contrib/wpa/wpa_supplicant/rrm.c

   1 /*
   2  * wpa_supplicant - Radio Measurements
   3  * Copyright (c) 2003-2016, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "includes.h"
  10
  11 #include "utils/common.h"
  12 #include "utils/eloop.h"
  13 #include "common/ieee802_11_common.h"
  14 #include "wpa_supplicant_i.h"
  15 #include "driver_i.h"
  16 #include "bss.h"
  17 #include "scan.h"
  18 #include "p2p_supplicant.h"
  19
  20
  21 static void wpas_rrm_neighbor_rep_timeout_handler(void *data, void *user_ctx)
  22 {
  23         struct rrm_data *rrm = data;
  24
  25         if (!rrm->notify_neighbor_rep) {
  26                 wpa_printf(MSG_ERROR,
  27                            "RRM: Unexpected neighbor report timeout");
  28                 return;
  29         }
  30
  31         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report - NONE");
  32         rrm->notify_neighbor_rep(rrm->neighbor_rep_cb_ctx, NULL);
  33
  34         rrm->notify_neighbor_rep = NULL;
  35         rrm->neighbor_rep_cb_ctx = NULL;
  36 }
  37
  38
  39 /*
  40  * wpas_rrm_reset - Clear and reset all RRM data in wpa_supplicant
  41  * @wpa_s: Pointer to wpa_supplicant
  42  */
  43 void wpas_rrm_reset(struct wpa_supplicant *wpa_s)
  44 {
  45         wpa_s->rrm.rrm_used = 0;
  46
  47         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
  48                              NULL);
  49         if (wpa_s->rrm.notify_neighbor_rep)
  50                 wpas_rrm_neighbor_rep_timeout_handler(&wpa_s->rrm, NULL);
  51         wpa_s->rrm.next_neighbor_rep_token = 1;
  52         wpas_clear_beacon_rep_data(wpa_s);
  53 }
  54
  55
  56 /*
  57  * wpas_rrm_process_neighbor_rep - Handle incoming neighbor report
  58  * @wpa_s: Pointer to wpa_supplicant
  59  * @report: Neighbor report buffer, prefixed by a 1-byte dialog token
  60  * @report_len: Length of neighbor report buffer
  61  */
  62 void wpas_rrm_process_neighbor_rep(struct wpa_supplicant *wpa_s,
  63                                    const u8 *report, size_t report_len)
  64 {
  65         struct wpabuf *neighbor_rep;
  66
  67         wpa_hexdump(MSG_DEBUG, "RRM: New Neighbor Report", report, report_len);
  68         if (report_len < 1)
  69                 return;
  70
  71         if (report[0] != wpa_s->rrm.next_neighbor_rep_token - 1) {
  72                 wpa_printf(MSG_DEBUG,
  73                            "RRM: Discarding neighbor report with token %d (expected %d)",
  74                            report[0], wpa_s->rrm.next_neighbor_rep_token - 1);
  75                 return;
  76         }
  77
  78         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
  79                              NULL);
  80
  81         if (!wpa_s->rrm.notify_neighbor_rep) {
  82                 wpa_printf(MSG_ERROR, "RRM: Unexpected neighbor report");
  83                 return;
  84         }
  85
  86         /* skipping the first byte, which is only an id (dialog token) */
  87         neighbor_rep = wpabuf_alloc(report_len - 1);
  88         if (!neighbor_rep) {
  89                 wpas_rrm_neighbor_rep_timeout_handler(&wpa_s->rrm, NULL);
  90                 return;
  91         }
  92         wpabuf_put_data(neighbor_rep, report + 1, report_len - 1);
  93         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report (token = %d)",
  94                    report[0]);
  95         wpa_s->rrm.notify_neighbor_rep(wpa_s->rrm.neighbor_rep_cb_ctx,
  96                                        neighbor_rep);
  97         wpa_s->rrm.notify_neighbor_rep = NULL;
  98         wpa_s->rrm.neighbor_rep_cb_ctx = NULL;
  99 }
 100
 101
 102 #if defined(__CYGWIN__) || defined(CONFIG_NATIVE_WINDOWS)
 103 /* Workaround different, undefined for Windows, error codes used here */
 104 #define ENOTCONN -1
 105 #define EOPNOTSUPP -1
 106 #define ECANCELED -1
 107 #endif
 108
 109 /* Measurement Request element + Location Subject + Maximum Age subelement */
 110 #define MEASURE_REQUEST_LCI_LEN (3 + 1 + 4)
 111 /* Measurement Request element + Location Civic Request */
 112 #define MEASURE_REQUEST_CIVIC_LEN (3 + 5)
 113
 114
 115 /**
 116  * wpas_rrm_send_neighbor_rep_request - Request a neighbor report from our AP
 117  * @wpa_s: Pointer to wpa_supplicant
 118  * @ssid: if not null, this is sent in the request. Otherwise, no SSID IE
 119  *        is sent in the request.
 120  * @lci: if set, neighbor request will include LCI request
 121  * @civic: if set, neighbor request will include civic location request
 122  * @cb: Callback function to be called once the requested report arrives, or
 123  *      timed out after RRM_NEIGHBOR_REPORT_TIMEOUT seconds.
 124  *      In the former case, 'neighbor_rep' is a newly allocated wpabuf, and it's
 125  *      the requester's responsibility to free it.
 126  *      In the latter case NULL will be sent in 'neighbor_rep'.
 127  * @cb_ctx: Context value to send the callback function
 128  * Returns: 0 in case of success, negative error code otherwise
 129  *
 130  * In case there is a previous request which has not been answered yet, the
 131  * new request fails. The caller may retry after RRM_NEIGHBOR_REPORT_TIMEOUT.
 132  * Request must contain a callback function.
 133  */
 134 int wpas_rrm_send_neighbor_rep_request(struct wpa_supplicant *wpa_s,
 135                                        const struct wpa_ssid_value *ssid,
 136                                        int lci, int civic,
 137                                        void (*cb)(void *ctx,
 138                                                   struct wpabuf *neighbor_rep),
 139                                        void *cb_ctx)
 140 {
 141         struct wpabuf *buf;
 142         const u8 *rrm_ie;
 143
 144         if (wpa_s->wpa_state != WPA_COMPLETED || wpa_s->current_ssid == NULL) {
 145                 wpa_printf(MSG_DEBUG, "RRM: No connection, no RRM.");
 146                 return -ENOTCONN;
 147         }
 148
 149         if (!wpa_s->rrm.rrm_used) {
 150                 wpa_printf(MSG_DEBUG, "RRM: No RRM in current connection.");
 151                 return -EOPNOTSUPP;
 152         }
 153
 154         rrm_ie = wpa_bss_get_ie(wpa_s->current_bss,
 155                                 WLAN_EID_RRM_ENABLED_CAPABILITIES);
 156         if (!rrm_ie || !(wpa_s->current_bss->caps & IEEE80211_CAP_RRM) ||
 157             !(rrm_ie[2] & WLAN_RRM_CAPS_NEIGHBOR_REPORT)) {
 158                 wpa_printf(MSG_DEBUG,
 159                            "RRM: No network support for Neighbor Report.");
 160                 return -EOPNOTSUPP;
 161         }
 162
 163         /* Refuse if there's a live request */
 164         if (wpa_s->rrm.notify_neighbor_rep) {
 165                 wpa_printf(MSG_DEBUG,
 166                            "RRM: Currently handling previous Neighbor Report.");
 167                 return -EBUSY;
 168         }
 169
 170         /* 3 = action category + action code + dialog token */
 171         buf = wpabuf_alloc(3 + (ssid ? 2 + ssid->ssid_len : 0) +
 172                            (lci ? 2 + MEASURE_REQUEST_LCI_LEN : 0) +
 173                            (civic ? 2 + MEASURE_REQUEST_CIVIC_LEN : 0));
 174         if (buf == NULL) {
 175                 wpa_printf(MSG_DEBUG,
 176                            "RRM: Failed to allocate Neighbor Report Request");
 177                 return -ENOMEM;
 178         }
 179
 180         wpa_printf(MSG_DEBUG, "RRM: Neighbor report request (for %s), token=%d",
 181                    (ssid ? wpa_ssid_txt(ssid->ssid, ssid->ssid_len) : ""),
 182                    wpa_s->rrm.next_neighbor_rep_token);
 183
 184         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
 185         wpabuf_put_u8(buf, WLAN_RRM_NEIGHBOR_REPORT_REQUEST);
 186         wpabuf_put_u8(buf, wpa_s->rrm.next_neighbor_rep_token);
 187         if (ssid) {
 188                 wpabuf_put_u8(buf, WLAN_EID_SSID);
 189                 wpabuf_put_u8(buf, ssid->ssid_len);
 190                 wpabuf_put_data(buf, ssid->ssid, ssid->ssid_len);
 191         }
 192
 193         if (lci) {
 194                 /* IEEE P802.11-REVmc/D5.0 9.4.2.21 */
 195                 wpabuf_put_u8(buf, WLAN_EID_MEASURE_REQUEST);
 196                 wpabuf_put_u8(buf, MEASURE_REQUEST_LCI_LEN);
 197
 198                 /*
 199                  * Measurement token; nonzero number that is unique among the
 200                  * Measurement Request elements in a particular frame.
