Add Beacon configuration for wpa_supplicant AP mode
[wpasupplicant] / src / drivers / driver_nl80211.c
index a207363..74749e8 100644 (file)
 #include <netlink/genl/genl.h>
 #include <netlink/genl/family.h>
 #include <netlink/genl/ctrl.h>
-#include <linux/nl80211.h>
-#ifdef CONFIG_CLIENT_MLME
-#include <netpacket/packet.h>
-#include <linux/if_ether.h>
-#include "radiotap.h"
-#include "radiotap_iter.h"
-#endif /* CONFIG_CLIENT_MLME */
-
+#include "nl80211_copy.h"
 #include "wireless_copy.h"
+
 #include "common.h"
 #include "driver.h"
 #include "eloop.h"
 
 struct wpa_driver_nl80211_data {
        void *ctx;
-       int event_sock;
+       int link_event_sock;
        int ioctl_sock;
        char ifname[IFNAMSIZ + 1];
        int ifindex;
        int if_removed;
-       u8 *assoc_req_ies;
-       size_t assoc_req_ies_len;
-       u8 *assoc_resp_ies;
-       size_t assoc_resp_ies_len;
        struct wpa_driver_capa capa;
        int has_capability;
-       int we_version_compiled;
-
-       /* for set_auth_alg fallback */
-       int use_crypt;
-       int auth_alg_fallback;
 
        int operstate;
 
-       char mlmedev[IFNAMSIZ + 1];
-
        int scan_complete_events;
 
        struct nl_handle *nl_handle;
@@ -77,22 +60,146 @@ struct wpa_driver_nl80211_data {
        struct nl_cb *nl_cb;
        struct genl_family *nl80211;
 
-#ifdef CONFIG_CLIENT_MLME
-       int monitor_sock; /* socket for monitor */
-       int monitor_ifidx;
-#endif /* CONFIG_CLIENT_MLME */
+       u8 bssid[ETH_ALEN];
+       int associated;
+       u8 ssid[32];
+       size_t ssid_len;
+
+#ifdef CONFIG_AP
+       int beacon_int;
+       unsigned int beacon_set:1;
+#endif /* CONFIG_AP */
 };
 
 
 static void wpa_driver_nl80211_scan_timeout(void *eloop_ctx,
                                            void *timeout_ctx);
-static int wpa_driver_nl80211_set_mode(void *priv, int mode);
-static int wpa_driver_nl80211_flush_pmkid(void *priv);
-static int wpa_driver_nl80211_get_range(void *priv);
-static void
+static int wpa_driver_nl80211_set_mode(struct wpa_driver_nl80211_data *drv,
+                                      int mode);
+static int
 wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv);
 
 
+/* nl80211 code */
+static int ack_handler(struct nl_msg *msg, void *arg)
+{
+       int *err = arg;
+       *err = 0;
+       return NL_STOP;
+}
+
+static int finish_handler(struct nl_msg *msg, void *arg)
+{
+       int *ret = arg;
+       *ret = 0;
+       return NL_SKIP;
+}
+
+static int error_handler(struct sockaddr_nl *nla, struct nlmsgerr *err,
+                        void *arg)
+{
+       int *ret = arg;
+       *ret = err->error;
+       return NL_SKIP;
+}
+
+static int send_and_recv_msgs(struct wpa_driver_nl80211_data *drv,
+                             struct nl_msg *msg,
+                             int (*valid_handler)(struct nl_msg *, void *),
+                             void *valid_data)
+{
+       struct nl_cb *cb;
+       int err = -ENOMEM;
+
+       cb = nl_cb_clone(drv->nl_cb);
+       if (!cb)
+               goto out;
+
+       err = nl_send_auto_complete(drv->nl_handle, msg);
+       if (err < 0)
+               goto out;
+
+       err = 1;
+
+       nl_cb_err(cb, NL_CB_CUSTOM, error_handler, &err);
+       nl_cb_set(cb, NL_CB_FINISH, NL_CB_CUSTOM, finish_handler, &err);
+       nl_cb_set(cb, NL_CB_ACK, NL_CB_CUSTOM, ack_handler, &err);
+
+       if (valid_handler)
+               nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM,
+                         valid_handler, valid_data);
+
+       while (err > 0)
+               nl_recvmsgs(drv->nl_handle, cb);
+ out:
+       nl_cb_put(cb);
+       nlmsg_free(msg);
+       return err;
+}
+
+
+struct family_data {
+       const char *group;
+       int id;
+};
+
+
+static int family_handler(struct nl_msg *msg, void *arg)
+{
+       struct family_data *res = arg;
+       struct nlattr *tb[CTRL_ATTR_MAX + 1];
+       struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
+       struct nlattr *mcgrp;
+       int i;
+
+       nla_parse(tb, CTRL_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
+                 genlmsg_attrlen(gnlh, 0), NULL);
+       if (!tb[CTRL_ATTR_MCAST_GROUPS])
+               return NL_SKIP;
+
+       nla_for_each_nested(mcgrp, tb[CTRL_ATTR_MCAST_GROUPS], i) {
+               struct nlattr *tb2[CTRL_ATTR_MCAST_GRP_MAX + 1];
+               nla_parse(tb2, CTRL_ATTR_MCAST_GRP_MAX, nla_data(mcgrp),
+                         nla_len(mcgrp), NULL);
+               if (!tb2[CTRL_ATTR_MCAST_GRP_NAME] ||
+                   !tb2[CTRL_ATTR_MCAST_GRP_ID] ||
+                   os_strncmp(nla_data(tb2[CTRL_ATTR_MCAST_GRP_NAME]),
+                              res->group,
+                              nla_len(tb2[CTRL_ATTR_MCAST_GRP_NAME])) != 0)
+                       continue;
+               res->id = nla_get_u32(tb2[CTRL_ATTR_MCAST_GRP_ID]);
+               break;
+       };
+
+       return NL_SKIP;
+}
+
+
+static int nl_get_multicast_id(struct wpa_driver_nl80211_data *drv,
+                              const char *family, const char *group)
+{
+       struct nl_msg *msg;
+       int ret = -1;
+       struct family_data res = { group, -ENOENT };
+
+       msg = nlmsg_alloc();
+       if (!msg)
+               return -ENOMEM;
+       genlmsg_put(msg, 0, 0, genl_ctrl_resolve(drv->nl_handle, "nlctrl"),
+                   0, 0, CTRL_CMD_GETFAMILY, 0);
+       NLA_PUT_STRING(msg, CTRL_ATTR_FAMILY_NAME, family);
+
+       ret = send_and_recv_msgs(drv, msg, family_handler, &res);
+       msg = NULL;
+       if (ret == 0)
+               ret = res.id;
+
+nla_put_failure:
+       nlmsg_free(msg);
+       return ret;
+}
+
+
 static int wpa_driver_nl80211_send_oper_ifla(
        struct wpa_driver_nl80211_data *drv,
        int linkmode, int operstate)
@@ -142,7 +249,7 @@ static int wpa_driver_nl80211_send_oper_ifla(
        wpa_printf(MSG_DEBUG, "WEXT: Operstate: linkmode=%d, operstate=%d",
                   linkmode, operstate);
 
-       ret = send(drv->event_sock, &req, req.hdr.nlmsg_len, 0);
+       ret = send(drv->link_event_sock, &req, req.hdr.nlmsg_len, 0);
        if (ret < 0) {
                wpa_printf(MSG_DEBUG, "WEXT: Sending operstate IFLA failed: "
                           "%s (assume operstate is not supported)",
@@ -180,421 +287,20 @@ static int wpa_driver_nl80211_set_auth_param(
 static int wpa_driver_nl80211_get_bssid(void *priv, u8 *bssid)
 {
        struct wpa_driver_nl80211_data *drv = priv;
-       struct iwreq iwr;
-       int ret = 0;
-
-       os_memset(&iwr, 0, sizeof(iwr));
-       os_strlcpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
-
-       if (ioctl(drv->ioctl_sock, SIOCGIWAP, &iwr) < 0) {
-               perror("ioctl[SIOCGIWAP]");
-               ret = -1;
-       }
-       os_memcpy(bssid, iwr.u.ap_addr.sa_data, ETH_ALEN);
-
-       return ret;
-}
-
-
-static int wpa_driver_nl80211_set_bssid(void *priv, const u8 *bssid)
-{
-       struct wpa_driver_nl80211_data *drv = priv;
-       struct iwreq iwr;
-       int ret = 0;
-
-       os_memset(&iwr, 0, sizeof(iwr));
-       os_strlcpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
-       iwr.u.ap_addr.sa_family = ARPHRD_ETHER;
-       if (bssid)
-               os_memcpy(iwr.u.ap_addr.sa_data, bssid, ETH_ALEN);
-       else
-               os_memset(iwr.u.ap_addr.sa_data, 0, ETH_ALEN);
-
-       if (ioctl(drv->ioctl_sock, SIOCSIWAP, &iwr) < 0) {
-               perror("ioctl[SIOCSIWAP]");
-               ret = -1;
-       }
-
-       return ret;
-}
-
-
-static int wpa_driver_nl80211_get_ssid(void *priv, u8 *ssid)
-{
-       struct wpa_driver_nl80211_data *drv = priv;
-       struct iwreq iwr;
-       int ret = 0;
-
-       os_memset(&iwr, 0, sizeof(iwr));
-       os_strlcpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
-       iwr.u.essid.pointer = (caddr_t) ssid;
-       iwr.u.essid.length = 32;
-
-       if (ioctl(drv->ioctl_sock, SIOCGIWESSID, &iwr) < 0) {
-               perror("ioctl[SIOCGIWESSID]");
-               ret = -1;
-       } else {
-               ret = iwr.u.essid.length;
-               if (ret > 32)
-                       ret = 32;
-               /* Some drivers include nul termination in the SSID, so let's
-                * remove it here before further processing. WE-21 changes this
-                * to explicitly require the length _not_ to include nul
-                * termination. */
-               if (ret > 0 && ssid[ret - 1] == '\0' &&
-                   drv->we_version_compiled < 21)
-                       ret--;
-       }
-
-       return ret;
-}
-
-
-static int wpa_driver_nl80211_set_ssid(void *priv, const u8 *ssid,
-                                      size_t ssid_len)
-{
-       struct wpa_driver_nl80211_data *drv = priv;
-       struct iwreq iwr;
-       int ret = 0;
-       char buf[33];
-
-       if (ssid_len > 32)
-               return -1;
-
-       os_memset(&iwr, 0, sizeof(iwr));
-       os_strlcpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
-       /* flags: 1 = ESSID is active, 0 = not (promiscuous) */
-       iwr.u.essid.flags = (ssid_len != 0);
-       os_memset(buf, 0, sizeof(buf));
-       os_memcpy(buf, ssid, ssid_len);
-       iwr.u.essid.pointer = (caddr_t) buf;
-       if (drv->we_version_compiled < 21) {
-               /* For historic reasons, set SSID length to include one extra
-                * character, C string nul termination, even though SSID is
-                * really an octet string that should not be presented as a C
-                * string. Some Linux drivers decrement the length by one and
-                * can thus end up missing the last octet of the SSID if the
-                * length is not incremented here. WE-21 changes this to
-                * explicitly require the length _not_ to include nul
-                * termination. */
-               if (ssid_len)
-                       ssid_len++;
-       }
-       iwr.u.essid.length = ssid_len;
-
-       if (ioctl(drv->ioctl_sock, SIOCSIWESSID, &iwr) < 0) {
-               perror("ioctl[SIOCSIWESSID]");
-               ret = -1;
-       }
-
-       return ret;
-}
-
-
-static int wpa_driver_nl80211_set_freq(void *priv, int freq)
-{
-       struct wpa_driver_nl80211_data *drv = priv;
-       struct iwreq iwr;
-       int ret = 0;
-
-       os_memset(&iwr, 0, sizeof(iwr));
-       os_strlcpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
-       iwr.u.freq.m = freq * 100000;
-       iwr.u.freq.e = 1;
-
-       if (ioctl(drv->ioctl_sock, SIOCSIWFREQ, &iwr) < 0) {
-               perror("ioctl[SIOCSIWFREQ]");
-               ret = -1;
-       }
-
-       return ret;
-}
-
-
-static void
-wpa_driver_nl80211_event_wireless_custom(void *ctx, char *custom)
-{
-       union wpa_event_data data;
-
-       wpa_printf(MSG_MSGDUMP, "WEXT: Custom wireless event: '%s'",
-                  custom);
-
-       os_memset(&data, 0, sizeof(data));
-       /* Host AP driver */
-       if (os_strncmp(custom, "MLME-MICHAELMICFAILURE.indication", 33) == 0) {
-               data.michael_mic_failure.unicast =
-                       os_strstr(custom, " unicast ") != NULL;
-               /* TODO: parse parameters(?) */
-               wpa_supplicant_event(ctx, EVENT_MICHAEL_MIC_FAILURE, &data);
-       } else if (os_strncmp(custom, "ASSOCINFO(ReqIEs=", 17) == 0) {
-               char *spos;
-               int bytes;
-
-               spos = custom + 17;
-
-               bytes = strspn(spos, "0123456789abcdefABCDEF");
-               if (!bytes || (bytes & 1))
-                       return;
-               bytes /= 2;
-
-               data.assoc_info.req_ies = os_malloc(bytes);
-               if (data.assoc_info.req_ies == NULL)
-                       return;
-
-               data.assoc_info.req_ies_len = bytes;
-               hexstr2bin(spos, data.assoc_info.req_ies, bytes);
-
-               spos += bytes * 2;
-
-               data.assoc_info.resp_ies = NULL;
-               data.assoc_info.resp_ies_len = 0;
-
-               if (os_strncmp(spos, " RespIEs=", 9) == 0) {
-                       spos += 9;
-
-                       bytes = strspn(spos, "0123456789abcdefABCDEF");
-                       if (!bytes || (bytes & 1))
-                               goto done;
-                       bytes /= 2;
-
-                       data.assoc_info.resp_ies = os_malloc(bytes);
-                       if (data.assoc_info.resp_ies == NULL)
-                               goto done;
-
-                       data.assoc_info.resp_ies_len = bytes;
-                       hexstr2bin(spos, data.assoc_info.resp_ies, bytes);
-               }
-
-               wpa_supplicant_event(ctx, EVENT_ASSOCINFO, &data);
-
-       done:
-               os_free(data.assoc_info.resp_ies);
-               os_free(data.assoc_info.req_ies);
-#ifdef CONFIG_PEERKEY
-       } else if (os_strncmp(custom, "STKSTART.request=", 17) == 0) {
-               if (hwaddr_aton(custom + 17, data.stkstart.peer)) {
-                       wpa_printf(MSG_DEBUG, "WEXT: unrecognized "
-                                  "STKSTART.request '%s'", custom + 17);
-                       return;
-               }
-               wpa_supplicant_event(ctx, EVENT_STKSTART, &data);
-#endif /* CONFIG_PEERKEY */
-       }
-}
-
-
-static int wpa_driver_nl80211_event_wireless_michaelmicfailure(
-       void *ctx, const char *ev, size_t len)
-{
-       const struct iw_michaelmicfailure *mic;
-       union wpa_event_data data;
-
-       if (len < sizeof(*mic))
-               return -1;
-
-       mic = (const struct iw_michaelmicfailure *) ev;
-
-       wpa_printf(MSG_DEBUG, "Michael MIC failure wireless event: "
-                  "flags=0x%x src_addr=" MACSTR, mic->flags,
-                  MAC2STR(mic->src_addr.sa_data));
-
-       os_memset(&data, 0, sizeof(data));
-       data.michael_mic_failure.unicast = !(mic->flags & IW_MICFAILURE_GROUP);
-       wpa_supplicant_event(ctx, EVENT_MICHAEL_MIC_FAILURE, &data);
-
-       return 0;
-}
-
-
-static int wpa_driver_nl80211_event_wireless_pmkidcand(
-       struct wpa_driver_nl80211_data *drv, const char *ev, size_t len)
-{
-       const struct iw_pmkid_cand *cand;
-       union wpa_event_data data;
-       const u8 *addr;
-
-       if (len < sizeof(*cand))
-               return -1;
-
-       cand = (const struct iw_pmkid_cand *) ev;
-       addr = (const u8 *) cand->bssid.sa_data;
-
-       wpa_printf(MSG_DEBUG, "PMKID candidate wireless event: "
-                  "flags=0x%x index=%d bssid=" MACSTR, cand->flags,
-                  cand->index, MAC2STR(addr));
-
-       os_memset(&data, 0, sizeof(data));
-       os_memcpy(data.pmkid_candidate.bssid, addr, ETH_ALEN);
-       data.pmkid_candidate.index = cand->index;
-       data.pmkid_candidate.preauth = cand->flags & IW_PMKID_CAND_PREAUTH;
-       wpa_supplicant_event(drv->ctx, EVENT_PMKID_CANDIDATE, &data);
-
-       return 0;
-}
-
-
-static int wpa_driver_nl80211_event_wireless_assocreqie(
-       struct wpa_driver_nl80211_data *drv, const char *ev, int len)
-{
-       if (len < 0)
-               return -1;
-
-       wpa_hexdump(MSG_DEBUG, "AssocReq IE wireless event", (const u8 *) ev,
-                   len);
-       os_free(drv->assoc_req_ies);
-       drv->assoc_req_ies = os_malloc(len);
-       if (drv->assoc_req_ies == NULL) {
-               drv->assoc_req_ies_len = 0;
+       if (!drv->associated)
                return -1;
-       }
-       os_memcpy(drv->assoc_req_ies, ev, len);
-       drv->assoc_req_ies_len = len;
-
+       os_memcpy(bssid, drv->bssid, ETH_ALEN);
        return 0;
 }
 
