1 /*
2  * Driver interaction with Linux nl80211/cfg80211 - Scanning
3  * Copyright(c) 2015 Intel Deutschland GmbH
4  * Copyright (c) 2002-2014, Jouni Malinen <j@w1.fi>
5  * Copyright (c) 2007, Johannes Berg <johannes@sipsolutions.net>
6  * Copyright (c) 2009-2010, Atheros Communications
7  *
8  * This software may be distributed under the terms of the BSD license.
9  * See README for more details.
10  */
11 
12 #include "includes.h"
13 #include <netlink/genl/genl.h>
14 
15 #include "utils/common.h"
16 #include "utils/eloop.h"
17 #include "common/ieee802_11_defs.h"
18 #include "common/ieee802_11_common.h"
19 #include "common/qca-vendor.h"
20 #include "driver_nl80211.h"
21 
22 
get_noise_for_scan_results(struct nl_msg * msg,void * arg)23 static int get_noise_for_scan_results(struct nl_msg *msg, void *arg)
24 {
25 	struct nlattr *tb[NL80211_ATTR_MAX + 1];
26 	struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
27 	struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
28 	static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
29 		[NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
30 		[NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
31 	};
32 	struct wpa_scan_results *scan_results = arg;
33 	struct wpa_scan_res *scan_res;
34 	size_t i;
35 
36 	nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
37 		  genlmsg_attrlen(gnlh, 0), NULL);
38 
39 	if (!tb[NL80211_ATTR_SURVEY_INFO]) {
40 		wpa_printf(MSG_DEBUG, "nl80211: Survey data missing");
41 		return NL_SKIP;
42 	}
43 
44 	if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
45 			     tb[NL80211_ATTR_SURVEY_INFO],
46 			     survey_policy)) {
47 		wpa_printf(MSG_DEBUG, "nl80211: Failed to parse nested "
48 			   "attributes");
49 		return NL_SKIP;
50 	}
51 
52 	if (!sinfo[NL80211_SURVEY_INFO_NOISE])
53 		return NL_SKIP;
54 
55 	if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY])
56 		return NL_SKIP;
57 
58 	for (i = 0; i < scan_results->num; ++i) {
59 		scan_res = scan_results->res[i];
60 		if (!scan_res)
61 			continue;
62 		if ((int) nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]) !=
63 		    scan_res->freq)
64 			continue;
65 		if (!(scan_res->flags & WPA_SCAN_NOISE_INVALID))
66 			continue;
67 		scan_res->noise = (s8)
68 			nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
69 		scan_res->flags &= ~WPA_SCAN_NOISE_INVALID;
70 	}
71 
72 	return NL_SKIP;
73 }
74 
75 
nl80211_get_noise_for_scan_results(struct wpa_driver_nl80211_data * drv,struct wpa_scan_results * scan_res)76 static int nl80211_get_noise_for_scan_results(
77 	struct wpa_driver_nl80211_data *drv,
78 	struct wpa_scan_results *scan_res)
79 {
80 	struct nl_msg *msg;
81 
82 	msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_GET_SURVEY);
83 	return send_and_recv_msgs(drv, msg, get_noise_for_scan_results,
84 				  scan_res);
85 }
86 
87 
88 /**
89  * wpa_driver_nl80211_scan_timeout - Scan timeout to report scan completion
90  * @eloop_ctx: Driver private data
91  * @timeout_ctx: ctx argument given to wpa_driver_nl80211_init()
92  *
93  * This function can be used as registered timeout when starting a scan to
94  * generate a scan completed event if the driver does not report this.
95  */
wpa_driver_nl80211_scan_timeout(void * eloop_ctx,void * timeout_ctx)96 void wpa_driver_nl80211_scan_timeout(void *eloop_ctx, void *timeout_ctx)
97 {
98 	struct wpa_driver_nl80211_data *drv = eloop_ctx;
99 
100 	wpa_printf(MSG_DEBUG, "nl80211: Scan timeout - try to abort it");
101 	if (!wpa_driver_nl80211_abort_scan(drv->first_bss))
102 		return;
103 
104 	wpa_printf(MSG_DEBUG, "nl80211: Failed to abort scan");
105 
106 	if (drv->ap_scan_as_station != NL80211_IFTYPE_UNSPECIFIED) {
107 		wpa_driver_nl80211_set_mode(drv->first_bss,
108 					    drv->ap_scan_as_station);
109 		drv->ap_scan_as_station = NL80211_IFTYPE_UNSPECIFIED;
110 	}
111 
112 	wpa_printf(MSG_DEBUG, "nl80211: Try to get scan results");
113 	wpa_supplicant_event(timeout_ctx, EVENT_SCAN_RESULTS, NULL);
114 }
115 
116 
117 static struct nl_msg *
nl80211_scan_common(struct i802_bss * bss,u8 cmd,struct wpa_driver_scan_params * params)118 nl80211_scan_common(struct i802_bss *bss, u8 cmd,
119 		    struct wpa_driver_scan_params *params)
120 {
121 	struct wpa_driver_nl80211_data *drv = bss->drv;
122 	struct nl_msg *msg;
123 	size_t i;
124 	u32 scan_flags = 0;
125 
126 	msg = nl80211_cmd_msg(bss, 0, cmd);
127 	if (!msg)
128 		return NULL;
129 
130 	if (params->num_ssids) {
131 		struct nlattr *ssids;
132 
133 		ssids = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
134 		if (ssids == NULL)
135 			goto fail;
136 		for (i = 0; i < params->num_ssids; i++) {
137 			wpa_hexdump_ascii(MSG_MSGDUMP, "nl80211: Scan SSID",