 201                  */
 202                 wpabuf_put_u8(buf, 1); /* Measurement Token */
 203
 204                 /*
 205                  * Parallel, Enable, Request, and Report bits are 0, Duration is
 206                  * reserved.
 207                  */
 208                 wpabuf_put_u8(buf, 0); /* Measurement Request Mode */
 209                 wpabuf_put_u8(buf, MEASURE_TYPE_LCI); /* Measurement Type */
 210
 211                 /* IEEE P802.11-REVmc/D5.0 9.4.2.21.10 - LCI request */
 212                 /* Location Subject */
 213                 wpabuf_put_u8(buf, LOCATION_SUBJECT_REMOTE);
 214
 215                 /* Optional Subelements */
 216                 /*
 217                  * IEEE P802.11-REVmc/D5.0 Figure 9-170
 218                  * The Maximum Age subelement is required, otherwise the AP can
 219                  * send only data that was determined after receiving the
 220                  * request. Setting it here to unlimited age.
 221                  */
 222                 wpabuf_put_u8(buf, LCI_REQ_SUBELEM_MAX_AGE);
 223                 wpabuf_put_u8(buf, 2);
 224                 wpabuf_put_le16(buf, 0xffff);
 225         }
 226
 227         if (civic) {
 228                 /* IEEE P802.11-REVmc/D5.0 9.4.2.21 */
 229                 wpabuf_put_u8(buf, WLAN_EID_MEASURE_REQUEST);
 230                 wpabuf_put_u8(buf, MEASURE_REQUEST_CIVIC_LEN);
 231
 232                 /*
 233                  * Measurement token; nonzero number that is unique among the
 234                  * Measurement Request elements in a particular frame.
 235                  */
 236                 wpabuf_put_u8(buf, 2); /* Measurement Token */
 237
 238                 /*
 239                  * Parallel, Enable, Request, and Report bits are 0, Duration is
 240                  * reserved.
 241                  */
 242                 wpabuf_put_u8(buf, 0); /* Measurement Request Mode */
 243                 /* Measurement Type */
 244                 wpabuf_put_u8(buf, MEASURE_TYPE_LOCATION_CIVIC);
 245
 246                 /* IEEE P802.11-REVmc/D5.0 9.4.2.21.14:
 247                  * Location Civic request */
 248                 /* Location Subject */
 249                 wpabuf_put_u8(buf, LOCATION_SUBJECT_REMOTE);
 250                 wpabuf_put_u8(buf, 0); /* Civic Location Type: IETF RFC 4776 */
 251                 /* Location Service Interval Units: Seconds */
 252                 wpabuf_put_u8(buf, 0);
 253                 /* Location Service Interval: 0 - Only one report is requested
 254                  */
 255                 wpabuf_put_le16(buf, 0);
 256                 /* No optional subelements */
 257         }
 258
 259         wpa_s->rrm.next_neighbor_rep_token++;
 260
 261         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
 262                                 wpa_s->own_addr, wpa_s->bssid,
 263                                 wpabuf_head(buf), wpabuf_len(buf), 0) < 0) {
 264                 wpa_printf(MSG_DEBUG,
 265                            "RRM: Failed to send Neighbor Report Request");
 266                 wpabuf_free(buf);
 267                 return -ECANCELED;
 268         }
 269
 270         wpa_s->rrm.neighbor_rep_cb_ctx = cb_ctx;
 271         wpa_s->rrm.notify_neighbor_rep = cb;
 272         eloop_register_timeout(RRM_NEIGHBOR_REPORT_TIMEOUT, 0,
 273                                wpas_rrm_neighbor_rep_timeout_handler,
 274                                &wpa_s->rrm, NULL);
 275
 276         wpabuf_free(buf);
 277         return 0;
 278 }
 279
 280
 281 static int wpas_rrm_report_elem(struct wpabuf **buf, u8 token, u8 mode, u8 type,
 282                                 const u8 *data, size_t data_len)
 283 {
 284         if (wpabuf_resize(buf, 5 + data_len))
 285                 return -1;
 286
 287         wpabuf_put_u8(*buf, WLAN_EID_MEASURE_REPORT);
 288         wpabuf_put_u8(*buf, 3 + data_len);
 289         wpabuf_put_u8(*buf, token);
 290         wpabuf_put_u8(*buf, mode);
 291         wpabuf_put_u8(*buf, type);
 292
 293         if (data_len)
 294                 wpabuf_put_data(*buf, data, data_len);
 295
 296         return 0;
 297 }
 298
 299
 300 static int
 301 wpas_rrm_build_lci_report(struct wpa_supplicant *wpa_s,
 302                           const struct rrm_measurement_request_element *req,
 303                           struct wpabuf **buf)
 304 {
 305         u8 subject;
 306         u16 max_age = 0;
 307         struct os_reltime t, diff;
 308         unsigned long diff_l;
 309         const u8 *subelem;
 310         const u8 *request = req->variable;
 311         size_t len = req->len - 3;
 312
 313         if (len < 1)
 314                 return -1;
 315
 316         if (!wpa_s->lci)
 317                 goto reject;
 318
 319         subject = *request++;
 320         len--;
 321
 322         wpa_printf(MSG_DEBUG, "Measurement request location subject=%u",
 323                    subject);
 324
 325         if (subject != LOCATION_SUBJECT_REMOTE) {
 326                 wpa_printf(MSG_INFO,
 327                            "Not building LCI report - bad location subject");
 328                 return 0;
 329         }
 330
 331         /* Subelements are formatted exactly like elements */
 332         wpa_hexdump(MSG_DEBUG, "LCI request subelements", request, len);
 333         subelem = get_ie(request, len, LCI_REQ_SUBELEM_MAX_AGE);
 334         if (subelem && subelem[1] == 2)
 335                 max_age = WPA_GET_LE16(subelem + 2);
 336
 337         if (os_get_reltime(&t))
 338                 goto reject;
 339
 340         os_reltime_sub(&t, &wpa_s->lci_time, &diff);
 341         /* LCI age is calculated in 10th of a second units. */
 342         diff_l = diff.sec * 10 + diff.usec / 100000;
 343
 344         if (max_age != 0xffff && max_age < diff_l)
 345                 goto reject;
 346
 347         if (wpas_rrm_report_elem(buf, req->token,
 348                                  MEASUREMENT_REPORT_MODE_ACCEPT, req->type,
 349                                  wpabuf_head_u8(wpa_s->lci),
