1 /*
2 * Driver interaction with Linux nl80211/cfg80211 - Event processing
3 * Copyright (c) 2002-2017, Jouni Malinen <j@w1.fi>
4 * Copyright (c) 2007, Johannes Berg <johannes@sipsolutions.net>
5 * Copyright (c) 2009-2010, Atheros Communications
6 *
7 * This software may be distributed under the terms of the BSD license.
8 * See README for more details.
9 */
10
11 #include "includes.h"
12 #include <netlink/genl/genl.h>
13
14 #include "utils/common.h"
15 #include "utils/eloop.h"
16 #include "common/qca-vendor.h"
17 #include "common/qca-vendor-attr.h"
18 #include "common/brcm_vendor.h"
19 #include "common/ieee802_11_defs.h"
20 #include "common/ieee802_11_common.h"
21 #include "driver_nl80211.h"
22
23
24 static void
25 nl80211_control_port_frame_tx_status(struct i802_bss *bss,
26 const u8 *frame, size_t len,
27 struct nlattr *ack, struct nlattr *cookie);
28
29
nl80211_command_to_string(enum nl80211_commands cmd)30 static const char * nl80211_command_to_string(enum nl80211_commands cmd)
31 {
32 #define C2S(x) case x: return #x;
33 switch (cmd) {
34 C2S(NL80211_CMD_UNSPEC)
35 C2S(NL80211_CMD_GET_WIPHY)
36 C2S(NL80211_CMD_SET_WIPHY)
37 C2S(NL80211_CMD_NEW_WIPHY)
38 C2S(NL80211_CMD_DEL_WIPHY)
39 C2S(NL80211_CMD_GET_INTERFACE)
40 C2S(NL80211_CMD_SET_INTERFACE)
41 C2S(NL80211_CMD_NEW_INTERFACE)
42 C2S(NL80211_CMD_DEL_INTERFACE)
43 C2S(NL80211_CMD_GET_KEY)
44 C2S(NL80211_CMD_SET_KEY)
45 C2S(NL80211_CMD_NEW_KEY)
46 C2S(NL80211_CMD_DEL_KEY)
47 C2S(NL80211_CMD_GET_BEACON)
48 C2S(NL80211_CMD_SET_BEACON)
49 C2S(NL80211_CMD_START_AP)
50 C2S(NL80211_CMD_STOP_AP)
51 C2S(NL80211_CMD_GET_STATION)
52 C2S(NL80211_CMD_SET_STATION)
53 C2S(NL80211_CMD_NEW_STATION)
54 C2S(NL80211_CMD_DEL_STATION)
55 C2S(NL80211_CMD_GET_MPATH)
56 C2S(NL80211_CMD_SET_MPATH)
57 C2S(NL80211_CMD_NEW_MPATH)
58 C2S(NL80211_CMD_DEL_MPATH)
59 C2S(NL80211_CMD_SET_BSS)
60 C2S(NL80211_CMD_SET_REG)
61 C2S(NL80211_CMD_REQ_SET_REG)
62 C2S(NL80211_CMD_GET_MESH_CONFIG)
63 C2S(NL80211_CMD_SET_MESH_CONFIG)
64 C2S(NL80211_CMD_SET_MGMT_EXTRA_IE)
65 C2S(NL80211_CMD_GET_REG)
66 C2S(NL80211_CMD_GET_SCAN)
67 C2S(NL80211_CMD_TRIGGER_SCAN)
68 C2S(NL80211_CMD_NEW_SCAN_RESULTS)
69 C2S(NL80211_CMD_SCAN_ABORTED)
70 C2S(NL80211_CMD_REG_CHANGE)
71 C2S(NL80211_CMD_AUTHENTICATE)
72 C2S(NL80211_CMD_ASSOCIATE)
73 C2S(NL80211_CMD_DEAUTHENTICATE)
74 C2S(NL80211_CMD_DISASSOCIATE)
75 C2S(NL80211_CMD_MICHAEL_MIC_FAILURE)
76 C2S(NL80211_CMD_REG_BEACON_HINT)
77 C2S(NL80211_CMD_JOIN_IBSS)
78 C2S(NL80211_CMD_LEAVE_IBSS)
79 C2S(NL80211_CMD_TESTMODE)
80 C2S(NL80211_CMD_CONNECT)
81 C2S(NL80211_CMD_ROAM)
82 C2S(NL80211_CMD_DISCONNECT)
83 C2S(NL80211_CMD_SET_WIPHY_NETNS)
84 C2S(NL80211_CMD_GET_SURVEY)
85 C2S(NL80211_CMD_NEW_SURVEY_RESULTS)
86 C2S(NL80211_CMD_SET_PMKSA)
87 C2S(NL80211_CMD_DEL_PMKSA)
88 C2S(NL80211_CMD_FLUSH_PMKSA)
89 C2S(NL80211_CMD_REMAIN_ON_CHANNEL)
90 C2S(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL)
91 C2S(NL80211_CMD_SET_TX_BITRATE_MASK)
92 C2S(NL80211_CMD_REGISTER_FRAME)
93 C2S(NL80211_CMD_FRAME)
94 C2S(NL80211_CMD_FRAME_TX_STATUS)
95 C2S(NL80211_CMD_SET_POWER_SAVE)
96 C2S(NL80211_CMD_GET_POWER_SAVE)
97 C2S(NL80211_CMD_SET_CQM)
98 C2S(NL80211_CMD_NOTIFY_CQM)
99 C2S(NL80211_CMD_SET_CHANNEL)
100 C2S(NL80211_CMD_SET_WDS_PEER)
101 C2S(NL80211_CMD_FRAME_WAIT_CANCEL)
102 C2S(NL80211_CMD_JOIN_MESH)
103 C2S(NL80211_CMD_LEAVE_MESH)
104 C2S(NL80211_CMD_UNPROT_DEAUTHENTICATE)
105 C2S(NL80211_CMD_UNPROT_DISASSOCIATE)
106 C2S(NL80211_CMD_NEW_PEER_CANDIDATE)
107 C2S(NL80211_CMD_GET_WOWLAN)
108 C2S(NL80211_CMD_SET_WOWLAN)
109 C2S(NL80211_CMD_START_SCHED_SCAN)
110 C2S(NL80211_CMD_STOP_SCHED_SCAN)
111 C2S(NL80211_CMD_SCHED_SCAN_RESULTS)
112 C2S(NL80211_CMD_SCHED_SCAN_STOPPED)
113 C2S(NL80211_CMD_SET_REKEY_OFFLOAD)
114 C2S(NL80211_CMD_PMKSA_CANDIDATE)
115 C2S(NL80211_CMD_TDLS_OPER)
116 C2S(NL80211_CMD_TDLS_MGMT)
117 C2S(NL80211_CMD_UNEXPECTED_FRAME)
118 C2S(NL80211_CMD_PROBE_CLIENT)
119 C2S(NL80211_CMD_REGISTER_BEACONS)
120 C2S(NL80211_CMD_UNEXPECTED_4ADDR_FRAME)
121 C2S(NL80211_CMD_SET_NOACK_MAP)
122 C2S(NL80211_CMD_CH_SWITCH_NOTIFY)
123 C2S(NL80211_CMD_START_P2P_DEVICE)
124 C2S(NL80211_CMD_STOP_P2P_DEVICE)
125 C2S(NL80211_CMD_CONN_FAILED)
126 C2S(NL80211_CMD_SET_MCAST_RATE)
127 C2S(NL80211_CMD_SET_MAC_ACL)
128 C2S(NL80211_CMD_RADAR_DETECT)
129 C2S(NL80211_CMD_GET_PROTOCOL_FEATURES)
130 C2S(NL80211_CMD_UPDATE_FT_IES)
131 C2S(NL80211_CMD_FT_EVENT)
132 C2S(NL80211_CMD_CRIT_PROTOCOL_START)
133 C2S(NL80211_CMD_CRIT_PROTOCOL_STOP)
134 C2S(NL80211_CMD_GET_COALESCE)
135 C2S(NL80211_CMD_SET_COALESCE)
136 C2S(NL80211_CMD_CHANNEL_SWITCH)
137 C2S(NL80211_CMD_VENDOR)
138 C2S(NL80211_CMD_SET_QOS_MAP)
139 C2S(NL80211_CMD_ADD_TX_TS)
140 C2S(NL80211_CMD_DEL_TX_TS)
141 C2S(NL80211_CMD_GET_MPP)
142 C2S(NL80211_CMD_JOIN_OCB)
143 C2S(NL80211_CMD_LEAVE_OCB)
144 C2S(NL80211_CMD_CH_SWITCH_STARTED_NOTIFY)
145 C2S(NL80211_CMD_TDLS_CHANNEL_SWITCH)
146 C2S(NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH)
147 C2S(NL80211_CMD_WIPHY_REG_CHANGE)
148 C2S(NL80211_CMD_ABORT_SCAN)
149 C2S(NL80211_CMD_START_NAN)
150 C2S(NL80211_CMD_STOP_NAN)
151 C2S(NL80211_CMD_ADD_NAN_FUNCTION)
152 C2S(NL80211_CMD_DEL_NAN_FUNCTION)
153 C2S(NL80211_CMD_CHANGE_NAN_CONFIG)
154 C2S(NL80211_CMD_NAN_MATCH)
155 C2S(NL80211_CMD_SET_MULTICAST_TO_UNICAST)
156 C2S(NL80211_CMD_UPDATE_CONNECT_PARAMS)
157 C2S(NL80211_CMD_SET_PMK)
158 C2S(NL80211_CMD_DEL_PMK)
159 C2S(NL80211_CMD_PORT_AUTHORIZED)
160 C2S(NL80211_CMD_RELOAD_REGDB)
161 C2S(NL80211_CMD_EXTERNAL_AUTH)
162 C2S(NL80211_CMD_STA_OPMODE_CHANGED)
163 C2S(NL80211_CMD_CONTROL_PORT_FRAME)
164 C2S(NL80211_CMD_GET_FTM_RESPONDER_STATS)
165 C2S(NL80211_CMD_PEER_MEASUREMENT_START)
166 C2S(NL80211_CMD_PEER_MEASUREMENT_RESULT)
167 C2S(NL80211_CMD_PEER_MEASUREMENT_COMPLETE)
168 C2S(NL80211_CMD_NOTIFY_RADAR)
169 C2S(NL80211_CMD_UPDATE_OWE_INFO)
170 C2S(NL80211_CMD_PROBE_MESH_LINK)
171 C2S(NL80211_CMD_SET_TID_CONFIG)
172 C2S(NL80211_CMD_UNPROT_BEACON)
173 C2S(NL80211_CMD_CONTROL_PORT_FRAME_TX_STATUS)
174 C2S(NL80211_CMD_SET_SAR_SPECS)
175 C2S(NL80211_CMD_OBSS_COLOR_COLLISION)
176 C2S(NL80211_CMD_COLOR_CHANGE_REQUEST)
177 C2S(NL80211_CMD_COLOR_CHANGE_STARTED)
178 C2S(NL80211_CMD_COLOR_CHANGE_ABORTED)
179 C2S(NL80211_CMD_COLOR_CHANGE_COMPLETED)
180 C2S(NL80211_CMD_SET_FILS_AAD)
181 C2S(NL80211_CMD_ASSOC_COMEBACK)
182 C2S(NL80211_CMD_ADD_LINK)
183 C2S(NL80211_CMD_REMOVE_LINK)
184 C2S(NL80211_CMD_ADD_LINK_STA)
185 C2S(NL80211_CMD_MODIFY_LINK_STA)
186 C2S(NL80211_CMD_REMOVE_LINK_STA)
187 C2S(NL80211_CMD_SET_HW_TIMESTAMP)
188 C2S(NL80211_CMD_LINKS_REMOVED)
189 C2S(NL80211_CMD_SET_TID_TO_LINK_MAPPING)
190 C2S(NL80211_CMD_ASSOC_MLO_RECONF)
191 C2S(NL80211_CMD_EPCS_CFG)
192 C2S(__NL80211_CMD_AFTER_LAST)
193 }
194 #undef C2S
195
196 return "NL80211_CMD_UNKNOWN";
197 }
198
199
mlme_event_auth(struct wpa_driver_nl80211_data * drv,const u8 * frame,size_t len)200 static void mlme_event_auth(struct wpa_driver_nl80211_data *drv,
201 const u8 *frame, size_t len)
202 {
203 const struct ieee80211_mgmt *mgmt;
204 union wpa_event_data event;
205
206 if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME) &&
207 drv->force_connect_cmd) {
208 /*
209 * Avoid reporting two association events that would confuse
210 * the core code.
211 */
212 wpa_printf(MSG_DEBUG,
213 "nl80211: Ignore auth event when using driver SME");
214 return;
215 }
216
217 wpa_printf(MSG_DEBUG, "nl80211: Authenticate event");
218 mgmt = (const struct ieee80211_mgmt *) frame;
219 if (len < 24 + sizeof(mgmt->u.auth)) {
220 wpa_printf(MSG_DEBUG, "nl80211: Too short association event "
221 "frame");
222 return;
223 }
224
225 os_memcpy(drv->auth_bssid, mgmt->sa, ETH_ALEN);
226 os_memset(drv->auth_attempt_bssid, 0, ETH_ALEN);
227 os_memset(&event, 0, sizeof(event));
228 os_memcpy(event.auth.peer, mgmt->sa, ETH_ALEN);
229 event.auth.auth_type = le_to_host16(mgmt->u.auth.auth_alg);
230 event.auth.auth_transaction =
231 le_to_host16(mgmt->u.auth.auth_transaction);
232 event.auth.status_code = le_to_host16(mgmt->u.auth.status_code);
233 if (len > 24 + sizeof(mgmt->u.auth)) {
234 event.auth.ies = mgmt->u.auth.variable;
235 event.auth.ies_len = len - 24 - sizeof(mgmt->u.auth);
236 }
237
238 wpa_supplicant_event(drv->ctx, EVENT_AUTH, &event);
239 }
240
241
nl80211_parse_wmm_params(struct nlattr * wmm_attr,struct wmm_params * wmm_params)242 static void nl80211_parse_wmm_params(struct nlattr *wmm_attr,
243 struct wmm_params *wmm_params)
244 {
245 struct nlattr *wmm_info[NL80211_STA_WME_MAX + 1];
246 static struct nla_policy wme_policy[NL80211_STA_WME_MAX + 1] = {
247 [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
248 };
249
250 if (!wmm_attr ||
251 nla_parse_nested(wmm_info, NL80211_STA_WME_MAX, wmm_attr,
252 wme_policy) ||
253 !wmm_info[NL80211_STA_WME_UAPSD_QUEUES])
254 return;
255
256 wmm_params->uapsd_queues =
257 nla_get_u8(wmm_info[NL80211_STA_WME_UAPSD_QUEUES]);
258 wmm_params->info_bitmap |= WMM_PARAMS_UAPSD_QUEUES_INFO;
259 }
260
261
mlme_event_assoc(struct wpa_driver_nl80211_data * drv,const u8 * frame,size_t len,struct nlattr * wmm,struct nlattr * req_ie)262 static void mlme_event_assoc(struct wpa_driver_nl80211_data *drv,
263 const u8 *frame, size_t len, struct nlattr *wmm,
264 struct nlattr *req_ie)
265 {
266 const struct ieee80211_mgmt *mgmt;
267 union wpa_event_data event;
268 u16 status;
269 int ssid_len;
270
271 if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME) &&
272 drv->force_connect_cmd) {
273 /*
274 * Avoid reporting two association events that would confuse
275 * the core code.
276 */
277 wpa_printf(MSG_DEBUG,
278 "nl80211: Ignore assoc event when using driver SME");
279 return;
280 }
281
282 wpa_printf(MSG_DEBUG, "nl80211: Associate event");
283 mgmt = (const struct ieee80211_mgmt *) frame;
284 if (len < 24 + sizeof(mgmt->u.assoc_resp)) {
285 wpa_printf(MSG_DEBUG, "nl80211: Too short association event "
286 "frame");
287 return;
288 }
289
290 status = le_to_host16(mgmt->u.assoc_resp.status_code);
291 if (status != WLAN_STATUS_SUCCESS) {
292 os_memset(&event, 0, sizeof(event));
293 event.assoc_reject.bssid = mgmt->bssid;
294 if (len > 24 + sizeof(mgmt->u.assoc_resp)) {
295 event.assoc_reject.resp_ies =
296 (u8 *) mgmt->u.assoc_resp.variable;
297 event.assoc_reject.resp_ies_len =
298 len - 24 - sizeof(mgmt->u.assoc_resp);
299 }
300 event.assoc_reject.status_code = status;
301
302 wpa_supplicant_event(drv->ctx, EVENT_ASSOC_REJECT, &event);
303 return;
304 }
305
306 drv->associated = 1;
307 os_memcpy(drv->bssid, mgmt->sa, ETH_ALEN);
308 os_memcpy(drv->prev_bssid, mgmt->sa, ETH_ALEN);
309
310 os_memset(&event, 0, sizeof(event));
311 event.assoc_info.resp_frame = frame;
312 event.assoc_info.resp_frame_len = len;
313 if (len > 24 + sizeof(mgmt->u.assoc_resp)) {
314 event.assoc_info.resp_ies = (u8 *) mgmt->u.assoc_resp.variable;
315 event.assoc_info.resp_ies_len =
316 len - 24 - sizeof(mgmt->u.assoc_resp);
317 }
318
319 if (req_ie) {
320 event.assoc_info.req_ies = nla_data(req_ie);
321 event.assoc_info.req_ies_len = nla_len(req_ie);
322 }
323
324 /* When this association was initiated outside of wpa_supplicant,
325 * drv->ssid needs to be set here to satisfy later checking. */
326 ssid_len = nl80211_get_assoc_ssid(drv, drv->ssid);
327 if (ssid_len > 0) {
328 drv->ssid_len = ssid_len;
329 wpa_printf(MSG_DEBUG,
330 "nl80211: Set drv->ssid based on scan res info to '%s'",
331 wpa_ssid_txt(drv->ssid, drv->ssid_len));
332 }
333
334 event.assoc_info.freq = drv->assoc_freq;
335 drv->first_bss->flink->freq = drv->assoc_freq;
336
337 nl80211_parse_wmm_params(wmm, &event.assoc_info.wmm_params);
338
339 wpa_supplicant_event(drv->ctx, EVENT_ASSOC, &event);
340 }
341
342
343 #ifdef CONFIG_DRIVER_NL80211_QCA
344
qca_drv_connect_fail_reason_code_handler(struct nl_msg * msg,void * arg)345 static int qca_drv_connect_fail_reason_code_handler(struct nl_msg *msg,
346 void *arg)
347 {
348 struct nlattr *tb[NL80211_ATTR_MAX + 1];
349 struct nlattr *tb_sta_info[QCA_WLAN_VENDOR_ATTR_GET_STA_INFO_MAX + 1];
350 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
351 u32 *reason_code = arg;
352
353 *reason_code = 0;
354 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
355 genlmsg_attrlen(gnlh, 0), NULL);
356
357 if (!tb[NL80211_ATTR_VENDOR_DATA]) {
358 wpa_printf(MSG_ERROR, "%s: Vendor data not found", __func__);
359 return NL_SKIP;
360 }
361
362 nla_parse(tb_sta_info, QCA_WLAN_VENDOR_ATTR_GET_STA_INFO_MAX,
363 nla_data(tb[NL80211_ATTR_VENDOR_DATA]),
364 nla_len(tb[NL80211_ATTR_VENDOR_DATA]), NULL);
365
366 if (!tb_sta_info[QCA_WLAN_VENDOR_ATTR_GET_STA_INFO_CONNECT_FAIL_REASON_CODE]) {
367 wpa_printf(MSG_INFO, "%s: Vendor attr not found", __func__);
368 return NL_SKIP;
369 }
370
371 *reason_code = nla_get_u32(tb_sta_info[QCA_WLAN_VENDOR_ATTR_GET_STA_INFO_CONNECT_FAIL_REASON_CODE]);
372
373 return NL_SKIP;
374 }
375
376
377 static enum qca_sta_connect_fail_reason_codes
drv_get_connect_fail_reason_code(struct wpa_driver_nl80211_data * drv)378 drv_get_connect_fail_reason_code(struct wpa_driver_nl80211_data *drv)
379 {
380 enum qca_sta_connect_fail_reason_codes reason_code;
381 struct nl_msg *msg;
382 int ret;
383
384 msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR);
385 if (!msg || nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
386 nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
387 QCA_NL80211_VENDOR_SUBCMD_GET_STA_INFO)) {
388 nlmsg_free(msg);
389 return 0;
390 }
391
392 ret = send_and_recv_resp(drv, msg,
393 qca_drv_connect_fail_reason_code_handler,
394 &reason_code);
395 if (ret)
396 wpa_printf(MSG_DEBUG,
397 "nl80211: Get connect fail reason_code failed: ret=%d (%s)",
398 ret, strerror(-ret));
399
400 return reason_code;
401 }
402
403
404 static enum sta_connect_fail_reason_codes
convert_connect_fail_reason_codes(enum qca_sta_connect_fail_reason_codes reason_code)405 convert_connect_fail_reason_codes(enum qca_sta_connect_fail_reason_codes
406 reason_code)
407 {
408 switch (reason_code) {
409 case QCA_STA_CONNECT_FAIL_REASON_NO_BSS_FOUND:
410 return STA_CONNECT_FAIL_REASON_NO_BSS_FOUND;
411 case QCA_STA_CONNECT_FAIL_REASON_AUTH_TX_FAIL:
412 return STA_CONNECT_FAIL_REASON_AUTH_TX_FAIL;
413 case QCA_STA_CONNECT_FAIL_REASON_AUTH_NO_ACK_RECEIVED:
414 return STA_CONNECT_FAIL_REASON_AUTH_NO_ACK_RECEIVED;
415 case QCA_STA_CONNECT_FAIL_REASON_AUTH_NO_RESP_RECEIVED:
416 return STA_CONNECT_FAIL_REASON_AUTH_NO_RESP_RECEIVED;
417 case QCA_STA_CONNECT_FAIL_REASON_ASSOC_REQ_TX_FAIL:
418 return STA_CONNECT_FAIL_REASON_ASSOC_REQ_TX_FAIL;
419 case QCA_STA_CONNECT_FAIL_REASON_ASSOC_NO_ACK_RECEIVED:
420 return STA_CONNECT_FAIL_REASON_ASSOC_NO_ACK_RECEIVED;
421 case QCA_STA_CONNECT_FAIL_REASON_ASSOC_NO_RESP_RECEIVED:
422 return STA_CONNECT_FAIL_REASON_ASSOC_NO_RESP_RECEIVED;
423 default:
424 return STA_CONNECT_FAIL_REASON_UNSPECIFIED;
425 }
426 }
427
428
qca_nl80211_link_reconfig_event(struct wpa_driver_nl80211_data * drv,u8 * data,size_t len)429 static void qca_nl80211_link_reconfig_event(struct wpa_driver_nl80211_data *drv,
430 u8 *data, size_t len)
431 {
432 struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_LINK_RECONFIG_MAX + 1];
433 u16 removed_links;
434 u8 *ap_mld;
435 int i;
436
437 if (!data)
438 return;
439
440 if (nla_parse(tb, QCA_WLAN_VENDOR_ATTR_LINK_RECONFIG_MAX,
441 (struct nlattr *) data, len, NULL) ||
442 !tb[QCA_WLAN_VENDOR_ATTR_LINK_RECONFIG_AP_MLD_ADDR])
443 return;
444
445 ap_mld = nla_data(tb[QCA_WLAN_VENDOR_ATTR_LINK_RECONFIG_AP_MLD_ADDR]);
446 wpa_printf(MSG_DEBUG, "nl80211: AP MLD address " MACSTR
447 " received in link reconfig event", MAC2STR(ap_mld));
448 if (!drv->sta_mlo_info.valid_links ||
449 !ether_addr_equal(drv->sta_mlo_info.ap_mld_addr, ap_mld)) {
450 if (drv->pending_link_reconfig_data == data) {
451 wpa_printf(MSG_DEBUG,
452 "nl80211: Drop pending link reconfig event since AP MLD not matched even after new connect/roam event");
453 os_free(drv->pending_link_reconfig_data);
454 drv->pending_link_reconfig_data = NULL;
455 return;
456 }
457
458 wpa_printf(MSG_DEBUG,
459 "nl80211: Cache new link reconfig event till next connect/roam event");
460 if (drv->pending_link_reconfig_data) {
461 wpa_printf(MSG_DEBUG, "nl80211: Override old link reconfig event data");
462 os_free(drv->pending_link_reconfig_data);
463 }
464 drv->pending_link_reconfig_data = os_memdup(data, len);
465 if (!drv->pending_link_reconfig_data)
466 return;
467 drv->pending_link_reconfig_data_len = len;
468 return;
469 }
470
471 if (!tb[QCA_WLAN_VENDOR_ATTR_LINK_RECONFIG_REMOVED_LINKS])
472 return;
473 removed_links = nla_get_u16(
474 tb[QCA_WLAN_VENDOR_ATTR_LINK_RECONFIG_REMOVED_LINKS]);
475
476 drv->sta_mlo_info.valid_links &= ~removed_links;
477
478 /*
479 * Set default BSSID to the BSSID of the lowest link ID of remaining
480 * links when the link used for (re)association is removed.