138 					  params->ssids[i].ssid,
139 					  params->ssids[i].ssid_len);
140 			if (nla_put(msg, i + 1, params->ssids[i].ssid_len,
141 				    params->ssids[i].ssid))
142 				goto fail;
143 		}
144 		nla_nest_end(msg, ssids);
145 	} else {
146 		wpa_printf(MSG_DEBUG, "nl80211: Passive scan requested");
147 	}
148 
149 	if (params->extra_ies) {
150 		wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan extra IEs",
151 			    params->extra_ies, params->extra_ies_len);
152 		if (nla_put(msg, NL80211_ATTR_IE, params->extra_ies_len,
153 			    params->extra_ies))
154 			goto fail;
155 	}
156 
157 	if (params->freqs) {
158 		struct nlattr *freqs;
159 		freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
160 		if (freqs == NULL)
161 			goto fail;
162 		for (i = 0; params->freqs[i]; i++) {
163 			wpa_printf(MSG_MSGDUMP, "nl80211: Scan frequency %u "
164 				   "MHz", params->freqs[i]);
165 			if (nla_put_u32(msg, i + 1, params->freqs[i]))
166 				goto fail;
167 		}
168 		nla_nest_end(msg, freqs);
169 	}
170 
171 	os_free(drv->filter_ssids);
172 	drv->filter_ssids = params->filter_ssids;
173 	params->filter_ssids = NULL;
174 	drv->num_filter_ssids = params->num_filter_ssids;
175 
176 	if (params->only_new_results) {
177 		wpa_printf(MSG_DEBUG, "nl80211: Add NL80211_SCAN_FLAG_FLUSH");
178 		scan_flags |= NL80211_SCAN_FLAG_FLUSH;
179 	}
180 
181 	if (params->low_priority && drv->have_low_prio_scan) {
182 		wpa_printf(MSG_DEBUG,
183 			   "nl80211: Add NL80211_SCAN_FLAG_LOW_PRIORITY");
184 		scan_flags |= NL80211_SCAN_FLAG_LOW_PRIORITY;
185 	}
186 
187 	if (params->mac_addr_rand) {
188 		wpa_printf(MSG_DEBUG,
189 			   "nl80211: Add NL80211_SCAN_FLAG_RANDOM_ADDR");
190 		scan_flags |= NL80211_SCAN_FLAG_RANDOM_ADDR;
191 
192 		if (params->mac_addr) {
193 			wpa_printf(MSG_DEBUG, "nl80211: MAC address: " MACSTR,
194 				   MAC2STR(params->mac_addr));
195 			if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
196 				    params->mac_addr))
197 				goto fail;
198 		}
199 
200 		if (params->mac_addr_mask) {
201 			wpa_printf(MSG_DEBUG, "nl80211: MAC address mask: "
202 				   MACSTR, MAC2STR(params->mac_addr_mask));
203 			if (nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN,
204 				    params->mac_addr_mask))
205 				goto fail;
206 		}
207 	}
208 
209 	if (scan_flags &&
210 	    nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, scan_flags))
211 		goto fail;
212 
213 	return msg;
214 
215 fail:
216 	nlmsg_free(msg);
217 	return NULL;
218 }
219 
220 
221 /**
222  * wpa_driver_nl80211_scan - Request the driver to initiate scan
223  * @bss: Pointer to private driver data from wpa_driver_nl80211_init()
224  * @params: Scan parameters
225  * Returns: 0 on success, -1 on failure
226  */
wpa_driver_nl80211_scan(struct i802_bss * bss,struct wpa_driver_scan_params * params)227 int wpa_driver_nl80211_scan(struct i802_bss *bss,
228 			    struct wpa_driver_scan_params *params)
229 {
230 	struct wpa_driver_nl80211_data *drv = bss->drv;
231 	int ret = -1, timeout;
232 	struct nl_msg *msg = NULL;
233 
234 	wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: scan request");
235 	drv->scan_for_auth = 0;
236 
237 	if (TEST_FAIL())
238 		return -1;
239 
240 	msg = nl80211_scan_common(bss, NL80211_CMD_TRIGGER_SCAN, params);
241 	if (!msg)
242 		return -1;
243 
244 	if (params->p2p_probe) {
245 		struct nlattr *rates;
246 
247 		wpa_printf(MSG_DEBUG, "nl80211: P2P probe - mask SuppRates");
248 
249 		rates = nla_nest_start(msg, NL80211_ATTR_SCAN_SUPP_RATES);
250 		if (rates == NULL)
251 			goto fail;
252 
253 		/*
254 		 * Remove 2.4 GHz rates 1, 2, 5.5, 11 Mbps from supported rates
255 		 * by masking out everything else apart from the OFDM rates 6,
256 		 * 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS rates. All 5 GHz
257 		 * rates are left enabled.
258 		 */
259 		if (nla_put(msg, NL80211_BAND_2GHZ, 8,
260 			    "\x0c\x12\x18\x24\x30\x48\x60\x6c"))
261 			goto fail;
262 		nla_nest_end(msg, rates);
263 
264 		if (nla_put_flag(msg, NL80211_ATTR_TX_NO_CCK_RATE))
265 			goto fail;
266 	}
267 
268 	if (params->bssid) {
269 		wpa_printf(MSG_DEBUG, "nl80211: Scan for a specific BSSID: "
270 			   MACSTR, MAC2STR(params->bssid));
271 		if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid))
272 			goto fail;
273 	}
274 
275 	ret = send_and_recv_msgs(drv, msg, NULL, NULL);
276 	msg = NULL;
277 	if (ret) {
278 		wpa_printf(MSG_DEBUG, "nl80211: Scan trigger failed: ret=%d "
279 			   "(%s)", ret, strerror(-ret));
280 		if (drv->hostapd && is_ap_interface(drv->nlmode)) {
281 			enum nl80211_iftype old_mode = drv->nlmode;
282 
283 			/*
284 			 * mac80211 does not allow scan requests in AP mode, so
285 			 * try to do this in station mode.
