1/*
2 * Driver interaction with Linux nl80211/cfg80211 - Capabilities
3 * Copyright (c) 2002-2015, Jouni Malinen <j@w1.fi>
4 * Copyright (c) 2007, Johannes Berg <johannes@sipsolutions.net>
5 * Copyright (c) 2009-2010, Atheros Communications
6 *
7 * This software may be distributed under the terms of the BSD license.
8 * See README for more details.
9 */
10
11#include "includes.h"
12#include <netlink/genl/genl.h>
13
14#include "utils/common.h"
15#include "common/ieee802_11_common.h"
16#include "common/wpa_common.h"
17#include "common/qca-vendor.h"
18#include "common/qca-vendor-attr.h"
19#include "common/brcm_vendor.h"
20#include "driver_nl80211.h"
21
22
23static int protocol_feature_handler(struct nl_msg *msg, void *arg)
24{
25	u32 *feat = arg;
26	struct nlattr *tb_msg[NL80211_ATTR_MAX + 1];
27	struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
28
29	nla_parse(tb_msg, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
30		  genlmsg_attrlen(gnlh, 0), NULL);
31
32	if (tb_msg[NL80211_ATTR_PROTOCOL_FEATURES])
33		*feat = nla_get_u32(tb_msg[NL80211_ATTR_PROTOCOL_FEATURES]);
34
35	return NL_SKIP;
36}
37
38
39static u32 get_nl80211_protocol_features(struct wpa_driver_nl80211_data *drv)
40{
41	u32 feat = 0;
42	struct nl_msg *msg;
43
44	msg = nlmsg_alloc();
45	if (!msg)
46		return 0;
47
48	if (!nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_PROTOCOL_FEATURES)) {
49		nlmsg_free(msg);
50		return 0;
51	}
52
53	if (send_and_recv_msgs(drv, msg, protocol_feature_handler, &feat,
54			       NULL, NULL) == 0)
55		return feat;
56
57	return 0;
58}
59
60
61struct wiphy_info_data {
62	struct wpa_driver_nl80211_data *drv;
63	struct wpa_driver_capa *capa;
64
65	unsigned int num_multichan_concurrent;
66
67	unsigned int error:1;
68	unsigned int device_ap_sme:1;
69	unsigned int poll_command_supported:1;
70	unsigned int data_tx_status:1;
71	unsigned int auth_supported:1;
72	unsigned int connect_supported:1;
73	unsigned int p2p_go_supported:1;
74	unsigned int p2p_client_supported:1;
75	unsigned int p2p_go_ctwindow_supported:1;
76	unsigned int p2p_concurrent:1;
77	unsigned int channel_switch_supported:1;
78	unsigned int set_qos_map_supported:1;
79	unsigned int have_low_prio_scan:1;
80	unsigned int wmm_ac_supported:1;
81	unsigned int mac_addr_rand_scan_supported:1;
82	unsigned int mac_addr_rand_sched_scan_supported:1;
83	unsigned int update_ft_ies_supported:1;
84	unsigned int has_key_mgmt:1;
85	unsigned int has_key_mgmt_iftype:1;
86};
87
88
89static unsigned int probe_resp_offload_support(int supp_protocols)
90{
91	unsigned int prot = 0;
92
93	if (supp_protocols & NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS)
94		prot |= WPA_DRIVER_PROBE_RESP_OFFLOAD_WPS;
95	if (supp_protocols & NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS2)
96		prot |= WPA_DRIVER_PROBE_RESP_OFFLOAD_WPS2;
97	if (supp_protocols & NL80211_PROBE_RESP_OFFLOAD_SUPPORT_P2P)
98		prot |= WPA_DRIVER_PROBE_RESP_OFFLOAD_P2P;
99	if (supp_protocols & NL80211_PROBE_RESP_OFFLOAD_SUPPORT_80211U)
100		prot |= WPA_DRIVER_PROBE_RESP_OFFLOAD_INTERWORKING;
101
102	return prot;
103}
104
105
106static void wiphy_info_supported_iftypes(struct wiphy_info_data *info,
107					 struct nlattr *tb)
108{
109	struct nlattr *nl_mode;
110	int i;
111
112	if (tb == NULL)
113		return;
114
115	nla_for_each_nested(nl_mode, tb, i) {
116		switch (nla_type(nl_mode)) {
117		case NL80211_IFTYPE_AP:
118			info->capa->flags |= WPA_DRIVER_FLAGS_AP;
119			break;
120		case NL80211_IFTYPE_MESH_POINT:
121			info->capa->flags |= WPA_DRIVER_FLAGS_MESH;
122			break;
123		case NL80211_IFTYPE_ADHOC:
124			info->capa->flags |= WPA_DRIVER_FLAGS_IBSS;
125			break;
126		case NL80211_IFTYPE_P2P_DEVICE:
127			info->capa->flags |=
128				WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE;
129			break;
130		case NL80211_IFTYPE_P2P_GO:
131			info->p2p_go_supported = 1;
132			break;
133		case NL80211_IFTYPE_P2P_CLIENT:
134			info->p2p_client_supported = 1;
135			break;
136		}
137	}
138}
139
140
141static int wiphy_info_iface_comb_process(struct wiphy_info_data *info,
142					 struct nlattr *nl_combi)
143{
144	struct nlattr *tb_comb[NUM_NL80211_IFACE_COMB];
145	struct nlattr *tb_limit[NUM_NL80211_IFACE_LIMIT];
146	struct nlattr *nl_limit, *nl_mode;
147	int err, rem_limit, rem_mode;
148	int combination_has_p2p = 0, combination_has_mgd = 0;
149	static struct nla_policy
150	iface_combination_policy[NUM_NL80211_IFACE_COMB] = {
151		[NL80211_IFACE_COMB_LIMITS] = { .type = NLA_NESTED },
152		[NL80211_IFACE_COMB_MAXNUM] = { .type = NLA_U32 },
153		[NL80211_IFACE_COMB_STA_AP_BI_MATCH] = { .type = NLA_FLAG },
154		[NL80211_IFACE_COMB_NUM_CHANNELS] = { .type = NLA_U32 },
155		[NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS] = { .type = NLA_U32 },
156	},
157	iface_limit_policy[NUM_NL80211_IFACE_LIMIT] = {
158		[NL80211_IFACE_LIMIT_TYPES] = { .type = NLA_NESTED },
159		[NL80211_IFACE_LIMIT_MAX] = { .type = NLA_U32 },
160	};
161
162	err = nla_parse_nested(tb_comb, MAX_NL80211_IFACE_COMB,
163			       nl_combi, iface_combination_policy);
164	if (err || !tb_comb[NL80211_IFACE_COMB_LIMITS] ||
165	    !tb_comb[NL80211_IFACE_COMB_MAXNUM] ||
166	    !tb_comb[NL80211_IFACE_COMB_NUM_CHANNELS])
167		return 0; /* broken combination */
168
169	if (tb_comb[NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS])
170		info->capa->flags |= WPA_DRIVER_FLAGS_RADAR;
171
172	nla_for_each_nested(nl_limit, tb_comb[NL80211_IFACE_COMB_LIMITS],
173			    rem_limit) {
174		err = nla_parse_nested(tb_limit, MAX_NL80211_IFACE_LIMIT,
175				       nl_limit, iface_limit_policy);
176		if (err || !tb_limit[NL80211_IFACE_LIMIT_TYPES])
177			return 0; /* broken combination */
178
179		nla_for_each_nested(nl_mode,
180				    tb_limit[NL80211_IFACE_LIMIT_TYPES],
181				    rem_mode) {
182			int ift = nla_type(nl_mode);
183			if (ift == NL80211_IFTYPE_P2P_GO ||
184			    ift == NL80211_IFTYPE_P2P_CLIENT)
185				combination_has_p2p = 1;
186			if (ift == NL80211_IFTYPE_STATION)
187				combination_has_mgd = 1;
188		}
189		if (combination_has_p2p && combination_has_mgd)
190			break;
191	}
192
193	if (combination_has_p2p && combination_has_mgd) {
194		unsigned int num_channels =
195			nla_get_u32(tb_comb[NL80211_IFACE_COMB_NUM_CHANNELS]);
196
197		info->p2p_concurrent = 1;
198		if (info->num_multichan_concurrent < num_channels)
199			info->num_multichan_concurrent = num_channels;
200	}
201
202	return 0;
203}
204
205
206static void wiphy_info_iface_comb(struct wiphy_info_data *info,
207				  struct nlattr *tb)
208{
209	struct nlattr *nl_combi;
210	int rem_combi;
211
212	if (tb == NULL)
213		return;
214
215	nla_for_each_nested(nl_combi, tb, rem_combi) {
216		if (wiphy_info_iface_comb_process(info, nl_combi) > 0)
217			break;
218	}
219}
220
221
222static void wiphy_info_supp_cmds(struct wiphy_info_data *info,
223				 struct nlattr *tb)
224{
225	struct nlattr *nl_cmd;
226	int i;
227
228	if (tb == NULL)
229		return;
230
231	nla_for_each_nested(nl_cmd, tb, i) {
232		switch (nla_get_u32(nl_cmd)) {
233		case NL80211_CMD_AUTHENTICATE:
234			info->auth_supported = 1;
235			break;
236		case NL80211_CMD_CONNECT:
237			info->connect_supported = 1;
238			break;
239		case NL80211_CMD_START_SCHED_SCAN:
240			info->capa->sched_scan_supported = 1;
241			break;
242		case NL80211_CMD_PROBE_CLIENT:
243			info->poll_command_supported = 1;
244			break;
245		case NL80211_CMD_CHANNEL_SWITCH:
246			info->channel_switch_supported = 1;
247			break;
248		case NL80211_CMD_SET_QOS_MAP:
249			info->set_qos_map_supported = 1;
250			break;
251		case NL80211_CMD_UPDATE_FT_IES:
252			info->update_ft_ies_supported = 1;
253			break;
254		}
255	}
256}
257
258
259static unsigned int get_akm_suites_info(struct nlattr *tb)
260{
261	int i, num;
262	unsigned int key_mgmt = 0;
263	u32 *akms;
264
265	if (!tb)
266		return 0;
267
268	num = nla_len(tb) / sizeof(u32);
269	akms = nla_data(tb);
270	for (i = 0; i < num; i++) {
271		switch (akms[i]) {
272		case RSN_AUTH_KEY_MGMT_UNSPEC_802_1X:
273			key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_WPA |
274				WPA_DRIVER_CAPA_KEY_MGMT_WPA2;
275			break;
276		case RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X:
277			key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_WPA_PSK |
278				WPA_DRIVER_CAPA_KEY_MGMT_WPA2_PSK;
279			break;
280		case RSN_AUTH_KEY_MGMT_FT_802_1X:
281			key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_FT;
282			break;
283		case RSN_AUTH_KEY_MGMT_FT_PSK:
284			key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_FT_PSK;
285			break;
286		case RSN_AUTH_KEY_MGMT_802_1X_SHA256:
287			key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_802_1X_SHA256;
288			break;
289		case RSN_AUTH_KEY_MGMT_PSK_SHA256:
290			key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_PSK_SHA256;
291			break;
292		case RSN_AUTH_KEY_MGMT_TPK_HANDSHAKE:
293			key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_TPK_HANDSHAKE;
294			break;
295		case RSN_AUTH_KEY_MGMT_FT_SAE:
296			key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_FT_SAE;
297			break;
298		case RSN_AUTH_KEY_MGMT_FT_802_1X_SHA384:
299			key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_FT_802_1X_SHA384;
300			break;
301		case RSN_AUTH_KEY_MGMT_CCKM:
302			key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_CCKM;
303			break;
304		case RSN_AUTH_KEY_MGMT_OSEN:
305			key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_OSEN;
306			break;
307		case RSN_AUTH_KEY_MGMT_802_1X_SUITE_B:
308			key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_SUITE_B;
309			break;
310		case RSN_AUTH_KEY_MGMT_802_1X_SUITE_B_192:
311			key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_SUITE_B_192;
312			break;
313		case RSN_AUTH_KEY_MGMT_OWE:
314			key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_OWE;
315			break;
316		case RSN_AUTH_KEY_MGMT_DPP:
317			key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_DPP;
318			break;
319		case RSN_AUTH_KEY_MGMT_FILS_SHA256:
320			key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_FILS_SHA256;
321			break;
322		case RSN_AUTH_KEY_MGMT_FILS_SHA384:
323			key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_FILS_SHA384;
324			break;
325		case RSN_AUTH_KEY_MGMT_FT_FILS_SHA256:
326			key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_FT_FILS_SHA256;
327			break;
328		case RSN_AUTH_KEY_MGMT_FT_FILS_SHA384:
329			key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_FT_FILS_SHA384;
330			break;
331		case RSN_AUTH_KEY_MGMT_SAE:
332			key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_SAE;