 
-static int wpa_driver_nl80211_event_wireless_assocrespie(
-       struct wpa_driver_nl80211_data *drv, const char *ev, int len)
+static int wpa_driver_nl80211_get_ssid(void *priv, u8 *ssid)
 {
-       if (len < 0)
-               return -1;
-
-       wpa_hexdump(MSG_DEBUG, "AssocResp IE wireless event", (const u8 *) ev,
-                   len);
-       os_free(drv->assoc_resp_ies);
-       drv->assoc_resp_ies = os_malloc(len);
-       if (drv->assoc_resp_ies == NULL) {
-               drv->assoc_resp_ies_len = 0;
+       struct wpa_driver_nl80211_data *drv = priv;
+       if (!drv->associated)
                return -1;
-       }
-       os_memcpy(drv->assoc_resp_ies, ev, len);
-       drv->assoc_resp_ies_len = len;
-
-       return 0;
-}
-
-
-static void wpa_driver_nl80211_event_assoc_ies(struct wpa_driver_nl80211_data *drv)
-{
-       union wpa_event_data data;
-
-       if (drv->assoc_req_ies == NULL && drv->assoc_resp_ies == NULL)
-               return;
-
-       os_memset(&data, 0, sizeof(data));
-       if (drv->assoc_req_ies) {
-               data.assoc_info.req_ies = drv->assoc_req_ies;
-               drv->assoc_req_ies = NULL;
-               data.assoc_info.req_ies_len = drv->assoc_req_ies_len;
-       }
-       if (drv->assoc_resp_ies) {
-               data.assoc_info.resp_ies = drv->assoc_resp_ies;
-               drv->assoc_resp_ies = NULL;
-               data.assoc_info.resp_ies_len = drv->assoc_resp_ies_len;
-       }
-
-       wpa_supplicant_event(drv->ctx, EVENT_ASSOCINFO, &data);
-
-       os_free(data.assoc_info.req_ies);
-       os_free(data.assoc_info.resp_ies);
-}
-
-
-static void wpa_driver_nl80211_event_wireless(struct wpa_driver_nl80211_data *drv,
-                                          void *ctx, char *data, int len)
-{
-       struct iw_event iwe_buf, *iwe = &iwe_buf;
-       char *pos, *end, *custom, *buf;
-
-       pos = data;
-       end = data + len;
-
-       while (pos + IW_EV_LCP_LEN <= end) {
-               /* Event data may be unaligned, so make a local, aligned copy
-                * before processing. */
-               os_memcpy(&iwe_buf, pos, IW_EV_LCP_LEN);
-               wpa_printf(MSG_DEBUG, "Wireless event: cmd=0x%x len=%d",
-                          iwe->cmd, iwe->len);
-               if (iwe->len <= IW_EV_LCP_LEN)
-                       return;
-
-               custom = pos + IW_EV_POINT_LEN;
-               if (drv->we_version_compiled > 18 &&
-                   (iwe->cmd == IWEVMICHAELMICFAILURE ||
-                    iwe->cmd == IWEVCUSTOM ||
-                    iwe->cmd == IWEVASSOCREQIE ||
-                    iwe->cmd == IWEVASSOCRESPIE ||
-                    iwe->cmd == IWEVPMKIDCAND)) {
-                       /* WE-19 removed the pointer from struct iw_point */
-                       char *dpos = (char *) &iwe_buf.u.data.length;
-                       int dlen = dpos - (char *) &iwe_buf;
-                       os_memcpy(dpos, pos + IW_EV_LCP_LEN,
-                                 sizeof(struct iw_event) - dlen);
-               } else {
-                       os_memcpy(&iwe_buf, pos, sizeof(struct iw_event));
-                       custom += IW_EV_POINT_OFF;
-               }
-
-               switch (iwe->cmd) {
-               case SIOCGIWAP:
-                       wpa_printf(MSG_DEBUG, "Wireless event: new AP: "
-                                  MACSTR,
-                                  MAC2STR((u8 *) iwe->u.ap_addr.sa_data));
-                       if (is_zero_ether_addr(
-                                   (const u8 *) iwe->u.ap_addr.sa_data) ||
-                           os_memcmp(iwe->u.ap_addr.sa_data,
-                                     "\x44\x44\x44\x44\x44\x44", ETH_ALEN) ==
-                           0) {
-                               os_free(drv->assoc_req_ies);
-                               drv->assoc_req_ies = NULL;
-                               os_free(drv->assoc_resp_ies);
-                               drv->assoc_resp_ies = NULL;
-                               wpa_supplicant_event(ctx, EVENT_DISASSOC,
-                                                    NULL);
-                       
-                       } else {
-                               wpa_driver_nl80211_event_assoc_ies(drv);
-                               wpa_supplicant_event(ctx, EVENT_ASSOC, NULL);
-                       }
-                       break;
-               case IWEVMICHAELMICFAILURE:
-                       wpa_driver_nl80211_event_wireless_michaelmicfailure(
-                               ctx, custom, iwe->u.data.length);
-                       break;
-               case IWEVCUSTOM:
-                       if (custom + iwe->u.data.length > end)
-                               return;
-                       buf = os_malloc(iwe->u.data.length + 1);
-                       if (buf == NULL)
-                               return;
-                       os_memcpy(buf, custom, iwe->u.data.length);
-                       buf[iwe->u.data.length] = '\0';
-                       wpa_driver_nl80211_event_wireless_custom(ctx, buf);
-                       os_free(buf);
-                       break;
-               case SIOCGIWSCAN:
-                       drv->scan_complete_events = 1;
-                       eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout,
-                                            drv, ctx);
-                       wpa_supplicant_event(ctx, EVENT_SCAN_RESULTS, NULL);
-                       break;
-               case IWEVASSOCREQIE:
-                       wpa_driver_nl80211_event_wireless_assocreqie(
-                               drv, custom, iwe->u.data.length);
-                       break;
-               case IWEVASSOCRESPIE:
-                       wpa_driver_nl80211_event_wireless_assocrespie(
-                               drv, custom, iwe->u.data.length);
-                       break;
-               case IWEVPMKIDCAND:
-                       wpa_driver_nl80211_event_wireless_pmkidcand(
-                               drv, custom, iwe->u.data.length);
-                       break;
-               }
-
-               pos += iwe->len;
-       }
+       os_memcpy(ssid, drv->ssid, drv->ssid_len);
+       return drv->ssid_len;
 }
 
 
@@ -725,11 +431,7 @@ static void wpa_driver_nl80211_event_rtm_newlink(struct wpa_driver_nl80211_data
 
        rta_len = RTA_ALIGN(sizeof(struct rtattr));
        while (RTA_OK(attr, attrlen)) {
-               if (attr->rta_type == IFLA_WIRELESS) {
-                       wpa_driver_nl80211_event_wireless(
-                               drv, ctx, ((char *) attr) + rta_len,
-                               attr->rta_len - rta_len);
-               } else if (attr->rta_type == IFLA_IFNAME) {
+               if (attr->rta_type == IFLA_IFNAME) {
                        wpa_driver_nl80211_event_link(
                                drv, ctx,
                                ((char *) attr) + rta_len,
@@ -774,8 +476,8 @@ static void wpa_driver_nl80211_event_rtm_dellink(struct wpa_driver_nl80211_data
 }
 
 
-static void wpa_driver_nl80211_event_receive(int sock, void *eloop_ctx,
-                                         void *sock_ctx)
+static void wpa_driver_nl80211_event_receive_link(int sock, void *eloop_ctx,
+                                                 void *sock_ctx)
 {
        char buf[8192];
        int left;
@@ -841,32 +543,212 @@ try_again:
 }
 
 
-static int wpa_driver_nl80211_get_ifflags_ifname(struct wpa_driver_nl80211_data *drv,
-                                             const char *ifname, int *flags)
+static int no_seq_check(struct nl_msg *msg, void *arg)
 {
-       struct ifreq ifr;
-
-       os_memset(&ifr, 0, sizeof(ifr));
-       os_strlcpy(ifr.ifr_name, ifname, IFNAMSIZ);
-       if (ioctl(drv->ioctl_sock, SIOCGIFFLAGS, (caddr_t) &ifr) < 0) {
-               perror("ioctl[SIOCGIFFLAGS]");
-               return -1;
-       }
-       *flags = ifr.ifr_flags & 0xffff;
-       return 0;
+       return NL_OK;
 }
 
 
-/**
- * wpa_driver_nl80211_get_ifflags - Get interface flags (SIOCGIFFLAGS)
- * @drv: driver_nl80211 private data
- * @flags: Pointer to returned flags value
- * Returns: 0 on success, -1 on failure
- */
-static int wpa_driver_nl80211_get_ifflags(struct wpa_driver_nl80211_data *drv,
-                                         int *flags)
+static void mlme_event_auth(struct wpa_driver_nl80211_data *drv,
+                           const u8 *frame, size_t len)
 {
-       return wpa_driver_nl80211_get_ifflags_ifname(drv, drv->ifname, flags);
+       const struct ieee80211_mgmt *mgmt;
+       union wpa_event_data event;
+
+       mgmt = (const struct ieee80211_mgmt *) frame;
+       if (len < 24 + sizeof(mgmt->u.auth)) {
+               wpa_printf(MSG_DEBUG, "nl80211: Too short association event "
+                          "frame");
+               return;
+       }
+
+       os_memset(&event, 0, sizeof(event));
+       os_memcpy(event.auth.peer, mgmt->sa, ETH_ALEN);
+       event.auth.auth_type = le_to_host16(mgmt->u.auth.auth_alg);
+       event.auth.status_code = le_to_host16(mgmt->u.auth.status_code);
+       if (len > 24 + sizeof(mgmt->u.auth)) {
+               event.auth.ies = mgmt->u.auth.variable;
+               event.auth.ies_len = len - 24 - sizeof(mgmt->u.auth);
+       }
+
+       wpa_supplicant_event(drv->ctx, EVENT_AUTH, &event);
+}
+
+
+static void mlme_event_assoc(struct wpa_driver_nl80211_data *drv,
+                           const u8 *frame, size_t len)
+{
+       const struct ieee80211_mgmt *mgmt;
+       union wpa_event_data event;
+       u16 status;
+
+       mgmt = (const struct ieee80211_mgmt *) frame;
+       if (len < 24 + sizeof(mgmt->u.assoc_resp)) {
+               wpa_printf(MSG_DEBUG, "nl80211: Too short association event "
+                          "frame");
+               return;
+       }
+
+       status = le_to_host16(mgmt->u.assoc_resp.status_code);
+       if (status != WLAN_STATUS_SUCCESS) {
+               os_memset(&event, 0, sizeof(event));
+               if (len > 24 + sizeof(mgmt->u.assoc_resp)) {
+                       event.assoc_reject.resp_ies =
+                               (u8 *) mgmt->u.assoc_resp.variable;
+                       event.assoc_reject.resp_ies_len =
+                               len - 24 - sizeof(mgmt->u.assoc_resp);
+               }
+               event.assoc_reject.status_code = status;
+
+               wpa_supplicant_event(drv->ctx, EVENT_ASSOC_REJECT, &event);
+               return;
+       }
+
+       drv->associated = 1;
+       os_memcpy(drv->bssid, mgmt->sa, ETH_ALEN);
+
+       os_memset(&event, 0, sizeof(event));
+       if (len > 24 + sizeof(mgmt->u.assoc_resp)) {
+               event.assoc_info.resp_ies = (u8 *) mgmt->u.assoc_resp.variable;
+               event.assoc_info.resp_ies_len =
+                       len - 24 - sizeof(mgmt->u.assoc_resp);
+       }
+
+       wpa_supplicant_event(drv->ctx, EVENT_ASSOC, &event);
+}
+
+
+static void mlme_event(struct wpa_driver_nl80211_data *drv,
+                      enum nl80211_commands cmd, struct nlattr *frame)
+{
+       if (frame == NULL) {
+               wpa_printf(MSG_DEBUG, "nl80211: MLME event %d without frame "
+                          "data", cmd);
+               return;
+       }
+
+       wpa_printf(MSG_DEBUG, "nl80211: MLME event %d", cmd);
+       wpa_hexdump(MSG_MSGDUMP, "nl80211: MLME event frame",
+                   nla_data(frame), nla_len(frame));
+
+       switch (cmd) {
+       case NL80211_CMD_AUTHENTICATE:
+               mlme_event_auth(drv, nla_data(frame), nla_len(frame));
+               break;
+       case NL80211_CMD_ASSOCIATE:
+               mlme_event_assoc(drv, nla_data(frame), nla_len(frame));
+               break;
+       case NL80211_CMD_DEAUTHENTICATE:
+               drv->associated = 0;
+               wpa_supplicant_event(drv->ctx, EVENT_DEAUTH, NULL);
+               break;
+       case NL80211_CMD_DISASSOCIATE:
+               drv->associated = 0;
+               wpa_supplicant_event(drv->ctx, EVENT_DISASSOC, NULL);
+               break;
+       default:
+               break;
+       }
+}
+
+
+static int process_event(struct nl_msg *msg, void *arg)
+{
+       struct wpa_driver_nl80211_data *drv = arg;
+       struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
+       struct nlattr *tb[NL80211_ATTR_MAX + 1];
+
+       nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
+                 genlmsg_attrlen(gnlh, 0), NULL);
+
+       if (tb[NL80211_ATTR_IFINDEX]) {
+               int ifindex = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
+               if (ifindex != drv->ifindex) {
+                       wpa_printf(MSG_DEBUG, "nl80211: Ignored event (cmd=%d)"
+                                  " for foreign interface (ifindex %d)",
+                                  gnlh->cmd, ifindex);
+                       return NL_SKIP;
+               }
+       }
+
+       switch (gnlh->cmd) {
+       case NL80211_CMD_NEW_SCAN_RESULTS:
+               wpa_printf(MSG_DEBUG, "nl80211: New scan results available");
+               drv->scan_complete_events = 1;
+               eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv,
+                                    drv->ctx);
+               wpa_supplicant_event(drv->ctx, EVENT_SCAN_RESULTS, NULL);
+               break;
+       case NL80211_CMD_SCAN_ABORTED:
+               wpa_printf(MSG_DEBUG, "nl80211: Scan aborted");
+               /*
+                * Need to indicate that scan results are available in order
+                * not to make wpa_supplicant stop its scanning.
+                */
+               eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv,
+                                    drv->ctx);
+               wpa_supplicant_event(drv->ctx, EVENT_SCAN_RESULTS, NULL);
+               break;
+       case NL80211_CMD_AUTHENTICATE:
+       case NL80211_CMD_ASSOCIATE:
+       case NL80211_CMD_DEAUTHENTICATE:
+       case NL80211_CMD_DISASSOCIATE:
+               mlme_event(drv, gnlh->cmd, tb[NL80211_ATTR_FRAME]);
+               break;
+       default:
+               wpa_printf(MSG_DEBUG, "nl80211: Ignored unknown event "
+                          "(cmd=%d)", gnlh->cmd);
+               break;
+       }
+
+       return NL_SKIP;
+}
+
+
+static void wpa_driver_nl80211_event_receive(int sock, void *eloop_ctx,
+                                            void *sock_ctx)
+{
+       struct nl_cb *cb;
+       struct wpa_driver_nl80211_data *drv = eloop_ctx;
+
+       wpa_printf(MSG_DEBUG, "nl80211: Event message available");
+
+       cb = nl_cb_clone(drv->nl_cb);
+       if (!cb)
+               return;
+       nl_cb_set(cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM, no_seq_check, NULL);
+       nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM, process_event, drv);
+       nl_recvmsgs(drv->nl_handle, cb);
+       nl_cb_put(cb);
+}
+
+
+static int wpa_driver_nl80211_get_ifflags_ifname(struct wpa_driver_nl80211_data *drv,
+                                             const char *ifname, int *flags)
+{
+       struct ifreq ifr;
+
+       os_memset(&ifr, 0, sizeof(ifr));
+       os_strlcpy(ifr.ifr_name, ifname, IFNAMSIZ);
+       if (ioctl(drv->ioctl_sock, SIOCGIFFLAGS, (caddr_t) &ifr) < 0) {
+               perror("ioctl[SIOCGIFFLAGS]");
+               return -1;
+       }
+       *flags = ifr.ifr_flags & 0xffff;
+       return 0;
+}
+
+
+/**
+ * wpa_driver_nl80211_get_ifflags - Get interface flags (SIOCGIFFLAGS)
+ * @drv: driver_nl80211 private data
+ * @flags: Pointer to returned flags value
+ * Returns: 0 on success, -1 on failure
+ */
+static int wpa_driver_nl80211_get_ifflags(struct wpa_driver_nl80211_data *drv,
+                                         int *flags)
+{
+       return wpa_driver_nl80211_get_ifflags_ifname(drv, drv->ifname, flags);
 }
 