481 */
482 if (removed_links & BIT(drv->sta_mlo_info.assoc_link_id)) {
483 for_each_link(drv->sta_mlo_info.valid_links, i) {
484 os_memcpy(drv->bssid, drv->sta_mlo_info.links[i].bssid,
485 ETH_ALEN);
486 drv->sta_mlo_info.assoc_link_id = i;
487 break;
488 }
489 }
490
491 wpa_printf(MSG_DEBUG, "nl80211: Removed MLO links bitmap: 0x%x",
492 removed_links);
493
494 wpa_supplicant_event(drv->ctx, EVENT_LINK_RECONFIG, NULL);
495 }
496
497
498 static void
nl80211_parse_qca_vendor_mlo_link_info(struct driver_sta_mlo_info * mlo,struct nlattr * mlo_links)499 nl80211_parse_qca_vendor_mlo_link_info(struct driver_sta_mlo_info *mlo,
500 struct nlattr *mlo_links)
501 {
502 struct nlattr *link;
503 int rem_links;
504
505 nla_for_each_nested(link, mlo_links, rem_links) {
506 struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_MLO_LINK_MAX + 1];
507 int link_id;
508
509 nla_parse(tb,QCA_WLAN_VENDOR_ATTR_MLO_LINK_MAX, nla_data(link),
510 nla_len(link), NULL);
511
512 if (!tb[QCA_WLAN_VENDOR_ATTR_MLO_LINK_ID] ||
513 !tb[QCA_WLAN_VENDOR_ATTR_MLO_LINK_MAC_ADDR] ||
514 !tb[QCA_WLAN_VENDOR_ATTR_MLO_LINK_BSSID])
515 continue;
516
517 link_id = nla_get_u8(tb[QCA_WLAN_VENDOR_ATTR_MLO_LINK_ID]);
518 if (link_id >= MAX_NUM_MLD_LINKS)
519 continue;
520
521 mlo->valid_links |= BIT(link_id);
522 os_memcpy(mlo->links[link_id].addr,
523 nla_data(tb[QCA_WLAN_VENDOR_ATTR_MLO_LINK_MAC_ADDR]),
524 ETH_ALEN);
525 os_memcpy(mlo->links[link_id].bssid,
526 nla_data(tb[QCA_WLAN_VENDOR_ATTR_MLO_LINK_BSSID]),
527 ETH_ALEN);
528 wpa_printf(MSG_DEBUG, "nl80211: MLO link[%u] addr " MACSTR
529 " bssid " MACSTR,
530 link_id, MAC2STR(mlo->links[link_id].addr),
531 MAC2STR(mlo->links[link_id].bssid));
532 }
533 }
534
535 #endif /* CONFIG_DRIVER_NL80211_QCA */
536
537
nl80211_parse_mlo_link_info(struct driver_sta_mlo_info * mlo,struct nlattr * mlo_links)538 static void nl80211_parse_mlo_link_info(struct driver_sta_mlo_info *mlo,
539 struct nlattr *mlo_links)
540 {
541 struct nlattr *link;
542 int rem_links;
543
544 nla_for_each_nested(link, mlo_links, rem_links) {
545 struct nlattr *tb[NL80211_ATTR_MAX + 1];
546 int link_id;
547
548 nla_parse(tb, NL80211_ATTR_MAX, nla_data(link), nla_len(link),
549 NULL);
550
551 if (!tb[NL80211_ATTR_MLO_LINK_ID] || !tb[NL80211_ATTR_MAC] ||
552 !tb[NL80211_ATTR_BSSID])
553 continue;
554
555 link_id = nla_get_u8(tb[NL80211_ATTR_MLO_LINK_ID]);
556 if (link_id >= MAX_NUM_MLD_LINKS)
557 continue;
558
559 if (tb[NL80211_ATTR_STATUS_CODE]) {
560 /* Set requested links only when status indicated */
561 mlo->req_links |= BIT(link_id);
562 if (nla_get_u16(tb[NL80211_ATTR_STATUS_CODE]) ==
563 WLAN_STATUS_SUCCESS)
564 mlo->valid_links |= BIT(link_id);
565 } else {
566 mlo->valid_links |= BIT(link_id);
567 }
568
569 os_memcpy(mlo->links[link_id].addr,
570 nla_data(tb[NL80211_ATTR_MAC]), ETH_ALEN);
571 os_memcpy(mlo->links[link_id].bssid,
572 nla_data(tb[NL80211_ATTR_BSSID]), ETH_ALEN);
573 wpa_printf(MSG_DEBUG, "nl80211: MLO link[%u] addr " MACSTR
574 " bssid " MACSTR,
575 link_id, MAC2STR(mlo->links[link_id].addr),
576 MAC2STR(mlo->links[link_id].bssid));
577 }
578 }
579
580
581 struct links_info {
582 /* bitmap of link IDs in Per-STA profile subelements */
583 u16 non_assoc_links;
584 u8 addr[MAX_NUM_MLD_LINKS][ETH_ALEN];
585 };
586
587
nl80211_get_basic_mle_links_info(const u8 * mle,size_t mle_len,struct links_info * info)588 static void nl80211_get_basic_mle_links_info(const u8 *mle, size_t mle_len,
589 struct links_info *info)
590 {
591 size_t rem_len;
592 const u8 *pos;
593
594 if (mle_len < MULTI_LINK_CONTROL_LEN + 1 ||
595 mle_len - MULTI_LINK_CONTROL_LEN < mle[MULTI_LINK_CONTROL_LEN])
596 return;
597
598 /* Skip Common Info */
599 pos = mle + MULTI_LINK_CONTROL_LEN + mle[MULTI_LINK_CONTROL_LEN];
600 rem_len = mle_len -
601 (MULTI_LINK_CONTROL_LEN + mle[MULTI_LINK_CONTROL_LEN]);
602
603 /* Parse Subelements */
604 while (rem_len > 2) {
605 size_t ie_len = 2 + pos[1];
606
607 if (rem_len < ie_len)
608 break;
609
610 if (pos[0] == MULTI_LINK_SUB_ELEM_ID_PER_STA_PROFILE) {
611 u8 link_id;
612 const u8 *sta_profile;
613 u16 sta_ctrl;
614
615 if (pos[1] < BASIC_MLE_STA_PROF_STA_MAC_IDX + ETH_ALEN)
616 goto next_subelem;
617
618 sta_profile = &pos[2];
619 sta_ctrl = WPA_GET_LE16(sta_profile);
620 link_id = sta_ctrl & BASIC_MLE_STA_CTRL_LINK_ID_MASK;
621 if (link_id >= MAX_NUM_MLD_LINKS)
622 goto next_subelem;
623
624 if (!(sta_ctrl & BASIC_MLE_STA_CTRL_PRES_STA_MAC))
625 goto next_subelem;
626
627 info->non_assoc_links |= BIT(link_id);
628 os_memcpy(info->addr[link_id],
629 &sta_profile[BASIC_MLE_STA_PROF_STA_MAC_IDX],
630 ETH_ALEN);
631 }
632 next_subelem:
633 pos += ie_len;
634 rem_len -= ie_len;
635 }
636 }
637
638
nl80211_update_rejected_links_info(struct driver_sta_mlo_info * mlo,struct nlattr * req_ie,struct nlattr * resp_ie)639 static int nl80211_update_rejected_links_info(struct driver_sta_mlo_info *mlo,
640 struct nlattr *req_ie,
641 struct nlattr *resp_ie)
642 {
643 int i;
644 struct wpabuf *mle;
645 struct ieee802_11_elems req_elems, resp_elems;
646 struct links_info req_info, resp_info;
647
648 if (!req_ie || !resp_ie) {
649 wpa_printf(MSG_INFO,
650 "nl80211: MLO: (Re)Association Request/Response frame elements not available");
651 return -1;
652 }
653
654 if (ieee802_11_parse_elems(nla_data(req_ie), nla_len(req_ie),
655 &req_elems, 0) == ParseFailed ||
656 ieee802_11_parse_elems(nla_data(resp_ie), nla_len(resp_ie),
657 &resp_elems, 0) == ParseFailed) {
658 wpa_printf(MSG_INFO,
659 "nl80211: MLO: Failed to parse (Re)Association Request/Response elements");
660 return -1;
661 }
662
663 mle = ieee802_11_defrag(req_elems.basic_mle, req_elems.basic_mle_len,
664 true);
665 if (!mle) {
666 wpa_printf(MSG_INFO,
667 "nl80211: MLO: Basic Multi-Link element not found in Association Request");
668 return -1;
669 }
670 os_memset(&req_info, 0, sizeof(req_info));
671 nl80211_get_basic_mle_links_info(wpabuf_head(mle), wpabuf_len(mle),
672 &req_info);
673 wpabuf_free(mle);
674
675 mle = ieee802_11_defrag(resp_elems.basic_mle, resp_elems.basic_mle_len,
676 true);
677 if (!mle) {
678 wpa_printf(MSG_ERROR,
679 "nl80211: MLO: Basic Multi-Link element not found in Association Response");
680 return -1;
681 }
682 os_memset(&resp_info, 0, sizeof(resp_info));
683 nl80211_get_basic_mle_links_info(wpabuf_head(mle), wpabuf_len(mle),
684 &resp_info);
685 wpabuf_free(mle);
686
687 if (req_info.non_assoc_links != resp_info.non_assoc_links) {
688 wpa_printf(MSG_ERROR,
689 "nl80211: MLO: Association Request and Response links bitmaps not equal (0x%x != 0x%x)",
690 req_info.non_assoc_links,
691 resp_info.non_assoc_links);
692 return -1;
693 }
694
695 mlo->req_links = BIT(mlo->assoc_link_id) | req_info.non_assoc_links;
696 if ((mlo->req_links & mlo->valid_links) != mlo->valid_links) {
697 wpa_printf(MSG_ERROR,
698 "nl80211: MLO: Accepted links are not a subset of requested links (req_links=0x%x valid_links=0x%x non_assoc_links=0x%x assoc_link_id=0x%x)",
699 mlo->req_links, mlo->valid_links,
700 req_info.non_assoc_links, BIT(mlo->assoc_link_id));
701 return -1;
702 }
703
704 /* Get MLO links info for rejected links */
705 for_each_link((mlo->req_links & ~mlo->valid_links), i) {
706 os_memcpy(mlo->links[i].bssid, resp_info.addr[i], ETH_ALEN);
707 os_memcpy(mlo->links[i].addr, req_info.addr[i], ETH_ALEN);
708 }
709
710 return 0;
711 }
712
713
nl80211_get_assoc_link_id(const u8 * data,u8 len)714 static int nl80211_get_assoc_link_id(const u8 *data, u8 len)
715 {
716 u16 control;
717
718 if (len < 2)
719 return -1;
720
721 control = WPA_GET_LE16(data);
722 if (!(control & BASIC_MULTI_LINK_CTRL_PRES_LINK_ID))
723 return -1;
724
725 #define BASIC_ML_IE_COMMON_INFO_LINK_ID_IDX \
726 (2 + /* Multi-Link Control field */ \
727 1 + /* Common Info Length field (Basic) */ \
728 ETH_ALEN) /* MLD MAC Address field (Basic) */
729 if (len <= BASIC_ML_IE_COMMON_INFO_LINK_ID_IDX)
730 return -1;
731
732 return data[BASIC_ML_IE_COMMON_INFO_LINK_ID_IDX] & 0x0F;
733 }
734
735
nl80211_parse_mlo_info(struct wpa_driver_nl80211_data * drv,bool qca_roam_auth,struct nlattr * addr,struct nlattr * mlo_links,struct nlattr * req_ie,struct nlattr * resp_ie)736 static void nl80211_parse_mlo_info(struct wpa_driver_nl80211_data *drv,
737 bool qca_roam_auth,
738 struct nlattr *addr,
739 struct nlattr *mlo_links,
740 struct nlattr *req_ie,
741 struct nlattr *resp_ie)
742 {
743 const u8 *ml_ie;
744 struct driver_sta_mlo_info *mlo = &drv->sta_mlo_info;
745 int res;
746
747 if (!addr || !mlo_links || !resp_ie)
748 return;
749
750 ml_ie = get_ml_ie(nla_data(resp_ie), nla_len(resp_ie),
751 MULTI_LINK_CONTROL_TYPE_BASIC);
752 if (!ml_ie)
753 return;
754
755 res = nl80211_get_assoc_link_id(&ml_ie[3], ml_ie[1] - 1);
756 if (res < 0 || res >= MAX_NUM_MLD_LINKS) {
757 wpa_printf(MSG_DEBUG,
758 "nl80211: Could not find a valid association Link ID (res=%d)",
759 res);
760 return;
761 }
762 drv->sta_mlo_info.assoc_link_id = res;
763
764 os_memcpy(mlo->ap_mld_addr, nla_data(addr), ETH_ALEN);
765 wpa_printf(MSG_DEBUG, "nl80211: AP MLD MAC Address " MACSTR,
766 MAC2STR(mlo->ap_mld_addr));
767
768 if (!qca_roam_auth)
769 nl80211_parse_mlo_link_info(mlo, mlo_links);
770 #ifdef CONFIG_DRIVER_NL80211_QCA
771 if (qca_roam_auth)
772 nl80211_parse_qca_vendor_mlo_link_info(mlo, mlo_links);
773 #endif /* CONFIG_DRIVER_NL80211_QCA */
774
775 if (!(mlo->valid_links & BIT(mlo->assoc_link_id)) ||
776 (!mlo->req_links &&
777 nl80211_update_rejected_links_info(mlo, req_ie, resp_ie))) {
778 wpa_printf(MSG_INFO, "nl80211: Invalid MLO connection info");
779 mlo->valid_links = 0;
780 return;
781 }
782
783 os_memcpy(drv->bssid, mlo->links[drv->sta_mlo_info.assoc_link_id].bssid,
784 ETH_ALEN);
785 os_memcpy(drv->prev_bssid, drv->bssid, ETH_ALEN);
786 }
787
788
789 #ifdef CONFIG_DRIVER_NL80211_QCA
790 static void
qca_nl80211_tid_to_link_map_event(struct wpa_driver_nl80211_data * drv,u8 * data,size_t len)791 qca_nl80211_tid_to_link_map_event(struct wpa_driver_nl80211_data *drv,
792 u8 *data, size_t len)
793 {
794 struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_TID_TO_LINK_MAP_MAX + 1];
795 struct nlattr *tids;
796 union wpa_event_data event;
797 u8 *ap_mld;
798 int i, rem, tidnum = 0;
799
800 os_memset(&event, 0, sizeof(event));
801
802 if (nla_parse(tb, QCA_WLAN_VENDOR_ATTR_TID_TO_LINK_MAP_MAX,
803 (struct nlattr *) data, len, NULL) ||
804 !tb[QCA_WLAN_VENDOR_ATTR_TID_TO_LINK_MAP_AP_MLD_ADDR])
805 return;
806
807 ap_mld = nla_data(tb[QCA_WLAN_VENDOR_ATTR_TID_TO_LINK_MAP_AP_MLD_ADDR]);
808
809 wpa_printf(MSG_DEBUG, "nl80211: AP MLD address " MACSTR
810 " received in TID to link mapping event", MAC2STR(ap_mld));
811 if (!drv->sta_mlo_info.valid_links ||
812 !ether_addr_equal(drv->sta_mlo_info.ap_mld_addr, ap_mld)) {
813 if (drv->pending_t2lm_data == data) {
814 wpa_printf(MSG_DEBUG,
815 "nl80211: Drop pending TID-to-link mapping event since AP MLD not matched even after new connect/roam event");
816 os_free(drv->pending_t2lm_data);
817 drv->pending_t2lm_data = NULL;
818 return;
819 }
820 wpa_printf(MSG_DEBUG,
821 "nl80211: Cache new TID-to-link map event until the next connect/roam event");
822 if (drv->pending_t2lm_data) {
823 wpa_printf(MSG_DEBUG,
824 "nl80211: Override old TID-to-link map event data");
825 os_free(drv->pending_t2lm_data);
826 }
827 drv->pending_t2lm_data = os_memdup(data, len);
828 if (!drv->pending_t2lm_data)
829 return;
830 drv->pending_t2lm_data_len = len;
831 return;
832 }
833
834 if (!tb[QCA_WLAN_VENDOR_ATTR_TID_TO_LINK_MAP_STATUS]) {
835 wpa_printf(MSG_DEBUG, "nl80211: Default TID-to-link map");
836 event.t2l_map_info.default_map = true;
837 goto out;
838 }
839
840 event.t2l_map_info.default_map = false;
841
842 nla_for_each_nested(tids,
843 tb[QCA_WLAN_VENDOR_ATTR_TID_TO_LINK_MAP_STATUS],
844 rem) {
845 u16 uplink, downlink;
846 struct nlattr *tid[QCA_WLAN_VENDOR_ATTR_LINK_TID_MAP_STATUS_MAX + 1];
847
848 if (nla_parse_nested(
849 tid, QCA_WLAN_VENDOR_ATTR_LINK_TID_MAP_STATUS_MAX,
850 tids, NULL)) {
851 wpa_printf(MSG_DEBUG,
852 "nl80211: TID-to-link: nla_parse_nested() failed");
853 return;
854 }
855
856 if (!tid[QCA_WLAN_VENDOR_ATTR_LINK_TID_MAP_STATUS_UPLINK]) {
857 wpa_printf(MSG_DEBUG,
858 "nl80211: TID-to-link: uplink not present for tid: %d",
859 tidnum);
860 return;
861 }
862 uplink = nla_get_u16(tid[QCA_WLAN_VENDOR_ATTR_LINK_TID_MAP_STATUS_UPLINK]);
863
864 if (!tid[QCA_WLAN_VENDOR_ATTR_LINK_TID_MAP_STATUS_DOWNLINK]) {
865 wpa_printf(MSG_DEBUG,
866 "nl80211: TID-to-link: downlink not present for tid: %d",
867 tidnum);
868 return;
869 }
870 downlink = nla_get_u16(tid[QCA_WLAN_VENDOR_ATTR_LINK_TID_MAP_STATUS_DOWNLINK]);
871
872 wpa_printf(MSG_DEBUG,
873 "nl80211: TID-to-link: Received uplink %x downlink %x",
874 uplink, downlink);
875 for_each_link(drv->sta_mlo_info.valid_links, i) {
876 if (uplink & BIT(i))
877 event.t2l_map_info.t2lmap[i].uplink |=
878 BIT(tidnum);
879 if (downlink & BIT(i))
880 event.t2l_map_info.t2lmap[i].downlink |=
881 BIT(tidnum);
882 }
883
884 tidnum++;
885 }
886
887 out:
888 drv->sta_mlo_info.default_map = event.t2l_map_info.default_map;
889
890 event.t2l_map_info.valid_links = drv->sta_mlo_info.valid_links;
891 for (i = 0; i < MAX_NUM_MLD_LINKS && !drv->sta_mlo_info.default_map;
892 i++) {
893 if (!(drv->sta_mlo_info.valid_links & BIT(i)))
894 continue;
895
896 drv->sta_mlo_info.links[i].t2lmap.uplink =
897 event.t2l_map_info.t2lmap[i].uplink;
898 drv->sta_mlo_info.links[i].t2lmap.downlink =
899 event.t2l_map_info.t2lmap[i].downlink;
900 }
901
902 wpa_supplicant_event(drv->ctx, EVENT_TID_LINK_MAP, &event);
903 }
904 #endif /* CONFIG_DRIVER_NL80211_QCA */
905
906
mlme_event_connect(struct wpa_driver_nl80211_data * drv,enum nl80211_commands cmd,bool qca_roam_auth,struct nlattr * status,struct nlattr * addr,struct nlattr * req_ie,struct nlattr * resp_ie,struct nlattr * timed_out,struct nlattr * timeout_reason,struct nlattr * authorized,struct nlattr * key_replay_ctr,struct nlattr * ptk_kck,struct nlattr * ptk_kek,struct nlattr * subnet_status,struct nlattr * fils_erp_next_seq_num,struct nlattr * fils_pmk,struct nlattr * fils_pmkid,struct nlattr * mlo_links)907 static void mlme_event_connect(struct wpa_driver_nl80211_data *drv,
908 enum nl80211_commands cmd, bool qca_roam_auth,
909 struct nlattr *status,
910 struct nlattr *addr, struct nlattr *req_ie,
911 struct nlattr *resp_ie,
912 struct nlattr *timed_out,
913 struct nlattr *timeout_reason,
914 struct nlattr *authorized,
915 struct nlattr *key_replay_ctr,
916 struct nlattr *ptk_kck,
917 struct nlattr *ptk_kek,
918 struct nlattr *subnet_status,
919 struct nlattr *fils_erp_next_seq_num,
920 struct nlattr *fils_pmk,
921 struct nlattr *fils_pmkid,
922 struct nlattr *mlo_links)
923 {
924 union wpa_event_data event;
925 const u8 *ssid = NULL;
926 u16 status_code;
927 int ssid_len;
928
929 if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) {
930 /*
931 * Avoid reporting two association events that would confuse
932 * the core code.
933 */
934 wpa_printf(MSG_DEBUG, "nl80211: Ignore connect event (cmd=%d) "
935 "when using userspace SME", cmd);
936 return;
937 }
938
939 drv->connect_reassoc = 0;
940
941 status_code = status ? nla_get_u16(status) : WLAN_STATUS_SUCCESS;
942
943 if (cmd == NL80211_CMD_CONNECT) {
944 wpa_printf(MSG_DEBUG,
945 "nl80211: Connect event (status=%u ignore_next_local_disconnect=%d)",
946 status_code, drv->ignore_next_local_disconnect);
947 } else if (cmd == NL80211_CMD_ROAM) {
948 wpa_printf(MSG_DEBUG, "nl80211: Roam event");
949 }
950
951 os_memset(&event, 0, sizeof(event));
952 if (cmd == NL80211_CMD_CONNECT && status_code != WLAN_STATUS_SUCCESS) {
953 if (addr)
954 event.assoc_reject.bssid = nla_data(addr);
955 if (drv->ignore_next_local_disconnect) {
956 drv->ignore_next_local_disconnect = 0;
957 if (!event.assoc_reject.bssid ||
958 !ether_addr_equal(event.assoc_reject.bssid,
959 drv->auth_attempt_bssid)) {
960 /*
961 * Ignore the event that came without a BSSID or
962 * for the old connection since this is likely
963 * not relevant to the new Connect command.
964 */
965 wpa_printf(MSG_DEBUG,
966 "nl80211: Ignore connection failure event triggered during reassociation");
967 return;
968 }
969 }
970 if (resp_ie) {
971 event.assoc_reject.resp_ies = nla_data(resp_ie);
972 event.assoc_reject.resp_ies_len = nla_len(resp_ie);
973 }
974 event.assoc_reject.status_code = status_code;
975 event.assoc_reject.timed_out = timed_out != NULL;
976 if (timed_out && timeout_reason) {
977 enum nl80211_timeout_reason reason;
978
979 reason = nla_get_u32(timeout_reason);
980 switch (reason) {
981 case NL80211_TIMEOUT_SCAN:
982 event.assoc_reject.timeout_reason = "scan";
983 break;
984 case NL80211_TIMEOUT_AUTH:
985 event.assoc_reject.timeout_reason = "auth";
986 break;
987 case NL80211_TIMEOUT_ASSOC:
988 event.assoc_reject.timeout_reason = "assoc";
989 break;
990 default:
991 break;
992 }
993 }
994 if (fils_erp_next_seq_num)
995 event.assoc_reject.fils_erp_next_seq_num =
996 nla_get_u16(fils_erp_next_seq_num);
997
998 #ifdef CONFIG_DRIVER_NL80211_QCA
999 if (drv->get_sta_info_vendor_cmd_avail) {
1000 enum qca_sta_connect_fail_reason_codes reason_code;
1001
1002 reason_code = drv_get_connect_fail_reason_code(drv);
1003 event.assoc_reject.reason_code =
1004 convert_connect_fail_reason_codes(reason_code);
1005 }
1006 #endif /* CONFIG_DRIVER_NL80211_QCA */
1007
1008 wpa_supplicant_event(drv->ctx, EVENT_ASSOC_REJECT, &event);
1009 return;
1010 }
1011
1012 drv->associated = 1;
1013 os_memset(&drv->sta_mlo_info, 0, sizeof(drv->sta_mlo_info));
1014 nl80211_parse_mlo_info(drv, qca_roam_auth, addr, mlo_links, req_ie,
1015 resp_ie);
1016 if (!drv->sta_mlo_info.valid_links && addr) {
1017 os_memcpy(drv->bssid, nla_data(addr), ETH_ALEN);
1018 os_memcpy(drv->prev_bssid, drv->bssid, ETH_ALEN);
1019 }
1020
1021 if (req_ie) {
1022 event.assoc_info.req_ies = nla_data(req_ie);
1023 event.assoc_info.req_ies_len = nla_len(req_ie);
1024
1025 if (cmd == NL80211_CMD_ROAM) {
1026 ssid = get_ie(event.assoc_info.req_ies,
1027 event.assoc_info.req_ies_len,
1028 WLAN_EID_SSID);
1029 if (ssid && ssid[1] > 0 && ssid[1] <= 32) {
1030 drv->ssid_len = ssid[1];
1031 os_memcpy(drv->ssid, ssid + 2, ssid[1]);
1032 wpa_printf(MSG_DEBUG,
1033 "nl80211: Set drv->ssid based on req_ie to '%s'",
1034 wpa_ssid_txt(drv->ssid,
1035 drv->ssid_len));
1036 }
1037 }
1038 }
1039 if (resp_ie) {
1040 event.assoc_info.resp_ies = nla_data(resp_ie);
1041 event.assoc_info.resp_ies_len = nla_len(resp_ie);
1042 }
1043
1044 event.assoc_info.freq = nl80211_get_assoc_freq(drv);
1045 drv->first_bss->flink->freq = drv->assoc_freq;
1046
1047 if ((!ssid || ssid[1] == 0 || ssid[1] > 32) &&
1048 (ssid_len = nl80211_get_assoc_ssid(drv, drv->ssid)) > 0) {
1049 /* When this connection was initiated outside of wpa_supplicant,
1050 * drv->ssid needs to be set here to satisfy later checking. */
1051 drv->ssid_len = ssid_len;
1052 wpa_printf(MSG_DEBUG,
1053 "nl80211: Set drv->ssid based on scan res info to '%s'",
1054 wpa_ssid_txt(drv->ssid, drv->ssid_len));
1055 }
1056
1057 if (authorized && nla_get_u8(authorized)) {
1058 event.assoc_info.authorized = 1;
1059 wpa_printf(MSG_DEBUG, "nl80211: connection authorized");
1060 }
1061 if (key_replay_ctr) {
1062 event.assoc_info.key_replay_ctr = nla_data(key_replay_ctr);
1063 event.assoc_info.key_replay_ctr_len = nla_len(key_replay_ctr);
1064 }
1065 if (ptk_kck) {
1066 event.assoc_info.ptk_kck = nla_data(ptk_kck);
1067 event.assoc_info.ptk_kck_len = nla_len(ptk_kck);
1068 }
1069 if (ptk_kek) {
1070 event.assoc_info.ptk_kek = nla_data(ptk_kek);
1071 event.assoc_info.ptk_kek_len = nla_len(ptk_kek);
1072 }
1073
1074 if (subnet_status) {
1075 /*
1076 * At least for now, this is only available from
1077 * QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_SUBNET_STATUS and that
1078 * attribute has the same values 0, 1, 2 as are used in the
1079 * variable here, so no mapping between different values are
1080 * needed.
1081 */
1082 event.assoc_info.subnet_status = nla_get_u8(subnet_status);
1083 }
1084
1085 if (fils_erp_next_seq_num)
1086 event.assoc_info.fils_erp_next_seq_num =
1087 nla_get_u16(fils_erp_next_seq_num);
1088
1089 if (fils_pmk) {
1090 event.assoc_info.fils_pmk = nla_data(fils_pmk);
1091 event.assoc_info.fils_pmk_len = nla_len(fils_pmk);
1092 }
1093
1094 if (fils_pmkid)
1095 event.assoc_info.fils_pmkid = nla_data(fils_pmkid);
1096
1097 wpa_supplicant_event(drv->ctx, EVENT_ASSOC, &event);
1098
1099 /* Avoid a race condition by stopping to ignore any following
1100 * disconnection events now that the driver has indicated it is
1101 * connected since that connection could have been triggered by a roam
1102 * operation that happened in parallel with the disconnection request.
