1 // SPDX-License-Identifier: GPL-2.0+
2 /* Copyright (c) 2015-2016 Quantenna Communications. All rights reserved. */
19 qtnf_event_handle_sta_assoc(struct qtnf_wmac *mac, struct qtnf_vif *vif,  in qtnf_event_handle_sta_assoc()  argument
34 		       mac->macid, vif->vifid, len, sizeof(*sta_assoc));  in qtnf_event_handle_sta_assoc()
35 		return -EINVAL;  in qtnf_event_handle_sta_assoc()
38 	if (vif->wdev.iftype != NL80211_IFTYPE_AP) {  in qtnf_event_handle_sta_assoc()
40 		       mac->macid, vif->vifid);  in qtnf_event_handle_sta_assoc()
41 		return -EPROTO;  in qtnf_event_handle_sta_assoc()
46 		return -ENOMEM;  in qtnf_event_handle_sta_assoc()
48 	sta_addr = sta_assoc->sta_addr;  in qtnf_event_handle_sta_assoc()
49 	frame_control = le16_to_cpu(sta_assoc->frame_control);  in qtnf_event_handle_sta_assoc()
51 	pr_debug("VIF%u.%u: MAC:%pM FC:%x\n", mac->macid, vif->vifid, sta_addr,  in qtnf_event_handle_sta_assoc()
56 	sinfo->assoc_req_ies = NULL;  in qtnf_event_handle_sta_assoc()
57 	sinfo->assoc_req_ies_len = 0;  in qtnf_event_handle_sta_assoc()
58 	sinfo->generation = vif->generation;  in qtnf_event_handle_sta_assoc()
60 	payload_len = len - sizeof(*sta_assoc);  in qtnf_event_handle_sta_assoc()
62 	qlink_for_each_tlv(tlv, sta_assoc->ies, payload_len) {  in qtnf_event_handle_sta_assoc()
63 		tlv_type = le16_to_cpu(tlv->type);  in qtnf_event_handle_sta_assoc()
64 		tlv_value_len = le16_to_cpu(tlv->len);  in qtnf_event_handle_sta_assoc()
71 			    (sizeof(*ie_set) - sizeof(ie_set->hdr))) {  in qtnf_event_handle_sta_assoc()
72 				ret = -EINVAL;  in qtnf_event_handle_sta_assoc()
77 			ie_len = tlv_value_len -  in qtnf_event_handle_sta_assoc()
78 				(sizeof(*ie_set) - sizeof(ie_set->hdr));  in qtnf_event_handle_sta_assoc()
80 			if (ie_set->type == QLINK_IE_SET_ASSOC_REQ && ie_len) {  in qtnf_event_handle_sta_assoc()
81 				sinfo->assoc_req_ies = ie_set->ie_data;  in qtnf_event_handle_sta_assoc()
82 				sinfo->assoc_req_ies_len = ie_len;  in qtnf_event_handle_sta_assoc()
87 	if (!qlink_tlv_parsing_ok(tlv, sta_assoc->ies, payload_len)) {  in qtnf_event_handle_sta_assoc()
89 		ret = -EINVAL;  in qtnf_event_handle_sta_assoc()
93 	cfg80211_new_sta(vif->netdev, sta_assoc->sta_addr, sinfo,  in qtnf_event_handle_sta_assoc()
102 qtnf_event_handle_sta_deauth(struct qtnf_wmac *mac, struct qtnf_vif *vif,  in qtnf_event_handle_sta_deauth()  argument
111 		       mac->macid, vif->vifid, len,  in qtnf_event_handle_sta_deauth()
113 		return -EINVAL;  in qtnf_event_handle_sta_deauth()
116 	if (vif->wdev.iftype != NL80211_IFTYPE_AP) {  in qtnf_event_handle_sta_deauth()
118 		       mac->macid, vif->vifid);  in qtnf_event_handle_sta_deauth()
119 		return -EPROTO;  in qtnf_event_handle_sta_deauth()
122 	sta_addr = sta_deauth->sta_addr;  in qtnf_event_handle_sta_deauth()
123 	reason = le16_to_cpu(sta_deauth->reason);  in qtnf_event_handle_sta_deauth()
125 	pr_debug("VIF%u.%u: MAC:%pM reason:%x\n", mac->macid, vif->vifid,  in qtnf_event_handle_sta_deauth()
129 		cfg80211_del_sta(vif->netdev, sta_deauth->sta_addr,  in qtnf_event_handle_sta_deauth()