333			break;
334		}
335	}
336
337	return key_mgmt;
338}
339
340
341static void get_iface_akm_suites_info(struct wiphy_info_data *info,
342					struct nlattr *nl_akms)
343{
344	struct nlattr *tb[NL80211_IFTYPE_AKM_ATTR_MAX + 1];
345	struct nlattr *nl_iftype;
346	unsigned int key_mgmt;
347	int i;
348
349	if (!nl_akms)
350		return;
351
352	nla_parse(tb, NL80211_IFTYPE_AKM_ATTR_MAX,
353		  nla_data(nl_akms), nla_len(nl_akms), NULL);
354
355	if (!tb[NL80211_IFTYPE_AKM_ATTR_IFTYPES] ||
356	    !tb[NL80211_IFTYPE_AKM_ATTR_SUITES])
357		return;
358
359	info->has_key_mgmt_iftype = 1;
360	key_mgmt = get_akm_suites_info(tb[NL80211_IFTYPE_AKM_ATTR_SUITES]);
361
362	nla_for_each_nested(nl_iftype, tb[NL80211_IFTYPE_AKM_ATTR_IFTYPES], i) {
363		switch (nla_type(nl_iftype)) {
364		case NL80211_IFTYPE_ADHOC:
365			info->drv->capa.key_mgmt_iftype[WPA_IF_IBSS] = key_mgmt;
366			break;
367		case NL80211_IFTYPE_STATION:
368			info->drv->capa.key_mgmt_iftype[WPA_IF_STATION] =
369				key_mgmt;
370			break;
371		case NL80211_IFTYPE_AP:
372			info->drv->capa.key_mgmt_iftype[WPA_IF_AP_BSS] =
373				key_mgmt;
374			break;
375		case NL80211_IFTYPE_AP_VLAN:
376			info->drv->capa.key_mgmt_iftype[WPA_IF_AP_VLAN] =
377				key_mgmt;
378			break;
379		case NL80211_IFTYPE_MESH_POINT:
380			info->drv->capa.key_mgmt_iftype[WPA_IF_MESH] = key_mgmt;
381			break;
382		case NL80211_IFTYPE_P2P_CLIENT:
383			info->drv->capa.key_mgmt_iftype[WPA_IF_P2P_CLIENT] =
384				key_mgmt;
385			break;
386		case NL80211_IFTYPE_P2P_GO:
387			info->drv->capa.key_mgmt_iftype[WPA_IF_P2P_GO] =
388				key_mgmt;
389			break;
390		case NL80211_IFTYPE_P2P_DEVICE:
391			info->drv->capa.key_mgmt_iftype[WPA_IF_P2P_DEVICE] =
392				key_mgmt;
393			break;
394		case NL80211_IFTYPE_NAN:
395			info->drv->capa.key_mgmt_iftype[WPA_IF_NAN] = key_mgmt;
396			break;
397		}
398		wpa_printf(MSG_DEBUG, "nl80211: %s supported key_mgmt 0x%x",
399			   nl80211_iftype_str(nla_type(nl_iftype)),
400			   key_mgmt);
401	}
402}
403
404
405static void wiphy_info_iftype_akm_suites(struct wiphy_info_data *info,
406					 struct nlattr *tb)
407{
408	struct nlattr *nl_if;
409	int rem_if;
410
411	if (!tb)
412		return;
413
414	nla_for_each_nested(nl_if, tb, rem_if)
415		get_iface_akm_suites_info(info, nl_if);
416}
417
418
419static void wiphy_info_akm_suites(struct wiphy_info_data *info,
420				  struct nlattr *tb)
421{
422	if (!tb)
423		return;
424
425	info->has_key_mgmt = 1;
426	info->capa->key_mgmt = get_akm_suites_info(tb);
427	wpa_printf(MSG_DEBUG, "nl80211: wiphy supported key_mgmt 0x%x",
428		   info->capa->key_mgmt);
429}
430
431
432static void wiphy_info_cipher_suites(struct wiphy_info_data *info,
433				     struct nlattr *tb)
434{
435	int i, num;
436	u32 *ciphers;
437
438	if (tb == NULL)
439		return;
440
441	num = nla_len(tb) / sizeof(u32);
442	ciphers = nla_data(tb);
443	for (i = 0; i < num; i++) {
444		u32 c = ciphers[i];
445
446		wpa_printf(MSG_DEBUG, "nl80211: Supported cipher %02x-%02x-%02x:%d",
447			   c >> 24, (c >> 16) & 0xff,
448			   (c >> 8) & 0xff, c & 0xff);
449		switch (c) {
450		case RSN_CIPHER_SUITE_CCMP_256:
451			info->capa->enc |= WPA_DRIVER_CAPA_ENC_CCMP_256;
452			break;
453		case RSN_CIPHER_SUITE_GCMP_256:
454			info->capa->enc |= WPA_DRIVER_CAPA_ENC_GCMP_256;
455			break;
456		case RSN_CIPHER_SUITE_CCMP:
457			info->capa->enc |= WPA_DRIVER_CAPA_ENC_CCMP;
458			break;
459		case RSN_CIPHER_SUITE_GCMP:
460			info->capa->enc |= WPA_DRIVER_CAPA_ENC_GCMP;
461			break;
462		case RSN_CIPHER_SUITE_TKIP:
463			info->capa->enc |= WPA_DRIVER_CAPA_ENC_TKIP;
464			break;
465		case RSN_CIPHER_SUITE_WEP104:
466			info->capa->enc |= WPA_DRIVER_CAPA_ENC_WEP104;
467			break;
468		case RSN_CIPHER_SUITE_WEP40:
469			info->capa->enc |= WPA_DRIVER_CAPA_ENC_WEP40;
470			break;
471		case RSN_CIPHER_SUITE_AES_128_CMAC:
472			info->capa->enc |= WPA_DRIVER_CAPA_ENC_BIP;
473			break;
474		case RSN_CIPHER_SUITE_BIP_GMAC_128:
475			info->capa->enc |= WPA_DRIVER_CAPA_ENC_BIP_GMAC_128;
476			break;
477		case RSN_CIPHER_SUITE_BIP_GMAC_256:
478			info->capa->enc |= WPA_DRIVER_CAPA_ENC_BIP_GMAC_256;
479			break;
480		case RSN_CIPHER_SUITE_BIP_CMAC_256:
481			info->capa->enc |= WPA_DRIVER_CAPA_ENC_BIP_CMAC_256;
482			break;
483		case RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED:
484			info->capa->enc |= WPA_DRIVER_CAPA_ENC_GTK_NOT_USED;
485			break;
486		}
487	}
488}
489
490
491static void wiphy_info_max_roc(struct wpa_driver_capa *capa,
492			       struct nlattr *tb)
493{
494	if (tb)
495		capa->max_remain_on_chan = nla_get_u32(tb);
496}
497
498
499static void wiphy_info_tdls(struct wpa_driver_capa *capa, struct nlattr *tdls,
500			    struct nlattr *ext_setup)
501{
502	if (tdls == NULL)
503		return;
504
505	wpa_printf(MSG_DEBUG, "nl80211: TDLS supported");
506	capa->flags |= WPA_DRIVER_FLAGS_TDLS_SUPPORT;
507
508	if (ext_setup) {
509		wpa_printf(MSG_DEBUG, "nl80211: TDLS external setup");
510		capa->flags |= WPA_DRIVER_FLAGS_TDLS_EXTERNAL_SETUP;
511	}
512}
513
514
515static int ext_feature_isset(const u8 *ext_features, int ext_features_len,
516			     enum nl80211_ext_feature_index ftidx)
517{
518	u8 ft_byte;
519
520	if ((int) ftidx / 8 >= ext_features_len)
521		return 0;
522
523	ft_byte = ext_features[ftidx / 8];
524	return (ft_byte & BIT(ftidx % 8)) != 0;
525}
526
527
528static void wiphy_info_ext_feature_flags(struct wiphy_info_data *info,
529					 struct nlattr *tb)
530{
531	struct wpa_driver_capa *capa = info->capa;
532	u8 *ext_features;
533	int len;
534
535	if (tb == NULL)
536		return;
537
538	ext_features = nla_data(tb);
539	len = nla_len(tb);
540
541	if (ext_feature_isset(ext_features, len, NL80211_EXT_FEATURE_VHT_IBSS))
542		capa->flags |= WPA_DRIVER_FLAGS_VHT_IBSS;
543
544	if (ext_feature_isset(ext_features, len, NL80211_EXT_FEATURE_RRM))
545		capa->rrm_flags |= WPA_DRIVER_FLAGS_SUPPORT_RRM;
546
547	if (ext_feature_isset(ext_features, len, NL80211_EXT_FEATURE_FILS_STA))
548		capa->flags |= WPA_DRIVER_FLAGS_SUPPORT_FILS;
549
550	if (ext_feature_isset(ext_features, len,
551			      NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
552		capa->flags |= WPA_DRIVER_FLAGS_BEACON_RATE_LEGACY;
553
554	if (ext_feature_isset(ext_features, len,
555			      NL80211_EXT_FEATURE_BEACON_RATE_HT))
556		capa->flags |= WPA_DRIVER_FLAGS_BEACON_RATE_HT;
557
558	if (ext_feature_isset(ext_features, len,
559			      NL80211_EXT_FEATURE_BEACON_RATE_VHT))
560		capa->flags |= WPA_DRIVER_FLAGS_BEACON_RATE_VHT;
561
562	if (ext_feature_isset(ext_features, len,
563			      NL80211_EXT_FEATURE_BEACON_RATE_HE))
564		capa->flags2 |= WPA_DRIVER_FLAGS2_BEACON_RATE_HE;
565
566	if (ext_feature_isset(ext_features, len,
567			      NL80211_EXT_FEATURE_SET_SCAN_DWELL))
568		capa->rrm_flags |= WPA_DRIVER_FLAGS_SUPPORT_SET_SCAN_DWELL;
569
570	if (ext_feature_isset(ext_features, len,
571			      NL80211_EXT_FEATURE_SCAN_START_TIME) &&
572	    ext_feature_isset(ext_features, len,
573			      NL80211_EXT_FEATURE_BSS_PARENT_TSF) &&
574	    ext_feature_isset(ext_features, len,
575			      NL80211_EXT_FEATURE_SET_SCAN_DWELL))
576		capa->rrm_flags |= WPA_DRIVER_FLAGS_SUPPORT_BEACON_REPORT;
577	if (ext_feature_isset(ext_features, len,
578			      NL80211_EXT_FEATURE_MGMT_TX_RANDOM_TA))
579		capa->flags |= WPA_DRIVER_FLAGS_MGMT_TX_RANDOM_TA;
580	if (ext_feature_isset(ext_features, len,
581			      NL80211_EXT_FEATURE_MGMT_TX_RANDOM_TA_CONNECTED))
582		capa->flags |= WPA_DRIVER_FLAGS_MGMT_TX_RANDOM_TA_CONNECTED;
583	if (ext_feature_isset(ext_features, len,
584			      NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI))
585		capa->flags |= WPA_DRIVER_FLAGS_SCHED_SCAN_RELATIVE_RSSI;
586	if (ext_feature_isset(ext_features, len,
587			      NL80211_EXT_FEATURE_FILS_SK_OFFLOAD))
588		capa->flags |= WPA_DRIVER_FLAGS_FILS_SK_OFFLOAD;
589
590	if (ext_feature_isset(ext_features, len,
591			      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK))
592		capa->flags |= WPA_DRIVER_FLAGS_4WAY_HANDSHAKE_PSK;
593	if (ext_feature_isset(ext_features, len,
594			      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
595		capa->flags |= WPA_DRIVER_FLAGS_4WAY_HANDSHAKE_8021X;
596
597	if (ext_feature_isset(ext_features, len,
598			      NL80211_EXT_FEATURE_MFP_OPTIONAL))
599		capa->flags |= WPA_DRIVER_FLAGS_MFP_OPTIONAL;
600
601	if (ext_feature_isset(ext_features, len,
602			      NL80211_EXT_FEATURE_DFS_OFFLOAD))
603		capa->flags |= WPA_DRIVER_FLAGS_DFS_OFFLOAD;
604
605#ifdef CONFIG_MBO
606	if (ext_feature_isset(ext_features, len,
607			      NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME) &&
608	    ext_feature_isset(ext_features, len,
609			      NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP) &&
610	    ext_feature_isset(ext_features, len,
611			      NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE) &&
612	    ext_feature_isset(
613		    ext_features, len,
614		    NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION))
615		capa->flags |= WPA_DRIVER_FLAGS_OCE_STA;
616#endif /* CONFIG_MBO */
617
618	if (ext_feature_isset(ext_features, len,
619			      NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER))
620		capa->flags |= WPA_DRIVER_FLAGS_FTM_RESPONDER;
621
622	if (ext_feature_isset(ext_features, len,
623			      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
624		capa->flags |= WPA_DRIVER_FLAGS_CONTROL_PORT;
625	if (ext_feature_isset(ext_features, len,
626			      NL80211_EXT_FEATURE_CONTROL_PORT_NO_PREAUTH))
627		capa->flags2 |= WPA_DRIVER_FLAGS2_CONTROL_PORT_RX;
628	if (ext_feature_isset(
629		    ext_features, len,
630		    NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211_TX_STATUS))
631		capa->flags2 |= WPA_DRIVER_FLAGS2_CONTROL_PORT_TX_STATUS;
632
633	if (ext_feature_isset(ext_features, len,
634			      NL80211_EXT_FEATURE_VLAN_OFFLOAD))
635		capa->flags |= WPA_DRIVER_FLAGS_VLAN_OFFLOAD;
636
637	if (ext_feature_isset(ext_features, len,
638			      NL80211_EXT_FEATURE_CAN_REPLACE_PTK0))
639		capa->flags |= WPA_DRIVER_FLAGS_SAFE_PTK0_REKEYS;
640
641	if (ext_feature_isset(ext_features, len,
642			      NL80211_EXT_FEATURE_BEACON_PROTECTION))
643		capa->flags |= WPA_DRIVER_FLAGS_BEACON_PROTECTION;
644
645	if (ext_feature_isset(ext_features, len,
646			      NL80211_EXT_FEATURE_EXT_KEY_ID))
647		capa->flags |= WPA_DRIVER_FLAGS_EXTENDED_KEY_ID;
648
649	if (ext_feature_isset(ext_features, len,
650			      NL80211_EXT_FEATURE_MULTICAST_REGISTRATIONS))
651		info->drv->multicast_registrations = 1;
652
653	if (ext_feature_isset(ext_features, len,
654			      NL80211_EXT_FEATURE_FILS_DISCOVERY))