 350                                  wpabuf_len(wpa_s->lci)) < 0) {
 351                 wpa_printf(MSG_DEBUG, "Failed to add LCI report element");
 352                 return -1;
 353         }
 354
 355         return 0;
 356
 357 reject:
 358         if (!is_multicast_ether_addr(wpa_s->rrm.dst_addr) &&
 359             wpas_rrm_report_elem(buf, req->token,
 360                                  MEASUREMENT_REPORT_MODE_REJECT_INCAPABLE,
 361                                  req->type, NULL, 0) < 0) {
 362                 wpa_printf(MSG_DEBUG, "RRM: Failed to add report element");
 363                 return -1;
 364         }
 365
 366         return 0;
 367 }
 368
 369
 370 static void wpas_rrm_send_msr_report_mpdu(struct wpa_supplicant *wpa_s,
 371                                           const u8 *data, size_t len)
 372 {
 373         struct wpabuf *report = wpabuf_alloc(len + 3);
 374
 375         if (!report)
 376                 return;
 377
 378         wpabuf_put_u8(report, WLAN_ACTION_RADIO_MEASUREMENT);
 379         wpabuf_put_u8(report, WLAN_RRM_RADIO_MEASUREMENT_REPORT);
 380         wpabuf_put_u8(report, wpa_s->rrm.token);
 381
 382         wpabuf_put_data(report, data, len);
 383
 384         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
 385                                 wpa_s->own_addr, wpa_s->bssid,
 386                                 wpabuf_head(report), wpabuf_len(report), 0)) {
 387                 wpa_printf(MSG_ERROR,
 388                            "RRM: Radio measurement report failed: Sending Action frame failed");
 389         }
 390
 391         wpabuf_free(report);
 392 }
 393
 394
 395 static void wpas_rrm_send_msr_report(struct wpa_supplicant *wpa_s,
 396                                      struct wpabuf *buf)
 397 {
 398         int len = wpabuf_len(buf);
 399         const u8 *pos = wpabuf_head_u8(buf), *next = pos;
 400
 401 #define MPDU_REPORT_LEN (int) (IEEE80211_MAX_MMPDU_SIZE - IEEE80211_HDRLEN - 3)
 402
 403         while (len) {
 404                 int send_len = (len > MPDU_REPORT_LEN) ? next - pos : len;
 405
 406                 if (send_len == len ||
 407                     (send_len + next[1] + 2) > MPDU_REPORT_LEN) {
 408                         wpas_rrm_send_msr_report_mpdu(wpa_s, pos, send_len);
 409                         len -= send_len;
 410                         pos = next;
 411                 }
 412
 413                 if (len)
 414                         next += next[1] + 2;
 415         }
 416 #undef MPDU_REPORT_LEN
 417 }
 418
 419
 420 static int wpas_add_channel(u8 op_class, u8 chan, u8 num_primary_channels,
 421                             int *freqs)
 422 {
 423         size_t i;
 424
 425         for (i = 0; i < num_primary_channels; i++) {
 426                 u8 primary_chan = chan - (2 * num_primary_channels - 2) + i * 4;
 427
 428                 freqs[i] = ieee80211_chan_to_freq(NULL, op_class, primary_chan);
 429                 /* ieee80211_chan_to_freq() is not really meant for this
 430                  * conversion of 20 MHz primary channel numbers for wider VHT
 431                  * channels, so handle those as special cases here for now. */
 432                 if (freqs[i] < 0 &&
 433                     (op_class == 128 || op_class == 129 || op_class == 130))
 434                         freqs[i] = 5000 + 5 * primary_chan;
 435                 if (freqs[i] < 0) {
 436                         wpa_printf(MSG_DEBUG,
 437                                    "Beacon Report: Invalid channel %u",
 438                                    chan);
 439                         return -1;
 440                 }
 441         }
 442
 443         return 0;
 444 }
 445
 446
 447 static int * wpas_add_channels(const struct oper_class_map *op,
 448                                struct hostapd_hw_modes *mode, int active,
 449                                const u8 *channels, const u8 size)
 450 {
 451         int *freqs, *next_freq;
 452         u8 num_primary_channels, i;
 453         u8 num_chans;
 454
 455         num_chans = channels ? size :
 456                 (op->max_chan - op->min_chan) / op->inc + 1;
 457
 458         if (op->bw == BW80 || op->bw == BW80P80)
 459                 num_primary_channels = 4;
 460         else if (op->bw == BW160)
 461                 num_primary_channels = 8;
 462         else
 463                 num_primary_channels = 1;
 464
 465         /* one extra place for the zero-terminator */
 466         freqs = os_calloc(num_chans * num_primary_channels + 1, sizeof(*freqs));
 467         if (!freqs) {
 468                 wpa_printf(MSG_ERROR,
 469                            "Beacon Report: Failed to allocate freqs array");
 470                 return NULL;
 471         }
 472
 473         next_freq = freqs;
 474         for  (i = 0; i < num_chans; i++) {
 475                 u8 chan = channels ? channels[i] : op->min_chan + i * op->inc;
 476                 enum chan_allowed res = verify_channel(mode, chan, op->bw);
 477
 478                 if (res == NOT_ALLOWED || (res == NO_IR && active))
 479                         continue;
 480
 481                 if (wpas_add_channel(op->op_class, chan, num_primary_channels,
 482                                      next_freq) < 0) {
 483                         os_free(freqs);
 484                         return NULL;
 485                 }
 486
 487                 next_freq += num_primary_channels;
 488         }
 489
 490         if (!freqs[0]) {
 491                 os_free(freqs);
 492                 return NULL;
 493         }
 494
 495         return freqs;
 496 }
 497
 498
 499 static int * wpas_op_class_freqs(const struct oper_class_map *op,
 500                                  struct hostapd_hw_modes *mode, int active)
 501 {
 502         u8 channels_80mhz[] = { 42, 58, 106, 122, 138, 155 };
 503         u8 channels_160mhz[] = { 50, 114 };
 504
 505         /*
 506          * When adding all channels in the operating class, 80 + 80 MHz
 507          * operating classes are like 80 MHz channels because we add all valid
 508          * channels anyway.