286 			 */
287 			if (wpa_driver_nl80211_set_mode(
288 				    bss, NL80211_IFTYPE_STATION))
289 				goto fail;
290 
291 			if (wpa_driver_nl80211_scan(bss, params)) {
292 				wpa_driver_nl80211_set_mode(bss, old_mode);
293 				goto fail;
294 			}
295 
296 			/* Restore AP mode when processing scan results */
297 			drv->ap_scan_as_station = old_mode;
298 			ret = 0;
299 		} else
300 			goto fail;
301 	}
302 
303 	drv->scan_state = SCAN_REQUESTED;
304 	/* Not all drivers generate "scan completed" wireless event, so try to
305 	 * read results after a timeout. */
306 	timeout = 10;
307 	if (drv->scan_complete_events) {
308 		/*
309 		 * The driver seems to deliver events to notify when scan is
310 		 * complete, so use longer timeout to avoid race conditions
311 		 * with scanning and following association request.
312 		 */
313 		timeout = 30;
314 	}
315 	wpa_printf(MSG_DEBUG, "Scan requested (ret=%d) - scan timeout %d "
316 		   "seconds", ret, timeout);
317 	eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
318 	eloop_register_timeout(timeout, 0, wpa_driver_nl80211_scan_timeout,
319 			       drv, drv->ctx);
320 	drv->last_scan_cmd = NL80211_CMD_TRIGGER_SCAN;
321 
322 fail:
323 	nlmsg_free(msg);
324 	return ret;
325 }
326 
327 
328 static int
nl80211_sched_scan_add_scan_plans(struct wpa_driver_nl80211_data * drv,struct nl_msg * msg,struct wpa_driver_scan_params * params)329 nl80211_sched_scan_add_scan_plans(struct wpa_driver_nl80211_data *drv,
330 				  struct nl_msg *msg,
331 				  struct wpa_driver_scan_params *params)
332 {
333 	struct nlattr *plans;
334 	struct sched_scan_plan *scan_plans = params->sched_scan_plans;
335 	unsigned int i;
336 
337 	plans = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
338 	if (!plans)
339 		return -1;
340 
341 	for (i = 0; i < params->sched_scan_plans_num; i++) {
342 		struct nlattr *plan = nla_nest_start(msg, i + 1);
343 
344 		if (!plan)
345 			return -1;
346 
347 		if (!scan_plans[i].interval ||
348 		    scan_plans[i].interval >
349 		    drv->capa.max_sched_scan_plan_interval) {
350 			wpa_printf(MSG_DEBUG,
351 				   "nl80211: sched scan plan no. %u: Invalid interval: %u",
352 				   i, scan_plans[i].interval);
353 			return -1;
354 		}
355 
356 		if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
357 				scan_plans[i].interval))
358 			return -1;
359 
360 		if (scan_plans[i].iterations >
361 		    drv->capa.max_sched_scan_plan_iterations) {
362 			wpa_printf(MSG_DEBUG,
363 				   "nl80211: sched scan plan no. %u: Invalid number of iterations: %u",
364 				   i, scan_plans[i].iterations);
365 			return -1;
366 		}
367 
368 		if (scan_plans[i].iterations &&
369 		    nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
370 				scan_plans[i].iterations))
371 			return -1;
372 
373 		nla_nest_end(msg, plan);
374 
375 		/*
376 		 * All the scan plans must specify the number of iterations
377 		 * except the last plan, which will run infinitely. So if the
378 		 * number of iterations is not specified, this ought to be the
379 		 * last scan plan.
380 		 */
381 		if (!scan_plans[i].iterations)
382 			break;
383 	}
384 
385 	if (i != params->sched_scan_plans_num - 1) {
386 		wpa_printf(MSG_DEBUG,
387 			   "nl80211: All sched scan plans but the last must specify number of iterations");
388 		return -1;
389 	}
390 
391 	nla_nest_end(msg, plans);
392 	return 0;
393 }
394 
395 
396 /**
397  * wpa_driver_nl80211_sched_scan - Initiate a scheduled scan
398  * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
399  * @params: Scan parameters
400  * Returns: 0 on success, -1 on failure or if not supported
401  */
wpa_driver_nl80211_sched_scan(void * priv,struct wpa_driver_scan_params * params)402 int wpa_driver_nl80211_sched_scan(void *priv,
403 				  struct wpa_driver_scan_params *params)
404 {
405 	struct i802_bss *bss = priv;
406 	struct wpa_driver_nl80211_data *drv = bss->drv;
407 	int ret = -1;
408 	struct nl_msg *msg;
409 	size_t i;
410 
411 	wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: sched_scan request");
412 
413 #ifdef ANDROID
414 	if (!drv->capa.sched_scan_supported)
415 		return android_pno_start(bss, params);
416 #endif /* ANDROID */
417 
418 	if (!params->sched_scan_plans_num ||
419 	    params->sched_scan_plans_num > drv->capa.max_sched_scan_plans) {
420 		wpa_printf(MSG_ERROR,
421 			   "nl80211: Invalid number of sched scan plans: %u",
422 			   params->sched_scan_plans_num);
423 		return -1;
424 	}
425 
426 	msg = nl80211_scan_common(bss, NL80211_CMD_START_SCHED_SCAN, params);
427 	if (!msg)
428 		goto fail;
429 
430 	if (drv->capa.max_sched_scan_plan_iterations) {
431 		if (nl80211_sched_scan_add_scan_plans(drv, msg, params))
432 			goto fail;
433 	} else {
434 		if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
435 				params->sched_scan_plans[0].interval * 1000))
436 			goto fail;
437 	}
438 
439 	if ((drv->num_filter_ssids &&
440 	    (int) drv->num_filter_ssids <= drv->capa.max_match_sets) ||
441 	    params->filter_rssi) {
442 		struct nlattr *match_sets;
443 		match_sets = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
444 		if (match_sets == NULL)
445 			goto fail;
446 
447 		for (i = 0; i < drv->num_filter_ssids; i++) {
448 			struct nlattr *match_set_ssid;
449 			wpa_hexdump_ascii(MSG_MSGDUMP,
450 					  "nl80211: Sched scan filter SSID",
451 					  drv->filter_ssids[i].ssid,
452 					  drv->filter_ssids[i].ssid_len);
453 
454 			match_set_ssid = nla_nest_start(msg, i + 1);
455 			if (match_set_ssid == NULL ||
456 			    nla_put(msg, NL80211_ATTR_SCHED_SCAN_MATCH_SSID,
457 				    drv->filter_ssids[i].ssid_len,
458 				    drv->filter_ssids[i].ssid) ||
459 			    (params->filter_rssi &&
460 			     nla_put_u32(msg,
461 					 NL80211_SCHED_SCAN_MATCH_ATTR_RSSI,
462 					 params->filter_rssi)))
463 				goto fail;
464 
465 			nla_nest_end(msg, match_set_ssid);
466 		}
467 
468 		/*
469 		 * Due to backward compatibility code, newer kernels treat this
470 		 * matchset (with only an RSSI filter) as the default for all
471 		 * other matchsets, unless it's the only one, in which case the
472 		 * matchset will actually allow all SSIDs above the RSSI.