 
@@ -900,286 +782,132 @@ static int wpa_driver_nl80211_set_ifflags(struct wpa_driver_nl80211_data *drv,
 }
 
 
-#ifdef CONFIG_CLIENT_MLME
-
-static int nl80211_set_vif(struct wpa_driver_nl80211_data *drv,
-                          int drop_unencrypted, int userspace_mlme)
+/**
+ * wpa_driver_nl80211_set_country - ask nl80211 to set the regulatory domain
+ * @priv: driver_nl80211 private data
+ * @alpha2_arg: country to which to switch to
+ * Returns: 0 on success, -1 on failure
+ *
+ * This asks nl80211 to set the regulatory domain for given
+ * country ISO / IEC alpha2.
+ */
+static int wpa_driver_nl80211_set_country(void *priv, const char *alpha2_arg)
 {
-#ifdef NL80211_CMD_SET_VIF
+       struct wpa_driver_nl80211_data *drv = priv;
+       char alpha2[3];
        struct nl_msg *msg;
-       int ret = -1;
 
        msg = nlmsg_alloc();
        if (!msg)
-               goto out;
-
-       genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
-                   NL80211_CMD_SET_VIF, 0);
-
-       if (drop_unencrypted >= 0)
-               NLA_PUT_U8(msg, NL80211_ATTR_VIF_DROP_UNENCRYPTED,
-                          drop_unencrypted);
-       if (userspace_mlme >= 0)
-               NLA_PUT_U8(msg, NL80211_ATTR_VIF_USERSPACE_MLME,
-                          userspace_mlme);
-
-       ret = 0;
+               goto nla_put_failure;
 
-       NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
+       alpha2[0] = alpha2_arg[0];
+       alpha2[1] = alpha2_arg[1];
+       alpha2[2] = '\0';
 
-       if (nl_send_auto_complete(drv->nl_handle, msg) < 0 ||
-           nl_wait_for_ack(drv->nl_handle) < 0) {
-               ret = -1;
-       }
+       genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
+                   0, NL80211_CMD_REQ_SET_REG, 0);
 
+       NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, alpha2);
+       if (send_and_recv_msgs(drv, msg, NULL, NULL))
+               return -EINVAL;
+       return 0;
 nla_put_failure:
-       nlmsg_free(msg);
-
-out:
-       return ret;
-#else /* NL80211_CMD_SET_VIF */
-       return -1;
-#endif /* NL80211_CMD_SET_VIF */
+       return -EINVAL;
 }
 
 
-static int wpa_driver_nl80211_set_userspace_mlme(
-       struct wpa_driver_nl80211_data *drv, int enabled)
-{
-       return nl80211_set_vif(drv, -1, enabled);
-}
+struct wiphy_info_data {
+       int max_scan_ssids;
+       int ap_supported;
+};
 
 
-static void nl80211_remove_iface(struct wpa_driver_nl80211_data *drv,
-                                int ifidx)
+static int wiphy_info_handler(struct nl_msg *msg, void *arg)
 {
-       struct nl_msg *msg;
+       struct nlattr *tb[NL80211_ATTR_MAX + 1];
+       struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
+       struct wiphy_info_data *info = arg;
 
-       msg = nlmsg_alloc();
-       if (!msg)
-               goto nla_put_failure;
+       nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
+                 genlmsg_attrlen(gnlh, 0), NULL);
 
-       genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
-                   0, NL80211_CMD_DEL_INTERFACE, 0);
-       NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifidx);
-       if (nl_send_auto_complete(drv->nl_handle, msg) < 0 ||
-           nl_wait_for_ack(drv->nl_handle) < 0) {
-       nla_put_failure:
-               wpa_printf(MSG_ERROR, "nl80211: Failed to remove interface.");
+       if (tb[NL80211_ATTR_MAX_NUM_SCAN_SSIDS])
+               info->max_scan_ssids =
+                       nla_get_u8(tb[NL80211_ATTR_MAX_NUM_SCAN_SSIDS]);
+
+       if (tb[NL80211_ATTR_SUPPORTED_IFTYPES]) {
+               struct nlattr *nl_mode;
+               int i;
+               nla_for_each_nested(nl_mode,
+                                   tb[NL80211_ATTR_SUPPORTED_IFTYPES], i) {
+                       if (nl_mode->nla_type == NL80211_IFTYPE_AP) {
+                               info->ap_supported = 1;
+                               break;
+                       }
+               }
        }
-       nlmsg_free(msg);
+
+       return NL_SKIP;
 }
 
 
-static int nl80211_create_iface(struct wpa_driver_nl80211_data *drv,
-                               const char *ifname, enum nl80211_iftype iftype)
+static int wpa_driver_nl80211_get_info(struct wpa_driver_nl80211_data *drv,
+                                      struct wiphy_info_data *info)
 {
-       struct nl_msg *msg, *flags = NULL;
-       int ifidx, err;
+       struct nl_msg *msg;
 
+       os_memset(info, 0, sizeof(*info));
        msg = nlmsg_alloc();
        if (!msg)
                return -1;
 
        genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
-                   0, NL80211_CMD_NEW_INTERFACE, 0);
-       NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(drv->ifname));
-       NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, ifname);
-       NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, iftype);
-
-       if (iftype == NL80211_IFTYPE_MONITOR) {
-               flags = nlmsg_alloc();
-               if (!flags)
-                       goto nla_put_failure;
-
-               NLA_PUT_FLAG(flags, NL80211_MNTR_FLAG_COOK_FRAMES);
-
-               err = nla_put_nested(msg, NL80211_ATTR_MNTR_FLAGS, flags);
-
-               nlmsg_free(flags);
-
-               if (err)
-                       goto nla_put_failure;
-       }
+                   0, NL80211_CMD_GET_WIPHY, 0);
 
-       err = nl_send_auto_complete(drv->nl_handle, msg);
-       if (err < 0)
-               wpa_printf(MSG_ERROR, "nl80211: nl_send_auto_complete failed: "
-                          "%d (create_iface)", err);
-       else {
-               err = nl_wait_for_ack(drv->nl_handle);
-               if (err < 0)
-                       wpa_printf(MSG_ERROR, "nl80211: nl_wait_for_ack "
-                                  "failed: %d (create_iface)", err);
-       }
-       if (err < 0) {
- nla_put_failure:
-               wpa_printf(MSG_ERROR, "nl80211: Failed to create interface "
-                          "%s.", ifname);
-               nlmsg_free(msg);
-               return -1;
-       }
+       NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
 
+       if (send_and_recv_msgs(drv, msg, wiphy_info_handler, info) == 0)
+               return 0;
+       msg = NULL;
+nla_put_failure:
        nlmsg_free(msg);
-
-       ifidx = if_nametoindex(ifname);
-       if (ifidx <= 0)
-               return -1;
-
-       return ifidx;
+       return -1;
 }
 
 
-static void handle_monitor_read(int sock, void *eloop_ctx, void *sock_ctx)
+static void wpa_driver_nl80211_capa(struct wpa_driver_nl80211_data *drv)
 {
-       struct wpa_driver_nl80211_data *drv = eloop_ctx;
-       int len;
-       unsigned char buf[3000];
-       struct ieee80211_radiotap_iterator iter;
-       int ret;
-       int injected = 0, failed = 0, rxflags = 0;
-       struct ieee80211_rx_status rx_status;
-
-       len = recv(sock, buf, sizeof(buf), 0);
-       if (len < 0) {
-               perror("recv");
-               return;
-       }
-
-       if (ieee80211_radiotap_iterator_init(&iter, (void *) buf, len)) {
-               wpa_printf(MSG_DEBUG, "nl80211: received invalid radiotap "
-                          "frame");
-               return;
-       }
-
-       os_memset(&rx_status, 0, sizeof(rx_status));
-
-       while (1) {
-               ret = ieee80211_radiotap_iterator_next(&iter);
-               if (ret == -ENOENT)
-                       break;
-               if (ret) {
-                       wpa_printf(MSG_DEBUG, "nl80211: received invalid "
-                                  "radiotap frame (%d)", ret);
-                       return;
-               }
-               switch (iter.this_arg_index) {
-               case IEEE80211_RADIOTAP_FLAGS:
-                       if (*iter.this_arg & IEEE80211_RADIOTAP_F_FCS)
-                               len -= 4;
-                       break;
-               case IEEE80211_RADIOTAP_RX_FLAGS:
-                       rxflags = 1;
-                       break;
-               case IEEE80211_RADIOTAP_TX_FLAGS:
-                       injected = 1;
-                       failed = le_to_host16((*(u16 *) iter.this_arg)) &
-                               IEEE80211_RADIOTAP_F_TX_FAIL;
-                       break;
-               case IEEE80211_RADIOTAP_DATA_RETRIES:
-                       break;
-               case IEEE80211_RADIOTAP_CHANNEL:
-                       /* TODO convert from freq/flags to channel number
-                        * rx_status.channel = XXX;
-                       */
-                       break;
-               case IEEE80211_RADIOTAP_RATE:
-                       break;
-               case IEEE80211_RADIOTAP_DB_ANTSIGNAL:
-                       rx_status.ssi = *iter.this_arg;
-                       break;
-               }
-       }
-
-       if (rxflags && injected)
+       struct wiphy_info_data info;
+       if (wpa_driver_nl80211_get_info(drv, &info))
                return;
+       drv->has_capability = 1;
+       /* For now, assume TKIP, CCMP, WPA, WPA2 are supported */
+       drv->capa.key_mgmt = WPA_DRIVER_CAPA_KEY_MGMT_WPA |
+               WPA_DRIVER_CAPA_KEY_MGMT_WPA_PSK |
+               WPA_DRIVER_CAPA_KEY_MGMT_WPA2 |
+               WPA_DRIVER_CAPA_KEY_MGMT_WPA2_PSK;
+       drv->capa.enc = WPA_DRIVER_CAPA_ENC_WEP40 |
+               WPA_DRIVER_CAPA_ENC_WEP104 |
+               WPA_DRIVER_CAPA_ENC_TKIP |
+               WPA_DRIVER_CAPA_ENC_CCMP;
 
-       if (!injected) {
-               wpa_supplicant_sta_rx(drv->ctx, buf + iter.max_length,
-                                     len - iter.max_length, &rx_status);
-       } else if (failed) {
-               /* TX failure callback */
-       } else {
-               /* TX success (ACK) callback */
-       }
-}
-
-
-static int wpa_driver_nl80211_create_monitor_interface(
-       struct wpa_driver_nl80211_data *drv)
-{
-       char buf[IFNAMSIZ];
-       struct sockaddr_ll ll;
-       int optval, flags;
-       socklen_t optlen;
-
-       os_snprintf(buf, IFNAMSIZ, "mon.%s", drv->ifname);
-       buf[IFNAMSIZ - 1] = '\0';
-
-       drv->monitor_ifidx =
-               nl80211_create_iface(drv, buf, NL80211_IFTYPE_MONITOR);
-
-       if (drv->monitor_ifidx < 0)
-               return -1;
-
-       if (wpa_driver_nl80211_get_ifflags_ifname(drv, buf, &flags) != 0 ||
-           wpa_driver_nl80211_set_ifflags_ifname(drv, buf, flags | IFF_UP) !=
-           0) {
-               wpa_printf(MSG_ERROR, "nl80211: Could not set interface '%s' "
-                          "UP", buf);
-               goto error;
-       }
-
-       os_memset(&ll, 0, sizeof(ll));
-       ll.sll_family = AF_PACKET;
-       ll.sll_ifindex = drv->monitor_ifidx;
-       drv->monitor_sock = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
-       if (drv->monitor_sock < 0) {
-               perror("socket[PF_PACKET,SOCK_RAW]");
-               goto error;
-       }
-
-       if (bind(drv->monitor_sock, (struct sockaddr *) &ll,
-                sizeof(ll)) < 0) {
-               perror("monitor socket bind");
-               goto error;
-       }
-
-       optlen = sizeof(optval);
-       optval = 20;
-       if (setsockopt
-           (drv->monitor_sock, SOL_SOCKET, SO_PRIORITY, &optval, optlen)) {
-               perror("Failed to set socket priority");
-               goto error;
-       }
-
-       if (eloop_register_read_sock(drv->monitor_sock, handle_monitor_read,
-                                    drv, NULL)) {
-               wpa_printf(MSG_ERROR, "nl80211: Could not register monitor "
-                          "read socket");
-               goto error;
-       }
-
-       return 0;
-
- error:
-       nl80211_remove_iface(drv, drv->monitor_ifidx);
-       return -1;
+       drv->capa.max_scan_ssids = info.max_scan_ssids;
+       if (info.ap_supported)
+               drv->capa.flags |= WPA_DRIVER_FLAGS_AP;
 }
 
-#endif /* CONFIG_CLIENT_MLME */
-
 
 /**
- * wpa_driver_nl80211_init - Initialize WE driver interface
+ * wpa_driver_nl80211_init - Initialize nl80211 driver interface
  * @ctx: context to be used when calling wpa_supplicant functions,
  * e.g., wpa_supplicant_event()
  * @ifname: interface name, e.g., wlan0
  * Returns: Pointer to private data, %NULL on failure
  */
-void * wpa_driver_nl80211_init(void *ctx, const char *ifname)
+static void * wpa_driver_nl80211_init(void *ctx, const char *ifname)
 {
-       int s;
+       int s, ret;
        struct sockaddr_nl local;
        struct wpa_driver_nl80211_data *drv;
 