140 	struct wiphy *wiphy = priv_to_wiphy(vif->mac);  in qtnf_event_handle_bss_join()
141 	enum ieee80211_statuscode status = le16_to_cpu(join_info->status);  in qtnf_event_handle_bss_join()
154 		       vif->mac->macid, vif->vifid, len,  in qtnf_event_handle_bss_join()
156 		return -EINVAL;  in qtnf_event_handle_bss_join()
159 	if (vif->wdev.iftype != NL80211_IFTYPE_STATION) {  in qtnf_event_handle_bss_join()
161 		       vif->mac->macid, vif->vifid);  in qtnf_event_handle_bss_join()
162 		return -EPROTO;  in qtnf_event_handle_bss_join()
166 		 vif->mac->macid, vif->vifid, join_info->bssid,  in qtnf_event_handle_bss_join()
167 		 le16_to_cpu(join_info->chan.chan.center_freq), status);  in qtnf_event_handle_bss_join()
172 	qlink_chandef_q2cfg(wiphy, &join_info->chan, &chandef);  in qtnf_event_handle_bss_join()
174 		pr_warn("MAC%u.%u: bad channel freq=%u cf1=%u cf2=%u bw=%u\n",  in qtnf_event_handle_bss_join()
175 			vif->mac->macid, vif->vifid,  in qtnf_event_handle_bss_join()
176 			chandef.chan ? chandef.chan->center_freq : 0,  in qtnf_event_handle_bss_join()
184 	bss = cfg80211_get_bss(wiphy, chandef.chan, join_info->bssid,  in qtnf_event_handle_bss_join()
189 			vif->mac->macid, vif->vifid,  in qtnf_event_handle_bss_join()
190 			join_info->bssid, chandef.chan->hw_value);  in qtnf_event_handle_bss_join()
192 		if (!vif->wdev.u.client.ssid_len) {  in qtnf_event_handle_bss_join()
194 				vif->mac->macid, vif->vifid,  in qtnf_event_handle_bss_join()
195 				join_info->bssid);  in qtnf_event_handle_bss_join()
200 		ie = kzalloc(2 + vif->wdev.u.client.ssid_len, GFP_KERNEL);  in qtnf_event_handle_bss_join()
203 				vif->mac->macid, vif->vifid,  in qtnf_event_handle_bss_join()
204 				join_info->bssid);  in qtnf_event_handle_bss_join()
210 		ie[1] = vif->wdev.u.client.ssid_len;  in qtnf_event_handle_bss_join()
211 		memcpy(ie + 2, vif->wdev.u.client.ssid,  in qtnf_event_handle_bss_join()
212 		       vif->wdev.u.client.ssid_len);  in qtnf_event_handle_bss_join()
216 					  join_info->bssid, 0,  in qtnf_event_handle_bss_join()
218 					  ie, 2 + vif->wdev.u.client.ssid_len,  in qtnf_event_handle_bss_join()
222 				vif->mac->macid, vif->vifid,  in qtnf_event_handle_bss_join()
223 				join_info->bssid);  in qtnf_event_handle_bss_join()
229 	payload_len = len - sizeof(*join_info);  in qtnf_event_handle_bss_join()
231 	qlink_for_each_tlv(tlv, join_info->ies, payload_len) {  in qtnf_event_handle_bss_join()
232 		tlv_type = le16_to_cpu(tlv->type);  in qtnf_event_handle_bss_join()
233 		tlv_value_len = le16_to_cpu(tlv->len);  in qtnf_event_handle_bss_join()
240 			    (sizeof(*ie_set) - sizeof(ie_set->hdr))) {  in qtnf_event_handle_bss_join()
247 			ie_len = tlv_value_len -  in qtnf_event_handle_bss_join()
248 				(sizeof(*ie_set) - sizeof(ie_set->hdr));  in qtnf_event_handle_bss_join()
250 			switch (ie_set->type) {  in qtnf_event_handle_bss_join()
253 					rsp_ies = ie_set->ie_data;  in qtnf_event_handle_bss_join()
259 					ie_set->type);  in qtnf_event_handle_bss_join()
265 	if (!qlink_tlv_parsing_ok(tlv, join_info->ies, payload_len))  in qtnf_event_handle_bss_join()