 509          */
 510         if (op->bw == BW80 || op->bw == BW80P80)
 511                 return wpas_add_channels(op, mode, active, channels_80mhz,
 512                                          ARRAY_SIZE(channels_80mhz));
 513
 514         if (op->bw == BW160)
 515                 return wpas_add_channels(op, mode, active, channels_160mhz,
 516                                          ARRAY_SIZE(channels_160mhz));
 517
 518         return wpas_add_channels(op, mode, active, NULL, 0);
 519 }
 520
 521
 522 static int * wpas_channel_report_freqs(struct wpa_supplicant *wpa_s, int active,
 523                                        const char *country, const u8 *subelems,
 524                                        size_t len)
 525 {
 526         int *freqs = NULL, *new_freqs;
 527         const u8 *end = subelems + len;
 528
 529         while (end - subelems > 2) {
 530                 const struct oper_class_map *op;
 531                 const u8 *ap_chan_elem, *pos;
 532                 u8 left;
 533                 struct hostapd_hw_modes *mode;
 534
 535                 ap_chan_elem = get_ie(subelems, end - subelems,
 536                                       WLAN_BEACON_REQUEST_SUBELEM_AP_CHANNEL);
 537                 if (!ap_chan_elem)
 538                         break;
 539                 pos = ap_chan_elem + 2;
 540                 left = ap_chan_elem[1];
 541                 if (left < 1)
 542                         break;
 543                 subelems = ap_chan_elem + 2 + left;
 544
 545                 op = get_oper_class(country, *pos);
 546                 if (!op) {
 547                         wpa_printf(MSG_DEBUG,
 548                                    "Beacon request: unknown operating class in AP Channel Report subelement %u",
 549                                    *pos);
 550                         goto out;
 551                 }
 552                 pos++;
 553                 left--;
 554
 555                 mode = get_mode(wpa_s->hw.modes, wpa_s->hw.num_modes, op->mode);
 556                 if (!mode)
 557                         continue;
 558
 559                 /*
 560                  * For 80 + 80 MHz operating classes, this AP Channel Report
 561                  * element should be followed by another element specifying
 562                  * the second 80 MHz channel. For now just add this 80 MHz
 563                  * channel, the second 80 MHz channel will be added when the
 564                  * next element is parsed.
 565                  * TODO: Verify that this AP Channel Report element is followed
 566                  * by a corresponding AP Channel Report element as specified in
 567                  * IEEE Std 802.11-2016, 11.11.9.1.
 568                  */
 569                 new_freqs = wpas_add_channels(op, mode, active, pos, left);
 570                 if (new_freqs)
 571                         int_array_concat(&freqs, new_freqs);
 572
 573                 os_free(new_freqs);
 574         }
 575
 576         return freqs;
 577 out:
 578         os_free(freqs);
 579         return NULL;
 580 }
 581
 582
 583 static int * wpas_beacon_request_freqs(struct wpa_supplicant *wpa_s,
 584                                        u8 op_class, u8 chan, int active,
 585                                        const u8 *subelems, size_t len)
 586 {
 587         int *freqs = NULL, *ext_freqs = NULL;
 588         struct hostapd_hw_modes *mode;
 589         const char *country = NULL;
 590         const struct oper_class_map *op;
 591         const u8 *elem;
 592
 593         if (!wpa_s->current_bss)
 594                 return NULL;
 595         elem = wpa_bss_get_ie(wpa_s->current_bss, WLAN_EID_COUNTRY);
 596         if (elem && elem[1] >= 2)
 597                 country = (const char *) (elem + 2);
 598
 599         op = get_oper_class(country, op_class);
 600         if (!op) {
 601                 wpa_printf(MSG_DEBUG,
 602                            "Beacon request: invalid operating class %d",
 603                            op_class);
 604                 return NULL;
 605         }
 606
 607         mode = get_mode(wpa_s->hw.modes, wpa_s->hw.num_modes, op->mode);
 608         if (!mode)
 609                 return NULL;
 610
 611         switch (chan) {
 612         case 0:
 613                 freqs = wpas_op_class_freqs(op, mode, active);
 614                 if (!freqs)
 615                         return NULL;
 616                 break;
 617         case 255:
 618                 /* freqs will be added from AP channel subelements */
 619                 break;
 620         default:
 621                 freqs = wpas_add_channels(op, mode, active, &chan, 1);
 622                 if (!freqs)
 623                         return NULL;
 624                 break;
 625         }
 626
 627         ext_freqs = wpas_channel_report_freqs(wpa_s, active, country, subelems,
 628                                               len);
 629         if (ext_freqs) {
 630                 int_array_concat(&freqs, ext_freqs);
 631                 os_free(ext_freqs);
 632                 int_array_sort_unique(freqs);
 633         }
 634
 635         return freqs;
 636 }
 637
 638
 639 static int wpas_get_op_chan_phy(int freq, const u8 *ies, size_t ies_len,
 640                                 u8 *op_class, u8 *chan, u8 *phy_type)
 641 {
 642         const u8 *ie;
 643         int sec_chan = 0, vht = 0;
 644         struct ieee80211_ht_operation *ht_oper = NULL;
 645         struct ieee80211_vht_operation *vht_oper = NULL;
 646         u8 seg0, seg1;
 647
 648         ie = get_ie(ies, ies_len, WLAN_EID_HT_OPERATION);
 649         if (ie && ie[1] >= sizeof(struct ieee80211_ht_operation)) {
 650                 u8 sec_chan_offset;
 651
 652                 ht_oper = (struct ieee80211_ht_operation *) (ie + 2);
 653                 sec_chan_offset = ht_oper->ht_param &
 654                         HT_INFO_HT_PARAM_SECONDARY_CHNL_OFF_MASK;
 655                 if (sec_chan_offset == HT_INFO_HT_PARAM_SECONDARY_CHNL_ABOVE)
 656                         sec_chan = 1;
 657                 else if (sec_chan_offset ==
 658                          HT_INFO_HT_PARAM_SECONDARY_CHNL_BELOW)
 659                         sec_chan = -1;
 660         }
 661
 662         ie = get_ie(ies, ies_len, WLAN_EID_VHT_OPERATION);
 663         if (ie && ie[1] >= sizeof(struct ieee80211_vht_operation)) {
 664                 vht_oper = (struct ieee80211_vht_operation *) (ie + 2);
 665
 666                 switch (vht_oper->vht_op_info_chwidth) {
 667                 case 1:
 668                         seg0 = vht_oper->vht_op_info_chan_center_freq_seg0_idx;
 669                         seg1 = vht_oper->vht_op_info_chan_center_freq_seg1_idx;
 670                         if (seg1 && abs(seg1 - seg0) == 8)
 671                                 vht = VHT_CHANWIDTH_160MHZ;
 672                         else if (seg1)
 673                                 vht = VHT_CHANWIDTH_80P80MHZ;
 674                         else
 675                                 vht = VHT_CHANWIDTH_80MHZ;
 676                         break;
 677                 case 2:
 678                         vht = VHT_CHANWIDTH_160MHZ;
 679                         break;
 680                 case 3:
 681                         vht = VHT_CHANWIDTH_80P80MHZ;
 682                         break;
 683                 default:
 684                         vht = VHT_CHANWIDTH_USE_HT;
 685                         break;
 686                 }
 687         }
 688
 689         if (ieee80211_freq_to_channel_ext(freq, sec_chan, vht, op_class,
 690                                           chan) == NUM_HOSTAPD_MODES) {
 691                 wpa_printf(MSG_DEBUG,
 692                            "Cannot determine operating class and channel");
 693                 return -1;
 694         }
 695
 696         *phy_type = ieee80211_get_phy_type(freq, ht_oper != NULL,
 697                                            vht_oper != NULL);
 698         if (*phy_type == PHY_TYPE_UNSPECIFIED) {
 699                 wpa_printf(MSG_DEBUG, "Cannot determine phy type");
 700                 return -1;
 701         }
 702
 703         return 0;
 704 }
 705
 706
 707 static int wpas_beacon_rep_add_frame_body(struct bitfield *eids,
 708                                           enum beacon_report_detail detail,
 709                                           struct wpa_bss *bss, u8 *buf,
 710                                           size_t buf_len)
 711 {
 712         u8 *ies = (u8 *) (bss + 1);
 713         size_t ies_len = bss->ie_len ? bss->ie_len : bss->beacon_ie_len;
 714         u8 *pos = buf;
 715         int rem_len;
 716
 717         rem_len = 255 - sizeof(struct rrm_measurement_beacon_report) -
 718                 sizeof(struct rrm_measurement_report_element) - 2;
 719
 720         if (detail > BEACON_REPORT_DETAIL_ALL_FIELDS_AND_ELEMENTS) {
 721                 wpa_printf(MSG_DEBUG,
 722                            "Beacon Request: Invalid reporting detail: %d",
 723                            detail);
 724                 return -1;
 725         }
 726
 727         if (detail == BEACON_REPORT_DETAIL_NONE)
 728                 return 0;
 729
 730         /*
 731          * Minimal frame body subelement size: EID(1) + length(1) + TSF(8) +
 732          * beacon interval(2) + capabilities(2) = 14 bytes
 733          */
 734         if (buf_len < 14)
 735                 return 0;
 736
 737         *pos++ = WLAN_BEACON_REPORT_SUBELEM_FRAME_BODY;
 738         /* The length will be filled later */
 739         pos++;
 740         WPA_PUT_LE64(pos, bss->tsf);
 741         pos += sizeof(bss->tsf);
 742         WPA_PUT_LE16(pos, bss->beacon_int);
 743         pos += 2;
 744         WPA_PUT_LE16(pos, bss->caps);
 745         pos += 2;
 746
 747         rem_len -= pos - buf;
 748
 749         /*
 750          * According to IEEE Std 802.11-2016, 9.4.2.22.7, if the reported frame
 751          * body subelement causes the element to exceed the maximum element
 752          * size, the subelement is truncated so that the last IE is a complete
 753          * IE. So even when required to report all IEs, add elements one after
 754          * the other and stop once there is no more room in the measurement
 755          * element.