1103 */
1104 drv->ignore_next_local_disconnect = 0;
1105
1106 #ifdef CONFIG_DRIVER_NL80211_QCA
1107 if (drv->pending_t2lm_data)
1108 qca_nl80211_tid_to_link_map_event(drv, drv->pending_t2lm_data,
1109 drv->pending_t2lm_data_len);
1110 else
1111 drv->sta_mlo_info.default_map = true;
1112
1113 if (drv->pending_link_reconfig_data)
1114 qca_nl80211_link_reconfig_event(
1115 drv, drv->pending_link_reconfig_data,
1116 drv->pending_link_reconfig_data_len);
1117 #endif /* CONFIG_DRIVER_NL80211_QCA */
1118 }
1119
1120
mlme_event_disconnect(struct wpa_driver_nl80211_data * drv,struct nlattr * reason,struct nlattr * addr,struct nlattr * by_ap)1121 static void mlme_event_disconnect(struct wpa_driver_nl80211_data *drv,
1122 struct nlattr *reason, struct nlattr *addr,
1123 struct nlattr *by_ap)
1124 {
1125 union wpa_event_data data;
1126 unsigned int locally_generated = by_ap == NULL;
1127
1128 if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) {
1129 /*
1130 * Avoid reporting two disassociation events that could
1131 * confuse the core code.
1132 */
1133 wpa_printf(MSG_DEBUG, "nl80211: Ignore disconnect "
1134 "event when using userspace SME");
1135 return;
1136 }
1137
1138 if (drv->ignore_next_local_disconnect) {
1139 drv->ignore_next_local_disconnect = 0;
1140 if (locally_generated) {
1141 wpa_printf(MSG_DEBUG, "nl80211: Ignore disconnect "
1142 "event triggered during reassociation");
1143 return;
1144 }
1145 wpa_printf(MSG_WARNING, "nl80211: Was expecting local "
1146 "disconnect but got another disconnect "
1147 "event first");
1148 }
1149
1150 wpa_printf(MSG_DEBUG, "nl80211: Disconnect event");
1151 nl80211_mark_disconnected(drv);
1152 os_memset(&data, 0, sizeof(data));
1153 if (reason)
1154 data.deauth_info.reason_code = nla_get_u16(reason);
1155 data.deauth_info.locally_generated = by_ap == NULL;
1156 wpa_supplicant_event(drv->ctx, EVENT_DEAUTH, &data);
1157 }
1158
1159
calculate_chan_offset(int width,int freq,int cf1,int cf2)1160 static int calculate_chan_offset(int width, int freq, int cf1, int cf2)
1161 {
1162 int freq1 = 0;
1163
1164 switch (convert2width(width)) {
1165 case CHAN_WIDTH_20_NOHT:
1166 case CHAN_WIDTH_20:
1167 return 0;
1168 case CHAN_WIDTH_40:
1169 freq1 = cf1 - 10;
1170 break;
1171 case CHAN_WIDTH_80:
1172 freq1 = cf1 - 30;
1173 break;
1174 case CHAN_WIDTH_160:
1175 freq1 = cf1 - 70;
1176 break;
1177 case CHAN_WIDTH_80P80:
1178 freq1 = cf1 - 30;
1179 break;
1180 case CHAN_WIDTH_320:
1181 freq1 = cf1 - 150;
1182 break;
1183 case CHAN_WIDTH_UNKNOWN:
1184 case CHAN_WIDTH_2160:
1185 case CHAN_WIDTH_4320:
1186 case CHAN_WIDTH_6480:
1187 case CHAN_WIDTH_8640:
1188 /* FIXME: implement this */
1189 return 0;
1190 }
1191
1192 return (abs(freq - freq1) / 20) % 2 == 0 ? 1 : -1;
1193 }
1194
1195
mlme_event_ch_switch(struct wpa_driver_nl80211_data * drv,struct nlattr * ifindex,struct nlattr * link,struct nlattr * freq,struct nlattr * type,struct nlattr * bw,struct nlattr * cf1,struct nlattr * cf2,struct nlattr * punct_bitmap,int finished)1196 static void mlme_event_ch_switch(struct wpa_driver_nl80211_data *drv,
1197 struct nlattr *ifindex, struct nlattr *link,
1198 struct nlattr *freq, struct nlattr *type,
1199 struct nlattr *bw, struct nlattr *cf1,
1200 struct nlattr *cf2,
1201 struct nlattr *punct_bitmap,
1202 int finished)
1203 {
1204 struct i802_bss *bss;
1205 union wpa_event_data data;
1206 int ht_enabled = 1;
1207 int chan_offset = 0;
1208 int ifidx;
1209
1210 if (!freq)
1211 return;
1212
1213 ifidx = nla_get_u32(ifindex);
1214 bss = get_bss_ifindex(drv, ifidx);
1215 if (bss == NULL) {
1216 wpa_printf(MSG_WARNING, "nl80211: Unknown ifindex (%d) for channel switch, ignoring",
1217 ifidx);
1218 return;
1219 }
1220
1221 wpa_printf(MSG_DEBUG, "nl80211: Channel switch%s event for %s",
1222 finished ? "" : " started", bss->ifname);
1223
1224 if (type) {
1225 enum nl80211_channel_type ch_type = nla_get_u32(type);
1226
1227 wpa_printf(MSG_DEBUG, "nl80211: Channel type: %d", ch_type);
1228 switch (ch_type) {
1229 case NL80211_CHAN_NO_HT:
1230 ht_enabled = 0;
1231 break;
1232 case NL80211_CHAN_HT20:
1233 break;
1234 case NL80211_CHAN_HT40PLUS:
1235 chan_offset = 1;
1236 break;
1237 case NL80211_CHAN_HT40MINUS:
1238 chan_offset = -1;
1239 break;
1240 }
1241 } else if (bw && cf1) {
1242 /* This can happen for example with VHT80 ch switch */
1243 chan_offset = calculate_chan_offset(nla_get_u32(bw),
1244 nla_get_u32(freq),
1245 nla_get_u32(cf1),
1246 cf2 ? nla_get_u32(cf2) : 0);
1247 wpa_printf(MSG_DEBUG, "nl80211: Calculated channel offset: %d",
1248 chan_offset);
1249 } else {
1250 wpa_printf(MSG_WARNING, "nl80211: Unknown secondary channel information - following channel definition calculations may fail");
1251 }
1252
1253 os_memset(&data, 0, sizeof(data));
1254 data.ch_switch.freq = nla_get_u32(freq);
1255 if (is_6ghz_freq(data.ch_switch.freq))
1256 ht_enabled = 0;
1257 data.ch_switch.ht_enabled = ht_enabled;
1258 data.ch_switch.ch_offset = chan_offset;
1259 if (punct_bitmap)
1260 data.ch_switch.punct_bitmap = (u16) nla_get_u32(punct_bitmap);
1261 if (bw)
1262 data.ch_switch.ch_width = convert2width(nla_get_u32(bw));
1263 if (cf1)
1264 data.ch_switch.cf1 = nla_get_u32(cf1);
1265 if (cf2)
1266 data.ch_switch.cf2 = nla_get_u32(cf2);
1267
1268 if (link) {
1269 data.ch_switch.link_id = nla_get_u8(link);
1270 wpa_printf(MSG_DEBUG, "nl80211: Link ID: %d",
1271 data.ch_switch.link_id);
1272 } else {
1273 data.ch_switch.link_id = NL80211_DRV_LINK_ID_NA;
1274 }
1275
1276 if (finished) {
1277 if (data.ch_switch.link_id != NL80211_DRV_LINK_ID_NA) {
1278 struct i802_link *mld_link;
1279
1280 mld_link = nl80211_get_link(bss,
1281 data.ch_switch.link_id);
1282 mld_link->freq = data.ch_switch.freq;
1283 if (bw)
1284 mld_link->bandwidth = channel_width_to_int(
1285 data.ch_switch.ch_width);
1286 } else {
1287 bss->flink->freq = data.ch_switch.freq;
1288 if (bw)
1289 bss->flink->bandwidth = channel_width_to_int(
1290 data.ch_switch.ch_width);
1291 }
1292 }
1293
1294 if (link && is_sta_interface(drv->nlmode)) {
1295 u8 link_id = data.ch_switch.link_id;
1296
1297 if (link_id < MAX_NUM_MLD_LINKS &&
1298 drv->sta_mlo_info.valid_links & BIT(link_id)) {
1299 drv->sta_mlo_info.links[link_id].freq =
1300 data.ch_switch.freq;
1301 wpa_supplicant_event(
1302 bss->ctx,
1303 finished ? EVENT_LINK_CH_SWITCH :
1304 EVENT_LINK_CH_SWITCH_STARTED, &data);
1305 }
1306
1307 if (link_id != drv->sta_mlo_info.assoc_link_id)
1308 return;
1309 }
1310
1311 if (link && is_ap_interface(drv->nlmode) &&
1312 !nl80211_link_valid(bss->valid_links, data.ch_switch.link_id)) {
1313 wpa_printf(MSG_WARNING,
1314 "nl80211: Unknown link ID (%d) for channel switch (%s), ignoring",
1315 data.ch_switch.link_id, bss->ifname);
1316 return;
1317 }
1318
1319 drv->assoc_freq = data.ch_switch.freq;
1320
1321 wpa_supplicant_event(bss->ctx, finished ?
1322 EVENT_CH_SWITCH : EVENT_CH_SWITCH_STARTED, &data);
1323 }
1324
1325
mlme_timeout_event(struct wpa_driver_nl80211_data * drv,enum nl80211_commands cmd,struct nlattr * addr)1326 static void mlme_timeout_event(struct wpa_driver_nl80211_data *drv,
1327 enum nl80211_commands cmd, struct nlattr *addr)
1328 {
1329 union wpa_event_data event;
1330 enum wpa_event_type ev;
1331
1332 if (nla_len(addr) != ETH_ALEN)
1333 return;
1334
1335 wpa_printf(MSG_DEBUG, "nl80211: MLME event %d; timeout with " MACSTR,
1336 cmd, MAC2STR((u8 *) nla_data(addr)));
1337
1338 if (cmd == NL80211_CMD_AUTHENTICATE)
1339 ev = EVENT_AUTH_TIMED_OUT;
1340 else if (cmd == NL80211_CMD_ASSOCIATE)
1341 ev = EVENT_ASSOC_TIMED_OUT;
1342 else
1343 return;
1344
1345 os_memset(&event, 0, sizeof(event));
1346 os_memcpy(event.timeout_event.addr, nla_data(addr), ETH_ALEN);
1347 wpa_supplicant_event(drv->ctx, ev, &event);
1348 }
1349
1350
mlme_event_mgmt(struct i802_bss * bss,struct nlattr * freq,struct nlattr * sig,const u8 * frame,size_t len,int link_id)1351 static void mlme_event_mgmt(struct i802_bss *bss,
1352 struct nlattr *freq, struct nlattr *sig,
1353 const u8 *frame, size_t len,
1354 int link_id)
1355 {
1356 struct wpa_driver_nl80211_data *drv = bss->drv;
1357 const struct ieee80211_mgmt *mgmt;
1358 union wpa_event_data event;
1359 u16 fc, stype;
1360 int ssi_signal = 0;
1361 int rx_freq = 0;
1362
1363 wpa_printf(MSG_MSGDUMP, "nl80211: Frame event");
1364 mgmt = (const struct ieee80211_mgmt *) frame;
1365 if (len < 24) {
1366 wpa_printf(MSG_DEBUG, "nl80211: Too short management frame");
1367 return;
1368 }
1369
1370 fc = le_to_host16(mgmt->frame_control);
1371 stype = WLAN_FC_GET_STYPE(fc);
1372
1373 if (sig)
1374 ssi_signal = (s32) nla_get_u32(sig);
1375
1376 os_memset(&event, 0, sizeof(event));
1377 if (freq) {
1378 event.rx_mgmt.freq = nla_get_u32(freq);
1379 rx_freq = drv->last_mgmt_freq = event.rx_mgmt.freq;
1380 }
1381 wpa_printf(MSG_DEBUG,
1382 "nl80211: RX frame da=" MACSTR " sa=" MACSTR " bssid=" MACSTR
1383 " freq=%d ssi_signal=%d fc=0x%x seq_ctrl=0x%x stype=%u (%s) len=%u",
1384 MAC2STR(mgmt->da), MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid),
1385 rx_freq, ssi_signal, fc,
1386 le_to_host16(mgmt->seq_ctrl), stype, fc2str(fc),
1387 (unsigned int) len);
1388 event.rx_mgmt.frame = frame;
1389 event.rx_mgmt.frame_len = len;
1390 event.rx_mgmt.ssi_signal = ssi_signal;
1391 event.rx_mgmt.drv_priv = bss;
1392 event.rx_mgmt.ctx = bss->ctx;
1393 event.rx_mgmt.link_id = link_id;
1394
1395 wpa_supplicant_event(drv->ctx, EVENT_RX_MGMT, &event);
1396 }
1397
1398
mlme_event_mgmt_tx_status(struct i802_bss * bss,struct nlattr * cookie,const u8 * frame,size_t len,struct nlattr * ack)1399 static void mlme_event_mgmt_tx_status(struct i802_bss *bss,
1400 struct nlattr *cookie, const u8 *frame,
1401 size_t len, struct nlattr *ack)
1402 {
1403 union wpa_event_data event;
1404 const struct ieee80211_hdr *hdr = (const struct ieee80211_hdr *) frame;
1405 struct wpa_driver_nl80211_data *drv = bss->drv;
1406 u16 fc = le_to_host16(hdr->frame_control);
1407 u64 cookie_val = 0;
1408
1409 if (cookie)
1410 cookie_val = nla_get_u64(cookie);
1411 wpa_printf(MSG_DEBUG,
1412 "nl80211: Frame TX status event A1=" MACSTR
1413 " %sstype=%d cookie=0x%llx%s ack=%d",
1414 MAC2STR(hdr->addr1),
1415 WLAN_FC_GET_TYPE(fc) != WLAN_FC_TYPE_MGMT ? "not-mgmt " : "",
1416 WLAN_FC_GET_STYPE(fc), (long long unsigned int) cookie_val,
1417 cookie ? "" : "(N/A)", ack != NULL);
1418
1419 if (cookie_val && cookie_val == drv->eapol_tx_cookie &&
1420 len >= ETH_HLEN &&
1421 WPA_GET_BE16(frame + 2 * ETH_ALEN) == ETH_P_PAE) {
1422 wpa_printf(MSG_DEBUG,
1423 "nl80211: Work around misdelivered control port TX status for EAPOL");
1424 nl80211_control_port_frame_tx_status(bss, frame, len, ack,
1425 cookie);
1426 return;
1427 }
1428
1429 if (WLAN_FC_GET_TYPE(fc) != WLAN_FC_TYPE_MGMT)
1430 return;
1431
1432 if (!is_ap_interface(drv->nlmode) &&
1433 WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_ACTION) {
1434 if (!cookie)
1435 return;
1436
1437 wpa_printf(MSG_DEBUG,
1438 "nl80211: Frame TX status: cookie=0x%llx%s (ack=%d)",
1439 (long long unsigned int) cookie_val,
1440 cookie_val == drv->send_frame_cookie ?
1441 " (match)" : " (unknown)", ack != NULL);
1442 if (cookie_val != drv->send_frame_cookie)
1443 return;
1444 } else if (!is_ap_interface(drv->nlmode) &&
1445 WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_AUTH) {
1446 wpa_printf(MSG_DEBUG,
1447 "nl80211: Authentication frame TX status: ack=%d",
1448 !!ack);
1449 }
1450
1451 os_memset(&event, 0, sizeof(event));
1452 event.tx_status.type = WLAN_FC_GET_TYPE(fc);
1453 event.tx_status.stype = WLAN_FC_GET_STYPE(fc);
1454 event.tx_status.dst = hdr->addr1;
1455 event.tx_status.data = frame;
1456 event.tx_status.data_len = len;
1457 event.tx_status.ack = ack != NULL;
1458 event.tx_status.link_id = cookie_val == drv->send_frame_cookie ?
1459 drv->send_frame_link_id : NL80211_DRV_LINK_ID_NA;
1460 wpa_supplicant_event(bss->ctx, EVENT_TX_STATUS, &event);
1461 }
1462
1463
mlme_event_deauth_disassoc(struct wpa_driver_nl80211_data * drv,enum wpa_event_type type,const u8 * frame,size_t len)1464 static void mlme_event_deauth_disassoc(struct wpa_driver_nl80211_data *drv,
1465 enum wpa_event_type type,
1466 const u8 *frame, size_t len)
1467 {
1468 const struct ieee80211_mgmt *mgmt;
1469 union wpa_event_data event;
1470 const u8 *bssid = NULL;
1471 u16 reason_code = 0;
1472
1473 if (type == EVENT_DEAUTH)
1474 wpa_printf(MSG_DEBUG, "nl80211: Deauthenticate event");
1475 else
1476 wpa_printf(MSG_DEBUG, "nl80211: Disassociate event");
1477
1478 mgmt = (const struct ieee80211_mgmt *) frame;
1479 if (len >= 24) {
1480 bssid = mgmt->bssid;
1481
1482 if ((drv->capa.flags & WPA_DRIVER_FLAGS_SME) &&
1483 !drv->associated &&
1484 !ether_addr_equal(bssid, drv->auth_bssid) &&
1485 !ether_addr_equal(bssid, drv->auth_attempt_bssid) &&
1486 ether_addr_equal(bssid, drv->prev_bssid)) {
1487 /*
1488 * Avoid issues with some roaming cases where
1489 * disconnection event for the old AP may show up after
1490 * we have started connection with the new AP.
1491 * In case of locally generated event clear
1492 * ignore_next_local_deauth as well, to avoid next local
1493 * deauth event be wrongly ignored.
1494 */
1495 if (ether_addr_equal(mgmt->sa, drv->first_bss->addr) ||
1496 (!is_zero_ether_addr(drv->first_bss->prev_addr) &&
1497 ether_addr_equal(mgmt->sa,
1498 drv->first_bss->prev_addr))) {
1499 wpa_printf(MSG_DEBUG,
1500 "nl80211: Received a locally generated deauth event. Clear ignore_next_local_deauth flag");
1501 drv->ignore_next_local_deauth = 0;
1502 } else {
1503 wpa_printf(MSG_DEBUG,
1504 "nl80211: Ignore deauth/disassoc event from old AP " MACSTR " when already authenticating with " MACSTR,
1505 MAC2STR(bssid),
1506 MAC2STR(drv->auth_attempt_bssid));
1507 }
1508 return;
1509 }
1510
1511 if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME) &&
1512 drv->connect_reassoc && drv->associated &&
1513 ether_addr_equal(bssid, drv->prev_bssid) &&
1514 !ether_addr_equal(bssid, drv->auth_attempt_bssid)) {
1515 /*
1516 * Avoid issues with some roaming cases where
1517 * disconnection event for the old AP may show up after
1518 * we have started connection with the new AP.
1519 */
1520 wpa_printf(MSG_DEBUG,
1521 "nl80211: Ignore deauth/disassoc event from old AP "
1522 MACSTR
1523 " when already connecting with " MACSTR,
1524 MAC2STR(bssid),
1525 MAC2STR(drv->auth_attempt_bssid));
1526 return;
1527 }
1528
1529 if (drv->associated != 0 &&
1530 !ether_addr_equal(bssid, drv->bssid) &&
1531 !ether_addr_equal(bssid, drv->auth_bssid)) {
1532 /*
1533 * We have presumably received this deauth as a
1534 * response to a clear_state_mismatch() outgoing
1535 * deauth. Don't let it take us offline!
1536 */
1537 wpa_printf(MSG_DEBUG, "nl80211: Deauth received "
1538 "from Unknown BSSID " MACSTR " -- ignoring",
1539 MAC2STR(bssid));
1540 return;
1541 }
1542 }
1543
1544 nl80211_mark_disconnected(drv);
1545 os_memset(&event, 0, sizeof(event));
1546
1547 /* Note: Same offset for Reason Code in both frame subtypes */
1548 if (len >= 24 + sizeof(mgmt->u.deauth))
1549 reason_code = le_to_host16(mgmt->u.deauth.reason_code);
1550
1551 if (type == EVENT_DISASSOC) {
1552 event.disassoc_info.locally_generated =
1553 ether_addr_equal(mgmt->sa, drv->first_bss->addr);
1554 event.disassoc_info.addr = bssid;
1555 event.disassoc_info.reason_code = reason_code;
1556 if (frame + len > mgmt->u.disassoc.variable) {
1557 event.disassoc_info.ie = mgmt->u.disassoc.variable;
1558 event.disassoc_info.ie_len = frame + len -
1559 mgmt->u.disassoc.variable;
1560 }
1561 } else {
1562 event.deauth_info.locally_generated =
1563 ether_addr_equal(mgmt->sa, drv->first_bss->addr);
1564 if (drv->ignore_deauth_event) {
1565 wpa_printf(MSG_DEBUG, "nl80211: Ignore deauth event due to previous forced deauth-during-auth");
1566 drv->ignore_deauth_event = 0;
1567 if (event.deauth_info.locally_generated)
1568 drv->ignore_next_local_deauth = 0;
1569 return;
1570 }
1571 if (drv->ignore_next_local_deauth) {
1572 drv->ignore_next_local_deauth = 0;
1573 if (event.deauth_info.locally_generated) {
1574 wpa_printf(MSG_DEBUG, "nl80211: Ignore deauth event triggered due to own deauth request");
1575 return;
1576 }
1577 wpa_printf(MSG_WARNING, "nl80211: Was expecting local deauth but got another disconnect event first");
1578 }
1579 event.deauth_info.addr = bssid;
1580 event.deauth_info.reason_code = reason_code;
1581 if (frame + len > mgmt->u.deauth.variable) {
1582 event.deauth_info.ie = mgmt->u.deauth.variable;
1583 event.deauth_info.ie_len = frame + len -
1584 mgmt->u.deauth.variable;
1585 }
1586 }
1587
1588 wpa_supplicant_event(drv->ctx, type, &event);
1589 }
1590
1591
mlme_event_unprot_disconnect(struct wpa_driver_nl80211_data * drv,enum wpa_event_type type,const u8 * frame,size_t len)1592 static void mlme_event_unprot_disconnect(struct wpa_driver_nl80211_data *drv,
1593 enum wpa_event_type type,
1594 const u8 *frame, size_t len)
1595 {
1596 const struct ieee80211_mgmt *mgmt;
1597 union wpa_event_data event;
1598 u16 reason_code = 0;
1599
1600 if (type == EVENT_UNPROT_DEAUTH)
1601 wpa_printf(MSG_DEBUG, "nl80211: Unprot Deauthenticate event");
1602 else
1603 wpa_printf(MSG_DEBUG, "nl80211: Unprot Disassociate event");
1604
1605 if (len < 24)
1606 return;
1607
1608 mgmt = (const struct ieee80211_mgmt *) frame;
1609
1610 os_memset(&event, 0, sizeof(event));
1611 /* Note: Same offset for Reason Code in both frame subtypes */
1612 if (len >= 24 + sizeof(mgmt->u.deauth))
1613 reason_code = le_to_host16(mgmt->u.deauth.reason_code);
1614
1615 if (type == EVENT_UNPROT_DISASSOC) {
1616 event.unprot_disassoc.sa = mgmt->sa;
1617 event.unprot_disassoc.da = mgmt->da;
1618 event.unprot_disassoc.reason_code = reason_code;
1619 } else {
1620 event.unprot_deauth.sa = mgmt->sa;
1621 event.unprot_deauth.da = mgmt->da;
1622 event.unprot_deauth.reason_code = reason_code;
1623 }
1624
1625 wpa_supplicant_event(drv->ctx, type, &event);
1626 }
1627
1628
mlme_event_unprot_beacon(struct wpa_driver_nl80211_data * drv,const u8 * frame,size_t len)1629 static void mlme_event_unprot_beacon(struct wpa_driver_nl80211_data *drv,
1630 const u8 *frame, size_t len)
1631 {
1632 const struct ieee80211_mgmt *mgmt;
1633 union wpa_event_data event;
1634
1635 if (len < 24)
1636 return;
1637
1638 mgmt = (const struct ieee80211_mgmt *) frame;
1639
1640 os_memset(&event, 0, sizeof(event));
1641 event.unprot_beacon.sa = mgmt->sa;
1642 wpa_supplicant_event(drv->ctx, EVENT_UNPROT_BEACON, &event);
1643 }
1644
1645
1646 static s8
nl80211_get_link_id_by_freq(struct i802_bss * bss,unsigned int freq)1647 nl80211_get_link_id_by_freq(struct i802_bss *bss, unsigned int freq)
1648 {
1649 unsigned int i;
1650
1651 for_each_link(bss->valid_links, i) {
1652 if ((unsigned int) bss->links[i].freq == freq)
1653 return i;
1654 }
1655
1656 return NL80211_DRV_LINK_ID_NA;
1657 }
1658
1659
mlme_event(struct i802_bss * bss,enum nl80211_commands cmd,struct nlattr * frame,struct nlattr * addr,struct nlattr * timed_out,struct nlattr * freq,struct nlattr * ack,struct nlattr * cookie,struct nlattr * sig,struct nlattr * wmm,struct nlattr * req_ie,struct nlattr * link)1660 static void mlme_event(struct i802_bss *bss,
1661 enum nl80211_commands cmd, struct nlattr *frame,
1662 struct nlattr *addr, struct nlattr *timed_out,
1663 struct nlattr *freq, struct nlattr *ack,
1664 struct nlattr *cookie, struct nlattr *sig,
1665 struct nlattr *wmm, struct nlattr *req_ie,
1666 struct nlattr *link)
1667 {
1668 struct wpa_driver_nl80211_data *drv = bss->drv;
1669 u16 stype = 0, auth_type = 0;
1670 const u8 *data;
1671 size_t len;
1672 int link_id = -1;
1673 struct i802_link *mld_link = NULL;
1674
1675 if (timed_out && addr) {
1676 mlme_timeout_event(drv, cmd, addr);
1677 return;
1678 }
1679
1680 if (frame == NULL) {
1681 wpa_printf(MSG_DEBUG,
1682 "nl80211: MLME event %d (%s) without frame data",
1683 cmd, nl80211_command_to_string(cmd));
1684 return;
1685 }
1686
1687 /* Determine the MLD link either by an explicitly provided link id or
1688 * finding a match based on the frequency. */
1689 if (link)
1690 link_id = nla_get_u8(link);
1691 else if (freq)
1692 link_id = nl80211_get_link_id_by_freq(bss, nla_get_u32(freq));
1693
1694 if (nl80211_link_valid(bss->valid_links, link_id))
1695 mld_link = nl80211_get_link(bss, link_id);
1696
1697 data = nla_data(frame);
1698 len = nla_len(frame);
1699 if (len < 4 + 2 * ETH_ALEN) {
1700 wpa_printf(MSG_MSGDUMP, "nl80211: MLME event %d (%s) on %s("
1701 MACSTR ") - too short",
1702 cmd, nl80211_command_to_string(cmd), bss->ifname,
1703 MAC2STR(bss->addr));
1704 return;
1705 }
1706 wpa_printf(MSG_MSGDUMP, "nl80211: MLME event %d (%s) on %s(" MACSTR
1707 ") A1=" MACSTR " A2=" MACSTR " on link_id=%d", cmd,
1708 nl80211_command_to_string(cmd), bss->ifname,
1709 MAC2STR(bss->addr), MAC2STR(data + 4),
1710 MAC2STR(data + 4 + ETH_ALEN), link_id);
1711
1712 /* PASN Authentication frame can be received with a different source MAC
1713 * address. Allow NL80211_CMD_FRAME event with foreign addresses also.