268 	cfg80211_connect_result(vif->netdev, join_info->bssid, NULL, 0, rsp_ies,  in qtnf_event_handle_bss_join()
271 		if (!ether_addr_equal(vif->bssid, join_info->bssid))  in qtnf_event_handle_bss_join()
272 			ether_addr_copy(vif->bssid, join_info->bssid);  in qtnf_event_handle_bss_join()
277 		netif_carrier_on(vif->netdev);  in qtnf_event_handle_bss_join()
290 		       vif->mac->macid, vif->vifid, len,  in qtnf_event_handle_bss_leave()
292 		return -EINVAL;  in qtnf_event_handle_bss_leave()
295 	if (vif->wdev.iftype != NL80211_IFTYPE_STATION) {  in qtnf_event_handle_bss_leave()
297 		       vif->mac->macid, vif->vifid);  in qtnf_event_handle_bss_leave()
298 		return -EPROTO;  in qtnf_event_handle_bss_leave()
301 	pr_debug("VIF%u.%u: disconnected\n", vif->mac->macid, vif->vifid);  in qtnf_event_handle_bss_leave()
303 	cfg80211_disconnected(vif->netdev, le16_to_cpu(leave_info->reason),  in qtnf_event_handle_bss_leave()
305 	netif_carrier_off(vif->netdev);  in qtnf_event_handle_bss_leave()
317 	const struct ieee80211_hdr_3addr *frame = (void *)rxmgmt->frame_data;  in qtnf_event_handle_mgmt_received()
318 	const u16 frame_len = len - sizeof(*rxmgmt);  in qtnf_event_handle_mgmt_received()
323 		       vif->mac->macid, vif->vifid, len, min_len);  in qtnf_event_handle_mgmt_received()
324 		return -EINVAL;  in qtnf_event_handle_mgmt_received()
327 	if (le32_to_cpu(rxmgmt->flags) & QLINK_RXMGMT_FLAG_ANSWERED)  in qtnf_event_handle_mgmt_received()
330 	pr_debug("%s LEN:%u FC:%.4X SA:%pM\n", vif->netdev->name, frame_len,  in qtnf_event_handle_mgmt_received()
331 		 le16_to_cpu(frame->frame_control), frame->addr2);  in qtnf_event_handle_mgmt_received()
333 	cfg80211_rx_mgmt(&vif->wdev, le32_to_cpu(rxmgmt->freq), rxmgmt->sig_dbm,  in qtnf_event_handle_mgmt_received()
334 			 rxmgmt->frame_data, frame_len, flags);  in qtnf_event_handle_mgmt_received()
346 	struct wiphy *wiphy = priv_to_wiphy(vif->mac);  in qtnf_event_handle_scan_results()
356 		pr_err("VIF%u.%u: payload is too short\n", vif->mac->macid,  in qtnf_event_handle_scan_results()
357 		       vif->vifid);  in qtnf_event_handle_scan_results()
358 		return -EINVAL;  in qtnf_event_handle_scan_results()
361 	channel = ieee80211_get_channel(wiphy, le16_to_cpu(sr->freq));  in qtnf_event_handle_scan_results()
364 		       vif->mac->macid, vif->vifid, le16_to_cpu(sr->freq));  in qtnf_event_handle_scan_results()
365 		return -EINVAL;  in qtnf_event_handle_scan_results()
368 	payload_len = len - sizeof(*sr);  in qtnf_event_handle_scan_results()
370 	qlink_for_each_tlv(tlv, sr->payload, payload_len) {  in qtnf_event_handle_scan_results()
371 		tlv_type = le16_to_cpu(tlv->type);  in qtnf_event_handle_scan_results()
372 		tlv_value_len = le16_to_cpu(tlv->len);  in qtnf_event_handle_scan_results()
379 			    (sizeof(*ie_set) - sizeof(ie_set->hdr)))  in qtnf_event_handle_scan_results()
380 				return -EINVAL;  in qtnf_event_handle_scan_results()
383 			ie_len = tlv_value_len -  in qtnf_event_handle_scan_results()
384 				(sizeof(*ie_set) - sizeof(ie_set->hdr));  in qtnf_event_handle_scan_results()
