contrib/wpa/wpa_supplicant/rrm.c

   1 /*
   2  * wpa_supplicant - Radio Measurements
   3  * Copyright (c) 2003-2016, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "includes.h"
  10
  11 #include "utils/common.h"
  12 #include "utils/eloop.h"
  13 #include "common/ieee802_11_common.h"
  14 #include "wpa_supplicant_i.h"
  15 #include "driver_i.h"
  16 #include "bss.h"
  17 #include "scan.h"
  18 #include "p2p_supplicant.h"
  19
  20
  21 static void wpas_rrm_neighbor_rep_timeout_handler(void *data, void *user_ctx)
  22 {
  23         struct rrm_data *rrm = data;
  24
  25         if (!rrm->notify_neighbor_rep) {
  26                 wpa_printf(MSG_ERROR,
  27                            "RRM: Unexpected neighbor report timeout");
  28                 return;
  29         }
  30
  31         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report - NONE");
  32         rrm->notify_neighbor_rep(rrm->neighbor_rep_cb_ctx, NULL);
  33
  34         rrm->notify_neighbor_rep = NULL;
  35         rrm->neighbor_rep_cb_ctx = NULL;
  36 }
  37
  38
  39 /*
  40  * wpas_rrm_reset - Clear and reset all RRM data in wpa_supplicant
  41  * @wpa_s: Pointer to wpa_supplicant
  42  */
  43 void wpas_rrm_reset(struct wpa_supplicant *wpa_s)
  44 {
  45         wpa_s->rrm.rrm_used = 0;
  46
  47         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
  48                              NULL);
  49         if (wpa_s->rrm.notify_neighbor_rep)
  50                 wpas_rrm_neighbor_rep_timeout_handler(&wpa_s->rrm, NULL);
  51         wpa_s->rrm.next_neighbor_rep_token = 1;
  52         wpas_clear_beacon_rep_data(wpa_s);
  53 }
  54
  55
  56 /*
  57  * wpas_rrm_process_neighbor_rep - Handle incoming neighbor report
  58  * @wpa_s: Pointer to wpa_supplicant
  59  * @report: Neighbor report buffer, prefixed by a 1-byte dialog token
  60  * @report_len: Length of neighbor report buffer
  61  */
  62 void wpas_rrm_process_neighbor_rep(struct wpa_supplicant *wpa_s,
  63                                    const u8 *report, size_t report_len)
  64 {
  65         struct wpabuf *neighbor_rep;
  66
  67         wpa_hexdump(MSG_DEBUG, "RRM: New Neighbor Report", report, report_len);
  68         if (report_len < 1)
  69                 return;
  70
  71         if (report[0] != wpa_s->rrm.next_neighbor_rep_token - 1) {
  72                 wpa_printf(MSG_DEBUG,
  73                            "RRM: Discarding neighbor report with token %d (expected %d)",
  74                            report[0], wpa_s->rrm.next_neighbor_rep_token - 1);
  75                 return;
  76         }
  77
  78         eloop_cancel_timeout(wpas_rrm_neighbor_rep_timeout_handler, &wpa_s->rrm,
  79                              NULL);
  80
  81         if (!wpa_s->rrm.notify_neighbor_rep) {
  82                 wpa_printf(MSG_ERROR, "RRM: Unexpected neighbor report");
  83                 return;
  84         }
  85
  86         /* skipping the first byte, which is only an id (dialog token) */
  87         neighbor_rep = wpabuf_alloc(report_len - 1);
  88         if (!neighbor_rep) {
  89                 wpas_rrm_neighbor_rep_timeout_handler(&wpa_s->rrm, NULL);
  90                 return;
  91         }
  92         wpabuf_put_data(neighbor_rep, report + 1, report_len - 1);
  93         wpa_printf(MSG_DEBUG, "RRM: Notifying neighbor report (token = %d)",
  94                    report[0]);
  95         wpa_s->rrm.notify_neighbor_rep(wpa_s->rrm.neighbor_rep_cb_ctx,
  96                                        neighbor_rep);
  97         wpa_s->rrm.notify_neighbor_rep = NULL;
  98         wpa_s->rrm.neighbor_rep_cb_ctx = NULL;
  99 }
 100
 101
 102 #if defined(__CYGWIN__) || defined(CONFIG_NATIVE_WINDOWS)
 103 /* Workaround different, undefined for Windows, error codes used here */
 104 #define ENOTCONN -1
 105 #define EOPNOTSUPP -1
 106 #define ECANCELED -1
 107 #endif
 108
 109 /* Measurement Request element + Location Subject + Maximum Age subelement */
 110 #define MEASURE_REQUEST_LCI_LEN (3 + 1 + 4)
 111 /* Measurement Request element + Location Civic Request */
 112 #define MEASURE_REQUEST_CIVIC_LEN (3 + 5)
 113
 114
 115 /**
 116  * wpas_rrm_send_neighbor_rep_request - Request a neighbor report from our AP
 117  * @wpa_s: Pointer to wpa_supplicant
 118  * @ssid: if not null, this is sent in the request. Otherwise, no SSID IE
 119  *        is sent in the request.
 120  * @lci: if set, neighbor request will include LCI request
 121  * @civic: if set, neighbor request will include civic location request
 122  * @cb: Callback function to be called once the requested report arrives, or
 123  *      timed out after RRM_NEIGHBOR_REPORT_TIMEOUT seconds.
 124  *      In the former case, 'neighbor_rep' is a newly allocated wpabuf, and it's
 125  *      the requester's responsibility to free it.
 126  *      In the latter case NULL will be sent in 'neighbor_rep'.
 127  * @cb_ctx: Context value to send the callback function
 128  * Returns: 0 in case of success, negative error code otherwise
 129  *
 130  * In case there is a previous request which has not been answered yet, the
 131  * new request fails. The caller may retry after RRM_NEIGHBOR_REPORT_TIMEOUT.
 132  * Request must contain a callback function.
 133  */
 134 int wpas_rrm_send_neighbor_rep_request(struct wpa_supplicant *wpa_s,
 135                                        const struct wpa_ssid_value *ssid,
 136                                        int lci, int civic,
 137                                        void (*cb)(void *ctx,
 138                                                   struct wpabuf *neighbor_rep),
 139                                        void *cb_ctx)
 140 {
 141         struct wpabuf *buf;
 142         const u8 *rrm_ie;
 143
 144         if (wpa_s->wpa_state != WPA_COMPLETED || wpa_s->current_ssid == NULL) {
 145                 wpa_printf(MSG_DEBUG, "RRM: No connection, no RRM.");
 146                 return -ENOTCONN;
 147         }
 148
 149         if (!wpa_s->rrm.rrm_used) {
 150                 wpa_printf(MSG_DEBUG, "RRM: No RRM in current connection.");
 151                 return -EOPNOTSUPP;
 152         }
 153
 154         rrm_ie = wpa_bss_get_ie(wpa_s->current_bss,
 155                                 WLAN_EID_RRM_ENABLED_CAPABILITIES);
 156         if (!rrm_ie || !(wpa_s->current_bss->caps & IEEE80211_CAP_RRM) ||
 157             !(rrm_ie[2] & WLAN_RRM_CAPS_NEIGHBOR_REPORT)) {
 158                 wpa_printf(MSG_DEBUG,
 159                            "RRM: No network support for Neighbor Report.");
 160                 return -EOPNOTSUPP;
 161         }
 162
 163         /* Refuse if there's a live request */
 164         if (wpa_s->rrm.notify_neighbor_rep) {
 165                 wpa_printf(MSG_DEBUG,
 166                            "RRM: Currently handling previous Neighbor Report.");
 167                 return -EBUSY;
 168         }
 169
 170         /* 3 = action category + action code + dialog token */
 171         buf = wpabuf_alloc(3 + (ssid ? 2 + ssid->ssid_len : 0) +
 172                            (lci ? 2 + MEASURE_REQUEST_LCI_LEN : 0) +
 173                            (civic ? 2 + MEASURE_REQUEST_CIVIC_LEN : 0));
 174         if (buf == NULL) {
 175                 wpa_printf(MSG_DEBUG,
 176                            "RRM: Failed to allocate Neighbor Report Request");
 177                 return -ENOMEM;
 178         }
 179
 180         wpa_printf(MSG_DEBUG, "RRM: Neighbor report request (for %s), token=%d",
 181                    (ssid ? wpa_ssid_txt(ssid->ssid, ssid->ssid_len) : ""),
 182                    wpa_s->rrm.next_neighbor_rep_token);
 183
 184         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
 185         wpabuf_put_u8(buf, WLAN_RRM_NEIGHBOR_REPORT_REQUEST);
 186         wpabuf_put_u8(buf, wpa_s->rrm.next_neighbor_rep_token);
 187         if (ssid) {
 188                 wpabuf_put_u8(buf, WLAN_EID_SSID);
 189                 wpabuf_put_u8(buf, ssid->ssid_len);
 190                 wpabuf_put_data(buf, ssid->ssid, ssid->ssid_len);
 191         }
 192
 193         if (lci) {
 194                 /* IEEE P802.11-REVmc/D5.0 9.4.2.21 */
 195                 wpabuf_put_u8(buf, WLAN_EID_MEASURE_REQUEST);
 196                 wpabuf_put_u8(buf, MEASURE_REQUEST_LCI_LEN);
 197
 198                 /*
 199                  * Measurement token; nonzero number that is unique among the
 200                  * Measurement Request elements in a particular frame.
