1 /* 2 * Driver interaction with Linux nl80211/cfg80211 - Scanning 3 * Copyright(c) 2015 Intel Deutschland GmbH 4 * Copyright (c) 2002-2014, Jouni Malinen <j (at) w1.fi> 5 * Copyright (c) 2007, Johannes Berg <johannes (at) sipsolutions.net> 6 * Copyright (c) 2009-2010, Atheros Communications 7 * 8 * This software may be distributed under the terms of the BSD license. 9 * See README for more details. 10 */ 11 12 #include "includes.h" 13 #include <time.h> 14 #include <netlink/genl/genl.h> 15 16 #include "utils/common.h" 17 #include "utils/eloop.h" 18 #include "common/ieee802_11_defs.h" 19 #include "common/ieee802_11_common.h" 20 #include "common/qca-vendor.h" 21 #include "driver_nl80211.h" 22 23 24 #define MAX_NL80211_NOISE_FREQS 100 25 26 struct nl80211_noise_info { 27 u32 freq[MAX_NL80211_NOISE_FREQS]; 28 s8 noise[MAX_NL80211_NOISE_FREQS]; 29 unsigned int count; 30 }; 31 32 static int get_noise_for_scan_results(struct nl_msg *msg, void *arg) 33 { 34 struct nlattr *tb[NL80211_ATTR_MAX + 1]; 35 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg)); 36 struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1]; 37 static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = { 38 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 }, 39 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 }, 40 }; 41 struct nl80211_noise_info *info = arg; 42 43 if (info->count >= MAX_NL80211_NOISE_FREQS) 44 return NL_SKIP; 45 46 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0), 47 genlmsg_attrlen(gnlh, 0), NULL); 48 49 if (!tb[NL80211_ATTR_SURVEY_INFO]) { 50 wpa_printf(MSG_DEBUG, "nl80211: Survey data missing"); 51 return NL_SKIP; 52 } 53 54 if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX, 55 tb[NL80211_ATTR_SURVEY_INFO], 56 survey_policy)) { 57 wpa_printf(MSG_DEBUG, "nl80211: Failed to parse nested " 58 "attributes"); 59 return NL_SKIP; 60 } 61 62 if (!sinfo[NL80211_SURVEY_INFO_NOISE]) 63 return NL_SKIP; 64 65 if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY]) 66 return NL_SKIP; 67 68 info->freq[info->count] = 69 nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]); 70 info->noise[info->count] = 71 (s8) nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]); 72 info->count++; 73 74 return NL_SKIP; 75 } 76 77 78 static int nl80211_get_noise_for_scan_results( 79 struct wpa_driver_nl80211_data *drv, struct nl80211_noise_info *info) 80 { 81 struct nl_msg *msg; 82 83 os_memset(info, 0, sizeof(*info)); 84 msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_GET_SURVEY); 85 return send_and_recv_resp(drv, msg, get_noise_for_scan_results, info); 86 } 87 88 89 static int nl80211_abort_scan(struct i802_bss *bss) 90 { 91 int ret; 92 struct nl_msg *msg; 93 struct wpa_driver_nl80211_data *drv = bss->drv; 94 95 wpa_printf(MSG_DEBUG, "nl80211: Abort scan"); 96 msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_ABORT_SCAN); 97 ret = send_and_recv_cmd(drv, msg); 98 if (ret) { 99 wpa_printf(MSG_DEBUG, "nl80211: Abort scan failed: ret=%d (%s)", 100 ret, strerror(-ret)); 101 } 102 return ret; 103 } 104 105 106 #ifdef CONFIG_DRIVER_NL80211_QCA 107 static int nl80211_abort_vendor_scan(struct wpa_driver_nl80211_data *drv, 108 u64 scan_cookie) 109 { 110 struct nl_msg *msg; 111 struct nlattr *params; 112 int ret; 113 114 wpa_printf(MSG_DEBUG, "nl80211: Abort vendor scan with cookie 0x%llx", 115 (long long unsigned int) scan_cookie); 116 117 msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR); 118 if (!msg || 119 nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) || 120 nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, 121 QCA_NL80211_VENDOR_SUBCMD_ABORT_SCAN) || 122 !(params = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA)) || 123 nla_put_u64(msg, QCA_WLAN_VENDOR_ATTR_SCAN_COOKIE, scan_cookie)) 124 goto fail; 125 126 nla_nest_end(msg, params); 127 128 ret = send_and_recv_cmd(drv, msg); 129 msg = NULL; 130 if (ret) { 131 wpa_printf(MSG_INFO, 132 "nl80211: Aborting vendor scan with cookie 0x%llx failed: ret=%d (%s)", 133 (long long unsigned int) scan_cookie, ret, 134 strerror(-ret)); 135 goto fail; 136 } 137 return 0; 138 fail: 139 nlmsg_free(msg); 140 return -1; 141 } 142 #endif /* CONFIG_DRIVER_NL80211_QCA */ 143 144 145 /** 146 * wpa_driver_nl80211_scan_timeout - Scan timeout to report scan completion 147 * @eloop_ctx: Driver private data 148 * @timeout_ctx: ctx argument given to wpa_driver_nl80211_init() 149 * 150 * This function can be used as registered timeout when starting a scan to 151 * generate a scan completed event if the driver does not report this. 152 */ 153 void wpa_driver_nl80211_scan_timeout(void *eloop_ctx, void *timeout_ctx) 154 { 155 struct wpa_driver_nl80211_data *drv = eloop_ctx; 156 157 wpa_printf(MSG_DEBUG, "nl80211: Scan timeout - try to abort it"); 158 #ifdef CONFIG_DRIVER_NL80211_QCA 159 if (drv->vendor_scan_cookie && 160 nl80211_abort_vendor_scan(drv, drv->vendor_scan_cookie) == 0) 161 return; 162 #endif /* CONFIG_DRIVER_NL80211_QCA */ 163 if (!drv->vendor_scan_cookie && 164 nl80211_abort_scan(drv->first_bss) == 0) 165 return; 166 167 wpa_printf(MSG_DEBUG, "nl80211: Failed to abort scan"); 168 169 if (drv->ap_scan_as_station != NL80211_IFTYPE_UNSPECIFIED) 170 nl80211_restore_ap_mode(drv->first_bss); 171 172 wpa_printf(MSG_DEBUG, "nl80211: Try to get scan results"); 173 wpa_supplicant_event(timeout_ctx, EVENT_SCAN_RESULTS, NULL); 174 } 175 176 177 static struct nl_msg * 178 nl80211_scan_common(struct i802_bss *bss, u8 cmd, 179 struct wpa_driver_scan_params *params) 180 { 181 struct wpa_driver_nl80211_data *drv = bss->drv; 182 struct nl_msg *msg; 183 size_t i; 184 u32 scan_flags = 0; 185 186 msg = nl80211_cmd_msg(bss, 0, cmd); 187 if (!msg) 188 return NULL; 189 190 if (params->num_ssids) { 191 struct nlattr *ssids; 192 193 ssids = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS); 194 if (ssids == NULL) 195 goto fail; 196 for (i = 0; i < params->num_ssids; i++) { 197 wpa_printf(MSG_MSGDUMP, "nl80211: Scan SSID %s", 198 wpa_ssid_txt(params->ssids[i].ssid, 199 params->ssids[i].ssid_len)); 200 if (nla_put(msg, i + 1, params->ssids[i].ssid_len, 201 params->ssids[i].ssid)) 202 goto fail; 203 } 204 nla_nest_end(msg, ssids); 205 206 /* 207 * If allowed, scan for 6 GHz APs that are reported by other 208 * APs. Note that if the flag is not set and 6 GHz channels are 209 * to be scanned, it is highly likely that non-PSC channels 210 * would be scanned passively (due to the Probe Request frame 211 * transmission restrictions mandated in IEEE Std 802.11ax-2021, 212 * 26.17.2.3 (Scanning in the 6 GHz band). Passive scanning of 213 * all non-PSC channels would take a significant amount of time. 214 */ 215 if (!params->non_coloc_6ghz) { 216 wpa_printf(MSG_DEBUG, 217 "nl80211: Scan co-located APs on 6 GHz"); 218 scan_flags |= NL80211_SCAN_FLAG_COLOCATED_6GHZ; 219 } 220 } else { 221 wpa_printf(MSG_DEBUG, "nl80211: Passive scan requested"); 222 } 223 224 if (params->extra_ies) { 225 wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan extra IEs", 226 params->extra_ies, params->extra_ies_len); 227 if (nla_put(msg, NL80211_ATTR_IE, params->extra_ies_len, 228 params->extra_ies)) 229 goto fail; 230 } 231 232 if (params->freqs) { 233 struct nlattr *freqs; 234 freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES); 235 if (freqs == NULL) 236 goto fail; 237 for (i = 0; params->freqs[i]; i++) { 238 wpa_printf(MSG_MSGDUMP, "nl80211: Scan frequency %u " 239 "MHz", params->freqs[i]); 240 if (nla_put_u32(msg, i + 1, params->freqs[i])) 241 goto fail; 242 } 243 nla_nest_end(msg, freqs); 244 } 245 246 os_free(drv->filter_ssids); 247 drv->filter_ssids = params->filter_ssids; 248 params->filter_ssids = NULL; 249 drv->num_filter_ssids = params->num_filter_ssids; 250 251 if (!drv->hostapd && is_ap_interface(drv->nlmode)) { 252 wpa_printf(MSG_DEBUG, "nl80211: Add NL80211_SCAN_FLAG_AP"); 253 scan_flags |= NL80211_SCAN_FLAG_AP; 254 } 255 256 if (params->only_new_results) { 257 wpa_printf(MSG_DEBUG, "nl80211: Add NL80211_SCAN_FLAG_FLUSH"); 258 scan_flags |= NL80211_SCAN_FLAG_FLUSH; 259 } 260 261 if (params->low_priority && drv->have_low_prio_scan) { 262 wpa_printf(MSG_DEBUG, 263 "nl80211: Add NL80211_SCAN_FLAG_LOW_PRIORITY"); 264 scan_flags |= NL80211_SCAN_FLAG_LOW_PRIORITY; 265 } 266 267 if (params->mac_addr_rand) { 268 wpa_printf(MSG_DEBUG, 269 "nl80211: Add NL80211_SCAN_FLAG_RANDOM_ADDR"); 270 scan_flags |= NL80211_SCAN_FLAG_RANDOM_ADDR; 271 272 if (params->mac_addr) { 273 wpa_printf(MSG_DEBUG, "nl80211: MAC address: " MACSTR, 274 MAC2STR(params->mac_addr)); 275 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, 276 params->mac_addr)) 277 goto fail; 278 } 279 280 if (params->mac_addr_mask) { 281 wpa_printf(MSG_DEBUG, "nl80211: MAC address mask: " 282 MACSTR, MAC2STR(params->mac_addr_mask)); 283 if (nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN, 284 params->mac_addr_mask)) 285 goto fail; 286 } 287 } 288 289 if (params->duration) { 290 if (!(drv->capa.rrm_flags & 291 WPA_DRIVER_FLAGS_SUPPORT_SET_SCAN_DWELL) || 292 nla_put_u16(msg, NL80211_ATTR_MEASUREMENT_DURATION, 293 params->duration)) 294 goto fail; 295 296 if (params->duration_mandatory && 297 nla_put_flag(msg, 298 NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY)) 299 goto fail; 300 } 301 302 if (params->oce_scan) { 303 wpa_printf(MSG_DEBUG, 304 "nl80211: Add NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME"); 305 wpa_printf(MSG_DEBUG, 306 "nl80211: Add NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP"); 307 wpa_printf(MSG_DEBUG, 308 "nl80211: Add NL80211_SCAN_FLAG_OCE_PROBE_REQ_MIN_TX_RATE"); 309 wpa_printf(MSG_DEBUG, 310 "nl80211: Add NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION"); 311 scan_flags |= NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME | 312 NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP | 313 NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE | 314 NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION; 315 } 316 317 if (params->min_probe_req_content) { 318 if (drv->capa.flags2 & WPA_DRIVER_FLAGS2_SCAN_MIN_PREQ) 319 scan_flags |= NL80211_SCAN_FLAG_MIN_PREQ_CONTENT; 320 else 321 wpa_printf(MSG_DEBUG, 322 "nl80211: NL80211_SCAN_FLAG_MIN_PREQ_CONTENT not supported"); 323 } 324 325 if (scan_flags && 326 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, scan_flags)) 