@@ -1223,6 +951,30 @@ void * wpa_driver_nl80211_init(void *ctx, const char *ifname)
                goto err4;
        }
 
+       ret = nl_get_multicast_id(drv, "nl80211", "scan");
+       if (ret >= 0)
+               ret = nl_socket_add_membership(drv->nl_handle, ret);
+       if (ret < 0) {
+               wpa_printf(MSG_ERROR, "nl80211: Could not add multicast "
+                          "membership for scan events: %d (%s)",
+                          ret, strerror(-ret));
+               goto err4;
+       }
+
+       ret = nl_get_multicast_id(drv, "nl80211", "mlme");
+       if (ret >= 0)
+               ret = nl_socket_add_membership(drv->nl_handle, ret);
+       if (ret < 0) {
+               wpa_printf(MSG_ERROR, "nl80211: Could not add multicast "
+                          "membership for mlme events: %d (%s)",
+                          ret, strerror(-ret));
+               goto err4;
+       }
+       drv->capa.flags |= WPA_DRIVER_FLAGS_SME;
+
+       eloop_register_read_sock(nl_socket_get_fd(drv->nl_handle),
+                                wpa_driver_nl80211_event_receive, drv, ctx);
+
        drv->ioctl_sock = socket(PF_INET, SOCK_DGRAM, 0);
        if (drv->ioctl_sock < 0) {
                perror("socket(PF_INET,SOCK_DGRAM)");
@@ -1244,14 +996,18 @@ void * wpa_driver_nl80211_init(void *ctx, const char *ifname)
                goto err6;
        }
 
-       eloop_register_read_sock(s, wpa_driver_nl80211_event_receive, drv,
+       eloop_register_read_sock(s, wpa_driver_nl80211_event_receive_link, drv,
                                 ctx);
-       drv->event_sock = s;
+       drv->link_event_sock = s;
 
-       wpa_driver_nl80211_finish_drv_init(drv);
+       if (wpa_driver_nl80211_finish_drv_init(drv))
+               goto err7;
 
        return drv;
 
+err7:
+       eloop_unregister_read_sock(drv->link_event_sock);
+       close(drv->link_event_sock);
 err6:
        close(drv->ioctl_sock);
 err5:
@@ -1268,92 +1024,67 @@ err1:
 }
 
 
-static void
+static int
 wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv)
 {
        int flags;
 
-       if (wpa_driver_nl80211_get_ifflags(drv, &flags) != 0)
-               printf("Could not get interface '%s' flags\n", drv->ifname);
-       else if (!(flags & IFF_UP)) {
-               if (wpa_driver_nl80211_set_ifflags(drv, flags | IFF_UP) != 0) {
-                       printf("Could not set interface '%s' UP\n",
-                              drv->ifname);
-               } else {
-                       /*
-                        * Wait some time to allow driver to initialize before
-                        * starting configuring the driver. This seems to be
-                        * needed at least some drivers that load firmware etc.
-                        * when the interface is set up.
-                        */
-                       wpa_printf(MSG_DEBUG, "Interface %s set UP - waiting "
-                                  "a second for the driver to complete "
-                                  "initialization", drv->ifname);
-                       sleep(1);
-               }
-       }
-
-       /*
-        * Make sure that the driver does not have any obsolete PMKID entries.
-        */
-       wpa_driver_nl80211_flush_pmkid(drv);
+       drv->ifindex = if_nametoindex(drv->ifname);
 
        if (wpa_driver_nl80211_set_mode(drv, 0) < 0) {
-               printf("Could not configure driver to use managed mode\n");
+               wpa_printf(MSG_DEBUG, "nl80211: Could not configure driver to "
+                          "use managed mode");
        }
 
-       wpa_driver_nl80211_get_range(drv);
+       if (wpa_driver_nl80211_get_ifflags(drv, &flags) != 0) {
+               wpa_printf(MSG_ERROR, "Could not get interface '%s' flags",
+                          drv->ifname);
+               return -1;
+       }
+       if (!(flags & IFF_UP)) {
+               if (wpa_driver_nl80211_set_ifflags(drv, flags | IFF_UP) != 0) {
+                       wpa_printf(MSG_ERROR, "Could not set interface '%s' "
+                                  "UP", drv->ifname);
+                       return -1;
+               }
+       }
 
-       drv->ifindex = if_nametoindex(drv->ifname);
+       wpa_driver_nl80211_capa(drv);
 
        wpa_driver_nl80211_send_oper_ifla(drv, 1, IF_OPER_DORMANT);
+
+       return 0;
 }
 
 
 /**
- * wpa_driver_nl80211_deinit - Deinitialize WE driver interface
- * @priv: Pointer to private wext data from wpa_driver_nl80211_init()
+ * wpa_driver_nl80211_deinit - Deinitialize nl80211 driver interface
+ * @priv: Pointer to private nl80211 data from wpa_driver_nl80211_init()
  *
  * Shut down driver interface and processing of driver events. Free
  * private data buffer if one was allocated in wpa_driver_nl80211_init().
  */
-void wpa_driver_nl80211_deinit(void *priv)
+static void wpa_driver_nl80211_deinit(void *priv)
 {
        struct wpa_driver_nl80211_data *drv = priv;
        int flags;
 
-#ifdef CONFIG_CLIENT_MLME
-       if (drv->monitor_sock >= 0) {
-               eloop_unregister_read_sock(drv->monitor_sock);
-               close(drv->monitor_sock);
-       }
-       if (drv->monitor_ifidx > 0)
-               nl80211_remove_iface(drv, drv->monitor_ifidx);
-       if (drv->capa.flags & WPA_DRIVER_FLAGS_USER_SPACE_MLME)
-               wpa_driver_nl80211_set_userspace_mlme(drv, 0);
-#endif /* CONFIG_CLIENT_MLME */
-
        eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
 
-       /*
-        * Clear possibly configured driver parameters in order to make it
-        * easier to use the driver after wpa_supplicant has been terminated.
-        */
-       (void) wpa_driver_nl80211_set_bssid(drv,
-                                        (u8 *) "\x00\x00\x00\x00\x00\x00");
+       wpa_driver_nl80211_set_auth_param(drv, IW_AUTH_DROP_UNENCRYPTED, 0);
 
        wpa_driver_nl80211_send_oper_ifla(priv, 0, IF_OPER_UP);
 
-       eloop_unregister_read_sock(drv->event_sock);
+       eloop_unregister_read_sock(drv->link_event_sock);
 
        if (wpa_driver_nl80211_get_ifflags(drv, &flags) == 0)
                (void) wpa_driver_nl80211_set_ifflags(drv, flags & ~IFF_UP);
+       wpa_driver_nl80211_set_mode(drv, 0);
 
-       close(drv->event_sock);
+       close(drv->link_event_sock);
        close(drv->ioctl_sock);
-       os_free(drv->assoc_req_ies);
-       os_free(drv->assoc_resp_ies);
 
+       eloop_unregister_read_sock(nl_socket_get_fd(drv->nl_handle));
        genl_family_put(drv->nl80211);
        nl_cache_free(drv->nl_cache);
        nl_handle_destroy(drv->nl_handle);
@@ -1381,568 +1112,197 @@ static void wpa_driver_nl80211_scan_timeout(void *eloop_ctx, void *timeout_ctx)
 /**
  * wpa_driver_nl80211_scan - Request the driver to initiate scan
  * @priv: Pointer to private wext data from wpa_driver_nl80211_init()
- * @ssid: Specific SSID to scan for (ProbeReq) or %NULL to scan for
- *     all SSIDs (either active scan with broadcast SSID or passive
- *     scan
- * @ssid_len: Length of the SSID
+ * @params: Scan parameters
  * Returns: 0 on success, -1 on failure
  */
-static int wpa_driver_nl80211_scan(void *priv, const u8 *ssid, size_t ssid_len)
+static int wpa_driver_nl80211_scan(void *priv,
+                                  struct wpa_driver_scan_params *params)
 {
        struct wpa_driver_nl80211_data *drv = priv;
-       struct iwreq iwr;
        int ret = 0, timeout;
-       struct iw_scan_req req;
+       struct nl_msg *msg, *ssids, *freqs;
+       size_t i;
 
-       if (ssid_len > IW_ESSID_MAX_SIZE) {
-               wpa_printf(MSG_DEBUG, "%s: too long SSID (%lu)",
-                          __FUNCTION__, (unsigned long) ssid_len);
+       msg = nlmsg_alloc();
+       ssids = nlmsg_alloc();
+       freqs = nlmsg_alloc();
+       if (!msg || !ssids || !freqs) {
+               nlmsg_free(msg);
+               nlmsg_free(ssids);
+               nlmsg_free(freqs);
                return -1;
        }
 
-       os_memset(&iwr, 0, sizeof(iwr));
-       os_strlcpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
+       genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
+                   NL80211_CMD_TRIGGER_SCAN, 0);
+
+       NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
+
+       for (i = 0; i < params->num_ssids; i++) {
+               NLA_PUT(ssids, i + 1, params->ssids[i].ssid_len,
+                       params->ssids[i].ssid);
+       }
+       if (params->num_ssids)
+               nla_put_nested(msg, NL80211_ATTR_SCAN_SSIDS, ssids);
+
+       if (params->extra_ies) {
+               NLA_PUT(msg, NL80211_ATTR_IE, params->extra_ies_len,
+                       params->extra_ies);
+       }
 
-       if (ssid && ssid_len) {
-               os_memset(&req, 0, sizeof(req));
-               req.essid_len = ssid_len;
-               req.bssid.sa_family = ARPHRD_ETHER;
-               os_memset(req.bssid.sa_data, 0xff, ETH_ALEN);
-               os_memcpy(req.essid, ssid, ssid_len);
-               iwr.u.data.pointer = (caddr_t) &req;
-               iwr.u.data.length = sizeof(req);
-               iwr.u.data.flags = IW_SCAN_THIS_ESSID;
+       if (params->freqs) {
+               for (i = 0; params->freqs[i]; i++)
+                       NLA_PUT_U32(freqs, i + 1, params->freqs[i]);
+               nla_put_nested(msg, NL80211_ATTR_SCAN_FREQUENCIES, freqs);
        }
 
-       if (ioctl(drv->ioctl_sock, SIOCSIWSCAN, &iwr) < 0) {
-               perror("ioctl[SIOCSIWSCAN]");
-               ret = -1;
+       ret = send_and_recv_msgs(drv, msg, NULL, NULL);
+       msg = NULL;
+       if (ret) {
+               wpa_printf(MSG_DEBUG, "nl80211: Scan trigger failed: ret=%d "
+                          "(%s)", ret, strerror(-ret));
+               goto nla_put_failure;
        }
 
        /* Not all drivers generate "scan completed" wireless event, so try to
         * read results after a timeout. */
-       timeout = 5;
+       timeout = 10;
        if (drv->scan_complete_events) {
                /*
-                * The driver seems to deliver SIOCGIWSCAN events to notify
-                * when scan is complete, so use longer timeout to avoid race
-                * conditions with scanning and following association request.
+                * The driver seems to deliver events to notify when scan is
+                * complete, so use longer timeout to avoid race conditions
+                * with scanning and following association request.
                 */
                timeout = 30;
        }
        wpa_printf(MSG_DEBUG, "Scan requested (ret=%d) - scan timeout %d "
                   "seconds", ret, timeout);
        eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
-       eloop_register_timeout(timeout, 0, wpa_driver_nl80211_scan_timeout, drv,
-                              drv->ctx);
+       eloop_register_timeout(timeout, 0, wpa_driver_nl80211_scan_timeout,
+                              drv, drv->ctx);
 
+nla_put_failure:
+       nlmsg_free(ssids);
+       nlmsg_free(msg);
+       nlmsg_free(freqs);
        return ret;
 }
 
 
-static u8 * wpa_driver_nl80211_giwscan(struct wpa_driver_nl80211_data *drv,
-                                   size_t *len)
+static int bss_info_handler(struct nl_msg *msg, void *arg)
 {
-       struct iwreq iwr;
-       u8 *res_buf;
-       size_t res_buf_len;
-
-       res_buf_len = IW_SCAN_MAX_DATA;
-       for (;;) {
-               res_buf = os_malloc(res_buf_len);
-               if (res_buf == NULL)
-                       return NULL;
-               os_memset(&iwr, 0, sizeof(iwr));
-               os_strlcpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
-               iwr.u.data.pointer = res_buf;
-               iwr.u.data.length = res_buf_len;
-
-               if (ioctl(drv->ioctl_sock, SIOCGIWSCAN, &iwr) == 0)
-                       break;
+       struct nlattr *tb[NL80211_ATTR_MAX + 1];
+       struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
+       struct nlattr *bss[NL80211_BSS_MAX + 1];
+       static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = {
+               [NL80211_BSS_BSSID] = { .type = NLA_UNSPEC },
+               [NL80211_BSS_FREQUENCY] = { .type = NLA_U32 },
+               [NL80211_BSS_TSF] = { .type = NLA_U64 },
+               [NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 },
+               [NL80211_BSS_CAPABILITY] = { .type = NLA_U16 },
+               [NL80211_BSS_INFORMATION_ELEMENTS] = { .type = NLA_UNSPEC },
+               [NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 },
+               [NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 },
+       };
+       struct wpa_scan_results *res = arg;
+       struct wpa_scan_res **tmp;
+       struct wpa_scan_res *r;
+       const u8 *ie;
+       size_t ie_len;
 
-               if (errno == E2BIG && res_buf_len < 100000) {
-                       os_free(res_buf);
-                       res_buf = NULL;
-                       res_buf_len *= 2;
-                       wpa_printf(MSG_DEBUG, "Scan results did not fit - "
-                                  "trying larger buffer (%lu bytes)",
-                                  (unsigned long) res_buf_len);
-               } else {
-                       perror("ioctl[SIOCGIWSCAN]");
-                       os_free(res_buf);
-                       return NULL;
-               }
+       nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
+                 genlmsg_attrlen(gnlh, 0), NULL);
+       if (!tb[NL80211_ATTR_BSS])
+               return NL_SKIP;
+       if (nla_parse_nested(bss, NL80211_BSS_MAX, tb[NL80211_ATTR_BSS],
+                            bss_policy))
+               return NL_SKIP;
+       if (bss[NL80211_BSS_INFORMATION_ELEMENTS]) {
+               ie = nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
+               ie_len = nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
+       } else {
+               ie = NULL;
+               ie_len = 0;
        }
 