473 		 */
474 		if (params->filter_rssi) {
475 			struct nlattr *match_set_rssi;
476 			match_set_rssi = nla_nest_start(msg, 0);
477 			if (match_set_rssi == NULL ||
478 			    nla_put_u32(msg, NL80211_SCHED_SCAN_MATCH_ATTR_RSSI,
479 					params->filter_rssi))
480 				goto fail;
481 			wpa_printf(MSG_MSGDUMP,
482 				   "nl80211: Sched scan RSSI filter %d dBm",
483 				   params->filter_rssi);
484 			nla_nest_end(msg, match_set_rssi);
485 		}
486 
487 		nla_nest_end(msg, match_sets);
488 	}
489 
490 	ret = send_and_recv_msgs(drv, msg, NULL, NULL);
491 
492 	/* TODO: if we get an error here, we should fall back to normal scan */
493 
494 	msg = NULL;
495 	if (ret) {
496 		wpa_printf(MSG_DEBUG, "nl80211: Sched scan start failed: "
497 			   "ret=%d (%s)", ret, strerror(-ret));
498 		goto fail;
499 	}
500 
501 	wpa_printf(MSG_DEBUG, "nl80211: Sched scan requested (ret=%d)", ret);
502 
503 fail:
504 	nlmsg_free(msg);
505 	return ret;
506 }
507 
508 
509 /**
510  * wpa_driver_nl80211_stop_sched_scan - Stop a scheduled scan
511  * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
512  * Returns: 0 on success, -1 on failure or if not supported
513  */
wpa_driver_nl80211_stop_sched_scan(void * priv)514 int wpa_driver_nl80211_stop_sched_scan(void *priv)
515 {
516 	struct i802_bss *bss = priv;
517 	struct wpa_driver_nl80211_data *drv = bss->drv;
518 	int ret;
519 	struct nl_msg *msg;
520 
521 #ifdef ANDROID
522 	if (!drv->capa.sched_scan_supported)
523 		return android_pno_stop(bss);
524 #endif /* ANDROID */
525 
526 	msg = nl80211_drv_msg(drv, 0, NL80211_CMD_STOP_SCHED_SCAN);
527 	ret = send_and_recv_msgs(drv, msg, NULL, NULL);
528 	if (ret) {
529 		wpa_printf(MSG_DEBUG,
530 			   "nl80211: Sched scan stop failed: ret=%d (%s)",
531 			   ret, strerror(-ret));
532 	} else {
533 		wpa_printf(MSG_DEBUG,
534 			   "nl80211: Sched scan stop sent");
535 	}
536 
537 	return ret;
538 }
539 
540 
nl80211_scan_filtered(struct wpa_driver_nl80211_data * drv,const u8 * ie,size_t ie_len)541 static int nl80211_scan_filtered(struct wpa_driver_nl80211_data *drv,
542 				 const u8 *ie, size_t ie_len)
543 {
544 	const u8 *ssid;
545 	size_t i;
546 
547 	if (drv->filter_ssids == NULL)
548 		return 0;
549 
550 	ssid = get_ie(ie, ie_len, WLAN_EID_SSID);
551 	if (ssid == NULL)
552 		return 1;
553 
554 	for (i = 0; i < drv->num_filter_ssids; i++) {
555 		if (ssid[1] == drv->filter_ssids[i].ssid_len &&
556 		    os_memcmp(ssid + 2, drv->filter_ssids[i].ssid, ssid[1]) ==
557 		    0)
558 			return 0;
559 	}
560 
561 	return 1;
562 }
563 
564 
bss_info_handler(struct nl_msg * msg,void * arg)565 int bss_info_handler(struct nl_msg *msg, void *arg)
566 {
567 	struct nlattr *tb[NL80211_ATTR_MAX + 1];
568 	struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
569 	struct nlattr *bss[NL80211_BSS_MAX + 1];
570 	static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = {
571 		[NL80211_BSS_BSSID] = { .type = NLA_UNSPEC },
572 		[NL80211_BSS_FREQUENCY] = { .type = NLA_U32 },
573 		[NL80211_BSS_TSF] = { .type = NLA_U64 },
574 		[NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 },
575 		[NL80211_BSS_CAPABILITY] = { .type = NLA_U16 },
576 		[NL80211_BSS_INFORMATION_ELEMENTS] = { .type = NLA_UNSPEC },
577 		[NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 },
578 		[NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 },
579 		[NL80211_BSS_STATUS] = { .type = NLA_U32 },
580 		[NL80211_BSS_SEEN_MS_AGO] = { .type = NLA_U32 },
581 		[NL80211_BSS_BEACON_IES] = { .type = NLA_UNSPEC },
582 	};
583 	struct nl80211_bss_info_arg *_arg = arg;
584 	struct wpa_scan_results *res = _arg->res;
585 	struct wpa_scan_res **tmp;
586 	struct wpa_scan_res *r;
587 	const u8 *ie, *beacon_ie;
588 	size_t ie_len, beacon_ie_len;
589 	u8 *pos;
590 	size_t i;
591 
592 	nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
593 		  genlmsg_attrlen(gnlh, 0), NULL);
594 	if (!tb[NL80211_ATTR_BSS])
595 		return NL_SKIP;
596 	if (nla_parse_nested(bss, NL80211_BSS_MAX, tb[NL80211_ATTR_BSS],