327 goto fail; 328 329 return msg; 330 331 fail: 332 nlmsg_free(msg); 333 return NULL; 334 } 335 336 337 /** 338 * wpa_driver_nl80211_scan - Request the driver to initiate scan 339 * @bss: Pointer to private driver data from wpa_driver_nl80211_init() 340 * @params: Scan parameters 341 * Returns: 0 on success, -1 on failure 342 */ 343 int wpa_driver_nl80211_scan(struct i802_bss *bss, 344 struct wpa_driver_scan_params *params) 345 { 346 struct wpa_driver_nl80211_data *drv = bss->drv; 347 int ret = -1, timeout; 348 struct nl_msg *msg = NULL; 349 350 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: scan request"); 351 drv->scan_for_auth = 0; 352 353 if (TEST_FAIL()) 354 return -1; 355 356 msg = nl80211_scan_common(bss, NL80211_CMD_TRIGGER_SCAN, params); 357 if (!msg) 358 return -1; 359 360 if (params->p2p_probe) { 361 struct nlattr *rates; 362 363 wpa_printf(MSG_DEBUG, "nl80211: P2P probe - mask SuppRates"); 364 365 rates = nla_nest_start(msg, NL80211_ATTR_SCAN_SUPP_RATES); 366 if (rates == NULL) 367 goto fail; 368 369 /* 370 * Remove 2.4 GHz rates 1, 2, 5.5, 11 Mbps from supported rates 371 * by masking out everything else apart from the OFDM rates 6, 372 * 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS rates. All 5 GHz 373 * rates are left enabled. 374 */ 375 if (nla_put(msg, NL80211_BAND_2GHZ, 8, 376 "\x0c\x12\x18\x24\x30\x48\x60\x6c")) 377 goto fail; 378 nla_nest_end(msg, rates); 379 380 if (nla_put_flag(msg, NL80211_ATTR_TX_NO_CCK_RATE)) 381 goto fail; 382 } 383 384 if (params->bssid) { 385 wpa_printf(MSG_DEBUG, "nl80211: Scan for a specific BSSID: " 386 MACSTR, MAC2STR(params->bssid)); 387 if (nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid)) 388 goto fail; 389 /* NL80211_ATTR_MAC was used for this purpose initially and the 390 * NL80211_ATTR_BSSID was added in 2016 when MAC address 391 * randomization was added. For compatibility with older kernel 392 * versions, add the NL80211_ATTR_MAC attribute as well when 393 * the conflicting functionality is not in use. */ 394 if (!params->mac_addr_rand && 395 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid)) 396 goto fail; 397 } 398 399 ret = send_and_recv_cmd(drv, msg); 400 msg = NULL; 401 if (ret) { 402 wpa_printf(MSG_DEBUG, "nl80211: Scan trigger failed: ret=%d " 403 "(%s)", ret, strerror(-ret)); 404 if (drv->hostapd && is_ap_interface(drv->nlmode)) { 405 /* 406 * mac80211 does not allow scan requests in AP mode, so 407 * try to do this in station mode. 408 */ 409 drv->ap_scan_as_station = drv->nlmode; 410 if (wpa_driver_nl80211_set_mode( 411 bss, NL80211_IFTYPE_STATION) || 412 wpa_driver_nl80211_scan(bss, params)) { 413 nl80211_restore_ap_mode(bss); 414 goto fail; 415 } 416 417 ret = 0; 418 } else 419 goto fail; 420 } 421 422 drv->scan_state = SCAN_REQUESTED; 423 /* Not all drivers generate "scan completed" wireless event, so try to 424 * read results after a timeout. */ 425 timeout = drv->uses_6ghz ? 20 : 10; 426 if (drv->uses_s1g) 427 timeout += 5; 428 if (drv->scan_complete_events) { 429 /* 430 * The driver seems to deliver events to notify when scan is 431 * complete, so use longer timeout to avoid race conditions 432 * with scanning and following association request. 433 */ 434 timeout = 30; 435 } 436 wpa_printf(MSG_DEBUG, "Scan requested (ret=%d) - scan timeout %d " 437 "seconds", ret, timeout); 438 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx); 439 eloop_register_timeout(timeout, 0, wpa_driver_nl80211_scan_timeout, 440 drv, drv->ctx); 441 drv->last_scan_cmd = NL80211_CMD_TRIGGER_SCAN; 442 443 fail: 444 nlmsg_free(msg); 445 return ret; 446 } 447 448 449 static int 450 nl80211_sched_scan_add_scan_plans(struct wpa_driver_nl80211_data *drv, 451 struct nl_msg *msg, 452 struct wpa_driver_scan_params *params) 453 { 454 struct nlattr *plans; 455 struct sched_scan_plan *scan_plans = params->sched_scan_plans; 456 unsigned int i; 457 458 plans = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_PLANS); 459 if (!plans) 460 return -1; 461 462 for (i = 0; i < params->sched_scan_plans_num; i++) { 463 struct nlattr *plan = nla_nest_start(msg, i + 1); 464 465 if (!plan) 466 return -1; 467 468 if (!scan_plans[i].interval || 469 scan_plans[i].interval > 470 drv->capa.max_sched_scan_plan_interval) { 471 wpa_printf(MSG_DEBUG, 472 "nl80211: sched scan plan no. %u: Invalid interval: %u", 473 i, scan_plans[i].interval); 474 return -1; 475 } 476 477 if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL, 478 scan_plans[i].interval)) 479 return -1; 480 481 if (scan_plans[i].iterations > 482 drv->capa.max_sched_scan_plan_iterations) { 483 wpa_printf(MSG_DEBUG, 484 "nl80211: sched scan plan no. %u: Invalid number of iterations: %u", 485 i, scan_plans[i].iterations); 486 return -1; 487 } 488 489 if (scan_plans[i].iterations && 490 nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS, 491 scan_plans[i].iterations)) 492 return -1; 493 494 nla_nest_end(msg, plan); 495 496 /* 497 * All the scan plans must specify the number of iterations 498 * except the last plan, which will run infinitely. So if the 499 * number of iterations is not specified, this