0001
0002
0003
0004 #include <linux/kernel.h>
0005 #include <linux/module.h>
0006 #include <linux/slab.h>
0007 #include <linux/nospec.h>
0008
0009 #include "cfg80211.h"
0010 #include "core.h"
0011 #include "qlink.h"
0012 #include "bus.h"
0013 #include "trans.h"
0014 #include "util.h"
0015 #include "event.h"
0016 #include "qlink_util.h"
0017
0018 static int
0019 qtnf_event_handle_sta_assoc(struct qtnf_wmac *mac, struct qtnf_vif *vif,
0020 const struct qlink_event_sta_assoc *sta_assoc,
0021 u16 len)
0022 {
0023 const u8 *sta_addr;
0024 u16 frame_control;
0025 struct station_info *sinfo;
0026 size_t payload_len;
0027 u16 tlv_type;
0028 u16 tlv_value_len;
0029 const struct qlink_tlv_hdr *tlv;
0030 int ret = 0;
0031
0032 if (unlikely(len < sizeof(*sta_assoc))) {
0033 pr_err("VIF%u.%u: payload is too short (%u < %zu)\n",
0034 mac->macid, vif->vifid, len, sizeof(*sta_assoc));
0035 return -EINVAL;
0036 }
0037
0038 if (vif->wdev.iftype != NL80211_IFTYPE_AP) {
0039 pr_err("VIF%u.%u: STA_ASSOC event when not in AP mode\n",
0040 mac->macid, vif->vifid);
0041 return -EPROTO;
0042 }
0043
0044 sinfo = kzalloc(sizeof(*sinfo), GFP_KERNEL);
0045 if (!sinfo)
0046 return -ENOMEM;
0047
0048 sta_addr = sta_assoc->sta_addr;
0049 frame_control = le16_to_cpu(sta_assoc->frame_control);
0050
0051 pr_debug("VIF%u.%u: MAC:%pM FC:%x\n", mac->macid, vif->vifid, sta_addr,
0052 frame_control);
0053
0054 qtnf_sta_list_add(vif, sta_addr);
0055
0056 sinfo->assoc_req_ies = NULL;
0057 sinfo->assoc_req_ies_len = 0;
0058 sinfo->generation = vif->generation;
0059
0060 payload_len = len - sizeof(*sta_assoc);
0061
0062 qlink_for_each_tlv(tlv, sta_assoc->ies, payload_len) {
0063 tlv_type = le16_to_cpu(tlv->type);
0064 tlv_value_len = le16_to_cpu(tlv->len);
0065
0066 if (tlv_type == QTN_TLV_ID_IE_SET) {
0067 const struct qlink_tlv_ie_set *ie_set;
0068 unsigned int ie_len;
0069
0070 if (tlv_value_len <
0071 (sizeof(*ie_set) - sizeof(ie_set->hdr))) {
0072 ret = -EINVAL;
0073 goto out;
0074 }
0075
0076 ie_set = (const struct qlink_tlv_ie_set *)tlv;
0077 ie_len = tlv_value_len -
0078 (sizeof(*ie_set) - sizeof(ie_set->hdr));
0079
0080 if (ie_set->type == QLINK_IE_SET_ASSOC_REQ && ie_len) {
0081 sinfo->assoc_req_ies = ie_set->ie_data;
0082 sinfo->assoc_req_ies_len = ie_len;
0083 }
0084 }
0085 }
0086
0087 if (!qlink_tlv_parsing_ok(tlv, sta_assoc->ies, payload_len)) {
0088 pr_err("Malformed TLV buffer\n");
0089 ret = -EINVAL;
0090 goto out;
0091 }
0092
0093 cfg80211_new_sta(vif->netdev, sta_assoc->sta_addr, sinfo,
0094 GFP_KERNEL);
0095
0096 out:
0097 kfree(sinfo);
0098 return ret;
0099 }
0100
0101 static int
0102 qtnf_event_handle_sta_deauth(struct qtnf_wmac *mac, struct qtnf_vif *vif,
0103 const struct qlink_event_sta_deauth *sta_deauth,
0104 u16 len)
0105 {
0106 const u8 *sta_addr;
0107 u16 reason;
0108
0109 if (unlikely(len < sizeof(*sta_deauth))) {
0110 pr_err("VIF%u.%u: payload is too short (%u < %zu)\n",