386 			switch (ie_set->type) {  in qtnf_event_handle_scan_results()
398 				ies = ie_set->ie_data;  in qtnf_event_handle_scan_results()
404 	if (!qlink_tlv_parsing_ok(tlv, sr->payload, payload_len))  in qtnf_event_handle_scan_results()
405 		return -EINVAL;  in qtnf_event_handle_scan_results()
408 				  sr->bssid, get_unaligned_le64(&sr->tsf),  in qtnf_event_handle_scan_results()
409 				  le16_to_cpu(sr->capab),  in qtnf_event_handle_scan_results()
410 				  le16_to_cpu(sr->bintval), ies, ies_len,  in qtnf_event_handle_scan_results()
411 				  DBM_TO_MBM(sr->sig_dbm), GFP_KERNEL);  in qtnf_event_handle_scan_results()
413 		return -ENOMEM;  in qtnf_event_handle_scan_results()
421 qtnf_event_handle_scan_complete(struct qtnf_wmac *mac,  in qtnf_event_handle_scan_complete()  argument
426 		pr_err("MAC%u: payload is too short\n", mac->macid);  in qtnf_event_handle_scan_complete()
427 		return -EINVAL;  in qtnf_event_handle_scan_complete()
430 	qtnf_scan_done(mac, le32_to_cpu(status->flags) & QLINK_SCAN_ABORTED);  in qtnf_event_handle_scan_complete()
436 qtnf_event_handle_freq_change(struct qtnf_wmac *mac,  in qtnf_event_handle_freq_change()  argument
440 	struct wiphy *wiphy = priv_to_wiphy(mac);  in qtnf_event_handle_freq_change()
446 		pr_err("MAC%u: payload is too short\n", mac->macid);  in qtnf_event_handle_freq_change()
447 		return -EINVAL;  in qtnf_event_handle_freq_change()
450 	if (!wiphy->registered)  in qtnf_event_handle_freq_change()
453 	qlink_chandef_q2cfg(wiphy, &data->chan, &chandef);  in qtnf_event_handle_freq_change()
456 		pr_err("MAC%u: bad channel freq=%u cf1=%u cf2=%u bw=%u\n",  in qtnf_event_handle_freq_change()
457 		       mac->macid, chandef.chan->center_freq,  in qtnf_event_handle_freq_change()
460 		return -EINVAL;  in qtnf_event_handle_freq_change()
463 	pr_debug("MAC%d: new channel ieee=%u freq1=%u freq2=%u bw=%u\n",  in qtnf_event_handle_freq_change()
464 		 mac->macid, chandef.chan->hw_value, chandef.center_freq1,  in qtnf_event_handle_freq_change()
468 		vif = &mac->iflist[i];  in qtnf_event_handle_freq_change()
470 		if (vif->wdev.iftype == NL80211_IFTYPE_UNSPECIFIED)  in qtnf_event_handle_freq_change()
473 		if (vif->wdev.iftype == NL80211_IFTYPE_STATION &&  in qtnf_event_handle_freq_change()
474 		    !vif->wdev.connected)  in qtnf_event_handle_freq_change()
477 		if (!vif->netdev)  in qtnf_event_handle_freq_change()
480 		wiphy_lock(priv_to_wiphy(vif->mac));  in qtnf_event_handle_freq_change()
481 		cfg80211_ch_switch_notify(vif->netdev, &chandef, 0);  in qtnf_event_handle_freq_change()
482 		wiphy_unlock(priv_to_wiphy(vif->mac));  in qtnf_event_handle_freq_change()
492 	struct wiphy *wiphy = priv_to_wiphy(vif->mac);  in qtnf_event_handle_radar()
496 		pr_err("MAC%u: payload is too short\n", vif->mac->macid);  in qtnf_event_handle_radar()
497 		return -EINVAL;  in qtnf_event_handle_radar()
500 	if (!wiphy->registered || !vif->netdev)  in qtnf_event_handle_radar()
503 	qlink_chandef_q2cfg(wiphy, &ev->chan, &chandef);  in qtnf_event_handle_radar()