655		info->drv->fils_discovery = 1;
656
657	if (ext_feature_isset(ext_features, len,
658			      NL80211_EXT_FEATURE_UNSOL_BCAST_PROBE_RESP))
659		info->drv->unsol_bcast_probe_resp = 1;
660
661	if (ext_feature_isset(ext_features, len,
662			      NL80211_EXT_FEATURE_BEACON_PROTECTION_CLIENT))
663		capa->flags2 |= WPA_DRIVER_FLAGS2_BEACON_PROTECTION_CLIENT;
664
665	if (ext_feature_isset(ext_features, len,
666			      NL80211_EXT_FEATURE_OPERATING_CHANNEL_VALIDATION))
667		capa->flags2 |= WPA_DRIVER_FLAGS2_OCV;
668}
669
670
671static void wiphy_info_feature_flags(struct wiphy_info_data *info,
672				     struct nlattr *tb)
673{
674	u32 flags;
675	struct wpa_driver_capa *capa = info->capa;
676
677	if (tb == NULL)
678		return;
679
680	flags = nla_get_u32(tb);
681
682	if (flags & NL80211_FEATURE_SK_TX_STATUS)
683		info->data_tx_status = 1;
684
685	if (flags & NL80211_FEATURE_INACTIVITY_TIMER)
686		capa->flags |= WPA_DRIVER_FLAGS_INACTIVITY_TIMER;
687
688	if (flags & NL80211_FEATURE_SAE)
689		capa->flags |= WPA_DRIVER_FLAGS_SAE;
690
691	if (flags & NL80211_FEATURE_NEED_OBSS_SCAN)
692		capa->flags |= WPA_DRIVER_FLAGS_OBSS_SCAN;
693
694	if (flags & NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)
695		capa->flags |= WPA_DRIVER_FLAGS_HT_2040_COEX;
696
697	if (flags & NL80211_FEATURE_TDLS_CHANNEL_SWITCH) {
698		wpa_printf(MSG_DEBUG, "nl80211: TDLS channel switch");
699		capa->flags |= WPA_DRIVER_FLAGS_TDLS_CHANNEL_SWITCH;
700	}
701
702	if (flags & NL80211_FEATURE_P2P_GO_CTWIN)
703		info->p2p_go_ctwindow_supported = 1;
704
705	if (flags & NL80211_FEATURE_LOW_PRIORITY_SCAN)
706		info->have_low_prio_scan = 1;
707
708	if (flags & NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR)
709		info->mac_addr_rand_scan_supported = 1;
710
711	if (flags & NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR)
712		info->mac_addr_rand_sched_scan_supported = 1;
713
714	if (flags & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
715		info->wmm_ac_supported = 1;
716
717	if (flags & NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES)
718		capa->rrm_flags |= WPA_DRIVER_FLAGS_DS_PARAM_SET_IE_IN_PROBES;
719
720	if (flags & NL80211_FEATURE_WFA_TPC_IE_IN_PROBES)
721		capa->rrm_flags |= WPA_DRIVER_FLAGS_WFA_TPC_IE_IN_PROBES;
722
723	if (flags & NL80211_FEATURE_QUIET)
724		capa->rrm_flags |= WPA_DRIVER_FLAGS_QUIET;
725
726	if (flags & NL80211_FEATURE_TX_POWER_INSERTION)
727		capa->rrm_flags |= WPA_DRIVER_FLAGS_TX_POWER_INSERTION;
728
729	if (flags & NL80211_FEATURE_HT_IBSS)
730		capa->flags |= WPA_DRIVER_FLAGS_HT_IBSS;
731
732	if (flags & NL80211_FEATURE_FULL_AP_CLIENT_STATE)
733		capa->flags |= WPA_DRIVER_FLAGS_FULL_AP_CLIENT_STATE;
734}
735
736
737static void wiphy_info_probe_resp_offload(struct wpa_driver_capa *capa,
738					  struct nlattr *tb)
739{
740	u32 protocols;
741
742	if (tb == NULL)
743		return;
744
745	protocols = nla_get_u32(tb);
746	wpa_printf(MSG_DEBUG, "nl80211: Supports Probe Response offload in AP "
747		   "mode");
748	capa->flags |= WPA_DRIVER_FLAGS_PROBE_RESP_OFFLOAD;
749	capa->probe_resp_offloads = probe_resp_offload_support(protocols);
750}
751
752
753static void wiphy_info_wowlan_triggers(struct wpa_driver_capa *capa,
754				       struct nlattr *tb)
755{
756	struct nlattr *triggers[MAX_NL80211_WOWLAN_TRIG + 1];
757
758	if (tb == NULL)
759		return;
760
761	if (nla_parse_nested(triggers, MAX_NL80211_WOWLAN_TRIG,
762			     tb, NULL))
763		return;
764
765	if (triggers[NL80211_WOWLAN_TRIG_ANY])
766		capa->wowlan_triggers.any = 1;
767	if (triggers[NL80211_WOWLAN_TRIG_DISCONNECT])
768		capa->wowlan_triggers.disconnect = 1;
769	if (triggers[NL80211_WOWLAN_TRIG_MAGIC_PKT])
770		capa->wowlan_triggers.magic_pkt = 1;
771	if (triggers[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE])
772		capa->wowlan_triggers.gtk_rekey_failure = 1;
773	if (triggers[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST])
774		capa->wowlan_triggers.eap_identity_req = 1;
775	if (triggers[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE])
776		capa->wowlan_triggers.four_way_handshake = 1;
777	if (triggers[NL80211_WOWLAN_TRIG_RFKILL_RELEASE])
778		capa->wowlan_triggers.rfkill_release = 1;
779}
780
781
782static void wiphy_info_extended_capab(struct wpa_driver_nl80211_data *drv,
783				      struct nlattr *tb)
784{
785	int rem = 0, i;
786	struct nlattr *tb1[NL80211_ATTR_MAX + 1], *attr;
787
788	if (!tb || drv->num_iface_ext_capa == NL80211_IFTYPE_MAX)
789		return;
790
791	nla_for_each_nested(attr, tb, rem) {
792		unsigned int len;
793		struct drv_nl80211_ext_capa *capa;
794
795		nla_parse(tb1, NL80211_ATTR_MAX, nla_data(attr),
796			  nla_len(attr), NULL);
797
798		if (!tb1[NL80211_ATTR_IFTYPE] ||
799		    !tb1[NL80211_ATTR_EXT_CAPA] ||
800		    !tb1[NL80211_ATTR_EXT_CAPA_MASK])
801			continue;
802
803		capa = &drv->iface_ext_capa[drv->num_iface_ext_capa];
804		capa->iftype = nla_get_u32(tb1[NL80211_ATTR_IFTYPE]);
805		wpa_printf(MSG_DEBUG,
806			   "nl80211: Driver-advertised extended capabilities for interface type %s",
807			   nl80211_iftype_str(capa->iftype));
808
809		len = nla_len(tb1[NL80211_ATTR_EXT_CAPA]);
810		capa->ext_capa = os_memdup(nla_data(tb1[NL80211_ATTR_EXT_CAPA]),
811					   len);
812		if (!capa->ext_capa)
813			goto err;
814
815		capa->ext_capa_len = len;
816		wpa_hexdump(MSG_DEBUG, "nl80211: Extended capabilities",
817			    capa->ext_capa, capa->ext_capa_len);
818
819		len = nla_len(tb1[NL80211_ATTR_EXT_CAPA_MASK]);
820		capa->ext_capa_mask =
821			os_memdup(nla_data(tb1[NL80211_ATTR_EXT_CAPA_MASK]),
822				  len);
823		if (!capa->ext_capa_mask)
824			goto err;
825
826		wpa_hexdump(MSG_DEBUG, "nl80211: Extended capabilities mask",
827			    capa->ext_capa_mask, capa->ext_capa_len);
828
829		drv->num_iface_ext_capa++;
830		if (drv->num_iface_ext_capa == NL80211_IFTYPE_MAX)
831			break;
832	}
833
834	return;
835
836err:
837	/* Cleanup allocated memory on error */
838	for (i = 0; i < NL80211_IFTYPE_MAX; i++) {
839		os_free(drv->iface_ext_capa[i].ext_capa);
840		drv->iface_ext_capa[i].ext_capa = NULL;
841		os_free(drv->iface_ext_capa[i].ext_capa_mask);
842		drv->iface_ext_capa[i].ext_capa_mask = NULL;
843		drv->iface_ext_capa[i].ext_capa_len = 0;
844	}
845	drv->num_iface_ext_capa = 0;
846}
847
848
849static int wiphy_info_handler(struct nl_msg *msg, void *arg)
850{
851	struct nlattr *tb[NL80211_ATTR_MAX + 1];
852	struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
853	struct wiphy_info_data *info = arg;
854	struct wpa_driver_capa *capa = info->capa;
855	struct wpa_driver_nl80211_data *drv = info->drv;
856
857	nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
858		  genlmsg_attrlen(gnlh, 0), NULL);
859
860	if (tb[NL80211_ATTR_WIPHY])
861		drv->wiphy_idx = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
862
863	if (tb[NL80211_ATTR_WIPHY_NAME])
864		os_strlcpy(drv->phyname,
865			   nla_get_string(tb[NL80211_ATTR_WIPHY_NAME]),
866			   sizeof(drv->phyname));
867	if (tb[NL80211_ATTR_MAX_NUM_SCAN_SSIDS])
868		capa->max_scan_ssids =
869			nla_get_u8(tb[NL80211_ATTR_MAX_NUM_SCAN_SSIDS]);
870
871	if (tb[NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS])
872		capa->max_sched_scan_ssids =
873			nla_get_u8(tb[NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS]);
874
875	if (tb[NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS] &&
876	    tb[NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL] &&
877	    tb[NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS]) {
878		capa->max_sched_scan_plans =
879			nla_get_u32(tb[NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS]);
880
881		capa->max_sched_scan_plan_interval =
882			nla_get_u32(tb[NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL]);
883
884		capa->max_sched_scan_plan_iterations =
885			nla_get_u32(tb[NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS]);
886	}
887
888	if (tb[NL80211_ATTR_MAX_MATCH_SETS])
889		capa->max_match_sets =
890			nla_get_u8(tb[NL80211_ATTR_MAX_MATCH_SETS]);
891
892	if (tb[NL80211_ATTR_MAC_ACL_MAX])
893		capa->max_acl_mac_addrs =
894			nla_get_u32(tb[NL80211_ATTR_MAC_ACL_MAX]);
895
896	wiphy_info_supported_iftypes(info, tb[NL80211_ATTR_SUPPORTED_IFTYPES]);
897	wiphy_info_iface_comb(info, tb[NL80211_ATTR_INTERFACE_COMBINATIONS]);
898	wiphy_info_supp_cmds(info, tb[NL80211_ATTR_SUPPORTED_COMMANDS]);
899	wiphy_info_cipher_suites(info, tb[NL80211_ATTR_CIPHER_SUITES]);
900	wiphy_info_akm_suites(info, tb[NL80211_ATTR_AKM_SUITES]);
901	wiphy_info_iftype_akm_suites(info, tb[NL80211_ATTR_IFTYPE_AKM_SUITES]);
902
903	if (tb[NL80211_ATTR_OFFCHANNEL_TX_OK]) {
904		wpa_printf(MSG_DEBUG, "nl80211: Using driver-based "
905			   "off-channel TX");
906		capa->flags |= WPA_DRIVER_FLAGS_OFFCHANNEL_TX;
907	}
908
909	if (tb[NL80211_ATTR_ROAM_SUPPORT]) {
910		wpa_printf(MSG_DEBUG, "nl80211: Using driver-based roaming");
911		capa->flags |= WPA_DRIVER_FLAGS_BSS_SELECTION;
912	}
913
914	wiphy_info_max_roc(capa,
915			   tb[NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION]);
916
917	if (tb[NL80211_ATTR_SUPPORT_AP_UAPSD])
918		capa->flags |= WPA_DRIVER_FLAGS_AP_UAPSD;
919
920	wiphy_info_tdls(capa, tb[NL80211_ATTR_TDLS_SUPPORT],
921			tb[NL80211_ATTR_TDLS_EXTERNAL_SETUP]);
922
923	if (tb[NL80211_ATTR_DEVICE_AP_SME])
924		info->device_ap_sme = 1;
925
926	wiphy_info_feature_flags(info, tb[NL80211_ATTR_FEATURE_FLAGS]);
927	wiphy_info_ext_feature_flags(info, tb[NL80211_ATTR_EXT_FEATURES]);
928	wiphy_info_probe_resp_offload(capa,
929				      tb[NL80211_ATTR_PROBE_RESP_OFFLOAD]);
930
931	if (tb[NL80211_ATTR_EXT_CAPA] && tb[NL80211_ATTR_EXT_CAPA_MASK] &&
932	    drv->extended_capa == NULL) {
933		drv->extended_capa =
934			os_malloc(nla_len(tb[NL80211_ATTR_EXT_CAPA]));
935		if (drv->extended_capa) {
936			os_memcpy(drv->extended_capa,
937				  nla_data(tb[NL80211_ATTR_EXT_CAPA]),
938				  nla_len(tb[NL80211_ATTR_EXT_CAPA]));
939			drv->extended_capa_len =
940				nla_len(tb[NL80211_ATTR_EXT_CAPA]);
941			wpa_hexdump(MSG_DEBUG,
942				    "nl80211: Driver-advertised extended capabilities (default)",
943				    drv->extended_capa, drv->extended_capa_len);
944		}
945		drv->extended_capa_mask =
946			os_malloc(nla_len(tb[NL80211_ATTR_EXT_CAPA_MASK]));
947		if (drv->extended_capa_mask) {
948			os_memcpy(drv->extended_capa_mask,
949				  nla_data(tb[NL80211_ATTR_EXT_CAPA_MASK]),
950				  nla_len(tb[NL80211_ATTR_EXT_CAPA_MASK]));
951			wpa_hexdump(MSG_DEBUG,
952				    "nl80211: Driver-advertised extended capabilities mask (default)",
953				    drv->extended_capa_mask,
954				    drv->extended_capa_len);
955		} else {