0111 mac->macid, vif->vifid, len,
0112 sizeof(struct qlink_event_sta_deauth));
0113 return -EINVAL;
0114 }
0115
0116 if (vif->wdev.iftype != NL80211_IFTYPE_AP) {
0117 pr_err("VIF%u.%u: STA_DEAUTH event when not in AP mode\n",
0118 mac->macid, vif->vifid);
0119 return -EPROTO;
0120 }
0121
0122 sta_addr = sta_deauth->sta_addr;
0123 reason = le16_to_cpu(sta_deauth->reason);
0124
0125 pr_debug("VIF%u.%u: MAC:%pM reason:%x\n", mac->macid, vif->vifid,
0126 sta_addr, reason);
0127
0128 if (qtnf_sta_list_del(vif, sta_addr))
0129 cfg80211_del_sta(vif->netdev, sta_deauth->sta_addr,
0130 GFP_KERNEL);
0131
0132 return 0;
0133 }
0134
0135 static int
0136 qtnf_event_handle_bss_join(struct qtnf_vif *vif,
0137 const struct qlink_event_bss_join *join_info,
0138 u16 len)
0139 {
0140 struct wiphy *wiphy = priv_to_wiphy(vif->mac);
0141 enum ieee80211_statuscode status = le16_to_cpu(join_info->status);
0142 struct cfg80211_chan_def chandef;
0143 struct cfg80211_bss *bss = NULL;
0144 u8 *ie = NULL;
0145 size_t payload_len;
0146 u16 tlv_type;
0147 u16 tlv_value_len;
0148 const struct qlink_tlv_hdr *tlv;
0149 const u8 *rsp_ies = NULL;
0150 size_t rsp_ies_len = 0;
0151
0152 if (unlikely(len < sizeof(*join_info))) {
0153 pr_err("VIF%u.%u: payload is too short (%u < %zu)\n",
0154 vif->mac->macid, vif->vifid, len,
0155 sizeof(struct qlink_event_bss_join));
0156 return -EINVAL;
0157 }
0158
0159 if (vif->wdev.iftype != NL80211_IFTYPE_STATION) {
0160 pr_err("VIF%u.%u: BSS_JOIN event when not in STA mode\n",
0161 vif->mac->macid, vif->vifid);
0162 return -EPROTO;
0163 }
0164
0165 pr_debug("VIF%u.%u: BSSID:%pM chan:%u status:%u\n",
0166 vif->mac->macid, vif->vifid, join_info->bssid,
0167 le16_to_cpu(join_info->chan.chan.center_freq), status);
0168
0169 if (status != WLAN_STATUS_SUCCESS)
0170 goto done;
0171
0172 qlink_chandef_q2cfg(wiphy, &join_info->chan, &chandef);
0173 if (!cfg80211_chandef_valid(&chandef)) {
0174 pr_warn("MAC%u.%u: bad channel freq=%u cf1=%u cf2=%u bw=%u\n",
0175 vif->mac->macid, vif->vifid,
0176 chandef.chan ? chandef.chan->center_freq : 0,
0177 chandef.center_freq1,
0178 chandef.center_freq2,
0179 chandef.width);
0180 status = WLAN_STATUS_UNSPECIFIED_FAILURE;
0181 goto done;
0182 }
0183
0184 bss = cfg80211_get_bss(wiphy, chandef.chan, join_info->bssid,
0185 NULL, 0, IEEE80211_BSS_TYPE_ESS,
0186 IEEE80211_PRIVACY_ANY);
0187 if (!bss) {
0188 pr_warn("VIF%u.%u: add missing BSS:%pM chan:%u\n",
0189 vif->mac->macid, vif->vifid,
0190 join_info->bssid, chandef.chan->hw_value);
0191
0192 if (!vif->wdev.u.client.ssid_len) {
0193 pr_warn("VIF%u.%u: SSID unknown for BSS:%pM\n",
0194 vif->mac->macid, vif->vifid,
0195 join_info->bssid);
0196 status = WLAN_STATUS_UNSPECIFIED_FAILURE;
0197 goto done;
0198 }
0199
0200 ie = kzalloc(2 + vif->wdev.u.client.ssid_len, GFP_KERNEL);
0201 if (!ie) {
0202 pr_warn("VIF%u.%u: IE alloc failed for BSS:%pM\n",
