla_put(msg, NL80211_ATTR_SCHED_SCAN_MATCH_SSID,
578 drv->filter_ssids[i].ssid_len,
579 drv->filter_ssids[i].ssid) ||
580 (params->filter_rssi &&
581 nla_put_u32(msg,
582 NL80211_SCHED_SCAN_MATCH_ATTR_RSSI,
583 params->filter_rssi)))
584 goto fail;
585
586 nla_nest_end(msg, match_set_ssid);
587 }
588
589 /*
590 * Due to backward compatibility code, newer kernels treat this
591 * matchset (with only an RSSI filter) as the default for all
592 * other matchsets, unless it's the only one, in which case the
593 * matchset will actually allow all SSIDs above the RSSI.
594 */
595 if (params->filter_rssi) {
596 struct nlattr *match_set_rssi;
597 match_set_rssi = nla_nest_start(msg, 0);
598 if (match_set_rssi == NULL ||
599 nla_put_u32(msg, NL80211_SCHED_SCAN_MATCH_ATTR_RSSI,
600 params->filter_rssi))
601 goto fail;
602 wpa_printf(MSG_MSGDUMP,
603 "nl80211: Sched scan RSSI filter %d dBm",
604 params->filter_rssi);
605 nla_nest_end(msg, match_set_rssi);
606 }
607
608 nla_nest_end(msg, match_sets);
609 }
610
611 if (params->relative_rssi_set) {
612 struct nl80211_bss_select_rssi_adjust rssi_adjust;
613
614 os_memset(&rssi_adjust, 0, sizeof(rssi_adjust));
615 wpa_printf(MSG_DEBUG, "nl80211: Relative RSSI: %d",
616 params->relative_rssi);
617 if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
618 params->relative_rssi))
619 goto fail;
620
621 if (params->relative_adjust_rssi) {
622 int pref_band_set = 1;
623
624 switch (params->relative_adjust_band) {
625 case WPA_SETBAND_5G:
626 rssi_adjust.band = NL80211_BAND_5GHZ;
627 break;
628 case WPA_SETBAND_2G:
629 rssi_adjust.band = NL80211_BAND_2GHZ;
630 break;
631 default:
632 pref_band_set = 0;
633 break;
634 }
635 rssi_adjust.delta = params->relative_adjust_rssi;
636
637 if (pref_band_set &&
638 nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
639 sizeof(rssi_adjust), &rssi_adjust))
640 goto fail;
641 }
642 }
643
644 if (params->sched_scan_start_delay &&
645 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY,
646 params->sched_scan_start_delay))
647 goto fail;
648
649 ret = send_and_recv_cmd(drv, msg);
650
651 /* TODO: if we get an error here, we should fall back to normal scan */
652
653 msg = NULL;
654 if (ret) {
655 wpa_printf(MSG_DEBUG, "nl80211: Sched scan start failed: "
656 "ret=%d (%s)", ret, strerror(-ret));
657 goto fail;
658 }
659
660 wpa_printf(MSG_DEBUG, "nl80211: Sched scan requested (ret=%d)", ret);
661
662 fail:
663 nlmsg_free(msg);
664 return ret;
665 }
666
667
668 /**
669 * wpa_driver_nl80211_stop_sched_scan - Stop a scheduled scan
670 * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
671 * Returns: 0 on success, -1 on failure or if not supported
672 */
wpa_driver_nl80211_stop_sched_scan(void * priv)673 int wpa_driver_nl80211_stop_sched_scan(void *priv)
674 {
675 struct i802_bss *bss = priv;
676 struct wpa_driver_nl80211_data *drv = bss->drv;
677 int ret;
678 struct nl_msg *msg;
679
680 #ifdef ANDROID
681 if (!drv->capa.sched_scan_supported)
682 return android_pno_stop(bss);
683 #endif /* ANDROID */
684