ought to be the 500 * last scan plan. 501 */ 502 if (!scan_plans[i].iterations) 503 break; 504 } 505 506 if (i != params->sched_scan_plans_num - 1) { 507 wpa_printf(MSG_DEBUG, 508 "nl80211: All sched scan plans but the last must specify number of iterations"); 509 return -1; 510 } 511 512 nla_nest_end(msg, plans); 513 return 0; 514 } 515 516 517 /** 518 * wpa_driver_nl80211_sched_scan - Initiate a scheduled scan 519 * @priv: Pointer to private driver data from wpa_driver_nl80211_init() 520 * @params: Scan parameters 521 * Returns: 0 on success, -1 on failure or if not supported 522 */ 523 int wpa_driver_nl80211_sched_scan(void *priv, 524 struct wpa_driver_scan_params *params) 525 { 526 struct i802_bss *bss = priv; 527 struct wpa_driver_nl80211_data *drv = bss->drv; 528 int ret = -1; 529 struct nl_msg *msg; 530 size_t i; 531 532 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: sched_scan request"); 533 534 #ifdef ANDROID 535 if (!drv->capa.sched_scan_supported) 536 return android_pno_start(bss, params); 537 #endif /* ANDROID */ 538 539 if (!params->sched_scan_plans_num || 540 params->sched_scan_plans_num > drv->capa.max_sched_scan_plans) { 541 wpa_printf(MSG_ERROR, 542 "nl80211: Invalid number of sched scan plans: %u", 543 params->sched_scan_plans_num); 544 return -1; 545 } 546 547 msg = nl80211_scan_common(bss, NL80211_CMD_START_SCHED_SCAN, params); 548 if (!msg) 549 goto fail; 550 551 if (drv->capa.max_sched_scan_plan_iterations) { 552 if (nl80211_sched_scan_add_scan_plans(drv, msg, params)) 553 goto fail; 554 } else { 555 if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL, 556 params->sched_scan_plans[0].interval * 1000)) 557 goto fail; 558 } 559 560 if ((drv->num_filter_ssids && 561 (int) drv->num_filter_ssids <= drv->capa.max_match_sets) || 562 params->filter_rssi) { 563 struct nlattr *match_sets; 564 match_sets = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH); 565 if (match_sets == NULL) 566 goto fail; 567 568 for (i = 0; i < drv->num_filter_ssids; i++) { 569 struct nlattr *match_set_ssid; 570 wpa_printf(MSG_MSGDUMP, 571 "nl80211: Sched scan filter SSID %s", 572 wpa_ssid_txt(drv->filter_ssids[i].ssid, 573 drv->filter_ssids[i].ssid_len)); 574 575 match_set_ssid = nla_nest_start(msg, i + 1); 576 if (match_set_ssid == NULL || 577 nla_put(msg, NL80211_ATTR_SCHED_SCAN_MATCH_SSID, 578 drv->filter_ssids[i].ssid_len, 579 drv->filter_ssids[i].ssid) || 580 (params->filter_rssi && 581 nla_put_u32(msg, 582 NL80211_SCHED_SCAN_MATCH_ATTR_RSSI, 583 params->filter_rssi))) 584 goto fail; 585 586 nla_nest_end(msg, match_set_ssid); 587 } 588 589 /* 590 * Due to backward compatibility code, newer kernels treat this 591 * matchset (with only an RSSI filter) as the default for all 592 * other matchsets, unless it's the only one, in which case the 593 * matchset will actually allow all SSIDs above the RSSI. 594 */ 595 if (params->filter_rssi) { 596 struct nlattr *match_set_rssi; 597 match_set_rssi = nla_nest_start(msg, 0); 598 if (match_set_rssi == NULL || 599 nla_put_u32(msg, NL80211_SCHED_SCAN_MATCH_ATTR_RSSI, 600 params->filter_rssi)) 601 goto fail; 602 wpa_printf(MSG_MSGDUMP, 603 "nl80211: Sched scan RSSI filter %d dBm", 604 params->filter_rssi); 605 nla_nest_end(msg, match_set_rssi); 606 } 607 608 nla_nest_end(msg, match_sets); 609 } 610 611 if (params->relative_rssi_set) { 612 struct nl80211_bss_select_rssi_adjust rssi_adjust; 613 614 os_memset(&rssi_adjust, 0, sizeof(rssi_adjust)); 615 wpa_printf(MSG_DEBUG, "nl80211: Relative RSSI: %d", 616 params->relative_rssi); 617 if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI, 618 params->relative_rssi)) 619 goto fail; 620 621 if (params->relative_adjust_rssi) { 622 int pref_band_set = 1; 623 624 switch (params->relative_adjust_band) { 625 case WPA_SETBAND_5G: 626 rssi_adjust.band = NL80211_BAND_5GHZ; 627 break; 628 case WPA_SETBAND_2G: 629 rssi_adjust.band = NL80211_BAND_2GHZ; 630 break; 631 default: 632 pref_band_set = 0; 633 break; 634 } 635 rssi_adjust.delta = params->relative_adjust_rssi; 636 637 if (pref_band_set && 638 nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST, 639 sizeof(rssi_adjust), &rssi_adjust)) 640 goto fail; 641 } 642 } 643 644 if (params->sched_scan_start_delay && 645 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, 646 params->sched_scan_start_delay)) 647 goto fail; 648 649 ret = send_and_recv_cmd(drv, msg); 650 651 /* TODO: if we get an error here, we should fall back to normal scan */ 652 653 msg = NULL; 654 if (ret) { 655 wpa_printf(MSG_DEBUG, "nl80211: Sched scan start failed: " 656 "ret=%d (%s)", ret, strerror(-ret)); 657 goto fail; 658 } 659 660 wpa_printf(MSG_DEBUG, "nl80211: Sched scan requested (ret=%d)", ret); 661 662 fail: 663 nlmsg_free(msg); 664 return ret; 665 } 666 667 668 /** 669 * wpa_driver_nl80211_stop_sched_scan - Stop a scheduled scan 670 * @priv: Pointer to private driver data from wpa_driver_nl80211_init() 671 * Returns: 0 on success, -1 on failure or if not supported 672 */ 673 int wpa_driver_nl80211_stop_sched_scan(void *priv) 674 { 675 struct i802_bss *bss = priv; 676 struct wpa_driver_nl80211_data *drv = bss->drv; 677 int ret; 678 