0203 vif->mac->macid, vif->vifid,
0204 join_info->bssid);
0205 status = WLAN_STATUS_UNSPECIFIED_FAILURE;
0206 goto done;
0207 }
0208
0209 ie[0] = WLAN_EID_SSID;
0210 ie[1] = vif->wdev.u.client.ssid_len;
0211 memcpy(ie + 2, vif->wdev.u.client.ssid,
0212 vif->wdev.u.client.ssid_len);
0213
0214 bss = cfg80211_inform_bss(wiphy, chandef.chan,
0215 CFG80211_BSS_FTYPE_UNKNOWN,
0216 join_info->bssid, 0,
0217 WLAN_CAPABILITY_ESS, 100,
0218 ie, 2 + vif->wdev.u.client.ssid_len,
0219 0, GFP_KERNEL);
0220 if (!bss) {
0221 pr_warn("VIF%u.%u: can't connect to unknown BSS: %pM\n",
0222 vif->mac->macid, vif->vifid,
0223 join_info->bssid);
0224 status = WLAN_STATUS_UNSPECIFIED_FAILURE;
0225 goto done;
0226 }
0227 }
0228
0229 payload_len = len - sizeof(*join_info);
0230
0231 qlink_for_each_tlv(tlv, join_info->ies, payload_len) {
0232 tlv_type = le16_to_cpu(tlv->type);
0233 tlv_value_len = le16_to_cpu(tlv->len);
0234
0235 if (tlv_type == QTN_TLV_ID_IE_SET) {
0236 const struct qlink_tlv_ie_set *ie_set;
0237 unsigned int ie_len;
0238
0239 if (tlv_value_len <
0240 (sizeof(*ie_set) - sizeof(ie_set->hdr))) {
0241 pr_warn("invalid IE_SET TLV\n");
0242 status = WLAN_STATUS_UNSPECIFIED_FAILURE;
0243 goto done;
0244 }
0245
0246 ie_set = (const struct qlink_tlv_ie_set *)tlv;
0247 ie_len = tlv_value_len -
0248 (sizeof(*ie_set) - sizeof(ie_set->hdr));
0249
0250 switch (ie_set->type) {
0251 case QLINK_IE_SET_ASSOC_RESP:
0252 if (ie_len) {
0253 rsp_ies = ie_set->ie_data;
0254 rsp_ies_len = ie_len;
0255 }
0256 break;
0257 default:
0258 pr_warn("unexpected IE type: %u\n",
0259 ie_set->type);
0260 break;
0261 }
0262 }
0263 }
0264
0265 if (!qlink_tlv_parsing_ok(tlv, join_info->ies, payload_len))
0266 pr_warn("Malformed TLV buffer\n");
0267 done:
0268 cfg80211_connect_result(vif->netdev, join_info->bssid, NULL, 0, rsp_ies,
0269 rsp_ies_len, status, GFP_KERNEL);
0270 if (bss) {
0271 if (!ether_addr_equal(vif->bssid, join_info->bssid))
0272 ether_addr_copy(vif->bssid, join_info->bssid);
0273 cfg80211_put_bss(wiphy, bss);
0274 }
0275
0276 if (status == WLAN_STATUS_SUCCESS)
0277 netif_carrier_on(vif->netdev);
0278
0279 kfree(ie);
0280 return 0;
0281 }
0282
0283 static int
0284 qtnf_event_handle_bss_leave(struct qtnf_vif *vif,
0285 const struct qlink_event_bss_leave *leave_info,
0286 u16 len)
0287 {
0288 if (unlikely(len < sizeof(*leave_info))) {
0289 pr_err("VIF%u.%u: payload is too short (%u < %zu)\n",
0290 vif->mac->macid, vif->vifid, len,
0291 sizeof(struct qlink_event_bss_leave));
0292 return -EINVAL;
0293 }
0294
0295 if (vif->wdev.iftype != NL80211_IFTYPE_STATION) {
0296 pr_err("VIF%u.%u: BSS_LEAVE event when not in STA mode\n",
0297 vif->mac->macid, vif->vifid);
0298 return -EPROTO;
0299 }
0300
0301 pr_debug("VIF%u.%u: disconnected\n", vif->mac->macid, vif->vifid);
0302
0303 cfg80211_disconnected(vif->netdev, le16_to_cpu(leave_info->reason),
0304 NULL, 0, 0, GFP_KERNEL);