 201                  */
 202                 wpabuf_put_u8(buf, 1); /* Measurement Token */
 203
 204                 /*
 205                  * Parallel, Enable, Request, and Report bits are 0, Duration is
 206                  * reserved.
 207                  */
 208                 wpabuf_put_u8(buf, 0); /* Measurement Request Mode */
 209                 wpabuf_put_u8(buf, MEASURE_TYPE_LCI); /* Measurement Type */
 210
 211                 /* IEEE P802.11-REVmc/D5.0 9.4.2.21.10 - LCI request */
 212                 /* Location Subject */
 213                 wpabuf_put_u8(buf, LOCATION_SUBJECT_REMOTE);
 214
 215                 /* Optional Subelements */
 216                 /*
 217                  * IEEE P802.11-REVmc/D5.0 Figure 9-170
 218                  * The Maximum Age subelement is required, otherwise the AP can
 219                  * send only data that was determined after receiving the
 220                  * request. Setting it here to unlimited age.
 221                  */
 222                 wpabuf_put_u8(buf, LCI_REQ_SUBELEM_MAX_AGE);
 223                 wpabuf_put_u8(buf, 2);
 224                 wpabuf_put_le16(buf, 0xffff);
 225         }
 226
 227         if (civic) {
 228                 /* IEEE P802.11-REVmc/D5.0 9.4.2.21 */
 229                 wpabuf_put_u8(buf, WLAN_EID_MEASURE_REQUEST);
 230                 wpabuf_put_u8(buf, MEASURE_REQUEST_CIVIC_LEN);
 231
 232                 /*
 233                  * Measurement token; nonzero number that is unique among the
 234                  * Measurement Request elements in a particular frame.
 235                  */
 236                 wpabuf_put_u8(buf, 2); /* Measurement Token */
 237
 238                 /*
 239                  * Parallel, Enable, Request, and Report bits are 0, Duration is
 240                  * reserved.
 241                  */
 242                 wpabuf_put_u8(buf, 0); /* Measurement Request Mode */
 243                 /* Measurement Type */
 244                 wpabuf_put_u8(buf, MEASURE_TYPE_LOCATION_CIVIC);
 245
 246                 /* IEEE P802.11-REVmc/D5.0 9.4.2.21.14:
 247                  * Location Civic request */
 248                 /* Location Subject */
 249                 wpabuf_put_u8(buf, LOCATION_SUBJECT_REMOTE);
 250                 wpabuf_put_u8(buf, 0); /* Civic Location Type: IETF RFC 4776 */
 251                 /* Location Service Interval Units: Seconds */
 252                 wpabuf_put_u8(buf, 0);
 253                 /* Location Service Interval: 0 - Only one report is requested
 254                  */
 255                 wpabuf_put_le16(buf, 0);
 256                 /* No optional subelements */
 257         }
 258
 259         wpa_s->rrm.next_neighbor_rep_token++;
 260
 261         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
 262                                 wpa_s->own_addr, wpa_s->bssid,
 263                                 wpabuf_head(buf), wpabuf_len(buf), 0) < 0) {
 264                 wpa_printf(MSG_DEBUG,
 265                            "RRM: Failed to send Neighbor Report Request");
 266                 wpabuf_free(buf);
 267                 return -ECANCELED;
 268         }
 269
 270         wpa_s->rrm.neighbor_rep_cb_ctx = cb_ctx;
 271         wpa_s->rrm.notify_neighbor_rep = cb;
 272         eloop_register_timeout(RRM_NEIGHBOR_REPORT_TIMEOUT, 0,
 273                                wpas_rrm_neighbor_rep_timeout_handler,
 274                                &wpa_s->rrm, NULL);
 275
 276         wpabuf_free(buf);
 277         return 0;
 278 }
 279
 280
 281 static int wpas_rrm_report_elem(struct wpabuf **buf, u8 token, u8 mode, u8 type,
 282                                 const u8 *data, size_t data_len)
 283 {
 284         if (wpabuf_resize(buf, 5 + data_len))
 285                 return -1;
 286
 287         wpabuf_put_u8(*buf, WLAN_EID_MEASURE_REPORT);
 288         wpabuf_put_u8(*buf, 3 + data_len);
 289         wpabuf_put_u8(*buf, token);
 290         wpabuf_put_u8(*buf, mode);
 291         wpabuf_put_u8(*buf, type);
 292
 293         if (data_len)
 294                 wpabuf_put_data(*buf, data, data_len);
 295
 296         return 0;
 297 }
 298
 299
 300 static int
 301 wpas_rrm_build_lci_report(struct wpa_supplicant *wpa_s,
 302                           const struct rrm_measurement_request_element *req,
 303                           struct wpabuf **buf)
 304 {
 305         u8 subject;
 306         u16 max_age = 0;
 307         struct os_reltime t, diff;
 308         unsigned long diff_l;
 309         const u8 *subelem;
 310         const u8 *request = req->variable;
 311         size_t len = req->len - 3;
 312
 313         if (len < 1)
 314                 return -1;
 315
 316         if (!wpa_s->lci)
 317                 goto reject;
 318
 319         subject = *request++;
 320         len--;
 321
 322         wpa_printf(MSG_DEBUG, "Measurement request location subject=%u",
 323                    subject);
 324
 325         if (subject != LOCATION_SUBJECT_REMOTE) {
 326                 wpa_printf(MSG_INFO,
 327                            "Not building LCI report - bad location subject");
 328                 return 0;
 329         }
 330
 331         /* Subelements are formatted exactly like elements */
 332         wpa_hexdump(MSG_DEBUG, "LCI request subelements", request, len);
 333         subelem = get_ie(request, len, LCI_REQ_SUBELEM_MAX_AGE);
 334         if (subelem && subelem[1] == 2)
 335                 max_age = WPA_GET_LE16(subelem + 2);
 336
 337         if (os_get_reltime(&t))
 338                 goto reject;
 339
 340         os_reltime_sub(&t, &wpa_s->lci_time, &diff);
 341         /* LCI age is calculated in 10th of a second units. */
 342         diff_l = diff.sec * 10 + diff.usec / 100000;
 343
 344         if (max_age != 0xffff && max_age < diff_l)
 345                 goto reject;
 346
 347         if (wpas_rrm_report_elem(buf, req->token,
 348                                  MEASUREMENT_REPORT_MODE_ACCEPT, req->type,
 349                                  wpabuf_head_u8(wpa_s->lci),
 350                                  wpabuf_len(wpa_s->lci)) < 0) {
 351                 wpa_printf(MSG_DEBUG, "Failed to add LCI report element");
 352                 return -1;
 353         }
 354
 355         return 0;
 356
 357 reject:
 358         if (!is_multicast_ether_addr(wpa_s->rrm.dst_addr) &&
 359             wpas_rrm_report_elem(buf, req->token,
 360                                  MEASUREMENT_REPORT_MODE_REJECT_INCAPABLE,
 361                                  req->type, NULL, 0) < 0) {
 362                 wpa_printf(MSG_DEBUG, "RRM: Failed to add report element");
 363                 return -1;
 364         }
 365
 366         return 0;
 367 }
 368
 369
 370 static void wpas_rrm_send_msr_report_mpdu(struct wpa_supplicant *wpa_s,
 371                                           const u8 *data, size_t len)
 372 {
 373         struct wpabuf *report = wpabuf_alloc(len + 3);
 374
 375         if (!report)
 376                 return;
 377