-       if (iwr.u.data.length > res_buf_len) {
-               os_free(res_buf);
-               return NULL;
-       }
-       *len = iwr.u.data.length;
-
-       return res_buf;
-}
-
-
-/*
- * Data structure for collecting WEXT scan results. This is needed to allow
- * the various methods of reporting IEs to be combined into a single IE buffer.
- */
-struct wext_scan_data {
-       struct wpa_scan_res res;
-       u8 *ie;
-       size_t ie_len;
-       u8 ssid[32];
-       size_t ssid_len;
-       int maxrate;
-};
-
-
-static void wext_get_scan_mode(struct iw_event *iwe,
-                              struct wext_scan_data *res)
-{
-       if (iwe->u.mode == IW_MODE_ADHOC)
-               res->res.caps |= IEEE80211_CAP_IBSS;
-       else if (iwe->u.mode == IW_MODE_MASTER || iwe->u.mode == IW_MODE_INFRA)
-               res->res.caps |= IEEE80211_CAP_ESS;
-}
-
-
-static void wext_get_scan_ssid(struct iw_event *iwe,
-                              struct wext_scan_data *res, char *custom,
-                              char *end)
-{
-       int ssid_len = iwe->u.essid.length;
-       if (custom + ssid_len > end)
-               return;
-       if (iwe->u.essid.flags &&
-           ssid_len > 0 &&
-           ssid_len <= IW_ESSID_MAX_SIZE) {
-               os_memcpy(res->ssid, custom, ssid_len);
-               res->ssid_len = ssid_len;
-       }
-}
-
-
-static void wext_get_scan_freq(struct iw_event *iwe,
-                              struct wext_scan_data *res)
-{
-       int divi = 1000000, i;
-
-       if (iwe->u.freq.e == 0) {
-               /*
-                * Some drivers do not report frequency, but a channel.
-                * Try to map this to frequency by assuming they are using
-                * IEEE 802.11b/g.  But don't overwrite a previously parsed
-                * frequency if the driver sends both frequency and channel,
-                * since the driver may be sending an A-band channel that we
-                * don't handle here.
-                */
-
-               if (res->res.freq)
-                       return;
-
-               if (iwe->u.freq.m >= 1 && iwe->u.freq.m <= 13) {
-                       res->res.freq = 2407 + 5 * iwe->u.freq.m;
-                       return;
-               } else if (iwe->u.freq.m == 14) {
-                       res->res.freq = 2484;
-                       return;
-               }
-       }
-
-       if (iwe->u.freq.e > 6) {
-               wpa_printf(MSG_DEBUG, "Invalid freq in scan results (BSSID="
-                          MACSTR " m=%d e=%d)",
-                          MAC2STR(res->res.bssid), iwe->u.freq.m,
-                          iwe->u.freq.e);
-               return;
-       }
-
-       for (i = 0; i < iwe->u.freq.e; i++)
-               divi /= 10;
-       res->res.freq = iwe->u.freq.m / divi;
-}
-
-
-static void wext_get_scan_qual(struct iw_event *iwe,
-                              struct wext_scan_data *res)
-{
-       res->res.qual = iwe->u.qual.qual;
-       res->res.noise = iwe->u.qual.noise;
-       res->res.level = iwe->u.qual.level;
-}
-
-
-static void wext_get_scan_encode(struct iw_event *iwe,
-                                struct wext_scan_data *res)
-{
-       if (!(iwe->u.data.flags & IW_ENCODE_DISABLED))
-               res->res.caps |= IEEE80211_CAP_PRIVACY;
-}
-
-
-static void wext_get_scan_rate(struct iw_event *iwe,
-                              struct wext_scan_data *res, char *pos,
-                              char *end)
-{
-       int maxrate;
-       char *custom = pos + IW_EV_LCP_LEN;
-       struct iw_param p;
-       size_t clen;
-
-       clen = iwe->len;
-       if (custom + clen > end)
-               return;
-       maxrate = 0;
-       while (((ssize_t) clen) >= (ssize_t) sizeof(struct iw_param)) {
-               /* Note: may be misaligned, make a local, aligned copy */
-               os_memcpy(&p, custom, sizeof(struct iw_param));
-               if (p.value > maxrate)
-                       maxrate = p.value;
-               clen -= sizeof(struct iw_param);
-               custom += sizeof(struct iw_param);
-       }
-
-       /* Convert the maxrate from WE-style (b/s units) to
-        * 802.11 rates (500000 b/s units).
-        */
-       res->maxrate = maxrate / 500000;
-}
-
-
-static void wext_get_scan_iwevgenie(struct iw_event *iwe,
-                                   struct wext_scan_data *res, char *custom,
-                                   char *end)
-{
-       char *genie, *gpos, *gend;
-       u8 *tmp;
-
-       if (iwe->u.data.length == 0)
-               return;
-
-       gpos = genie = custom;
-       gend = genie + iwe->u.data.length;
-       if (gend > end) {
-               wpa_printf(MSG_INFO, "IWEVGENIE overflow");
-               return;
-       }
-
-       tmp = os_realloc(res->ie, res->ie_len + gend - gpos);
-       if (tmp == NULL)
-               return;
-       os_memcpy(tmp + res->ie_len, gpos, gend - gpos);
-       res->ie = tmp;
-       res->ie_len += gend - gpos;
-}
-
-
-static void wext_get_scan_custom(struct iw_event *iwe,
-                                struct wext_scan_data *res, char *custom,
-                                char *end)
-{
-       size_t clen;
-       u8 *tmp;
-
-       clen = iwe->u.data.length;
-       if (custom + clen > end)
-               return;
-
-       if (clen > 7 && os_strncmp(custom, "wpa_ie=", 7) == 0) {
-               char *spos;
-               int bytes;
-               spos = custom + 7;
-               bytes = custom + clen - spos;
-               if (bytes & 1 || bytes == 0)
-                       return;
-               bytes /= 2;
-               tmp = os_realloc(res->ie, res->ie_len + bytes);
-               if (tmp == NULL)
-                       return;
-               hexstr2bin(spos, tmp + res->ie_len, bytes);
-               res->ie = tmp;
-               res->ie_len += bytes;
-       } else if (clen > 7 && os_strncmp(custom, "rsn_ie=", 7) == 0) {
-               char *spos;
-               int bytes;
-               spos = custom + 7;
-               bytes = custom + clen - spos;
-               if (bytes & 1 || bytes == 0)
-                       return;
-               bytes /= 2;
-               tmp = os_realloc(res->ie, res->ie_len + bytes);
-               if (tmp == NULL)
-                       return;
-               hexstr2bin(spos, tmp + res->ie_len, bytes);
-               res->ie = tmp;
-               res->ie_len += bytes;
-       } else if (clen > 4 && os_strncmp(custom, "tsf=", 4) == 0) {
-               char *spos;
-               int bytes;
-               u8 bin[8];
-               spos = custom + 4;
-               bytes = custom + clen - spos;
-               if (bytes != 16) {
-                       wpa_printf(MSG_INFO, "Invalid TSF length (%d)", bytes);
-                       return;
-               }
-               bytes /= 2;
-               hexstr2bin(spos, bin, bytes);
-               res->res.tsf += WPA_GET_BE64(bin);
-       }
-}
-
-
-static int wext_19_iw_point(struct wpa_driver_nl80211_data *drv, u16 cmd)
-{
-       return drv->we_version_compiled > 18 &&
-               (cmd == SIOCGIWESSID || cmd == SIOCGIWENCODE ||
-                cmd == IWEVGENIE || cmd == IWEVCUSTOM);
-}
-
-
-static void wpa_driver_nl80211_add_scan_entry(struct wpa_scan_results *res,
-                                          struct wext_scan_data *data)
-{
-       struct wpa_scan_res **tmp;
-       struct wpa_scan_res *r;
-       size_t extra_len;
-       u8 *pos, *end, *ssid_ie = NULL, *rate_ie = NULL;
-
-       /* Figure out whether we need to fake any IEs */
-       pos = data->ie;
-       end = pos + data->ie_len;
-       while (pos && pos + 1 < end) {
-               if (pos + 2 + pos[1] > end)
-                       break;
-               if (pos[0] == WLAN_EID_SSID)
-                       ssid_ie = pos;
-               else if (pos[0] == WLAN_EID_SUPP_RATES)
-                       rate_ie = pos;
-               else if (pos[0] == WLAN_EID_EXT_SUPP_RATES)
-                       rate_ie = pos;
-               pos += 2 + pos[1];
-       }
-
-       extra_len = 0;
-       if (ssid_ie == NULL)
-               extra_len += 2 + data->ssid_len;
-       if (rate_ie == NULL && data->maxrate)
-               extra_len += 3;
-
-       r = os_zalloc(sizeof(*r) + extra_len + data->ie_len);
+       r = os_zalloc(sizeof(*r) + ie_len);
        if (r == NULL)
-               return;
-       os_memcpy(r, &data->res, sizeof(*r));
-       r->ie_len = extra_len + data->ie_len;
-       pos = (u8 *) (r + 1);
-       if (ssid_ie == NULL) {
-               /*
-                * Generate a fake SSID IE since the driver did not report
-                * a full IE list.
-                */
-               *pos++ = WLAN_EID_SSID;
-               *pos++ = data->ssid_len;
-               os_memcpy(pos, data->ssid, data->ssid_len);
-               pos += data->ssid_len;
-       }
-       if (rate_ie == NULL && data->maxrate) {
-               /*
-                * Generate a fake Supported Rates IE since the driver did not
-                * report a full IE list.
-                */
-               *pos++ = WLAN_EID_SUPP_RATES;
-               *pos++ = 1;
-               *pos++ = data->maxrate;
-       }
-       if (data->ie)
-               os_memcpy(pos, data->ie, data->ie_len);
+               return NL_SKIP;
+       if (bss[NL80211_BSS_BSSID])
+               os_memcpy(r->bssid, nla_data(bss[NL80211_BSS_BSSID]),
+                         ETH_ALEN);
+       if (bss[NL80211_BSS_FREQUENCY])
+               r->freq = nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
+       if (bss[NL80211_BSS_BEACON_INTERVAL])
+               r->beacon_int = nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]);
+       if (bss[NL80211_BSS_CAPABILITY])
+               r->caps = nla_get_u16(bss[NL80211_BSS_CAPABILITY]);
+       r->flags |= WPA_SCAN_NOISE_INVALID;
+       if (bss[NL80211_BSS_SIGNAL_MBM]) {
+               r->level = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]);
+               r->level /= 100; /* mBm to dBm */
+               r->flags |= WPA_SCAN_LEVEL_DBM | WPA_SCAN_QUAL_INVALID;
+       } else if (bss[NL80211_BSS_SIGNAL_UNSPEC]) {
+               r->level = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]);
+               r->flags |= WPA_SCAN_LEVEL_INVALID;
+       } else
+               r->flags |= WPA_SCAN_LEVEL_INVALID | WPA_SCAN_QUAL_INVALID;
+       if (bss[NL80211_BSS_TSF])
+               r->tsf = nla_get_u64(bss[NL80211_BSS_TSF]);
+       r->ie_len = ie_len;
+       if (ie)
+               os_memcpy(r + 1, ie, ie_len);
 
        tmp = os_realloc(res->res,
                         (res->num + 1) * sizeof(struct wpa_scan_res *));
        if (tmp == NULL) {
                os_free(r);
-               return;
+               return NL_SKIP;
        }
        tmp[res->num++] = r;
        res->res = tmp;
+
+       return NL_SKIP;
 }
-                                     
+
 
 /**
  * wpa_driver_nl80211_get_scan_results - Fetch the latest scan results
  * @priv: Pointer to private wext data from wpa_driver_nl80211_init()
  * Returns: Scan results on success, -1 on failure
  */
-struct wpa_scan_results * wpa_driver_nl80211_get_scan_results(void *priv)
+static struct wpa_scan_results *
+wpa_driver_nl80211_get_scan_results(void *priv)
 {
        struct wpa_driver_nl80211_data *drv = priv;
-       size_t ap_num = 0, len;
-       int first;
-       u8 *res_buf;
-       struct iw_event iwe_buf, *iwe = &iwe_buf;
-       char *pos, *end, *custom;
+       struct nl_msg *msg;
        struct wpa_scan_results *res;
-       struct wext_scan_data data;
-
-       res_buf = wpa_driver_nl80211_giwscan(drv, &len);
-       if (res_buf == NULL)
-               return NULL;
-
-       ap_num = 0;
-       first = 1;
+       int ret;
 
        res = os_zalloc(sizeof(*res));
-       if (res == NULL) {
-               os_free(res_buf);
-               return NULL;
-       }
-
-       pos = (char *) res_buf;
-       end = (char *) res_buf + len;
-       os_memset(&data, 0, sizeof(data));
-
-       while (pos + IW_EV_LCP_LEN <= end) {
-               /* Event data may be unaligned, so make a local, aligned copy
-                * before processing. */
-               os_memcpy(&iwe_buf, pos, IW_EV_LCP_LEN);
-               if (iwe->len <= IW_EV_LCP_LEN)
-                       break;
-
-               custom = pos + IW_EV_POINT_LEN;
-               if (wext_19_iw_point(drv, iwe->cmd)) {
-                       /* WE-19 removed the pointer from struct iw_point */
-                       char *dpos = (char *) &iwe_buf.u.data.length;
-                       int dlen = dpos - (char *) &iwe_buf;
-                       os_memcpy(dpos, pos + IW_EV_LCP_LEN,
-                                 sizeof(struct iw_event) - dlen);
-               } else {
-                       os_memcpy(&iwe_buf, pos, sizeof(struct iw_event));
-                       custom += IW_EV_POINT_OFF;
-               }
-
-               switch (iwe->cmd) {
-               case SIOCGIWAP:
-                       if (!first)
-                               wpa_driver_nl80211_add_scan_entry(res, &data);
-                       first = 0;
-                       os_free(data.ie);
-                       os_memset(&data, 0, sizeof(data));
-                       os_memcpy(data.res.bssid,
-                                 iwe->u.ap_addr.sa_data, ETH_ALEN);
-                       break;
-               case SIOCGIWMODE:
-                       wext_get_scan_mode(iwe, &data);
-                       break;
-               case SIOCGIWESSID:
-                       wext_get_scan_ssid(iwe, &data, custom, end);
-                       break;
-               case SIOCGIWFREQ:
-                       wext_get_scan_freq(iwe, &data);
-                       break;
-               case IWEVQUAL:
-                       wext_get_scan_qual(iwe, &data);
-                       break;
-               case SIOCGIWENCODE:
-                       wext_get_scan_encode(iwe, &data);
-                       break;
-               case SIOCGIWRATE:
-                       wext_get_scan_rate(iwe, &data, pos, end);
-                       break;
-               case IWEVGENIE:
-                       wext_get_scan_iwevgenie(iwe, &data, custom, end);
-                       break;
-               case IWEVCUSTOM:
-                       wext_get_scan_custom(iwe, &data, custom, end);
-                       break;
-               }
-
-               pos += iwe->len;
-       }
-       os_free(res_buf);
-       res_buf = NULL;
-       if (!first)
-               wpa_driver_nl80211_add_scan_entry(res, &data);
-       os_free(data.ie);
-
-       wpa_printf(MSG_DEBUG, "Received %lu bytes of scan results (%lu BSSes)",
-                  (unsigned long) len, (unsigned long) res->num);
-
-       return res;
-}
-
-
-static int wpa_driver_nl80211_get_range(void *priv)
-{
-       struct wpa_driver_nl80211_data *drv = priv;
-       struct iw_range *range;
-       struct iwreq iwr;
-       int minlen;
-       size_t buflen;
-
-       /*
-        * Use larger buffer than struct iw_range in order to allow the
-        * structure to grow in the future.
-        */
-       buflen = sizeof(struct iw_range) + 500;
-       range = os_zalloc(buflen);
-       if (range == NULL)
-               return -1;
-
-       os_memset(&iwr, 0, sizeof(iwr));
-       os_strlcpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
-       iwr.u.data.pointer = (caddr_t) range;
-       iwr.u.data.length = buflen;
+       if (res == NULL)
+               return 0;
+       msg = nlmsg_alloc();
+       if (!msg)
+               goto nla_put_failure;
 
-       minlen = ((char *) &range->enc_capa) - (char *) range +
-               sizeof(range->enc_capa);
+       genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, NLM_F_DUMP,
+                   NL80211_CMD_GET_SCAN, 0);
+       NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
 