0305 netif_carrier_off(vif->netdev);
0306
0307 return 0;
0308 }
0309
0310 static int
0311 qtnf_event_handle_mgmt_received(struct qtnf_vif *vif,
0312 const struct qlink_event_rxmgmt *rxmgmt,
0313 u16 len)
0314 {
0315 const size_t min_len = sizeof(*rxmgmt) +
0316 sizeof(struct ieee80211_hdr_3addr);
0317 const struct ieee80211_hdr_3addr *frame = (void *)rxmgmt->frame_data;
0318 const u16 frame_len = len - sizeof(*rxmgmt);
0319 enum nl80211_rxmgmt_flags flags = 0;
0320
0321 if (unlikely(len < min_len)) {
0322 pr_err("VIF%u.%u: payload is too short (%u < %zu)\n",
0323 vif->mac->macid, vif->vifid, len, min_len);
0324 return -EINVAL;
0325 }
0326
0327 if (le32_to_cpu(rxmgmt->flags) & QLINK_RXMGMT_FLAG_ANSWERED)
0328 flags |= NL80211_RXMGMT_FLAG_ANSWERED;
0329
0330 pr_debug("%s LEN:%u FC:%.4X SA:%pM\n", vif->netdev->name, frame_len,
0331 le16_to_cpu(frame->frame_control), frame->addr2);
0332
0333 cfg80211_rx_mgmt(&vif->wdev, le32_to_cpu(rxmgmt->freq), rxmgmt->sig_dbm,
0334 rxmgmt->frame_data, frame_len, flags);
0335
0336 return 0;
0337 }
0338
0339 static int
0340 qtnf_event_handle_scan_results(struct qtnf_vif *vif,
0341 const struct qlink_event_scan_result *sr,
0342 u16 len)
0343 {
0344 struct cfg80211_bss *bss;
0345 struct ieee80211_channel *channel;
0346 struct wiphy *wiphy = priv_to_wiphy(vif->mac);
0347 enum cfg80211_bss_frame_type frame_type = CFG80211_BSS_FTYPE_UNKNOWN;
0348 size_t payload_len;
0349 u16 tlv_type;
0350 u16 tlv_value_len;
0351 const struct qlink_tlv_hdr *tlv;
0352 const u8 *ies = NULL;
0353 size_t ies_len = 0;
0354
0355 if (len < sizeof(*sr)) {
0356 pr_err("VIF%u.%u: payload is too short\n", vif->mac->macid,
0357 vif->vifid);
0358 return -EINVAL;
0359 }
0360
0361 channel = ieee80211_get_channel(wiphy, le16_to_cpu(sr->freq));
0362 if (!channel) {
0363 pr_err("VIF%u.%u: channel at %u MHz not found\n",
0364 vif->mac->macid, vif->vifid, le16_to_cpu(sr->freq));
0365 return -EINVAL;
0366 }
0367
0368 payload_len = len - sizeof(*sr);
0369
0370 qlink_for_each_tlv(tlv, sr->payload, payload_len) {
0371 tlv_type = le16_to_cpu(tlv->type);
0372 tlv_value_len = le16_to_cpu(tlv->len);
0373
0374 if (tlv_type == QTN_TLV_ID_IE_SET) {
0375 const struct qlink_tlv_ie_set *ie_set;
0376 unsigned int ie_len;
0377
0378 if (tlv_value_len <
0379 (sizeof(*ie_set) - sizeof(ie_set->hdr)))
0380 return -EINVAL;
0381
0382 ie_set = (const struct qlink_tlv_ie_set *)tlv;
0383 ie_len = tlv_value_len -
0384 (sizeof(*ie_set) - sizeof(ie_set->hdr));
0385
0386 switch (ie_set->type) {
0387 case QLINK_IE_SET_BEACON_IES:
0388 frame_type = CFG80211_BSS_FTYPE_BEACON;
0389 break;
0390 case QLINK_IE_SET_PROBE_RESP_IES:
0391 frame_type = CFG80211_BSS_FTYPE_PRESP;
0392 break;
0393 default:
0394 frame_type = CFG80211_BSS_FTYPE_UNKNOWN;
0395 }
0396
0397 if (ie_len) {
0398 ies = ie_set->ie_data;
0399 ies_len = ie_len;
0400 }
0401 }
0402 }
0403
0404 if (!qlink_tlv_parsing_ok(tlv, sr->payload, payload_len))