struct nl_msg *msg; 679 680 #ifdef ANDROID 681 if (!drv->capa.sched_scan_supported) 682 return android_pno_stop(bss); 683 #endif /* ANDROID */ 684 685 msg = nl80211_drv_msg(drv, 0, NL80211_CMD_STOP_SCHED_SCAN); 686 ret = send_and_recv_cmd(drv, msg); 687 if (ret) { 688 wpa_printf(MSG_DEBUG, 689 "nl80211: Sched scan stop failed: ret=%d (%s)", 690 ret, strerror(-ret)); 691 } else { 692 wpa_printf(MSG_DEBUG, 693 "nl80211: Sched scan stop sent"); 694 } 695 696 return ret; 697 } 698 699 700 static int nl80211_scan_filtered(struct wpa_driver_nl80211_data *drv, 701 const u8 *ie, size_t ie_len) 702 { 703 const u8 *ssid; 704 size_t i; 705 706 if (drv->filter_ssids == NULL) 707 return 0; 708 709 ssid = get_ie(ie, ie_len, WLAN_EID_SSID); 710 if (ssid == NULL) 711 return 1; 712 713 for (i = 0; i < drv->num_filter_ssids; i++) { 714 if (ssid[1] == drv->filter_ssids[i].ssid_len && 715 os_memcmp(ssid + 2, drv->filter_ssids[i].ssid, ssid[1]) == 716 0) 717 return 0; 718 } 719 720 return 1; 721 } 722 723 724 static struct wpa_scan_res * 725 nl80211_parse_bss_info(struct wpa_driver_nl80211_data *drv, 726 struct nl_msg *msg, const u8 *bssid) 727 { 728 struct nlattr *tb[NL80211_ATTR_MAX + 1]; 729 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg)); 730 struct nlattr *bss[NL80211_BSS_MAX + 1]; 731 static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = { 732 [NL80211_BSS_BSSID] = { .type = NLA_UNSPEC }, 733 [NL80211_BSS_FREQUENCY] = { .type = NLA_U32 }, 734 [NL80211_BSS_TSF] = { .type = NLA_U64 }, 735 [NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 }, 736 [NL80211_BSS_CAPABILITY] = { .type = NLA_U16 }, 737 [NL80211_BSS_INFORMATION_ELEMENTS] = { .type = NLA_UNSPEC }, 738 [NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 }, 739 [NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 }, 740 [NL80211_BSS_STATUS] = { .type = NLA_U32 }, 741 [NL80211_BSS_SEEN_MS_AGO] = { .type = NLA_U32 }, 742 [NL80211_BSS_BEACON_IES] = { .type = NLA_UNSPEC }, 743 [NL80211_BSS_BEACON_TSF] = { .type = NLA_U64 }, 744 [NL80211_BSS_PARENT_TSF] = { .type = NLA_U64 }, 745 [NL80211_BSS_PARENT_BSSID] = { .type = NLA_UNSPEC }, 746 [NL80211_BSS_LAST_SEEN_BOOTTIME] = { .type = NLA_U64 }, 747 }; 748 struct wpa_scan_res *r; 749 const u8 *ie, *beacon_ie; 750 size_t ie_len, beacon_ie_len; 751 u8 *pos; 752 753 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0), 754 genlmsg_attrlen(gnlh, 0), NULL); 755 if (!tb[NL80211_ATTR_BSS]) 756 return NULL; 757 if (nla_parse_nested(bss, NL80211_BSS_MAX, tb[NL80211_ATTR_BSS], 758 bss_policy)) 759 return NULL; 760 if (bssid && bss[NL80211_BSS_BSSID] && 761 !ether_addr_equal(bssid, nla_data(bss[NL80211_BSS_BSSID]))) 762 return NULL; 763 if (bss[NL80211_BSS_INFORMATION_ELEMENTS]) { 764 ie = nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]); 765 ie_len = nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]); 766 } else { 767 ie = NULL; 768 ie_len = 0; 769 } 770 if (bss[NL80211_BSS_BEACON_IES]) { 771 beacon_ie = nla_data(bss[NL80211_BSS_BEACON_IES]); 772 beacon_ie_len = nla_len(bss[NL80211_BSS_BEACON_IES]); 773 } else { 774 beacon_ie = NULL; 775 beacon_ie_len = 0; 776 } 777 778 if (nl80211_scan_filtered(drv, ie ? ie : beacon_ie, 779 ie ? ie_len : beacon_ie_len)) 780 return NULL; 781 782 r = os_zalloc(sizeof(*r) + ie_len + beacon_ie_len); 783 if (r == NULL) 784 return NULL; 785 if (bss[NL80211_BSS_BSSID]) 786 os_memcpy(r->bssid, nla_data(bss[NL80211_BSS_BSSID]), 787 ETH_ALEN); 788 if (bss[NL80211_BSS_FREQUENCY]) 789 r->freq = nla_get_u32(bss[NL80211_BSS_FREQUENCY]); 790 if (bss[NL80211_BSS_BEACON_INTERVAL]) 791 r->beacon_int = nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]); 792 if (bss[NL80211_BSS_CAPABILITY]) 793 r->caps = nla_get_u16(bss[NL80211_BSS_CAPABILITY]); 794 r->flags |= WPA_SCAN_NOISE_INVALID; 795 if (bss[NL80211_BSS_SIGNAL_MBM]) { 796 r->level = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]); 797 r->level /= 100; /* mBm to dBm */ 798 r->flags |= WPA_SCAN_LEVEL_DBM | WPA_SCAN_QUAL_INVALID; 799 } else if (bss[NL80211_BSS_SIGNAL_UNSPEC]) { 800 r->level = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]); 801 r->flags |= WPA_SCAN_QUAL_INVALID; 802 } else 803 r->flags |= WPA_SCAN_LEVEL_INVALID | WPA_SCAN_QUAL_INVALID; 804 if (bss[NL80211_BSS_TSF]) 805 r->tsf = nla_get_u64(bss[NL80211_BSS_TSF]); 806 if (bss[NL80211_BSS_BEACON_TSF]) { 807 u64 tsf = nla_get_u64(bss[NL80211_BSS_BEACON_TSF]); 808 if (tsf > r->tsf) { 809 r->tsf = tsf; 810 r->beacon_newer = true; 811 } 812 } 813 if (bss[NL80211_BSS_SEEN_MS_AGO]) 814 r->age = nla_get_u32(bss[NL80211_BSS_SEEN_MS_AGO]); 815 if (bss[NL80211_BSS_LAST_SEEN_BOOTTIME]) { 816 u64 boottime; 817 struct timespec ts; 818 819 #ifndef CLOCK_BOOTTIME 820 #define CLOCK_BOOTTIME 7 821 #endif 822 if (clock_gettime(CLOCK_BOOTTIME, &ts) == 0) { 823 /* Use more accurate boottime information to update the 824 * scan result age since the driver reports this and 825 * CLOCK_BOOTTIME is available. */ 826 boottime = nla_get_u64( 827 bss[NL80211_BSS_LAST_SEEN_BOOTTIME]); 828 r->age = ((u64) ts.tv_sec * 1000000000 + 829 ts.tv_nsec - boottime) / 1000000; 830 } 831 } 832 r->ie_len = ie_len; 833 pos = (u8 *) (r + 1); 834 if (ie) { 835 os_memcpy(pos, ie, ie_len); 836 pos += ie_len; 837 } 838 r->beacon_ie_len = beacon_ie_len; 839 if (beacon_ie) 840 os_memcpy(pos, beacon_ie, beacon_ie_len); 841 842 if (bss[NL80211_BSS_STATUS]) { 843 enum nl80211_bss_status status; 844 status = nla_get_u32(bss[NL80211_BSS_STATUS]); 845 switch (status) { 846 case NL80211_BSS_STATUS_ASSOCIATED: 847 r->flags |= WPA_SCAN_ASSOCIATED; 848 break; 849 default: 850 break; 851 } 852 } 853 854 if (bss[NL80211_BSS_PARENT_TSF] && bss[NL80211_BSS_PARENT_BSSID]) { 855 r->parent_tsf = nla_get_u64(bss[NL80211_BSS_PARENT_TSF]); 856 os_memcpy(r->tsf_bssid, nla_data(bss[NL80211_BSS_PARENT_BSSID]), 857 ETH_ALEN); 858 } 859 860 return r; 861 } 862 863 864 struct nl80211_bss_info_arg { 865 struct wpa_driver_nl80211_data *drv; 866 struct wpa_scan_results *res; 867 const u8 *bssid; 868 }; 869 870 static int bss_info_handler(struct nl_msg *msg, void *arg) 871 { 872 struct nl80211_bss_info_arg *_arg = arg; 873 struct wpa_scan_results *res = _arg->res; 874 struct wpa_scan_res **tmp; 875 struct wpa_scan_res *r; 876 877 r = nl80211_parse_bss_info(_arg->drv, msg, _arg->bssid); 878 if (!r) 879 return NL_SKIP; 880 881 if (!res) { 882 os_free(r); 883 return NL_SKIP; 884 } 885 tmp = os_realloc_array(res->res, res->num + 1, 886 sizeof(struct wpa_scan_res *)); 887 if (tmp == NULL) { 888 os_free(r); 889 return NL_SKIP; 890 } 891 tmp[res->num++] = r; 892 res->res = tmp; 893 894 return NL_SKIP; 895 } 896 897 898 static void clear_state_mismatch(struct wpa_driver_nl80211_data *drv, 899 const u8 *addr) 900 { 901 if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) { 902 wpa_printf(MSG_DEBUG, "nl80211: Clear possible state " 903 "mismatch (" MACSTR ")", MAC2STR(addr)); 904 wpa_driver_nl80211_mlme(drv, addr, 905 NL80211_CMD_DEAUTHENTICATE, 906 WLAN_REASON_PREV_AUTH_NOT_VALID, 1, 907 drv->first_bss); 908 } 909 } 910 911 912 static void nl80211_check_bss_status(struct wpa_driver_nl80211_data *drv, 913 struct wpa_scan_res *r) 914 { 915 if (!(r->flags & WPA_SCAN_ASSOCIATED)) 916 return; 917 918 wpa_printf(MSG_DEBUG, "nl80211: Scan results indicate BSS status with " 919 MACSTR " as associated", MAC2STR(r->bssid)); 920 if (is_sta_interface(drv->nlmode) && !drv->associated) { 921 wpa_printf(MSG_DEBUG, 922 "nl80211: Local state (not associated) does not match with BSS state"); 923 clear_state_mismatch(drv, r->bssid); 924 } else if (is_sta_interface(drv->nlmode) && 925 !ether_addr_equal(drv->bssid, r->bssid)) { 926 wpa_printf(MSG_DEBUG, 927 "nl80211: Local state (associated with " MACSTR 928 ") does not match with BSS state", 929 MAC2STR(drv->bssid)); 930 931 if (!ether_addr_equal(drv->sta_mlo_info.ap_mld_addr, 932 drv->bssid)) { 933 clear_state_mismatch(drv, r->bssid); 934 935 if (!is_zero_ether_addr(drv->sta_mlo_info.ap_mld_addr)) 936 clear_state_mismatch( 937 drv, drv->sta_mlo_info.ap_mld_addr); 938 else 939 clear_state_mismatch(drv, drv->bssid); 940 941 } else { 942 wpa_printf(MSG_DEBUG, 943 "nl80211: BSSID is the MLD address"); 944 } 945 } 946 } 947 948 949 static void wpa_driver_nl80211_check_bss_status( 950 struct wpa_driver_nl80211_data *drv, struct wpa_scan_results *res) 951 { 952 size_t i; 953 954 for (i = 0; i < res->num; i++) 955 nl80211_check_bss_status(drv, res->res[i]); 956 } 957 958 959 static void nl80211_update_scan_res_noise(struct wpa_scan_res *res, 960 struct nl80211_noise_info *info) 961 { 962 unsigned int i; 963 964 for (i = 0; res && i < info->count; i++) { 965 if ((int) info->freq[i] != res->freq || 966 !(res->flags & WPA_SCAN_NOISE_INVALID)) 967 continue; 968 res->noise = info->noise[i]; 969 res->flags &= ~WPA_SCAN_NOISE_INVALID; 970 } 971 } 972 973 974 static struct wpa_scan_results * 975 nl80211_get_scan_results(struct wpa_driver_nl80211_data *drv, const u8 *bssid) 976 { 977 struct nl_msg *msg; 978 struct wpa_scan_results *res; 979 int ret; 980 struct nl80211_bss_info_arg arg; 981 int count = 0; 982 983 try_again: 984 res = os_zalloc(sizeof(*res)); 985 if (res == NULL) 986 return NULL; 987 if (!(msg = nl80211_cmd_msg(drv->first_bss, NLM_F_DUMP, 988 NL80211_CMD_GET_SCAN))) { 989 wpa_scan_results_free(res); 990 return NULL; 991 } 992 993 arg.drv = drv; 994 arg.res = res; 995 arg.bssid = bssid; 996 ret = send_and_recv_resp(drv, msg, bss_info_handler, &arg); 997 if (ret == -EAGAIN) { 998 count++; 999 if (count >= 10) { 1000 wpa_printf(MSG_INFO, 1001 "nl80211: Failed to receive consistent scan result dump"); 1002 } else { 1003 wpa_printf(MSG_DEBUG, 1004 "nl80211: Failed to receive consistent scan result dump - try again"); 1005 wpa_scan_results_free(res); 1006 goto try_again; 1007 } 1008 } 1009 if (ret == 0) { 1010 struct nl80211_noise_info info; 1011 1012 wpa_printf(MSG_DEBUG, "nl80211: Received scan results (%lu " 1013 "BSSes)", (unsigned long) res->num); 1014 if (nl80211_get_noise_for_scan_results(drv, &info) == 0) { 1015 size_t i; 1016 1017 for (i = 0; i < res->num; ++i) 1018 nl80211_update_scan_res_noise(res->res[i], 1019 &info); 1020 } 1021 return res; 1022 } 1023 wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d " 1024 "(%s)", ret, strerror(-ret)); 1025 wpa_scan_results_free(res); 1026 