685 msg = nl80211_drv_msg(drv, 0, NL80211_CMD_STOP_SCHED_SCAN);
686 ret = send_and_recv_cmd(drv, msg);
687 if (ret) {
688 wpa_printf(MSG_DEBUG,
689 "nl80211: Sched scan stop failed: ret=%d (%s)",
690 ret, strerror(-ret));
691 } else {
692 wpa_printf(MSG_DEBUG,
693 "nl80211: Sched scan stop sent");
694 }
695
696 return ret;
697 }
698
699
nl80211_scan_filtered(struct wpa_driver_nl80211_data * drv,const u8 * ie,size_t ie_len)700 static int nl80211_scan_filtered(struct wpa_driver_nl80211_data *drv,
701 const u8 *ie, size_t ie_len)
702 {
703 const u8 *ssid;
704 size_t i;
705
706 if (drv->filter_ssids == NULL)
707 return 0;
708
709 ssid = get_ie(ie, ie_len, WLAN_EID_SSID);
710 if (ssid == NULL)
711 return 1;
712
713 for (i = 0; i < drv->num_filter_ssids; i++) {
714 if (ssid[1] == drv->filter_ssids[i].ssid_len &&
715 os_memcmp(ssid + 2, drv->filter_ssids[i].ssid, ssid[1]) ==
716 0)
717 return 0;
718 }
719
720 return 1;
721 }
722
723
724 static struct wpa_scan_res *
nl80211_parse_bss_info(struct wpa_driver_nl80211_data * drv,struct nl_msg * msg,const u8 * bssid)725 nl80211_parse_bss_info(struct wpa_driver_nl80211_data *drv,
726 struct nl_msg *msg, const u8 *bssid)
727 {
728 struct nlattr *tb[NL80211_ATTR_MAX + 1];
729 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
730 struct nlattr *bss[NL80211_BSS_MAX + 1];
731 static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = {
732 [NL80211_BSS_BSSID] = { .type = NLA_UNSPEC },
733 [NL80211_BSS_FREQUENCY] = { .type = NLA_U32 },
734 [NL80211_BSS_TSF] = { .type = NLA_U64 },
735 [NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 },
736 [NL80211_BSS_CAPABILITY] = { .type = NLA_U16 },
737 [NL80211_BSS_INFORMATION_ELEMENTS] = { .type = NLA_UNSPEC },
738 [NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 },
739 [NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 },
740 [NL80211_BSS_STATUS] = { .type = NLA_U32 },
741 [NL80211_BSS_SEEN_MS_AGO] = { .type = NLA_U32 },
742 [NL80211_BSS_BEACON_IES] = { .type = NLA_UNSPEC },
743 [NL80211_BSS_BEACON_TSF] = { .type = NLA_U64 },
744 [NL80211_BSS_PARENT_TSF] = { .type = NLA_U64 },
745 [NL80211_BSS_PARENT_BSSID] = { .type = NLA_UNSPEC },
746 [NL80211_BSS_LAST_SEEN_BOOTTIME] = { .type = NLA_U64 },
747 };
748 struct wpa_scan_res *r;
749 const u8 *ie, *beacon_ie;
750 size_t ie_len, beacon_ie_len;
751 u8 *pos;
752
753 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
754 genlmsg_attrlen(gnlh, 0), NULL);
755 if (!tb[NL80211_ATTR_BSS])
756 return NULL;
757 if (nla_parse_nested(bss, NL80211_BSS_MAX, tb[NL80211_ATTR_BSS],
758 bss_policy))
759 return NULL;
760 if (bssid && bss[NL80211_BSS_BSSID] &&
761 !ether_addr_equal(bssid, nla_data(bss[NL80211_BSS_BSSID])))
762 return NULL;
763 if (bss[NL80211_BSS_INFORMATION_ELEMENTS]) {
764 ie = nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
765 ie_len = nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
766 } else {
767 ie = NULL;
768 ie_len = 0;
769 }
770 if (bss[NL80211_BSS_BEACON_IES]) {
771 beacon_ie = nla_data(bss[NL80211_BSS_BEACON_IES]);