597 			     bss_policy))
598 		return NL_SKIP;
599 	if (bss[NL80211_BSS_STATUS]) {
600 		enum nl80211_bss_status status;
601 		status = nla_get_u32(bss[NL80211_BSS_STATUS]);
602 		if (status == NL80211_BSS_STATUS_ASSOCIATED &&
603 		    bss[NL80211_BSS_FREQUENCY]) {
604 			_arg->assoc_freq =
605 				nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
606 			wpa_printf(MSG_DEBUG, "nl80211: Associated on %u MHz",
607 				   _arg->assoc_freq);
608 		}
609 		if (status == NL80211_BSS_STATUS_IBSS_JOINED &&
610 		    bss[NL80211_BSS_FREQUENCY]) {
611 			_arg->ibss_freq =
612 				nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
613 			wpa_printf(MSG_DEBUG, "nl80211: IBSS-joined on %u MHz",
614 				   _arg->ibss_freq);
615 		}
616 		if (status == NL80211_BSS_STATUS_ASSOCIATED &&
617 		    bss[NL80211_BSS_BSSID]) {
618 			os_memcpy(_arg->assoc_bssid,
619 				  nla_data(bss[NL80211_BSS_BSSID]), ETH_ALEN);
620 			wpa_printf(MSG_DEBUG, "nl80211: Associated with "
621 				   MACSTR, MAC2STR(_arg->assoc_bssid));
622 		}
623 	}
624 	if (!res)
625 		return NL_SKIP;
626 	if (bss[NL80211_BSS_INFORMATION_ELEMENTS]) {
627 		ie = nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
628 		ie_len = nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
629 	} else {
630 		ie = NULL;
631 		ie_len = 0;
632 	}
633 	if (bss[NL80211_BSS_BEACON_IES]) {
634 		beacon_ie = nla_data(bss[NL80211_BSS_BEACON_IES]);
635 		beacon_ie_len = nla_len(bss[NL80211_BSS_BEACON_IES]);
636 	} else {
637 		beacon_ie = NULL;
638 		beacon_ie_len = 0;
639 	}
640 
641 	if (nl80211_scan_filtered(_arg->drv, ie ? ie : beacon_ie,
642 				  ie ? ie_len : beacon_ie_len))
643 		return NL_SKIP;
644 
645 	r = os_zalloc(sizeof(*r) + ie_len + beacon_ie_len);
646 	if (r == NULL)
647 		return NL_SKIP;
648 	if (bss[NL80211_BSS_BSSID])
649 		os_memcpy(r->bssid, nla_data(bss[NL80211_BSS_BSSID]),
650 			  ETH_ALEN);
651 	if (bss[NL80211_BSS_FREQUENCY])
652 		r->freq = nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
653 	if (bss[NL80211_BSS_BEACON_INTERVAL])
654 		r->beacon_int = nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]);
655 	if (bss[NL80211_BSS_CAPABILITY])
656 		r->caps = nla_get_u16(bss[NL80211_BSS_CAPABILITY]);
657 	r->flags |= WPA_SCAN_NOISE_INVALID;
658 	if (bss[NL80211_BSS_SIGNAL_MBM]) {
659 		r->level = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]);
660 		r->level /= 100; /* mBm to dBm */
661 		r->flags |= WPA_SCAN_LEVEL_DBM | WPA_SCAN_QUAL_INVALID;
662 	} else if (bss[NL80211_BSS_SIGNAL_UNSPEC]) {
663 		r->level = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]);
664 		r->flags |= WPA_SCAN_QUAL_INVALID;
665 	} else
666 		r->flags |= WPA_SCAN_LEVEL_INVALID | WPA_SCAN_QUAL_INVALID;
667 	if (bss[NL80211_BSS_TSF])
668 		r->tsf = nla_get_u64(bss[NL80211_BSS_TSF]);
669 	if (bss[NL80211_BSS_BEACON_TSF]) {
670 		u64 tsf = nla_get_u64(bss[NL80211_BSS_BEACON_TSF]);
671 		if (tsf > r->tsf)
672 			r->tsf = tsf;
673 	}
674 	if (bss[NL80211_BSS_SEEN_MS_AGO])
675 		r->age = nla_get_u32(bss[NL80211_BSS_SEEN_MS_AGO]);
676 	r->ie_len = ie_len;
677 	pos = (u8 *) (r + 1);
678 	if (ie) {
679 		os_memcpy(pos, ie, ie_len);
680 		pos += ie_len;
681 	}
682 	r->beacon_ie_len = beacon_ie_len;
683 	if (beacon_ie)
684 		os_memcpy(pos, beacon_ie, beacon_ie_len);
685 
686 	if (bss[NL80211_BSS_STATUS]) {
687 		enum nl80211_bss_status status;
688 		status = nla_get_u32(bss[NL80211_BSS_STATUS]);
689 		switch (status) {
690 		case NL80211_BSS_STATUS_ASSOCIATED:
691 			r->flags |= WPA_SCAN_ASSOCIATED;
692 			break;
693 		default:
694 			break;
695 		}
696 	}
697 
698 	/*
699 	 * cfg80211 maintains separate BSS table entries for APs if the same
700 	 * BSSID,SSID pair is seen on multiple channels. wpa_supplicant does
701 	 * not use frequency as a separate key in the BSS table, so filter out
702 	 * duplicated entries. Prefer associated BSS entry in such a case in
703 	 * order to get the correct frequency into the BSS table. Similarly,
704 	 * prefer newer entries over older.