0405 return -EINVAL;
0406
0407 bss = cfg80211_inform_bss(wiphy, channel, frame_type,
0408 sr->bssid, get_unaligned_le64(&sr->tsf),
0409 le16_to_cpu(sr->capab),
0410 le16_to_cpu(sr->bintval), ies, ies_len,
0411 DBM_TO_MBM(sr->sig_dbm), GFP_KERNEL);
0412 if (!bss)
0413 return -ENOMEM;
0414
0415 cfg80211_put_bss(wiphy, bss);
0416
0417 return 0;
0418 }
0419
0420 static int
0421 qtnf_event_handle_scan_complete(struct qtnf_wmac *mac,
0422 const struct qlink_event_scan_complete *status,
0423 u16 len)
0424 {
0425 if (len < sizeof(*status)) {
0426 pr_err("MAC%u: payload is too short\n", mac->macid);
0427 return -EINVAL;
0428 }
0429
0430 qtnf_scan_done(mac, le32_to_cpu(status->flags) & QLINK_SCAN_ABORTED);
0431
0432 return 0;
0433 }
0434
0435 static int
0436 qtnf_event_handle_freq_change(struct qtnf_wmac *mac,
0437 const struct qlink_event_freq_change *data,
0438 u16 len)
0439 {
0440 struct wiphy *wiphy = priv_to_wiphy(mac);
0441 struct cfg80211_chan_def chandef;
0442 struct qtnf_vif *vif;
0443 int i;
0444
0445 if (len < sizeof(*data)) {
0446 pr_err("MAC%u: payload is too short\n", mac->macid);
0447 return -EINVAL;
0448 }
0449
0450 if (!wiphy->registered)
0451 return 0;
0452
0453 qlink_chandef_q2cfg(wiphy, &data->chan, &chandef);
0454
0455 if (!cfg80211_chandef_valid(&chandef)) {
0456 pr_err("MAC%u: bad channel freq=%u cf1=%u cf2=%u bw=%u\n",
0457 mac->macid, chandef.chan->center_freq,
0458 chandef.center_freq1, chandef.center_freq2,
0459 chandef.width);
0460 return -EINVAL;
0461 }
0462
0463 pr_debug("MAC%d: new channel ieee=%u freq1=%u freq2=%u bw=%u\n",
0464 mac->macid, chandef.chan->hw_value, chandef.center_freq1,
0465 chandef.center_freq2, chandef.width);
0466
0467 for (i = 0; i < QTNF_MAX_INTF; i++) {
0468 vif = &mac->iflist[i];
0469
0470 if (vif->wdev.iftype == NL80211_IFTYPE_UNSPECIFIED)
0471 continue;
0472
0473 if (vif->wdev.iftype == NL80211_IFTYPE_STATION &&
0474 !vif->wdev.connected)
0475 continue;
0476
0477 if (!vif->netdev)
0478 continue;
0479
0480 mutex_lock(&vif->wdev.mtx);
0481 cfg80211_ch_switch_notify(vif->netdev, &chandef, 0);
0482 mutex_unlock(&vif->wdev.mtx);
0483 }
0484
0485 return 0;
0486 }
0487
0488 static int qtnf_event_handle_radar(struct qtnf_vif *vif,
0489 const struct qlink_event_radar *ev,
0490 u16 len)
0491 {
0492 struct wiphy *wiphy = priv_to_wiphy(vif->mac);
0493 struct cfg80211_chan_def chandef;
0494
0495 if (len < sizeof(*ev)) {
0496 pr_err("MAC%u: payload is too short\n", vif->mac->macid);
0497 return -EINVAL;
0498 }
0499
0500 if (!wiphy->registered || !vif->netdev)
0501 return 0;
0502
0503 qlink_chandef_q2cfg(wiphy, &ev->chan, &chandef);
0504
0505 if (!cfg80211_chandef_valid(&chandef)) {
0506 pr_err("MAC%u: bad channel f1=%u f2=%u bw=%u\n",
0507 vif->mac->macid,
0508 chandef.center_freq1, chandef.center_freq2,
0509 chandef.width);
0510 return -EINVAL;
0511 }
0512
0513 pr_info("%s: radar event=%u f1=%u f2=%u bw=%u\n",