772 beacon_ie_len = nla_len(bss[NL80211_BSS_BEACON_IES]);
773 } else {
774 beacon_ie = NULL;
775 beacon_ie_len = 0;
776 }
777
778 if (nl80211_scan_filtered(drv, ie ? ie : beacon_ie,
779 ie ? ie_len : beacon_ie_len))
780 return NULL;
781
782 r = os_zalloc(sizeof(*r) + ie_len + beacon_ie_len);
783 if (r == NULL)
784 return NULL;
785 if (bss[NL80211_BSS_BSSID])
786 os_memcpy(r->bssid, nla_data(bss[NL80211_BSS_BSSID]),
787 ETH_ALEN);
788 if (bss[NL80211_BSS_FREQUENCY])
789 r->freq = nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
790 if (bss[NL80211_BSS_BEACON_INTERVAL])
791 r->beacon_int = nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]);
792 if (bss[NL80211_BSS_CAPABILITY])
793 r->caps = nla_get_u16(bss[NL80211_BSS_CAPABILITY]);
794 r->flags |= WPA_SCAN_NOISE_INVALID;
795 if (bss[NL80211_BSS_SIGNAL_MBM]) {
796 r->level = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]);
797 r->level /= 100; /* mBm to dBm */
798 r->flags |= WPA_SCAN_LEVEL_DBM | WPA_SCAN_QUAL_INVALID;
799 } else if (bss[NL80211_BSS_SIGNAL_UNSPEC]) {
800 r->level = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]);
801 r->flags |= WPA_SCAN_QUAL_INVALID;
802 } else
803 r->flags |= WPA_SCAN_LEVEL_INVALID | WPA_SCAN_QUAL_INVALID;
804 if (bss[NL80211_BSS_TSF])
805 r->tsf = nla_get_u64(bss[NL80211_BSS_TSF]);
806 if (bss[NL80211_BSS_BEACON_TSF]) {
807 u64 tsf = nla_get_u64(bss[NL80211_BSS_BEACON_TSF]);
808 if (tsf > r->tsf) {
809 r->tsf = tsf;
810 r->beacon_newer = true;
811 }
812 }
813 if (bss[NL80211_BSS_SEEN_MS_AGO])
814 r->age = nla_get_u32(bss[NL80211_BSS_SEEN_MS_AGO]);
815 if (bss[NL80211_BSS_LAST_SEEN_BOOTTIME]) {
816 u64 boottime;
817 struct timespec ts;
818
819 #ifndef CLOCK_BOOTTIME
820 #define CLOCK_BOOTTIME 7
821 #endif
822 if (clock_gettime(CLOCK_BOOTTIME, &ts) == 0) {
823 /* Use more accurate boottime information to update the
824 * scan result age since the driver reports this and
825 * CLOCK_BOOTTIME is available. */
826 boottime = nla_get_u64(
827 bss[NL80211_BSS_LAST_SEEN_BOOTTIME]);
828 r->age = ((u64) ts.tv_sec * 1000000000 +
829 ts.tv_nsec - boottime) / 1000000;
830 }
831 }
832 r->ie_len = ie_len;
833 pos = (u8 *) (r + 1);
834 if (ie) {
835 os_memcpy(pos, ie, ie_len);
836 pos += ie_len;
837 }
838 r->beacon_ie_len = beacon_ie_len;
839 if (beacon_ie)
840 os_memcpy(pos, beacon_ie, beacon_ie_len);
841
842 if (bss[NL80211_BSS_STATUS]) {
843 enum nl80211_bss_status status;
844 status = nla_get_u32(bss[NL80211_BSS_STATUS]);
845 switch (status) {
846 case NL80211_BSS_STATUS_ASSOCIATED:
847 r->flags |= WPA_SCAN_ASSOCIATED;
848 break;
849 default:
850 break;
851 }
852 }
853
854 if (bss[NL80211_BSS_PARENT_TSF] && bss[NL80211_BSS_PARENT_BSSID]) {
855 r->parent_tsf = nla_get_u64(bss[NL80211_BSS_PARENT_TSF]);
856 os_memcpy(r->tsf_bssid, nla_data(bss[NL80211_BSS_PARENT_BSSID]),
857 ETH_ALEN);
858 }
859
860 return r;
861 }
862
863
864 struct nl80211_bss_info_arg {
865 struct wpa_driver_nl80211_data *drv;
866 struct wpa_scan_results *res;
867 const u8 *bssid;
868 };
869