 756          */
 757         while (ies_len > 2 && 2U + ies[1] <= ies_len && rem_len > 0) {
 758                 if (detail == BEACON_REPORT_DETAIL_ALL_FIELDS_AND_ELEMENTS ||
 759                     (eids && bitfield_is_set(eids, ies[0]))) {
 760                         u8 eid = ies[0], elen = ies[1];
 761
 762                         if ((eid == WLAN_EID_TIM || eid == WLAN_EID_RSN) &&
 763                             elen > 4)
 764                                 elen = 4;
 765                         /*
 766                          * TODO: Truncate IBSS DFS element as described in
 767                          * IEEE Std 802.11-2016, 9.4.2.22.7.
 768                          */
 769
 770                         if (2 + elen > buf + buf_len - pos ||
 771                             2 + elen > rem_len)
 772                                 break;
 773
 774                         *pos++ = ies[0];
 775                         *pos++ = elen;
 776                         os_memcpy(pos, ies + 2, elen);
 777                         pos += elen;
 778                         rem_len -= 2 + elen;
 779                 }
 780
 781                 ies_len -= 2 + ies[1];
 782                 ies += 2 + ies[1];
 783         }
 784
 785         /* Now the length is known */
 786         buf[1] = pos - buf - 2;
 787         return pos - buf;
 788 }
 789
 790
 791 static int wpas_add_beacon_rep(struct wpa_supplicant *wpa_s,
 792                                struct wpabuf **wpa_buf, struct wpa_bss *bss,
 793                                u64 start, u64 parent_tsf)
 794 {
 795         struct beacon_rep_data *data = &wpa_s->beacon_rep_data;
 796         u8 *ie = (u8 *) (bss + 1);
 797         size_t ie_len = bss->ie_len + bss->beacon_ie_len;
 798         int ret;
 799         u8 *buf;
 800         struct rrm_measurement_beacon_report *rep;
 801
 802         if (os_memcmp(data->bssid, broadcast_ether_addr, ETH_ALEN) != 0 &&
 803             os_memcmp(data->bssid, bss->bssid, ETH_ALEN) != 0)
 804                 return 0;
 805
 806         if (data->ssid_len &&
 807             (data->ssid_len != bss->ssid_len ||
 808              os_memcmp(data->ssid, bss->ssid, bss->ssid_len) != 0))
 809                 return 0;
 810
 811         /* Maximum element length: beacon report element + reported frame body
 812          * subelement + all IEs of the reported beacon */
 813         buf = os_malloc(sizeof(*rep) + 14 + ie_len);
 814         if (!buf)
 815                 return -1;
 816
 817         rep = (struct rrm_measurement_beacon_report *) buf;
 818         if (wpas_get_op_chan_phy(bss->freq, ie, ie_len, &rep->op_class,
 819                                  &rep->channel, &rep->report_info) < 0) {
 820                 ret = 0;
 821                 goto out;
 822         }
 823
 824         rep->start_time = host_to_le64(start);
 825         rep->duration = host_to_le16(data->scan_params.duration);
 826         rep->rcpi = rssi_to_rcpi(bss->level);
 827         rep->rsni = 255; /* 255 indicates that RSNI is not available */
 828         os_memcpy(rep->bssid, bss->bssid, ETH_ALEN);
 829         rep->antenna_id = 0; /* unknown */
 830         rep->parent_tsf = host_to_le32(parent_tsf);
 831
 832         ret = wpas_beacon_rep_add_frame_body(data->eids, data->report_detail,
 833                                              bss, rep->variable, 14 + ie_len);
 834         if (ret < 0)
 835                 goto out;
 836
 837         ret = wpas_rrm_report_elem(wpa_buf, wpa_s->beacon_rep_data.token,
 838                                    MEASUREMENT_REPORT_MODE_ACCEPT,
 839                                    MEASURE_TYPE_BEACON, buf,
 840                                    ret + sizeof(*rep));
 841 out:
 842         os_free(buf);
 843         return ret;
 844 }
 845
 846
 847 static int wpas_beacon_rep_no_results(struct wpa_supplicant *wpa_s,
 848                                       struct wpabuf **buf)
 849 {
 850         return wpas_rrm_report_elem(buf, wpa_s->beacon_rep_data.token,
 851                                     MEASUREMENT_REPORT_MODE_ACCEPT,
 852                                     MEASURE_TYPE_BEACON, NULL, 0);
 853 }
 854
 855
 856 static void wpas_beacon_rep_table(struct wpa_supplicant *wpa_s,
 857                                   struct wpabuf **buf)
 858 {
 859         size_t i;
 860
 861         for (i = 0; i < wpa_s->last_scan_res_used; i++) {
 862                 if (wpas_add_beacon_rep(wpa_s, buf, wpa_s->last_scan_res[i],
 863                                         0, 0) < 0)
 864                         break;
 865         }
 866
 867         if (!(*buf))
 868                 wpas_beacon_rep_no_results(wpa_s, buf);
 869
 870         wpa_hexdump_buf(MSG_DEBUG, "RRM: Radio Measurement report", *buf);
 871 }
 872
 873
 874 void wpas_rrm_refuse_request(struct wpa_supplicant *wpa_s)
 875 {
 876         if (!is_multicast_ether_addr(wpa_s->rrm.dst_addr)) {
 877                 struct wpabuf *buf = NULL;
 878
 879                 if (wpas_rrm_report_elem(&buf, wpa_s->beacon_rep_data.token,
 880                                          MEASUREMENT_REPORT_MODE_REJECT_REFUSED,
 881                                          MEASURE_TYPE_BEACON, NULL, 0)) {
 882                         wpa_printf(MSG_ERROR, "RRM: Memory allocation failed");
 883                         wpabuf_free(buf);
 884                         return;
 885                 }
 886
 887                 wpas_rrm_send_msr_report(wpa_s, buf);
 888                 wpabuf_free(buf);
 889         }
 890
 891         wpas_clear_beacon_rep_data(wpa_s);
 892 }
 893
 894
 895 static void wpas_rrm_scan_timeout(void *eloop_ctx, void *timeout_ctx)
 896 {
 897         struct wpa_supplicant *wpa_s = eloop_ctx;
 898         struct wpa_driver_scan_params *params =
 899                 &wpa_s->beacon_rep_data.scan_params;
 900         u16 prev_duration = params->duration;
 901
 902         if (!wpa_s->current_bss)
 903                 return;
 904
 905         if (!(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_SUPPORT_SET_SCAN_DWELL) &&
 906             params->duration) {
 907                 wpa_printf(MSG_DEBUG,
 908                            "RRM: Cannot set scan duration due to missing driver support");
 909                 params->duration = 0;
 910         }
 911         os_get_reltime(&wpa_s->beacon_rep_scan);
 912         if (wpa_s->scanning || wpas_p2p_in_progress(wpa_s) ||
 913             wpa_supplicant_trigger_scan(wpa_s, params))
 914                 wpas_rrm_refuse_request(wpa_s);
 915         params->duration = prev_duration;
 916 }
 917
 918
 919 static int wpas_rm_handle_beacon_req_subelem(struct wpa_supplicant *wpa_s,
 920                                              struct beacon_rep_data *data,
 921                                              u8 sid, u8 slen, const u8 *subelem)
 922 {
 923         u8 report_info, i;
 924
 925         switch (sid) {
 926         case WLAN_BEACON_REQUEST_SUBELEM_SSID:
 927                 if (!slen) {
 928                         wpa_printf(MSG_DEBUG,
 929                                    "SSID subelement with zero length - wildcard SSID");
 930                         break;
 931                 }
 932
 933                 if (slen > SSID_MAX_LEN) {
 934                         wpa_printf(MSG_DEBUG,
 935                                    "Invalid SSID subelement length: %u", slen);
 936                         return -1;
 937                 }
 938
 939                 data->ssid_len = slen;
 940                 os_memcpy(data->ssid, subelem, data->ssid_len);
 941                 break;
 942         case WLAN_BEACON_REQUEST_SUBELEM_INFO:
 943                 if (slen != 2) {