956			os_free(drv->extended_capa);
957			drv->extended_capa = NULL;
958			drv->extended_capa_len = 0;
959		}
960	}
961
962	wiphy_info_extended_capab(drv, tb[NL80211_ATTR_IFTYPE_EXT_CAPA]);
963
964	if (tb[NL80211_ATTR_VENDOR_DATA]) {
965		struct nlattr *nl;
966		int rem;
967
968		nla_for_each_nested(nl, tb[NL80211_ATTR_VENDOR_DATA], rem) {
969			struct nl80211_vendor_cmd_info *vinfo;
970			if (nla_len(nl) != sizeof(*vinfo)) {
971				wpa_printf(MSG_DEBUG, "nl80211: Unexpected vendor data info");
972				continue;
973			}
974			vinfo = nla_data(nl);
975			if (vinfo->vendor_id == OUI_QCA) {
976				switch (vinfo->subcmd) {
977				case QCA_NL80211_VENDOR_SUBCMD_TEST:
978					drv->vendor_cmd_test_avail = 1;
979					break;
980#ifdef CONFIG_DRIVER_NL80211_QCA
981				case QCA_NL80211_VENDOR_SUBCMD_ROAMING:
982					drv->roaming_vendor_cmd_avail = 1;
983					break;
984				case QCA_NL80211_VENDOR_SUBCMD_DFS_CAPABILITY:
985					drv->dfs_vendor_cmd_avail = 1;
986					break;
987				case QCA_NL80211_VENDOR_SUBCMD_GET_FEATURES:
988					drv->get_features_vendor_cmd_avail = 1;
989					break;
990				case QCA_NL80211_VENDOR_SUBCMD_GET_PREFERRED_FREQ_LIST:
991					drv->get_pref_freq_list = 1;
992					break;
993				case QCA_NL80211_VENDOR_SUBCMD_SET_PROBABLE_OPER_CHANNEL:
994					drv->set_prob_oper_freq = 1;
995					break;
996				case QCA_NL80211_VENDOR_SUBCMD_DO_ACS:
997					drv->capa.flags |=
998						WPA_DRIVER_FLAGS_ACS_OFFLOAD;
999					drv->qca_do_acs = 1;
1000					break;
1001				case QCA_NL80211_VENDOR_SUBCMD_SETBAND:
1002					drv->setband_vendor_cmd_avail = 1;
1003					break;
1004				case QCA_NL80211_VENDOR_SUBCMD_TRIGGER_SCAN:
1005					drv->scan_vendor_cmd_avail = 1;
1006					break;
1007				case QCA_NL80211_VENDOR_SUBCMD_SET_WIFI_CONFIGURATION:
1008					drv->set_wifi_conf_vendor_cmd_avail = 1;
1009					break;
1010				case QCA_NL80211_VENDOR_SUBCMD_FETCH_BSS_TRANSITION_STATUS:
1011					drv->fetch_bss_trans_status = 1;
1012					break;
1013				case QCA_NL80211_VENDOR_SUBCMD_ROAM:
1014					drv->roam_vendor_cmd_avail = 1;
1015					break;
1016				case QCA_NL80211_VENDOR_SUBCMD_ADD_STA_NODE:
1017					drv->add_sta_node_vendor_cmd_avail = 1;
1018					break;
1019				case QCA_NL80211_VENDOR_SUBCMD_GET_STA_INFO:
1020					drv->get_sta_info_vendor_cmd_avail = 1;
1021					break;
1022#endif /* CONFIG_DRIVER_NL80211_QCA */
1023				}
1024#ifdef CONFIG_DRIVER_NL80211_BRCM
1025			} else if (vinfo->vendor_id == OUI_BRCM) {
1026				switch (vinfo->subcmd) {
1027				case BRCM_VENDOR_SCMD_ACS:
1028					drv->capa.flags |=
1029						WPA_DRIVER_FLAGS_ACS_OFFLOAD;
1030					wpa_printf(MSG_DEBUG,
1031						   "Enabled BRCM ACS");
1032					drv->brcm_do_acs = 1;
1033					break;
1034				}
1035#endif /* CONFIG_DRIVER_NL80211_BRCM */
1036			}
1037
1038			wpa_printf(MSG_DEBUG, "nl80211: Supported vendor command: vendor_id=0x%x subcmd=%u",
1039				   vinfo->vendor_id, vinfo->subcmd);
1040		}
1041	}
1042
1043	if (tb[NL80211_ATTR_VENDOR_EVENTS]) {
1044		struct nlattr *nl;
1045		int rem;
1046
1047		nla_for_each_nested(nl, tb[NL80211_ATTR_VENDOR_EVENTS], rem) {
1048			struct nl80211_vendor_cmd_info *vinfo;
1049			if (nla_len(nl) != sizeof(*vinfo)) {
1050				wpa_printf(MSG_DEBUG, "nl80211: Unexpected vendor data info");
1051				continue;
1052			}
1053			vinfo = nla_data(nl);
1054			wpa_printf(MSG_DEBUG, "nl80211: Supported vendor event: vendor_id=0x%x subcmd=%u",
1055				   vinfo->vendor_id, vinfo->subcmd);
1056		}
1057	}
1058
1059	wiphy_info_wowlan_triggers(capa,
1060				   tb[NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED]);
1061
1062	if (tb[NL80211_ATTR_MAX_AP_ASSOC_STA])
1063		capa->max_stations =
1064			nla_get_u32(tb[NL80211_ATTR_MAX_AP_ASSOC_STA]);
1065
1066	if (tb[NL80211_ATTR_MAX_CSA_COUNTERS])
1067		capa->max_csa_counters =
1068			nla_get_u8(tb[NL80211_ATTR_MAX_CSA_COUNTERS]);
1069
1070	if (tb[NL80211_ATTR_WIPHY_SELF_MANAGED_REG])
1071		capa->flags |= WPA_DRIVER_FLAGS_SELF_MANAGED_REGULATORY;
1072
1073	return NL_SKIP;
1074}
1075
1076
1077static int wpa_driver_nl80211_get_info(struct wpa_driver_nl80211_data *drv,
1078				       struct wiphy_info_data *info)
1079{
1080	u32 feat;
1081	struct nl_msg *msg;
1082	int flags = 0;
1083
1084	os_memset(info, 0, sizeof(*info));
1085	info->capa = &drv->capa;
1086	info->drv = drv;
1087
1088	feat = get_nl80211_protocol_features(drv);
1089	if (feat & NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP)
1090		flags = NLM_F_DUMP;
1091	msg = nl80211_cmd_msg(drv->first_bss, flags, NL80211_CMD_GET_WIPHY);
1092	if (!msg || nla_put_flag(msg, NL80211_ATTR_SPLIT_WIPHY_DUMP)) {
1093		nlmsg_free(msg);
1094		return -1;
1095	}
1096
1097	if (send_and_recv_msgs(drv, msg, wiphy_info_handler, info, NULL, NULL))
1098		return -1;
1099
1100	if (info->auth_supported)
1101		drv->capa.flags |= WPA_DRIVER_FLAGS_SME;
1102	else if (!info->connect_supported) {
1103		wpa_printf(MSG_INFO, "nl80211: Driver does not support "
1104			   "authentication/association or connect commands");
1105		info->error = 1;
1106	}
1107
1108	if (info->p2p_go_supported && info->p2p_client_supported)
1109		drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_CAPABLE;
1110	if (info->p2p_concurrent) {
1111		wpa_printf(MSG_DEBUG, "nl80211: Use separate P2P group "
1112			   "interface (driver advertised support)");
1113		drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_CONCURRENT;
1114		drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_MGMT_AND_NON_P2P;
1115	}
1116	if (info->num_multichan_concurrent > 1) {
1117		wpa_printf(MSG_DEBUG, "nl80211: Enable multi-channel "
1118			   "concurrent (driver advertised support)");
1119		drv->capa.num_multichan_concurrent =
1120			info->num_multichan_concurrent;
1121	}
1122	if (drv->capa.flags & WPA_DRIVER_FLAGS_DEDICATED_P2P_DEVICE)
1123		wpa_printf(MSG_DEBUG, "nl80211: use P2P_DEVICE support");
1124
1125	/* default to 5000 since early versions of mac80211 don't set it */
1126	if (!drv->capa.max_remain_on_chan)
1127		drv->capa.max_remain_on_chan = 5000;
1128
1129	drv->capa.wmm_ac_supported = info->wmm_ac_supported;
1130
1131	drv->capa.mac_addr_rand_sched_scan_supported =
1132		info->mac_addr_rand_sched_scan_supported;
1133	drv->capa.mac_addr_rand_scan_supported =
1134		info->mac_addr_rand_scan_supported;
1135
1136	if (info->channel_switch_supported) {
1137		drv->capa.flags |= WPA_DRIVER_FLAGS_AP_CSA;
1138		if (!drv->capa.max_csa_counters)
1139			drv->capa.max_csa_counters = 1;
1140	}
1141
1142	if (!drv->capa.max_sched_scan_plans) {
1143		drv->capa.max_sched_scan_plans = 1;
1144		drv->capa.max_sched_scan_plan_interval = UINT32_MAX;
1145		drv->capa.max_sched_scan_plan_iterations = 0;
1146	}
1147
1148	if (info->update_ft_ies_supported)
1149		drv->capa.flags |= WPA_DRIVER_FLAGS_UPDATE_FT_IES;
1150
1151	return 0;
1152}
1153
1154
1155#ifdef CONFIG_DRIVER_NL80211_QCA
1156
1157static int dfs_info_handler(struct nl_msg *msg, void *arg)
1158{
1159	struct nlattr *tb[NL80211_ATTR_MAX + 1];
1160	struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1161	int *dfs_capability_ptr = arg;
1162
1163	nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1164		  genlmsg_attrlen(gnlh, 0), NULL);
1165
1166	if (tb[NL80211_ATTR_VENDOR_DATA]) {
1167		struct nlattr *nl_vend = tb[NL80211_ATTR_VENDOR_DATA];
1168		struct nlattr *tb_vendor[QCA_WLAN_VENDOR_ATTR_MAX + 1];
1169
1170		nla_parse(tb_vendor, QCA_WLAN_VENDOR_ATTR_MAX,
1171			  nla_data(nl_vend), nla_len(nl_vend), NULL);
1172
1173		if (tb_vendor[QCA_WLAN_VENDOR_ATTR_DFS]) {
1174			u32 val;
1175			val = nla_get_u32(tb_vendor[QCA_WLAN_VENDOR_ATTR_DFS]);
1176			wpa_printf(MSG_DEBUG, "nl80211: DFS offload capability: %u",
1177				   val);
1178			*dfs_capability_ptr = val;
1179		}
1180	}
1181
1182	return NL_SKIP;
1183}
1184
1185
1186static void qca_nl80211_check_dfs_capa(struct wpa_driver_nl80211_data *drv)
1187{
1188	struct nl_msg *msg;
1189	int dfs_capability = 0;
1190	int ret;
1191
1192	if (!drv->dfs_vendor_cmd_avail)
1193		return;
1194
1195	if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
1196	    nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
1197	    nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
1198			QCA_NL80211_VENDOR_SUBCMD_DFS_CAPABILITY)) {
1199		nlmsg_free(msg);
1200		return;
1201	}
1202
1203	ret = send_and_recv_msgs(drv, msg, dfs_info_handler, &dfs_capability,
1204				 NULL, NULL);
1205	if (!ret && dfs_capability)
1206		drv->capa.flags |= WPA_DRIVER_FLAGS_DFS_OFFLOAD;
1207}
1208
1209
1210struct features_info {
1211	u8 *flags;
1212	size_t flags_len;
1213	struct wpa_driver_capa *capa;
1214};
1215
1216
1217static int features_info_handler(struct nl_msg *msg, void *arg)
1218{
1219	struct nlattr *tb[NL80211_ATTR_MAX + 1];
1220	struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1221	struct features_info *info = arg;
1222	struct nlattr *nl_vend, *attr;
1223
1224	nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1225		  genlmsg_attrlen(gnlh, 0), NULL);
1226
1227	nl_vend = tb[NL80211_ATTR_VENDOR_DATA];
1228	if (nl_vend) {
1229		struct nlattr *tb_vendor[QCA_WLAN_VENDOR_ATTR_MAX + 1];
1230
1231		nla_parse(tb_vendor, QCA_WLAN_VENDOR_ATTR_MAX,
1232			  nla_data(nl_vend), nla_len(nl_vend), NULL);
1233
1234		attr = tb_vendor[QCA_WLAN_VENDOR_ATTR_FEATURE_FLAGS];
1235		if (attr) {
1236			int len = nla_len(attr);
1237			info->flags = os_malloc(len);
1238			if (info->flags != NULL) {
1239				os_memcpy(info->flags, nla_data(attr), len);
1240				info->flags_len = len;
1241			}
1242		}
1243		attr = tb_vendor[QCA_WLAN_VENDOR_ATTR_CONCURRENCY_CAPA];
1244		if (attr)
1245			info->capa->conc_capab = nla_get_u32(attr);
1246
1247		attr = tb_vendor[
1248			QCA_WLAN_VENDOR_ATTR_MAX_CONCURRENT_CHANNELS_2_4_BAND];
1249		if (attr)
1250			info->capa->max_conc_chan_2_4 = nla_get_u32(attr);
1251
1252		attr = tb_vendor[
1253			QCA_WLAN_VENDOR_ATTR_MAX_CONCURRENT_CHANNELS_5_0_BAND];
1254		if (attr)
1255			info->capa->max_conc_chan_5_0 = nla_get_u32(attr);
1256	}
1257
1258	return NL_SKIP;
1259}
1260
1261
1262static int check_feature(enum qca_wlan_vendor_features feature,
1263			 struct features_info *info)
1264{
1265	size_t idx = feature / 8;
1266
1267	return (idx < info->flags_len) &&
1268		(info->flags[idx] & BIT(feature % 8));
1269}
1270
1271
1272static void qca_nl80211_get_features(struct wpa_driver_nl80211_data *drv)
1273{
1274	struct nl_msg *msg;
1275	struct features_info info;
1276	int ret;
1277
1278	if (!drv->get_features_vendor_cmd_avail)
1279		return;
1280
1281	if (!(msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR)) ||
1282	    nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