bss_info_handler(struct nl_msg * msg,void * arg)870 static int bss_info_handler(struct nl_msg *msg, void *arg)
871 {
872 struct nl80211_bss_info_arg *_arg = arg;
873 struct wpa_scan_results *res = _arg->res;
874 struct wpa_scan_res **tmp;
875 struct wpa_scan_res *r;
876
877 r = nl80211_parse_bss_info(_arg->drv, msg, _arg->bssid);
878 if (!r)
879 return NL_SKIP;
880
881 if (!res) {
882 os_free(r);
883 return NL_SKIP;
884 }
885 tmp = os_realloc_array(res->res, res->num + 1,
886 sizeof(struct wpa_scan_res *));
887 if (tmp == NULL) {
888 os_free(r);
889 return NL_SKIP;
890 }
891 tmp[res->num++] = r;
892 res->res = tmp;
893
894 return NL_SKIP;
895 }
896
897
clear_state_mismatch(struct wpa_driver_nl80211_data * drv,const u8 * addr)898 static void clear_state_mismatch(struct wpa_driver_nl80211_data *drv,
899 const u8 *addr)
900 {
901 if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) {
902 wpa_printf(MSG_DEBUG, "nl80211: Clear possible state "
903 "mismatch (" MACSTR ")", MAC2STR(addr));
904 wpa_driver_nl80211_mlme(drv, addr,
905 NL80211_CMD_DEAUTHENTICATE,
906 WLAN_REASON_PREV_AUTH_NOT_VALID, 1,
907 drv->first_bss);
908 }
909 }
910
911
nl80211_check_bss_status(struct wpa_driver_nl80211_data * drv,struct wpa_scan_res * r)912 static void nl80211_check_bss_status(struct wpa_driver_nl80211_data *drv,
913 struct wpa_scan_res *r)
914 {
915 if (!(r->flags & WPA_SCAN_ASSOCIATED))
916 return;
917
918 wpa_printf(MSG_DEBUG, "nl80211: Scan results indicate BSS status with "
919 MACSTR " as associated", MAC2STR(r->bssid));
920 if (is_sta_interface(drv->nlmode) && !drv->associated) {
921 wpa_printf(MSG_DEBUG,
922 "nl80211: Local state (not associated) does not match with BSS state");
923 clear_state_mismatch(drv, r->bssid);
924 } else if (is_sta_interface(drv->nlmode) &&
925 !ether_addr_equal(drv->bssid, r->bssid)) {
926 wpa_printf(MSG_DEBUG,
927 "nl80211: Local state (associated with " MACSTR
928 ") does not match with BSS state",
929 MAC2STR(drv->bssid));
930
931 if (!ether_addr_equal(drv->sta_mlo_info.ap_mld_addr,
932 drv->bssid)) {
933 clear_state_mismatch(drv, r->bssid);
934
935 if (!is_zero_ether_addr(drv->sta_mlo_info.ap_mld_addr))
936 clear_state_mismatch(
937 drv, drv->sta_mlo_info.ap_mld_addr);
938 else
939 clear_state_mismatch(drv, drv->bssid);
940
941 } else {
942 wpa_printf(MSG_DEBUG,
943 "nl80211: BSSID is the MLD address");
944 }
945 }
946 }
947
948
wpa_driver_nl80211_check_bss_status(struct wpa_driver_nl80211_data * drv,struct wpa_scan_results * res)949 static void wpa_driver_nl80211_check_bss_status(
950 struct wpa_driver_nl80211_data *drv, struct wpa_scan_results *res)
951 {
952 size_t i;
953
954 for (i = 0; i < res->num; i++)
955 nl80211_check_bss_status(drv, res->res[i]);
956 }
957
958
nl80211_update_scan_res_noise(struct wpa_scan_res * res,struct nl80211_noise_info * info)959 static void nl80211_update_scan_res_noise(struct wpa_scan_res *res,
960 struct nl80211_noise_info *info)
961 {
962 unsigned int i;
963
964 for (i = 0; res && i < info->count; i++) {
965 if ((int) info->freq[i] != res->freq ||
966 !(res->flags & WPA_SCAN_NOISE_INVALID))
