1 /* 2 * Driver interaction with Linux nl80211/cfg80211 - Scanning 3 * Copyright (c) 2002-2014, Jouni Malinen <j@w1.fi> 4 * Copyright (c) 2007, Johannes Berg <johannes@sipsolutions.net> 5 * Copyright (c) 2009-2010, Atheros Communications 6 * 7 * This software may be distributed under the terms of the BSD license. 8 * See README for more details. 9 */ 10 11 #include "includes.h" 12 #include <netlink/genl/genl.h> 13 14 #include "utils/common.h" 15 #include "utils/eloop.h" 16 #include "common/ieee802_11_defs.h" 17 #include "driver_nl80211.h" 18 19 20 static int get_noise_for_scan_results(struct nl_msg *msg, void *arg) 21 { 22 struct nlattr *tb[NL80211_ATTR_MAX + 1]; 23 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg)); 24 struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1]; 25 static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = { 26 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 }, 27 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 }, 28 }; 29 struct wpa_scan_results *scan_results = arg; 30 struct wpa_scan_res *scan_res; 31 size_t i; 32 33 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0), 34 genlmsg_attrlen(gnlh, 0), NULL); 35 36 if (!tb[NL80211_ATTR_SURVEY_INFO]) { 37 wpa_printf(MSG_DEBUG, "nl80211: Survey data missing"); 38 return NL_SKIP; 39 } 40 41 if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX, 42 tb[NL80211_ATTR_SURVEY_INFO], 43 survey_policy)) { 44 wpa_printf(MSG_DEBUG, "nl80211: Failed to parse nested " 45 "attributes"); 46 return NL_SKIP; 47 } 48 49 if (!sinfo[NL80211_SURVEY_INFO_NOISE]) 50 return NL_SKIP; 51 52 if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY]) 53 return NL_SKIP; 54 55 for (i = 0; i < scan_results->num; ++i) { 56 scan_res = scan_results->res[i]; 57 if (!scan_res) 58 continue; 59 if ((int) nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]) != 60 scan_res->freq) 61 continue; 62 if (!(scan_res->flags & WPA_SCAN_NOISE_INVALID)) 63 continue; 64 scan_res->noise = (s8) 65 nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]); 66 scan_res->flags &= ~WPA_SCAN_NOISE_INVALID; 67 } 68 69 return NL_SKIP; 70 } 71 72 73 static int nl80211_get_noise_for_scan_results( 74 struct wpa_driver_nl80211_data *drv, 75 struct wpa_scan_results *scan_res) 76 { 77 struct nl_msg *msg; 78 79 msg = nl80211_drv_msg(drv, NLM_F_DUMP, NL80211_CMD_GET_SURVEY); 80 return send_and_recv_msgs(drv, msg, get_noise_for_scan_results, 81 scan_res); 82 } 83 84 85 /** 86 * wpa_driver_nl80211_scan_timeout - Scan timeout to report scan completion 87 * @eloop_ctx: Driver private data 88 * @timeout_ctx: ctx argument given to wpa_driver_nl80211_init() 89 * 90 * This function can be used as registered timeout when starting a scan to 91 * generate a scan completed event if the driver does not report this. 92 */ 93 void wpa_driver_nl80211_scan_timeout(void *eloop_ctx, void *timeout_ctx) 94 { 95 struct wpa_driver_nl80211_data *drv = eloop_ctx; 96 if (drv->ap_scan_as_station != NL80211_IFTYPE_UNSPECIFIED) { 97 wpa_driver_nl80211_set_mode(drv->first_bss, 98 drv->ap_scan_as_station); 99 drv->ap_scan_as_station = NL80211_IFTYPE_UNSPECIFIED; 100 } 101 wpa_printf(MSG_DEBUG, "Scan timeout - try to get results"); 102 wpa_supplicant_event(timeout_ctx, EVENT_SCAN_RESULTS, NULL); 103 } 104 105 106 static struct nl_msg * 107 nl80211_scan_common(struct i802_bss *bss, u8 cmd, 108 struct wpa_driver_scan_params *params) 109 { 110 struct wpa_driver_nl80211_data *drv = bss->drv; 111 struct nl_msg *msg; 112 size_t i; 113 u32 scan_flags = 0; 114 115 msg = nl80211_cmd_msg(bss, 0, cmd); 116 if (!msg) 117 return NULL; 118 119 if (params->num_ssids) { 120 struct nlattr *ssids; 121 122 ssids = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS); 123 if (ssids == NULL) 124 goto fail; 125 for (i = 0; i < params->num_ssids; i++) { 126 wpa_hexdump_ascii(MSG_MSGDUMP, "nl80211: Scan SSID", 127 params->ssids[i].ssid, 128 params->ssids[i].ssid_len); 129 if (nla_put(msg, i + 1, params->ssids[i].ssid_len, 130 params->ssids[i].ssid)) 131 goto fail; 132 } 133 nla_nest_end(msg, ssids); 134 } 135 136 if (params->extra_ies) { 137 wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan extra IEs", 138 params->extra_ies, params->extra_ies_len); 139 if (nla_put(msg, NL80211_ATTR_IE, params->extra_ies_len, 140 params->extra_ies)) 141 goto fail; 142 } 143 144 if (params->freqs) { 145 struct nlattr *freqs; 146 freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES); 147 if (freqs == NULL) 148 goto fail; 149 for (i = 0; params->freqs[i]; i++) { 150 wpa_printf(MSG_MSGDUMP, "nl80211: Scan frequency %u " 151 "MHz", params->freqs[i]); 152 if (nla_put_u32(msg, i + 1, params->freqs[i])) 153 goto fail; 154 } 155 nla_nest_end(msg, freqs); 156 } 157 158 os_free(drv->filter_ssids); 159 drv->filter_ssids = params->filter_ssids; 160 params->filter_ssids = NULL; 161 drv->num_filter_ssids = params->num_filter_ssids; 162 163 if (params->only_new_results) { 164 wpa_printf(MSG_DEBUG, "nl80211: Add NL80211_SCAN_FLAG_FLUSH"); 165 scan_flags |= NL80211_SCAN_FLAG_FLUSH; 166 } 167 168 if (params->low_priority && drv->have_low_prio_scan) { 169 wpa_printf(MSG_DEBUG, 170 "nl80211: Add NL80211_SCAN_FLAG_LOW_PRIORITY"); 171 scan_flags |= NL80211_SCAN_FLAG_LOW_PRIORITY; 172 } 173 174 if (params->mac_addr_rand) { 175 wpa_printf(MSG_DEBUG, 176 "nl80211: Add NL80211_SCAN_FLAG_RANDOM_ADDR"); 177 scan_flags |= NL80211_SCAN_FLAG_RANDOM_ADDR; 178 179 if (params->mac_addr) { 180 wpa_printf(MSG_DEBUG, "nl80211: MAC address: " MACSTR, 181 MAC2STR(params->mac_addr)); 182 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, 183 params->mac_addr)) 184 goto fail; 185 } 186 187 if (params->mac_addr_mask) { 188 wpa_printf(MSG_DEBUG, "nl80211: MAC address mask: " 189 MACSTR, MAC2STR(params->mac_addr_mask)); 190 if (nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN, 191 params->mac_addr_mask)) 192 goto fail; 193 } 194 } 195 196 if (scan_flags && 197 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, scan_flags)) 198 goto fail; 199 200 return msg; 201 202 fail: 203 nlmsg_free(msg); 204 return NULL; 205 } 206 207 208 /** 209 * wpa_driver_nl80211_scan - Request the driver to initiate scan 210 * @bss: Pointer to private driver data from wpa_driver_nl80211_init() 211 * @params: Scan parameters 212 * Returns: 0 on success, -1 on failure 213 */ 214 int wpa_driver_nl80211_scan(struct i802_bss *bss, 215 struct wpa_driver_scan_params *params) 216 { 217 struct wpa_driver_nl80211_data *drv = bss->drv; 218 int ret = -1, timeout; 219 struct nl_msg *msg = NULL; 220 221 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: scan request"); 222 drv->scan_for_auth = 0; 223 224 if (TEST_FAIL()) 225 return -1; 226 227 msg = nl80211_scan_common(bss, NL80211_CMD_TRIGGER_SCAN, params); 228 if (!msg) 229 return -1; 230 231 if (params->p2p_probe) { 232 struct nlattr *rates; 233 234 wpa_printf(MSG_DEBUG, "nl80211: P2P probe - mask SuppRates"); 235 236 rates = nla_nest_start(msg, NL80211_ATTR_SCAN_SUPP_RATES); 237 if (rates == NULL) 238 goto fail; 239 240 /* 241 * Remove 2.4 GHz rates 1, 2, 5.5, 11 Mbps from supported rates 242 * by masking out everything else apart from the OFDM rates 6, 243 * 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS rates. All 5 GHz 244 * rates are left enabled. 245 */ 246 if (nla_put(msg, NL80211_BAND_2GHZ, 8, 247 "\x0c\x12\x18\x24\x30\x48\x60\x6c")) 248 goto fail; 249 nla_nest_end(msg, rates); 250 251 if (nla_put_flag(msg, NL80211_ATTR_TX_NO_CCK_RATE)) 252 goto fail; 253 } 254 255 ret = send_and_recv_msgs(drv, msg, NULL, NULL); 256 msg = NULL; 257 if (ret) { 258 wpa_printf(MSG_DEBUG, "nl80211: Scan trigger failed: ret=%d " 259 "(%s)", ret, strerror(-ret)); 260 if (drv->hostapd && is_ap_interface(drv->nlmode)) { 261 enum nl80211_iftype old_mode = drv->nlmode; 262 263 /* 264 * mac80211 does not allow scan requests in AP mode, so 265 * try to do this in station mode. 266 */ 267 if (wpa_driver_nl80211_set_mode( 268 bss, NL80211_IFTYPE_STATION)) 269 goto fail; 270 271 if (wpa_driver_nl80211_scan(bss, params)) { 272 wpa_driver_nl80211_set_mode(bss, old_mode); 273 goto fail; 274 } 275 276 /* Restore AP mode when processing scan results */ 277 drv->ap_scan_as_station = old_mode; 278 ret = 0; 279 } else 280 goto fail; 281 } 282 283 drv->scan_state = SCAN_REQUESTED; 284 /* Not all drivers generate "scan completed" wireless event, so try to 285 * read results after a timeout. */ 286 timeout = 10; 287 if (drv->scan_complete_events) { 288 /* 289 * The driver seems to deliver events to notify when scan is 290 * complete, so use longer timeout to avoid race conditions 291 * with scanning and following association request. 292 */ 293 timeout = 30; 294 } 295 wpa_printf(MSG_DEBUG, "Scan requested (ret=%d) - scan timeout %d " 296 "seconds", ret, timeout); 297 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx); 298 eloop_register_timeout(timeout, 0, wpa_driver_nl80211_scan_timeout, 299 drv, drv->ctx); 300 301 fail: 302 nlmsg_free(msg); 303 return ret; 304 } 305 306 307 /** 308 * wpa_driver_nl80211_sched_scan - Initiate a scheduled scan 309 * @priv: Pointer to private driver data from wpa_driver_nl80211_init() 310 * @params: Scan parameters 311 * @interval: Interval between scan cycles in milliseconds 312 * Returns: 0 on success, -1 on failure or if not supported 313 */ 314 int wpa_driver_nl80211_sched_scan(void *priv, 315 struct wpa_driver_scan_params *params, 316 u32 interval) 317 { 318 struct i802_bss *bss = priv; 319 struct wpa_driver_nl80211_data *drv = bss->drv; 320 int ret = -1; 321 struct nl_msg *msg; 322 size_t i; 323 324 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: sched_scan request"); 325 326 #ifdef ANDROID 327 if (!drv->capa.sched_scan_supported) 328 return android_pno_start(bss, params); 329 #endif /* ANDROID */ 330 331 msg = nl80211_scan_common(bss, NL80211_CMD_START_SCHED_SCAN, params); 332 if (!msg || 333 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL, interval)) 334 goto fail; 335 336 if ((drv->num_filter_ssids && 337 (int) drv->num_filter_ssids <= drv->capa.max_match_sets) || 338 params->filter_rssi) { 339 struct nlattr *match_sets; 340 match_sets = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH); 341 if (match_sets == NULL) 342 goto fail; 343 344 for (i = 0; i < drv->num_filter_ssids; i++) { 345 struct nlattr *match_set_ssid; 346 wpa_hexdump_ascii(MSG_MSGDUMP, 347 "nl80211: Sched scan filter SSID", 348 drv->filter_ssids[i].ssid, 349 drv->filter_ssids[i].ssid_len); 350 351 match_set_ssid = nla_nest_start(msg, i + 1); 352 if (match_set_ssid == NULL || 353 nla_put(msg, NL80211_ATTR_SCHED_SCAN_MATCH_SSID, 354 drv->filter_ssids[i].ssid_len, 355 drv->filter_ssids[i].ssid) || 356 (params->filter_rssi && 357 nla_put_u32(msg, 358 NL80211_SCHED_SCAN_MATCH_ATTR_RSSI, 359 params->filter_rssi))) 360 goto fail; 361 362 nla_nest_end(msg, match_set_ssid); 363 } 364 365 /* 366 * Due to backward compatibility code, newer kernels treat this 367 * matchset (with only an RSSI filter) as the default for all 368 * other matchsets, unless it's the only one, in which case the 369 * matchset will actually allow all SSIDs above the RSSI. 370 */ 371 if (params->filter_rssi) { 372 struct nlattr *match_set_rssi; 373 match_set_rssi = nla_nest_start(msg, 0); 374 if (match_set_rssi == NULL || 375 nla_put_u32(msg, NL80211_SCHED_SCAN_MATCH_ATTR_RSSI, 376 params->filter_rssi)) 377 goto fail; 378 wpa_printf(MSG_MSGDUMP, 379 "nl80211: Sched scan RSSI filter %d dBm", 380 params->filter_rssi); 381 nla_nest_end(msg, match_set_rssi); 382 } 383 384 nla_nest_end(msg, match_sets); 385 } 386 387 ret = send_and_recv_msgs(drv, msg, NULL, NULL); 388 389 /* TODO: if we get an error here, we should fall back to normal scan */ 390 391 msg = NULL; 392 if (ret) { 393 wpa_printf(MSG_DEBUG, "nl80211: Sched scan start failed: " 394 "ret=%d (%s)", ret, strerror(-ret)); 395 goto fail; 396 } 397 398 wpa_printf(MSG_DEBUG, "nl80211: Sched scan requested (ret=%d) - " 399 "scan interval %d msec", ret, interval); 400 401 fail: 402 nlmsg_free(msg); 403 return ret; 404 } 405 406 407 /** 408 * wpa_driver_nl80211_stop_sched_scan - Stop a scheduled scan 409 * @priv: Pointer to private driver data from wpa_driver_nl80211_init() 410 * Returns: 0 on success, -1 on failure or if not supported 411 */ 412 int wpa_driver_nl80211_stop_sched_scan(void *priv) 413 { 414 struct i802_bss *bss = priv; 415 struct wpa_driver_nl80211_data *drv = bss->drv; 416 int ret; 417 struct nl_msg *msg; 418 419 #ifdef ANDROID 420 if (!drv->capa.sched_scan_supported) 421 return android_pno_stop(bss); 422 #endif /* ANDROID */ 423 424 msg = nl80211_drv_msg(drv, 0, NL80211_CMD_STOP_SCHED_SCAN); 425 ret = send_and_recv_msgs(drv, msg, NULL, NULL); 426 if (ret) { 427 wpa_printf(MSG_DEBUG, 428 "nl80211: Sched scan stop failed: ret=%d (%s)", 429 ret, strerror(-ret)); 430 } else { 431 wpa_printf(MSG_DEBUG, 432 "nl80211: Sched scan stop sent"); 433 } 434 435 return ret; 436 } 437 438 439 const u8 * nl80211_get_ie(const u8 *ies, size_t ies_len, u8 ie) 440 { 441 const u8 *end, *pos; 442 443 if (ies == NULL) 444 return NULL; 445 446 pos = ies; 447 end = ies + ies_len; 448 449 while (pos + 1 < end) { 450 if (pos + 2 + pos[1] > end) 451 break; 452 if (pos[0] == ie) 453 return pos; 454 pos += 2 + pos[1]; 455 } 456 457 return NULL; 458 } 459 460 461 static int nl80211_scan_filtered(struct wpa_driver_nl80211_data *drv, 462 const u8 *ie, size_t ie_len) 