506 		pr_err("MAC%u: bad channel f1=%u f2=%u bw=%u\n",  in qtnf_event_handle_radar()
507 		       vif->mac->macid,  in qtnf_event_handle_radar()
510 		return -EINVAL;  in qtnf_event_handle_radar()
513 	pr_info("%s: radar event=%u f1=%u f2=%u bw=%u\n",  in qtnf_event_handle_radar()
514 		vif->netdev->name, ev->event,  in qtnf_event_handle_radar()
518 	switch (ev->event) {  in qtnf_event_handle_radar()
523 		if (!vif->wdev.links[0].cac_started)  in qtnf_event_handle_radar()
526 		cfg80211_cac_event(vif->netdev, &chandef,  in qtnf_event_handle_radar()
530 		if (!vif->wdev.links[0].cac_started)  in qtnf_event_handle_radar()
533 		cfg80211_cac_event(vif->netdev, &chandef,  in qtnf_event_handle_radar()
537 		if (vif->wdev.links[0].cac_started)  in qtnf_event_handle_radar()
544 		cfg80211_cac_event(vif->netdev, &chandef,  in qtnf_event_handle_radar()
548 		pr_warn("%s: unhandled radar event %u\n",  in qtnf_event_handle_radar()
549 			vif->netdev->name, ev->event);  in qtnf_event_handle_radar()
562 	struct wiphy *wiphy = priv_to_wiphy(vif->mac);  in qtnf_event_handle_external_auth()
566 		pr_err("MAC%u: payload is too short\n", vif->mac->macid);  in qtnf_event_handle_external_auth()
567 		return -EINVAL;  in qtnf_event_handle_external_auth()
570 	if (!wiphy->registered || !vif->netdev)  in qtnf_event_handle_external_auth()
573 	if (ev->ssid_len) {  in qtnf_event_handle_external_auth()
574 		int len = clamp_val(ev->ssid_len, 0, IEEE80211_MAX_SSID_LEN);  in qtnf_event_handle_external_auth()
576 		memcpy(auth.ssid.ssid, ev->ssid, len);  in qtnf_event_handle_external_auth()
580 	auth.key_mgmt_suite = le32_to_cpu(ev->akm_suite);  in qtnf_event_handle_external_auth()
581 	ether_addr_copy(auth.bssid, ev->bssid);  in qtnf_event_handle_external_auth()
582 	auth.action = ev->action;  in qtnf_event_handle_external_auth()
584 	pr_debug("%s: external SAE processing: bss=%pM action=%u akm=%u\n",  in qtnf_event_handle_external_auth()
585 		 vif->netdev->name, auth.bssid, auth.action,  in qtnf_event_handle_external_auth()
588 	ret = cfg80211_external_auth_request(vif->netdev, &auth, GFP_KERNEL);  in qtnf_event_handle_external_auth()
600 	struct wiphy *wiphy = priv_to_wiphy(vif->mac);  in qtnf_event_handle_mic_failure()
605 		       vif->mac->macid, vif->vifid, len,  in qtnf_event_handle_mic_failure()
607 		return -EINVAL;  in qtnf_event_handle_mic_failure()
610 	if (!wiphy->registered || !vif->netdev)  in qtnf_event_handle_mic_failure()
613 	if (vif->wdev.iftype != NL80211_IFTYPE_STATION) {  in qtnf_event_handle_mic_failure()
615 		       vif->mac->macid, vif->vifid);  in qtnf_event_handle_mic_failure()
616 		return -EPROTO;  in qtnf_event_handle_mic_failure()
619 	pairwise = mic_ev->pairwise ?  in qtnf_event_handle_mic_failure()
622 	pr_info("%s: MIC error: src=%pM key_index=%u pairwise=%u\n",  in qtnf_event_handle_mic_failure()
623 		vif->netdev->name, mic_ev->src, mic_ev->key_index, pairwise);  in qtnf_event_handle_mic_failure()
625 	cfg80211_michael_mic_failure(vif->netdev, mic_ev->src, pairwise,  in qtnf_event_handle_mic_failure()
626 				     mic_ev->key_index, NULL, GFP_KERNEL);  in qtnf_event_handle_mic_failure()