return NULL; 1027 } 1028 1029 1030 /** 1031 * wpa_driver_nl80211_get_scan_results - Fetch the latest scan results 1032 * @priv: Pointer to private nl80211 data from wpa_driver_nl80211_init() 1033 * @bssid: Return results only for the specified BSSID, %NULL for all 1034 * Returns: Scan results on success, -1 on failure 1035 */ 1036 struct wpa_scan_results * wpa_driver_nl80211_get_scan_results(void *priv, 1037 const u8 *bssid) 1038 { 1039 struct i802_bss *bss = priv; 1040 struct wpa_driver_nl80211_data *drv = bss->drv; 1041 struct wpa_scan_results *res; 1042 1043 res = nl80211_get_scan_results(drv, bssid); 1044 if (res) 1045 wpa_driver_nl80211_check_bss_status(drv, res); 1046 return res; 1047 } 1048 1049 1050 struct nl80211_dump_scan_ctx { 1051 struct wpa_driver_nl80211_data *drv; 1052 int idx; 1053 }; 1054 1055 static int nl80211_dump_scan_handler(struct nl_msg *msg, void *arg) 1056 { 1057 struct nl80211_dump_scan_ctx *ctx = arg; 1058 struct wpa_scan_res *r; 1059 1060 r = nl80211_parse_bss_info(ctx->drv, msg, NULL); 1061 if (!r) 1062 return NL_SKIP; 1063 wpa_printf(MSG_DEBUG, "nl80211: %d " MACSTR " %d%s", 1064 ctx->idx, MAC2STR(r->bssid), r->freq, 1065 r->flags & WPA_SCAN_ASSOCIATED ? " [assoc]" : ""); 1066 ctx->idx++; 1067 os_free(r); 1068 return NL_SKIP; 1069 } 1070 1071 1072 void nl80211_dump_scan(struct wpa_driver_nl80211_data *drv) 1073 { 1074 struct nl_msg *msg; 1075 struct nl80211_dump_scan_ctx ctx; 1076 1077 wpa_printf(MSG_DEBUG, "nl80211: Scan result dump"); 1078 ctx.drv = drv; 1079 ctx.idx = 0; 1080 msg = nl80211_cmd_msg(drv->first_bss, NLM_F_DUMP, NL80211_CMD_GET_SCAN); 1081 if (msg) 1082 send_and_recv_resp(drv, msg, nl80211_dump_scan_handler, &ctx); 1083 } 1084 1085 1086 int wpa_driver_nl80211_abort_scan(void *priv, u64 scan_cookie) 1087 { 1088 struct i802_bss *bss = priv; 1089 #ifdef CONFIG_DRIVER_NL80211_QCA 1090 struct wpa_driver_nl80211_data *drv = bss->drv; 1091 1092 /* 1093 * If scan_cookie is zero, a normal scan through kernel (cfg80211) 1094 * was triggered, hence abort the cfg80211 scan instead of the vendor 1095 * scan. 1096 */ 1097 if (drv->scan_vendor_cmd_avail && scan_cookie) 1098 return nl80211_abort_vendor_scan(drv, scan_cookie); 1099 #endif /* CONFIG_DRIVER_NL80211_QCA */ 1100 return nl80211_abort_scan(bss); 1101 } 1102 1103 1104 #ifdef CONFIG_DRIVER_NL80211_QCA 1105 1106 static int scan_cookie_handler(struct nl_msg *msg, void *arg) 1107 { 1108 struct nlattr *tb[NL80211_ATTR_MAX + 1]; 1109 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg)); 1110 u64 *cookie = arg; 1111 1112 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0), 1113 genlmsg_attrlen(gnlh, 0), NULL); 1114 1115 if (tb[NL80211_ATTR_VENDOR_DATA]) { 1116 struct nlattr *nl_vendor = tb[NL80211_ATTR_VENDOR_DATA]; 1117 struct nlattr *tb_vendor[QCA_WLAN_VENDOR_ATTR_SCAN_MAX + 1]; 1118 1119 nla_parse(tb_vendor, QCA_WLAN_VENDOR_ATTR_SCAN_MAX, 1120 nla_data(nl_vendor), nla_len(nl_vendor), NULL); 1121 1122 if (tb_vendor[QCA_WLAN_VENDOR_ATTR_SCAN_COOKIE]) 1123 *cookie = nla_get_u64( 1124 tb_vendor[QCA_WLAN_VENDOR_ATTR_SCAN_COOKIE]); 1125 } 1126 1127 return NL_SKIP; 1128 } 1129 1130 1131 /** 1132 * wpa_driver_nl80211_vendor_scan - Request the driver to initiate a vendor scan 1133 * @bss: Pointer to private driver data from wpa_driver_nl80211_init() 1134 * @params: Scan parameters 1135 * Returns: 0 on success, -1 on failure 1136 */ 1137 int wpa_driver_nl80211_vendor_scan(struct i802_bss *bss, 1138 struct wpa_driver_scan_params *params) 1139 { 1140 struct wpa_driver_nl80211_data *drv = bss->drv; 1141 struct nl_msg *msg = NULL; 1142 struct nlattr *attr; 1143 size_t i; 1144 u32 scan_flags = 0; 1145 int ret = -1; 1146 u64 cookie = 0; 1147 1148 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: vendor scan request"); 1149 drv->scan_for_auth = 0; 1150 1151 if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) || 1152 nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) || 1153 nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, 1154 QCA_NL80211_VENDOR_SUBCMD_TRIGGER_SCAN) ) 1155 goto fail; 1156 1157 attr = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA); 1158 if (attr == NULL) 1159 goto fail; 1160 1161 if (params->num_ssids) { 1162 struct nlattr *ssids; 1163 1164 ssids = nla_nest_start(msg, QCA_WLAN_VENDOR_ATTR_SCAN_SSIDS); 1165 if (ssids == NULL) 1166 goto fail; 1167 for (i = 0; i < params->num_ssids; i++) { 1168 wpa_printf(MSG_MSGDUMP, "nl80211: Scan SSID %s", 1169 wpa_ssid_txt(params->ssids[i].ssid, 1170 params->ssids[i].ssid_len)); 1171 if (nla_put(msg, i + 1, params->ssids[i].ssid_len, 1172 params->ssids[i].ssid)) 1173 goto fail; 1174 } 1175 nla_nest_end(msg, ssids); 1176 } 1177 1178 if (params->extra_ies) { 1179 wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan extra IEs", 1180 params->extra_ies, params->extra_ies_len); 1181 if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_SCAN_IE, 1182 params->extra_ies_len, params->extra_ies)) 1183 goto fail; 1184 } 1185 1186 if (params->freqs) { 1187 struct nlattr *freqs; 1188 1189 freqs = nla_nest_start(msg, 1190 QCA_WLAN_VENDOR_ATTR_SCAN_FREQUENCIES); 1191 if (freqs == NULL) 1192 goto fail; 1193 