967 continue;
968 res->noise = info->noise[i];
969 res->flags &= ~WPA_SCAN_NOISE_INVALID;
970 }
971 }
972
973
974 static struct wpa_scan_results *
nl80211_get_scan_results(struct wpa_driver_nl80211_data * drv,const u8 * bssid)975 nl80211_get_scan_results(struct wpa_driver_nl80211_data *drv, const u8 *bssid)
976 {
977 struct nl_msg *msg;
978 struct wpa_scan_results *res;
979 int ret;
980 struct nl80211_bss_info_arg arg;
981 int count = 0;
982
983 try_again:
984 res = os_zalloc(sizeof(*res));
985 if (res == NULL)
986 return NULL;
987 if (!(msg = nl80211_cmd_msg(drv->first_bss, NLM_F_DUMP,
988 NL80211_CMD_GET_SCAN))) {
989 wpa_scan_results_free(res);
990 return NULL;
991 }
992
993 arg.drv = drv;
994 arg.res = res;
995 arg.bssid = bssid;
996 ret = send_and_recv_resp(drv, msg, bss_info_handler, &arg);
997 if (ret == -EAGAIN) {
998 count++;
999 if (count >= 10) {
1000 wpa_printf(MSG_INFO,
1001 "nl80211: Failed to receive consistent scan result dump");
1002 } else {
1003 wpa_printf(MSG_DEBUG,
1004 "nl80211: Failed to receive consistent scan result dump - try again");
1005 wpa_scan_results_free(res);
1006 goto try_again;
1007 }
1008 }
1009 if (ret == 0) {
1010 struct nl80211_noise_info info;
1011
1012 wpa_printf(MSG_DEBUG, "nl80211: Received scan results (%lu "
1013 "BSSes)", (unsigned long) res->num);
1014 if (nl80211_get_noise_for_scan_results(drv, &info) == 0) {
1015 size_t i;
1016
1017 for (i = 0; i < res->num; ++i)
1018 nl80211_update_scan_res_noise(res->res[i],
1019 &info);
1020 }
1021 return res;
1022 }
1023 wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d "
1024 "(%s)", ret, strerror(-ret));
1025 wpa_scan_results_free(res);
1026 return NULL;
1027 }
1028
1029
1030 /**
1031 * wpa_driver_nl80211_get_scan_results - Fetch the latest scan results
1032 * @priv: Pointer to private nl80211 data from wpa_driver_nl80211_init()
1033 * @bssid: Return results only for the specified BSSID, %NULL for all
1034 * Returns: Scan results on success, -1 on failure
1035 */
wpa_driver_nl80211_get_scan_results(void * priv,const u8 * bssid)1036 struct wpa_scan_results * wpa_driver_nl80211_get_scan_results(void *priv,
1037 const u8 *bssid)
1038 {
1039 struct i802_bss *bss = priv;
1040 struct wpa_driver_nl80211_data *drv = bss->drv;
1041 struct wpa_scan_results *res;
1042
1043 res = nl80211_get_scan_results(drv, bssid);
1044 if (res)
1045 wpa_driver_nl80211_check_bss_status(drv, res);
1046 return res;
1047 }
1048
1049
1050 struct nl80211_dump_scan_ctx {
1051 struct wpa_driver_nl80211_data *drv;
1052 int idx;
1053 };
1054
nl80211_dump_scan_handler(struct nl_msg * msg,void * arg)1055 static int nl80211_dump_scan_handler(struct nl_msg *msg, void *arg)
1056 {
1057 struct nl80211_dump_scan_ctx *ctx = arg;
1058 struct wpa_scan_res *r;
1059
1060 r = nl80211_parse_bss_info(ctx->drv, msg, NULL);
1061 if (!r)
1062 return NL_SKIP;
1063 wpa_printf(MSG_DEBUG, "nl80211: %d " MACSTR " %d%s",
1064 ctx->idx, MAC2STR(r->bssid), r->freq,
1065 r->flags & WPA_SCAN_ASSOCIATED ? " [assoc]" : "");
1066 ctx->idx++;
1067 os_free(r);