705 	 */
706 	for (i = 0; i < res->num; i++) {
707 		const u8 *s1, *s2;
708 		if (os_memcmp(res->res[i]->bssid, r->bssid, ETH_ALEN) != 0)
709 			continue;
710 
711 		s1 = get_ie((u8 *) (res->res[i] + 1),
712 			    res->res[i]->ie_len, WLAN_EID_SSID);
713 		s2 = get_ie((u8 *) (r + 1), r->ie_len, WLAN_EID_SSID);
714 		if (s1 == NULL || s2 == NULL || s1[1] != s2[1] ||
715 		    os_memcmp(s1, s2, 2 + s1[1]) != 0)
716 			continue;
717 
718 		/* Same BSSID,SSID was already included in scan results */
719 		wpa_printf(MSG_DEBUG, "nl80211: Remove duplicated scan result "
720 			   "for " MACSTR, MAC2STR(r->bssid));
721 
722 		if (((r->flags & WPA_SCAN_ASSOCIATED) &&
723 		     !(res->res[i]->flags & WPA_SCAN_ASSOCIATED)) ||
724 		    r->age < res->res[i]->age) {
725 			os_free(res->res[i]);
726 			res->res[i] = r;
727 		} else
728 			os_free(r);
729 		return NL_SKIP;
730 	}
731 
732 	tmp = os_realloc_array(res->res, res->num + 1,
733 			       sizeof(struct wpa_scan_res *));
734 	if (tmp == NULL) {
735 		os_free(r);
736 		return NL_SKIP;
737 	}
738 	tmp[res->num++] = r;
739 	res->res = tmp;
740 
741 	return NL_SKIP;
742 }
743 
744 
clear_state_mismatch(struct wpa_driver_nl80211_data * drv,const u8 * addr)745 static void clear_state_mismatch(struct wpa_driver_nl80211_data *drv,
746 				 const u8 *addr)
747 {
748 	if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) {
749 		wpa_printf(MSG_DEBUG, "nl80211: Clear possible state "
750 			   "mismatch (" MACSTR ")", MAC2STR(addr));
751 		wpa_driver_nl80211_mlme(drv, addr,
752 					NL80211_CMD_DEAUTHENTICATE,
753 					WLAN_REASON_PREV_AUTH_NOT_VALID, 1);
754 	}
755 }
756 
757 
wpa_driver_nl80211_check_bss_status(struct wpa_driver_nl80211_data * drv,struct wpa_scan_results * res)758 static void wpa_driver_nl80211_check_bss_status(
759 	struct wpa_driver_nl80211_data *drv, struct wpa_scan_results *res)
760 {
761 	size_t i;
762 
763 	for (i = 0; i < res->num; i++) {
764 		struct wpa_scan_res *r = res->res[i];
765 
766 		if (r->flags & WPA_SCAN_ASSOCIATED) {
767 			wpa_printf(MSG_DEBUG, "nl80211: Scan results "
768 				   "indicate BSS status with " MACSTR
769 				   " as associated",
770 				   MAC2STR(r->bssid));
771 			if (is_sta_interface(drv->nlmode) &&
772 			    !drv->associated) {
773 				wpa_printf(MSG_DEBUG, "nl80211: Local state "
774 					   "(not associated) does not match "
775 					   "with BSS state");
776 				clear_state_mismatch(drv, r->bssid);
777 			} else if (is_sta_interface(drv->nlmode) &&
778 				   os_memcmp(drv->bssid, r->bssid, ETH_ALEN) !=
779 				   0) {
780 				wpa_printf(MSG_DEBUG, "nl80211: Local state "
781 					   "(associated with " MACSTR ") does "
782 					   "not match with BSS state",
783 					   MAC2STR(drv->bssid));
784 				clear_state_mismatch(drv, r->bssid);
785 				clear_state_mismatch(drv, drv->bssid);
786 			}
787 		}
788 	}
789 }
790 
791 
792 static struct wpa_scan_results *
nl80211_get_scan_results(struct wpa_driver_nl80211_data * drv)793 nl80211_get_scan_results(struct wpa_driver_nl80211_data *drv)
794 {
795 	struct nl_msg *msg;
796 	struct wpa_scan_results *res;
797 	int ret;
798 	struct nl80211_bss_info_arg arg;
799 
800 	res = os_zalloc(sizeof(*res));
801 	if (res == NULL)
802 		return NULL;
803 	if (!(msg = nl80211_cmd_msg(drv->first_bss, NLM_F_DUMP,
804 				    NL80211_CMD_GET_SCAN))) {
805 		wpa_scan_results_free(res);
806 		return NULL;
807 	}
808 
809 	arg.drv = drv;
810 	arg.res = res;
811 	ret = send_and_recv_msgs(drv, msg, bss_info_handler, &arg);
812 	if (ret == 0) {
813 		wpa_printf(MSG_DEBUG, "nl80211: Received scan results (%lu "
814 			   "BSSes)", (unsigned long) res->num);
815 		nl80211_get_noise_for_scan_results(drv, res);
816 		return res;
817 	}
818 	wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d "
819 		   "(%s)", ret, strerror(-ret));
820 	wpa_scan_results_free(res);
821 	return NULL;
822 }
823 
824 
825 /**
826  * wpa_driver_nl80211_get_scan_results - Fetch the latest scan results
827  * @priv: Pointer to private wext data from wpa_driver_nl80211_init()