1714 */
1715 if (cmd == NL80211_CMD_FRAME && len >= 24) {
1716 const struct ieee80211_mgmt *mgmt;
1717 u16 fc;
1718
1719 mgmt = (const struct ieee80211_mgmt *) data;
1720 fc = le_to_host16(mgmt->frame_control);
1721 stype = WLAN_FC_GET_STYPE(fc);
1722 auth_type = le_to_host16(mgmt->u.auth.auth_alg);
1723 }
1724
1725 if (cmd == NL80211_CMD_FRAME && stype == WLAN_FC_STYPE_AUTH &&
1726 auth_type == WLAN_AUTH_PASN) {
1727 wpa_printf(MSG_DEBUG,
1728 "nl80211: %s: Allow PASN frame for foreign address",
1729 bss->ifname);
1730 } else if (cmd != NL80211_CMD_FRAME_TX_STATUS &&
1731 !(data[4] & 0x01) &&
1732 !ether_addr_equal(bss->addr, data + 4) &&
1733 (is_zero_ether_addr(bss->rand_addr) ||
1734 !ether_addr_equal(bss->rand_addr, data + 4)) &&
1735 !ether_addr_equal(bss->addr, data + 4 + ETH_ALEN) &&
1736 (is_zero_ether_addr(drv->first_bss->prev_addr) ||
1737 !ether_addr_equal(bss->prev_addr, data + 4 + ETH_ALEN)) &&
1738 (!mld_link ||
1739 !ether_addr_equal(mld_link->addr, data + 4))) {
1740 wpa_printf(MSG_MSGDUMP, "nl80211: %s: Ignore MLME frame event "
1741 "for foreign address", bss->ifname);
1742 return;
1743 }
1744 wpa_hexdump(MSG_MSGDUMP, "nl80211: MLME event frame",
1745 nla_data(frame), nla_len(frame));
1746
1747 switch (cmd) {
1748 case NL80211_CMD_AUTHENTICATE:
1749 mlme_event_auth(drv, nla_data(frame), nla_len(frame));
1750 break;
1751 case NL80211_CMD_ASSOCIATE:
1752 mlme_event_assoc(drv, nla_data(frame), nla_len(frame), wmm,
1753 req_ie);
1754 break;
1755 case NL80211_CMD_DEAUTHENTICATE:
1756 mlme_event_deauth_disassoc(drv, EVENT_DEAUTH,
1757 nla_data(frame), nla_len(frame));
1758 break;
1759 case NL80211_CMD_DISASSOCIATE:
1760 mlme_event_deauth_disassoc(drv, EVENT_DISASSOC,
1761 nla_data(frame), nla_len(frame));
1762 break;
1763 case NL80211_CMD_FRAME:
1764 mlme_event_mgmt(bss, freq, sig, nla_data(frame),
1765 nla_len(frame), link_id);
1766 break;
1767 case NL80211_CMD_FRAME_TX_STATUS:
1768 mlme_event_mgmt_tx_status(bss, cookie, nla_data(frame),
1769 nla_len(frame), ack);
1770 break;
1771 case NL80211_CMD_UNPROT_DEAUTHENTICATE:
1772 mlme_event_unprot_disconnect(drv, EVENT_UNPROT_DEAUTH,
1773 nla_data(frame), nla_len(frame));
1774 break;
1775 case NL80211_CMD_UNPROT_DISASSOCIATE:
1776 mlme_event_unprot_disconnect(drv, EVENT_UNPROT_DISASSOC,
1777 nla_data(frame), nla_len(frame));
1778 break;
1779 case NL80211_CMD_UNPROT_BEACON:
1780 mlme_event_unprot_beacon(drv, nla_data(frame), nla_len(frame));
1781 break;
1782 default:
1783 break;
1784 }
1785 }
1786
1787
mlme_event_michael_mic_failure(struct i802_bss * bss,struct nlattr * tb[])1788 static void mlme_event_michael_mic_failure(struct i802_bss *bss,
1789 struct nlattr *tb[])
1790 {
1791 union wpa_event_data data;
1792
1793 wpa_printf(MSG_DEBUG, "nl80211: MLME event Michael MIC failure");
1794 os_memset(&data, 0, sizeof(data));
1795 if (tb[NL80211_ATTR_MAC]) {
1796 wpa_hexdump(MSG_DEBUG, "nl80211: Source MAC address",
1797 nla_data(tb[NL80211_ATTR_MAC]),
1798 nla_len(tb[NL80211_ATTR_MAC]));
1799 data.michael_mic_failure.src = nla_data(tb[NL80211_ATTR_MAC]);
1800 }
1801 if (tb[NL80211_ATTR_KEY_SEQ]) {
1802 wpa_hexdump(MSG_DEBUG, "nl80211: TSC",
1803 nla_data(tb[NL80211_ATTR_KEY_SEQ]),
1804 nla_len(tb[NL80211_ATTR_KEY_SEQ]));
1805 }
1806 if (tb[NL80211_ATTR_KEY_TYPE]) {
1807 enum nl80211_key_type key_type =
1808 nla_get_u32(tb[NL80211_ATTR_KEY_TYPE]);
1809 wpa_printf(MSG_DEBUG, "nl80211: Key Type %d", key_type);
1810 if (key_type == NL80211_KEYTYPE_PAIRWISE)
1811 data.michael_mic_failure.unicast = 1;
1812 } else
1813 data.michael_mic_failure.unicast = 1;
1814
1815 if (tb[NL80211_ATTR_KEY_IDX]) {
1816 u8 key_id = nla_get_u8(tb[NL80211_ATTR_KEY_IDX]);
1817 wpa_printf(MSG_DEBUG, "nl80211: Key Id %d", key_id);
1818 }
1819
1820 wpa_supplicant_event(bss->ctx, EVENT_MICHAEL_MIC_FAILURE, &data);
1821 }
1822
1823
mlme_event_join_ibss(struct wpa_driver_nl80211_data * drv,struct nlattr * tb[])1824 static void mlme_event_join_ibss(struct wpa_driver_nl80211_data *drv,
1825 struct nlattr *tb[])
1826 {
1827 unsigned int freq;
1828 union wpa_event_data event;
1829
1830 if (tb[NL80211_ATTR_MAC] == NULL) {
1831 wpa_printf(MSG_DEBUG, "nl80211: No address in IBSS joined "
1832 "event");
1833 return;
1834 }
1835 os_memcpy(drv->bssid, nla_data(tb[NL80211_ATTR_MAC]), ETH_ALEN);
1836
1837 drv->associated = 1;
1838 wpa_printf(MSG_DEBUG, "nl80211: IBSS " MACSTR " joined",
1839 MAC2STR(drv->bssid));
1840
1841 freq = nl80211_get_assoc_freq(drv);
1842 if (freq) {
1843 wpa_printf(MSG_DEBUG, "nl80211: IBSS on frequency %u MHz",
1844 freq);
1845 drv->first_bss->flink->freq = freq;
1846 }
1847
1848 os_memset(&event, 0, sizeof(event));
1849 event.assoc_info.freq = freq;
1850
1851 wpa_supplicant_event(drv->ctx, EVENT_ASSOC, &event);
1852 }
1853
1854
mlme_event_remain_on_channel(struct wpa_driver_nl80211_data * drv,int cancel_event,struct nlattr * tb[])1855 static void mlme_event_remain_on_channel(struct wpa_driver_nl80211_data *drv,
1856 int cancel_event, struct nlattr *tb[])
1857 {
1858 unsigned int freq, chan_type, duration;
1859 union wpa_event_data data;
1860 u64 cookie;
1861
1862 if (tb[NL80211_ATTR_WIPHY_FREQ])
1863 freq = nla_get_u32(tb[NL80211_ATTR_WIPHY_FREQ]);
1864 else
1865 freq = 0;
1866
1867 if (tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE])
1868 chan_type = nla_get_u32(tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1869 else
1870 chan_type = 0;
1871
1872 if (tb[NL80211_ATTR_DURATION])
1873 duration = nla_get_u32(tb[NL80211_ATTR_DURATION]);
1874 else
1875 duration = 0;
1876
1877 if (tb[NL80211_ATTR_COOKIE])
1878 cookie = nla_get_u64(tb[NL80211_ATTR_COOKIE]);
1879 else
1880 cookie = 0;
1881
1882 wpa_printf(MSG_DEBUG, "nl80211: Remain-on-channel event (cancel=%d "
1883 "freq=%u channel_type=%u duration=%u cookie=0x%llx (%s))",
1884 cancel_event, freq, chan_type, duration,
1885 (long long unsigned int) cookie,
1886 cookie == drv->remain_on_chan_cookie ? "match" : "unknown");
1887
1888 if (cookie != drv->remain_on_chan_cookie)
1889 return; /* not for us */
1890
1891 if (cancel_event)
1892 drv->pending_remain_on_chan = 0;
1893
1894 os_memset(&data, 0, sizeof(data));
1895 data.remain_on_channel.freq = freq;
1896 data.remain_on_channel.duration = duration;
1897 wpa_supplicant_event(drv->ctx, cancel_event ?
1898 EVENT_CANCEL_REMAIN_ON_CHANNEL :
1899 EVENT_REMAIN_ON_CHANNEL, &data);
1900 }
1901
1902
mlme_event_ft_event(struct wpa_driver_nl80211_data * drv,struct nlattr * tb[])1903 static void mlme_event_ft_event(struct wpa_driver_nl80211_data *drv,
1904 struct nlattr *tb[])
1905 {
1906 union wpa_event_data data;
1907
1908 os_memset(&data, 0, sizeof(data));
1909
1910 if (tb[NL80211_ATTR_IE]) {
1911 data.ft_ies.ies = nla_data(tb[NL80211_ATTR_IE]);
1912 data.ft_ies.ies_len = nla_len(tb[NL80211_ATTR_IE]);
1913 }
1914
1915 if (tb[NL80211_ATTR_IE_RIC]) {
1916 data.ft_ies.ric_ies = nla_data(tb[NL80211_ATTR_IE_RIC]);
1917 data.ft_ies.ric_ies_len = nla_len(tb[NL80211_ATTR_IE_RIC]);
1918 }
1919
1920 if (tb[NL80211_ATTR_MAC])
1921 os_memcpy(data.ft_ies.target_ap,
1922 nla_data(tb[NL80211_ATTR_MAC]), ETH_ALEN);
1923
1924 wpa_printf(MSG_DEBUG, "nl80211: FT event target_ap " MACSTR,
1925 MAC2STR(data.ft_ies.target_ap));
1926
1927 wpa_supplicant_event(drv->ctx, EVENT_FT_RESPONSE, &data);
1928 }
1929
1930
mlme_event_dh_event(struct wpa_driver_nl80211_data * drv,struct i802_bss * bss,struct nlattr * tb[])1931 static void mlme_event_dh_event(struct wpa_driver_nl80211_data *drv,
1932 struct i802_bss *bss,
1933 struct nlattr *tb[])
1934 {
1935 union wpa_event_data data;
1936 u8 *addr, *link_addr = NULL;
1937 int assoc_link_id = -1;
1938
1939 if (!is_ap_interface(drv->nlmode))
1940 return;
1941 if (!tb[NL80211_ATTR_MAC] || !tb[NL80211_ATTR_IE])
1942 return;
1943
1944 os_memset(&data, 0, sizeof(data));
1945 addr = nla_data(tb[NL80211_ATTR_MAC]);
1946
1947 if (!bss->valid_links &&
1948 (tb[NL80211_ATTR_MLO_LINK_ID] ||
1949 tb[NL80211_ATTR_MLD_ADDR])) {
1950 wpa_printf(MSG_ERROR,
1951 "nl80211: Link info not expected for DH event for non-MLD AP");
1952 return;
1953 }
1954
1955 if (tb[NL80211_ATTR_MLO_LINK_ID]) {
1956 assoc_link_id = nla_get_u8(tb[NL80211_ATTR_MLO_LINK_ID]);
1957 wpa_printf(MSG_DEBUG,
1958 "nl80211: STA assoc link ID %d in UPDATE_OWE_INFO event",
1959 assoc_link_id);
1960
1961 if (assoc_link_id != NL80211_DRV_LINK_ID_NA &&
1962 tb[NL80211_ATTR_MLD_ADDR]) {
1963 link_addr = addr;
1964 addr = nla_data(tb[NL80211_ATTR_MLD_ADDR]);
1965 wpa_printf(MSG_DEBUG,
1966 "nl80211: STA assoc link addr " MACSTR,
1967 MAC2STR(link_addr));
1968 }
1969 }
1970
1971 data.update_dh.peer = addr;
1972 data.update_dh.ie = nla_data(tb[NL80211_ATTR_IE]);
1973 data.update_dh.ie_len = nla_len(tb[NL80211_ATTR_IE]);
1974 data.update_dh.assoc_link_id = assoc_link_id;
1975 data.update_dh.link_addr = link_addr;
1976
1977 wpa_printf(MSG_DEBUG, "nl80211: DH event - peer " MACSTR,
1978 MAC2STR(data.update_dh.peer));
1979
1980 wpa_supplicant_event(bss->ctx, EVENT_UPDATE_DH, &data);
1981 }
1982
1983
send_scan_event(struct i802_bss * bss,int aborted,struct nlattr * tb[],int external_scan)1984 static void send_scan_event(struct i802_bss *bss, int aborted,
1985 struct nlattr *tb[], int external_scan)
1986 {
1987 struct wpa_driver_nl80211_data *drv = bss->drv;
1988 union wpa_event_data event;
1989 struct nlattr *nl;
1990 int rem;
1991 struct scan_info *info;
1992 #define MAX_REPORT_FREQS 110
1993 int freqs[MAX_REPORT_FREQS];
1994 int num_freqs = 0;
1995 struct i802_link *mld_link;
1996 void *ctx = bss->ctx;
1997
1998 if (!external_scan && drv->scan_for_auth) {
1999 drv->scan_for_auth = 0;
2000 wpa_printf(MSG_DEBUG, "nl80211: Scan results for missing "
2001 "cfg80211 BSS entry");
2002 wpa_driver_nl80211_authenticate_retry(drv);
2003 return;
2004 }
2005
2006 os_memset(&event, 0, sizeof(event));
2007 info = &event.scan_info;
2008 info->aborted = aborted;
2009 info->external_scan = external_scan;
2010 info->nl_scan_event = 1;
2011
2012 if (tb[NL80211_ATTR_SCAN_SSIDS]) {
2013 nla_for_each_nested(nl, tb[NL80211_ATTR_SCAN_SSIDS], rem) {
2014 struct wpa_driver_scan_ssid *s =
2015 &info->ssids[info->num_ssids];
2016 s->ssid = nla_data(nl);
2017 s->ssid_len = nla_len(nl);
2018 wpa_printf(MSG_DEBUG, "nl80211: Scan probed for SSID '%s'",
2019 wpa_ssid_txt(s->ssid, s->ssid_len));
2020 info->num_ssids++;
2021 if (info->num_ssids == WPAS_MAX_SCAN_SSIDS)
2022 break;
2023 }
2024 }
2025 if (tb[NL80211_ATTR_SCAN_FREQUENCIES]) {
2026 char msg[MAX_REPORT_FREQS * 5 + 1], *pos, *end;
2027 int res;
2028
2029 pos = msg;
2030 end = pos + sizeof(msg);
2031 *pos = '\0';
2032
2033 nla_for_each_nested(nl, tb[NL80211_ATTR_SCAN_FREQUENCIES], rem)
2034 {
2035 freqs[num_freqs] = nla_get_u32(nl);
2036 res = os_snprintf(pos, end - pos, " %d",
2037 freqs[num_freqs]);
2038 if (!os_snprintf_error(end - pos, res))
2039 pos += res;
2040 num_freqs++;
2041 if (num_freqs == MAX_REPORT_FREQS)
2042 break;
2043 }
2044 info->freqs = freqs;
2045 info->num_freqs = num_freqs;
2046 msg[sizeof(msg) - 1] = '\0';
2047 wpa_printf(MSG_DEBUG, "nl80211: Scan included frequencies:%s",
2048 msg);
2049 }
2050
2051 if (tb[NL80211_ATTR_SCAN_START_TIME_TSF] &&
2052 tb[NL80211_ATTR_SCAN_START_TIME_TSF_BSSID]) {
2053 info->scan_start_tsf =
2054 nla_get_u64(tb[NL80211_ATTR_SCAN_START_TIME_TSF]);
2055 os_memcpy(info->scan_start_tsf_bssid,
2056 nla_data(tb[NL80211_ATTR_SCAN_START_TIME_TSF_BSSID]),
2057 ETH_ALEN);
2058 }
2059
2060 /* Need to pass to the correct link ctx during AP MLD operation */
2061 if (is_ap_interface(drv->nlmode)) {
2062 mld_link = bss->scan_link;
2063 if (!mld_link) {
2064 wpa_printf(MSG_DEBUG,
2065 "nl80211: Scan event on unknown link");
2066 } else if (mld_link->ctx) {
2067 u8 link_id = nl80211_get_link_id_from_link(bss,
2068 mld_link);
2069
2070 wpa_printf(MSG_DEBUG,
2071 "nl80211: Scan event for link_id %d",
2072 link_id);
2073 ctx = mld_link->ctx;
2074 }
2075 }
2076
2077 wpa_supplicant_event(ctx, EVENT_SCAN_RESULTS, &event);
2078 }
2079
2080
nl80211_cqm_event(struct i802_bss * bss,struct nlattr * tb[])2081 static void nl80211_cqm_event(struct i802_bss *bss, struct nlattr *tb[])
2082 {
2083 struct wpa_driver_nl80211_data *drv = bss->drv;
2084 static struct nla_policy cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
2085 [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
2086 [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U8 },
2087 [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
2088 [NL80211_ATTR_CQM_PKT_LOSS_EVENT] = { .type = NLA_U32 },
2089 [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
2090 [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
2091 [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
2092 [NL80211_ATTR_CQM_BEACON_LOSS_EVENT] = { .type = NLA_FLAG },
2093 };
2094 struct nlattr *cqm[NL80211_ATTR_CQM_MAX + 1];
2095 enum nl80211_cqm_rssi_threshold_event event;
2096 union wpa_event_data ed;
2097 int res;
2098
2099 if (tb[NL80211_ATTR_CQM] == NULL ||
2100 nla_parse_nested(cqm, NL80211_ATTR_CQM_MAX, tb[NL80211_ATTR_CQM],
2101 cqm_policy)) {
2102 wpa_printf(MSG_DEBUG, "nl80211: Ignore invalid CQM event");
2103 return;
2104 }
2105
2106 os_memset(&ed, 0, sizeof(ed));
2107
2108 if (cqm[NL80211_ATTR_CQM_PKT_LOSS_EVENT]) {
2109 if (!tb[NL80211_ATTR_MAC])
2110 return;
2111 os_memcpy(ed.low_ack.addr, nla_data(tb[NL80211_ATTR_MAC]),
2112 ETH_ALEN);
2113 ed.low_ack.num_packets =
2114 nla_get_u32(cqm[NL80211_ATTR_CQM_PKT_LOSS_EVENT]);
2115 wpa_printf(MSG_DEBUG, "nl80211: Packet loss event for " MACSTR
2116 " (num_packets %u)",
2117 MAC2STR(ed.low_ack.addr), ed.low_ack.num_packets);
2118 wpa_supplicant_event(bss->ctx, EVENT_STATION_LOW_ACK, &ed);
2119 return;
2120 }
2121
2122 if (cqm[NL80211_ATTR_CQM_BEACON_LOSS_EVENT]) {
2123 wpa_printf(MSG_DEBUG, "nl80211: Beacon loss event");
2124 wpa_supplicant_event(drv->ctx, EVENT_BEACON_LOSS, NULL);
2125 return;
2126 }
2127
2128 if (cqm[NL80211_ATTR_CQM_TXE_RATE] &&
2129 cqm[NL80211_ATTR_CQM_TXE_PKTS] &&
2130 cqm[NL80211_ATTR_CQM_TXE_INTVL] &&
2131 cqm[NL80211_ATTR_MAC]) {
2132 wpa_printf(MSG_DEBUG, "nl80211: CQM TXE event for " MACSTR
2133 " (rate: %u pkts: %u interval: %u)",
2134 MAC2STR((u8 *) nla_data(cqm[NL80211_ATTR_MAC])),
2135 nla_get_u32(cqm[NL80211_ATTR_CQM_TXE_RATE]),
2136 nla_get_u32(cqm[NL80211_ATTR_CQM_TXE_PKTS]),
2137 nla_get_u32(cqm[NL80211_ATTR_CQM_TXE_INTVL]));
2138 return;
2139 }
2140
2141 if (cqm[NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] == NULL) {
2142 wpa_printf(MSG_DEBUG,
2143 "nl80211: Not a CQM RSSI threshold event");
2144 return;
2145 }
2146 event = nla_get_u32(cqm[NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT]);
2147
2148 if (event == NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH) {
2149 wpa_printf(MSG_DEBUG, "nl80211: Connection quality monitor "
2150 "event: RSSI high");
2151 ed.signal_change.above_threshold = 1;
2152 } else if (event == NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW) {
2153 wpa_printf(MSG_DEBUG, "nl80211: Connection quality monitor "
2154 "event: RSSI low");
2155 ed.signal_change.above_threshold = 0;
2156 } else {
2157 wpa_printf(MSG_DEBUG,
2158 "nl80211: Unknown CQM RSSI threshold event: %d",
2159 event);
2160 return;
2161 }
2162
2163 /*
2164 * nl80211_get_link_signal() and nl80211_get_link_noise() set default
2165 * values in case querying the driver fails.