-       if (ioctl(drv->ioctl_sock, SIOCGIWRANGE, &iwr) < 0) {
-               perror("ioctl[SIOCGIWRANGE]");
-               os_free(range);
-               return -1;
-       } else if (iwr.u.data.length >= minlen &&
-                  range->we_version_compiled >= 18) {
-               wpa_printf(MSG_DEBUG, "SIOCGIWRANGE: WE(compiled)=%d "
-                          "WE(source)=%d enc_capa=0x%x",
-                          range->we_version_compiled,
-                          range->we_version_source,
-                          range->enc_capa);
-               drv->has_capability = 1;
-               drv->we_version_compiled = range->we_version_compiled;
-               if (range->enc_capa & IW_ENC_CAPA_WPA) {
-                       drv->capa.key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_WPA |
-                               WPA_DRIVER_CAPA_KEY_MGMT_WPA_PSK;
-               }
-               if (range->enc_capa & IW_ENC_CAPA_WPA2) {
-                       drv->capa.key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_WPA2 |
-                               WPA_DRIVER_CAPA_KEY_MGMT_WPA2_PSK;
-               }
-               drv->capa.enc |= WPA_DRIVER_CAPA_ENC_WEP40 |
-                       WPA_DRIVER_CAPA_ENC_WEP104;
-               if (range->enc_capa & IW_ENC_CAPA_CIPHER_TKIP)
-                       drv->capa.enc |= WPA_DRIVER_CAPA_ENC_TKIP;
-               if (range->enc_capa & IW_ENC_CAPA_CIPHER_CCMP)
-                       drv->capa.enc |= WPA_DRIVER_CAPA_ENC_CCMP;
-               wpa_printf(MSG_DEBUG, "  capabilities: key_mgmt 0x%x enc 0x%x",
-                          drv->capa.key_mgmt, drv->capa.enc);
-       } else {
-               wpa_printf(MSG_DEBUG, "SIOCGIWRANGE: too old (short) data - "
-                          "assuming WPA is not supported");
+       ret = send_and_recv_msgs(drv, msg, bss_info_handler, res);
+       msg = NULL;
+       if (ret == 0) {
+               wpa_printf(MSG_DEBUG, "Received scan results (%lu BSSes)",
+                          (unsigned long) res->num);
+               return res;
        }
-
-       os_free(range);
-       return 0;
-}
-
-
-static int wpa_driver_nl80211_set_wpa(void *priv, int enabled)
-{
-       struct wpa_driver_nl80211_data *drv = priv;
-       wpa_printf(MSG_DEBUG, "%s", __FUNCTION__);
-
-       return wpa_driver_nl80211_set_auth_param(drv, IW_AUTH_WPA_ENABLED,
-                                             enabled);
+       wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d "
+                  "(%s)", ret, strerror(-ret));
+nla_put_failure:
+       nlmsg_free(msg);
+       wpa_scan_results_free(res);
+       return NULL;
 }
 
 
@@ -1953,7 +1313,7 @@ static int wpa_driver_nl80211_set_key(void *priv, wpa_alg alg,
                                      const u8 *key, size_t key_len)
 {
        struct wpa_driver_nl80211_data *drv = priv;
-       int ret = -1, err;
+       int err;
        struct nl_msg *msg;
 
        wpa_printf(MSG_DEBUG, "%s: alg=%d addr=%p key_idx=%d set_tx=%d "
@@ -1987,6 +1347,11 @@ static int wpa_driver_nl80211_set_key(void *priv, wpa_alg alg,
                case WPA_ALG_CCMP:
                        NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER, 0x000FAC04);
                        break;
+#ifdef CONFIG_IEEE80211W
+               case WPA_ALG_IGTK:
+                       NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER, 0x000FAC06);
+                       break;
+#endif /* CONFIG_IEEE80211W */
                default:
                        nlmsg_free(msg);
                        return -1;
@@ -2001,16 +1366,13 @@ static int wpa_driver_nl80211_set_key(void *priv, wpa_alg alg,
        NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
 
-       err = 0;
-       if (nl_send_auto_complete(drv->nl_handle, msg) < 0 ||
-           (err = nl_wait_for_ack(drv->nl_handle)) < 0) {
+       err = send_and_recv_msgs(drv, msg, NULL, NULL);
+       if (err) {
                wpa_printf(MSG_DEBUG, "nl80211: set_key failed; err=%d", err);
-               nlmsg_free(msg);
                return -1;
        }
 
        if (set_tx && alg != WPA_ALG_NONE) {
-               nlmsg_free(msg);
                msg = nlmsg_alloc();
                if (msg == NULL)
                        return -1;
@@ -2021,305 +1383,351 @@ static int wpa_driver_nl80211_set_key(void *priv, wpa_alg alg,
                NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
                NLA_PUT_FLAG(msg, NL80211_ATTR_KEY_DEFAULT);
 
-               err = 0;
-               if (nl_send_auto_complete(drv->nl_handle, msg) < 0 ||
-                   (err = nl_wait_for_ack(drv->nl_handle)) < 0) {
+               err = send_and_recv_msgs(drv, msg, NULL, NULL);
+               if (err) {
                        wpa_printf(MSG_DEBUG, "nl80211: set default key "
                                   "failed; err=%d", err);
-                       nlmsg_free(msg);
                        return -1;
                }
        }
 
-       ret = 0;
+       return 0;
 
 nla_put_failure:
-       nlmsg_free(msg);
-       return ret;
+       return -ENOBUFS;
 }
 
 
-static int wpa_driver_nl80211_set_countermeasures(void *priv,
-                                              int enabled)
+static int wpa_driver_nl80211_mlme(struct wpa_driver_nl80211_data *drv,
+                                  const u8 *addr, int cmd, u16 reason_code)
 {
-       struct wpa_driver_nl80211_data *drv = priv;
-       wpa_printf(MSG_DEBUG, "%s", __FUNCTION__);
-       return wpa_driver_nl80211_set_auth_param(drv,
-                                             IW_AUTH_TKIP_COUNTERMEASURES,
-                                             enabled);
-}
-
+       int ret = -1;
+       struct nl_msg *msg;
 
-static int wpa_driver_nl80211_set_drop_unencrypted(void *priv,
-                                               int enabled)
-{
-       struct wpa_driver_nl80211_data *drv = priv;
-       wpa_printf(MSG_DEBUG, "%s", __FUNCTION__);
-       drv->use_crypt = enabled;
-       return wpa_driver_nl80211_set_auth_param(drv, IW_AUTH_DROP_UNENCRYPTED,
-                                             enabled);
-}
+       msg = nlmsg_alloc();
+       if (!msg)
+               return -1;
 
+       genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, cmd, 0);
 
-static int wpa_driver_nl80211_mlme(struct wpa_driver_nl80211_data *drv,
-                               const u8 *addr, int cmd, int reason_code)
-{
-       struct iwreq iwr;
-       struct iw_mlme mlme;
-       int ret = 0;
+       NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
+       NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason_code);
+       NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
 
-       os_memset(&iwr, 0, sizeof(iwr));
-       os_strlcpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
-       os_memset(&mlme, 0, sizeof(mlme));
-       mlme.cmd = cmd;
-       mlme.reason_code = reason_code;
-       mlme.addr.sa_family = ARPHRD_ETHER;
-       os_memcpy(mlme.addr.sa_data, addr, ETH_ALEN);
-       iwr.u.data.pointer = (caddr_t) &mlme;
-       iwr.u.data.length = sizeof(mlme);
-
-       if (ioctl(drv->ioctl_sock, SIOCSIWMLME, &iwr) < 0) {
-               perror("ioctl[SIOCSIWMLME]");
-               ret = -1;
+       ret = send_and_recv_msgs(drv, msg, NULL, NULL);
+       msg = NULL;
+       if (ret) {
+               wpa_printf(MSG_DEBUG, "nl80211: MLME command failed: ret=%d "
+                          "(%s)", ret, strerror(-ret));
+               goto nla_put_failure;
        }
+       ret = 0;
 
+nla_put_failure:
+       nlmsg_free(msg);
        return ret;
 }
 
 
 static int wpa_driver_nl80211_deauthenticate(void *priv, const u8 *addr,
-                                         int reason_code)
+                                            int reason_code)
 {
        struct wpa_driver_nl80211_data *drv = priv;
-       wpa_printf(MSG_DEBUG, "%s", __FUNCTION__);
-       return wpa_driver_nl80211_mlme(drv, addr, IW_MLME_DEAUTH, reason_code);
+       wpa_printf(MSG_DEBUG, "%s", __func__);
+       return wpa_driver_nl80211_mlme(drv, addr, NL80211_CMD_DEAUTHENTICATE,
+                                      reason_code);
 }
 
 
 static int wpa_driver_nl80211_disassociate(void *priv, const u8 *addr,
-                                       int reason_code)
+                                          int reason_code)
 {
        struct wpa_driver_nl80211_data *drv = priv;
-       wpa_printf(MSG_DEBUG, "%s", __FUNCTION__);
-       return wpa_driver_nl80211_mlme(drv, addr, IW_MLME_DISASSOC,
-                                   reason_code);
+       wpa_printf(MSG_DEBUG, "%s", __func__);
+       return wpa_driver_nl80211_mlme(drv, addr, NL80211_CMD_DISASSOCIATE,
+                                      reason_code);
 }
 
 
-static int wpa_driver_nl80211_set_gen_ie(void *priv, const u8 *ie,
-                                     size_t ie_len)
+static int wpa_driver_nl80211_authenticate(
+       void *priv, struct wpa_driver_auth_params *params)
 {
        struct wpa_driver_nl80211_data *drv = priv;
-       struct iwreq iwr;
-       int ret = 0;
+       int ret = -1;
+       struct nl_msg *msg;
+       enum nl80211_auth_type type;
 
-       os_memset(&iwr, 0, sizeof(iwr));
-       os_strlcpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
-       iwr.u.data.pointer = (caddr_t) ie;
-       iwr.u.data.length = ie_len;
+       drv->associated = 0;
+
+       msg = nlmsg_alloc();
+       if (!msg)
+               return -1;
+
+       wpa_printf(MSG_DEBUG, "nl80211: Authenticate (ifindex=%d)",
+                  drv->ifindex);
+       genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
+                   NL80211_CMD_AUTHENTICATE, 0);
 
-       if (ioctl(drv->ioctl_sock, SIOCSIWGENIE, &iwr) < 0) {
-               perror("ioctl[SIOCSIWGENIE]");
-               ret = -1;
+       NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
+       if (params->bssid) {
+               wpa_printf(MSG_DEBUG, "  * bssid=" MACSTR,
+                          MAC2STR(params->bssid));
+               NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid);
+       }
+       if (params->freq) {
+               wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq);
+               NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq);
+       }
+       if (params->ssid) {
+               wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
+                                 params->ssid, params->ssid_len);
+               NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
+                       params->ssid);
+       }
+       wpa_hexdump(MSG_DEBUG, "  * IEs", params->ie, params->ie_len);
+       if (params->ie)
+               NLA_PUT(msg, NL80211_ATTR_IE, params->ie_len, params->ie);
+       /*
+        * TODO: if multiple auth_alg options enabled, try them one by one if
+        * the AP rejects authentication due to unknown auth alg
+        */
+       if (params->auth_alg & AUTH_ALG_OPEN_SYSTEM)
+               type = NL80211_AUTHTYPE_OPEN_SYSTEM;
+       else if (params->auth_alg & AUTH_ALG_SHARED_KEY)
+               type = NL80211_AUTHTYPE_SHARED_KEY;
+       else if (params->auth_alg & AUTH_ALG_LEAP)
+               type = NL80211_AUTHTYPE_NETWORK_EAP;
+       else if (params->auth_alg & AUTH_ALG_FT)
+               type = NL80211_AUTHTYPE_FT;
+       else
+               goto nla_put_failure;
+       wpa_printf(MSG_DEBUG, "  * Auth Type %d", type);
+       NLA_PUT_U32(msg, NL80211_ATTR_AUTH_TYPE, type);
+
+       ret = send_and_recv_msgs(drv, msg, NULL, NULL);
+       msg = NULL;
+       if (ret) {
+               wpa_printf(MSG_DEBUG, "nl80211: MLME command failed: ret=%d "
+                          "(%s)", ret, strerror(-ret));
+               goto nla_put_failure;
        }
+       ret = 0;
+       wpa_printf(MSG_DEBUG, "nl80211: Authentication request send "
+                  "successfully");
 
+nla_put_failure:
+       nlmsg_free(msg);
        return ret;
 }
 
 
-static int wpa_driver_nl80211_cipher2wext(int cipher)
+#ifdef CONFIG_AP
+static int wpa_driver_nl80211_set_beacon(void *priv,
+                                        const u8 *head, size_t head_len,
+                                        const u8 *tail, size_t tail_len,
+                                        int dtim_period)
 {
-       switch (cipher) {
-       case CIPHER_NONE:
-               return IW_AUTH_CIPHER_NONE;
-       case CIPHER_WEP40:
-               return IW_AUTH_CIPHER_WEP40;
-       case CIPHER_TKIP:
-               return IW_AUTH_CIPHER_TKIP;
-       case CIPHER_CCMP:
-               return IW_AUTH_CIPHER_CCMP;
-       case CIPHER_WEP104:
-               return IW_AUTH_CIPHER_WEP104;
-       default:
-               return 0;
-       }
-}
+       struct wpa_driver_nl80211_data *drv = priv;
+       struct nl_msg *msg;
+       u8 cmd = NL80211_CMD_NEW_BEACON;
+       int ret;
 
+       msg = nlmsg_alloc();
+       if (!msg)
+               return -ENOMEM;
 
-static int wpa_driver_nl80211_keymgmt2wext(int keymgmt)
-{
-       switch (keymgmt) {
-       case KEY_MGMT_802_1X:
-       case KEY_MGMT_802_1X_NO_WPA:
-               return IW_AUTH_KEY_MGMT_802_1X;
-       case KEY_MGMT_PSK:
-               return IW_AUTH_KEY_MGMT_PSK;
-       default:
-               return 0;
-       }
+       wpa_printf(MSG_DEBUG, "nl80211: Set beacon (beacon_set=%d)",
+                  drv->beacon_set);
+       if (drv->beacon_set)
+               cmd = NL80211_CMD_SET_BEACON;
+
+       genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
+                   0, cmd, 0);
+       NLA_PUT(msg, NL80211_ATTR_BEACON_HEAD, head_len, head);
+       NLA_PUT(msg, NL80211_ATTR_BEACON_TAIL, tail_len, tail);
+       NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
+       if (!drv->beacon_int)
+               drv->beacon_int = 100;
+       NLA_PUT_U32(msg, NL80211_ATTR_BEACON_INTERVAL, drv->beacon_int);
+       NLA_PUT_U32(msg, NL80211_ATTR_DTIM_PERIOD, dtim_period);
+
+       ret = send_and_recv_msgs(drv, msg, NULL, NULL);
+       if (ret) {
+               wpa_printf(MSG_DEBUG, "nl80211: Beacon set failed: %d (%s)",
+                          ret, strerror(-ret));
+       } else
+               drv->beacon_set = 1;
+       return ret;
+ nla_put_failure:
+       return -ENOBUFS;
 }
 
 
-static int
-wpa_driver_nl80211_auth_alg_fallback(struct wpa_driver_nl80211_data *drv,
-                                 struct wpa_driver_associate_params *params)
+static int wpa_driver_nl80211_set_beacon_int(void *priv, int value)
 {
-       struct iwreq iwr;
-       int ret = 0;
+       struct wpa_driver_nl80211_data *drv = priv;
+       struct nl_msg *msg;
 
-       wpa_printf(MSG_DEBUG, "WEXT: Driver did not support "
-                  "SIOCSIWAUTH for AUTH_ALG, trying SIOCSIWENCODE");
+       drv->beacon_int = value;
 
-       os_memset(&iwr, 0, sizeof(iwr));
-       os_strlcpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
-       /* Just changing mode, not actual keys */
-       iwr.u.encoding.flags = 0;
-       iwr.u.encoding.pointer = (caddr_t) NULL;
-       iwr.u.encoding.length = 0;
+       if (!drv->beacon_set)
+               return 0;
 
-       /*
-        * Note: IW_ENCODE_{OPEN,RESTRICTED} can be interpreted to mean two
-        * different things. Here they are used to indicate Open System vs.
-        * Shared Key authentication algorithm. However, some drivers may use
-        * them to select between open/restricted WEP encrypted (open = allow
-        * both unencrypted and encrypted frames; restricted = only allow
-        * encrypted frames).
-        */
+       msg = nlmsg_alloc();
+       if (!msg)
+               return -ENOMEM;
 
-       if (!drv->use_crypt) {
-               iwr.u.encoding.flags |= IW_ENCODE_DISABLED;
-       } else {
-               if (params->auth_alg & AUTH_ALG_OPEN_SYSTEM)
-                       iwr.u.encoding.flags |= IW_ENCODE_OPEN;
-               if (params->auth_alg & AUTH_ALG_SHARED_KEY)
-                       iwr.u.encoding.flags |= IW_ENCODE_RESTRICTED;
-       }
+       wpa_printf(MSG_DEBUG, "nl80211: Set beacon interval %d "
+                  "(beacon_set=%d)", value, drv->beacon_set);
+       genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
+                   0, NL80211_CMD_SET_BEACON, 0);
+       NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
 