828  * Returns: Scan results on success, -1 on failure
829  */
wpa_driver_nl80211_get_scan_results(void * priv)830 struct wpa_scan_results * wpa_driver_nl80211_get_scan_results(void *priv)
831 {
832 	struct i802_bss *bss = priv;
833 	struct wpa_driver_nl80211_data *drv = bss->drv;
834 	struct wpa_scan_results *res;
835 
836 	res = nl80211_get_scan_results(drv);
837 	if (res)
838 		wpa_driver_nl80211_check_bss_status(drv, res);
839 	return res;
840 }
841 
842 
nl80211_dump_scan(struct wpa_driver_nl80211_data * drv)843 void nl80211_dump_scan(struct wpa_driver_nl80211_data *drv)
844 {
845 	struct wpa_scan_results *res;
846 	size_t i;
847 
848 	res = nl80211_get_scan_results(drv);
849 	if (res == NULL) {
850 		wpa_printf(MSG_DEBUG, "nl80211: Failed to get scan results");
851 		return;
852 	}
853 
854 	wpa_printf(MSG_DEBUG, "nl80211: Scan result dump");
855 	for (i = 0; i < res->num; i++) {
856 		struct wpa_scan_res *r = res->res[i];
857 		wpa_printf(MSG_DEBUG, "nl80211: %d/%d " MACSTR "%s",
858 			   (int) i, (int) res->num, MAC2STR(r->bssid),
859 			   r->flags & WPA_SCAN_ASSOCIATED ? " [assoc]" : "");
860 	}
861 
862 	wpa_scan_results_free(res);
863 }
864 
865 
wpa_driver_nl80211_abort_scan(void * priv)866 int wpa_driver_nl80211_abort_scan(void *priv)
867 {
868 	struct i802_bss *bss = priv;
869 	struct wpa_driver_nl80211_data *drv = bss->drv;
870 	int ret;
871 	struct nl_msg *msg;
872 
873 	wpa_printf(MSG_DEBUG, "nl80211: Abort scan");
874 	msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_ABORT_SCAN);
875 	ret = send_and_recv_msgs(drv, msg, NULL, NULL);
876 	if (ret) {
877 		wpa_printf(MSG_DEBUG, "nl80211: Abort scan failed: ret=%d (%s)",
878 			   ret, strerror(-ret));
879 	}
880 
881 	return ret;
882 }
883 
884 
885 #ifdef CONFIG_DRIVER_NL80211_QCA
886 
scan_cookie_handler(struct nl_msg * msg,void * arg)887 static int scan_cookie_handler(struct nl_msg *msg, void *arg)
888 {
889 	struct nlattr *tb[NL80211_ATTR_MAX + 1];
890 	struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
891 	u64 *cookie = arg;
892 
893 	nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
894 		  genlmsg_attrlen(gnlh, 0), NULL);
895 
896 	if (tb[NL80211_ATTR_VENDOR_DATA]) {
897 		struct nlattr *nl_vendor = tb[NL80211_ATTR_VENDOR_DATA];
898 		struct nlattr *tb_vendor[QCA_WLAN_VENDOR_ATTR_SCAN_MAX + 1];
899 
900 		nla_parse(tb_vendor, QCA_WLAN_VENDOR_ATTR_SCAN_MAX,
901 			  nla_data(nl_vendor), nla_len(nl_vendor), NULL);
902 
903 		if (tb_vendor[QCA_WLAN_VENDOR_ATTR_SCAN_COOKIE])
904 			*cookie = nla_get_u64(
905 				tb_vendor[QCA_WLAN_VENDOR_ATTR_SCAN_COOKIE]);
906 	}
907 
908 	return NL_SKIP;
909 }
910 
911 
912 /**
913  * wpa_driver_nl80211_vendor_scan - Request the driver to initiate a vendor scan
914  * @bss: Pointer to private driver data from wpa_driver_nl80211_init()
915  * @params: Scan parameters
916  * Returns: 0 on success, -1 on failure
917  */
wpa_driver_nl80211_vendor_scan(struct i802_bss * bss,struct wpa_driver_scan_params * params)918 int wpa_driver_nl80211_vendor_scan(struct i802_bss *bss,
919 				   struct wpa_driver_scan_params *params)
920 {
921 	struct wpa_driver_nl80211_data *drv = bss->drv;
922 	struct nl_msg *msg = NULL;
923 	struct nlattr *attr;
924 	size_t i;
925 	u32 scan_flags = 0;
926 	int ret = -1;
927 	u64 cookie = 0;
928 
929 	wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: vendor scan request");
930 	drv->scan_for_auth = 0;
931 
932 	if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
933 	    nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
934 	    nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
935 			QCA_NL80211_VENDOR_SUBCMD_TRIGGER_SCAN) )
936 		goto fail;
937 
938 	attr = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
939 	if (attr == NULL)
940 		goto fail;
941 
942 	if (params->num_ssids) {
943 		struct nlattr *ssids;
944 
945 		ssids = nla_nest_start(msg, QCA_WLAN_VENDOR_ATTR_SCAN_SSIDS);
946 		if (ssids == NULL)
947 			goto fail;
948 		for (i = 0; i < params->num_ssids; i++) {