2166 */
2167 res = nl80211_get_link_signal(drv, drv->bssid, &ed.signal_change.data);
2168 if (res == 0) {
2169 wpa_printf(MSG_DEBUG, "nl80211: Signal: %d dBm txrate: %lu",
2170 ed.signal_change.data.signal,
2171 ed.signal_change.data.current_tx_rate);
2172 } else {
2173 wpa_printf(MSG_DEBUG,
2174 "nl80211: Querying the driver for signal info failed");
2175 }
2176
2177 res = nl80211_get_link_noise(drv, &ed.signal_change);
2178 if (res == 0) {
2179 wpa_printf(MSG_DEBUG, "nl80211: Noise: %d dBm",
2180 ed.signal_change.current_noise);
2181 } else {
2182 wpa_printf(MSG_DEBUG,
2183 "nl80211: Querying the driver for noise info failed");
2184 }
2185
2186 wpa_supplicant_event(drv->ctx, EVENT_SIGNAL_CHANGE, &ed);
2187 }
2188
2189
nl80211_new_peer_candidate(struct wpa_driver_nl80211_data * drv,struct nlattr ** tb)2190 static void nl80211_new_peer_candidate(struct wpa_driver_nl80211_data *drv,
2191 struct nlattr **tb)
2192 {
2193 const u8 *addr;
2194 union wpa_event_data data;
2195
2196 if (drv->nlmode != NL80211_IFTYPE_MESH_POINT ||
2197 !tb[NL80211_ATTR_MAC] || !tb[NL80211_ATTR_IE])
2198 return;
2199
2200 addr = nla_data(tb[NL80211_ATTR_MAC]);
2201 wpa_printf(MSG_DEBUG, "nl80211: New peer candidate " MACSTR,
2202 MAC2STR(addr));
2203
2204 os_memset(&data, 0, sizeof(data));
2205 data.mesh_peer.peer = addr;
2206 data.mesh_peer.ies = nla_data(tb[NL80211_ATTR_IE]);
2207 data.mesh_peer.ie_len = nla_len(tb[NL80211_ATTR_IE]);
2208 wpa_supplicant_event(drv->ctx, EVENT_NEW_PEER_CANDIDATE, &data);
2209 }
2210
2211
nl80211_new_station_event(struct wpa_driver_nl80211_data * drv,struct i802_bss * bss,struct nlattr ** tb)2212 static void nl80211_new_station_event(struct wpa_driver_nl80211_data *drv,
2213 struct i802_bss *bss,
2214 struct nlattr **tb)
2215 {
2216 u8 *peer_addr;
2217 union wpa_event_data data;
2218
2219 if (tb[NL80211_ATTR_MAC] == NULL)
2220 return;
2221 peer_addr = nla_data(tb[NL80211_ATTR_MAC]);
2222 wpa_printf(MSG_DEBUG, "nl80211: New station " MACSTR,
2223 MAC2STR(peer_addr));
2224
2225 if (is_ap_interface(drv->nlmode) && drv->device_ap_sme) {
2226 u8 *link_addr = NULL;
2227 int assoc_link_id = -1;
2228 u8 *req_ies = NULL, *resp_ies = NULL;
2229 size_t req_ies_len = 0, resp_ies_len = 0;
2230
2231 if (!bss->valid_links &&
2232 (tb[NL80211_ATTR_MLO_LINK_ID] ||
2233 tb[NL80211_ATTR_MLD_ADDR])) {
2234 wpa_printf(MSG_ERROR,
2235 "nl80211: MLO info not expected for new station event for non-MLD AP");
2236 return;
2237 }
2238
2239 if (tb[NL80211_ATTR_MLO_LINK_ID]) {
2240 assoc_link_id =
2241 nla_get_u8(tb[NL80211_ATTR_MLO_LINK_ID]);
2242 wpa_printf(MSG_DEBUG, "nl80211: STA assoc link ID %d",
2243 assoc_link_id);
2244 if (tb[NL80211_ATTR_MLD_ADDR]) {
2245 peer_addr = nla_data(tb[NL80211_ATTR_MLD_ADDR]);
2246 link_addr = nla_data(tb[NL80211_ATTR_MAC]);
2247 wpa_printf(MSG_DEBUG,
2248 "nl80211: STA MLD address " MACSTR,
2249 MAC2STR(peer_addr));
2250 }
2251 }
2252
2253 if (tb[NL80211_ATTR_IE]) {
2254 req_ies = nla_data(tb[NL80211_ATTR_IE]);
2255 req_ies_len = nla_len(tb[NL80211_ATTR_IE]);
2256 wpa_hexdump(MSG_DEBUG, "nl80211: Assoc Req IEs",
2257 req_ies, req_ies_len);
2258 }
2259
2260 if (tb[NL80211_ATTR_RESP_IE]) {
2261 resp_ies = nla_data(tb[NL80211_ATTR_RESP_IE]);
2262 resp_ies_len = nla_len(tb[NL80211_ATTR_RESP_IE]);
2263 wpa_hexdump(MSG_DEBUG, "nl80211: Assoc Resp IEs",
2264 resp_ies, resp_ies_len);
2265 }
2266
2267 drv_event_assoc(bss->ctx, peer_addr, req_ies, req_ies_len,
2268 resp_ies, resp_ies_len, link_addr,
2269 assoc_link_id, 0);
2270 return;
2271 }
2272
2273 if (drv->nlmode != NL80211_IFTYPE_ADHOC)
2274 return;
2275
2276 os_memset(&data, 0, sizeof(data));
2277 os_memcpy(data.ibss_rsn_start.peer, peer_addr, ETH_ALEN);
2278 wpa_supplicant_event(bss->ctx, EVENT_IBSS_RSN_START, &data);
2279 }
2280
2281
nl80211_del_station_event(struct wpa_driver_nl80211_data * drv,struct i802_bss * bss,struct nlattr ** tb)2282 static void nl80211_del_station_event(struct wpa_driver_nl80211_data *drv,
2283 struct i802_bss *bss,
2284 struct nlattr **tb)
2285 {
2286 u8 *addr;
2287 union wpa_event_data data;
2288
2289 if (tb[NL80211_ATTR_MAC] == NULL)
2290 return;
2291 addr = nla_data(tb[NL80211_ATTR_MAC]);
2292 wpa_printf(MSG_DEBUG, "nl80211: Delete station " MACSTR,
2293 MAC2STR(addr));
2294
2295 if (is_ap_interface(drv->nlmode) && drv->device_ap_sme) {
2296 drv_event_disassoc(bss->ctx, addr);
2297 return;
2298 }
2299
2300 if (drv->nlmode != NL80211_IFTYPE_ADHOC)
2301 return;
2302
2303 os_memset(&data, 0, sizeof(data));
2304 os_memcpy(data.ibss_peer_lost.peer, addr, ETH_ALEN);
2305 wpa_supplicant_event(bss->ctx, EVENT_IBSS_PEER_LOST, &data);
2306 }
2307
2308
nl80211_rekey_offload_event(struct wpa_driver_nl80211_data * drv,struct nlattr ** tb)2309 static void nl80211_rekey_offload_event(struct wpa_driver_nl80211_data *drv,
2310 struct nlattr **tb)
2311 {
2312 struct nlattr *rekey_info[NUM_NL80211_REKEY_DATA];
2313 static struct nla_policy rekey_policy[NUM_NL80211_REKEY_DATA] = {
2314 [NL80211_REKEY_DATA_KEK] = {
2315 .minlen = NL80211_KEK_LEN,
2316 .maxlen = NL80211_KEK_LEN,
2317 },
2318 [NL80211_REKEY_DATA_KCK] = {
2319 .minlen = NL80211_KCK_LEN,
2320 .maxlen = NL80211_KCK_LEN,
2321 },
2322 [NL80211_REKEY_DATA_REPLAY_CTR] = {
2323 .minlen = NL80211_REPLAY_CTR_LEN,
2324 .maxlen = NL80211_REPLAY_CTR_LEN,
2325 },
2326 };
2327 union wpa_event_data data;
2328
2329 if (!tb[NL80211_ATTR_MAC] ||
2330 !tb[NL80211_ATTR_REKEY_DATA] ||
2331 nla_parse_nested(rekey_info, MAX_NL80211_REKEY_DATA,
2332 tb[NL80211_ATTR_REKEY_DATA], rekey_policy) ||
2333 !rekey_info[NL80211_REKEY_DATA_REPLAY_CTR])
2334 return;
2335
2336 os_memset(&data, 0, sizeof(data));
2337 data.driver_gtk_rekey.bssid = nla_data(tb[NL80211_ATTR_MAC]);
2338 wpa_printf(MSG_DEBUG, "nl80211: Rekey offload event for BSSID " MACSTR,
2339 MAC2STR(data.driver_gtk_rekey.bssid));
2340 data.driver_gtk_rekey.replay_ctr =
2341 nla_data(rekey_info[NL80211_REKEY_DATA_REPLAY_CTR]);
2342 wpa_hexdump(MSG_DEBUG, "nl80211: Rekey offload - Replay Counter",
2343 data.driver_gtk_rekey.replay_ctr, NL80211_REPLAY_CTR_LEN);
2344 wpa_supplicant_event(drv->ctx, EVENT_DRIVER_GTK_REKEY, &data);
2345 }
2346
2347
nl80211_pmksa_candidate_event(struct wpa_driver_nl80211_data * drv,struct nlattr ** tb)2348 static void nl80211_pmksa_candidate_event(struct wpa_driver_nl80211_data *drv,
2349 struct nlattr **tb)
2350 {
2351 struct nlattr *cand[NUM_NL80211_PMKSA_CANDIDATE];
2352 static struct nla_policy cand_policy[NUM_NL80211_PMKSA_CANDIDATE] = {
2353 [NL80211_PMKSA_CANDIDATE_INDEX] = { .type = NLA_U32 },
2354 [NL80211_PMKSA_CANDIDATE_BSSID] = {
2355 .minlen = ETH_ALEN,
2356 .maxlen = ETH_ALEN,
2357 },
2358 [NL80211_PMKSA_CANDIDATE_PREAUTH] = { .type = NLA_FLAG },
2359 };
2360 union wpa_event_data data;
2361
2362 wpa_printf(MSG_DEBUG, "nl80211: PMKSA candidate event");
2363
2364 if (!tb[NL80211_ATTR_PMKSA_CANDIDATE] ||
2365 nla_parse_nested(cand, MAX_NL80211_PMKSA_CANDIDATE,
2366 tb[NL80211_ATTR_PMKSA_CANDIDATE], cand_policy) ||
2367 !cand[NL80211_PMKSA_CANDIDATE_INDEX] ||
2368 !cand[NL80211_PMKSA_CANDIDATE_BSSID])
2369 return;
2370
2371 os_memset(&data, 0, sizeof(data));
2372 os_memcpy(data.pmkid_candidate.bssid,
2373 nla_data(cand[NL80211_PMKSA_CANDIDATE_BSSID]), ETH_ALEN);
2374 data.pmkid_candidate.index =
2375 nla_get_u32(cand[NL80211_PMKSA_CANDIDATE_INDEX]);
2376 data.pmkid_candidate.preauth =
2377 cand[NL80211_PMKSA_CANDIDATE_PREAUTH] != NULL;
2378 wpa_supplicant_event(drv->ctx, EVENT_PMKID_CANDIDATE, &data);
2379 }
2380
2381
nl80211_client_probe_event(struct wpa_driver_nl80211_data * drv,struct nlattr ** tb)2382 static void nl80211_client_probe_event(struct wpa_driver_nl80211_data *drv,
2383 struct nlattr **tb)
2384 {
2385 union wpa_event_data data;
2386 const u8 *addr;
2387 u64 cookie = 0;
2388
2389 addr = nla_data(tb[NL80211_ATTR_MAC]);
2390 if (!addr)
2391 return;
2392 if (tb[NL80211_ATTR_COOKIE])
2393 cookie = nla_get_u64(tb[NL80211_ATTR_COOKIE]);
2394 wpa_printf(MSG_DEBUG, "nl80211: Probe client event (addr=" MACSTR
2395 " ack=%d cookie=%llu)", MAC2STR(addr),
2396 tb[NL80211_ATTR_ACK] != NULL,
2397 (long long unsigned int) cookie);
2398 if (!tb[NL80211_ATTR_ACK])
2399 return;
2400
2401 os_memset(&data, 0, sizeof(data));
2402 os_memcpy(data.client_poll.addr, addr, ETH_ALEN);
2403 wpa_supplicant_event(drv->ctx, EVENT_DRIVER_CLIENT_POLL_OK, &data);
2404 }
2405
2406
nl80211_tdls_oper_event(struct wpa_driver_nl80211_data * drv,struct nlattr ** tb)2407 static void nl80211_tdls_oper_event(struct wpa_driver_nl80211_data *drv,
2408 struct nlattr **tb)
2409 {
2410 union wpa_event_data data;
2411
2412 wpa_printf(MSG_DEBUG, "nl80211: TDLS operation event");
2413
2414 if (!tb[NL80211_ATTR_MAC] || !tb[NL80211_ATTR_TDLS_OPERATION])
2415 return;
2416
2417 os_memset(&data, 0, sizeof(data));
2418 os_memcpy(data.tdls.peer, nla_data(tb[NL80211_ATTR_MAC]), ETH_ALEN);
2419 switch (nla_get_u8(tb[NL80211_ATTR_TDLS_OPERATION])) {
2420 case NL80211_TDLS_SETUP:
2421 wpa_printf(MSG_DEBUG, "nl80211: TDLS setup request for peer "
2422 MACSTR, MAC2STR(data.tdls.peer));
2423 data.tdls.oper = TDLS_REQUEST_SETUP;
2424 break;
2425 case NL80211_TDLS_TEARDOWN:
2426 wpa_printf(MSG_DEBUG, "nl80211: TDLS teardown request for peer "
2427 MACSTR, MAC2STR(data.tdls.peer));
2428 data.tdls.oper = TDLS_REQUEST_TEARDOWN;
2429 break;
2430 case NL80211_TDLS_DISCOVERY_REQ:
2431 wpa_printf(MSG_DEBUG,
2432 "nl80211: TDLS discovery request for peer " MACSTR,
2433 MAC2STR(data.tdls.peer));
2434 data.tdls.oper = TDLS_REQUEST_DISCOVER;
2435 break;
2436 default:
2437 wpa_printf(MSG_DEBUG, "nl80211: Unsupported TDLS operatione "
2438 "event");
2439 return;
2440 }
2441 if (tb[NL80211_ATTR_REASON_CODE]) {
2442 data.tdls.reason_code =
2443 nla_get_u16(tb[NL80211_ATTR_REASON_CODE]);
2444 }
2445
2446 wpa_supplicant_event(drv->ctx, EVENT_TDLS, &data);
2447 }
2448
2449
nl80211_stop_ap(struct i802_bss * bss,struct nlattr ** tb)2450 static void nl80211_stop_ap(struct i802_bss *bss, struct nlattr **tb)
2451 {
2452 struct i802_link *mld_link = NULL;
2453 void *ctx = bss->ctx;
2454 int link_id = -1;
2455
2456 if (tb[NL80211_ATTR_MLO_LINK_ID]) {
2457 link_id = nla_get_u8(tb[NL80211_ATTR_MLO_LINK_ID]);
2458 if (!nl80211_link_valid(bss->valid_links, link_id)) {
2459 wpa_printf(MSG_DEBUG,
2460 "nl80211: Ignoring STOP_AP event for invalid link ID %d (valid: 0x%04x)",
2461 link_id, bss->valid_links);
2462 return;
2463 }
2464
2465 mld_link = nl80211_get_link(bss, link_id);
2466 wpa_printf(MSG_DEBUG,
2467 "nl80211: STOP_AP event on link %d", link_id);
2468 ctx = mld_link->ctx;
2469
2470 /* The driver would have already deleted the link and this call
2471 * will return an error. Ignore that since nl80211_remove_link()
2472 * is called here only to update the bss->links[] state. */
2473 nl80211_remove_link(bss, link_id);
2474 }
2475
2476 wpa_supplicant_event(ctx, EVENT_INTERFACE_UNAVAILABLE, NULL);
2477 }
2478
2479
nl80211_connect_failed_event(struct wpa_driver_nl80211_data * drv,struct nlattr ** tb)2480 static void nl80211_connect_failed_event(struct wpa_driver_nl80211_data *drv,
2481 struct nlattr **tb)
2482 {
2483 union wpa_event_data data;
2484 u32 reason;
2485
2486 wpa_printf(MSG_DEBUG, "nl80211: Connect failed event");
2487
2488 if (!tb[NL80211_ATTR_MAC] || !tb[NL80211_ATTR_CONN_FAILED_REASON])
2489 return;
2490
2491 os_memset(&data, 0, sizeof(data));
2492 os_memcpy(data.connect_failed_reason.addr,
2493 nla_data(tb[NL80211_ATTR_MAC]), ETH_ALEN);
2494
2495 reason = nla_get_u32(tb[NL80211_ATTR_CONN_FAILED_REASON]);
2496 switch (reason) {
2497 case NL80211_CONN_FAIL_MAX_CLIENTS:
2498 wpa_printf(MSG_DEBUG, "nl80211: Max client reached");
2499 data.connect_failed_reason.code = MAX_CLIENT_REACHED;
2500 break;
2501 case NL80211_CONN_FAIL_BLOCKED_CLIENT:
2502 wpa_printf(MSG_DEBUG, "nl80211: Blocked client " MACSTR
2503 " tried to connect",
2504 MAC2STR(data.connect_failed_reason.addr));
2505 data.connect_failed_reason.code = BLOCKED_CLIENT;
2506 break;
2507 default:
2508 wpa_printf(MSG_DEBUG, "nl8021l: Unknown connect failed reason "
2509 "%u", reason);
2510 return;
2511 }
2512
2513 wpa_supplicant_event(drv->ctx, EVENT_CONNECT_FAILED_REASON, &data);
2514 }
2515
2516
nl80211_process_radar_event(struct i802_bss * bss,union wpa_event_data * data,enum nl80211_radar_event event_type)2517 static void nl80211_process_radar_event(struct i802_bss *bss,
2518 union wpa_event_data *data,
2519 enum nl80211_radar_event event_type)
2520 {
2521 wpa_printf(MSG_DEBUG,
2522 "nl80211: DFS event on freq %d MHz, ht: %d, offset: %d, width: %d, cf1: %dMHz, cf2: %dMHz, link_id=%d",
2523 data->dfs_event.freq, data->dfs_event.ht_enabled,
2524 data->dfs_event.chan_offset, data->dfs_event.chan_width,
2525 data->dfs_event.cf1, data->dfs_event.cf2,
2526 data->dfs_event.link_id);
2527
2528 switch (event_type) {
2529 case NL80211_RADAR_DETECTED:
2530 wpa_supplicant_event(bss->ctx, EVENT_DFS_RADAR_DETECTED, data);
2531 break;
2532 case NL80211_RADAR_CAC_FINISHED:
2533 wpa_supplicant_event(bss->ctx, EVENT_DFS_CAC_FINISHED, data);
2534 break;
2535 case NL80211_RADAR_CAC_ABORTED:
2536 wpa_supplicant_event(bss->ctx, EVENT_DFS_CAC_ABORTED, data);
2537 break;
2538 case NL80211_RADAR_NOP_FINISHED:
2539 wpa_supplicant_event(bss->ctx, EVENT_DFS_NOP_FINISHED, data);
2540 break;
2541 case NL80211_RADAR_PRE_CAC_EXPIRED:
2542 wpa_supplicant_event(bss->ctx, EVENT_DFS_PRE_CAC_EXPIRED,
2543 data);
2544 break;
2545 case NL80211_RADAR_CAC_STARTED:
2546 wpa_supplicant_event(bss->ctx, EVENT_DFS_CAC_STARTED, data);
2547 break;
2548 default:
2549 wpa_printf(MSG_DEBUG,
2550 "nl80211: Unknown radar event %d received",
2551 event_type);
2552 break;
2553 }
2554 }
2555
2556
nl80211_radar_event(struct i802_bss * bss,struct nlattr ** tb)2557 static void nl80211_radar_event(struct i802_bss *bss, struct nlattr **tb)
2558 {
2559 struct wpa_driver_nl80211_data *drv = bss->drv;
2560 union wpa_event_data data;
2561 enum nl80211_radar_event event_type;
2562 struct i802_bss *bss_iter;
2563 int i;
2564 bool hit = false;
2565
2566 if (!tb[NL80211_ATTR_WIPHY_FREQ] || !tb[NL80211_ATTR_RADAR_EVENT])
2567 return;
2568
2569 os_memset(&data, 0, sizeof(data));
2570 data.dfs_event.freq = nla_get_u32(tb[NL80211_ATTR_WIPHY_FREQ]);
2571 event_type = nla_get_u32(tb[NL80211_ATTR_RADAR_EVENT]);
2572
2573 /* Check HT params */
2574 if (tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
2575 data.dfs_event.ht_enabled = 1;
2576 data.dfs_event.chan_offset = 0;
2577
2578 switch (nla_get_u32(tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE])) {
2579 case NL80211_CHAN_NO_HT:
2580 data.dfs_event.ht_enabled = 0;
2581 break;
2582 case NL80211_CHAN_HT20:
2583 break;
2584 case NL80211_CHAN_HT40PLUS:
2585 data.dfs_event.chan_offset = 1;
2586 break;
2587 case NL80211_CHAN_HT40MINUS:
2588 data.dfs_event.chan_offset = -1;
2589 break;
2590 }
2591 }
2592
2593 /* Get VHT params */
2594 if (tb[NL80211_ATTR_CHANNEL_WIDTH])
2595 data.dfs_event.chan_width =
2596 convert2width(nla_get_u32(
2597 tb[NL80211_ATTR_CHANNEL_WIDTH]));
2598 if (tb[NL80211_ATTR_CENTER_FREQ1])
2599 data.dfs_event.cf1 = nla_get_u32(tb[NL80211_ATTR_CENTER_FREQ1]);
2600 if (tb[NL80211_ATTR_CENTER_FREQ2])
2601 data.dfs_event.cf2 = nla_get_u32(tb[NL80211_ATTR_CENTER_FREQ2]);
2602
2603 wpa_printf(MSG_DEBUG,
2604 "nl80211: Checking suitable BSS for the DFS event");
2605
2606 /* It is possible to have the event without ifidx and wdev_id, e.g.,
2607 * with NL80211_RADAR_NOP_FINISHED and NL80211_RADAR_PRE_CAC_EXPIRED.
2608 * Hence need to check on all BSSs. */
2609 for (bss_iter = drv->first_bss; bss_iter; bss_iter = bss_iter->next) {
2610 /* Find a link match based on the frequency. If
2611 * NL80211_DRV_LINK_ID_NA is returned, either a match was not
2612 * found or the BSS could be operating as a non-MLO. */
2613 data.dfs_event.link_id = nl80211_get_link_id_by_freq(
2614 bss_iter, data.dfs_event.freq);
2615 /* If a link match is found, exit the loop after the handler is
2616 * called */
2617 if (data.dfs_event.link_id != NL80211_DRV_LINK_ID_NA)
2618 return nl80211_process_radar_event(bss_iter, &data,
2619 event_type);
2620 if (data.dfs_event.link_id == NL80211_DRV_LINK_ID_NA) {
2621 /* For non-MLO operation, frequency should still match
2622 */
2623 if (!bss_iter->valid_links &&
2624 bss_iter->links[0].freq == data.dfs_event.freq)
2625 return nl80211_process_radar_event(
2626 bss_iter, &data, event_type);
2627 }
2628
2629 /* For event like NL80211_RADAR_NOP_FINISHED, frequency
2630 * information will not match exactly the link frequency. Hence,
2631 * if the link frequency is 5 GHz, pass the event to it.
2632 */
2633 for_each_link_default(bss_iter->valid_links, i, 0) {
2634 if (bss_iter->links[i].freq < 5180 ||
2635 bss_iter->links[i].freq > 5900)
2636 continue;
2637
2638 data.dfs_event.link_id = bss_iter->valid_links ?
2639 i : NL80211_DRV_LINK_ID_NA;
2640
2641 /* Cannot just return after one match since if split
2642 * hardware is participating in MLO, possibly the event
2643 * is for 5 GHz upper band and this iteration has picked
2644 * a 5 GHz low band link, but 5 GHz freq check will be
2645 * true for both. Hence, iterate on all possible links.