1283	    nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
1284			QCA_NL80211_VENDOR_SUBCMD_GET_FEATURES)) {
1285		nlmsg_free(msg);
1286		return;
1287	}
1288
1289	os_memset(&info, 0, sizeof(info));
1290	info.capa = &drv->capa;
1291	ret = send_and_recv_msgs(drv, msg, features_info_handler, &info,
1292				 NULL, NULL);
1293	if (ret || !info.flags)
1294		return;
1295
1296	if (check_feature(QCA_WLAN_VENDOR_FEATURE_KEY_MGMT_OFFLOAD, &info))
1297		drv->capa.flags |= WPA_DRIVER_FLAGS_KEY_MGMT_OFFLOAD;
1298
1299	if (check_feature(QCA_WLAN_VENDOR_FEATURE_SUPPORT_HW_MODE_ANY, &info))
1300		drv->capa.flags |= WPA_DRIVER_FLAGS_SUPPORT_HW_MODE_ANY;
1301
1302	if (check_feature(QCA_WLAN_VENDOR_FEATURE_OFFCHANNEL_SIMULTANEOUS,
1303			  &info))
1304		drv->capa.flags |= WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS;
1305	if (check_feature(QCA_WLAN_VENDOR_FEATURE_P2P_LISTEN_OFFLOAD, &info))
1306		drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_LISTEN_OFFLOAD;
1307	if (check_feature(QCA_WLAN_VENDOR_FEATURE_OCE_STA, &info))
1308		drv->capa.flags |= WPA_DRIVER_FLAGS_OCE_STA;
1309	if (check_feature(QCA_WLAN_VENDOR_FEATURE_OCE_AP, &info))
1310		drv->capa.flags |= WPA_DRIVER_FLAGS_OCE_AP;
1311	if (check_feature(QCA_WLAN_VENDOR_FEATURE_OCE_STA_CFON, &info))
1312		drv->capa.flags |= WPA_DRIVER_FLAGS_OCE_STA_CFON;
1313	os_free(info.flags);
1314}
1315
1316#endif /* CONFIG_DRIVER_NL80211_QCA */
1317
1318
1319int wpa_driver_nl80211_capa(struct wpa_driver_nl80211_data *drv)
1320{
1321	struct wiphy_info_data info;
1322	int i;
1323
1324	if (wpa_driver_nl80211_get_info(drv, &info))
1325		return -1;
1326
1327	if (info.error)
1328		return -1;
1329
1330	drv->has_capability = 1;
1331	drv->has_driver_key_mgmt = info.has_key_mgmt | info.has_key_mgmt_iftype;
1332
1333	/* Fallback to hardcoded defaults if the driver does nott advertize any
1334	 * AKM capabilities. */
1335	if (!drv->has_driver_key_mgmt) {
1336		drv->capa.key_mgmt = WPA_DRIVER_CAPA_KEY_MGMT_WPA |
1337			WPA_DRIVER_CAPA_KEY_MGMT_WPA_PSK |
1338			WPA_DRIVER_CAPA_KEY_MGMT_WPA2 |
1339			WPA_DRIVER_CAPA_KEY_MGMT_WPA2_PSK |
1340			WPA_DRIVER_CAPA_KEY_MGMT_SUITE_B |
1341			WPA_DRIVER_CAPA_KEY_MGMT_OWE |
1342			WPA_DRIVER_CAPA_KEY_MGMT_DPP;
1343
1344		if (drv->capa.enc & (WPA_DRIVER_CAPA_ENC_CCMP_256 |
1345				     WPA_DRIVER_CAPA_ENC_GCMP_256))
1346			drv->capa.key_mgmt |=
1347				WPA_DRIVER_CAPA_KEY_MGMT_SUITE_B_192;
1348
1349		if (drv->capa.flags & WPA_DRIVER_FLAGS_SME)
1350			drv->capa.key_mgmt |=
1351				WPA_DRIVER_CAPA_KEY_MGMT_FILS_SHA256 |
1352				WPA_DRIVER_CAPA_KEY_MGMT_FILS_SHA384 |
1353				WPA_DRIVER_CAPA_KEY_MGMT_FT_FILS_SHA256 |
1354				WPA_DRIVER_CAPA_KEY_MGMT_FT_FILS_SHA384 |
1355				WPA_DRIVER_CAPA_KEY_MGMT_SAE;
1356		else if (drv->capa.flags & WPA_DRIVER_FLAGS_FILS_SK_OFFLOAD)
1357			drv->capa.key_mgmt |=
1358				WPA_DRIVER_CAPA_KEY_MGMT_FILS_SHA256 |
1359				WPA_DRIVER_CAPA_KEY_MGMT_FILS_SHA384;
1360	}
1361
1362	if (!info.has_key_mgmt_iftype) {
1363		/* If the driver does not advertize per interface AKM
1364		 * capabilities, consider all interfaces to support default AKMs
1365		 * in key_mgmt. */
1366		for (i = 0; i < WPA_IF_MAX; i++)
1367			drv->capa.key_mgmt_iftype[i] = drv->capa.key_mgmt;
1368	} else if (info.has_key_mgmt_iftype && !info.has_key_mgmt) {
1369		/* If the driver advertizes only per interface supported AKMs
1370		 * but does not advertize per wiphy AKM capabilities, consider
1371		 * the default key_mgmt as a mask of per interface supported
1372		 * AKMs. */
1373		drv->capa.key_mgmt = 0;
1374		for (i = 0; i < WPA_IF_MAX; i++)
1375			drv->capa.key_mgmt |= drv->capa.key_mgmt_iftype[i];
1376	} else if (info.has_key_mgmt_iftype && info.has_key_mgmt) {
1377		/* If the driver advertizes AKM capabilities both per wiphy and
1378		 * per interface, consider the interfaces for which per
1379		 * interface AKM capabilities were not received to support the
1380		 * default key_mgmt capabilities.
1381		 */
1382		for (i = 0; i < WPA_IF_MAX; i++)
1383			if (!drv->capa.key_mgmt_iftype[i])
1384				drv->capa.key_mgmt_iftype[i] =
1385					drv->capa.key_mgmt;
1386	}
1387
1388	drv->capa.auth = WPA_DRIVER_AUTH_OPEN |
1389		WPA_DRIVER_AUTH_SHARED |
1390		WPA_DRIVER_AUTH_LEAP;
1391
1392	drv->capa.flags |= WPA_DRIVER_FLAGS_VALID_ERROR_CODES;
1393	drv->capa.flags |= WPA_DRIVER_FLAGS_SET_KEYS_AFTER_ASSOC_DONE;
1394	drv->capa.flags |= WPA_DRIVER_FLAGS_EAPOL_TX_STATUS;
1395
1396	/*
1397	 * As all cfg80211 drivers must support cases where the AP interface is
1398	 * removed without the knowledge of wpa_supplicant/hostapd, e.g., in
1399	 * case that the user space daemon has crashed, they must be able to
1400	 * cleanup all stations and key entries in the AP tear down flow. Thus,
1401	 * this flag can/should always be set for cfg80211 drivers.
1402	 */
1403	drv->capa.flags |= WPA_DRIVER_FLAGS_AP_TEARDOWN_SUPPORT;
1404
1405	if (!info.device_ap_sme) {
1406		drv->capa.flags |= WPA_DRIVER_FLAGS_DEAUTH_TX_STATUS;
1407		drv->capa.flags2 |= WPA_DRIVER_FLAGS2_AP_SME;
1408
1409		/*
1410		 * No AP SME is currently assumed to also indicate no AP MLME
1411		 * in the driver/firmware.
1412		 */
1413		drv->capa.flags |= WPA_DRIVER_FLAGS_AP_MLME;
1414	}
1415
1416	drv->device_ap_sme = info.device_ap_sme;
1417	drv->poll_command_supported = info.poll_command_supported;
1418	drv->data_tx_status = info.data_tx_status;
1419	drv->p2p_go_ctwindow_supported = info.p2p_go_ctwindow_supported;
1420	if (info.set_qos_map_supported)
1421		drv->capa.flags |= WPA_DRIVER_FLAGS_QOS_MAPPING;
1422	drv->have_low_prio_scan = info.have_low_prio_scan;
1423
1424	/*
1425	 * If poll command and tx status are supported, mac80211 is new enough
1426	 * to have everything we need to not need monitor interfaces.
1427	 */
1428	drv->use_monitor = !info.device_ap_sme &&
1429		(!info.poll_command_supported || !info.data_tx_status);
1430
1431	/*
1432	 * If we aren't going to use monitor interfaces, but the
1433	 * driver doesn't support data TX status, we won't get TX
1434	 * status for EAPOL frames.
1435	 */
1436	if (!drv->use_monitor && !info.data_tx_status)
1437		drv->capa.flags &= ~WPA_DRIVER_FLAGS_EAPOL_TX_STATUS;
1438
1439#ifdef CONFIG_DRIVER_NL80211_QCA
1440	if (!(info.capa->flags & WPA_DRIVER_FLAGS_DFS_OFFLOAD))
1441		qca_nl80211_check_dfs_capa(drv);
1442	qca_nl80211_get_features(drv);
1443
1444	/*
1445	 * To enable offchannel simultaneous support in wpa_supplicant, the
1446	 * underlying driver needs to support the same along with offchannel TX.
1447	 * Offchannel TX support is needed since remain_on_channel and
1448	 * action_tx use some common data structures and hence cannot be
1449	 * scheduled simultaneously.
1450	 */
1451	if (!(drv->capa.flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX))
1452		drv->capa.flags &= ~WPA_DRIVER_FLAGS_OFFCHANNEL_SIMULTANEOUS;
1453#endif /* CONFIG_DRIVER_NL80211_QCA */
1454
1455	wpa_printf(MSG_DEBUG,
1456		   "nl80211: key_mgmt=0x%x enc=0x%x auth=0x%x flags=0x%llx rrm_flags=0x%x probe_resp_offloads=0x%x max_stations=%u max_remain_on_chan=%u max_scan_ssids=%d",
1457		   drv->capa.key_mgmt, drv->capa.enc, drv->capa.auth,
1458		   (unsigned long long) drv->capa.flags, drv->capa.rrm_flags,
1459		   drv->capa.probe_resp_offloads, drv->capa.max_stations,
1460		   drv->capa.max_remain_on_chan, drv->capa.max_scan_ssids);
1461	return 0;
1462}
1463
1464
1465struct phy_info_arg {
1466	u16 *num_modes;
1467	struct hostapd_hw_modes *modes;
1468	int last_mode, last_chan_idx;
1469	int failed;
1470	u8 dfs_domain;
1471};
1472
1473static void phy_info_ht_capa(struct hostapd_hw_modes *mode, struct nlattr *capa,
1474			     struct nlattr *ampdu_factor,
1475			     struct nlattr *ampdu_density,
1476			     struct nlattr *mcs_set)
1477{
1478	if (capa)
1479		mode->ht_capab = nla_get_u16(capa);
1480
1481	if (ampdu_factor)
1482		mode->a_mpdu_params |= nla_get_u8(ampdu_factor) & 0x03;
1483
1484	if (ampdu_density)
1485		mode->a_mpdu_params |= nla_get_u8(ampdu_density) << 2;
1486
1487	if (mcs_set && nla_len(mcs_set) >= 16) {
1488		u8 *mcs;
1489		mcs = nla_data(mcs_set);
1490		os_memcpy(mode->mcs_set, mcs, 16);
1491	}
1492}
1493
1494
1495static void phy_info_vht_capa(struct hostapd_hw_modes *mode,
1496			      struct nlattr *capa,
1497			      struct nlattr *mcs_set)
1498{
1499	if (capa)
1500		mode->vht_capab = nla_get_u32(capa);
1501
1502	if (mcs_set && nla_len(mcs_set) >= 8) {
1503		u8 *mcs;
1504		mcs = nla_data(mcs_set);
1505		os_memcpy(mode->vht_mcs_set, mcs, 8);
1506	}
1507}
1508
1509
1510static int phy_info_edmg_capa(struct hostapd_hw_modes *mode,
1511			      struct nlattr *bw_config,
1512			      struct nlattr *channels)
1513{
1514	if (!bw_config || !channels)
1515		return NL_OK;
1516
1517	mode->edmg.bw_config = nla_get_u8(bw_config);
1518	mode->edmg.channels = nla_get_u8(channels);
1519
1520	if (!mode->edmg.channels || !mode->edmg.bw_config)
1521		return NL_STOP;
1522
1523	return NL_OK;
1524}
1525
1526
1527static int cw2ecw(unsigned int cw)
1528{
1529	int bit;
1530
1531	if (cw == 0)
1532		return 0;
1533
1534	for (bit = 1; cw != 1; bit++)
1535		cw >>= 1;
1536
1537	return bit;
1538}
1539
1540
1541static void phy_info_freq(struct hostapd_hw_modes *mode,
1542			  struct hostapd_channel_data *chan,
1543			  struct nlattr *tb_freq[])
1544{
1545	u8 channel;
1546
1547	os_memset(chan, 0, sizeof(*chan));
1548	chan->freq = nla_get_u32(tb_freq[NL80211_FREQUENCY_ATTR_FREQ]);
1549	chan->flag = 0;
1550	chan->allowed_bw = ~0;
1551	chan->dfs_cac_ms = 0;
1552	if (ieee80211_freq_to_chan(chan->freq, &channel) != NUM_HOSTAPD_MODES)
1553		chan->chan = channel;
1554	else
1555		wpa_printf(MSG_DEBUG,
1556			   "nl80211: No channel number found for frequency %u MHz",
1557			   chan->freq);
1558
1559	if (tb_freq[NL80211_FREQUENCY_ATTR_DISABLED])
1560		chan->flag |= HOSTAPD_CHAN_DISABLED;
1561	if (tb_freq[NL80211_FREQUENCY_ATTR_NO_IR])
1562		chan->flag |= HOSTAPD_CHAN_NO_IR;
1563	if (tb_freq[NL80211_FREQUENCY_ATTR_RADAR])
1564		chan->flag |= HOSTAPD_CHAN_RADAR;
1565	if (tb_freq[NL80211_FREQUENCY_ATTR_INDOOR_ONLY])
1566		chan->flag |= HOSTAPD_CHAN_INDOOR_ONLY;
1567	if (tb_freq[NL80211_FREQUENCY_ATTR_GO_CONCURRENT])
1568		chan->flag |= HOSTAPD_CHAN_GO_CONCURRENT;
1569
1570	if (tb_freq[NL80211_FREQUENCY_ATTR_NO_10MHZ])
1571		chan->allowed_bw &= ~HOSTAPD_CHAN_WIDTH_10;
1572	if (tb_freq[NL80211_FREQUENCY_ATTR_NO_20MHZ])
1573		chan->allowed_bw &= ~HOSTAPD_CHAN_WIDTH_20;
1574	if (tb_freq[NL80211_FREQUENCY_ATTR_NO_HT40_PLUS])
1575		chan->allowed_bw &= ~HOSTAPD_CHAN_WIDTH_40P;
1576	if (tb_freq[NL80211_FREQUENCY_ATTR_NO_HT40_MINUS])