1068 return NL_SKIP;
1069 }
1070
1071
nl80211_dump_scan(struct wpa_driver_nl80211_data * drv)1072 void nl80211_dump_scan(struct wpa_driver_nl80211_data *drv)
1073 {
1074 struct nl_msg *msg;
1075 struct nl80211_dump_scan_ctx ctx;
1076
1077 wpa_printf(MSG_DEBUG, "nl80211: Scan result dump");
1078 ctx.drv = drv;
1079 ctx.idx = 0;
1080 msg = nl80211_cmd_msg(drv->first_bss, NLM_F_DUMP, NL80211_CMD_GET_SCAN);
1081 if (msg)
1082 send_and_recv_resp(drv, msg, nl80211_dump_scan_handler, &ctx);
1083 }
1084
1085
wpa_driver_nl80211_abort_scan(void * priv,u64 scan_cookie)1086 int wpa_driver_nl80211_abort_scan(void *priv, u64 scan_cookie)
1087 {
1088 struct i802_bss *bss = priv;
1089 #ifdef CONFIG_DRIVER_NL80211_QCA
1090 struct wpa_driver_nl80211_data *drv = bss->drv;
1091
1092 /*
1093 * If scan_cookie is zero, a normal scan through kernel (cfg80211)
1094 * was triggered, hence abort the cfg80211 scan instead of the vendor
1095 * scan.
1096 */
1097 if (drv->scan_vendor_cmd_avail && scan_cookie)
1098 return nl80211_abort_vendor_scan(drv, scan_cookie);
1099 #endif /* CONFIG_DRIVER_NL80211_QCA */
1100 return nl80211_abort_scan(bss);
1101 }
1102
1103
1104 #ifdef CONFIG_DRIVER_NL80211_QCA
1105
scan_cookie_handler(struct nl_msg * msg,void * arg)1106 static int scan_cookie_handler(struct nl_msg *msg, void *arg)
1107 {
1108 struct nlattr *tb[NL80211_ATTR_MAX + 1];
1109 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1110 u64 *cookie = arg;
1111
1112 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1113 genlmsg_attrlen(gnlh, 0), NULL);
1114
1115 if (tb[NL80211_ATTR_VENDOR_DATA]) {
1116 struct nlattr *nl_vendor = tb[NL80211_ATTR_VENDOR_DATA];
1117 struct nlattr *tb_vendor[QCA_WLAN_VENDOR_ATTR_SCAN_MAX + 1];
1118
1119 nla_parse(tb_vendor, QCA_WLAN_VENDOR_ATTR_SCAN_MAX,
1120 nla_data(nl_vendor), nla_len(nl_vendor), NULL);
1121
1122 if (tb_vendor[QCA_WLAN_VENDOR_ATTR_SCAN_COOKIE])
1123 *cookie = nla_get_u64(
1124 tb_vendor[QCA_WLAN_VENDOR_ATTR_SCAN_COOKIE]);
1125 }
1126
1127 return NL_SKIP;
1128 }
1129
1130
1131 /**
1132 * wpa_driver_nl80211_vendor_scan - Request the driver to initiate a vendor scan
1133 * @bss: Pointer to private driver data from wpa_driver_nl80211_init()
1134 * @params: Scan parameters
1135 * Returns: 0 on success, -1 on failure
1136 */
wpa_driver_nl80211_vendor_scan(struct i802_bss * bss,struct wpa_driver_scan_params * params)1137 int wpa_driver_nl80211_vendor_scan(struct i802_bss *bss,
1138 struct wpa_driver_scan_params *params)
1139 {
1140 struct wpa_driver_nl80211_data *drv = bss->drv;
1141 struct nl_msg *msg = NULL;
1142 struct nlattr *attr;
1143 size_t i;
1144 u32 scan_flags = 0;
1145 int ret = -1;
1146 u64 cookie = 0;
1147
1148 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: vendor scan request");
1149 drv->scan_for_auth = 0;
1150
1151 if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
1152 nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
1153 nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
1154 QCA_NL80211_VENDOR_SUBCMD_TRIGGER_SCAN) )
1155 goto fail;