 944                         wpa_printf(MSG_DEBUG,
 945                                    "Invalid reporting information subelement length: %u",
 946                                    slen);
 947                         return -1;
 948                 }
 949
 950                 report_info = subelem[0];
 951                 if (report_info != 0) {
 952                         wpa_printf(MSG_DEBUG,
 953                                    "reporting information=%u is not supported",
 954                                    report_info);
 955                         return 0;
 956                 }
 957                 break;
 958         case WLAN_BEACON_REQUEST_SUBELEM_DETAIL:
 959                 if (slen != 1) {
 960                         wpa_printf(MSG_DEBUG,
 961                                    "Invalid reporting detail subelement length: %u",
 962                                    slen);
 963                         return -1;
 964                 }
 965
 966                 data->report_detail = subelem[0];
 967                 if (data->report_detail >
 968                     BEACON_REPORT_DETAIL_ALL_FIELDS_AND_ELEMENTS) {
 969                         wpa_printf(MSG_DEBUG, "Invalid reporting detail: %u",
 970                                    subelem[0]);
 971                         return -1;
 972                 }
 973
 974                 break;
 975         case WLAN_BEACON_REQUEST_SUBELEM_REQUEST:
 976                 if (data->report_detail !=
 977                     BEACON_REPORT_DETAIL_REQUESTED_ONLY) {
 978                         wpa_printf(MSG_DEBUG,
 979                                    "Beacon request: request subelement is present but report detail is %u",
 980                                    data->report_detail);
 981                         return -1;
 982                 }
 983
 984                 if (!slen) {
 985                         wpa_printf(MSG_DEBUG,
 986                                    "Invalid request subelement length: %u",
 987                                    slen);
 988                         return -1;
 989                 }
 990
 991                 if (data->eids) {
 992                         wpa_printf(MSG_DEBUG,
 993                                    "Beacon Request: Request subelement appears more than once");
 994                         return -1;
 995                 }
 996
 997                 data->eids = bitfield_alloc(255);
 998                 if (!data->eids) {
 999                         wpa_printf(MSG_DEBUG, "Failed to allocate EIDs bitmap");
1000                         return -1;
1001                 }
1002
1003                 for (i = 0; i < slen; i++)
1004                         bitfield_set(data->eids, subelem[i]);
1005                 break;
1006         case WLAN_BEACON_REQUEST_SUBELEM_AP_CHANNEL:
1007                 /* Skip - it will be processed when freqs are added */
1008                 break;
1009         default:
1010                 wpa_printf(MSG_DEBUG,
1011                            "Beacon request: Unknown subelement id %u", sid);
1012                 break;
1013         }
1014
1015         return 1;
1016 }
1017
1018
1019 /**
1020  * Returns 0 if the next element can be processed, 1 if some operation was
1021  * triggered, and -1 if processing failed (i.e., the element is in invalid
1022  * format or an internal error occurred).
1023  */
1024 static int
1025 wpas_rm_handle_beacon_req(struct wpa_supplicant *wpa_s,
1026                           u8 elem_token, int duration_mandatory,
1027                           const struct rrm_measurement_beacon_request *req,
1028                           size_t len, struct wpabuf **buf)
1029 {
1030         struct beacon_rep_data *data = &wpa_s->beacon_rep_data;
1031         struct wpa_driver_scan_params *params = &data->scan_params;
1032         const u8 *subelems;
1033         size_t elems_len;
1034         u16 rand_interval;
1035         u32 interval_usec;
1036         u32 _rand;
1037         int ret = 0, res;
1038         u8 reject_mode;
1039
1040         if (len < sizeof(*req))
1041                 return -1;
1042
1043         if (req->mode != BEACON_REPORT_MODE_PASSIVE &&
1044             req->mode != BEACON_REPORT_MODE_ACTIVE &&
1045             req->mode != BEACON_REPORT_MODE_TABLE)
1046                 return 0;
1047
1048         subelems = req->variable;
1049         elems_len = len - sizeof(*req);
1050         rand_interval = le_to_host16(req->rand_interval);
1051
1052         os_free(params->freqs);
1053         os_memset(params, 0, sizeof(*params));
1054
1055         data->token = elem_token;
1056
1057         /* default reporting detail is all fixed length fields and all
1058          * elements */
1059         data->report_detail = BEACON_REPORT_DETAIL_ALL_FIELDS_AND_ELEMENTS;
1060         os_memcpy(data->bssid, req->bssid, ETH_ALEN);
1061
1062         while (elems_len >= 2) {
1063                 if (subelems[1] > elems_len - 2) {
1064                         wpa_printf(MSG_DEBUG,
1065                                    "Beacon Request: Truncated subelement");
1066                         ret = -1;
1067                         goto out;
1068                 }
1069
1070                 res = wpas_rm_handle_beacon_req_subelem(
1071                         wpa_s, data, subelems[0], subelems[1], &subelems[2]);
1072                 if (res < 0) {
1073                         ret = res;
1074                         goto out;
1075                 } else if (!res) {
1076                         reject_mode = MEASUREMENT_REPORT_MODE_REJECT_INCAPABLE;
1077                         goto out_reject;
1078                 }
1079
1080                 elems_len -= 2 + subelems[1];
1081                 subelems += 2 + subelems[1];
1082         }
1083
1084         if (req->mode == BEACON_REPORT_MODE_TABLE) {
1085                 wpas_beacon_rep_table(wpa_s, buf);
1086                 goto out;
1087         }
1088
1089         params->freqs = wpas_beacon_request_freqs(
1090                 wpa_s, req->oper_class, req->channel,
1091                 req->mode == BEACON_REPORT_MODE_ACTIVE,
1092                 req->variable, len - sizeof(*req));
1093         if (!params->freqs) {
1094                 wpa_printf(MSG_DEBUG, "Beacon request: No valid channels");
1095                 reject_mode = MEASUREMENT_REPORT_MODE_REJECT_REFUSED;
1096                 goto out_reject;
1097         }
1098
1099         params->duration = le_to_host16(req->duration);
1100         params->duration_mandatory = duration_mandatory;
1101         if (!params->duration) {
1102                 wpa_printf(MSG_DEBUG, "Beacon request: Duration is 0");
1103                 ret = -1;
1104                 goto out;
1105         }
1106
1107         params->only_new_results = 1;
1108
1109         if (req->mode == BEACON_REPORT_MODE_ACTIVE) {
1110                 params->ssids[params->num_ssids].ssid = data->ssid;
1111                 params->ssids[params->num_ssids++].ssid_len = data->ssid_len;
1112         }
1113
1114         if (os_get_random((u8 *) &_rand, sizeof(_rand)) < 0)
1115                 _rand = os_random();
1116         interval_usec = (_rand % (rand_interval + 1)) * 1024;
1117         eloop_register_timeout(0, interval_usec, wpas_rrm_scan_timeout, wpa_s,
1118                                NULL);
1119         return 1;
1120 out_reject:
1121         if (!is_multicast_ether_addr(wpa_s->rrm.dst_addr) &&
1122             wpas_rrm_report_elem(buf, elem_token, reject_mode,
1123                                  MEASURE_TYPE_BEACON, NULL, 0) < 0) {
1124                 wpa_printf(MSG_DEBUG, "RRM: Failed to add report element");
1125                 ret = -1;
1126         }
1127 out:
1128         wpas_clear_beacon_rep_data(wpa_s);
1129         return ret;
1130 }
1131
1132
1133 static int
1134 wpas_rrm_handle_msr_req_element(
1135         struct wpa_supplicant *wpa_s,
1136         const struct rrm_measurement_request_element *req,
1137         struct wpabuf **buf)
1138 {
1139         int duration_mandatory;
1140
1141         wpa_printf(MSG_DEBUG, "Measurement request type %d token %d",
1142                    req->type, req->token);
1143
1144         if (req->mode & MEASUREMENT_REQUEST_MODE_ENABLE) {
1145                 /* Enable bit is not supported for now */
1146                 wpa_printf(MSG_DEBUG, "RRM: Enable bit not supported, ignore");
1147                 return 0;
1148         }
1149
1150         if ((req->mode & MEASUREMENT_REQUEST_MODE_PARALLEL) &&
1151             req->type > MEASURE_TYPE_RPI_HIST) {
1152                 /* Parallel measurements are not supported for now */
1153                 wpa_printf(MSG_DEBUG,
1154                            "RRM: Parallel measurements are not supported, reject");
1155                 goto reject;
1156         }
1157
1158         duration_mandatory =
1159                 !!(req->mode & MEASUREMENT_REQUEST_MODE_DURATION_MANDATORY);
1160
1161         switch (req->type) {
1162         case MEASURE_TYPE_LCI:
1163                 return wpas_rrm_build_lci_report(wpa_s, req, buf);
1164         case MEASURE_TYPE_BEACON:
1165                 if (duration_mandatory &&
1166                     !(wpa_s->drv_rrm_flags &
1167                       WPA_DRIVER_FLAGS_SUPPORT_SET_SCAN_DWELL)) {
1168                         wpa_printf(MSG_DEBUG,
1169                                    "RRM: Driver does not support dwell time configuration - reject beacon report with mandatory duration");
1170                         goto reject;
1171                 }
1172                 return wpas_rm_handle_beacon_req(wpa_s, req->token,
1173                                                  duration_mandatory,
1174                                                  (const void *) req->variable,
1175                                                  req->len - 3, buf);
1176         default:
1177                 wpa_printf(MSG_INFO,
1178                            "RRM: Unsupported radio measurement type %u",
1179                            req->type);
1180                 break;
1181         }
1182
1183 reject:
1184         if (!is_multicast_ether_addr(wpa_s->rrm.dst_addr) &&
1185             wpas_rrm_report_elem(buf, req->token,
1186                                  MEASUREMENT_REPORT_MODE_REJECT_INCAPABLE,
1187                                  req->type, NULL, 0) < 0) {
1188                 wpa_printf(MSG_DEBUG, "RRM: Failed to add report element");
1189                 return -1;
1190         }
1191
1192         return 0;
1193 }
1194
1195
1196 static struct wpabuf *
1197 wpas_rrm_process_msr_req_elems(struct wpa_supplicant *wpa_s, const u8 *pos,
1198                                size_t len)
1199 {
1200         struct wpabuf *buf = NULL;
1201
1202         while (len) {
1203                 const struct rrm_measurement_request_element *req;
1204                 int res;
1205
1206                 if (len < 2) {
1207                         wpa_printf(MSG_DEBUG, "RRM: Truncated element");
1208                         goto out;
1209                 }
1210
1211                 req = (const struct rrm_measurement_request_element *) pos;
1212                 if (req->eid != WLAN_EID_MEASURE_REQUEST) {
1213                         wpa_printf(MSG_DEBUG,
1214                                    "RRM: Expected Measurement Request element, but EID is %u",
1215                                    req->eid);
1216                         goto out;
1217                 }
1218
1219                 if (req->len < 3) {
1220                         wpa_printf(MSG_DEBUG, "RRM: Element length too short");
1221                         goto out;
1222                 }
1223
1224                 if (req->len > len - 2) {
1225                         wpa_printf(MSG_DEBUG, "RRM: Element length too long");
1226                         goto out;
1227                 }
1228
1229                 res = wpas_rrm_handle_msr_req_element(wpa_s, req, &buf);
1230                 if (res < 0)
1231                         goto out;
1232
1233                 pos += req->len + 2;
1234                 len -= req->len + 2;
1235         }
1236
1237         return buf;
1238
1239 out:
1240         wpabuf_free(buf);
1241         return NULL;
1242 }
1243
1244
1245 void wpas_rrm_handle_radio_measurement_request(struct wpa_supplicant *wpa_s,
1246                                                const u8 *src, const u8 *dst,
1247                                                const u8 *frame, size_t len)
1248 {
1249         struct wpabuf *report;
1250
1251         if (wpa_s->wpa_state != WPA_COMPLETED) {
1252                 wpa_printf(MSG_INFO,
1253                            "RRM: Ignoring radio measurement request: Not associated");
1254                 return;
1255         }
1256
1257         if (!wpa_s->rrm.rrm_used) {
1258                 wpa_printf(MSG_INFO,
1259                            "RRM: Ignoring radio measurement request: Not RRM network");
1260                 return;
1261         }
1262
1263         if (len < 3) {
1264                 wpa_printf(MSG_INFO,
1265                            "RRM: Ignoring too short radio measurement request");
1266                 return;
1267         }
1268
1269         wpa_s->rrm.token = *frame;
1270         os_memcpy(wpa_s->rrm.dst_addr, dst, ETH_ALEN);
1271
1272         /* Number of repetitions is not supported */
1273
1274         report = wpas_rrm_process_msr_req_elems(wpa_s, frame + 3, len - 3);
1275         if (!report)
1276                 return;
1277
1278         wpas_rrm_send_msr_report(wpa_s, report);
1279         wpabuf_free(report);
1280 }
1281
1282
1283 void wpas_rrm_handle_link_measurement_request(struct wpa_supplicant *wpa_s,
1284                                               const u8 *src,
1285                                               const u8 *frame, size_t len,
1286                                               int rssi)
1287 {
1288         struct wpabuf *buf;
1289         const struct rrm_link_measurement_request *req;
1290         struct rrm_link_measurement_report report;
1291
1292         if (wpa_s->wpa_state != WPA_COMPLETED) {
1293                 wpa_printf(MSG_INFO,
1294                            "RRM: Ignoring link measurement request. Not associated");
1295                 return;
1296         }
1297
1298         if (!wpa_s->rrm.rrm_used) {
1299                 wpa_printf(MSG_INFO,
1300                            "RRM: Ignoring link measurement request. Not RRM network");
1301                 return;
1302         }
1303
1304         if (!(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION)) {
1305                 wpa_printf(MSG_INFO,
1306                            "RRM: Measurement report failed. TX power insertion not supported");
1307                 return;
1308         }
1309
1310         req = (const struct rrm_link_measurement_request *) frame;
1311         if (len < sizeof(*req)) {
1312                 wpa_printf(MSG_INFO,
1313                            "RRM: Link measurement report failed. Request too short");
1314                 return;
1315         }
1316
1317         os_memset(&report, 0, sizeof(report));
1318         report.dialog_token = req->dialog_token;
1319         report.tpc.eid = WLAN_EID_TPC_REPORT;
1320         report.tpc.len = 2;
1321         /* Note: The driver is expected to update report.tpc.tx_power and
1322          * report.tpc.link_margin subfields when sending out this frame.