-       if (ioctl(drv->ioctl_sock, SIOCSIWENCODE, &iwr) < 0) {
-               perror("ioctl[SIOCSIWENCODE]");
-               ret = -1;
-       }
+       NLA_PUT_U32(msg, NL80211_ATTR_BEACON_INTERVAL, value);
 
-       return ret;
+       return send_and_recv_msgs(drv, msg, NULL, NULL);
+ nla_put_failure:
+       return -ENOBUFS;
 }
 
 
-static int wpa_driver_nl80211_associate(
-       void *priv, struct wpa_driver_associate_params *params)
+static int wpa_driver_nl80211_set_freq2(
+       struct wpa_driver_nl80211_data *drv,
+       struct wpa_driver_associate_params *params)
 {
-       struct wpa_driver_nl80211_data *drv = priv;
-       int ret = 0;
-       int allow_unencrypted_eapol;
-       int value;
+       struct nl_msg *msg;
+       int ret;
 
-       wpa_printf(MSG_DEBUG, "%s", __FUNCTION__);
+       msg = nlmsg_alloc();
+       if (!msg)
+               return -1;
 
-       /*
-        * If the driver did not support SIOCSIWAUTH, fallback to
-        * SIOCSIWENCODE here.
-        */
-       if (drv->auth_alg_fallback &&
-           wpa_driver_nl80211_auth_alg_fallback(drv, params) < 0)
-               ret = -1;
-
-       if (!params->bssid &&
-           wpa_driver_nl80211_set_bssid(drv, NULL) < 0)
-               ret = -1;
-
-       /* TODO: should consider getting wpa version and cipher/key_mgmt suites
-        * from configuration, not from here, where only the selected suite is
-        * available */
-       if (wpa_driver_nl80211_set_gen_ie(drv, params->wpa_ie, params->wpa_ie_len)
-           < 0)
-               ret = -1;
-       if (params->wpa_ie == NULL || params->wpa_ie_len == 0)
-               value = IW_AUTH_WPA_VERSION_DISABLED;
-       else if (params->wpa_ie[0] == WLAN_EID_RSN)
-               value = IW_AUTH_WPA_VERSION_WPA2;
-       else
-               value = IW_AUTH_WPA_VERSION_WPA;
-       if (wpa_driver_nl80211_set_auth_param(drv,
-                                          IW_AUTH_WPA_VERSION, value) < 0)
-               ret = -1;
-       value = wpa_driver_nl80211_cipher2wext(params->pairwise_suite);
-       if (wpa_driver_nl80211_set_auth_param(drv,
-                                          IW_AUTH_CIPHER_PAIRWISE, value) < 0)
-               ret = -1;
-       value = wpa_driver_nl80211_cipher2wext(params->group_suite);
-       if (wpa_driver_nl80211_set_auth_param(drv,
-                                          IW_AUTH_CIPHER_GROUP, value) < 0)
-               ret = -1;
-       value = wpa_driver_nl80211_keymgmt2wext(params->key_mgmt_suite);
-       if (wpa_driver_nl80211_set_auth_param(drv,
-                                          IW_AUTH_KEY_MGMT, value) < 0)
-               ret = -1;
-       value = params->key_mgmt_suite != KEY_MGMT_NONE ||
-               params->pairwise_suite != CIPHER_NONE ||
-               params->group_suite != CIPHER_NONE ||
-               params->wpa_ie_len;
-       if (wpa_driver_nl80211_set_auth_param(drv,
-                                          IW_AUTH_PRIVACY_INVOKED, value) < 0)
-               ret = -1;
-
-       /* Allow unencrypted EAPOL messages even if pairwise keys are set when
-        * not using WPA. IEEE 802.1X specifies that these frames are not
-        * encrypted, but WPA encrypts them when pairwise keys are in use. */
-       if (params->key_mgmt_suite == KEY_MGMT_802_1X ||
-           params->key_mgmt_suite == KEY_MGMT_PSK)
-               allow_unencrypted_eapol = 0;
-       else
-               allow_unencrypted_eapol = 1;
-       
-       if (wpa_driver_nl80211_set_auth_param(drv,
-                                          IW_AUTH_RX_UNENCRYPTED_EAPOL,
-                                          allow_unencrypted_eapol) < 0)
-               ret = -1;
-       if (params->freq && wpa_driver_nl80211_set_freq(drv, params->freq) < 0)
-               ret = -1;
-       if (wpa_driver_nl80211_set_ssid(drv, params->ssid, params->ssid_len) < 0)
-               ret = -1;
-       if (params->bssid &&
-           wpa_driver_nl80211_set_bssid(drv, params->bssid) < 0)
-               ret = -1;
+       genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
+                   NL80211_CMD_SET_WIPHY, 0);
 
-       return ret;
+       NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
+
+       NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq);
+
+       ret = send_and_recv_msgs(drv, msg, NULL, NULL);
+       if (ret == 0)
+               return 0;
+       wpa_printf(MSG_DEBUG, "nl80211: MLME Failed to set channel (freq=%d): "
+                  "%d (%s)", params->freq, ret, strerror(-ret));
+nla_put_failure:
+       return -1;
+}
+
+
+static int wpa_driver_nl80211_ap(struct wpa_driver_nl80211_data *drv,
+                                struct wpa_driver_associate_params *params)
+{
+       if (wpa_driver_nl80211_set_mode(drv, params->mode) ||
+           wpa_driver_nl80211_set_freq2(drv, params))
+               return -1;
+
+       /* TODO: setup monitor interface (and add code somewhere to remove this
+        * when AP mode is stopped; associate with mode != 2 or drv_deinit) */
+
+       return 0;
 }
+#endif /* CONFIG_AP */
 
 
-static int wpa_driver_nl80211_set_auth_alg(void *priv, int auth_alg)
+static int wpa_driver_nl80211_associate(
+       void *priv, struct wpa_driver_associate_params *params)
 {
        struct wpa_driver_nl80211_data *drv = priv;
-       int algs = 0, res;
-
-       if (auth_alg & AUTH_ALG_OPEN_SYSTEM)
-               algs |= IW_AUTH_ALG_OPEN_SYSTEM;
-       if (auth_alg & AUTH_ALG_SHARED_KEY)
-               algs |= IW_AUTH_ALG_SHARED_KEY;
-       if (auth_alg & AUTH_ALG_LEAP)
-               algs |= IW_AUTH_ALG_LEAP;
-       if (algs == 0) {
-               /* at least one algorithm should be set */
-               algs = IW_AUTH_ALG_OPEN_SYSTEM;
+       int ret = -1;
+       struct nl_msg *msg;
+
+#ifdef CONFIG_AP
+       if (params->mode == 2)
+               return wpa_driver_nl80211_ap(drv, params);
+#endif /* CONFIG_AP */
+
+       wpa_driver_nl80211_set_auth_param(drv, IW_AUTH_DROP_UNENCRYPTED,
+                                         params->drop_unencrypted);
+
+       drv->associated = 0;
+
+       msg = nlmsg_alloc();
+       if (!msg)
+               return -1;
+
+       wpa_printf(MSG_DEBUG, "nl80211: Associate (ifindex=%d)",
+                  drv->ifindex);
+       genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
+                   NL80211_CMD_ASSOCIATE, 0);
+
+       NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
+       if (params->bssid) {
+               wpa_printf(MSG_DEBUG, "  * bssid=" MACSTR,
+                          MAC2STR(params->bssid));
+               NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid);
+       }
+       if (params->freq) {
+               wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq);
+               NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq);
+       }
+       if (params->ssid) {
+               wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
+                                 params->ssid, params->ssid_len);
+               NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
+                       params->ssid);
+               if (params->ssid_len > sizeof(drv->ssid))
+                       goto nla_put_failure;
+               os_memcpy(drv->ssid, params->ssid, params->ssid_len);
+               drv->ssid_len = params->ssid_len;
+       }
+       wpa_hexdump(MSG_DEBUG, "  * IEs", params->wpa_ie, params->wpa_ie_len);
+       if (params->wpa_ie)
+               NLA_PUT(msg, NL80211_ATTR_IE, params->wpa_ie_len,
+                       params->wpa_ie);
+
+       ret = send_and_recv_msgs(drv, msg, NULL, NULL);
+       msg = NULL;
+       if (ret) {
+               wpa_printf(MSG_DEBUG, "nl80211: MLME command failed: ret=%d "
+                          "(%s)", ret, strerror(-ret));
+               goto nla_put_failure;
        }
+       ret = 0;
+       wpa_printf(MSG_DEBUG, "nl80211: Association request send "
+                  "successfully");
 
-       res = wpa_driver_nl80211_set_auth_param(drv, IW_AUTH_80211_AUTH_ALG,
-                                            algs);
-       drv->auth_alg_fallback = res == -2;
-       return res;
+nla_put_failure:
+       nlmsg_free(msg);
+       return ret;
 }
 
 
 /**
- * wpa_driver_nl80211_set_mode - Set wireless mode (infra/adhoc), SIOCSIWMODE
- * @priv: Pointer to private wext data from wpa_driver_nl80211_init()
+ * wpa_driver_nl80211_set_mode - Set wireless mode (infra/adhoc)
+ * @drv: Pointer to private driver data from wpa_driver_nl80211_init()
  * @mode: 0 = infra/BSS (associate with an AP), 1 = adhoc/IBSS
  * Returns: 0 on success, -1 on failure
  */
-static int wpa_driver_nl80211_set_mode(void *priv, int mode)
+static int wpa_driver_nl80211_set_mode(struct wpa_driver_nl80211_data *drv,
+                                      int mode)
 {
-       struct wpa_driver_nl80211_data *drv = priv;
        int ret = -1, flags;
        struct nl_msg *msg;
+       int nlmode;
+
+       switch (mode) {
+       case 0:
+               nlmode = NL80211_IFTYPE_STATION;
+               break;
+       case 1:
+               nlmode = NL80211_IFTYPE_ADHOC;
+               break;
+       case 2:
+               nlmode = NL80211_IFTYPE_AP;
+               break;
+       default:
+               return -1;
+       }
 
        msg = nlmsg_alloc();
        if (!msg)
@@ -2328,18 +1736,17 @@ static int wpa_driver_nl80211_set_mode(void *priv, int mode)
        genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
                    0, NL80211_CMD_SET_INTERFACE, 0);
        NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
-       NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE,
-                   mode ? NL80211_IFTYPE_ADHOC : NL80211_IFTYPE_STATION);
+       NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, nlmode);
 
-       if (nl_send_auto_complete(drv->nl_handle, msg) < 0 ||
-           nl_wait_for_ack(drv->nl_handle) < 0)
+       ret = send_and_recv_msgs(drv, msg, NULL, NULL);
+       if (!ret)
+               return 0;
+       else
                goto try_again;
 
-       nlmsg_free(msg);
-       return 0;
-
 nla_put_failure:
-       nlmsg_free(msg);
+       wpa_printf(MSG_ERROR, "nl80211: Failed to set interface mode: %d (%s)",
+                  ret, strerror(-ret));
        return -1;
 
 try_again:
@@ -2351,12 +1758,20 @@ try_again:
                (void) wpa_driver_nl80211_set_ifflags(drv, flags & ~IFF_UP);
 
                /* Try to set the mode again while the interface is down */
-               if (nl_send_auto_complete(drv->nl_handle, msg) < 0 ||
-                   nl_wait_for_ack(drv->nl_handle) < 0) {
+               msg = nlmsg_alloc();
+               if (!msg)
+                       return -1;
+
+               genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
+                           0, NL80211_CMD_SET_INTERFACE, 0);
+               NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
+               NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, nlmode);
+               ret = send_and_recv_msgs(drv, msg, NULL, NULL);
+               if (ret) {
                        wpa_printf(MSG_ERROR, "Failed to set interface %s "
-                                  "mode", drv->ifname);
-               } else
-                       ret = 0;
+                                  "mode(try_again): %d (%s)",
+                                  drv->ifname, ret, strerror(-ret));
+               }
 
                /* Ignore return value of get_ifflags to ensure that the device
                 * is always up like it was before this function was called.
@@ -2365,63 +1780,10 @@ try_again:
                (void) wpa_driver_nl80211_set_ifflags(drv, flags | IFF_UP);
        }
 
-       nlmsg_free(msg);
        return ret;
 }
 
 
-static int wpa_driver_nl80211_pmksa(struct wpa_driver_nl80211_data *drv,
-                                u32 cmd, const u8 *bssid, const u8 *pmkid)
-{
-       struct iwreq iwr;
-       struct iw_pmksa pmksa;
-       int ret = 0;
-
-       os_memset(&iwr, 0, sizeof(iwr));
-       os_strlcpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
-       os_memset(&pmksa, 0, sizeof(pmksa));
-       pmksa.cmd = cmd;
-       pmksa.bssid.sa_family = ARPHRD_ETHER;
-       if (bssid)
-               os_memcpy(pmksa.bssid.sa_data, bssid, ETH_ALEN);
-       if (pmkid)
-               os_memcpy(pmksa.pmkid, pmkid, IW_PMKID_LEN);
-       iwr.u.data.pointer = (caddr_t) &pmksa;
-       iwr.u.data.length = sizeof(pmksa);
-
-       if (ioctl(drv->ioctl_sock, SIOCSIWPMKSA, &iwr) < 0) {
-               if (errno != EOPNOTSUPP)
-                       perror("ioctl[SIOCSIWPMKSA]");
-               ret = -1;
-       }
-
-       return ret;
-}
-
-
-static int wpa_driver_nl80211_add_pmkid(void *priv, const u8 *bssid,
-                                    const u8 *pmkid)
-{
-       struct wpa_driver_nl80211_data *drv = priv;
-       return wpa_driver_nl80211_pmksa(drv, IW_PMKSA_ADD, bssid, pmkid);
-}
-
-
-static int wpa_driver_nl80211_remove_pmkid(void *priv, const u8 *bssid,
-                                       const u8 *pmkid)
-{
-       struct wpa_driver_nl80211_data *drv = priv;
-       return wpa_driver_nl80211_pmksa(drv, IW_PMKSA_REMOVE, bssid, pmkid);
-}
-
-
-static int wpa_driver_nl80211_flush_pmkid(void *priv)
-{
-       struct wpa_driver_nl80211_data *drv = priv;
-       return wpa_driver_nl80211_pmksa(drv, IW_PMKSA_FLUSH, NULL, NULL);
-}
-
-
 static int wpa_driver_nl80211_get_capa(void *priv,
                                       struct wpa_driver_capa *capa)
 {
@@ -2445,436 +1807,25 @@ static int wpa_driver_nl80211_set_operstate(void *priv, int state)
 }
 