0514 vif->netdev->name, ev->event,
0515 chandef.center_freq1, chandef.center_freq2,
0516 chandef.width);
0517
0518 switch (ev->event) {
0519 case QLINK_RADAR_DETECTED:
0520 cfg80211_radar_event(wiphy, &chandef, GFP_KERNEL);
0521 break;
0522 case QLINK_RADAR_CAC_FINISHED:
0523 if (!vif->wdev.cac_started)
0524 break;
0525
0526 cfg80211_cac_event(vif->netdev, &chandef,
0527 NL80211_RADAR_CAC_FINISHED, GFP_KERNEL);
0528 break;
0529 case QLINK_RADAR_CAC_ABORTED:
0530 if (!vif->wdev.cac_started)
0531 break;
0532
0533 cfg80211_cac_event(vif->netdev, &chandef,
0534 NL80211_RADAR_CAC_ABORTED, GFP_KERNEL);
0535 break;
0536 case QLINK_RADAR_CAC_STARTED:
0537 if (vif->wdev.cac_started)
0538 break;
0539
0540 if (!wiphy_ext_feature_isset(wiphy,
0541 NL80211_EXT_FEATURE_DFS_OFFLOAD))
0542 break;
0543
0544 cfg80211_cac_event(vif->netdev, &chandef,
0545 NL80211_RADAR_CAC_STARTED, GFP_KERNEL);
0546 break;
0547 default:
0548 pr_warn("%s: unhandled radar event %u\n",
0549 vif->netdev->name, ev->event);
0550 break;
0551 }
0552
0553 return 0;
0554 }
0555
0556 static int
0557 qtnf_event_handle_external_auth(struct qtnf_vif *vif,
0558 const struct qlink_event_external_auth *ev,
0559 u16 len)
0560 {
0561 struct cfg80211_external_auth_params auth = {0};
0562 struct wiphy *wiphy = priv_to_wiphy(vif->mac);
0563 int ret;
0564
0565 if (len < sizeof(*ev)) {
0566 pr_err("MAC%u: payload is too short\n", vif->mac->macid);
0567 return -EINVAL;
0568 }
0569
0570 if (!wiphy->registered || !vif->netdev)
0571 return 0;
0572
0573 if (ev->ssid_len) {
0574 int len = clamp_val(ev->ssid_len, 0, IEEE80211_MAX_SSID_LEN);
0575
0576 memcpy(auth.ssid.ssid, ev->ssid, len);
0577 auth.ssid.ssid_len = len;
0578 }
0579
0580 auth.key_mgmt_suite = le32_to_cpu(ev->akm_suite);
0581 ether_addr_copy(auth.bssid, ev->bssid);
0582 auth.action = ev->action;
0583
0584 pr_debug("%s: external SAE processing: bss=%pM action=%u akm=%u\n",
0585 vif->netdev->name, auth.bssid, auth.action,
0586 auth.key_mgmt_suite);
0587
0588 ret = cfg80211_external_auth_request(vif->netdev, &auth, GFP_KERNEL);
0589 if (ret)
0590 pr_warn("failed to offload external auth request\n");
0591
0592 return ret;
0593 }
0594
0595 static int
0596 qtnf_event_handle_mic_failure(struct qtnf_vif *vif,
0597 const struct qlink_event_mic_failure *mic_ev,
0598 u16 len)
0599 {
0600 struct wiphy *wiphy = priv_to_wiphy(vif->mac);
0601 u8 pairwise;
0602
0603 if (len < sizeof(*mic_ev)) {
0604 pr_err("VIF%u.%u: payload is too short (%u < %zu)\n",
0605 vif->mac->macid, vif->vifid, len,
0606 sizeof(struct qlink_event_mic_failure));
0607 return -EINVAL;
0608 }
0609
0610 if (!wiphy->registered || !vif->netdev)
0611 return 0;
0612
0613 if (vif->wdev.iftype != NL80211_IFTYPE_STATION) {
0614 pr_err("VIF%u.%u: MIC_FAILURE event when not in STA mode\n",
0615 vif->mac->macid, vif->vifid);
0616 return -EPROTO;
0617 }
0618
0619 pairwise = mic_ev->pairwise ?