 378         wpabuf_put_u8(report, WLAN_ACTION_RADIO_MEASUREMENT);
 379         wpabuf_put_u8(report, WLAN_RRM_RADIO_MEASUREMENT_REPORT);
 380         wpabuf_put_u8(report, wpa_s->rrm.token);
 381
 382         wpabuf_put_data(report, data, len);
 383
 384         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
 385                                 wpa_s->own_addr, wpa_s->bssid,
 386                                 wpabuf_head(report), wpabuf_len(report), 0)) {
 387                 wpa_printf(MSG_ERROR,
 388                            "RRM: Radio measurement report failed: Sending Action frame failed");
 389         }
 390
 391         wpabuf_free(report);
 392 }
 393
 394
 395 static int wpas_rrm_beacon_rep_update_last_frame(u8 *pos, size_t len)
 396 {
 397         struct rrm_measurement_report_element *msr_rep;
 398         u8 *end = pos + len;
 399         u8 *msr_rep_end;
 400         struct rrm_measurement_beacon_report *rep = NULL;
 401         u8 *subelem;
 402
 403         /* Find the last beacon report element */
 404         while (end - pos >= (int) sizeof(*msr_rep)) {
 405                 msr_rep = (struct rrm_measurement_report_element *) pos;
 406                 msr_rep_end = pos + msr_rep->len + 2;
 407
 408                 if (msr_rep->eid != WLAN_EID_MEASURE_REPORT ||
 409                     msr_rep_end > end) {
 410                         /* Should not happen. This indicates a bug. */
 411                         wpa_printf(MSG_ERROR,
 412                                    "RRM: non-measurement report element in measurement report frame");
 413                         return -1;
 414                 }
 415
 416                 if (msr_rep->type == MEASURE_TYPE_BEACON)
 417                         rep = (struct rrm_measurement_beacon_report *)
 418                                 msr_rep->variable;
 419
 420                 pos += pos[1] + 2;
 421         }
 422
 423         if (!rep)
 424                 return 0;
 425
 426         subelem = rep->variable;
 427         while (subelem + 2 < msr_rep_end &&
 428                subelem[0] != WLAN_BEACON_REPORT_SUBELEM_LAST_INDICATION)
 429                 subelem += 2 + subelem[1];
 430
 431         if (subelem + 2 < msr_rep_end &&
 432             subelem[0] == WLAN_BEACON_REPORT_SUBELEM_LAST_INDICATION &&
 433             subelem[1] == 1 &&
 434             subelem + BEACON_REPORT_LAST_INDICATION_SUBELEM_LEN <= end)
 435                 subelem[2] = 1;
 436
 437         return 0;
 438 }
 439
 440
 441 static void wpas_rrm_send_msr_report(struct wpa_supplicant *wpa_s,
 442                                      struct wpabuf *buf)
 443 {
 444         int len = wpabuf_len(buf);
 445         u8 *pos = wpabuf_mhead_u8(buf), *next = pos;
 446
 447 #define MPDU_REPORT_LEN (int) (IEEE80211_MAX_MMPDU_SIZE - IEEE80211_HDRLEN - 3)
 448
 449         while (len) {
 450                 int send_len = (len > MPDU_REPORT_LEN) ? next - pos : len;
 451
 452                 if (send_len == len)
 453                         wpas_rrm_beacon_rep_update_last_frame(pos, len);
 454
 455                 if (send_len == len ||
 456                     (send_len + next[1] + 2) > MPDU_REPORT_LEN) {
 457                         wpas_rrm_send_msr_report_mpdu(wpa_s, pos, send_len);
 458                         len -= send_len;
 459                         pos = next;
 460                 }
 461
 462                 if (len)
 463                         next += next[1] + 2;
 464         }
 465 #undef MPDU_REPORT_LEN
 466 }
 467
 468
 469 static int wpas_add_channel(u8 op_class, u8 chan, u8 num_primary_channels,
 470                             int *freqs)
 471 {
 472         size_t i;
 473
 474         for (i = 0; i < num_primary_channels; i++) {
 475                 u8 primary_chan = chan - (2 * num_primary_channels - 2) + i * 4;
 476
 477                 freqs[i] = ieee80211_chan_to_freq(NULL, op_class, primary_chan);
 478                 /* ieee80211_chan_to_freq() is not really meant for this
 479                  * conversion of 20 MHz primary channel numbers for wider VHT
 480                  * channels, so handle those as special cases here for now. */
 481                 if (freqs[i] < 0 &&
 482                     (op_class == 128 || op_class == 129 || op_class == 130))
 483                         freqs[i] = 5000 + 5 * primary_chan;
 484                 if (freqs[i] < 0) {
 485                         wpa_printf(MSG_DEBUG,
 486                                    "Beacon Report: Invalid channel %u",
 487                                    chan);
 488                         return -1;
 489                 }
 490         }
 491
 492         return 0;
 493 }
 494
 495
 496 static int * wpas_add_channels(const struct oper_class_map *op,
 497                                struct hostapd_hw_modes *mode, int active,
 498                                const u8 *channels, const u8 size)
 499 {
 500         int *freqs, *next_freq;
 501         u8 num_primary_channels, i;
 502         u8 num_chans;
 503
 504         num_chans = channels ? size :
 505                 (op->max_chan - op->min_chan) / op->inc + 1;
 506
 507         if (op->bw == BW80 || op->bw == BW80P80)
 508                 num_primary_channels = 4;
 509         else if (op->bw == BW160)
 510                 num_primary_channels = 8;
 511         else
 512                 num_primary_channels = 1;
 513
 514         /* one extra place for the zero-terminator */
 515         freqs = os_calloc(num_chans * num_primary_channels + 1, sizeof(*freqs));
 516         if (!freqs) {
 517                 wpa_printf(MSG_ERROR,
 518                            "Beacon Report: Failed to allocate freqs array");
 519                 return NULL;
 520         }
 521
 522         next_freq = freqs;
 523         for  (i = 0; i < num_chans; i++) {
 524                 u8 chan = channels ? channels[i] : op->min_chan + i * op->inc;
 525                 enum chan_allowed res = verify_channel(mode, chan, op->bw);
 526
 527                 if (res == NOT_ALLOWED || (res == NO_IR && active))
 528                         continue;
 529
 530                 if (wpas_add_channel(op->op_class, chan, num_primary_channels,
 531                                      next_freq) < 0) {
 532                         os_free(freqs);
 533                         return NULL;
 534                 }
 535
 536                 next_freq += num_primary_channels;
 537         }
 538
 539         if (!freqs[0]) {
 540                 os_free(freqs);
 541                 return NULL;
 542         }
 543
 544         return freqs;
 545 }
 546
 547
 548 static int * wpas_op_class_freqs(const struct oper_class_map *op,
 549                                  struct hostapd_hw_modes *mode, int active)
 550 {
 551         u8 channels_80mhz[] = { 42, 58, 106, 122, 138, 155 };
 552         u8 channels_160mhz[] = { 50, 114 };
 553
 554         /*
 555          * When adding all channels in the operating class, 80 + 80 MHz
 556          * operating classes are like 80 MHz channels because we add all valid
 557          * channels anyway.