1323          * Similarly, the driver would need to update report.rx_ant_id and
1324          * report.tx_ant_id subfields. */
1325         report.rsni = 255; /* 255 indicates that RSNI is not available */
1326         report.rcpi = rssi_to_rcpi(rssi);
1327
1328         /* action_category + action_code */
1329         buf = wpabuf_alloc(2 + sizeof(report));
1330         if (buf == NULL) {
1331                 wpa_printf(MSG_ERROR,
1332                            "RRM: Link measurement report failed. Buffer allocation failed");
1333                 return;
1334         }
1335
1336         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
1337         wpabuf_put_u8(buf, WLAN_RRM_LINK_MEASUREMENT_REPORT);
1338         wpabuf_put_data(buf, &report, sizeof(report));
1339         wpa_hexdump_buf(MSG_DEBUG, "RRM: Link measurement report", buf);
1340
1341         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, src,
1342                                 wpa_s->own_addr, wpa_s->bssid,
1343                                 wpabuf_head(buf), wpabuf_len(buf), 0)) {
1344                 wpa_printf(MSG_ERROR,
1345                            "RRM: Link measurement report failed. Send action failed");
1346         }
1347         wpabuf_free(buf);
1348 }
1349
1350
1351 int wpas_beacon_rep_scan_process(struct wpa_supplicant *wpa_s,
1352                                  struct wpa_scan_results *scan_res,
1353                                  struct scan_info *info)
1354 {
1355         size_t i = 0;
1356         struct wpabuf *buf = NULL;
1357
1358         if (!wpa_s->beacon_rep_data.token)
1359                 return 0;
1360
1361         if (!wpa_s->current_bss)
1362                 goto out;
1363
1364         /* If the measurement was aborted, don't report partial results */
1365         if (info->aborted)
1366                 goto out;
1367
1368         wpa_printf(MSG_DEBUG, "RRM: TSF BSSID: " MACSTR " current BSS: " MACSTR,
1369                    MAC2STR(info->scan_start_tsf_bssid),
1370                    MAC2STR(wpa_s->current_bss->bssid));
1371         if ((wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_SUPPORT_BEACON_REPORT) &&
1372             os_memcmp(info->scan_start_tsf_bssid, wpa_s->current_bss->bssid,
1373                       ETH_ALEN) != 0) {
1374                 wpa_printf(MSG_DEBUG,
1375                            "RRM: Ignore scan results due to mismatching TSF BSSID");
1376                 goto out;
1377         }
1378
1379         for (i = 0; i < scan_res->num; i++) {
1380                 struct wpa_bss *bss =
1381                         wpa_bss_get_bssid(wpa_s, scan_res->res[i]->bssid);
1382
1383                 if (!bss)
1384                         continue;
1385
1386                 if ((wpa_s->drv_rrm_flags &
1387                      WPA_DRIVER_FLAGS_SUPPORT_BEACON_REPORT) &&
1388                     os_memcmp(scan_res->res[i]->tsf_bssid,
1389                               wpa_s->current_bss->bssid, ETH_ALEN) != 0) {
1390                         wpa_printf(MSG_DEBUG,
1391                                    "RRM: Ignore scan result for " MACSTR
1392                                    " due to mismatching TSF BSSID" MACSTR,
1393                                    MAC2STR(scan_res->res[i]->bssid),
1394                                    MAC2STR(scan_res->res[i]->tsf_bssid));
1395                         continue;
1396                 }
1397
1398                 /*
1399                  * Don't report results that were not received during the
1400                  * current measurement.
1401                  */
1402                 if (!(wpa_s->drv_rrm_flags &
1403                       WPA_DRIVER_FLAGS_SUPPORT_BEACON_REPORT)) {
1404                         struct os_reltime update_time, diff;
1405
1406                         /* For now, allow 8 ms older results due to some
1407                          * unknown issue with cfg80211 BSS table updates during
1408                          * a scan with the current BSS.
1409                          * TODO: Fix this more properly to avoid having to have
1410                          * this type of hacks in place. */
1411                         calculate_update_time(&scan_res->fetch_time,
1412                                               scan_res->res[i]->age,
1413                                               &update_time);
1414                         os_reltime_sub(&wpa_s->beacon_rep_scan,
1415                                        &update_time, &diff);
1416                         if (os_reltime_before(&update_time,
1417                                               &wpa_s->beacon_rep_scan) &&
1418                             (diff.sec || diff.usec >= 8000)) {
1419                                 wpa_printf(MSG_DEBUG,
1420                                            "RRM: Ignore scan result for " MACSTR
1421                                            " due to old update (age(ms) %u, calculated age %u.%06u seconds)",
1422                                            MAC2STR(scan_res->res[i]->bssid),
1423                                            scan_res->res[i]->age,
1424                                            (unsigned int) diff.sec,
1425                                            (unsigned int) diff.usec);
1426                                 continue;
1427                         }
1428                 } else if (info->scan_start_tsf >
1429                            scan_res->res[i]->parent_tsf) {
1430                         continue;
1431                 }
1432
1433                 if (wpas_add_beacon_rep(wpa_s, &buf, bss, info->scan_start_tsf,
1434                                         scan_res->res[i]->parent_tsf) < 0)
1435                         break;
1436         }
1437
1438         if (!buf && wpas_beacon_rep_no_results(wpa_s, &buf))
1439                 goto out;
1440
1441         wpa_hexdump_buf(MSG_DEBUG, "RRM: Radio Measurement report", buf);
1442
1443         wpas_rrm_send_msr_report(wpa_s, buf);
1444         wpabuf_free(buf);
1445
1446 out:
1447         wpas_clear_beacon_rep_data(wpa_s);
1448         return 1;
1449 }
1450
1451
1452 void wpas_clear_beacon_rep_data(struct wpa_supplicant *wpa_s)
1453 {
1454         struct beacon_rep_data *data = &wpa_s->beacon_rep_data;
1455
1456         eloop_cancel_timeout(wpas_rrm_scan_timeout, wpa_s, NULL);
1457         bitfield_free(data->eids);
1458         os_free(data->scan_params.freqs);
1459         os_memset(data, 0, sizeof(*data));
1460 }