1156
1157 attr = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1158 if (attr == NULL)
1159 goto fail;
1160
1161 if (params->num_ssids) {
1162 struct nlattr *ssids;
1163
1164 ssids = nla_nest_start(msg, QCA_WLAN_VENDOR_ATTR_SCAN_SSIDS);
1165 if (ssids == NULL)
1166 goto fail;
1167 for (i = 0; i < params->num_ssids; i++) {
1168 wpa_printf(MSG_MSGDUMP, "nl80211: Scan SSID %s",
1169 wpa_ssid_txt(params->ssids[i].ssid,
1170 params->ssids[i].ssid_len));
1171 if (nla_put(msg, i + 1, params->ssids[i].ssid_len,
1172 params->ssids[i].ssid))
1173 goto fail;
1174 }
1175 nla_nest_end(msg, ssids);
1176 }
1177
1178 if (params->extra_ies) {
1179 wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan extra IEs",
1180 params->extra_ies, params->extra_ies_len);
1181 if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_SCAN_IE,
1182 params->extra_ies_len, params->extra_ies))
1183 goto fail;
1184 }
1185
1186 if (params->freqs) {
1187 struct nlattr *freqs;
1188
1189 freqs = nla_nest_start(msg,
1190 QCA_WLAN_VENDOR_ATTR_SCAN_FREQUENCIES);
1191 if (freqs == NULL)
1192 goto fail;
1193 for (i = 0; params->freqs[i]; i++) {
1194 wpa_printf(MSG_MSGDUMP,
1195 "nl80211: Scan frequency %u MHz",
1196 params->freqs[i]);
1197 if (nla_put_u32(msg, i + 1, params->freqs[i]))
1198 goto fail;
1199 }
1200 nla_nest_end(msg, freqs);
1201 }
1202
1203 os_free(drv->filter_ssids);
1204 drv->filter_ssids = params->filter_ssids;
1205 params->filter_ssids = NULL;
1206 drv->num_filter_ssids = params->num_filter_ssids;
1207
1208 if (params->low_priority && drv->have_low_prio_scan) {
1209 wpa_printf(MSG_DEBUG,
1210 "nl80211: Add NL80211_SCAN_FLAG_LOW_PRIORITY");
1211 scan_flags |= NL80211_SCAN_FLAG_LOW_PRIORITY;
1212 }
1213
1214 if (params->mac_addr_rand) {
1215 wpa_printf(MSG_DEBUG,
1216 "nl80211: Add NL80211_SCAN_FLAG_RANDOM_ADDR");
1217 scan_flags |= NL80211_SCAN_FLAG_RANDOM_ADDR;
1218
1219 if (params->mac_addr) {
1220 wpa_printf(MSG_DEBUG, "nl80211: MAC address: " MACSTR,
1221 MAC2STR(params->mac_addr));
1222 if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_SCAN_MAC,
1223 ETH_ALEN, params->mac_addr))
1224 goto fail;
1225 }
1226
1227 if (params->mac_addr_mask) {
1228 wpa_printf(MSG_DEBUG, "nl80211: MAC address mask: "
1229 MACSTR, MAC2STR(params->mac_addr_mask));
1230 if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_SCAN_MAC_MASK,
1231 ETH_ALEN, params->mac_addr_mask))
1232 goto fail;
1233 }
1234 }
1235
1236 if (scan_flags &&
1237 nla_put_u32(msg, QCA_WLAN_VENDOR_ATTR_SCAN_FLAGS, scan_flags))
1238 goto fail;
1239
1240 if (params->p2p_probe) {
1241 struct nlattr *rates;
1242
1243 wpa_printf(MSG_DEBUG, "nl80211: P2P probe - mask SuppRates");
1244
1245 rates = nla_nest_start(msg,
1246 QCA_WLAN_VENDOR_ATTR_SCAN_SUPP_RATES);
1247 if (rates == NULL)
1248 goto fail;
1249
1250 /*
1251 * Remove 2.4 GHz rates 1, 2, 5.5, 11 Mbps from supported rates
1252 * by masking out everything else apart from the OFDM rates 6,
1253 * 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS rates. All 5 GHz
1254 * rates are left enabled.