 558          */
 559         if (op->bw == BW80 || op->bw == BW80P80)
 560                 return wpas_add_channels(op, mode, active, channels_80mhz,
 561                                          ARRAY_SIZE(channels_80mhz));
 562
 563         if (op->bw == BW160)
 564                 return wpas_add_channels(op, mode, active, channels_160mhz,
 565                                          ARRAY_SIZE(channels_160mhz));
 566
 567         return wpas_add_channels(op, mode, active, NULL, 0);
 568 }
 569
 570
 571 static int * wpas_channel_report_freqs(struct wpa_supplicant *wpa_s, int active,
 572                                        const char *country, const u8 *subelems,
 573                                        size_t len)
 574 {
 575         int *freqs = NULL, *new_freqs;
 576         const u8 *end = subelems + len;
 577
 578         while (end - subelems > 2) {
 579                 const struct oper_class_map *op;
 580                 const u8 *ap_chan_elem, *pos;
 581                 u8 left;
 582                 struct hostapd_hw_modes *mode;
 583
 584                 ap_chan_elem = get_ie(subelems, end - subelems,
 585                                       WLAN_BEACON_REQUEST_SUBELEM_AP_CHANNEL);
 586                 if (!ap_chan_elem)
 587                         break;
 588                 pos = ap_chan_elem + 2;
 589                 left = ap_chan_elem[1];
 590                 if (left < 1)
 591                         break;
 592                 subelems = ap_chan_elem + 2 + left;
 593
 594                 op = get_oper_class(country, *pos);
 595                 if (!op) {
 596                         wpa_printf(MSG_DEBUG,
 597                                    "Beacon request: unknown operating class in AP Channel Report subelement %u",
 598                                    *pos);
 599                         goto out;
 600                 }
 601                 pos++;
 602                 left--;
 603
 604                 mode = get_mode(wpa_s->hw.modes, wpa_s->hw.num_modes, op->mode);
 605                 if (!mode)
 606                         continue;
 607
 608                 /*
 609                  * For 80 + 80 MHz operating classes, this AP Channel Report
 610                  * element should be followed by another element specifying
 611                  * the second 80 MHz channel. For now just add this 80 MHz
 612                  * channel, the second 80 MHz channel will be added when the
 613                  * next element is parsed.
 614                  * TODO: Verify that this AP Channel Report element is followed
 615                  * by a corresponding AP Channel Report element as specified in
 616                  * IEEE Std 802.11-2016, 11.11.9.1.
 617                  */
 618                 new_freqs = wpas_add_channels(op, mode, active, pos, left);
 619                 if (new_freqs)
 620                         int_array_concat(&freqs, new_freqs);
 621
 622                 os_free(new_freqs);
 623         }
 624
 625         return freqs;
 626 out:
 627         os_free(freqs);
 628         return NULL;
 629 }
 630
 631
 632 static int * wpas_beacon_request_freqs(struct wpa_supplicant *wpa_s,
 633                                        u8 op_class, u8 chan, int active,
 634                                        const u8 *subelems, size_t len)
 635 {
 636         int *freqs = NULL, *ext_freqs = NULL;
 637         struct hostapd_hw_modes *mode;
 638         const char *country = NULL;
 639         const struct oper_class_map *op;
 640         const u8 *elem;
 641
 642         if (!wpa_s->current_bss)
 643                 return NULL;
 644         elem = wpa_bss_get_ie(wpa_s->current_bss, WLAN_EID_COUNTRY);
 645         if (elem && elem[1] >= 2)
 646                 country = (const char *) (elem + 2);
 647
 648         op = get_oper_class(country, op_class);
 649         if (!op) {
 650                 wpa_printf(MSG_DEBUG,
 651                            "Beacon request: invalid operating class %d",
 652                            op_class);
 653                 return NULL;
 654         }
 655
 656         mode = get_mode(wpa_s->hw.modes, wpa_s->hw.num_modes, op->mode);
 657         if (!mode)
 658                 return NULL;
 659
 660         switch (chan) {
 661         case 0:
 662                 freqs = wpas_op_class_freqs(op, mode, active);
 663                 if (!freqs)
 664                         return NULL;
 665                 break;
 666         case 255:
 667                 /* freqs will be added from AP channel subelements */
 668                 break;
 669         default:
 670                 freqs = wpas_add_channels(op, mode, active, &chan, 1);
 671                 if (!freqs)
 672                         return NULL;
 673                 break;
 674         }
 675
 676         ext_freqs = wpas_channel_report_freqs(wpa_s, active, country, subelems,
 677                                               len);
 678         if (ext_freqs) {
 679                 int_array_concat(&freqs, ext_freqs);
 680                 os_free(ext_freqs);
 681                 int_array_sort_unique(freqs);
 682         }
 683
 684         return freqs;
 685 }
 686
 687
 688 static int wpas_get_op_chan_phy(int freq, const u8 *ies, size_t ies_len,
 689                                 u8 *op_class, u8 *chan, u8 *phy_type)
 690 {
 691         const u8 *ie;
 692         int sec_chan = 0, vht = 0;
 693         struct ieee80211_ht_operation *ht_oper = NULL;
 694         struct ieee80211_vht_operation *vht_oper = NULL;
 695         u8 seg0, seg1;
 696
 697         ie = get_ie(ies, ies_len, WLAN_EID_HT_OPERATION);
 698         if (ie && ie[1] >= sizeof(struct ieee80211_ht_operation)) {
 699                 u8 sec_chan_offset;
 700
 701                 ht_oper = (struct ieee80211_ht_operation *) (ie + 2);
 702                 sec_chan_offset = ht_oper->ht_param &
 703                         HT_INFO_HT_PARAM_SECONDARY_CHNL_OFF_MASK;
 704                 if (sec_chan_offset == HT_INFO_HT_PARAM_SECONDARY_CHNL_ABOVE)
 705                         sec_chan = 1;
 706                 else if (sec_chan_offset ==
 707                          HT_INFO_HT_PARAM_SECONDARY_CHNL_BELOW)
 708                         sec_chan = -1;
 709         }
 710
 711         ie = get_ie(ies, ies_len, WLAN_EID_VHT_OPERATION);
 712         if (ie && ie[1] >= sizeof(struct ieee80211_vht_operation)) {
 713                 vht_oper = (struct ieee80211_vht_operation *) (ie + 2);
 714
 715                 switch (vht_oper->vht_op_info_chwidth) {
 716                 case 1:
 717                         seg0 = vht_oper->vht_op_info_chan_center_freq_seg0_idx;
 718                         seg1 = vht_oper->vht_op_info_chan_center_freq_seg1_idx;
 719                         if (seg1 && abs(seg1 - seg0) == 8)
 720                                 vht = VHT_CHANWIDTH_160MHZ;
 721                         else if (seg1)
 722                                 vht = VHT_CHANWIDTH_80P80MHZ;
 723                         else
 724                                 vht = VHT_CHANWIDTH_80MHZ;
 725                         break;
 726                 case 2:
 727                         vht = VHT_CHANWIDTH_160MHZ;
 728                         break;
 729                 case 3:
 730                         vht = VHT_CHANWIDTH_80P80MHZ;
 731                         break;
 732                 default:
 733                         vht = VHT_CHANWIDTH_USE_HT;
 734                         break;
 735                 }
 736         }
 737
 738         if (ieee80211_freq_to_channel_ext(freq, sec_chan, vht, op_class,
 739                                           chan) == NUM_HOSTAPD_MODES) {
 740                 wpa_printf(MSG_DEBUG,
 741                            "Cannot determine operating class and channel");
 742                 return -1;
 743         }
 744
 745         *phy_type = ieee80211_get_phy_type(freq, ht_oper != NULL,
 746                                            vht_oper != NULL);
 747         if (*phy_type == PHY_TYPE_UNSPECIFIED) {
 748                 wpa_printf(MSG_DEBUG, "Cannot determine phy type");
 749                 return -1;
 750         }
 751
 752         return 0;
 753 }
 754
 755
 756 static int wpas_beacon_rep_add_frame_body(struct bitfield *eids,
 757                                           enum beacon_report_detail detail,
 758                                           struct wpa_bss *bss, u8 *buf,
 759                                           size_t buf_len, u8 **ies_buf,
 760                                           size_t *ie_len, int add_fixed)
 761 {
 762         u8 *ies = *ies_buf;
 763         size_t ies_len = *ie_len;
 764         u8 *pos = buf;
 765         int rem_len;
 766
 767         rem_len = 255 - sizeof(struct rrm_measurement_beacon_report) -
 768                 sizeof(struct rrm_measurement_report_element) - 2 -
 769                 REPORTED_FRAME_BODY_SUBELEM_LEN;
 770
 771         if (detail > BEACON_REPORT_DETAIL_ALL_FIELDS_AND_ELEMENTS) {
 772                 wpa_printf(MSG_DEBUG,
 773                            "Beacon Request: Invalid reporting detail: %d",
 774                            detail);
 775                 return -1;
 776         }
 777
 778         if (detail == BEACON_REPORT_DETAIL_NONE)
 779                 return 0;
 780
 781         /*
 782          * Minimal frame body subelement size: EID(1) + length(1) + TSF(8) +
 783          * beacon interval(2) + capabilities(2) = 14 bytes
 784          */
 785         if (add_fixed && buf_len < 14)
 786                 return -1;
 787
 788         *pos++ = WLAN_BEACON_REPORT_SUBELEM_FRAME_BODY;
 789         /* The length will be filled later */
 790         pos++;
 791
 792         if (add_fixed) {
 793                 WPA_PUT_LE64(pos, bss->tsf);
 794                 pos += sizeof(bss->tsf);
 795                 WPA_PUT_LE16(pos, bss->beacon_int);
 796                 pos += 2;
 797                 WPA_PUT_LE16(pos, bss->caps);
 798                 pos += 2;
 799         }
 800
 801         rem_len -= pos - buf;
 802
 803         /*
 804          * According to IEEE Std 802.11-2016, 9.4.2.22.7, if the reported frame
 805          * body subelement causes the element to exceed the maximum element
 806          * size, the subelement is truncated so that the last IE is a complete
 807          * IE. So even when required to report all IEs, add elements one after
 808          * the other and stop once there is no more room in the measurement
 809          * element.