2646 * The handler should take care whether the event is
2647 * actually for it. */
2648 nl80211_process_radar_event(bss_iter, &data,
2649 event_type);
2650
2651 hit = true;
2652 }
2653 }
2654
2655 if (hit)
2656 return;
2657
2658 wpa_printf(MSG_DEBUG, "nl80211: DFS event on unknown freq on %s",
2659 bss->ifname);
2660 }
2661
2662
nl80211_spurious_frame(struct i802_bss * bss,struct nlattr ** tb,int wds)2663 static void nl80211_spurious_frame(struct i802_bss *bss, struct nlattr **tb,
2664 int wds)
2665 {
2666 struct wpa_driver_nl80211_data *drv = bss->drv;
2667 union wpa_event_data event;
2668
2669 if (!tb[NL80211_ATTR_MAC])
2670 return;
2671
2672 os_memset(&event, 0, sizeof(event));
2673 event.rx_from_unknown.bssid = bss->addr;
2674 event.rx_from_unknown.addr = nla_data(tb[NL80211_ATTR_MAC]);
2675 event.rx_from_unknown.wds = wds;
2676
2677 wpa_supplicant_event(drv->ctx, EVENT_RX_FROM_UNKNOWN, &event);
2678 }
2679
2680
2681 #ifdef CONFIG_DRIVER_NL80211_QCA
2682
qca_nl80211_avoid_freq(struct wpa_driver_nl80211_data * drv,const u8 * data,size_t len)2683 static void qca_nl80211_avoid_freq(struct wpa_driver_nl80211_data *drv,
2684 const u8 *data, size_t len)
2685 {
2686 u32 i, count;
2687 union wpa_event_data event;
2688 struct wpa_freq_range *range = NULL;
2689 const struct qca_avoid_freq_list *freq_range;
2690
2691 freq_range = (const struct qca_avoid_freq_list *) data;
2692 if (len < sizeof(freq_range->count))
2693 return;
2694
2695 count = freq_range->count;
2696 if (len < sizeof(freq_range->count) +
2697 count * sizeof(struct qca_avoid_freq_range)) {
2698 wpa_printf(MSG_DEBUG, "nl80211: Ignored too short avoid frequency list (len=%u)",
2699 (unsigned int) len);
2700 return;
2701 }
2702
2703 if (count > 0) {
2704 range = os_calloc(count, sizeof(struct wpa_freq_range));
2705 if (range == NULL)
2706 return;
2707 }
2708
2709 os_memset(&event, 0, sizeof(event));
2710 for (i = 0; i < count; i++) {
2711 unsigned int idx = event.freq_range.num;
2712 range[idx].min = freq_range->range[i].start_freq;
2713 range[idx].max = freq_range->range[i].end_freq;
2714 wpa_printf(MSG_DEBUG, "nl80211: Avoid frequency range: %u-%u",
2715 range[idx].min, range[idx].max);
2716 if (range[idx].min > range[idx].max) {
2717 wpa_printf(MSG_DEBUG, "nl80211: Ignore invalid frequency range");
2718 continue;
2719 }
2720 event.freq_range.num++;
2721 }
2722 event.freq_range.range = range;
2723
2724 wpa_supplicant_event(drv->ctx, EVENT_AVOID_FREQUENCIES, &event);
2725
2726 os_free(range);
2727 }
2728
2729
get_qca_hw_mode(u8 hw_mode)2730 static enum hostapd_hw_mode get_qca_hw_mode(u8 hw_mode)
2731 {
2732 switch (hw_mode) {
2733 case QCA_ACS_MODE_IEEE80211B:
2734 return HOSTAPD_MODE_IEEE80211B;
2735 case QCA_ACS_MODE_IEEE80211G:
2736 return HOSTAPD_MODE_IEEE80211G;
2737 case QCA_ACS_MODE_IEEE80211A:
2738 return HOSTAPD_MODE_IEEE80211A;
2739 case QCA_ACS_MODE_IEEE80211AD:
2740 return HOSTAPD_MODE_IEEE80211AD;
2741 case QCA_ACS_MODE_IEEE80211ANY:
2742 return HOSTAPD_MODE_IEEE80211ANY;
2743 default:
2744 return NUM_HOSTAPD_MODES;
2745 }
2746 }
2747
2748
chan_to_freq(struct wpa_driver_nl80211_data * drv,u8 chan,enum hostapd_hw_mode hw_mode)2749 static unsigned int chan_to_freq(struct wpa_driver_nl80211_data *drv,
2750 u8 chan, enum hostapd_hw_mode hw_mode)
2751 {
2752 if (hw_mode == NUM_HOSTAPD_MODES) {
2753 /* For drivers that do not report ACS_HW_MODE */
2754 u16 num_modes, flags;
2755 struct hostapd_hw_modes *modes;
2756 u8 dfs_domain;
2757 int i;
2758
2759 modes = nl80211_get_hw_feature_data(drv->first_bss, &num_modes,
2760 &flags, &dfs_domain);
2761 if (!modes) {
2762 wpa_printf(MSG_DEBUG,
2763 "nl80211: Fetching hardware mode failed");
2764 goto try_2_4_or_5;
2765 }
2766 if (num_modes == 1)
2767 hw_mode = modes[0].mode;
2768
2769 for (i = 0; i < num_modes; i++) {
2770 os_free(modes[i].channels);
2771 os_free(modes[i].rates);
2772 }
2773
2774 os_free(modes);
2775 }
2776
2777 if (hw_mode == HOSTAPD_MODE_IEEE80211AD) {
2778 if (chan >= 1 && chan <= 6)
2779 return 56160 + (2160 * chan);
2780 return 0;
2781 }
2782
2783 try_2_4_or_5:
2784 if (chan >= 1 && chan <= 13)
2785 return 2407 + 5 * chan;
2786 if (chan == 14)
2787 return 2484;
2788 if (chan >= 36 && chan <= 177)
2789 return 5000 + 5 * chan;
2790
2791 return 0;
2792 }
2793
2794
qca_nl80211_acs_select_ch(struct wpa_driver_nl80211_data * drv,const u8 * data,size_t len)2795 static void qca_nl80211_acs_select_ch(struct wpa_driver_nl80211_data *drv,
2796 const u8 *data, size_t len)
2797 {
2798 struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_ACS_MAX + 1];
2799 union wpa_event_data event;
2800 u8 chan;
2801
2802 wpa_printf(MSG_DEBUG,
2803 "nl80211: ACS channel selection vendor event received");
2804
2805 if (nla_parse(tb, QCA_WLAN_VENDOR_ATTR_ACS_MAX,
2806 (struct nlattr *) data, len, NULL) ||
2807 (!tb[QCA_WLAN_VENDOR_ATTR_ACS_PRIMARY_FREQUENCY] &&
2808 !tb[QCA_WLAN_VENDOR_ATTR_ACS_PRIMARY_CHANNEL]) ||
2809 (!tb[QCA_WLAN_VENDOR_ATTR_ACS_SECONDARY_FREQUENCY] &&
2810 !tb[QCA_WLAN_VENDOR_ATTR_ACS_SECONDARY_CHANNEL]))
2811 return;
2812
2813 os_memset(&event, 0, sizeof(event));
2814 event.acs_selected_channels.hw_mode = NUM_HOSTAPD_MODES;
2815
2816 if (tb[QCA_WLAN_VENDOR_ATTR_ACS_HW_MODE]) {
2817 u8 hw_mode = nla_get_u8(tb[QCA_WLAN_VENDOR_ATTR_ACS_HW_MODE]);
2818
2819 event.acs_selected_channels.hw_mode = get_qca_hw_mode(hw_mode);
2820 if (event.acs_selected_channels.hw_mode == NUM_HOSTAPD_MODES ||
2821 event.acs_selected_channels.hw_mode ==
2822 HOSTAPD_MODE_IEEE80211ANY) {
2823 wpa_printf(MSG_DEBUG,
2824 "nl80211: Invalid hw_mode %d in ACS selection event",
2825 hw_mode);
2826 return;
2827 }
2828 }
2829
2830 if (tb[QCA_WLAN_VENDOR_ATTR_ACS_PRIMARY_FREQUENCY]) {
2831 event.acs_selected_channels.pri_freq = nla_get_u32(
2832 tb[QCA_WLAN_VENDOR_ATTR_ACS_PRIMARY_FREQUENCY]);
2833 } else {
2834 chan = nla_get_u8(tb[QCA_WLAN_VENDOR_ATTR_ACS_PRIMARY_CHANNEL]);
2835 event.acs_selected_channels.pri_freq =
2836 chan_to_freq(drv, chan,
2837 event.acs_selected_channels.hw_mode);
2838 }
2839
2840 if (tb[QCA_WLAN_VENDOR_ATTR_ACS_SECONDARY_FREQUENCY]) {
2841 event.acs_selected_channels.sec_freq = nla_get_u32(
2842 tb[QCA_WLAN_VENDOR_ATTR_ACS_SECONDARY_FREQUENCY]);
2843 } else {
2844 chan = nla_get_u8(
2845 tb[QCA_WLAN_VENDOR_ATTR_ACS_SECONDARY_CHANNEL]);
2846 event.acs_selected_channels.sec_freq =
2847 chan_to_freq(drv, chan,
2848 event.acs_selected_channels.hw_mode);
2849 }
2850
2851 if (tb[QCA_WLAN_VENDOR_ATTR_ACS_EDMG_CHANNEL])
2852 event.acs_selected_channels.edmg_channel =
2853 nla_get_u8(tb[QCA_WLAN_VENDOR_ATTR_ACS_EDMG_CHANNEL]);
2854 if (tb[QCA_WLAN_VENDOR_ATTR_ACS_VHT_SEG0_CENTER_CHANNEL])
2855 event.acs_selected_channels.vht_seg0_center_ch =
2856 nla_get_u8(tb[QCA_WLAN_VENDOR_ATTR_ACS_VHT_SEG0_CENTER_CHANNEL]);
2857 if (tb[QCA_WLAN_VENDOR_ATTR_ACS_VHT_SEG1_CENTER_CHANNEL])
2858 event.acs_selected_channels.vht_seg1_center_ch =
2859 nla_get_u8(tb[QCA_WLAN_VENDOR_ATTR_ACS_VHT_SEG1_CENTER_CHANNEL]);
2860 if (tb[QCA_WLAN_VENDOR_ATTR_ACS_CHWIDTH])
2861 event.acs_selected_channels.ch_width =
2862 nla_get_u16(tb[QCA_WLAN_VENDOR_ATTR_ACS_CHWIDTH]);
2863 if (tb[QCA_WLAN_VENDOR_ATTR_ACS_PUNCTURE_BITMAP])
2864 event.acs_selected_channels.puncture_bitmap =
2865 nla_get_u16(tb[QCA_WLAN_VENDOR_ATTR_ACS_PUNCTURE_BITMAP]);
2866 if (tb[QCA_WLAN_VENDOR_ATTR_ACS_LINK_ID])
2867 event.acs_selected_channels.link_id =
2868 nla_get_u8(tb[QCA_WLAN_VENDOR_ATTR_ACS_LINK_ID]);
2869 else
2870 event.acs_selected_channels.link_id = -1;
2871
2872 wpa_printf(MSG_INFO,
2873 "nl80211: ACS Results: PFreq: %d SFreq: %d BW: %d VHT0: %d VHT1: %d HW_MODE: %d EDMGCH: %d PUNCBITMAP: 0x%x, LinkId: %d",
2874 event.acs_selected_channels.pri_freq,
2875 event.acs_selected_channels.sec_freq,
2876 event.acs_selected_channels.ch_width,
2877 event.acs_selected_channels.vht_seg0_center_ch,
2878 event.acs_selected_channels.vht_seg1_center_ch,
2879 event.acs_selected_channels.hw_mode,
2880 event.acs_selected_channels.edmg_channel,
2881 event.acs_selected_channels.puncture_bitmap,
2882 event.acs_selected_channels.link_id);
2883
2884 /* Ignore ACS channel list check for backwards compatibility */
2885
2886 wpa_supplicant_event(drv->ctx, EVENT_ACS_CHANNEL_SELECTED, &event);
2887 }
2888
2889
qca_nl80211_key_mgmt_auth(struct wpa_driver_nl80211_data * drv,const u8 * data,size_t len)2890 static void qca_nl80211_key_mgmt_auth(struct wpa_driver_nl80211_data *drv,
2891 const u8 *data, size_t len)
2892 {
2893 struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_MAX + 1];
2894 u8 *bssid;
2895
2896 wpa_printf(MSG_DEBUG,
2897 "nl80211: Key management roam+auth vendor event received");
2898
2899 if (nla_parse(tb, QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_MAX,
2900 (struct nlattr *) data, len, NULL) ||
2901 !tb[QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_BSSID] ||
2902 nla_len(tb[QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_BSSID]) != ETH_ALEN ||
2903 !tb[QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_REQ_IE] ||
2904 !tb[QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_RESP_IE] ||
2905 !tb[QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_AUTHORIZED])
2906 return;
2907
2908 bssid = nla_data(tb[QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_BSSID]);
2909 wpa_printf(MSG_DEBUG, " * roam BSSID " MACSTR, MAC2STR(bssid));
2910
2911 mlme_event_connect(drv, NL80211_CMD_ROAM, true, NULL,
2912 tb[QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_BSSID],
2913 tb[QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_REQ_IE],
2914 tb[QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_RESP_IE],
2915 NULL, NULL,
2916 tb[QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_AUTHORIZED],
2917 tb[QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_KEY_REPLAY_CTR],
2918 tb[QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_PTK_KCK],
2919 tb[QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_PTK_KEK],
2920 tb[QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_SUBNET_STATUS],
2921 tb[QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_FILS_ERP_NEXT_SEQ_NUM],
2922 tb[QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_PMK],
2923 tb[QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_PMKID],
2924 tb[QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_MLO_LINKS]);
2925
2926 #ifdef ANDROID
2927 #ifdef ANDROID_LIB_EVENT
2928 wpa_driver_nl80211_driver_event(
2929 drv, OUI_QCA, QCA_NL80211_VENDOR_SUBCMD_KEY_MGMT_ROAM_AUTH,
2930 data, len);
2931 #endif /* ANDROID_LIB_EVENT */
2932 #endif /* ANDROID */
2933 }
2934
2935
2936 static void
qca_nl80211_key_mgmt_auth_handler(struct wpa_driver_nl80211_data * drv,const u8 * data,size_t len)2937 qca_nl80211_key_mgmt_auth_handler(struct wpa_driver_nl80211_data *drv,
2938 const u8 *data, size_t len)
2939 {
2940 if (!drv->roam_indication_done) {
2941 wpa_printf(MSG_DEBUG,
2942 "nl80211: Pending roam indication, delay processing roam+auth vendor event");
2943
2944 os_free(drv->pending_roam_data);
2945 drv->pending_roam_data = os_memdup(data, len);
2946 if (!drv->pending_roam_data)
2947 return;
2948 drv->pending_roam_data_len = len;
2949 return;
2950 }
2951 drv->roam_indication_done = false;
2952 qca_nl80211_key_mgmt_auth(drv, data, len);
2953 }
2954
2955
qca_nl80211_dfs_offload_radar_event(struct wpa_driver_nl80211_data * drv,u32 subcmd,u8 * msg,int length)2956 static void qca_nl80211_dfs_offload_radar_event(
2957 struct wpa_driver_nl80211_data *drv, u32 subcmd, u8 *msg, int length)
2958 {
2959 union wpa_event_data data;
2960 struct nlattr *tb[NL80211_ATTR_MAX + 1];
2961
2962 wpa_printf(MSG_DEBUG,
2963 "nl80211: DFS offload radar vendor event received");
2964
2965 if (nla_parse(tb, NL80211_ATTR_MAX,
2966 (struct nlattr *) msg, length, NULL))
2967 return;
2968
2969 if (!tb[NL80211_ATTR_WIPHY_FREQ]) {
2970 wpa_printf(MSG_INFO,
2971 "nl80211: Error parsing WIPHY_FREQ in FS offload radar vendor event");
2972 return;
2973 }
2974
2975 os_memset(&data, 0, sizeof(data));
2976 data.dfs_event.freq = nla_get_u32(tb[NL80211_ATTR_WIPHY_FREQ]);
2977 data.dfs_event.link_id = NL80211_DRV_LINK_ID_NA;
2978
2979 if (tb[NL80211_ATTR_MLO_LINK_ID]) {
2980 data.dfs_event.link_id =
2981 nla_get_u8(tb[NL80211_ATTR_MLO_LINK_ID]);
2982 } else if (data.dfs_event.freq) {
2983 data.dfs_event.link_id =
2984 nl80211_get_link_id_by_freq(drv->first_bss,
2985 data.dfs_event.freq);
2986 }
2987
2988 wpa_printf(MSG_DEBUG, "nl80211: DFS event on freq %d MHz, link=%d",
2989 data.dfs_event.freq, data.dfs_event.link_id);
2990
2991 /* Check HT params */
2992 if (tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
2993 data.dfs_event.ht_enabled = 1;
2994 data.dfs_event.chan_offset = 0;
2995
2996 switch (nla_get_u32(tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE])) {
2997 case NL80211_CHAN_NO_HT:
2998 data.dfs_event.ht_enabled = 0;
2999 break;
3000 case NL80211_CHAN_HT20:
3001 break;
3002 case NL80211_CHAN_HT40PLUS:
3003 data.dfs_event.chan_offset = 1;
3004 break;
3005 case NL80211_CHAN_HT40MINUS:
3006 data.dfs_event.chan_offset = -1;
3007 break;
3008 }
3009 }
3010
3011 /* Get VHT params */
3012 if (tb[NL80211_ATTR_CHANNEL_WIDTH])
3013 data.dfs_event.chan_width =
3014 convert2width(nla_get_u32(
3015 tb[NL80211_ATTR_CHANNEL_WIDTH]));
3016 if (tb[NL80211_ATTR_CENTER_FREQ1])
3017 data.dfs_event.cf1 = nla_get_u32(tb[NL80211_ATTR_CENTER_FREQ1]);
3018 if (tb[NL80211_ATTR_CENTER_FREQ2])
3019 data.dfs_event.cf2 = nla_get_u32(tb[NL80211_ATTR_CENTER_FREQ2]);
3020
3021 wpa_printf(MSG_DEBUG, "nl80211: DFS event on freq %d MHz, ht: %d, "
3022 "offset: %d, width: %d, cf1: %dMHz, cf2: %dMHz",
3023 data.dfs_event.freq, data.dfs_event.ht_enabled,
3024 data.dfs_event.chan_offset, data.dfs_event.chan_width,
3025 data.dfs_event.cf1, data.dfs_event.cf2);
3026
3027 switch (subcmd) {
3028 case QCA_NL80211_VENDOR_SUBCMD_DFS_OFFLOAD_RADAR_DETECTED:
3029 wpa_supplicant_event(drv->ctx, EVENT_DFS_RADAR_DETECTED, &data);
3030 break;
3031 case QCA_NL80211_VENDOR_SUBCMD_DFS_OFFLOAD_CAC_STARTED:
3032 wpa_supplicant_event(drv->ctx, EVENT_DFS_CAC_STARTED, &data);
3033 break;
3034 case QCA_NL80211_VENDOR_SUBCMD_DFS_OFFLOAD_CAC_FINISHED:
3035 wpa_supplicant_event(drv->ctx, EVENT_DFS_CAC_FINISHED, &data);
3036 break;
3037 case QCA_NL80211_VENDOR_SUBCMD_DFS_OFFLOAD_CAC_ABORTED:
3038 wpa_supplicant_event(drv->ctx, EVENT_DFS_CAC_ABORTED, &data);
3039 break;
3040 case QCA_NL80211_VENDOR_SUBCMD_DFS_OFFLOAD_CAC_NOP_FINISHED:
3041 wpa_supplicant_event(drv->ctx, EVENT_DFS_NOP_FINISHED, &data);
3042 break;
3043 default:
3044 wpa_printf(MSG_DEBUG,
3045 "nl80211: Unknown DFS offload radar event %d received",
3046 subcmd);
3047 break;
3048 }
3049 }
3050
3051
qca_nl80211_scan_trigger_event(struct wpa_driver_nl80211_data * drv,u8 * data,size_t len)3052 static void qca_nl80211_scan_trigger_event(struct wpa_driver_nl80211_data *drv,
3053 u8 *data, size_t len)
3054 {
3055 struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_SCAN_MAX + 1];
3056 u64 cookie = 0;
3057 union wpa_event_data event;
3058 struct scan_info *info;
3059
3060 if (nla_parse(tb, QCA_WLAN_VENDOR_ATTR_SCAN_MAX,
3061 (struct nlattr *) data, len, NULL) ||
3062 !tb[QCA_WLAN_VENDOR_ATTR_SCAN_COOKIE])
3063 return;
3064
3065 cookie = nla_get_u64(tb[QCA_WLAN_VENDOR_ATTR_SCAN_COOKIE]);
3066 if (cookie != drv->vendor_scan_cookie) {
3067 /* External scan trigger event, ignore */
3068 return;
3069 }
3070
3071 /* Cookie match, own scan */
3072 os_memset(&event, 0, sizeof(event));
3073 info = &event.scan_info;
3074 info->external_scan = 0;
3075 info->nl_scan_event = 0;
3076
3077 drv->scan_state = SCAN_STARTED;
3078 wpa_supplicant_event(drv->ctx, EVENT_SCAN_STARTED, &event);
3079 }
3080
3081
send_vendor_scan_event(struct wpa_driver_nl80211_data * drv,int aborted,struct nlattr * tb[],int external_scan)3082 static void send_vendor_scan_event(struct wpa_driver_nl80211_data *drv,
3083 int aborted, struct nlattr *tb[],
3084 int external_scan)
3085 {
3086 union wpa_event_data event;
3087 struct nlattr *nl;
3088 int rem;
3089 struct scan_info *info;
3090 int freqs[MAX_REPORT_FREQS];
3091 int num_freqs = 0;
3092
3093 os_memset(&event, 0, sizeof(event));
3094 info = &event.scan_info;
3095 info->aborted = aborted;
3096 info->external_scan = external_scan;
3097 info->scan_cookie = nla_get_u64(tb[QCA_WLAN_VENDOR_ATTR_SCAN_COOKIE]);
3098
3099 if (tb[QCA_WLAN_VENDOR_ATTR_SCAN_SSIDS]) {
3100 nla_for_each_nested(nl,
3101 tb[QCA_WLAN_VENDOR_ATTR_SCAN_SSIDS], rem) {
3102 struct wpa_driver_scan_ssid *s =
3103 &info->ssids[info->num_ssids];
3104 s->ssid = nla_data(nl);
3105 s->ssid_len = nla_len(nl);
3106 wpa_printf(MSG_DEBUG,
3107 "nl80211: Scan probed for SSID '%s'",
3108 wpa_ssid_txt(s->ssid, s->ssid_len));
3109 info->num_ssids++;
3110 if (info->num_ssids == WPAS_MAX_SCAN_SSIDS)
3111 break;
3112 }
3113 }
3114
3115 if (tb[QCA_WLAN_VENDOR_ATTR_SCAN_FREQUENCIES]) {
3116 char msg[500], *pos, *end;
3117 int res;
3118
3119 pos = msg;
3120 end = pos + sizeof(msg);
3121 *pos = '\0';
3122
3123 nla_for_each_nested(nl,
3124 tb[QCA_WLAN_VENDOR_ATTR_SCAN_FREQUENCIES],
3125 rem) {
3126 freqs[num_freqs] = nla_get_u32(nl);
3127 res = os_snprintf(pos, end - pos, " %d",
3128 freqs[num_freqs]);
3129 if (!os_snprintf_error(end - pos, res))
3130 pos += res;
3131 num_freqs++;
3132 if (num_freqs == MAX_REPORT_FREQS - 1)
3133 break;
3134 }
3135
3136 info->freqs = freqs;
3137 info->num_freqs = num_freqs;
3138 wpa_printf(MSG_DEBUG, "nl80211: Scan included frequencies:%s",
3139 msg);
3140 }
3141 wpa_supplicant_event(drv->ctx, EVENT_SCAN_RESULTS, &event);
3142 }
3143
3144
qca_nl80211_scan_done_event(struct wpa_driver_nl80211_data * drv,u8 * data,size_t len)3145 static void qca_nl80211_scan_done_event(struct wpa_driver_nl80211_data *drv,
3146 u8 *data, size_t len)
3147 {
3148 struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_SCAN_MAX + 1];
3149 u64 cookie = 0;
3150 enum scan_status status;
3151 int external_scan;
3152
3153 if (nla_parse(tb, QCA_WLAN_VENDOR_ATTR_SCAN_MAX,
3154 (struct nlattr *) data, len, NULL) ||
3155 !tb[QCA_WLAN_VENDOR_ATTR_SCAN_STATUS] ||
3156 !tb[QCA_WLAN_VENDOR_ATTR_SCAN_COOKIE])
3157 return;
3158
3159 status = nla_get_u8(tb[QCA_WLAN_VENDOR_ATTR_SCAN_STATUS]);
3160 if (status >= VENDOR_SCAN_STATUS_MAX)
3161 return; /* invalid status */
3162
3163 cookie = nla_get_u64(tb[QCA_WLAN_VENDOR_ATTR_SCAN_COOKIE]);
3164 if (cookie != drv->vendor_scan_cookie) {
3165 /* Event from an external scan, get scan results */
3166 external_scan = 1;
3167 } else {
3168 external_scan = 0;
3169 if (status == VENDOR_SCAN_STATUS_NEW_RESULTS)
3170 drv->scan_state = SCAN_COMPLETED;
3171 else
3172 drv->scan_state = SCAN_ABORTED;
3173
3174 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv,
3175 drv->first_bss->ctx);
3176 drv->vendor_scan_cookie = 0;
3177 drv->last_scan_cmd = 0;
3178 }
3179
3180 send_vendor_scan_event(drv, (status == VENDOR_SCAN_STATUS_ABORTED), tb,
3181 external_scan);
3182 }
3183
3184
qca_nl80211_p2p_lo_stop_event(struct wpa_driver_nl80211_data * drv,u8 * data,size_t len)3185 static void qca_nl80211_p2p_lo_stop_event(struct wpa_driver_nl80211_data *drv,
3186 u8 *data, size_t len)
3187 {
3188 struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_P2P_LISTEN_OFFLOAD_MAX + 1];
3189 union wpa_event_data event;
3190
3191 wpa_printf(MSG_DEBUG,
3192 "nl80211: P2P listen offload stop vendor event received");
3193
3194 if (nla_parse(tb, QCA_WLAN_VENDOR_ATTR_P2P_LISTEN_OFFLOAD_MAX,
3195 (struct nlattr *) data, len, NULL) ||
3196 !tb[QCA_WLAN_VENDOR_ATTR_P2P_LISTEN_OFFLOAD_STOP_REASON])
3197 return;
3198
3199 os_memset(&event, 0, sizeof(event));
3200 event.p2p_lo_stop.reason_code =
3201 nla_get_u8(tb[QCA_WLAN_VENDOR_ATTR_P2P_LISTEN_OFFLOAD_STOP_REASON]);
3202
3203 wpa_printf(MSG_DEBUG,
3204 "nl80211: P2P Listen offload stop reason: %d",
3205 event.p2p_lo_stop.reason_code);
3206 wpa_supplicant_event(drv->ctx, EVENT_P2P_LO_STOP, &event);
3207 }
3208
3209
3210 #ifdef CONFIG_PASN
3211
qca_nl80211_pasn_auth(struct wpa_driver_nl80211_data * drv,u8 * data,size_t len)3212 static void qca_nl80211_pasn_auth(struct wpa_driver_nl80211_data *drv,
3213 u8 *data, size_t len)
3214 {
3215 int ret = -EINVAL;
3216 struct nlattr *attr;
3217 struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_MAX + 1];
3218 struct nlattr *cfg[QCA_WLAN_VENDOR_ATTR_PASN_PEER_MAX + 1];
3219 unsigned int n_peers = 0, idx = 0;
3220 int rem_conf;
3221 enum qca_wlan_vendor_pasn_action action;
3222 union wpa_event_data event;
3223
3224 if (nla_parse(tb, QCA_WLAN_VENDOR_ATTR_PASN_MAX,
3225 (struct nlattr *) data, len, NULL) ||
3226 !tb[QCA_WLAN_VENDOR_ATTR_PASN_PEERS] ||
3227 !tb[QCA_WLAN_VENDOR_ATTR_PASN_ACTION]) {
3228 return;
3229 }
3230
3231 os_memset(&event, 0, sizeof(event));
3232 action = nla_get_u32(tb[QCA_WLAN_VENDOR_ATTR_PASN_ACTION]);
3233 switch (action) {
3234 case QCA_WLAN_VENDOR_PASN_ACTION_AUTH:
3235 event.pasn_auth.action = PASN_ACTION_AUTH;
3236 break;
3237 case QCA_WLAN_VENDOR_PASN_ACTION_DELETE_SECURE_RANGING_CONTEXT:
3238 event.pasn_auth.action =
3239 PASN_ACTION_DELETE_SECURE_RANGING_CONTEXT;
3240 break;
3241 default:
3242 return;
3243 }
3244
3245 nla_for_each_nested(attr, tb[QCA_WLAN_VENDOR_ATTR_PASN_PEERS], rem_conf)