1577		chan->allowed_bw &= ~HOSTAPD_CHAN_WIDTH_40M;
1578	if (tb_freq[NL80211_FREQUENCY_ATTR_NO_80MHZ])
1579		chan->allowed_bw &= ~HOSTAPD_CHAN_WIDTH_80;
1580	if (tb_freq[NL80211_FREQUENCY_ATTR_NO_160MHZ])
1581		chan->allowed_bw &= ~HOSTAPD_CHAN_WIDTH_160;
1582
1583	if (tb_freq[NL80211_FREQUENCY_ATTR_DFS_STATE]) {
1584		enum nl80211_dfs_state state =
1585			nla_get_u32(tb_freq[NL80211_FREQUENCY_ATTR_DFS_STATE]);
1586
1587		switch (state) {
1588		case NL80211_DFS_USABLE:
1589			chan->flag |= HOSTAPD_CHAN_DFS_USABLE;
1590			break;
1591		case NL80211_DFS_AVAILABLE:
1592			chan->flag |= HOSTAPD_CHAN_DFS_AVAILABLE;
1593			break;
1594		case NL80211_DFS_UNAVAILABLE:
1595			chan->flag |= HOSTAPD_CHAN_DFS_UNAVAILABLE;
1596			break;
1597		}
1598	}
1599
1600	if (tb_freq[NL80211_FREQUENCY_ATTR_DFS_CAC_TIME]) {
1601		chan->dfs_cac_ms = nla_get_u32(
1602			tb_freq[NL80211_FREQUENCY_ATTR_DFS_CAC_TIME]);
1603	}
1604
1605	chan->wmm_rules_valid = 0;
1606	if (tb_freq[NL80211_FREQUENCY_ATTR_WMM]) {
1607		static struct nla_policy wmm_policy[NL80211_WMMR_MAX + 1] = {
1608			[NL80211_WMMR_CW_MIN] = { .type = NLA_U16 },
1609			[NL80211_WMMR_CW_MAX] = { .type = NLA_U16 },
1610			[NL80211_WMMR_AIFSN] = { .type = NLA_U8 },
1611			[NL80211_WMMR_TXOP] = { .type = NLA_U16 },
1612		};
1613		static const u8 wmm_map[4] = {
1614			[NL80211_AC_BE] = WMM_AC_BE,
1615			[NL80211_AC_BK] = WMM_AC_BK,
1616			[NL80211_AC_VI] = WMM_AC_VI,
1617			[NL80211_AC_VO] = WMM_AC_VO,
1618		};
1619		struct nlattr *nl_wmm;
1620		struct nlattr *tb_wmm[NL80211_WMMR_MAX + 1];
1621		int rem_wmm, ac, count = 0;
1622
1623		nla_for_each_nested(nl_wmm, tb_freq[NL80211_FREQUENCY_ATTR_WMM],
1624				    rem_wmm) {
1625			if (nla_parse_nested(tb_wmm, NL80211_WMMR_MAX, nl_wmm,
1626					     wmm_policy)) {
1627				wpa_printf(MSG_DEBUG,
1628					   "nl80211: Failed to parse WMM rules attribute");
1629				return;
1630			}
1631			if (!tb_wmm[NL80211_WMMR_CW_MIN] ||
1632			    !tb_wmm[NL80211_WMMR_CW_MAX] ||
1633			    !tb_wmm[NL80211_WMMR_AIFSN] ||
1634			    !tb_wmm[NL80211_WMMR_TXOP]) {
1635				wpa_printf(MSG_DEBUG,
1636					   "nl80211: Channel is missing WMM rule attribute");
1637				return;
1638			}
1639			ac = nl_wmm->nla_type;
1640			if ((unsigned int) ac >= ARRAY_SIZE(wmm_map)) {
1641				wpa_printf(MSG_DEBUG,
1642					   "nl80211: Invalid AC value %d", ac);
1643				return;
1644			}
1645
1646			ac = wmm_map[ac];
1647			chan->wmm_rules[ac].min_cwmin =
1648				cw2ecw(nla_get_u16(
1649					       tb_wmm[NL80211_WMMR_CW_MIN]));
1650			chan->wmm_rules[ac].min_cwmax =
1651				cw2ecw(nla_get_u16(
1652					       tb_wmm[NL80211_WMMR_CW_MAX]));
1653			chan->wmm_rules[ac].min_aifs =
1654				nla_get_u8(tb_wmm[NL80211_WMMR_AIFSN]);
1655			chan->wmm_rules[ac].max_txop =
1656				nla_get_u16(tb_wmm[NL80211_WMMR_TXOP]) / 32;
1657			count++;
1658		}
1659
1660		/* Set valid flag if all the AC rules are present */
1661		if (count == WMM_AC_NUM)
1662			chan->wmm_rules_valid = 1;
1663	}
1664}
1665
1666
1667static int phy_info_freqs(struct phy_info_arg *phy_info,
1668			  struct hostapd_hw_modes *mode, struct nlattr *tb)
1669{
1670	static struct nla_policy freq_policy[NL80211_FREQUENCY_ATTR_MAX + 1] = {
1671		[NL80211_FREQUENCY_ATTR_FREQ] = { .type = NLA_U32 },
1672		[NL80211_FREQUENCY_ATTR_DISABLED] = { .type = NLA_FLAG },
1673		[NL80211_FREQUENCY_ATTR_NO_IR] = { .type = NLA_FLAG },
1674		[NL80211_FREQUENCY_ATTR_RADAR] = { .type = NLA_FLAG },
1675		[NL80211_FREQUENCY_ATTR_MAX_TX_POWER] = { .type = NLA_U32 },
1676		[NL80211_FREQUENCY_ATTR_DFS_STATE] = { .type = NLA_U32 },
1677		[NL80211_FREQUENCY_ATTR_NO_10MHZ] = { .type = NLA_FLAG },
1678		[NL80211_FREQUENCY_ATTR_NO_20MHZ] = { .type = NLA_FLAG },
1679		[NL80211_FREQUENCY_ATTR_NO_HT40_PLUS] = { .type = NLA_FLAG },
1680		[NL80211_FREQUENCY_ATTR_NO_HT40_MINUS] = { .type = NLA_FLAG },
1681		[NL80211_FREQUENCY_ATTR_NO_80MHZ] = { .type = NLA_FLAG },
1682		[NL80211_FREQUENCY_ATTR_NO_160MHZ] = { .type = NLA_FLAG },
1683	};
1684	int new_channels = 0;
1685	struct hostapd_channel_data *channel;
1686	struct nlattr *tb_freq[NL80211_FREQUENCY_ATTR_MAX + 1];
1687	struct nlattr *nl_freq;
1688	int rem_freq, idx;
1689
1690	if (tb == NULL)
1691		return NL_OK;
1692
1693	nla_for_each_nested(nl_freq, tb, rem_freq) {
1694		nla_parse(tb_freq, NL80211_FREQUENCY_ATTR_MAX,
1695			  nla_data(nl_freq), nla_len(nl_freq), freq_policy);
1696		if (!tb_freq[NL80211_FREQUENCY_ATTR_FREQ])
1697			continue;
1698		new_channels++;
1699	}
1700
1701	channel = os_realloc_array(mode->channels,
1702				   mode->num_channels + new_channels,
1703				   sizeof(struct hostapd_channel_data));
1704	if (!channel)
1705		return NL_STOP;
1706
1707	mode->channels = channel;
1708	mode->num_channels += new_channels;
1709
1710	idx = phy_info->last_chan_idx;
1711
1712	nla_for_each_nested(nl_freq, tb, rem_freq) {
1713		nla_parse(tb_freq, NL80211_FREQUENCY_ATTR_MAX,
1714			  nla_data(nl_freq), nla_len(nl_freq), freq_policy);
1715		if (!tb_freq[NL80211_FREQUENCY_ATTR_FREQ])
1716			continue;
1717		phy_info_freq(mode, &mode->channels[idx], tb_freq);
1718		idx++;
1719	}
1720	phy_info->last_chan_idx = idx;
1721
1722	return NL_OK;
1723}
1724
1725
1726static int phy_info_rates(struct hostapd_hw_modes *mode, struct nlattr *tb)
1727{
1728	static struct nla_policy rate_policy[NL80211_BITRATE_ATTR_MAX + 1] = {
1729		[NL80211_BITRATE_ATTR_RATE] = { .type = NLA_U32 },
1730		[NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE] =
1731		{ .type = NLA_FLAG },
1732	};
1733	struct nlattr *tb_rate[NL80211_BITRATE_ATTR_MAX + 1];
1734	struct nlattr *nl_rate;
1735	int rem_rate, idx;
1736
1737	if (tb == NULL)
1738		return NL_OK;
1739
1740	nla_for_each_nested(nl_rate, tb, rem_rate) {
1741		nla_parse(tb_rate, NL80211_BITRATE_ATTR_MAX,
1742			  nla_data(nl_rate), nla_len(nl_rate),
1743			  rate_policy);
1744		if (!tb_rate[NL80211_BITRATE_ATTR_RATE])
1745			continue;
1746		mode->num_rates++;
1747	}
1748
1749	mode->rates = os_calloc(mode->num_rates, sizeof(int));
1750	if (!mode->rates)
1751		return NL_STOP;
1752
1753	idx = 0;
1754
1755	nla_for_each_nested(nl_rate, tb, rem_rate) {
1756		nla_parse(tb_rate, NL80211_BITRATE_ATTR_MAX,
1757			  nla_data(nl_rate), nla_len(nl_rate),
1758			  rate_policy);
1759		if (!tb_rate[NL80211_BITRATE_ATTR_RATE])
1760			continue;
1761		mode->rates[idx] = nla_get_u32(
1762			tb_rate[NL80211_BITRATE_ATTR_RATE]);
1763		idx++;
1764	}
1765
1766	return NL_OK;
1767}
1768
1769
1770static void phy_info_iftype_copy(struct he_capabilities *he_capab,
1771				 enum ieee80211_op_mode opmode,
1772				 struct nlattr **tb, struct nlattr **tb_flags)
1773{
1774	enum nl80211_iftype iftype;
1775	size_t len;
1776
1777	switch (opmode) {
1778	case IEEE80211_MODE_INFRA:
1779		iftype = NL80211_IFTYPE_STATION;
1780		break;
1781	case IEEE80211_MODE_IBSS:
1782		iftype = NL80211_IFTYPE_ADHOC;
1783		break;
1784	case IEEE80211_MODE_AP:
1785		iftype = NL80211_IFTYPE_AP;
1786		break;
1787	case IEEE80211_MODE_MESH:
1788		iftype = NL80211_IFTYPE_MESH_POINT;
1789		break;
1790	default:
1791		return;
1792	}
1793
1794	if (!nla_get_flag(tb_flags[iftype]))
1795		return;
1796
1797	he_capab->he_supported = 1;
1798
1799	if (tb[NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY]) {
1800		len = nla_len(tb[NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY]);
1801
1802		if (len > sizeof(he_capab->phy_cap))
1803			len = sizeof(he_capab->phy_cap);
1804		os_memcpy(he_capab->phy_cap,
1805			  nla_data(tb[NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY]),
1806			  len);
1807	}
1808
1809	if (tb[NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC]) {
1810		len = nla_len(tb[NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC]);
1811
1812		if (len > sizeof(he_capab->mac_cap))
1813			len = sizeof(he_capab->mac_cap);
1814		os_memcpy(he_capab->mac_cap,
1815			  nla_data(tb[NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC]),
1816			  len);
1817	}
1818
1819	if (tb[NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET]) {
1820		len = nla_len(tb[NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET]);
1821
1822		if (len > sizeof(he_capab->mcs))
1823			len = sizeof(he_capab->mcs);
1824		os_memcpy(he_capab->mcs,
1825			  nla_data(tb[NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET]),
1826			  len);
1827	}
1828
1829	if (tb[NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE]) {
1830		len = nla_len(tb[NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE]);
1831
1832		if (len > sizeof(he_capab->ppet))
1833			len = sizeof(he_capab->ppet);
1834		os_memcpy(&he_capab->ppet,
1835			  nla_data(tb[NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE]),
1836			  len);
1837	}
1838
1839	if (tb[NL80211_BAND_IFTYPE_ATTR_HE_6GHZ_CAPA]) {
1840		u16 capa;
1841
1842		capa = nla_get_u16(tb[NL80211_BAND_IFTYPE_ATTR_HE_6GHZ_CAPA]);
1843		he_capab->he_6ghz_capa = le_to_host16(capa);
1844	}
1845}
1846
1847
1848static int phy_info_iftype(struct hostapd_hw_modes *mode,
1849			   struct nlattr *nl_iftype)
1850{
1851	struct nlattr *tb[NL80211_BAND_IFTYPE_ATTR_MAX + 1];
1852	struct nlattr *tb_flags[NL80211_IFTYPE_MAX + 1];
1853	unsigned int i;
1854
1855	nla_parse(tb, NL80211_BAND_IFTYPE_ATTR_MAX,
1856		  nla_data(nl_iftype), nla_len(nl_iftype), NULL);
1857
1858	if (!tb[NL80211_BAND_IFTYPE_ATTR_IFTYPES])
1859		return NL_STOP;
1860
1861	if (nla_parse_nested(tb_flags, NL80211_IFTYPE_MAX,
1862			     tb[NL80211_BAND_IFTYPE_ATTR_IFTYPES], NULL))
1863		return NL_STOP;
1864
1865	for (i = 0; i < IEEE80211_MODE_NUM; i++)
1866		phy_info_iftype_copy(&mode->he_capab[i], i, tb, tb_flags);
1867
1868	return NL_OK;
1869}
1870
1871
1872static int phy_info_band(struct phy_info_arg *phy_info, struct nlattr *nl_band)
1873{
1874	struct nlattr *tb_band[NL80211_BAND_ATTR_MAX + 1];
1875	struct hostapd_hw_modes *mode;
1876	int ret;
1877
1878	if (phy_info->last_mode != nl_band->nla_type) {
1879		mode = os_realloc_array(phy_info->modes,
1880					*phy_info->num_modes + 1,
1881					sizeof(*mode));
1882		if (!mode) {
1883			phy_info->failed = 1;
1884			return NL_STOP;
1885		}
1886		phy_info->modes = mode;
1887
1888		mode = &phy_info->modes[*(phy_info->num_modes)];
1889		os_memset(mode, 0, sizeof(*mode));
1890		mode->mode = NUM_HOSTAPD_MODES;
1891		mode->flags = HOSTAPD_MODE_FLAG_HT_INFO_KNOWN |
1892			HOSTAPD_MODE_FLAG_VHT_INFO_KNOWN;
1893
1894		/*
1895		 * Unsupported VHT MCS stream is defined as value 3, so the VHT
1896		 * MCS RX/TX map must be initialized with 0xffff to mark all 8
1897		 * possible streams as unsupported. This will be overridden if
1898		 * driver advertises VHT support.