 810          */
 811         while (ies_len > 2 && 2U + ies[1] <= ies_len && rem_len > 0) {
 812                 if (detail == BEACON_REPORT_DETAIL_ALL_FIELDS_AND_ELEMENTS ||
 813                     (eids && bitfield_is_set(eids, ies[0]))) {
 814                         u8 elen = ies[1];
 815
 816                         if (2 + elen > buf + buf_len - pos ||
 817                             2 + elen > rem_len)
 818                                 break;
 819
 820                         *pos++ = ies[0];
 821                         *pos++ = elen;
 822                         os_memcpy(pos, ies + 2, elen);
 823                         pos += elen;
 824                         rem_len -= 2 + elen;
 825                 }
 826
 827                 ies_len -= 2 + ies[1];
 828                 ies += 2 + ies[1];
 829         }
 830
 831         *ie_len = ies_len;
 832         *ies_buf = ies;
 833
 834         /* Now the length is known */
 835         buf[1] = pos - buf - 2;
 836         return pos - buf;
 837 }
 838
 839
 840 static int wpas_add_beacon_rep_elem(struct beacon_rep_data *data,
 841                                     struct wpa_bss *bss,
 842                                     struct wpabuf **wpa_buf,
 843                                     struct rrm_measurement_beacon_report *rep,
 844                                     u8 **ie, size_t *ie_len, u8 idx)
 845 {
 846         int ret;
 847         u8 *buf, *pos;
 848         u32 subelems_len = REPORTED_FRAME_BODY_SUBELEM_LEN +
 849                 (data->last_indication ?
 850                  BEACON_REPORT_LAST_INDICATION_SUBELEM_LEN : 0);
 851
 852         /* Maximum element length: Beacon Report element + Reported Frame Body
 853          * subelement + all IEs of the reported Beacon frame + Reported Frame
 854          * Body Fragment ID subelement */
 855         buf = os_malloc(sizeof(*rep) + 14 + *ie_len + subelems_len);
 856         if (!buf)
 857                 return -1;
 858
 859         os_memcpy(buf, rep, sizeof(*rep));
 860
 861         ret = wpas_beacon_rep_add_frame_body(data->eids, data->report_detail,
 862                                              bss, buf + sizeof(*rep),
 863                                              14 + *ie_len, ie, ie_len,
 864                                              idx == 0);
 865         if (ret < 0)
 866                 goto out;
 867
 868         pos = buf + ret + sizeof(*rep);
 869         pos[0] = WLAN_BEACON_REPORT_SUBELEM_FRAME_BODY_FRAGMENT_ID;
 870         pos[1] = 2;
 871
 872         /*
 873          * Only one Beacon Report Measurement is supported at a time, so
 874          * the Beacon Report ID can always be set to 1.
 875          */
 876         pos[2] = 1;
 877
 878         /* Fragment ID Number (bits 0..6) and More Frame Body Fragments (bit 7)
 879  */
 880         pos[3] = idx;
 881         if (data->report_detail != BEACON_REPORT_DETAIL_NONE && *ie_len)
 882                 pos[3] |= REPORTED_FRAME_BODY_MORE_FRAGMENTS;
 883         else
 884                 pos[3] &= ~REPORTED_FRAME_BODY_MORE_FRAGMENTS;
 885
 886         pos += REPORTED_FRAME_BODY_SUBELEM_LEN;
 887
 888         if (data->last_indication) {
 889                 pos[0] = WLAN_BEACON_REPORT_SUBELEM_LAST_INDICATION;
 890                 pos[1] = 1;
 891
 892                 /* This field will be updated later if this is the last frame */
 893                 pos[2] = 0;
 894         }
 895
 896         ret = wpas_rrm_report_elem(wpa_buf, data->token,
 897                                    MEASUREMENT_REPORT_MODE_ACCEPT,
 898                                    MEASURE_TYPE_BEACON, buf,
 899                                    ret + sizeof(*rep) + subelems_len);
 900 out:
 901         os_free(buf);
 902         return ret;
 903 }
 904
 905
 906 static int wpas_add_beacon_rep(struct wpa_supplicant *wpa_s,
 907                                struct wpabuf **wpa_buf, struct wpa_bss *bss,
 908                                u64 start, u64 parent_tsf)
 909 {
 910         struct beacon_rep_data *data = &wpa_s->beacon_rep_data;
 911         u8 *ies = (u8 *) (bss + 1);
 912         u8 *pos = ies;
 913         size_t ies_len = bss->ie_len ? bss->ie_len : bss->beacon_ie_len;
 914         struct rrm_measurement_beacon_report rep;
 915         u8 idx = 0;
 916
 917         if (os_memcmp(data->bssid, broadcast_ether_addr, ETH_ALEN) != 0 &&
 918             os_memcmp(data->bssid, bss->bssid, ETH_ALEN) != 0)
 919                 return 0;
 920
 921         if (data->ssid_len &&
 922             (data->ssid_len != bss->ssid_len ||
 923              os_memcmp(data->ssid, bss->ssid, bss->ssid_len) != 0))
 924                 return 0;
 925
 926         if (wpas_get_op_chan_phy(bss->freq, ies, ies_len, &rep.op_class,
 927                                  &rep.channel, &rep.report_info) < 0)
 928                 return 0;
 929
 930         rep.start_time = host_to_le64(start);
 931         rep.duration = host_to_le16(data->scan_params.duration);
 932         rep.rcpi = rssi_to_rcpi(bss->level);
 933         rep.rsni = 255; /* 255 indicates that RSNI is not available */
 934         os_memcpy(rep.bssid, bss->bssid, ETH_ALEN);
 935         rep.antenna_id = 0; /* unknown */
 936         rep.parent_tsf = host_to_le32(parent_tsf);
 937
 938         do {
 939                 int ret;
 940
 941                 ret = wpas_add_beacon_rep_elem(data, bss, wpa_buf, &rep,
 942                                                &pos, &ies_len, idx++);
 943                 if (ret)
 944                         return ret;
 945         } while (data->report_detail != BEACON_REPORT_DETAIL_NONE &&
 946                  ies_len >= 2);
 947
 948         return 0;
 949 }
 950
 951
 952 static int wpas_beacon_rep_no_results(struct wpa_supplicant *wpa_s,
 953                                       struct wpabuf **buf)
 954 {
 955         return wpas_rrm_report_elem(buf, wpa_s->beacon_rep_data.token,
 956                                     MEASUREMENT_REPORT_MODE_ACCEPT,
 957                                     MEASURE_TYPE_BEACON, NULL, 0);
 958 }
 959
 960
 961 static void wpas_beacon_rep_table(struct wpa_supplicant *wpa_s,
 962                                   struct wpabuf **buf)
 963 {
 964         size_t i;
 965
 966         for (i = 0; i < wpa_s->last_scan_res_used; i++) {
 967                 if (wpas_add_beacon_rep(wpa_s, buf, wpa_s->last_scan_res[i],
 968                                         0, 0) < 0)
 969                         break;
 970         }
 971
 972         if (!(*buf))
 973                 wpas_beacon_rep_no_results(wpa_s, buf);
 974
 975         wpa_hexdump_buf(MSG_DEBUG, "RRM: Radio Measurement report", *buf);
 976 }
 977
 978