636 	struct wiphy *wiphy = priv_to_wiphy(vif->mac);  in qtnf_event_handle_update_owe()
638 	const u16 ie_len = len - sizeof(*owe_ev);  in qtnf_event_handle_update_owe()
643 		       vif->mac->macid, vif->vifid, len,  in qtnf_event_handle_update_owe()
645 		return -EINVAL;  in qtnf_event_handle_update_owe()
648 	if (!wiphy->registered || !vif->netdev)  in qtnf_event_handle_update_owe()
651 	if (vif->wdev.iftype != NL80211_IFTYPE_AP) {  in qtnf_event_handle_update_owe()
653 		       vif->mac->macid, vif->vifid);  in qtnf_event_handle_update_owe()
654 		return -EPROTO;  in qtnf_event_handle_update_owe()
659 		return -ENOMEM;  in qtnf_event_handle_update_owe()
661 	memcpy(owe_info.peer, owe_ev->peer, ETH_ALEN);  in qtnf_event_handle_update_owe()
662 	memcpy(ie, owe_ev->ies, ie_len);  in qtnf_event_handle_update_owe()
665 	owe_info.assoc_link_id = -1;  in qtnf_event_handle_update_owe()
667 	pr_info("%s: external OWE processing: peer=%pM\n",  in qtnf_event_handle_update_owe()
668 		vif->netdev->name, owe_ev->peer);  in qtnf_event_handle_update_owe()
670 	cfg80211_update_owe_info_event(vif->netdev, &owe_info, GFP_KERNEL);  in qtnf_event_handle_update_owe()
676 static int qtnf_event_parse(struct qtnf_wmac *mac,  in qtnf_event_parse()  argument
681 	int ret = -1;  in qtnf_event_parse()
686 	event = (const struct qlink_event *)event_skb->data;  in qtnf_event_parse()
687 	event_id = le16_to_cpu(event->event_id);  in qtnf_event_parse()
688 	event_len = le16_to_cpu(event->mhdr.len);  in qtnf_event_parse()
690 	if (event->vifid >= QTNF_MAX_INTF) {  in qtnf_event_parse()
691 		pr_err("invalid vif(%u)\n", event->vifid);  in qtnf_event_parse()
692 		return -EINVAL;  in qtnf_event_parse()
695 	vifid = array_index_nospec(event->vifid, QTNF_MAX_INTF);  in qtnf_event_parse()
696 	vif = &mac->iflist[vifid];  in qtnf_event_parse()
700 		ret = qtnf_event_handle_sta_assoc(mac, vif, (const void *)event,  in qtnf_event_parse()
704 		ret = qtnf_event_handle_sta_deauth(mac, vif,  in qtnf_event_parse()
717 		ret = qtnf_event_handle_scan_complete(mac, (const void *)event,  in qtnf_event_parse()
729 		ret = qtnf_event_handle_freq_change(mac, (const void *)event,  in qtnf_event_parse()
760 	struct qtnf_wmac *mac;  in qtnf_event_process_skb()  local
763 	if (unlikely(!skb || skb->len < sizeof(*event))) {  in qtnf_event_process_skb()
765 		return -EINVAL;  in qtnf_event_process_skb()
768 	event = (struct qlink_event *)skb->data;  in qtnf_event_process_skb()
770 	mac = qtnf_core_get_mac(bus, event->macid);  in qtnf_event_process_skb()
772 	pr_debug("new event id:%x len:%u mac:%u vif:%u\n",  in qtnf_event_process_skb()
773 		 le16_to_cpu(event->event_id), le16_to_cpu(event->mhdr.len),  in qtnf_event_process_skb()
774 		 event->macid, event->vifid);  in qtnf_event_process_skb()
776 	if (unlikely(!mac))  in qtnf_event_process_skb()
777 		return -ENXIO;  in qtnf_event_process_skb()
780 	res = qtnf_event_parse(mac, skb);  in qtnf_event_process_skb()
789 	struct sk_buff_head *event_queue = &bus->trans.event_queue;  in qtnf_event_work_handler()