3246 n_peers++;
3247
3248 if (n_peers > WPAS_MAX_PASN_PEERS) {
3249 wpa_printf(MSG_DEBUG, "nl80211: PASN auth: too many peers (%d)",
3250 n_peers);
3251 return;
3252 }
3253
3254 nla_for_each_nested(attr, tb[QCA_WLAN_VENDOR_ATTR_PASN_PEERS],
3255 rem_conf) {
3256 struct nlattr *nl_src, *nl_peer;
3257
3258 ret = nla_parse_nested(cfg, QCA_WLAN_VENDOR_ATTR_PASN_PEER_MAX,
3259 attr, NULL);
3260 if (ret)
3261 return;
3262 nl_src = cfg[QCA_WLAN_VENDOR_ATTR_PASN_PEER_SRC_ADDR];
3263 nl_peer = cfg[QCA_WLAN_VENDOR_ATTR_PASN_PEER_MAC_ADDR];
3264 if (nl_src)
3265 os_memcpy(event.pasn_auth.peer[idx].own_addr,
3266 nla_data(nl_src), ETH_ALEN);
3267 if (nl_peer)
3268 os_memcpy(event.pasn_auth.peer[idx].peer_addr,
3269 nla_data(nl_peer), ETH_ALEN);
3270 if (cfg[QCA_WLAN_VENDOR_ATTR_PASN_PEER_LTF_KEYSEED_REQUIRED])
3271 event.pasn_auth.peer[idx].ltf_keyseed_required = true;
3272 idx++;
3273 }
3274 event.pasn_auth.num_peers = n_peers;
3275
3276 wpa_printf(MSG_DEBUG,
3277 "nl80211: PASN auth action: %u, num_bssids: %d",
3278 event.pasn_auth.action,
3279 event.pasn_auth.num_peers);
3280 wpa_supplicant_event(drv->ctx, EVENT_PASN_AUTH, &event);
3281 }
3282
3283 #endif /* CONFIG_PASN */
3284
3285 #endif /* CONFIG_DRIVER_NL80211_QCA */
3286
3287
nl80211_vendor_event_qca(struct wpa_driver_nl80211_data * drv,u32 subcmd,u8 * data,size_t len)3288 static void nl80211_vendor_event_qca(struct wpa_driver_nl80211_data *drv,
3289 u32 subcmd, u8 *data, size_t len)
3290 {
3291 switch (subcmd) {
3292 case QCA_NL80211_VENDOR_SUBCMD_TEST:
3293 wpa_hexdump(MSG_DEBUG, "nl80211: QCA test event", data, len);
3294 break;
3295 #ifdef CONFIG_DRIVER_NL80211_QCA
3296 case QCA_NL80211_VENDOR_SUBCMD_AVOID_FREQUENCY:
3297 qca_nl80211_avoid_freq(drv, data, len);
3298 break;
3299 case QCA_NL80211_VENDOR_SUBCMD_KEY_MGMT_ROAM_AUTH:
3300 qca_nl80211_key_mgmt_auth_handler(drv, data, len);
3301 break;
3302 case QCA_NL80211_VENDOR_SUBCMD_DO_ACS:
3303 qca_nl80211_acs_select_ch(drv, data, len);
3304 break;
3305 case QCA_NL80211_VENDOR_SUBCMD_DFS_OFFLOAD_CAC_STARTED:
3306 case QCA_NL80211_VENDOR_SUBCMD_DFS_OFFLOAD_CAC_FINISHED:
3307 case QCA_NL80211_VENDOR_SUBCMD_DFS_OFFLOAD_CAC_ABORTED:
3308 case QCA_NL80211_VENDOR_SUBCMD_DFS_OFFLOAD_CAC_NOP_FINISHED:
3309 case QCA_NL80211_VENDOR_SUBCMD_DFS_OFFLOAD_RADAR_DETECTED:
3310 qca_nl80211_dfs_offload_radar_event(drv, subcmd, data, len);
3311 break;
3312 case QCA_NL80211_VENDOR_SUBCMD_TRIGGER_SCAN:
3313 qca_nl80211_scan_trigger_event(drv, data, len);
3314 break;
3315 case QCA_NL80211_VENDOR_SUBCMD_SCAN_DONE:
3316 qca_nl80211_scan_done_event(drv, data, len);
3317 break;
3318 case QCA_NL80211_VENDOR_SUBCMD_P2P_LISTEN_OFFLOAD_STOP:
3319 qca_nl80211_p2p_lo_stop_event(drv, data, len);
3320 break;
3321 #ifdef CONFIG_PASN
3322 case QCA_NL80211_VENDOR_SUBCMD_PASN:
3323 qca_nl80211_pasn_auth(drv, data, len);
3324 break;
3325 #endif /* CONFIG_PASN */
3326 case QCA_NL80211_VENDOR_SUBCMD_TID_TO_LINK_MAP:
3327 qca_nl80211_tid_to_link_map_event(drv, data, len);
3328 break;
3329 case QCA_NL80211_VENDOR_SUBCMD_LINK_RECONFIG:
3330 qca_nl80211_link_reconfig_event(drv, data, len);
3331 break;
3332 #endif /* CONFIG_DRIVER_NL80211_QCA */
3333 default:
3334 wpa_printf(MSG_DEBUG,
3335 "nl80211: Ignore unsupported QCA vendor event %u",
3336 subcmd);
3337 break;
3338 }
3339 }
3340
3341
3342 #ifdef CONFIG_DRIVER_NL80211_BRCM
3343
brcm_nl80211_acs_select_ch(struct wpa_driver_nl80211_data * drv,const u8 * data,size_t len)3344 static void brcm_nl80211_acs_select_ch(struct wpa_driver_nl80211_data *drv,
3345 const u8 *data, size_t len)
3346 {
3347 struct nlattr *tb[BRCM_VENDOR_ATTR_ACS_LAST + 1];
3348 union wpa_event_data event;
3349
3350 wpa_printf(MSG_DEBUG,
3351 "nl80211: BRCM ACS channel selection vendor event received");
3352
3353 if (nla_parse(tb, BRCM_VENDOR_ATTR_ACS_LAST, (struct nlattr *) data,
3354 len, NULL) ||
3355 !tb[BRCM_VENDOR_ATTR_ACS_PRIMARY_FREQ] ||
3356 !tb[BRCM_VENDOR_ATTR_ACS_SECONDARY_FREQ])
3357 return;
3358
3359 os_memset(&event, 0, sizeof(event));
3360 if (tb[BRCM_VENDOR_ATTR_ACS_PRIMARY_FREQ])
3361 event.acs_selected_channels.pri_freq =
3362 nla_get_u32(tb[BRCM_VENDOR_ATTR_ACS_PRIMARY_FREQ]);
3363 if (tb[BRCM_VENDOR_ATTR_ACS_SECONDARY_FREQ])
3364 event.acs_selected_channels.sec_freq =
3365 nla_get_u32(tb[BRCM_VENDOR_ATTR_ACS_SECONDARY_FREQ]);
3366 if (tb[BRCM_VENDOR_ATTR_ACS_VHT_SEG0_CENTER_CHANNEL])
3367 event.acs_selected_channels.vht_seg0_center_ch =
3368 nla_get_u8(tb[BRCM_VENDOR_ATTR_ACS_VHT_SEG0_CENTER_CHANNEL]);
3369 if (tb[BRCM_VENDOR_ATTR_ACS_VHT_SEG0_CENTER_CHANNEL])
3370 event.acs_selected_channels.vht_seg1_center_ch =
3371 nla_get_u8(tb[BRCM_VENDOR_ATTR_ACS_VHT_SEG1_CENTER_CHANNEL]);
3372 if (tb[BRCM_VENDOR_ATTR_ACS_CHWIDTH])
3373 event.acs_selected_channels.ch_width =
3374 nla_get_u16(tb[BRCM_VENDOR_ATTR_ACS_CHWIDTH]);
3375 if (tb[BRCM_VENDOR_ATTR_ACS_HW_MODE]) {
3376 event.acs_selected_channels.hw_mode = nla_get_u8(tb[BRCM_VENDOR_ATTR_ACS_HW_MODE]);
3377 if (event.acs_selected_channels.hw_mode == NUM_HOSTAPD_MODES ||
3378 event.acs_selected_channels.hw_mode ==
3379 HOSTAPD_MODE_IEEE80211ANY) {
3380 wpa_printf(MSG_DEBUG,
3381 "nl80211: Invalid hw_mode %d in ACS selection event",
3382 event.acs_selected_channels.hw_mode);
3383 return;
3384 }
3385 }
3386
3387 wpa_printf(MSG_DEBUG,
3388 "nl80211: ACS Results: PCH: %d SCH: %d BW: %d VHT0: %d VHT1: %d HW_MODE: %d",
3389 event.acs_selected_channels.pri_freq,
3390 event.acs_selected_channels.sec_freq,
3391 event.acs_selected_channels.ch_width,
3392 event.acs_selected_channels.vht_seg0_center_ch,
3393 event.acs_selected_channels.vht_seg1_center_ch,
3394 event.acs_selected_channels.hw_mode);
3395 wpa_supplicant_event(drv->ctx, EVENT_ACS_CHANNEL_SELECTED, &event);
3396 }
3397
3398
nl80211_vendor_event_brcm(struct wpa_driver_nl80211_data * drv,u32 subcmd,u8 * data,size_t len)3399 static void nl80211_vendor_event_brcm(struct wpa_driver_nl80211_data *drv,
3400 u32 subcmd, u8 *data, size_t len)
3401 {
3402 wpa_printf(MSG_DEBUG, "nl80211: Got BRCM vendor event %u", subcmd);
3403 switch (subcmd) {
3404 case BRCM_VENDOR_EVENT_PRIV_STR:
3405 case BRCM_VENDOR_EVENT_HANGED:
3406 /* Dump the event on to the console */
3407 wpa_msg(NULL, MSG_INFO, "%s", data);
3408 break;
3409 case BRCM_VENDOR_EVENT_ACS:
3410 brcm_nl80211_acs_select_ch(drv, data, len);
3411 break;
3412 default:
3413 wpa_printf(MSG_DEBUG,
3414 "%s: Ignore unsupported BRCM vendor event %u",
3415 __func__, subcmd);
3416 break;
3417 }
3418 }
3419
3420 #endif /* CONFIG_DRIVER_NL80211_BRCM */
3421
3422
nl80211_vendor_event(struct wpa_driver_nl80211_data * drv,struct nlattr ** tb)3423 static void nl80211_vendor_event(struct wpa_driver_nl80211_data *drv,
3424 struct nlattr **tb)
3425 {
3426 u32 vendor_id, subcmd, wiphy = 0;
3427 int wiphy_idx;
3428 u8 *data = NULL;
3429 size_t len = 0;
3430
3431 if (!tb[NL80211_ATTR_VENDOR_ID] ||
3432 !tb[NL80211_ATTR_VENDOR_SUBCMD])
3433 return;
3434
3435 vendor_id = nla_get_u32(tb[NL80211_ATTR_VENDOR_ID]);
3436 subcmd = nla_get_u32(tb[NL80211_ATTR_VENDOR_SUBCMD]);
3437
3438 if (tb[NL80211_ATTR_WIPHY])
3439 wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
3440
3441 wpa_printf(MSG_DEBUG, "nl80211: Vendor event: wiphy=%u vendor_id=0x%x subcmd=%u",
3442 wiphy, vendor_id, subcmd);
3443
3444 if (tb[NL80211_ATTR_VENDOR_DATA]) {
3445 data = nla_data(tb[NL80211_ATTR_VENDOR_DATA]);
3446 len = nla_len(tb[NL80211_ATTR_VENDOR_DATA]);
3447 wpa_hexdump(MSG_MSGDUMP, "nl80211: Vendor data", data, len);
3448 }
3449
3450 wiphy_idx = nl80211_get_wiphy_index(drv->first_bss);
3451 if (wiphy_idx >= 0 && wiphy_idx != (int) wiphy) {
3452 wpa_printf(MSG_DEBUG, "nl80211: Ignore vendor event for foreign wiphy %u (own: %d)",
3453 wiphy, wiphy_idx);
3454 return;
3455 }
3456
3457 #ifdef ANDROID
3458 #ifdef ANDROID_LIB_EVENT
3459 /* Postpone QCA roam+auth event indication to the point when both that
3460 * and the NL80211_CMD_ROAM event have been received (see calls to
3461 * qca_nl80211_key_mgmt_auth() and drv->pending_roam_data). */
3462 if (!(vendor_id == OUI_QCA &&
3463 subcmd == QCA_NL80211_VENDOR_SUBCMD_KEY_MGMT_ROAM_AUTH))
3464 wpa_driver_nl80211_driver_event(drv, vendor_id, subcmd, data,
3465 len);
3466 #endif /* ANDROID_LIB_EVENT */
3467 #endif /* ANDROID */
3468
3469 switch (vendor_id) {
3470 case OUI_QCA:
3471 nl80211_vendor_event_qca(drv, subcmd, data, len);
3472 break;
3473 #ifdef CONFIG_DRIVER_NL80211_BRCM
3474 case OUI_BRCM:
3475 nl80211_vendor_event_brcm(drv, subcmd, data, len);
3476 break;
3477 #endif /* CONFIG_DRIVER_NL80211_BRCM */
3478 default:
3479 wpa_printf(MSG_DEBUG, "nl80211: Ignore unsupported vendor event");
3480 break;
3481 }
3482 }
3483
3484
nl80211_reg_change_event(struct wpa_driver_nl80211_data * drv,struct nlattr * tb[])3485 static void nl80211_reg_change_event(struct wpa_driver_nl80211_data *drv,
3486 struct nlattr *tb[])
3487 {
3488 union wpa_event_data data;
3489 enum nl80211_reg_initiator init;
3490
3491 wpa_printf(MSG_DEBUG, "nl80211: Regulatory domain change");
3492
3493 if (tb[NL80211_ATTR_REG_INITIATOR] == NULL)
3494 return;
3495
3496 os_memset(&data, 0, sizeof(data));
3497 init = nla_get_u8(tb[NL80211_ATTR_REG_INITIATOR]);
3498 wpa_printf(MSG_DEBUG, " * initiator=%d", init);
3499 switch (init) {
3500 case NL80211_REGDOM_SET_BY_CORE:
3501 data.channel_list_changed.initiator = REGDOM_SET_BY_CORE;
3502 break;
3503 case NL80211_REGDOM_SET_BY_USER:
3504 data.channel_list_changed.initiator = REGDOM_SET_BY_USER;
3505 break;
3506 case NL80211_REGDOM_SET_BY_DRIVER:
3507 data.channel_list_changed.initiator = REGDOM_SET_BY_DRIVER;
3508 break;
3509 case NL80211_REGDOM_SET_BY_COUNTRY_IE:
3510 data.channel_list_changed.initiator = REGDOM_SET_BY_COUNTRY_IE;
3511 break;
3512 }
3513
3514 if (tb[NL80211_ATTR_REG_TYPE]) {
3515 enum nl80211_reg_type type;
3516 type = nla_get_u8(tb[NL80211_ATTR_REG_TYPE]);
3517 wpa_printf(MSG_DEBUG, " * type=%d", type);
3518 switch (type) {
3519 case NL80211_REGDOM_TYPE_COUNTRY:
3520 data.channel_list_changed.type = REGDOM_TYPE_COUNTRY;
3521 break;
3522 case NL80211_REGDOM_TYPE_WORLD:
3523 data.channel_list_changed.type = REGDOM_TYPE_WORLD;
3524 break;
3525 case NL80211_REGDOM_TYPE_CUSTOM_WORLD:
3526 data.channel_list_changed.type =
3527 REGDOM_TYPE_CUSTOM_WORLD;
3528 break;
3529 case NL80211_REGDOM_TYPE_INTERSECTION:
3530 data.channel_list_changed.type =
3531 REGDOM_TYPE_INTERSECTION;
3532 break;
3533 }
3534 }
3535
3536 if (tb[NL80211_ATTR_REG_ALPHA2]) {
3537 os_strlcpy(data.channel_list_changed.alpha2,
3538 nla_get_string(tb[NL80211_ATTR_REG_ALPHA2]),
3539 sizeof(data.channel_list_changed.alpha2));
3540 wpa_printf(MSG_DEBUG, " * alpha2=%s",
3541 data.channel_list_changed.alpha2);
3542 }
3543
3544 wpa_supplicant_event(drv->ctx, EVENT_CHANNEL_LIST_CHANGED, &data);
3545 }
3546
3547
nl80211_parse_freq_attrs(const char * title,struct nlattr * nl_freq,struct frequency_attrs * attrs)3548 static void nl80211_parse_freq_attrs(const char *title, struct nlattr *nl_freq,
3549 struct frequency_attrs *attrs)
3550 {
3551 static struct nla_policy freq_policy[NL80211_FREQUENCY_ATTR_MAX + 1] = {
3552 [NL80211_FREQUENCY_ATTR_FREQ] = { .type = NLA_U32 },
3553 [NL80211_FREQUENCY_ATTR_DISABLED] = { .type = NLA_FLAG },
3554 [NL80211_FREQUENCY_ATTR_NO_IR] = { .type = NLA_FLAG },
3555 [NL80211_FREQUENCY_ATTR_RADAR] = { .type = NLA_FLAG },
3556 [NL80211_FREQUENCY_ATTR_MAX_TX_POWER] = { .type = NLA_U32 },
3557 };
3558 struct nlattr *tb[NL80211_FREQUENCY_ATTR_MAX + 1];
3559 u32 freq = 0, max_tx_power = 0;
3560
3561 nla_parse(tb, NL80211_FREQUENCY_ATTR_MAX,
3562 nla_data(nl_freq), nla_len(nl_freq), freq_policy);
3563
3564 if (tb[NL80211_FREQUENCY_ATTR_FREQ])
3565 freq = nla_get_u32(tb[NL80211_FREQUENCY_ATTR_FREQ]);
3566 if (tb[NL80211_FREQUENCY_ATTR_MAX_TX_POWER])
3567 max_tx_power =
3568 nla_get_u32(tb[NL80211_FREQUENCY_ATTR_MAX_TX_POWER]);
3569
3570 wpa_printf(MSG_DEBUG,
3571 "nl80211: Channel (%s): freq=%u max_tx_power=%u%s%s%s",
3572 title, freq, max_tx_power,
3573 tb[NL80211_FREQUENCY_ATTR_DISABLED] ? " disabled" : "",
3574 tb[NL80211_FREQUENCY_ATTR_NO_IR] ? " no-IR" : "",
3575 tb[NL80211_FREQUENCY_ATTR_RADAR] ? " radar" : "");
3576
3577 attrs->freq = freq;
3578 attrs->max_tx_power = max_tx_power;
3579 if (tb[NL80211_FREQUENCY_ATTR_DISABLED])
3580 attrs->disabled = true;
3581 if (tb[NL80211_FREQUENCY_ATTR_NO_IR])
3582 attrs->no_ir = true;
3583 if (tb[NL80211_FREQUENCY_ATTR_RADAR])
3584 attrs->radar = true;
3585 }
3586
3587
nl80211_reg_beacon_hint_event(struct wpa_driver_nl80211_data * drv,struct nlattr * tb[])3588 static void nl80211_reg_beacon_hint_event(struct wpa_driver_nl80211_data *drv,
3589 struct nlattr *tb[])
3590 {
3591 union wpa_event_data data;
3592
3593 wpa_printf(MSG_DEBUG, "nl80211: Regulatory beacon hint");
3594 os_memset(&data, 0, sizeof(data));
3595 data.channel_list_changed.initiator = REGDOM_BEACON_HINT;
3596
3597 if (tb[NL80211_ATTR_FREQ_BEFORE])
3598 nl80211_parse_freq_attrs(
3599 "before", tb[NL80211_ATTR_FREQ_BEFORE],
3600 &data.channel_list_changed.beacon_hint_before);
3601 if (tb[NL80211_ATTR_FREQ_AFTER])
3602 nl80211_parse_freq_attrs(
3603 "after", tb[NL80211_ATTR_FREQ_AFTER],
3604 &data.channel_list_changed.beacon_hint_after);
3605
3606 wpa_supplicant_event(drv->ctx, EVENT_CHANNEL_LIST_CHANGED, &data);
3607 }
3608
3609
nl80211_external_auth(struct wpa_driver_nl80211_data * drv,struct nlattr ** tb)3610 static void nl80211_external_auth(struct wpa_driver_nl80211_data *drv,
3611 struct nlattr **tb)
3612 {
3613 union wpa_event_data event;
3614 enum nl80211_external_auth_action act;
3615 char mld_addr[50];
3616
3617 if (!tb[NL80211_ATTR_AKM_SUITES] ||
3618 !tb[NL80211_ATTR_EXTERNAL_AUTH_ACTION] ||
3619 !tb[NL80211_ATTR_BSSID] ||
3620 !tb[NL80211_ATTR_SSID])
3621 return;
3622
3623 os_memset(&event, 0, sizeof(event));
3624 act = nla_get_u32(tb[NL80211_ATTR_EXTERNAL_AUTH_ACTION]);
3625 switch (act) {
3626 case NL80211_EXTERNAL_AUTH_START:
3627 event.external_auth.action = EXT_AUTH_START;
3628 break;
3629 case NL80211_EXTERNAL_AUTH_ABORT:
3630 event.external_auth.action = EXT_AUTH_ABORT;
3631 break;
3632 default:
3633 return;
3634 }
3635
3636 event.external_auth.key_mgmt_suite =
3637 nla_get_u32(tb[NL80211_ATTR_AKM_SUITES]);
3638
3639 event.external_auth.ssid_len = nla_len(tb[NL80211_ATTR_SSID]);
3640 if (event.external_auth.ssid_len > SSID_MAX_LEN)
3641 return;
3642 event.external_auth.ssid = nla_data(tb[NL80211_ATTR_SSID]);
3643
3644 event.external_auth.bssid = nla_data(tb[NL80211_ATTR_BSSID]);
3645
3646 mld_addr[0] = '\0';
3647 if (tb[NL80211_ATTR_MLD_ADDR]) {
3648 event.external_auth.mld_addr =
3649 nla_data(tb[NL80211_ATTR_MLD_ADDR]);
3650 os_snprintf(mld_addr, sizeof(mld_addr), ", MLD ADDR: " MACSTR,
3651 MAC2STR(event.external_auth.mld_addr));
3652 }
3653
3654 wpa_printf(MSG_DEBUG,
3655 "nl80211: External auth action: %u, AKM: 0x%x, SSID: %s, BSSID: " MACSTR "%s",
3656 event.external_auth.action,
3657 event.external_auth.key_mgmt_suite,
3658 wpa_ssid_txt(event.external_auth.ssid,
3659 event.external_auth.ssid_len),
3660 MAC2STR(event.external_auth.bssid), mld_addr);
3661 wpa_supplicant_event(drv->ctx, EVENT_EXTERNAL_AUTH, &event);
3662 }
3663
3664
nl80211_port_authorized(struct wpa_driver_nl80211_data * drv,struct nlattr ** tb)3665 static void nl80211_port_authorized(struct wpa_driver_nl80211_data *drv,
3666 struct nlattr **tb)
3667 {
3668 const u8 *addr;
3669 union wpa_event_data event;
3670
3671 os_memset(&event, 0, sizeof(event));
3672
3673 if (!tb[NL80211_ATTR_MAC] ||
3674 nla_len(tb[NL80211_ATTR_MAC]) != ETH_ALEN) {
3675 wpa_printf(MSG_DEBUG,
3676 "nl80211: Ignore port authorized event without BSSID");
3677 return;
3678 }
3679
3680 addr = nla_data(tb[NL80211_ATTR_MAC]);
3681 if (is_ap_interface(drv->nlmode) && drv->device_ap_sme) {
3682 event.port_authorized.sta_addr = addr;
3683 wpa_printf(MSG_DEBUG,
3684 "nl80211: Port authorized for STA addr " MACSTR,
3685 MAC2STR(addr));
3686 } else if (is_sta_interface(drv->nlmode)) {
3687 const u8 *connected_addr;
3688
3689 connected_addr = drv->sta_mlo_info.valid_links ?
3690 drv->sta_mlo_info.ap_mld_addr : drv->bssid;
3691 if (!ether_addr_equal(addr, connected_addr)) {
3692 wpa_printf(MSG_DEBUG,
3693 "nl80211: Ignore port authorized event for "
3694 MACSTR " (not the currently connected BSSID "
3695 MACSTR ")",
3696 MAC2STR(addr), MAC2STR(connected_addr));
3697 return;
3698 }
3699 }
3700
3701 if (tb[NL80211_ATTR_TD_BITMAP]) {
3702 event.port_authorized.td_bitmap_len =
3703 nla_len(tb[NL80211_ATTR_TD_BITMAP]);
3704 if (event.port_authorized.td_bitmap_len > 0)
3705 event.port_authorized.td_bitmap =
3706 nla_data(tb[NL80211_ATTR_TD_BITMAP]);
3707 }
3708
3709 wpa_supplicant_event(drv->ctx, EVENT_PORT_AUTHORIZED, &event);
3710 }
3711
3712
nl80211_sta_opmode_change_event(struct wpa_driver_nl80211_data * drv,struct nlattr ** tb)3713 static void nl80211_sta_opmode_change_event(struct wpa_driver_nl80211_data *drv,
3714 struct nlattr **tb)
3715 {
3716 union wpa_event_data ed;
3717 u8 smps_mode, max_bw;
3718
3719 if (!tb[NL80211_ATTR_MAC] ||
3720 (!tb[NL80211_ATTR_CHANNEL_WIDTH] &&
3721 !tb[NL80211_ATTR_SMPS_MODE] &&
3722 !tb[NL80211_ATTR_NSS]))
3723 return;
3724
3725 ed.sta_opmode.smps_mode = SMPS_INVALID;
3726 ed.sta_opmode.chan_width = CHAN_WIDTH_UNKNOWN;
3727 ed.sta_opmode.rx_nss = 0xff;
3728 ed.sta_opmode.addr = nla_data(tb[NL80211_ATTR_MAC]);
3729
3730 if (tb[NL80211_ATTR_SMPS_MODE]) {
3731 smps_mode = nla_get_u8(tb[NL80211_ATTR_SMPS_MODE]);
3732 switch (smps_mode) {
3733 case NL80211_SMPS_OFF:
3734 ed.sta_opmode.smps_mode = SMPS_OFF;
3735 break;
3736 case NL80211_SMPS_STATIC:
3737 ed.sta_opmode.smps_mode = SMPS_STATIC;
3738 break;
3739 case NL80211_SMPS_DYNAMIC:
3740 ed.sta_opmode.smps_mode = SMPS_DYNAMIC;
3741 break;
3742 default:
3743 ed.sta_opmode.smps_mode = SMPS_INVALID;
3744 break;
3745 }
3746 }
3747
3748 if (tb[NL80211_ATTR_CHANNEL_WIDTH]) {
3749 max_bw = nla_get_u32(tb[NL80211_ATTR_CHANNEL_WIDTH]);
3750 switch (max_bw) {
3751 case NL80211_CHAN_WIDTH_20_NOHT:
3752 ed.sta_opmode.chan_width = CHAN_WIDTH_20_NOHT;
3753 break;
3754 case NL80211_CHAN_WIDTH_20:
3755 ed.sta_opmode.chan_width = CHAN_WIDTH_20;
3756 break;
3757 case NL80211_CHAN_WIDTH_40:
3758 ed.sta_opmode.chan_width = CHAN_WIDTH_40;
3759 break;
3760 case NL80211_CHAN_WIDTH_80:
3761 ed.sta_opmode.chan_width = CHAN_WIDTH_80;
3762 break;
3763 case NL80211_CHAN_WIDTH_80P80:
3764 ed.sta_opmode.chan_width = CHAN_WIDTH_80P80;
3765 break;
3766 case NL80211_CHAN_WIDTH_160:
3767 ed.sta_opmode.chan_width = CHAN_WIDTH_160;
3768 break;
3769 case NL80211_CHAN_WIDTH_320:
3770 ed.sta_opmode.chan_width = CHAN_WIDTH_320;
3771 break;
3772 default:
3773 ed.sta_opmode.chan_width = CHAN_WIDTH_UNKNOWN;
3774 break;
3775
3776 }
3777 }
3778
3779 if (tb[NL80211_ATTR_NSS])
3780 ed.sta_opmode.rx_nss = nla_get_u8(tb[NL80211_ATTR_NSS]);
3781
3782 wpa_supplicant_event(drv->ctx, EVENT_STATION_OPMODE_CHANGED, &ed);
3783 }
3784
3785
nl80211_control_port_frame(struct i802_bss * bss,struct nlattr ** tb)3786 static void nl80211_control_port_frame(struct i802_bss *bss, struct nlattr **tb)
3787 {
3788 u8 *src_addr;
3789 u16 ethertype;
3790 enum frame_encryption encrypted;
3791 int link_id;
3792
3793 if (!tb[NL80211_ATTR_MAC] ||
3794 !tb[NL80211_ATTR_FRAME] ||
3795 !tb[NL80211_ATTR_CONTROL_PORT_ETHERTYPE])
3796 return;
3797
3798 src_addr = nla_data(tb[NL80211_ATTR_MAC]);
3799 ethertype = nla_get_u16(tb[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
3800 encrypted = nla_get_flag(tb[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]) ?
3801 FRAME_NOT_ENCRYPTED : FRAME_ENCRYPTED;
3802
3803 if (tb[NL80211_ATTR_MLO_LINK_ID])
3804 link_id = nla_get_u8(tb[NL80211_ATTR_MLO_LINK_ID]);
3805 else
3806 link_id = -1;
3807
3808 switch (ethertype) {
3809 case ETH_P_RSN_PREAUTH:
3810 wpa_printf(MSG_INFO, "nl80211: Got pre-auth frame from "
3811 MACSTR " over control port unexpectedly",
3812 MAC2STR(src_addr));
3813 break;
3814 case ETH_P_PAE:
3815 drv_event_eapol_rx2(bss->ctx, src_addr,
3816 nla_data(tb[NL80211_ATTR_FRAME]),
3817 nla_len(tb[NL80211_ATTR_FRAME]),
3818 encrypted, link_id);
3819 break;
3820 default:
3821 wpa_printf(MSG_INFO,
3822 "nl80211: Unexpected ethertype 0x%04x from "
3823 MACSTR " over control port",
3824 ethertype, MAC2STR(src_addr));
3825 break;
3826 }
3827 }
3828
3829
3830 static void
nl80211_control_port_frame_tx_status(struct i802_bss * bss,const u8 * frame,size_t len,struct nlattr * ack,struct nlattr * cookie)3831 nl80211_control_port_frame_tx_status(struct i802_bss *bss,
3832 const u8 *frame, size_t len,
3833 struct nlattr *ack, struct nlattr *cookie)
3834 {
3835 struct wpa_driver_nl80211_data *drv = bss->drv;
3836 union wpa_event_data event;
3837
3838 if (!cookie || len < ETH_HLEN)
3839 return;
3840
3841 wpa_printf(MSG_DEBUG,
3842 "nl80211: Control port TX status (ack=%d), cookie=%llu",
3843 ack != NULL, (long long unsigned int) nla_get_u64(cookie));
3844
3845 os_memset(&event, 0, sizeof(event));
3846 event.eapol_tx_status.dst = frame;
3847 event.eapol_tx_status.data = frame + ETH_HLEN;
3848 event.eapol_tx_status.data_len = len - ETH_HLEN;
3849 event.eapol_tx_status.ack = ack != NULL;
3850 event.eapol_tx_status.link_id =
3851 nla_get_u64(cookie) == drv->eapol_tx_cookie ?