 979 void wpas_rrm_refuse_request(struct wpa_supplicant *wpa_s)
 980 {
 981         if (!is_multicast_ether_addr(wpa_s->rrm.dst_addr)) {
 982                 struct wpabuf *buf = NULL;
 983
 984                 if (wpas_rrm_report_elem(&buf, wpa_s->beacon_rep_data.token,
 985                                          MEASUREMENT_REPORT_MODE_REJECT_REFUSED,
 986                                          MEASURE_TYPE_BEACON, NULL, 0)) {
 987                         wpa_printf(MSG_ERROR, "RRM: Memory allocation failed");
 988                         wpabuf_free(buf);
 989                         return;
 990                 }
 991
 992                 wpas_rrm_send_msr_report(wpa_s, buf);
 993                 wpabuf_free(buf);
 994         }
 995
 996         wpas_clear_beacon_rep_data(wpa_s);
 997 }
 998
 999
1000 static void wpas_rrm_scan_timeout(void *eloop_ctx, void *timeout_ctx)
1001 {
1002         struct wpa_supplicant *wpa_s = eloop_ctx;
1003         struct wpa_driver_scan_params *params =
1004                 &wpa_s->beacon_rep_data.scan_params;
1005         u16 prev_duration = params->duration;
1006
1007         if (!wpa_s->current_bss)
1008                 return;
1009
1010         if (!(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_SUPPORT_SET_SCAN_DWELL) &&
1011             params->duration) {
1012                 wpa_printf(MSG_DEBUG,
1013                            "RRM: Cannot set scan duration due to missing driver support");
1014                 params->duration = 0;
1015         }
1016         os_get_reltime(&wpa_s->beacon_rep_scan);
1017         if (wpa_s->scanning || wpas_p2p_in_progress(wpa_s) ||
1018             wpa_supplicant_trigger_scan(wpa_s, params))
1019                 wpas_rrm_refuse_request(wpa_s);
1020         params->duration = prev_duration;
1021 }
1022
1023
1024 static int wpas_rm_handle_beacon_req_subelem(struct wpa_supplicant *wpa_s,
1025                                              struct beacon_rep_data *data,
1026                                              u8 sid, u8 slen, const u8 *subelem)
1027 {
1028         u8 report_info, i;
1029
1030         switch (sid) {
1031         case WLAN_BEACON_REQUEST_SUBELEM_SSID:
1032                 if (!slen) {
1033                         wpa_printf(MSG_DEBUG,
1034                                    "SSID subelement with zero length - wildcard SSID");
1035                         break;
1036                 }
1037
1038                 if (slen > SSID_MAX_LEN) {
1039                         wpa_printf(MSG_DEBUG,
1040                                    "Invalid SSID subelement length: %u", slen);
1041                         return -1;
1042                 }
1043
1044                 data->ssid_len = slen;
1045                 os_memcpy(data->ssid, subelem, data->ssid_len);
1046                 break;
1047         case WLAN_BEACON_REQUEST_SUBELEM_INFO:
1048                 if (slen != 2) {
1049                         wpa_printf(MSG_DEBUG,
1050                                    "Invalid reporting information subelement length: %u",
1051                                    slen);
1052                         return -1;
1053                 }
1054
1055                 report_info = subelem[0];
1056                 if (report_info != 0) {
1057                         wpa_printf(MSG_DEBUG,
1058                                    "reporting information=%u is not supported",
1059                                    report_info);
1060                         return 0;
1061                 }
1062                 break;
1063         case WLAN_BEACON_REQUEST_SUBELEM_DETAIL:
1064                 if (slen != 1) {
1065                         wpa_printf(MSG_DEBUG,
1066                                    "Invalid reporting detail subelement length: %u",
1067                                    slen);
1068                         return -1;
1069                 }
1070
1071                 data->report_detail = subelem[0];
1072                 if (data->report_detail >
1073                     BEACON_REPORT_DETAIL_ALL_FIELDS_AND_ELEMENTS) {
1074                         wpa_printf(MSG_DEBUG, "Invalid reporting detail: %u",
1075                                    subelem[0]);
1076                         return -1;
1077                 }
1078
1079                 break;
1080         case WLAN_BEACON_REQUEST_SUBELEM_REQUEST:
1081                 if (data->report_detail !=
1082                     BEACON_REPORT_DETAIL_REQUESTED_ONLY) {
1083                         wpa_printf(MSG_DEBUG,
1084                                    "Beacon request: request subelement is present but report detail is %u",
1085                                    data->report_detail);
1086                         return -1;
1087                 }
1088
1089                 if (!slen) {
1090                         wpa_printf(MSG_DEBUG,
1091                                    "Invalid request subelement length: %u",
1092                                    slen);
1093                         return -1;
1094                 }
1095
1096                 if (data->eids) {
1097                         wpa_printf(MSG_DEBUG,
1098                                    "Beacon Request: Request subelement appears more than once");
1099                         return -1;
1100                 }
1101
1102                 data->eids = bitfield_alloc(255);
1103                 if (!data->eids) {
1104                         wpa_printf(MSG_DEBUG, "Failed to allocate EIDs bitmap");
1105                         return -1;
1106                 }
1107
1108                 for (i = 0; i < slen; i++)
1109                         bitfield_set(data->eids, subelem[i]);
1110                 break;
1111         case WLAN_BEACON_REQUEST_SUBELEM_AP_CHANNEL:
1112                 /* Skip - it will be processed when freqs are added */
1113                 break;
1114         case WLAN_BEACON_REQUEST_SUBELEM_LAST_INDICATION:
1115                 if (slen != 1) {
1116                         wpa_printf(MSG_DEBUG,
1117                                    "Beacon request: Invalid last indication request subelement length: %u",
1118                                    slen);
1119                         return -1;
1120                 }
1121
1122                 data->last_indication = subelem[0];
1123                 break;
1124         default:
1125                 wpa_printf(MSG_DEBUG,
1126                            "Beacon request: Unknown subelement id %u", sid);
1127                 break;
1128         }
1129
1130         return 1;
1131 }
1132
1133
1134 /**
1135  * Returns 0 if the next element can be processed, 1 if some operation was
1136  * triggered, and -1 if processing failed (i.e., the element is in invalid
1137  * format or an internal error occurred).