949 			wpa_hexdump_ascii(MSG_MSGDUMP, "nl80211: Scan SSID",
950 					params->ssids[i].ssid,
951 					params->ssids[i].ssid_len);
952 			if (nla_put(msg, i + 1, params->ssids[i].ssid_len,
953 				    params->ssids[i].ssid))
954 				goto fail;
955 		}
956 		nla_nest_end(msg, ssids);
957 	}
958 
959 	if (params->extra_ies) {
960 		wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan extra IEs",
961 			    params->extra_ies, params->extra_ies_len);
962 		if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_SCAN_IE,
963 			    params->extra_ies_len, params->extra_ies))
964 			goto fail;
965 	}
966 
967 	if (params->freqs) {
968 		struct nlattr *freqs;
969 
970 		freqs = nla_nest_start(msg,
971 				       QCA_WLAN_VENDOR_ATTR_SCAN_FREQUENCIES);
972 		if (freqs == NULL)
973 			goto fail;
974 		for (i = 0; params->freqs[i]; i++) {
975 			wpa_printf(MSG_MSGDUMP,
976 				   "nl80211: Scan frequency %u MHz",
977 				   params->freqs[i]);
978 			if (nla_put_u32(msg, i + 1, params->freqs[i]))
979 				goto fail;
980 		}
981 		nla_nest_end(msg, freqs);
982 	}
983 
984 	os_free(drv->filter_ssids);
985 	drv->filter_ssids = params->filter_ssids;
986 	params->filter_ssids = NULL;
987 	drv->num_filter_ssids = params->num_filter_ssids;
988 
989 	if (params->low_priority && drv->have_low_prio_scan) {
990 		wpa_printf(MSG_DEBUG,
991 			   "nl80211: Add NL80211_SCAN_FLAG_LOW_PRIORITY");
992 		scan_flags |= NL80211_SCAN_FLAG_LOW_PRIORITY;
993 	}
994 
995 	if (params->mac_addr_rand) {
996 		wpa_printf(MSG_DEBUG,
997 			   "nl80211: Add NL80211_SCAN_FLAG_RANDOM_ADDR");
998 		scan_flags |= NL80211_SCAN_FLAG_RANDOM_ADDR;
999 
1000 		if (params->mac_addr) {
1001 			wpa_printf(MSG_DEBUG, "nl80211: MAC address: " MACSTR,
1002 				   MAC2STR(params->mac_addr));
1003 			if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_SCAN_MAC,
1004 				    ETH_ALEN, params->mac_addr))
1005 				goto fail;
1006 		}
1007 
1008 		if (params->mac_addr_mask) {
1009 			wpa_printf(MSG_DEBUG, "nl80211: MAC address mask: "
1010 				   MACSTR, MAC2STR(params->mac_addr_mask));
1011 			if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_SCAN_MAC_MASK,
1012 				    ETH_ALEN, params->mac_addr_mask))
1013 				goto fail;
1014 		}
1015 	}
1016 
1017 	if (scan_flags &&
1018 	    nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, scan_flags))
1019 		goto fail;
1020 
1021 	if (params->p2p_probe) {
1022 		struct nlattr *rates;
1023 
1024 		wpa_printf(MSG_DEBUG, "nl80211: P2P probe - mask SuppRates");
1025 
1026 		rates = nla_nest_start(msg,
1027 				       QCA_WLAN_VENDOR_ATTR_SCAN_SUPP_RATES);
1028 		if (rates == NULL)
1029 			goto fail;
1030 
1031 		/*
1032 		 * Remove 2.4 GHz rates 1, 2, 5.5, 11 Mbps from supported rates
1033 		 * by masking out everything else apart from the OFDM rates 6,
1034 		 * 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS rates. All 5 GHz
1035 		 * rates are left enabled.
1036 		 */
1037 		if (nla_put(msg, NL80211_BAND_2GHZ, 8,
1038 			    "\x0c\x12\x18\x24\x30\x48\x60\x6c"))
1039 			goto fail;
1040 		nla_nest_end(msg, rates);
1041 
1042 		if (nla_put_flag(msg, QCA_WLAN_VENDOR_ATTR_SCAN_TX_NO_CCK_RATE))
1043 			goto fail;
1044 	}
1045 
1046 	nla_nest_end(msg, attr);
1047 
1048 	ret = send_and_recv_msgs(drv, msg, scan_cookie_handler, &cookie);
1049 	msg = NULL;
1050 	if (ret) {
1051 		wpa_printf(MSG_DEBUG,
1052 			   "nl80211: Vendor scan trigger failed: ret=%d (%s)",
1053 			   ret, strerror(-ret));
1054 		goto fail;
1055 	}
1056 
1057 	drv->vendor_scan_cookie = cookie;
1058 	drv->scan_state = SCAN_REQUESTED;
1059 
1060 	wpa_printf(MSG_DEBUG,
1061 		   "nl80211: Vendor scan requested (ret=%d) - scan timeout 30 seconds, scan cookie:0x%llx",
1062 		   ret, (long long unsigned int) cookie);
1063 	eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
1064 	eloop_register_timeout(30, 0, wpa_driver_nl80211_scan_timeout,
1065 			       drv, drv->ctx);
1066 	drv->last_scan_cmd = NL80211_CMD_VENDOR;
1067 
1068 fail:
1069 	nlmsg_free(msg);
1070 	return ret;
1071 }
1072 
1073 #endif /* CONFIG_DRIVER_NL80211_QCA */
1074