463 { 464 const u8 *ssid; 465 size_t i; 466 467 if (drv->filter_ssids == NULL) 468 return 0; 469 470 ssid = nl80211_get_ie(ie, ie_len, WLAN_EID_SSID); 471 if (ssid == NULL) 472 return 1; 473 474 for (i = 0; i < drv->num_filter_ssids; i++) { 475 if (ssid[1] == drv->filter_ssids[i].ssid_len && 476 os_memcmp(ssid + 2, drv->filter_ssids[i].ssid, ssid[1]) == 477 0) 478 return 0; 479 } 480 481 return 1; 482 } 483 484 485 int bss_info_handler(struct nl_msg *msg, void *arg) 486 { 487 struct nlattr *tb[NL80211_ATTR_MAX + 1]; 488 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg)); 489 struct nlattr *bss[NL80211_BSS_MAX + 1]; 490 static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = { 491 [NL80211_BSS_BSSID] = { .type = NLA_UNSPEC }, 492 [NL80211_BSS_FREQUENCY] = { .type = NLA_U32 }, 493 [NL80211_BSS_TSF] = { .type = NLA_U64 }, 494 [NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 }, 495 [NL80211_BSS_CAPABILITY] = { .type = NLA_U16 }, 496 [NL80211_BSS_INFORMATION_ELEMENTS] = { .type = NLA_UNSPEC }, 497 [NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 }, 498 [NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 }, 499 [NL80211_BSS_STATUS] = { .type = NLA_U32 }, 500 [NL80211_BSS_SEEN_MS_AGO] = { .type = NLA_U32 }, 501 [NL80211_BSS_BEACON_IES] = { .type = NLA_UNSPEC }, 502 }; 503 struct nl80211_bss_info_arg *_arg = arg; 504 struct wpa_scan_results *res = _arg->res; 505 struct wpa_scan_res **tmp; 506 struct wpa_scan_res *r; 507 const u8 *ie, *beacon_ie; 508 size_t ie_len, beacon_ie_len; 509 u8 *pos; 510 size_t i; 511 512 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0), 513 genlmsg_attrlen(gnlh, 0), NULL); 514 if (!tb[NL80211_ATTR_BSS]) 515 return NL_SKIP; 516 if (nla_parse_nested(bss, NL80211_BSS_MAX, tb[NL80211_ATTR_BSS], 517 bss_policy)) 518 return NL_SKIP; 519 if (bss[NL80211_BSS_STATUS]) { 520 enum nl80211_bss_status status; 521 status = nla_get_u32(bss[NL80211_BSS_STATUS]); 522 if (status == NL80211_BSS_STATUS_ASSOCIATED && 523 bss[NL80211_BSS_FREQUENCY]) { 524 _arg->assoc_freq = 525 nla_get_u32(bss[NL80211_BSS_FREQUENCY]); 526 wpa_printf(MSG_DEBUG, "nl80211: Associated on %u MHz", 527 _arg->assoc_freq); 528 } 529 if (status == NL80211_BSS_STATUS_IBSS_JOINED && 530 bss[NL80211_BSS_FREQUENCY]) { 531 _arg->ibss_freq = 532 nla_get_u32(bss[NL80211_BSS_FREQUENCY]); 533 wpa_printf(MSG_DEBUG, "nl80211: IBSS-joined on %u MHz", 534 _arg->ibss_freq); 535 } 536 if (status == NL80211_BSS_STATUS_ASSOCIATED && 537 bss[NL80211_BSS_BSSID]) { 538 os_memcpy(_arg->assoc_bssid, 539 nla_data(bss[NL80211_BSS_BSSID]), ETH_ALEN); 540 wpa_printf(MSG_DEBUG, "nl80211: Associated with " 541 MACSTR, MAC2STR(_arg->assoc_bssid)); 542 } 543 } 544 if (!res) 545 return NL_SKIP; 546 if (bss[NL80211_BSS_INFORMATION_ELEMENTS]) { 547 ie = nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]); 548 ie_len = nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]); 549 } else { 550 ie = NULL; 551 ie_len = 0; 552 } 553 if (bss[NL80211_BSS_BEACON_IES]) { 554 beacon_ie = nla_data(bss[NL80211_BSS_BEACON_IES]); 555 beacon_ie_len = nla_len(bss[NL80211_BSS_BEACON_IES]); 556 } else { 557 beacon_ie = NULL; 558 beacon_ie_len = 0; 559 } 560 561 if (nl80211_scan_filtered(_arg->drv, ie ? ie : beacon_ie, 562 ie ? ie_len : beacon_ie_len)) 563 return NL_SKIP; 564 565 r = os_zalloc(sizeof(*r) + ie_len + beacon_ie_len); 