1138  */
1139 static int
1140 wpas_rm_handle_beacon_req(struct wpa_supplicant *wpa_s,
1141                           u8 elem_token, int duration_mandatory,
1142                           const struct rrm_measurement_beacon_request *req,
1143                           size_t len, struct wpabuf **buf)
1144 {
1145         struct beacon_rep_data *data = &wpa_s->beacon_rep_data;
1146         struct wpa_driver_scan_params *params = &data->scan_params;
1147         const u8 *subelems;
1148         size_t elems_len;
1149         u16 rand_interval;
1150         u32 interval_usec;
1151         u32 _rand;
1152         int ret = 0, res;
1153         u8 reject_mode;
1154
1155         if (len < sizeof(*req))
1156                 return -1;
1157
1158         if (req->mode != BEACON_REPORT_MODE_PASSIVE &&
1159             req->mode != BEACON_REPORT_MODE_ACTIVE &&
1160             req->mode != BEACON_REPORT_MODE_TABLE)
1161                 return 0;
1162
1163         subelems = req->variable;
1164         elems_len = len - sizeof(*req);
1165         rand_interval = le_to_host16(req->rand_interval);
1166
1167         os_free(params->freqs);
1168         os_memset(params, 0, sizeof(*params));
1169
1170         data->token = elem_token;
1171
1172         /* default reporting detail is all fixed length fields and all
1173          * elements */
1174         data->report_detail = BEACON_REPORT_DETAIL_ALL_FIELDS_AND_ELEMENTS;
1175         os_memcpy(data->bssid, req->bssid, ETH_ALEN);
1176
1177         while (elems_len >= 2) {
1178                 if (subelems[1] > elems_len - 2) {
1179                         wpa_printf(MSG_DEBUG,
1180                                    "Beacon Request: Truncated subelement");
1181                         ret = -1;
1182                         goto out;
1183                 }
1184
1185                 res = wpas_rm_handle_beacon_req_subelem(
1186                         wpa_s, data, subelems[0], subelems[1], &subelems[2]);
1187                 if (res < 0) {
1188                         ret = res;
1189                         goto out;
1190                 } else if (!res) {
1191                         reject_mode = MEASUREMENT_REPORT_MODE_REJECT_INCAPABLE;
1192                         goto out_reject;
1193                 }
1194
1195                 elems_len -= 2 + subelems[1];
1196                 subelems += 2 + subelems[1];
1197         }
1198
1199         if (req->mode == BEACON_REPORT_MODE_TABLE) {
1200                 wpas_beacon_rep_table(wpa_s, buf);
1201                 goto out;
1202         }
1203
1204         params->freqs = wpas_beacon_request_freqs(
1205                 wpa_s, req->oper_class, req->channel,
1206                 req->mode == BEACON_REPORT_MODE_ACTIVE,
1207                 req->variable, len - sizeof(*req));
1208         if (!params->freqs) {
1209                 wpa_printf(MSG_DEBUG, "Beacon request: No valid channels");
1210                 reject_mode = MEASUREMENT_REPORT_MODE_REJECT_REFUSED;
1211                 goto out_reject;
1212         }
1213
1214         params->duration = le_to_host16(req->duration);
1215         params->duration_mandatory = duration_mandatory;
1216         if (!params->duration) {
1217                 wpa_printf(MSG_DEBUG, "Beacon request: Duration is 0");
1218                 ret = -1;
1219                 goto out;
1220         }
1221
1222         params->only_new_results = 1;
1223
1224         if (req->mode == BEACON_REPORT_MODE_ACTIVE) {
1225                 params->ssids[params->num_ssids].ssid = data->ssid;
1226                 params->ssids[params->num_ssids++].ssid_len = data->ssid_len;
1227         }
1228
1229         if (os_get_random((u8 *) &_rand, sizeof(_rand)) < 0)
1230                 _rand = os_random();
1231         interval_usec = (_rand % (rand_interval + 1)) * 1024;
1232         eloop_register_timeout(0, interval_usec, wpas_rrm_scan_timeout, wpa_s,
1233                                NULL);
1234         return 1;
1235 out_reject:
1236         if (!is_multicast_ether_addr(wpa_s->rrm.dst_addr) &&
1237             wpas_rrm_report_elem(buf, elem_token, reject_mode,
1238                                  MEASURE_TYPE_BEACON, NULL, 0) < 0) {
1239                 wpa_printf(MSG_DEBUG, "RRM: Failed to add report element");
1240                 ret = -1;
1241         }
1242 out:
1243         wpas_clear_beacon_rep_data(wpa_s);
1244         return ret;
1245 }
1246
1247
1248 static int
1249 wpas_rrm_handle_msr_req_element(
1250         struct wpa_supplicant *wpa_s,
1251         const struct rrm_measurement_request_element *req,
1252         struct wpabuf **buf)
1253 {
1254         int duration_mandatory;
1255
1256         wpa_printf(MSG_DEBUG, "Measurement request type %d token %d",
1257                    req->type, req->token);
1258
1259         if (req->mode & MEASUREMENT_REQUEST_MODE_ENABLE) {
1260                 /* Enable bit is not supported for now */
1261                 wpa_printf(MSG_DEBUG, "RRM: Enable bit not supported, ignore");
1262                 return 0;
1263         }
1264
1265         if ((req->mode & MEASUREMENT_REQUEST_MODE_PARALLEL) &&
1266             req->type > MEASURE_TYPE_RPI_HIST) {
1267                 /* Parallel measurements are not supported for now */
1268                 wpa_printf(MSG_DEBUG,
1269                            "RRM: Parallel measurements are not supported, reject");
1270                 goto reject;
1271         }
1272
1273         duration_mandatory =
1274                 !!(req->mode & MEASUREMENT_REQUEST_MODE_DURATION_MANDATORY);
1275
1276         switch (req->type) {
1277         case MEASURE_TYPE_LCI:
1278                 return wpas_rrm_build_lci_report(wpa_s, req, buf);
1279         case MEASURE_TYPE_BEACON:
1280                 if (duration_mandatory &&
1281                     !(wpa_s->drv_rrm_flags &
1282                       WPA_DRIVER_FLAGS_SUPPORT_SET_SCAN_DWELL)) {
1283                         wpa_printf(MSG_DEBUG,
1284                                    "RRM: Driver does not support dwell time configuration - reject beacon report with mandatory duration");
1285                         goto reject;
1286                 }
1287                 return wpas_rm_handle_beacon_req(wpa_s, req->token,
1288                                                  duration_mandatory,
1289                                                  (const void *) req->variable,
1290                                                  req->len - 3, buf);
1291         default:
1292                 wpa_printf(MSG_INFO,
1293                            "RRM: Unsupported radio measurement type %u",
1294                            req->type);
1295                 break;
1296         }
1297
1298 reject:
1299         if (!is_multicast_ether_addr(wpa_s->rrm.dst_addr) &&
1300             wpas_rrm_report_elem(buf, req->token,
1301                                  MEASUREMENT_REPORT_MODE_REJECT_INCAPABLE,
1302                                  req->type, NULL, 0) < 0) {
1303                 wpa_printf(MSG_DEBUG, "RRM: Failed to add report element");
1304                 return -1;
1305         }
1306
1307         return 0;
1308 }
1309
1310
1311 static struct wpabuf *
1312 wpas_rrm_process_msr_req_elems(struct wpa_supplicant *wpa_s, const u8 *pos,
1313                                size_t len)
1314 {
1315         struct wpabuf *buf = NULL;
1316
1317         while (len) {
1318                 const struct rrm_measurement_request_element *req;
1319                 int res;
1320
1321                 if (len < 2) {
1322                         wpa_printf(MSG_DEBUG, "RRM: Truncated element");
1323                         goto out;
1324                 }
1325
1326                 req = (const struct rrm_measurement_request_element *) pos;
1327                 if (req->eid != WLAN_EID_MEASURE_REQUEST) {
1328                         wpa_printf(MSG_DEBUG,
1329                                    "RRM: Expected Measurement Request element, but EID is %u",
1330                                    req->eid);
1331                         goto out;
1332                 }
1333
1334                 if (req->len < 3) {
1335                         wpa_printf(MSG_DEBUG, "RRM: Element length too short");
1336                         goto out;
1337                 }
1338
1339                 if (req->len > len - 2) {
1340                         wpa_printf(MSG_DEBUG, "RRM: Element length too long");
1341                         goto out;
1342                 }
1343
1344                 res = wpas_rrm_handle_msr_req_element(wpa_s, req, &buf);
1345                 if (res < 0)
1346                         goto out;
1347
1348                 pos += req->len + 2;
1349                 len -= req->len + 2;
1350         }
1351
1352         return buf;
1353
1354 out:
1355         wpabuf_free(buf);
1356         return NULL;
1357 }
1358
1359
1360 void wpas_rrm_handle_radio_measurement_request(struct wpa_supplicant *wpa_s,
1361                                                const u8 *src, const u8 *dst,
1362                                                const u8 *frame, size_t len)
1363 {
1364         struct wpabuf *report;
1365
1366         if (wpa_s->wpa_state != WPA_COMPLETED) {
1367                 wpa_printf(MSG_INFO,
1368                            "RRM: Ignoring radio measurement request: Not associated");
1369                 return;
1370         }
1371
1372         if (!wpa_s->rrm.rrm_used) {
1373                 wpa_printf(MSG_INFO,
1374                            "RRM: Ignoring radio measurement request: Not RRM network");
1375                 return;
1376         }
1377
1378         if (len < 3) {
1379                 wpa_printf(MSG_INFO,
1380                            "RRM: Ignoring too short radio measurement request");
1381                 return;
1382         }
1383
1384         wpa_s->rrm.token = *frame;
1385         os_memcpy(wpa_s->rrm.dst_addr, dst, ETH_ALEN);
1386
1387         /* Number of repetitions is not supported */
1388
1389         report = wpas_rrm_process_msr_req_elems(wpa_s, frame + 3, len - 3);
1390         if (!report)
1391                 return;
1392
1393         wpas_rrm_send_msr_report(wpa_s, report);
1394         wpabuf_free(report);
1395 }
1396
1397
1398 void wpas_rrm_handle_link_measurement_request(struct wpa_supplicant *wpa_s,
1399                                               const u8 *src,
1400                                               const u8 *frame, size_t len,
1401                                               int rssi)
1402 {
1403         struct wpabuf *buf;
1404         const struct rrm_link_measurement_request *req;
1405         struct rrm_link_measurement_report report;
1406
1407         if (wpa_s->wpa_state != WPA_COMPLETED) {
1408                 wpa_printf(MSG_INFO,
1409                            "RRM: Ignoring link measurement request. Not associated");
1410                 return;
1411         }
1412
1413         if (!wpa_s->rrm.rrm_used) {
1414                 wpa_printf(MSG_INFO,
1415                            "RRM: Ignoring link measurement request. Not RRM network");
1416                 return;
1417         }
1418
1419         if (!(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION)) {
1420                 wpa_printf(MSG_INFO,
1421                            "RRM: Measurement report failed. TX power insertion not supported");
1422                 return;
1423         }
1424
1425         req = (const struct rrm_link_measurement_request *) frame;
1426         if (len < sizeof(*req)) {
1427                 wpa_printf(MSG_INFO,
1428                            "RRM: Link measurement report failed. Request too short");
1429                 return;
1430         }
1431
1432         os_memset(&report, 0, sizeof(report));
1433         report.dialog_token = req->dialog_token;
1434         report.tpc.eid = WLAN_EID_TPC_REPORT;
1435         report.tpc.len = 2;
1436         /* Note: The driver is expected to update report.tpc.tx_power and
1437          * report.tpc.link_margin subfields when sending out this frame.