for (i = 0; params->freqs[i]; i++) { 1194 wpa_printf(MSG_MSGDUMP, 1195 "nl80211: Scan frequency %u MHz", 1196 params->freqs[i]); 1197 if (nla_put_u32(msg, i + 1, params->freqs[i])) 1198 goto fail; 1199 } 1200 nla_nest_end(msg, freqs); 1201 } 1202 1203 os_free(drv->filter_ssids); 1204 drv->filter_ssids = params->filter_ssids; 1205 params->filter_ssids = NULL; 1206 drv->num_filter_ssids = params->num_filter_ssids; 1207 1208 if (params->low_priority && drv->have_low_prio_scan) { 1209 wpa_printf(MSG_DEBUG, 1210 "nl80211: Add NL80211_SCAN_FLAG_LOW_PRIORITY"); 1211 scan_flags |= NL80211_SCAN_FLAG_LOW_PRIORITY; 1212 } 1213 1214 if (params->mac_addr_rand) { 1215 wpa_printf(MSG_DEBUG, 1216 "nl80211: Add NL80211_SCAN_FLAG_RANDOM_ADDR"); 1217 scan_flags |= NL80211_SCAN_FLAG_RANDOM_ADDR; 1218 1219 if (params->mac_addr) { 1220 wpa_printf(MSG_DEBUG, "nl80211: MAC address: " MACSTR, 1221 MAC2STR(params->mac_addr)); 1222 if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_SCAN_MAC, 1223 ETH_ALEN, params->mac_addr)) 1224 goto fail; 1225 } 1226 1227 if (params->mac_addr_mask) { 1228 wpa_printf(MSG_DEBUG, "nl80211: MAC address mask: " 1229 MACSTR, MAC2STR(params->mac_addr_mask)); 1230 if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_SCAN_MAC_MASK, 1231 ETH_ALEN, params->mac_addr_mask)) 1232 goto fail; 1233 } 1234 } 1235 1236 if (scan_flags && 1237 nla_put_u32(msg, QCA_WLAN_VENDOR_ATTR_SCAN_FLAGS, scan_flags)) 1238 goto fail; 1239 1240 if (params->p2p_probe) { 1241 struct nlattr *rates; 1242 1243 wpa_printf(MSG_DEBUG, "nl80211: P2P probe - mask SuppRates"); 1244 1245 rates = nla_nest_start(msg, 1246 QCA_WLAN_VENDOR_ATTR_SCAN_SUPP_RATES); 1247 if (rates == NULL) 1248 goto fail; 1249 1250 /* 1251 * Remove 2.4 GHz rates 1, 2, 5.5, 11 Mbps from supported rates 1252 * by masking out everything else apart from the OFDM rates 6, 1253 * 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS rates. All 5 GHz 1254 * rates are left enabled. 1255 */ 1256 if (nla_put(msg, NL80211_BAND_2GHZ, 8, 1257 "\x0c\x12\x18\x24\x30\x48\x60\x6c")) 1258 goto fail; 1259 nla_nest_end(msg, rates); 1260 1261 if (nla_put_flag(msg, QCA_WLAN_VENDOR_ATTR_SCAN_TX_NO_CCK_RATE)) 1262 goto fail; 1263 } 1264 1265 if (params->bssid) { 1266 wpa_printf(MSG_DEBUG, "nl80211: Scan for a specific BSSID: " 1267 MACSTR, MAC2STR(params->bssid)); 1268 if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_SCAN_BSSID, ETH_ALEN, 1269 params->bssid)) 1270 goto fail; 1271 } 1272 1273 if (is_ap_interface(drv->nlmode) && 1274 params->link_id != NL80211_DRV_LINK_ID_NA && 1275 nla_put_u8(msg, QCA_WLAN_VENDOR_ATTR_SCAN_LINK_ID, params->link_id)) 1276 goto fail; 1277 1278 nla_nest_end(msg, attr); 1279 1280 ret = send_and_recv_resp(drv, msg, scan_cookie_handler, &cookie); 1281 msg = NULL; 1282 if (ret) { 1283 wpa_printf(MSG_DEBUG, 1284 "nl80211: Vendor scan trigger failed: ret=%d (%s)", 1285 ret, strerror(-ret)); 1286 goto fail; 1287 } 1288 1289 drv->vendor_scan_cookie = cookie; 1290 drv->scan_state = SCAN_REQUESTED; 1291 /* Pass the cookie to the caller to help distinguish the scans. */ 1292 params->scan_cookie = cookie; 1293 1294 wpa_printf(MSG_DEBUG, 1295 "nl80211: Vendor scan requested (ret=%d) - scan timeout 30 seconds, scan cookie:0x%llx", 1296 ret, (long long unsigned int) cookie); 1297 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx); 1298 eloop_register_timeout(30, 0, wpa_driver_nl80211_scan_timeout, 1299 drv, drv->ctx); 1300 drv->last_scan_cmd = NL80211_CMD_VENDOR; 1301 1302 fail: 1303 nlmsg_free(msg); 1304 return ret; 1305 } 1306 1307 1308 /** 1309 * nl80211_set_default_scan_ies - Set the scan default IEs to the driver 1310 * @priv: Pointer to private driver data from wpa_driver_nl80211_init() 1311 * @ies: Pointer to IEs buffer 1312 * @ies_len: Length of IEs in bytes 1313 * Returns: 0 on success, -1 on failure 1314 */ 1315 int nl80211_set_default_scan_ies(void *priv, const u8 *ies, size_t ies_len) 1316 { 1317 struct i802_bss *bss = priv; 1318 struct wpa_driver_nl80211_data *drv = bss->drv; 1319 struct nl_msg *msg = NULL; 1320 struct nlattr *attr; 1321 int ret = -1; 1322 1323 if (!drv->set_wifi_conf_vendor_cmd_avail) 1324 return -1; 1325 1326 if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) || 1327 nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) || 1328 nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD, 1329 QCA_NL80211_VENDOR_SUBCMD_SET_WIFI_CONFIGURATION)) 1330 goto fail; 1331 1332 attr = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA); 1333 if (attr == NULL) 1334 goto fail; 1335 1336 wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan default IEs", ies, ies_len); 1337 if (nla_put(msg, QCA_WLAN_VENDOR_ATTR_CONFIG_SCAN_DEFAULT_IES, 1338 ies_len, ies)) 1339 goto fail; 1340 1341 nla_nest_end(msg, attr); 1342 1343 ret = send_and_recv_cmd(drv, msg); 1344 msg = NULL; 1345 if (ret) { 1346 wpa_printf(MSG_ERROR, 1347 "nl80211: Set scan default IEs failed: ret=%d (%s)", 1348 ret, strerror(-ret)); 1349 goto fail; 1350 } 1351 1352 fail: 1353 nlmsg_free(msg); 1354 return ret; 1355 } 1356 1357 #endif /* CONFIG_DRIVER_NL80211_QCA */ 1358
Indexes created Wed Sep 16 00:24:39 UTC 2026