566 if (r == NULL) 567 return NL_SKIP; 568 if (bss[NL80211_BSS_BSSID]) 569 os_memcpy(r->bssid, nla_data(bss[NL80211_BSS_BSSID]), 570 ETH_ALEN); 571 if (bss[NL80211_BSS_FREQUENCY]) 572 r->freq = nla_get_u32(bss[NL80211_BSS_FREQUENCY]); 573 if (bss[NL80211_BSS_BEACON_INTERVAL]) 574 r->beacon_int = nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]); 575 if (bss[NL80211_BSS_CAPABILITY]) 576 r->caps = nla_get_u16(bss[NL80211_BSS_CAPABILITY]); 577 r->flags |= WPA_SCAN_NOISE_INVALID; 578 if (bss[NL80211_BSS_SIGNAL_MBM]) { 579 r->level = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]); 580 r->level /= 100; /* mBm to dBm */ 581 r->flags |= WPA_SCAN_LEVEL_DBM | WPA_SCAN_QUAL_INVALID; 582 } else if (bss[NL80211_BSS_SIGNAL_UNSPEC]) { 583 r->level = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]); 584 r->flags |= WPA_SCAN_QUAL_INVALID; 585 } else 586 r->flags |= WPA_SCAN_LEVEL_INVALID | WPA_SCAN_QUAL_INVALID; 587 if (bss[NL80211_BSS_TSF]) 588 r->tsf = nla_get_u64(bss[NL80211_BSS_TSF]); 589 if (bss[NL80211_BSS_BEACON_TSF]) { 590 u64 tsf = nla_get_u64(bss[NL80211_BSS_BEACON_TSF]); 591 if (tsf > r->tsf) 592 r->tsf = tsf; 593 } 594 if (bss[NL80211_BSS_SEEN_MS_AGO]) 595 r->age = nla_get_u32(bss[NL80211_BSS_SEEN_MS_AGO]); 596 r->ie_len = ie_len; 597 pos = (u8 *) (r + 1); 598 if (ie) { 599 os_memcpy(pos, ie, ie_len); 600 pos += ie_len; 601 } 602 r->beacon_ie_len = beacon_ie_len; 603 if (beacon_ie) 604 os_memcpy(pos, beacon_ie, beacon_ie_len); 605 606 if (bss[NL80211_BSS_STATUS]) { 607 enum nl80211_bss_status status; 608 status = nla_get_u32(bss[NL80211_BSS_STATUS]); 609 switch (status) { 610 case NL80211_BSS_STATUS_ASSOCIATED: 611 r->flags |= WPA_SCAN_ASSOCIATED; 612 break; 613 default: 614 break; 615 } 616 } 617 618 /* 619 * cfg80211 maintains separate BSS table entries for APs if the same 620 * BSSID,SSID pair is seen on multiple channels. wpa_supplicant does 621 * not use frequency as a separate key in the BSS table, so filter out 622 * duplicated entries. Prefer associated BSS entry in such a case in 623 * order to get the correct frequency into the BSS table. Similarly, 624 * prefer newer entries over older. 625 */ 626 for (i = 0; i < res->num; i++) { 627 const u8 *s1, *s2; 628 if (os_memcmp(res->res[i]->bssid, r->bssid, ETH_ALEN) != 0) 629 continue; 630 631 s1 = nl80211_get_ie((u8 *) (res->res[i] + 1), 632 res->res[i]->ie_len, WLAN_EID_SSID); 633 s2 = nl80211_get_ie((u8 *) (r + 1), r->ie_len, WLAN_EID_SSID); 634 if (s1 == NULL || s2 == NULL || s1[1] != s2[1] || 635 os_memcmp(s1, s2, 2 + s1[1]) != 0) 636 continue; 637 638 /* Same BSSID,SSID was already included in scan results */ 639 wpa_printf(MSG_DEBUG, "nl80211: Remove duplicated scan result " 640 "for " MACSTR, MAC2STR(r->bssid)); 641 642 if (((r->flags & WPA_SCAN_ASSOCIATED) && 643 !(res->res[i]->flags & WPA_SCAN_ASSOCIATED)) || 644 r->age < res->res[i]->age) { 645 os_free(res->res[i]); 646 res->res[i] = r; 647 } else 648 os_free(r); 649 return NL_SKIP; 650 } 651 652 tmp = os_realloc_array(res->res, res->num + 1, 653 sizeof(struct wpa_scan_res *)); 654 if (tmp == NULL) { 655 os_free(r); 656 return NL_SKIP; 657 } 658 tmp[res->num++] = r; 659 res->res = tmp; 660 661 return NL_SKIP; 662 } 663 664 665 static void clear_state_mismatch(struct wpa_driver_nl80211_data *drv, 666 const u8 *addr) 667 { 668 