1255 */
1256 if (nla_put(msg, NL80211_BAND_2GHZ, 8,
1257 "\x0c\x12\x18\x24\x30\x48\x60\x6c"))
1258 goto fail;
1259 nla_nest_end(msg, rates);
1260
1261 if (nla_put_flag(msg, QCA_WLAN_VENDOR_ATTR_SCAN_TX_NO_CCK_RATE))
1262 goto fail;
1263 }
1264
1265 if (params->bssid) {
1266 wpa_printf(MSG_DEBUG, "nl80211: Scan for a specific BSSID: "
1267 MACSTR, MAC2STR(params->bssid));
1268 if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_SCAN_BSSID, ETH_ALEN,
1269 params->bssid))
1270 goto fail;
1271 }
1272
1273 if (is_ap_interface(drv->nlmode) &&
1274 params->link_id != NL80211_DRV_LINK_ID_NA &&
1275 nla_put_u8(msg, QCA_WLAN_VENDOR_ATTR_SCAN_LINK_ID, params->link_id))
1276 goto fail;
1277
1278 nla_nest_end(msg, attr);
1279
1280 ret = send_and_recv_resp(drv, msg, scan_cookie_handler, &cookie);
1281 msg = NULL;
1282 if (ret) {
1283 wpa_printf(MSG_DEBUG,
1284 "nl80211: Vendor scan trigger failed: ret=%d (%s)",
1285 ret, strerror(-ret));
1286 goto fail;
1287 }
1288
1289 drv->vendor_scan_cookie = cookie;
1290 drv->scan_state = SCAN_REQUESTED;
1291 /* Pass the cookie to the caller to help distinguish the scans. */
1292 params->scan_cookie = cookie;
1293
1294 wpa_printf(MSG_DEBUG,
1295 "nl80211: Vendor scan requested (ret=%d) - scan timeout 30 seconds, scan cookie:0x%llx",
1296 ret, (long long unsigned int) cookie);
1297 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
1298 eloop_register_timeout(30, 0, wpa_driver_nl80211_scan_timeout,
1299 drv, drv->ctx);
1300 drv->last_scan_cmd = NL80211_CMD_VENDOR;
1301
1302 fail:
1303 nlmsg_free(msg);
1304 return ret;
1305 }
1306
1307
1308 /**
1309 * nl80211_set_default_scan_ies - Set the scan default IEs to the driver
1310 * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
1311 * @ies: Pointer to IEs buffer
1312 * @ies_len: Length of IEs in bytes
1313 * Returns: 0 on success, -1 on failure
1314 */
nl80211_set_default_scan_ies(void * priv,const u8 * ies,size_t ies_len)1315 int nl80211_set_default_scan_ies(void *priv, const u8 *ies, size_t ies_len)
1316 {
1317 struct i802_bss *bss = priv;
1318 struct wpa_driver_nl80211_data *drv = bss->drv;
1319 struct nl_msg *msg = NULL;
1320 struct nlattr *attr;
1321 int ret = -1;
1322
1323 if (!drv->set_wifi_conf_vendor_cmd_avail)
1324 return -1;
1325
1326 if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
1327 nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
1328 nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
1329 QCA_NL80211_VENDOR_SUBCMD_SET_WIFI_CONFIGURATION))
1330 goto fail;
1331
1332 attr = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1333 if (attr == NULL)
1334 goto fail;
1335
1336 wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan default IEs", ies, ies_len);
1337 if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_CONFIG_SCAN_DEFAULT_IES,
1338 ies_len, ies))
1339 goto fail;
1340
1341 nla_nest_end(msg, attr);
1342
1343 ret = send_and_recv_cmd(drv, msg);
1344 msg = NULL;
1345 if (ret) {
1346 wpa_printf(MSG_ERROR,
1347 "nl80211: Set scan default IEs failed: ret=%d (%s)",
1348 ret, strerror(-ret));
1349 goto fail;
1350 }
1351
1352 fail:
1353 nlmsg_free(msg);
1354 return ret;
1355 }
1356
1357 #endif /* CONFIG_DRIVER_NL80211_QCA */
1358