0620 NL80211_KEYTYPE_PAIRWISE : NL80211_KEYTYPE_GROUP;
0621
0622 pr_info("%s: MIC error: src=%pM key_index=%u pairwise=%u\n",
0623 vif->netdev->name, mic_ev->src, mic_ev->key_index, pairwise);
0624
0625 cfg80211_michael_mic_failure(vif->netdev, mic_ev->src, pairwise,
0626 mic_ev->key_index, NULL, GFP_KERNEL);
0627
0628 return 0;
0629 }
0630
0631 static int
0632 qtnf_event_handle_update_owe(struct qtnf_vif *vif,
0633 const struct qlink_event_update_owe *owe_ev,
0634 u16 len)
0635 {
0636 struct wiphy *wiphy = priv_to_wiphy(vif->mac);
0637 struct cfg80211_update_owe_info owe_info = {};
0638 const u16 ie_len = len - sizeof(*owe_ev);
0639 u8 *ie;
0640
0641 if (len < sizeof(*owe_ev)) {
0642 pr_err("VIF%u.%u: payload is too short (%u < %zu)\n",
0643 vif->mac->macid, vif->vifid, len,
0644 sizeof(struct qlink_event_update_owe));
0645 return -EINVAL;
0646 }
0647
0648 if (!wiphy->registered || !vif->netdev)
0649 return 0;
0650
0651 if (vif->wdev.iftype != NL80211_IFTYPE_AP) {
0652 pr_err("VIF%u.%u: UPDATE_OWE event when not in AP mode\n",
0653 vif->mac->macid, vif->vifid);
0654 return -EPROTO;
0655 }
0656
0657 ie = kzalloc(ie_len, GFP_KERNEL);
0658 if (!ie)
0659 return -ENOMEM;
0660
0661 memcpy(owe_info.peer, owe_ev->peer, ETH_ALEN);
0662 memcpy(ie, owe_ev->ies, ie_len);
0663 owe_info.ie_len = ie_len;
0664 owe_info.ie = ie;
0665
0666 pr_info("%s: external OWE processing: peer=%pM\n",
0667 vif->netdev->name, owe_ev->peer);
0668
0669 cfg80211_update_owe_info_event(vif->netdev, &owe_info, GFP_KERNEL);
0670 kfree(ie);
0671
0672 return 0;
0673 }
0674
0675 static int qtnf_event_parse(struct qtnf_wmac *mac,
0676 const struct sk_buff *event_skb)
0677 {
0678 const struct qlink_event *event;
0679 struct qtnf_vif *vif = NULL;
0680 int ret = -1;
0681 u16 event_id;
0682 u16 event_len;
0683 u8 vifid;
0684
0685 event = (const struct qlink_event *)event_skb->data;
0686 event_id = le16_to_cpu(event->event_id);
0687 event_len = le16_to_cpu(event->mhdr.len);
0688
0689 if (event->vifid >= QTNF_MAX_INTF) {
0690 pr_err("invalid vif(%u)\n", event->vifid);
0691 return -EINVAL;
0692 }
0693
0694 vifid = array_index_nospec(event->vifid, QTNF_MAX_INTF);
0695 vif = &mac->iflist[vifid];
0696
0697 switch (event_id) {
0698 case QLINK_EVENT_STA_ASSOCIATED:
0699 ret = qtnf_event_handle_sta_assoc(mac, vif, (const void *)event,
0700 event_len);
0701 break;
0702 case QLINK_EVENT_STA_DEAUTH:
0703 ret = qtnf_event_handle_sta_deauth(mac, vif,
0704 (const void *)event,
0705 event_len);
0706 break;
0707 case QLINK_EVENT_MGMT_RECEIVED:
0708 ret = qtnf_event_handle_mgmt_received(vif, (const void *)event,
0709 event_len);
0710 break;
0711 case QLINK_EVENT_SCAN_RESULTS:
0712 ret = qtnf_event_handle_scan_results(vif, (const void *)event,
0713 event_len);
0714 break;
0715 case QLINK_EVENT_SCAN_COMPLETE:
0716 ret = qtnf_event_handle_scan_complete(mac, (const void *)event,
0717 event_len);
0718 break;
0719 case QLINK_EVENT_BSS_JOIN:
0720 ret = qtnf_event_handle_bss_join(vif, (const void *)event,
0721 event_len);
0722 break;
0723 case QLINK_EVENT_BSS_LEAVE:
0724 ret = qtnf_event_handle_bss_leave(vif, (const void *)event,
0725 event_len);
0726 break;
0727 case QLINK_EVENT_FREQ_CHANGE:
0728 ret = qtnf_event_handle_freq_change(mac, (const void *)event,
0729 event_len);
0730 break;
0731 case QLINK_EVENT_RADAR:
0732 ret = qtnf_event_handle_radar(vif, (const void *)event,
0733 event_len);
0734 break;
0735 case QLINK_EVENT_EXTERNAL_AUTH:
0736 ret = qtnf_event_handle_external_auth(vif, (const void *)event,
0737 event_len);
0738 break;
0739 case QLINK_EVENT_MIC_FAILURE:
0740 ret = qtnf_event_handle_mic_failure(vif, (const void *)event,
0741 event_len);
0742 break;
0743 case QLINK_EVENT_UPDATE_OWE:
0744 ret = qtnf_event_handle_update_owe(vif, (const void *)event,
0745 event_len);
0746 break;
0747 default:
0748 pr_warn("unknown event type: %x\n", event_id);
0749 break;
0750 }
0751
0752 return ret;
0753 }
0754
0755 static int qtnf_event_process_skb(struct qtnf_bus *bus,
0756 const struct sk_buff *skb)
0757 {
0758 const struct qlink_event *event;
0759 struct qtnf_wmac *mac;
0760 int res;
0761
0762 if (unlikely(!skb || skb->len < sizeof(*event))) {
0763 pr_err("invalid event buffer\n");
0764 return -EINVAL;
0765 }
0766
0767 event = (struct qlink_event *)skb->data;
0768
0769 mac = qtnf_core_get_mac(bus, event->macid);
0770
0771 pr_debug("new event id:%x len:%u mac:%u vif:%u\n",
0772 le16_to_cpu(event->event_id), le16_to_cpu(event->mhdr.len),
0773 event->macid, event->vifid);
0774
0775 if (unlikely(!mac))
0776 return -ENXIO;
0777
0778 rtnl_lock();
0779 res = qtnf_event_parse(mac, skb);
0780 rtnl_unlock();
0781
0782 return res;
0783 }
0784
0785 void qtnf_event_work_handler(struct work_struct *work)
0786 {
0787 struct qtnf_bus *bus = container_of(work, struct qtnf_bus, event_work);
0788 struct sk_buff_head *event_queue = &bus->trans.event_queue;
0789 struct sk_buff *current_event_skb = skb_dequeue(event_queue);
0790
0791 while (current_event_skb) {
0792 qtnf_event_process_skb(bus, current_event_skb);
0793 dev_kfree_skb_any(current_event_skb);
0794 current_event_skb = skb_dequeue(event_queue);
0795 }
0796 }