 
-#ifdef CONFIG_CLIENT_MLME
-static int wpa_driver_nl80211_open_mlme(struct wpa_driver_nl80211_data *drv)
-{
-       if (wpa_driver_nl80211_set_userspace_mlme(drv, 1) < 0) {
-               wpa_printf(MSG_ERROR, "nl80211: Failed to enable userspace "
-                          "MLME");
-               return -1;
-       }
-       if (wpa_driver_nl80211_create_monitor_interface(drv)) {
-               wpa_printf(MSG_ERROR, "nl80211: Failed to create monitor "
-                          "interface");
-               return -1;
-       }
-       return 0;
-}
-#endif /* CONFIG_CLIENT_MLME */
-
-
-static int wpa_driver_nl80211_set_param(void *priv, const char *param)
-{
-#ifdef CONFIG_CLIENT_MLME
-       struct wpa_driver_nl80211_data *drv = priv;
-
-       if (param == NULL)
-               return 0;
-
-       wpa_printf(MSG_DEBUG, "%s: param='%s'", __func__, param);
-
-       if (os_strstr(param, "use_mlme=1")) {
-               wpa_printf(MSG_DEBUG, "nl80211: Using user space MLME");
-               drv->capa.flags |= WPA_DRIVER_FLAGS_USER_SPACE_MLME;
-
-               if (wpa_driver_nl80211_open_mlme(drv))
-                       return -1;
-       }
-#endif /* CONFIG_CLIENT_MLME */
-
-       return 0;
-}
-
-
-#ifdef CONFIG_CLIENT_MLME
-
-static int ack_wait_handler(struct nl_msg *msg, void *arg)
-{
-       int *finished = arg;
-
-       *finished = 1;
-       return NL_STOP;
-}
-
-
-struct phy_info_arg {
-       u16 *num_modes;
-       struct wpa_hw_modes *modes;
-       int error;
-};
-
-
-static int phy_info_handler(struct nl_msg *msg, void *arg)
-{
-       struct nlattr *tb_msg[NL80211_ATTR_MAX + 1];
-       struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
-       struct phy_info_arg *phy_info = arg;
-
-       struct nlattr *tb_band[NL80211_BAND_ATTR_MAX + 1];
-
-       struct nlattr *tb_freq[NL80211_FREQUENCY_ATTR_MAX + 1];
-       static struct nla_policy freq_policy[NL80211_FREQUENCY_ATTR_MAX + 1]
-               = {
-               [NL80211_FREQUENCY_ATTR_FREQ] = { .type = NLA_U32 },
-               [NL80211_FREQUENCY_ATTR_DISABLED] = { .type = NLA_FLAG },
-               [NL80211_FREQUENCY_ATTR_PASSIVE_SCAN] = { .type = NLA_FLAG },
-               [NL80211_FREQUENCY_ATTR_NO_IBSS] = { .type = NLA_FLAG },
-               [NL80211_FREQUENCY_ATTR_RADAR] = { .type = NLA_FLAG },
-       };
-
-       struct nlattr *tb_rate[NL80211_BITRATE_ATTR_MAX + 1];
-       static struct nla_policy rate_policy[NL80211_BITRATE_ATTR_MAX + 1] = {
-               [NL80211_BITRATE_ATTR_RATE] = { .type = NLA_U32 },
-               [NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE] =
-               { .type = NLA_FLAG },
-       };
-
-       struct nlattr *nl_band;
-       struct nlattr *nl_freq;
-       struct nlattr *nl_rate;
-       int rem_band, rem_freq, rem_rate;
-       struct wpa_hw_modes *mode;
-       int idx, mode_is_set;
-
-       nla_parse(tb_msg, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
-                 genlmsg_attrlen(gnlh, 0), NULL);
-
-       if (!tb_msg[NL80211_ATTR_WIPHY_BANDS])
-               return NL_SKIP;
-
-       nla_for_each_nested(nl_band, tb_msg[NL80211_ATTR_WIPHY_BANDS],
-                           rem_band) {
-               mode = os_realloc(phy_info->modes,
-                                 (*phy_info->num_modes + 1) * sizeof(*mode));
-               if (!mode)
-                       return NL_SKIP;
-               phy_info->modes = mode;
-
-               mode_is_set = 0;
-
-               mode = &phy_info->modes[*(phy_info->num_modes)];
-               os_memset(mode, 0, sizeof(*mode));
-               *(phy_info->num_modes) += 1;
-
-               nla_parse(tb_band, NL80211_BAND_ATTR_MAX, nla_data(nl_band),
-                         nla_len(nl_band), NULL);
-
-               nla_for_each_nested(nl_freq, tb_band[NL80211_BAND_ATTR_FREQS],
-                                   rem_freq) {
-                       nla_parse(tb_freq, NL80211_FREQUENCY_ATTR_MAX,
-                                 nla_data(nl_freq), nla_len(nl_freq),
-                                 freq_policy);
-                       if (!tb_freq[NL80211_FREQUENCY_ATTR_FREQ])
-                               continue;
-                       mode->num_channels++;
-               }
-
-               mode->channels = os_zalloc(mode->num_channels *
-                                          sizeof(struct wpa_channel_data));
-               if (!mode->channels)
-                       return NL_SKIP;
-
-               idx = 0;
-
-               nla_for_each_nested(nl_freq, tb_band[NL80211_BAND_ATTR_FREQS],
-                                   rem_freq) {
-                       nla_parse(tb_freq, NL80211_FREQUENCY_ATTR_MAX,
-                                 nla_data(nl_freq), nla_len(nl_freq),
-                                 freq_policy);
-                       if (!tb_freq[NL80211_FREQUENCY_ATTR_FREQ])
-                               continue;
-
-                       mode->channels[idx].freq = nla_get_u32(
-                               tb_freq[NL80211_FREQUENCY_ATTR_FREQ]);
-                       mode->channels[idx].flag |= WPA_CHAN_W_SCAN |
-                               WPA_CHAN_W_ACTIVE_SCAN |
-                               WPA_CHAN_W_IBSS;
-
-                       if (!mode_is_set) {
-                               /* crude heuristic */
-                               if (mode->channels[idx].freq < 4000)
-                                       mode->mode = WPA_MODE_IEEE80211B;
-                               else
-                                       mode->mode = WPA_MODE_IEEE80211A;
-                               mode_is_set = 1;
-                       }
-
-                       /* crude heuristic */
-                       if (mode->channels[idx].freq < 4000) {
-                               if (mode->channels[idx].freq == 2848)
-                                       mode->channels[idx].chan = 14;
-                               else
-                                       mode->channels[idx].chan =
-                                               (mode->channels[idx].freq -
-                                                2407) / 5;
-                       } else
-                               mode->channels[idx].chan =
-                                       mode->channels[idx].freq / 5 - 1000;
-
-                       if (tb_freq[NL80211_FREQUENCY_ATTR_DISABLED])
-                               mode->channels[idx].flag &= ~WPA_CHAN_W_SCAN;
-                       if (tb_freq[NL80211_FREQUENCY_ATTR_PASSIVE_SCAN])
-                               mode->channels[idx].flag &=
-                                       ~WPA_CHAN_W_ACTIVE_SCAN;
-                       if (tb_freq[NL80211_FREQUENCY_ATTR_NO_IBSS])
-                               mode->channels[idx].flag &= ~WPA_CHAN_W_IBSS;
-                       idx++;
-               }
-
-               nla_for_each_nested(nl_rate, tb_band[NL80211_BAND_ATTR_RATES],
-                                   rem_rate) {
-                       nla_parse(tb_rate, NL80211_BITRATE_ATTR_MAX,
-                                 nla_data(nl_rate), nla_len(nl_rate),
-                                 rate_policy);
-                       if (!tb_rate[NL80211_BITRATE_ATTR_RATE])
-                               continue;
-                       mode->num_rates++;
-               }
-
-               mode->rates = os_zalloc(mode->num_rates *
-                                       sizeof(struct wpa_rate_data));
-               if (!mode->rates)
-                       return NL_SKIP;
-
-               idx = 0;
-
-               nla_for_each_nested(nl_rate, tb_band[NL80211_BAND_ATTR_RATES],
-                                   rem_rate) {
-                       nla_parse(tb_rate, NL80211_BITRATE_ATTR_MAX,
-                                 nla_data(nl_rate), nla_len(nl_rate),
-                                 rate_policy);
-                       if (!tb_rate[NL80211_BITRATE_ATTR_RATE])
-                               continue;
-                       mode->rates[idx].rate = nla_get_u32(
-                               tb_rate[NL80211_BITRATE_ATTR_RATE]);
-
-                       /* crude heuristic */
-                       if (mode->mode == WPA_MODE_IEEE80211B &&
-                           mode->rates[idx].rate > 200)
-                               mode->mode = WPA_MODE_IEEE80211G;
-
-                       if (tb_rate[NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE])
-                               mode->rates[idx].flags |= WPA_RATE_PREAMBLE2;
-
-                       idx++;
-               }
-       }
-
-       phy_info->error = 0;
-
-       return NL_SKIP;
-}
-
-
-static struct wpa_hw_modes *
-wpa_driver_nl80211_get_hw_feature_data(void *priv, u16 *num_modes, u16 *flags)
-{
-       struct wpa_driver_nl80211_data *drv = priv;
-       struct nl_msg *msg;
-       int err = -1;
-       struct nl_cb *cb = NULL;
-       int finished = 0;
-       struct phy_info_arg result = {
-               .num_modes = num_modes,
-               .modes = NULL,
-               .error = 1,
-       };
-
-       *num_modes = 0;
-       *flags = 0;
-
-       msg = nlmsg_alloc();
-       if (!msg)
-               return NULL;
-
-       genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
-                   0, NL80211_CMD_GET_WIPHY, 0);
-
-       NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
-
-       cb = nl_cb_clone(drv->nl_cb);
-       if (!cb)
-               goto out;
-
-       if (nl_send_auto_complete(drv->nl_handle, msg) < 0)
-               goto out;
-
-       nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM, phy_info_handler, &result);
-       nl_cb_set(cb, NL_CB_ACK, NL_CB_CUSTOM, ack_wait_handler, &finished);
-
-       err = nl_recvmsgs(drv->nl_handle, cb);
-
-       if (!finished)
-               err = nl_wait_for_ack(drv->nl_handle);
-
-       if (err < 0 || result.error) {
-               wpa_supplicant_sta_free_hw_features(result.modes, *num_modes);
-               result.modes = NULL;
-       }
-
- out:
-       nl_cb_put(cb);
- nla_put_failure:
-       if (err)
-               fprintf(stderr, "failed to get information: %d\n", err);
-       nlmsg_free(msg);
-       return result.modes;
-}
-
-
-static int wpa_driver_nl80211_set_channel(void *priv, wpa_hw_mode phymode,
-                                         int chan, int freq)
-{
-       return wpa_driver_nl80211_set_freq(priv, freq);
-}
-
-
-static int wpa_driver_nl80211_send_mlme(void *priv, const u8 *data,
-                                       size_t data_len)
-{
-       struct wpa_driver_nl80211_data *drv = priv;
-       __u8 rtap_hdr[] = {
-               0x00, 0x00, /* radiotap version */
-               0x0e, 0x00, /* radiotap length */
-               0x02, 0xc0, 0x00, 0x00, /* bmap: flags, tx and rx flags */
-               0x0c,       /* F_WEP | F_FRAG (encrypt/fragment if required) */
-               0x00,       /* padding */
-               0x00, 0x00, /* RX and TX flags to indicate that */
-               0x00, 0x00, /* this is the injected frame directly */
-       };
-       struct iovec iov[2] = {
-               {
-                       .iov_base = &rtap_hdr,
-                       .iov_len = sizeof(rtap_hdr),
-               },
-               {
-                       .iov_base = (void *) data,
-                       .iov_len = data_len,
-               }
-       };
-       struct msghdr msg = {
-               .msg_name = NULL,
-               .msg_namelen = 0,
-               .msg_iov = iov,
-               .msg_iovlen = 2,
-               .msg_control = NULL,
-               .msg_controllen = 0,
-               .msg_flags = 0,
-       };
-
-       if (sendmsg(drv->monitor_sock, &msg, 0) < 0) {
-               perror("send[MLME]");
-               return -1;
-       }
-
-       return 0;
-}
-
-
-static int wpa_driver_nl80211_mlme_add_sta(void *priv, const u8 *addr,
-                                          const u8 *supp_rates,
-                                          size_t supp_rates_len)
-{
-       struct wpa_driver_nl80211_data *drv = priv;
-       struct nl_msg *msg;
-       int ret = -1;
-
-       msg = nlmsg_alloc();
-       if (!msg)
-               goto out;
-
-       genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
-                   0, NL80211_CMD_NEW_STATION, 0);
-
-       NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
-       NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
-       /* TODO: Get proper Association ID and listen interval */
-       NLA_PUT_U16(msg, NL80211_ATTR_STA_AID, 1);
-       NLA_PUT(msg, NL80211_ATTR_STA_SUPPORTED_RATES, supp_rates_len,
-               supp_rates);
-       NLA_PUT_U16(msg, NL80211_ATTR_STA_LISTEN_INTERVAL, 1);
-
-       ret = nl_send_auto_complete(drv->nl_handle, msg);
-       if (ret < 0)
-               goto nla_put_failure;
-
-       ret = nl_wait_for_ack(drv->nl_handle);
-       /* ignore EEXIST, this happens if a STA associates while associated */
-       if (ret == -EEXIST || ret >= 0)
-               ret = 0;
-
- nla_put_failure:
-       nlmsg_free(msg);
-
- out:
-       return ret;
-}
-
-
-static int wpa_driver_nl80211_mlme_remove_sta(void *priv, const u8 *addr)
-{
-       struct wpa_driver_nl80211_data *drv = priv;
-       struct nl_msg *msg;
-       int ret = -1;
-
-       msg = nlmsg_alloc();
-       if (!msg)
-               goto out;
-
-       genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
-                   0, NL80211_CMD_DEL_STATION, 0);
-
-       NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
-       NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
-
-       ret = 0;
-
-       if (nl_send_auto_complete(drv->nl_handle, msg) < 0 ||
-           nl_wait_for_ack(drv->nl_handle) < 0) {
-               ret = -1;
-       }
-
- nla_put_failure:
-       nlmsg_free(msg);
-
- out:
-       return ret;
-}
-
-#endif /* CONFIG_CLIENT_MLME */
-
-
 const struct wpa_driver_ops wpa_driver_nl80211_ops = {
        .name = "nl80211",
        .desc = "Linux nl80211/cfg80211",
        .get_bssid = wpa_driver_nl80211_get_bssid,
        .get_ssid = wpa_driver_nl80211_get_ssid,
-       .set_wpa = wpa_driver_nl80211_set_wpa,
        .set_key = wpa_driver_nl80211_set_key,
-       .set_countermeasures = wpa_driver_nl80211_set_countermeasures,
-       .set_drop_unencrypted = wpa_driver_nl80211_set_drop_unencrypted,
-       .scan = wpa_driver_nl80211_scan,
+       .scan2 = wpa_driver_nl80211_scan,
        .get_scan_results2 = wpa_driver_nl80211_get_scan_results,
        .deauthenticate = wpa_driver_nl80211_deauthenticate,
        .disassociate = wpa_driver_nl80211_disassociate,
-       .set_mode = wpa_driver_nl80211_set_mode,
+       .authenticate = wpa_driver_nl80211_authenticate,
        .associate = wpa_driver_nl80211_associate,
-       .set_auth_alg = wpa_driver_nl80211_set_auth_alg,
        .init = wpa_driver_nl80211_init,
        .deinit = wpa_driver_nl80211_deinit,
-       .set_param = wpa_driver_nl80211_set_param,
-       .add_pmkid = wpa_driver_nl80211_add_pmkid,
-       .remove_pmkid = wpa_driver_nl80211_remove_pmkid,
-       .flush_pmkid = wpa_driver_nl80211_flush_pmkid,
        .get_capa = wpa_driver_nl80211_get_capa,
        .set_operstate = wpa_driver_nl80211_set_operstate,
-#ifdef CONFIG_CLIENT_MLME
-       .get_hw_feature_data = wpa_driver_nl80211_get_hw_feature_data,
-       .set_channel = wpa_driver_nl80211_set_channel,
-       .set_ssid = wpa_driver_nl80211_set_ssid,
-       .set_bssid = wpa_driver_nl80211_set_bssid,
-       .send_mlme = wpa_driver_nl80211_send_mlme,
-       .mlme_add_sta = wpa_driver_nl80211_mlme_add_sta,
-       .mlme_remove_sta = wpa_driver_nl80211_mlme_remove_sta,
-#endif /* CONFIG_CLIENT_MLME */
+       .set_country = wpa_driver_nl80211_set_country,
+#ifdef CONFIG_AP
+       .set_beacon = wpa_driver_nl80211_set_beacon,
+       .set_beacon_int = wpa_driver_nl80211_set_beacon_int,
+#endif /* CONFIG_AP */
 };