3852 drv->eapol_tx_link_id : NL80211_DRV_LINK_ID_NA;
3853
3854 wpa_supplicant_event(bss->ctx, EVENT_EAPOL_TX_STATUS, &event);
3855 }
3856
3857
nl80211_frame_wait_cancel(struct wpa_driver_nl80211_data * drv,struct nlattr * cookie_attr)3858 static void nl80211_frame_wait_cancel(struct wpa_driver_nl80211_data *drv,
3859 struct nlattr *cookie_attr)
3860 {
3861 unsigned int i;
3862 u64 cookie;
3863 bool match = false;
3864
3865 if (!cookie_attr)
3866 return;
3867 cookie = nla_get_u64(cookie_attr);
3868
3869 for (i = 0; i < drv->num_send_frame_cookies; i++) {
3870 if (cookie == drv->send_frame_cookies[i]) {
3871 match = true;
3872 break;
3873 }
3874 }
3875 wpa_printf(MSG_DEBUG,
3876 "nl80211: TX frame wait expired for cookie 0x%llx%s%s",
3877 (long long unsigned int) cookie,
3878 match ? " (match)" : "",
3879 drv->send_frame_cookie == cookie ? " (match-saved)" : "");
3880 if (drv->send_frame_cookie == cookie) {
3881 drv->send_frame_cookie = (u64) -1;
3882 if (!match)
3883 goto send_event;
3884 }
3885 if (!match)
3886 return;
3887
3888 if (i < drv->num_send_frame_cookies - 1)
3889 os_memmove(&drv->send_frame_cookies[i],
3890 &drv->send_frame_cookies[i + 1],
3891 (drv->num_send_frame_cookies - i - 1) * sizeof(u64));
3892 drv->num_send_frame_cookies--;
3893
3894 send_event:
3895 wpa_supplicant_event(drv->ctx, EVENT_TX_WAIT_EXPIRE, NULL);
3896 }
3897
3898
nl80211_assoc_comeback(struct wpa_driver_nl80211_data * drv,struct nlattr * mac,struct nlattr * timeout)3899 static void nl80211_assoc_comeback(struct wpa_driver_nl80211_data *drv,
3900 struct nlattr *mac, struct nlattr *timeout)
3901 {
3902 if (!mac || !timeout)
3903 return;
3904 wpa_printf(MSG_DEBUG, "nl80211: Association comeback requested by "
3905 MACSTR " (timeout: %u ms)",
3906 MAC2STR((u8 *) nla_data(mac)), nla_get_u32(timeout));
3907 }
3908
3909
3910 #ifdef CONFIG_IEEE80211AX
3911
nl80211_obss_color_event(struct i802_bss * bss,enum nl80211_commands cmd,struct nlattr * tb[])3912 static void nl80211_obss_color_event(struct i802_bss *bss,
3913 enum nl80211_commands cmd,
3914 struct nlattr *tb[])
3915 {
3916 union wpa_event_data data;
3917 enum wpa_event_type event_type;
3918
3919 os_memset(&data, 0, sizeof(data));
3920 data.bss_color_collision.link_id = NL80211_DRV_LINK_ID_NA;
3921
3922 switch (cmd) {
3923 case NL80211_CMD_OBSS_COLOR_COLLISION:
3924 event_type = EVENT_BSS_COLOR_COLLISION;
3925 if (!tb[NL80211_ATTR_OBSS_COLOR_BITMAP])
3926 return;
3927 data.bss_color_collision.bitmap =
3928 nla_get_u64(tb[NL80211_ATTR_OBSS_COLOR_BITMAP]);
3929 wpa_printf(MSG_DEBUG,
3930 "nl80211: BSS color collision - bitmap %08llx",
3931 (long long unsigned int)
3932 data.bss_color_collision.bitmap);
3933 break;
3934 case NL80211_CMD_COLOR_CHANGE_STARTED:
3935 event_type = EVENT_CCA_STARTED_NOTIFY;
3936 wpa_printf(MSG_DEBUG, "nl80211: CCA started");
3937 break;
3938 case NL80211_CMD_COLOR_CHANGE_ABORTED:
3939 event_type = EVENT_CCA_ABORTED_NOTIFY;
3940 wpa_printf(MSG_DEBUG, "nl80211: CCA aborted");
3941 break;
3942 case NL80211_CMD_COLOR_CHANGE_COMPLETED:
3943 event_type = EVENT_CCA_NOTIFY;
3944 wpa_printf(MSG_DEBUG, "nl80211: CCA completed");
3945 break;
3946 default:
3947 wpa_printf(MSG_DEBUG, "nl80211: Unknown CCA command %d", cmd);
3948 return;
3949 }
3950
3951 if (tb[NL80211_ATTR_MLO_LINK_ID]) {
3952 data.bss_color_collision.link_id =
3953 nla_get_u8(tb[NL80211_ATTR_MLO_LINK_ID]);
3954
3955 if (!nl80211_link_valid(bss->valid_links,
3956 data.bss_color_collision.link_id)) {
3957 wpa_printf(MSG_DEBUG,
3958 "nl80211: Invalid BSS color event link ID %d",
3959 data.bss_color_collision.link_id);
3960 return;
3961 }
3962
3963 wpa_printf(MSG_DEBUG, "nl80211: BSS color event - Link ID %d",
3964 data.bss_color_collision.link_id);
3965 }
3966
3967 wpa_supplicant_event(bss->ctx, event_type, &data);
3968 }
3969
3970 #endif /* CONFIG_IEEE80211AX */
3971
3972
do_process_drv_event(struct i802_bss * bss,int cmd,struct nlattr ** tb)3973 static void do_process_drv_event(struct i802_bss *bss, int cmd,
3974 struct nlattr **tb)
3975 {
3976 struct wpa_driver_nl80211_data *drv = bss->drv;
3977 int external_scan_event = 0;
3978 struct nlattr *frame = tb[NL80211_ATTR_FRAME];
3979
3980 wpa_printf(MSG_DEBUG, "nl80211: Drv Event %d (%s) received for %s",
3981 cmd, nl80211_command_to_string(cmd), bss->ifname);
3982
3983 #ifdef CONFIG_DRIVER_NL80211_QCA
3984 if (cmd == NL80211_CMD_ROAM &&
3985 (drv->capa.flags & WPA_DRIVER_FLAGS_KEY_MGMT_OFFLOAD)) {
3986 if (drv->pending_roam_data) {
3987 wpa_printf(MSG_DEBUG,
3988 "nl80211: Process pending roam+auth vendor event");
3989 qca_nl80211_key_mgmt_auth(drv, drv->pending_roam_data,
3990 drv->pending_roam_data_len);
3991 os_free(drv->pending_roam_data);
3992 drv->pending_roam_data = NULL;
3993 return;
3994 }
3995 /*
3996 * Device will use roam+auth vendor event to indicate
3997 * roaming, so ignore the regular roam event.
3998 */
3999 drv->roam_indication_done = true;
4000 wpa_printf(MSG_DEBUG,
4001 "nl80211: Ignore roam event (cmd=%d), device will use vendor event roam+auth",
4002 cmd);
4003 return;
4004 }
4005 #endif /* CONFIG_DRIVER_NL80211_QCA */
4006
4007 if (drv->ap_scan_as_station != NL80211_IFTYPE_UNSPECIFIED &&
4008 (cmd == NL80211_CMD_NEW_SCAN_RESULTS ||
4009 cmd == NL80211_CMD_SCAN_ABORTED))
4010 nl80211_restore_ap_mode(bss);
4011
4012 switch (cmd) {
4013 case NL80211_CMD_TRIGGER_SCAN:
4014 wpa_dbg(bss->ctx, MSG_DEBUG, "nl80211: Scan trigger");
4015 drv->scan_state = SCAN_STARTED;
4016 if (drv->scan_for_auth) {
4017 /*
4018 * Cannot indicate EVENT_SCAN_STARTED here since we skip
4019 * EVENT_SCAN_RESULTS in scan_for_auth case and the
4020 * upper layer implementation could get confused about
4021 * scanning state.
4022 */
4023 wpa_printf(MSG_DEBUG, "nl80211: Do not indicate scan-start event due to internal scan_for_auth");
4024 break;
4025 }
4026 wpa_supplicant_event(bss->ctx, EVENT_SCAN_STARTED, NULL);
4027 break;
4028 case NL80211_CMD_START_SCHED_SCAN:
4029 wpa_dbg(bss->ctx, MSG_DEBUG, "nl80211: Sched scan started");
4030 drv->scan_state = SCHED_SCAN_STARTED;
4031 break;
4032 case NL80211_CMD_SCHED_SCAN_STOPPED:
4033 wpa_dbg(bss->ctx, MSG_DEBUG, "nl80211: Sched scan stopped");
4034 drv->scan_state = SCHED_SCAN_STOPPED;
4035 wpa_supplicant_event(bss->ctx, EVENT_SCHED_SCAN_STOPPED, NULL);
4036 break;
4037 case NL80211_CMD_NEW_SCAN_RESULTS:
4038 wpa_dbg(bss->ctx, MSG_DEBUG,
4039 "nl80211: New scan results available");
4040 if (drv->last_scan_cmd != NL80211_CMD_VENDOR)
4041 drv->scan_state = SCAN_COMPLETED;
4042 drv->scan_complete_events = 1;
4043 if (drv->last_scan_cmd == NL80211_CMD_TRIGGER_SCAN) {
4044 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout,
4045 drv, bss->ctx);
4046 drv->last_scan_cmd = 0;
4047 } else {
4048 external_scan_event = 1;
4049 }
4050 send_scan_event(bss, 0, tb, external_scan_event);
4051 break;
4052 case NL80211_CMD_SCHED_SCAN_RESULTS:
4053 wpa_dbg(bss->ctx, MSG_DEBUG,
4054 "nl80211: New sched scan results available");
4055 drv->scan_state = SCHED_SCAN_RESULTS;
4056 send_scan_event(bss, 0, tb, 0);
4057 break;
4058 case NL80211_CMD_SCAN_ABORTED:
4059 wpa_dbg(bss->ctx, MSG_DEBUG, "nl80211: Scan aborted");
4060 if (drv->last_scan_cmd != NL80211_CMD_VENDOR)
4061 drv->scan_state = SCAN_ABORTED;
4062 if (drv->last_scan_cmd == NL80211_CMD_TRIGGER_SCAN) {
4063 /*
4064 * Need to indicate that scan results are available in
4065 * order not to make wpa_supplicant stop its scanning.
4066 */
4067 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout,
4068 drv, bss->ctx);
4069 drv->last_scan_cmd = 0;
4070 } else {
4071 external_scan_event = 1;
4072 }
4073 send_scan_event(bss, 1, tb, external_scan_event);
4074 break;
4075 case NL80211_CMD_AUTHENTICATE:
4076 case NL80211_CMD_ASSOCIATE:
4077 case NL80211_CMD_DEAUTHENTICATE:
4078 case NL80211_CMD_DISASSOCIATE:
4079 case NL80211_CMD_FRAME:
4080 case NL80211_CMD_FRAME_TX_STATUS:
4081 case NL80211_CMD_UNPROT_DEAUTHENTICATE:
4082 case NL80211_CMD_UNPROT_DISASSOCIATE:
4083 mlme_event(bss, cmd, tb[NL80211_ATTR_FRAME],
4084 tb[NL80211_ATTR_MAC], tb[NL80211_ATTR_TIMED_OUT],
4085 tb[NL80211_ATTR_WIPHY_FREQ], tb[NL80211_ATTR_ACK],
4086 tb[NL80211_ATTR_COOKIE],
4087 tb[NL80211_ATTR_RX_SIGNAL_DBM],
4088 tb[NL80211_ATTR_STA_WME],
4089 tb[NL80211_ATTR_REQ_IE],
4090 tb[NL80211_ATTR_MLO_LINK_ID]);
4091 break;
4092 case NL80211_CMD_CONNECT:
4093 case NL80211_CMD_ROAM:
4094 mlme_event_connect(drv, cmd, false,
4095 tb[NL80211_ATTR_STATUS_CODE],
4096 tb[NL80211_ATTR_MAC],
4097 tb[NL80211_ATTR_REQ_IE],
4098 tb[NL80211_ATTR_RESP_IE],
4099 tb[NL80211_ATTR_TIMED_OUT],
4100 tb[NL80211_ATTR_TIMEOUT_REASON],
4101 NULL, NULL, NULL,
4102 tb[NL80211_ATTR_FILS_KEK],
4103 NULL,
4104 tb[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM],
4105 tb[NL80211_ATTR_PMK],
4106 tb[NL80211_ATTR_PMKID],
4107 tb[NL80211_ATTR_MLO_LINKS]);
4108 break;
4109 case NL80211_CMD_CH_SWITCH_STARTED_NOTIFY:
4110 mlme_event_ch_switch(drv,
4111 tb[NL80211_ATTR_IFINDEX],
4112 tb[NL80211_ATTR_MLO_LINK_ID],
4113 tb[NL80211_ATTR_WIPHY_FREQ],
4114 tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE],
4115 tb[NL80211_ATTR_CHANNEL_WIDTH],
4116 tb[NL80211_ATTR_CENTER_FREQ1],
4117 tb[NL80211_ATTR_CENTER_FREQ2],
4118 tb[NL80211_ATTR_PUNCT_BITMAP],
4119 0);
4120 break;
4121 case NL80211_CMD_CH_SWITCH_NOTIFY:
4122 mlme_event_ch_switch(drv,
4123 tb[NL80211_ATTR_IFINDEX],
4124 tb[NL80211_ATTR_MLO_LINK_ID],
4125 tb[NL80211_ATTR_WIPHY_FREQ],
4126 tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE],
4127 tb[NL80211_ATTR_CHANNEL_WIDTH],
4128 tb[NL80211_ATTR_CENTER_FREQ1],
4129 tb[NL80211_ATTR_CENTER_FREQ2],
4130 tb[NL80211_ATTR_PUNCT_BITMAP],
4131 1);
4132 break;
4133 case NL80211_CMD_DISCONNECT:
4134 mlme_event_disconnect(drv, tb[NL80211_ATTR_REASON_CODE],
4135 tb[NL80211_ATTR_MAC],
4136 tb[NL80211_ATTR_DISCONNECTED_BY_AP]);
4137 break;
4138 case NL80211_CMD_MICHAEL_MIC_FAILURE:
4139 mlme_event_michael_mic_failure(bss, tb);
4140 break;
4141 case NL80211_CMD_JOIN_IBSS:
4142 mlme_event_join_ibss(drv, tb);
4143 break;
4144 case NL80211_CMD_REMAIN_ON_CHANNEL:
4145 mlme_event_remain_on_channel(drv, 0, tb);
4146 break;
4147 case NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL:
4148 mlme_event_remain_on_channel(drv, 1, tb);
4149 break;
4150 case NL80211_CMD_NOTIFY_CQM:
4151 nl80211_cqm_event(bss, tb);
4152 break;
4153 case NL80211_CMD_REG_CHANGE:
4154 case NL80211_CMD_WIPHY_REG_CHANGE:
4155 nl80211_reg_change_event(drv, tb);
4156 break;
4157 case NL80211_CMD_REG_BEACON_HINT:
4158 nl80211_reg_beacon_hint_event(drv, tb);
4159 break;
4160 case NL80211_CMD_NEW_STATION:
4161 nl80211_new_station_event(drv, bss, tb);
4162 break;
4163 case NL80211_CMD_DEL_STATION:
4164 nl80211_del_station_event(drv, bss, tb);
4165 break;
4166 case NL80211_CMD_SET_REKEY_OFFLOAD:
4167 nl80211_rekey_offload_event(drv, tb);
4168 break;
4169 case NL80211_CMD_PMKSA_CANDIDATE:
4170 nl80211_pmksa_candidate_event(drv, tb);
4171 break;
4172 case NL80211_CMD_PROBE_CLIENT:
4173 nl80211_client_probe_event(drv, tb);
4174 break;
4175 case NL80211_CMD_TDLS_OPER:
4176 nl80211_tdls_oper_event(drv, tb);
4177 break;
4178 case NL80211_CMD_CONN_FAILED:
4179 nl80211_connect_failed_event(drv, tb);
4180 break;
4181 case NL80211_CMD_FT_EVENT:
4182 mlme_event_ft_event(drv, tb);
4183 break;
4184 case NL80211_CMD_RADAR_DETECT:
4185 nl80211_radar_event(bss, tb);
4186 break;
4187 case NL80211_CMD_STOP_AP:
4188 nl80211_stop_ap(bss, tb);
4189 break;
4190 case NL80211_CMD_VENDOR:
4191 nl80211_vendor_event(drv, tb);
4192 break;
4193 case NL80211_CMD_NEW_PEER_CANDIDATE:
4194 nl80211_new_peer_candidate(drv, tb);
4195 break;
4196 case NL80211_CMD_PORT_AUTHORIZED:
4197 nl80211_port_authorized(drv, tb);
4198 break;
4199 case NL80211_CMD_STA_OPMODE_CHANGED:
4200 nl80211_sta_opmode_change_event(drv, tb);
4201 break;
4202 case NL80211_CMD_UPDATE_OWE_INFO:
4203 mlme_event_dh_event(drv, bss, tb);
4204 break;
4205 case NL80211_CMD_UNPROT_BEACON:
4206 if (frame)
4207 mlme_event_unprot_beacon(drv, nla_data(frame),
4208 nla_len(frame));
4209 break;
4210 case NL80211_CMD_CONTROL_PORT_FRAME_TX_STATUS:
4211 if (!frame)
4212 break;
4213 nl80211_control_port_frame_tx_status(bss,
4214 nla_data(frame),
4215 nla_len(frame),
4216 tb[NL80211_ATTR_ACK],
4217 tb[NL80211_ATTR_COOKIE]);
4218 break;
4219 case NL80211_CMD_FRAME_WAIT_CANCEL:
4220 nl80211_frame_wait_cancel(drv, tb[NL80211_ATTR_COOKIE]);
4221 break;
4222 case NL80211_CMD_ASSOC_COMEBACK:
4223 nl80211_assoc_comeback(drv, tb[NL80211_ATTR_MAC],
4224 tb[NL80211_ATTR_TIMEOUT]);
4225 break;
4226 #ifdef CONFIG_IEEE80211AX
4227 case NL80211_CMD_OBSS_COLOR_COLLISION:
4228 case NL80211_CMD_COLOR_CHANGE_STARTED:
4229 case NL80211_CMD_COLOR_CHANGE_ABORTED:
4230 case NL80211_CMD_COLOR_CHANGE_COMPLETED:
4231 nl80211_obss_color_event(bss, cmd, tb);
4232 break;
4233 #endif /* CONFIG_IEEE80211AX */
4234 case NL80211_CMD_LINKS_REMOVED:
4235 wpa_supplicant_event(drv->ctx, EVENT_LINK_RECONFIG, NULL);
4236 break;
4237 default:
4238 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: Ignored unknown event "
4239 "(cmd=%d)", cmd);
4240 break;
4241 }
4242 }
4243
4244
nl80211_drv_in_list(struct nl80211_global * global,struct wpa_driver_nl80211_data * drv)4245 static bool nl80211_drv_in_list(struct nl80211_global *global,
4246 struct wpa_driver_nl80211_data *drv)
4247 {
4248 struct wpa_driver_nl80211_data *tmp;
4249
4250 dl_list_for_each(tmp, &global->interfaces,
4251 struct wpa_driver_nl80211_data, list) {
4252 if (drv == tmp)
4253 return true;
4254 }
4255
4256 return false;
4257 }
4258
4259
process_global_event(struct nl_msg * msg,void * arg)4260 int process_global_event(struct nl_msg *msg, void *arg)
4261 {
4262 struct nl80211_global *global = arg;
4263 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
4264 struct nlattr *tb[NL80211_ATTR_MAX + 1];
4265 struct wpa_driver_nl80211_data *drv, *tmp;
4266 int ifidx = -1, wiphy_idx = -1, wiphy_idx_rx = -1;
4267 struct i802_bss *bss;
4268 u64 wdev_id = 0;
4269 int wdev_id_set = 0;
4270 int wiphy_idx_set = 0;
4271 bool processed = false;
4272
4273 /* Event marker, all prior events have been processed */
4274 if (gnlh->cmd == NL80211_CMD_GET_PROTOCOL_FEATURES) {
4275 u32 seq = nlmsg_hdr(msg)->nlmsg_seq;
4276
4277 dl_list_for_each_safe(drv, tmp, &global->interfaces,
4278 struct wpa_driver_nl80211_data, list) {
4279 if (drv->ignore_next_local_deauth > 0 &&
4280 drv->ignore_next_local_deauth <= seq) {
4281 wpa_printf(MSG_DEBUG,
4282 "nl80211: No DEAUTHENTICATE event was ignored");
4283 drv->ignore_next_local_deauth = 0;
4284 }
4285
4286 if (drv->ignore_next_local_disconnect > 0 &&
4287 drv->ignore_next_local_disconnect <= seq) {
4288 wpa_printf(MSG_DEBUG,
4289 "nl80211: No DISCONNECT event was ignored");
4290 drv->ignore_next_local_disconnect = 0;
4291 }
4292 }
4293
4294 return NL_SKIP;
4295 }
4296
4297 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
4298 genlmsg_attrlen(gnlh, 0), NULL);
4299
4300 if (tb[NL80211_ATTR_IFINDEX])
4301 ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
4302 else if (tb[NL80211_ATTR_WDEV]) {
4303 wdev_id = nla_get_u64(tb[NL80211_ATTR_WDEV]);
4304 wdev_id_set = 1;
4305 } else if (tb[NL80211_ATTR_WIPHY]) {
4306 wiphy_idx_rx = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
4307 wiphy_idx_set = 1;
4308 }
4309
4310 dl_list_for_each_safe(drv, tmp, &global->interfaces,
4311 struct wpa_driver_nl80211_data, list) {
4312 for (bss = drv->first_bss; bss; bss = bss->next) {
4313 if (wiphy_idx_set)
4314 wiphy_idx = nl80211_get_wiphy_index(bss);
4315 if ((ifidx == -1 && !wiphy_idx_set && !wdev_id_set) ||
4316 ifidx == bss->ifindex ||
4317 (wiphy_idx_set && wiphy_idx == wiphy_idx_rx) ||
4318 (wdev_id_set && bss->wdev_id_set &&
4319 wdev_id == bss->wdev_id)) {
4320 processed = true;
4321 do_process_drv_event(bss, gnlh->cmd, tb);
4322 /* There are two types of events that may need
4323 * to be delivered to multiple interfaces:
4324 * 1. Events for a wiphy, as it can have
4325 * multiple interfaces.
4326 * 2. "Global" events, like
4327 * NL80211_CMD_REG_CHANGE.
4328 *
4329 * Terminate early only if the event is directed
4330 * to a specific interface or wdev. */
4331 if (ifidx != -1 || wdev_id_set)
4332 return NL_SKIP;
4333 /* The driver instance could have been removed,
4334 * e.g., due to NL80211_CMD_RADAR_DETECT event,
4335 * so need to stop the loop if that has
4336 * happened. */
4337 if (!nl80211_drv_in_list(global, drv))
4338 break;
4339 }
4340 }
4341 }
4342
4343 if (processed)
4344 return NL_SKIP;
4345
4346 wpa_printf(MSG_DEBUG,
4347 "nl80211: Ignored event %d (%s) for foreign interface (ifindex %d wdev 0x%llx wiphy %d)",
4348 gnlh->cmd, nl80211_command_to_string(gnlh->cmd),
4349 ifidx, (long long unsigned int) wdev_id, wiphy_idx_rx);
4350
4351 return NL_SKIP;
4352 }
4353
4354
process_bss_event(struct nl_msg * msg,void * arg)4355 int process_bss_event(struct nl_msg *msg, void *arg)
4356 {
4357 struct i802_bss *bss = arg;
4358 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
4359 struct nlattr *tb[NL80211_ATTR_MAX + 1];
4360
4361 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
4362 genlmsg_attrlen(gnlh, 0), NULL);
4363
4364 wpa_printf(MSG_DEBUG, "nl80211: BSS Event %d (%s) received for %s",
4365 gnlh->cmd, nl80211_command_to_string(gnlh->cmd),
4366 bss->ifname);
4367
4368 switch (gnlh->cmd) {
4369 case NL80211_CMD_FRAME:
4370 case NL80211_CMD_FRAME_TX_STATUS:
4371 mlme_event(bss, gnlh->cmd, tb[NL80211_ATTR_FRAME],
4372 tb[NL80211_ATTR_MAC], tb[NL80211_ATTR_TIMED_OUT],
4373 tb[NL80211_ATTR_WIPHY_FREQ], tb[NL80211_ATTR_ACK],
4374 tb[NL80211_ATTR_COOKIE],
4375 tb[NL80211_ATTR_RX_SIGNAL_DBM],
4376 tb[NL80211_ATTR_STA_WME], NULL,
4377 tb[NL80211_ATTR_MLO_LINK_ID]);
4378 break;
4379 case NL80211_CMD_UNEXPECTED_FRAME:
4380 nl80211_spurious_frame(bss, tb, 0);
4381 break;
4382 case NL80211_CMD_UNEXPECTED_4ADDR_FRAME:
4383 nl80211_spurious_frame(bss, tb, 1);
4384 break;
4385 case NL80211_CMD_EXTERNAL_AUTH:
4386 nl80211_external_auth(bss->drv, tb);
4387 break;
4388 case NL80211_CMD_CONTROL_PORT_FRAME:
4389 nl80211_control_port_frame(bss, tb);
4390 break;
4391 default:
4392 wpa_printf(MSG_DEBUG, "nl80211: Ignored unknown event "
4393 "(cmd=%d)", gnlh->cmd);
4394 break;
4395 }
4396
4397 return NL_SKIP;
4398 }
4399