1438          * Similarly, the driver would need to update report.rx_ant_id and
1439          * report.tx_ant_id subfields. */
1440         report.rsni = 255; /* 255 indicates that RSNI is not available */
1441         report.rcpi = rssi_to_rcpi(rssi);
1442
1443         /* action_category + action_code */
1444         buf = wpabuf_alloc(2 + sizeof(report));
1445         if (buf == NULL) {
1446                 wpa_printf(MSG_ERROR,
1447                            "RRM: Link measurement report failed. Buffer allocation failed");
1448                 return;
1449         }
1450
1451         wpabuf_put_u8(buf, WLAN_ACTION_RADIO_MEASUREMENT);
1452         wpabuf_put_u8(buf, WLAN_RRM_LINK_MEASUREMENT_REPORT);
1453         wpabuf_put_data(buf, &report, sizeof(report));
1454         wpa_hexdump_buf(MSG_DEBUG, "RRM: Link measurement report", buf);
1455
1456         if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, src,
1457                                 wpa_s->own_addr, wpa_s->bssid,
1458                                 wpabuf_head(buf), wpabuf_len(buf), 0)) {
1459                 wpa_printf(MSG_ERROR,
1460                            "RRM: Link measurement report failed. Send action failed");
1461         }
1462         wpabuf_free(buf);
1463 }
1464
1465
1466 int wpas_beacon_rep_scan_process(struct wpa_supplicant *wpa_s,
1467                                  struct wpa_scan_results *scan_res,
1468                                  struct scan_info *info)
1469 {
1470         size_t i = 0;
1471         struct wpabuf *buf = NULL;
1472
1473         if (!wpa_s->beacon_rep_data.token)
1474                 return 0;
1475
1476         if (!wpa_s->current_bss)
1477                 goto out;
1478
1479         /* If the measurement was aborted, don't report partial results */
1480         if (info->aborted)
1481                 goto out;
1482
1483         wpa_printf(MSG_DEBUG, "RRM: TSF BSSID: " MACSTR " current BSS: " MACSTR,
1484                    MAC2STR(info->scan_start_tsf_bssid),
1485                    MAC2STR(wpa_s->current_bss->bssid));
1486         if ((wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_SUPPORT_BEACON_REPORT) &&
1487             os_memcmp(info->scan_start_tsf_bssid, wpa_s->current_bss->bssid,
1488                       ETH_ALEN) != 0) {
1489                 wpa_printf(MSG_DEBUG,
1490                            "RRM: Ignore scan results due to mismatching TSF BSSID");
1491                 goto out;
1492         }
1493
1494         for (i = 0; i < scan_res->num; i++) {
1495                 struct wpa_bss *bss =
1496                         wpa_bss_get_bssid(wpa_s, scan_res->res[i]->bssid);
1497
1498                 if (!bss)
1499                         continue;
1500
1501                 if ((wpa_s->drv_rrm_flags &
1502                      WPA_DRIVER_FLAGS_SUPPORT_BEACON_REPORT) &&
1503                     os_memcmp(scan_res->res[i]->tsf_bssid,
1504                               wpa_s->current_bss->bssid, ETH_ALEN) != 0) {
1505                         wpa_printf(MSG_DEBUG,
1506                                    "RRM: Ignore scan result for " MACSTR
1507                                    " due to mismatching TSF BSSID" MACSTR,
1508                                    MAC2STR(scan_res->res[i]->bssid),
1509                                    MAC2STR(scan_res->res[i]->tsf_bssid));
1510                         continue;
1511                 }
1512
1513                 /*
1514                  * Don't report results that were not received during the
1515                  * current measurement.
1516                  */
1517                 if (!(wpa_s->drv_rrm_flags &
1518                       WPA_DRIVER_FLAGS_SUPPORT_BEACON_REPORT)) {
1519                         struct os_reltime update_time, diff;
1520
1521                         /* For now, allow 8 ms older results due to some
1522                          * unknown issue with cfg80211 BSS table updates during
1523                          * a scan with the current BSS.
1524                          * TODO: Fix this more properly to avoid having to have
1525                          * this type of hacks in place. */
1526                         calculate_update_time(&scan_res->fetch_time,
1527                                               scan_res->res[i]->age,
1528                                               &update_time);
1529                         os_reltime_sub(&wpa_s->beacon_rep_scan,
1530                                        &update_time, &diff);
1531                         if (os_reltime_before(&update_time,
1532                                               &wpa_s->beacon_rep_scan) &&
1533                             (diff.sec || diff.usec >= 8000)) {
1534                                 wpa_printf(MSG_DEBUG,
1535                                            "RRM: Ignore scan result for " MACSTR
1536                                            " due to old update (age(ms) %u, calculated age %u.%06u seconds)",
1537                                            MAC2STR(scan_res->res[i]->bssid),
1538                                            scan_res->res[i]->age,
1539                                            (unsigned int) diff.sec,
1540                                            (unsigned int) diff.usec);
1541                                 continue;
1542                         }
1543                 } else if (info->scan_start_tsf >
1544                            scan_res->res[i]->parent_tsf) {
1545                         continue;
1546                 }
1547
1548                 if (wpas_add_beacon_rep(wpa_s, &buf, bss, info->scan_start_tsf,
1549                                         scan_res->res[i]->parent_tsf) < 0)
1550                         break;
1551         }
1552
1553         if (!buf && wpas_beacon_rep_no_results(wpa_s, &buf))
1554                 goto out;
1555
1556         wpa_hexdump_buf(MSG_DEBUG, "RRM: Radio Measurement report", buf);
1557
1558         wpas_rrm_send_msr_report(wpa_s, buf);
1559         wpabuf_free(buf);
1560
1561 out:
1562         wpas_clear_beacon_rep_data(wpa_s);
1563         return 1;
1564 }
1565
1566
1567 void wpas_clear_beacon_rep_data(struct wpa_supplicant *wpa_s)
1568 {
1569         struct beacon_rep_data *data = &wpa_s->beacon_rep_data;
1570
1571         eloop_cancel_timeout(wpas_rrm_scan_timeout, wpa_s, NULL);
1572         bitfield_free(data->eids);
1573         os_free(data->scan_params.freqs);
1574         os_memset(data, 0, sizeof(*data));
1575 }