1899		 */
1900		mode->vht_mcs_set[0] = 0xff;
1901		mode->vht_mcs_set[1] = 0xff;
1902		mode->vht_mcs_set[4] = 0xff;
1903		mode->vht_mcs_set[5] = 0xff;
1904
1905		*(phy_info->num_modes) += 1;
1906		phy_info->last_mode = nl_band->nla_type;
1907		phy_info->last_chan_idx = 0;
1908	} else
1909		mode = &phy_info->modes[*(phy_info->num_modes) - 1];
1910
1911	nla_parse(tb_band, NL80211_BAND_ATTR_MAX, nla_data(nl_band),
1912		  nla_len(nl_band), NULL);
1913
1914	phy_info_ht_capa(mode, tb_band[NL80211_BAND_ATTR_HT_CAPA],
1915			 tb_band[NL80211_BAND_ATTR_HT_AMPDU_FACTOR],
1916			 tb_band[NL80211_BAND_ATTR_HT_AMPDU_DENSITY],
1917			 tb_band[NL80211_BAND_ATTR_HT_MCS_SET]);
1918	phy_info_vht_capa(mode, tb_band[NL80211_BAND_ATTR_VHT_CAPA],
1919			  tb_band[NL80211_BAND_ATTR_VHT_MCS_SET]);
1920	ret = phy_info_edmg_capa(mode,
1921				 tb_band[NL80211_BAND_ATTR_EDMG_BW_CONFIG],
1922				 tb_band[NL80211_BAND_ATTR_EDMG_CHANNELS]);
1923	if (ret == NL_OK)
1924		ret = phy_info_freqs(phy_info, mode,
1925				     tb_band[NL80211_BAND_ATTR_FREQS]);
1926	if (ret == NL_OK)
1927		ret = phy_info_rates(mode, tb_band[NL80211_BAND_ATTR_RATES]);
1928	if (ret != NL_OK) {
1929		phy_info->failed = 1;
1930		return ret;
1931	}
1932
1933	if (tb_band[NL80211_BAND_ATTR_IFTYPE_DATA]) {
1934		struct nlattr *nl_iftype;
1935		int rem_band;
1936
1937		nla_for_each_nested(nl_iftype,
1938				    tb_band[NL80211_BAND_ATTR_IFTYPE_DATA],
1939				    rem_band) {
1940			ret = phy_info_iftype(mode, nl_iftype);
1941			if (ret != NL_OK)
1942				return ret;
1943		}
1944	}
1945
1946	return NL_OK;
1947}
1948
1949
1950static int phy_info_handler(struct nl_msg *msg, void *arg)
1951{
1952	struct nlattr *tb_msg[NL80211_ATTR_MAX + 1];
1953	struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1954	struct phy_info_arg *phy_info = arg;
1955	struct nlattr *nl_band;
1956	int rem_band;
1957
1958	nla_parse(tb_msg, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1959		  genlmsg_attrlen(gnlh, 0), NULL);
1960
1961	if (!tb_msg[NL80211_ATTR_WIPHY_BANDS])
1962		return NL_SKIP;
1963
1964	nla_for_each_nested(nl_band, tb_msg[NL80211_ATTR_WIPHY_BANDS], rem_band)
1965	{
1966		int res = phy_info_band(phy_info, nl_band);
1967		if (res != NL_OK)
1968			return res;
1969	}
1970
1971	return NL_SKIP;
1972}
1973
1974
1975static struct hostapd_hw_modes *
1976wpa_driver_nl80211_postprocess_modes(struct hostapd_hw_modes *modes,
1977				     u16 *num_modes)
1978{
1979	u16 m;
1980	struct hostapd_hw_modes *mode11g = NULL, *nmodes, *mode;
1981	int i, mode11g_idx = -1;
1982
1983	/* heuristic to set up modes */
1984	for (m = 0; m < *num_modes; m++) {
1985		if (!modes[m].num_channels)
1986			continue;
1987		if (modes[m].channels[0].freq < 2000) {
1988			modes[m].num_channels = 0;
1989			continue;
1990		} else if (modes[m].channels[0].freq < 4000) {
1991			modes[m].mode = HOSTAPD_MODE_IEEE80211B;
1992			for (i = 0; i < modes[m].num_rates; i++) {
1993				if (modes[m].rates[i] > 200) {
1994					modes[m].mode = HOSTAPD_MODE_IEEE80211G;
1995					break;
1996				}
1997			}
1998		} else if (modes[m].channels[0].freq > 50000)
1999			modes[m].mode = HOSTAPD_MODE_IEEE80211AD;
2000		else
2001			modes[m].mode = HOSTAPD_MODE_IEEE80211A;
2002	}
2003
2004	/* Remove unsupported bands */
2005	m = 0;
2006	while (m < *num_modes) {
2007		if (modes[m].mode == NUM_HOSTAPD_MODES) {
2008			wpa_printf(MSG_DEBUG,
2009				   "nl80211: Remove unsupported mode");
2010			os_free(modes[m].channels);
2011			os_free(modes[m].rates);
2012			if (m + 1 < *num_modes)
2013				os_memmove(&modes[m], &modes[m + 1],
2014					   sizeof(struct hostapd_hw_modes) *
2015					   (*num_modes - (m + 1)));
2016			(*num_modes)--;
2017			continue;
2018		}
2019		m++;
2020	}
2021
2022	/* If only 802.11g mode is included, use it to construct matching
2023	 * 802.11b mode data. */
2024
2025	for (m = 0; m < *num_modes; m++) {
2026		if (modes[m].mode == HOSTAPD_MODE_IEEE80211B)
2027			return modes; /* 802.11b already included */
2028		if (modes[m].mode == HOSTAPD_MODE_IEEE80211G)
2029			mode11g_idx = m;
2030	}
2031
2032	if (mode11g_idx < 0)
2033		return modes; /* 2.4 GHz band not supported at all */
2034
2035	nmodes = os_realloc_array(modes, *num_modes + 1, sizeof(*nmodes));
2036	if (nmodes == NULL)
2037		return modes; /* Could not add 802.11b mode */
2038
2039	mode = &nmodes[*num_modes];
2040	os_memset(mode, 0, sizeof(*mode));
2041	(*num_modes)++;
2042	modes = nmodes;
2043
2044	mode->mode = HOSTAPD_MODE_IEEE80211B;
2045
2046	mode11g = &modes[mode11g_idx];
2047	mode->num_channels = mode11g->num_channels;
2048	mode->channels = os_memdup(mode11g->channels,
2049				   mode11g->num_channels *
2050				   sizeof(struct hostapd_channel_data));
2051	if (mode->channels == NULL) {
2052		(*num_modes)--;
2053		return modes; /* Could not add 802.11b mode */
2054	}
2055
2056	mode->num_rates = 0;
2057	mode->rates = os_malloc(4 * sizeof(int));
2058	if (mode->rates == NULL) {
2059		os_free(mode->channels);
2060		(*num_modes)--;
2061		return modes; /* Could not add 802.11b mode */
2062	}
2063
2064	for (i = 0; i < mode11g->num_rates; i++) {
2065		if (mode11g->rates[i] != 10 && mode11g->rates[i] != 20 &&
2066		    mode11g->rates[i] != 55 && mode11g->rates[i] != 110)
2067			continue;
2068		mode->rates[mode->num_rates] = mode11g->rates[i];
2069		mode->num_rates++;
2070		if (mode->num_rates == 4)
2071			break;
2072	}
2073
2074	if (mode->num_rates == 0) {
2075		os_free(mode->channels);
2076		os_free(mode->rates);
2077		(*num_modes)--;
2078		return modes; /* No 802.11b rates */
2079	}
2080
2081	wpa_printf(MSG_DEBUG, "nl80211: Added 802.11b mode based on 802.11g "
2082		   "information");
2083
2084	return modes;
2085}
2086
2087
2088static void nl80211_set_ht40_mode(struct hostapd_hw_modes *mode, int start,
2089				  int end)
2090{
2091	int c;
2092
2093	for (c = 0; c < mode->num_channels; c++) {
2094		struct hostapd_channel_data *chan = &mode->channels[c];
2095		if (chan->freq - 10 >= start && chan->freq + 10 <= end)
2096			chan->flag |= HOSTAPD_CHAN_HT40;
2097	}
2098}
2099
2100
2101static void nl80211_set_ht40_mode_sec(struct hostapd_hw_modes *mode, int start,
2102				      int end)
2103{
2104	int c;
2105
2106	for (c = 0; c < mode->num_channels; c++) {
2107		struct hostapd_channel_data *chan = &mode->channels[c];
2108		if (!(chan->flag & HOSTAPD_CHAN_HT40))
2109			continue;
2110		if (chan->freq - 30 >= start && chan->freq - 10 <= end)
2111			chan->flag |= HOSTAPD_CHAN_HT40MINUS;
2112		if (chan->freq + 10 >= start && chan->freq + 30 <= end)
2113			chan->flag |= HOSTAPD_CHAN_HT40PLUS;
2114	}
2115}
2116
2117
2118static void nl80211_reg_rule_max_eirp(u32 start, u32 end, u32 max_eirp,
2119				      struct phy_info_arg *results)
2120{
2121	u16 m;
2122
2123	for (m = 0; m < *results->num_modes; m++) {
2124		int c;
2125		struct hostapd_hw_modes *mode = &results->modes[m];
2126
2127		for (c = 0; c < mode->num_channels; c++) {
2128			struct hostapd_channel_data *chan = &mode->channels[c];
2129			if ((u32) chan->freq - 10 >= start &&
2130			    (u32) chan->freq + 10 <= end)
2131				chan->max_tx_power = max_eirp;
2132		}
2133	}
2134}
2135
2136
2137static void nl80211_reg_rule_ht40(u32 start, u32 end,
2138				  struct phy_info_arg *results)
2139{
2140	u16 m;
2141
2142	for (m = 0; m < *results->num_modes; m++) {
2143		if (!(results->modes[m].ht_capab &
2144		      HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET))
2145			continue;
2146		nl80211_set_ht40_mode(&results->modes[m], start, end);
2147	}
2148}
2149
2150
2151static void nl80211_reg_rule_sec(struct nlattr *tb[],
2152				 struct phy_info_arg *results)
2153{
2154	u32 start, end, max_bw;
2155	u16 m;
2156
2157	if (tb[NL80211_ATTR_FREQ_RANGE_START] == NULL ||
2158	    tb[NL80211_ATTR_FREQ_RANGE_END] == NULL ||
2159	    tb[NL80211_ATTR_FREQ_RANGE_MAX_BW] == NULL)
2160		return;
2161
2162	start = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]) / 1000;
2163	end = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]) / 1000;
2164	max_bw = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]) / 1000;
2165
2166	if (max_bw < 20)
2167		return;
2168
2169	for (m = 0; m < *results->num_modes; m++) {
2170		if (!(results->modes[m].ht_capab &
2171		      HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET))
2172			continue;
2173		nl80211_set_ht40_mode_sec(&results->modes[m], start, end);
2174	}
2175}
2176
2177
2178static void nl80211_set_vht_mode(struct hostapd_hw_modes *mode, int start,
2179				 int end, int max_bw)
2180{
2181	int c;
2182
2183	for (c = 0; c < mode->num_channels; c++) {
2184		struct hostapd_channel_data *chan = &mode->channels[c];
2185		if (chan->freq - 10 >= start && chan->freq + 70 <= end)
2186			chan->flag |= HOSTAPD_CHAN_VHT_10_70;
2187
2188		if (chan->freq - 30 >= start && chan->freq + 50 <= end)
2189			chan->flag |= HOSTAPD_CHAN_VHT_30_50;
2190
2191		if (chan->freq - 50 >= start && chan->freq + 30 <= end)
2192			chan->flag |= HOSTAPD_CHAN_VHT_50_30;
2193
2194		if (chan->freq - 70 >= start && chan->freq + 10 <= end)
2195			chan->flag |= HOSTAPD_CHAN_VHT_70_10;
2196
2197		if (max_bw >= 160) {
2198			if (chan->freq - 10 >= start && chan->freq + 150 <= end)
2199				chan->flag |= HOSTAPD_CHAN_VHT_10_150;
2200
2201			if (chan->freq - 30 >= start && chan->freq + 130 <= end)
2202				chan->flag |= HOSTAPD_CHAN_VHT_30_130;
2203
2204			if (chan->freq - 50 >= start && chan->freq + 110 <= end)
2205				chan->flag |= HOSTAPD_CHAN_VHT_50_110;
2206
2207			if (chan->freq - 70 >= start && chan->freq + 90 <= end)
2208				chan->flag |= HOSTAPD_CHAN_VHT_70_90;
2209
2210			if (chan->freq - 90 >= start && chan->freq + 70 <= end)
2211				chan->flag |= HOSTAPD_CHAN_VHT_90_70;
2212