if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) { 669 wpa_printf(MSG_DEBUG, "nl80211: Clear possible state " 670 "mismatch (" MACSTR ")", MAC2STR(addr)); 671 wpa_driver_nl80211_mlme(drv, addr, 672 NL80211_CMD_DEAUTHENTICATE, 673 WLAN_REASON_PREV_AUTH_NOT_VALID, 1); 674 } 675 } 676 677 678 static void wpa_driver_nl80211_check_bss_status( 679 struct wpa_driver_nl80211_data *drv, struct wpa_scan_results *res) 680 { 681 size_t i; 682 683 for (i = 0; i < res->num; i++) { 684 struct wpa_scan_res *r = res->res[i]; 685 686 if (r->flags & WPA_SCAN_ASSOCIATED) { 687 wpa_printf(MSG_DEBUG, "nl80211: Scan results " 688 "indicate BSS status with " MACSTR 689 " as associated", 690 MAC2STR(r->bssid)); 691 if (is_sta_interface(drv->nlmode) && 692 !drv->associated) { 693 wpa_printf(MSG_DEBUG, "nl80211: Local state " 694 "(not associated) does not match " 695 "with BSS state"); 696 clear_state_mismatch(drv, r->bssid); 697 } else if (is_sta_interface(drv->nlmode) && 698 os_memcmp(drv->bssid, r->bssid, ETH_ALEN) != 699 0) { 700 wpa_printf(MSG_DEBUG, "nl80211: Local state " 701 "(associated with " MACSTR ") does " 702 "not match with BSS state", 703 MAC2STR(drv->bssid)); 704 clear_state_mismatch(drv, r->bssid); 705 clear_state_mismatch(drv, drv->bssid); 706 } 707 } 708 } 709 } 710 711 712 static struct wpa_scan_results * 713 nl80211_get_scan_results(struct wpa_driver_nl80211_data *drv) 714 { 715 struct nl_msg *msg; 716 struct wpa_scan_results *res; 717 int ret; 718 struct nl80211_bss_info_arg arg; 719 720 res = os_zalloc(sizeof(*res)); 721 if (res == NULL) 722 return NULL; 723 if (!(msg = nl80211_cmd_msg(drv->first_bss, NLM_F_DUMP, 724 NL80211_CMD_GET_SCAN))) { 725 wpa_scan_results_free(res); 726 return NULL; 727 } 728 729 arg.drv = drv; 730 arg.res = res; 731 ret = send_and_recv_msgs(drv, msg, bss_info_handler, &arg); 732 if (ret == 0) { 733 wpa_printf(MSG_DEBUG, "nl80211: Received scan results (%lu " 734 "BSSes)", (unsigned long) res->num); 735 nl80211_get_noise_for_scan_results(drv, res); 736 return res; 737 } 738 wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d " 739 "(%s)", ret, strerror(-ret)); 740 wpa_scan_results_free(res); 741 return NULL; 742 } 743 744 745 /** 746 * wpa_driver_nl80211_get_scan_results - Fetch the latest scan results 747 * @priv: Pointer to private wext data from wpa_driver_nl80211_init() 748 * Returns: Scan results on success, -1 on failure 749 */ 750 struct wpa_scan_results * wpa_driver_nl80211_get_scan_results(void *priv) 751 { 752 struct i802_bss *bss = priv; 753 struct wpa_driver_nl80211_data *drv = bss->drv; 754 struct wpa_scan_results *res; 755 756 res = nl80211_get_scan_results(drv); 757 if (res) 758 wpa_driver_nl80211_check_bss_status(drv, res); 759 return res; 760 } 761 762 763 void nl80211_dump_scan(struct wpa_driver_nl80211_data *drv) 764 { 765 struct wpa_scan_results *res; 766 size_t i; 767 768 res = nl80211_get_scan_results(drv); 769 if (res == NULL) { 770 wpa_printf(MSG_DEBUG, "nl80211: Failed to get scan results"); 771 return; 772 } 773 774 wpa_printf(MSG_DEBUG, "nl80211: Scan result dump"); 775 for (i = 0; i < res->num; i++) { 776 struct wpa_scan_res *r = res->res[i]; 777 wpa_printf(MSG_DEBUG, "nl80211: %d/%d " MACSTR "%s", 778 (int) i, (int) res->num, MAC2STR(r->bssid), 779 r->flags & WPA_SCAN_ASSOCIATED ? " [assoc]" : ""); 780 } 781 782 wpa_scan_results_free(res); 783 } 784