2213			if (chan->freq - 110 >= start && chan->freq + 50 <= end)
2214				chan->flag |= HOSTAPD_CHAN_VHT_110_50;
2215
2216			if (chan->freq - 130 >= start && chan->freq + 30 <= end)
2217				chan->flag |= HOSTAPD_CHAN_VHT_130_30;
2218
2219			if (chan->freq - 150 >= start && chan->freq + 10 <= end)
2220				chan->flag |= HOSTAPD_CHAN_VHT_150_10;
2221		}
2222	}
2223}
2224
2225
2226static void nl80211_reg_rule_vht(struct nlattr *tb[],
2227				 struct phy_info_arg *results)
2228{
2229	u32 start, end, max_bw;
2230	u16 m;
2231
2232	if (tb[NL80211_ATTR_FREQ_RANGE_START] == NULL ||
2233	    tb[NL80211_ATTR_FREQ_RANGE_END] == NULL ||
2234	    tb[NL80211_ATTR_FREQ_RANGE_MAX_BW] == NULL)
2235		return;
2236
2237	start = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]) / 1000;
2238	end = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]) / 1000;
2239	max_bw = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]) / 1000;
2240
2241	if (max_bw < 80)
2242		return;
2243
2244	for (m = 0; m < *results->num_modes; m++) {
2245		if (!(results->modes[m].ht_capab &
2246		      HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET))
2247			continue;
2248		/* TODO: use a real VHT support indication */
2249		if (!results->modes[m].vht_capab)
2250			continue;
2251
2252		nl80211_set_vht_mode(&results->modes[m], start, end, max_bw);
2253	}
2254}
2255
2256
2257static void nl80211_set_dfs_domain(enum nl80211_dfs_regions region,
2258				   u8 *dfs_domain)
2259{
2260	if (region == NL80211_DFS_FCC)
2261		*dfs_domain = HOSTAPD_DFS_REGION_FCC;
2262	else if (region == NL80211_DFS_ETSI)
2263		*dfs_domain = HOSTAPD_DFS_REGION_ETSI;
2264	else if (region == NL80211_DFS_JP)
2265		*dfs_domain = HOSTAPD_DFS_REGION_JP;
2266	else
2267		*dfs_domain = 0;
2268}
2269
2270
2271static const char * dfs_domain_name(enum nl80211_dfs_regions region)
2272{
2273	switch (region) {
2274	case NL80211_DFS_UNSET:
2275		return "DFS-UNSET";
2276	case NL80211_DFS_FCC:
2277		return "DFS-FCC";
2278	case NL80211_DFS_ETSI:
2279		return "DFS-ETSI";
2280	case NL80211_DFS_JP:
2281		return "DFS-JP";
2282	default:
2283		return "DFS-invalid";
2284	}
2285}
2286
2287
2288static int nl80211_get_reg(struct nl_msg *msg, void *arg)
2289{
2290	struct phy_info_arg *results = arg;
2291	struct nlattr *tb_msg[NL80211_ATTR_MAX + 1];
2292	struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
2293	struct nlattr *nl_rule;
2294	struct nlattr *tb_rule[NL80211_FREQUENCY_ATTR_MAX + 1];
2295	int rem_rule;
2296	static struct nla_policy reg_policy[NL80211_FREQUENCY_ATTR_MAX + 1] = {
2297		[NL80211_ATTR_REG_RULE_FLAGS] = { .type = NLA_U32 },
2298		[NL80211_ATTR_FREQ_RANGE_START] = { .type = NLA_U32 },
2299		[NL80211_ATTR_FREQ_RANGE_END] = { .type = NLA_U32 },
2300		[NL80211_ATTR_FREQ_RANGE_MAX_BW] = { .type = NLA_U32 },
2301		[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN] = { .type = NLA_U32 },
2302		[NL80211_ATTR_POWER_RULE_MAX_EIRP] = { .type = NLA_U32 },
2303	};
2304
2305	nla_parse(tb_msg, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
2306		  genlmsg_attrlen(gnlh, 0), NULL);
2307	if (!tb_msg[NL80211_ATTR_REG_ALPHA2] ||
2308	    !tb_msg[NL80211_ATTR_REG_RULES]) {
2309		wpa_printf(MSG_DEBUG, "nl80211: No regulatory information "
2310			   "available");
2311		return NL_SKIP;
2312	}
2313
2314	if (tb_msg[NL80211_ATTR_DFS_REGION]) {
2315		enum nl80211_dfs_regions dfs_domain;
2316		dfs_domain = nla_get_u8(tb_msg[NL80211_ATTR_DFS_REGION]);
2317		nl80211_set_dfs_domain(dfs_domain, &results->dfs_domain);
2318		wpa_printf(MSG_DEBUG, "nl80211: Regulatory information - country=%s (%s)",
2319			   (char *) nla_data(tb_msg[NL80211_ATTR_REG_ALPHA2]),
2320			   dfs_domain_name(dfs_domain));
2321	} else {
2322		wpa_printf(MSG_DEBUG, "nl80211: Regulatory information - country=%s",
2323			   (char *) nla_data(tb_msg[NL80211_ATTR_REG_ALPHA2]));
2324	}
2325
2326	nla_for_each_nested(nl_rule, tb_msg[NL80211_ATTR_REG_RULES], rem_rule)
2327	{
2328		u32 start, end, max_eirp = 0, max_bw = 0, flags = 0;
2329		nla_parse(tb_rule, NL80211_FREQUENCY_ATTR_MAX,
2330			  nla_data(nl_rule), nla_len(nl_rule), reg_policy);
2331		if (tb_rule[NL80211_ATTR_FREQ_RANGE_START] == NULL ||
2332		    tb_rule[NL80211_ATTR_FREQ_RANGE_END] == NULL)
2333			continue;
2334		start = nla_get_u32(tb_rule[NL80211_ATTR_FREQ_RANGE_START]) / 1000;
2335		end = nla_get_u32(tb_rule[NL80211_ATTR_FREQ_RANGE_END]) / 1000;
2336		if (tb_rule[NL80211_ATTR_POWER_RULE_MAX_EIRP])
2337			max_eirp = nla_get_u32(tb_rule[NL80211_ATTR_POWER_RULE_MAX_EIRP]) / 100;
2338		if (tb_rule[NL80211_ATTR_FREQ_RANGE_MAX_BW])
2339			max_bw = nla_get_u32(tb_rule[NL80211_ATTR_FREQ_RANGE_MAX_BW]) / 1000;
2340		if (tb_rule[NL80211_ATTR_REG_RULE_FLAGS])
2341			flags = nla_get_u32(tb_rule[NL80211_ATTR_REG_RULE_FLAGS]);
2342
2343		wpa_printf(MSG_DEBUG, "nl80211: %u-%u @ %u MHz %u mBm%s%s%s%s%s%s%s%s",
2344			   start, end, max_bw, max_eirp,
2345			   flags & NL80211_RRF_NO_OFDM ? " (no OFDM)" : "",
2346			   flags & NL80211_RRF_NO_CCK ? " (no CCK)" : "",
2347			   flags & NL80211_RRF_NO_INDOOR ? " (no indoor)" : "",
2348			   flags & NL80211_RRF_NO_OUTDOOR ? " (no outdoor)" :
2349			   "",
2350			   flags & NL80211_RRF_DFS ? " (DFS)" : "",
2351			   flags & NL80211_RRF_PTP_ONLY ? " (PTP only)" : "",
2352			   flags & NL80211_RRF_PTMP_ONLY ? " (PTMP only)" : "",
2353			   flags & NL80211_RRF_NO_IR ? " (no IR)" : "");
2354		if (max_bw >= 40)
2355			nl80211_reg_rule_ht40(start, end, results);
2356		if (tb_rule[NL80211_ATTR_POWER_RULE_MAX_EIRP])
2357			nl80211_reg_rule_max_eirp(start, end, max_eirp,
2358						  results);
2359	}
2360
2361	nla_for_each_nested(nl_rule, tb_msg[NL80211_ATTR_REG_RULES], rem_rule)
2362	{
2363		nla_parse(tb_rule, NL80211_FREQUENCY_ATTR_MAX,
2364			  nla_data(nl_rule), nla_len(nl_rule), reg_policy);
2365		nl80211_reg_rule_sec(tb_rule, results);
2366	}
2367
2368	nla_for_each_nested(nl_rule, tb_msg[NL80211_ATTR_REG_RULES], rem_rule)
2369	{
2370		nla_parse(tb_rule, NL80211_FREQUENCY_ATTR_MAX,
2371			  nla_data(nl_rule), nla_len(nl_rule), reg_policy);
2372		nl80211_reg_rule_vht(tb_rule, results);
2373	}
2374
2375	return NL_SKIP;
2376}
2377
2378
2379static int nl80211_set_regulatory_flags(struct wpa_driver_nl80211_data *drv,
2380					struct phy_info_arg *results)
2381{
2382	struct nl_msg *msg;
2383
2384	msg = nlmsg_alloc();
2385	if (!msg)
2386		return -ENOMEM;
2387
2388	nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_REG);
2389	if (drv->capa.flags & WPA_DRIVER_FLAGS_SELF_MANAGED_REGULATORY) {
2390		if (nla_put_u32(msg, NL80211_ATTR_WIPHY, drv->wiphy_idx)) {
2391			nlmsg_free(msg);
2392			return -1;
2393		}
2394	}
2395
2396	return send_and_recv_msgs(drv, msg, nl80211_get_reg, results,
2397				  NULL, NULL);
2398}
2399
2400
2401static const char * modestr(enum hostapd_hw_mode mode)
2402{
2403	switch (mode) {
2404	case HOSTAPD_MODE_IEEE80211B:
2405		return "802.11b";
2406	case HOSTAPD_MODE_IEEE80211G:
2407		return "802.11g";
2408	case HOSTAPD_MODE_IEEE80211A:
2409		return "802.11a";
2410	case HOSTAPD_MODE_IEEE80211AD:
2411		return "802.11ad";
2412	default:
2413		return "?";
2414	}
2415}
2416
2417
2418static void nl80211_dump_chan_list(struct hostapd_hw_modes *modes,
2419				   u16 num_modes)
2420{
2421	int i;
2422
2423	if (!modes)
2424		return;
2425
2426	for (i = 0; i < num_modes; i++) {
2427		struct hostapd_hw_modes *mode = &modes[i];
2428		char str[200];
2429		char *pos = str;
2430		char *end = pos + sizeof(str);
2431		int j, res;
2432
2433		for (j = 0; j < mode->num_channels; j++) {
2434			struct hostapd_channel_data *chan = &mode->channels[j];
2435
2436			res = os_snprintf(pos, end - pos, " %d%s%s%s",
2437					  chan->freq,
2438					  (chan->flag & HOSTAPD_CHAN_DISABLED) ?
2439					  "[DISABLED]" : "",
2440					  (chan->flag & HOSTAPD_CHAN_NO_IR) ?
2441					  "[NO_IR]" : "",
2442					  (chan->flag & HOSTAPD_CHAN_RADAR) ?
2443					  "[RADAR]" : "");
2444			if (os_snprintf_error(end - pos, res))
2445				break;
2446			pos += res;
2447		}
2448
2449		*pos = '\0';
2450		wpa_printf(MSG_DEBUG, "nl80211: Mode IEEE %s:%s",
2451			   modestr(mode->mode), str);
2452	}
2453}
2454
2455
2456struct hostapd_hw_modes *
2457nl80211_get_hw_feature_data(void *priv, u16 *num_modes, u16 *flags,
2458			    u8 *dfs_domain)
2459{
2460	u32 feat;
2461	struct i802_bss *bss = priv;
2462	struct wpa_driver_nl80211_data *drv = bss->drv;
2463	int nl_flags = 0;
2464	struct nl_msg *msg;
2465	struct phy_info_arg result = {
2466		.num_modes = num_modes,
2467		.modes = NULL,
2468		.last_mode = -1,
2469		.failed = 0,
2470		.dfs_domain = 0,
2471	};
2472
2473	*num_modes = 0;
2474	*flags = 0;
2475	*dfs_domain = 0;
2476
2477	feat = get_nl80211_protocol_features(drv);
2478	if (feat & NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP)
2479		nl_flags = NLM_F_DUMP;
2480	if (!(msg = nl80211_cmd_msg(bss, nl_flags, NL80211_CMD_GET_WIPHY)) ||
2481	    nla_put_flag(msg, NL80211_ATTR_SPLIT_WIPHY_DUMP)) {
2482		nlmsg_free(msg);
2483		return NULL;
2484	}
2485
2486	if (send_and_recv_msgs(drv, msg, phy_info_handler, &result,
2487			       NULL, NULL) == 0) {
2488		struct hostapd_hw_modes *modes;
2489
2490		nl80211_set_regulatory_flags(drv, &result);
2491		if (result.failed) {
2492			int i;
2493
2494			for (i = 0; result.modes && i < *num_modes; i++) {
2495				os_free(result.modes[i].channels);
2496				os_free(result.modes[i].rates);
2497			}
2498			os_free(result.modes);
2499			*num_modes = 0;
2500			return NULL;
2501		}
2502
2503		*dfs_domain = result.dfs_domain;
2504
2505		modes = wpa_driver_nl80211_postprocess_modes(result.modes,
2506							     num_modes);
2507		nl80211_dump_chan_list(modes, *num_modes);
2508		return modes;
2509	}
2510
2511	return NULL;
2512}
2513