1 /*
2 * Driver interaction with Linux nl80211/cfg80211 - Event processing
3 * Copyright (c) 2002-2017, Jouni Malinen <j@w1.fi>
4 * Copyright (c) 2007, Johannes Berg <johannes@sipsolutions.net>
5 * Copyright (c) 2009-2010, Atheros Communications
6 *
7 * This software may be distributed under the terms of the BSD license.
8 * See README for more details.
9 */
10
11 #include "includes.h"
12 #include <netlink/genl/genl.h>
13
14 #include "utils/common.h"
15 #include "utils/eloop.h"
16 #include "common/qca-vendor.h"
17 #include "common/qca-vendor-attr.h"
18 #include "common/brcm_vendor.h"
19 #include "common/ieee802_11_defs.h"
20 #include "common/ieee802_11_common.h"
21 #include "driver_nl80211.h"
22
23 static void
24 nl80211_control_port_frame_tx_status(struct i802_bss *bss,
25 const u8 *frame, size_t len,
26 struct nlattr *ack, struct nlattr *cookie);
27
28
nl80211_command_to_string(enum nl80211_commands cmd)29 static const char * nl80211_command_to_string(enum nl80211_commands cmd)
30 {
31 #define C2S(x) case x: return #x;
32 switch (cmd) {
33 C2S(NL80211_CMD_UNSPEC)
34 C2S(NL80211_CMD_GET_WIPHY)
35 C2S(NL80211_CMD_SET_WIPHY)
36 C2S(NL80211_CMD_NEW_WIPHY)
37 C2S(NL80211_CMD_DEL_WIPHY)
38 C2S(NL80211_CMD_GET_INTERFACE)
39 C2S(NL80211_CMD_SET_INTERFACE)
40 C2S(NL80211_CMD_NEW_INTERFACE)
41 C2S(NL80211_CMD_DEL_INTERFACE)
42 C2S(NL80211_CMD_GET_KEY)
43 C2S(NL80211_CMD_SET_KEY)
44 C2S(NL80211_CMD_NEW_KEY)
45 C2S(NL80211_CMD_DEL_KEY)
46 C2S(NL80211_CMD_GET_BEACON)
47 C2S(NL80211_CMD_SET_BEACON)
48 C2S(NL80211_CMD_START_AP)
49 C2S(NL80211_CMD_STOP_AP)
50 C2S(NL80211_CMD_GET_STATION)
51 C2S(NL80211_CMD_SET_STATION)
52 C2S(NL80211_CMD_NEW_STATION)
53 C2S(NL80211_CMD_DEL_STATION)
54 C2S(NL80211_CMD_GET_MPATH)
55 C2S(NL80211_CMD_SET_MPATH)
56 C2S(NL80211_CMD_NEW_MPATH)
57 C2S(NL80211_CMD_DEL_MPATH)
58 C2S(NL80211_CMD_SET_BSS)
59 C2S(NL80211_CMD_SET_REG)
60 C2S(NL80211_CMD_REQ_SET_REG)
61 C2S(NL80211_CMD_GET_MESH_CONFIG)
62 C2S(NL80211_CMD_SET_MESH_CONFIG)
63 C2S(NL80211_CMD_SET_MGMT_EXTRA_IE)
64 C2S(NL80211_CMD_GET_REG)
65 C2S(NL80211_CMD_GET_SCAN)
66 C2S(NL80211_CMD_TRIGGER_SCAN)
67 C2S(NL80211_CMD_NEW_SCAN_RESULTS)
68 C2S(NL80211_CMD_SCAN_ABORTED)
69 C2S(NL80211_CMD_REG_CHANGE)
70 C2S(NL80211_CMD_AUTHENTICATE)
71 C2S(NL80211_CMD_ASSOCIATE)
72 C2S(NL80211_CMD_DEAUTHENTICATE)
73 C2S(NL80211_CMD_DISASSOCIATE)
74 C2S(NL80211_CMD_MICHAEL_MIC_FAILURE)
75 C2S(NL80211_CMD_REG_BEACON_HINT)
76 C2S(NL80211_CMD_JOIN_IBSS)
77 C2S(NL80211_CMD_LEAVE_IBSS)
78 C2S(NL80211_CMD_TESTMODE)
79 C2S(NL80211_CMD_CONNECT)
80 C2S(NL80211_CMD_ROAM)
81 C2S(NL80211_CMD_DISCONNECT)
82 C2S(NL80211_CMD_SET_WIPHY_NETNS)
83 C2S(NL80211_CMD_GET_SURVEY)
84 C2S(NL80211_CMD_NEW_SURVEY_RESULTS)
85 C2S(NL80211_CMD_SET_PMKSA)
86 C2S(NL80211_CMD_DEL_PMKSA)
87 C2S(NL80211_CMD_FLUSH_PMKSA)
88 C2S(NL80211_CMD_REMAIN_ON_CHANNEL)
89 C2S(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL)
90 C2S(NL80211_CMD_SET_TX_BITRATE_MASK)
91 C2S(NL80211_CMD_REGISTER_FRAME)
92 C2S(NL80211_CMD_FRAME)
93 C2S(NL80211_CMD_FRAME_TX_STATUS)
94 C2S(NL80211_CMD_SET_POWER_SAVE)
95 C2S(NL80211_CMD_GET_POWER_SAVE)
96 C2S(NL80211_CMD_SET_CQM)
97 C2S(NL80211_CMD_NOTIFY_CQM)
98 C2S(NL80211_CMD_SET_CHANNEL)
99 C2S(NL80211_CMD_SET_WDS_PEER)
100 C2S(NL80211_CMD_FRAME_WAIT_CANCEL)
101 C2S(NL80211_CMD_JOIN_MESH)
102 C2S(NL80211_CMD_LEAVE_MESH)
103 C2S(NL80211_CMD_UNPROT_DEAUTHENTICATE)
104 C2S(NL80211_CMD_UNPROT_DISASSOCIATE)
105 C2S(NL80211_CMD_NEW_PEER_CANDIDATE)
106 C2S(NL80211_CMD_GET_WOWLAN)
107 C2S(NL80211_CMD_SET_WOWLAN)
108 C2S(NL80211_CMD_START_SCHED_SCAN)
109 C2S(NL80211_CMD_STOP_SCHED_SCAN)
110 C2S(NL80211_CMD_SCHED_SCAN_RESULTS)
111 C2S(NL80211_CMD_SCHED_SCAN_STOPPED)
112 C2S(NL80211_CMD_SET_REKEY_OFFLOAD)
113 C2S(NL80211_CMD_PMKSA_CANDIDATE)
114 C2S(NL80211_CMD_TDLS_OPER)
115 C2S(NL80211_CMD_TDLS_MGMT)
116 C2S(NL80211_CMD_UNEXPECTED_FRAME)
117 C2S(NL80211_CMD_PROBE_CLIENT)
118 C2S(NL80211_CMD_REGISTER_BEACONS)
119 C2S(NL80211_CMD_UNEXPECTED_4ADDR_FRAME)
120 C2S(NL80211_CMD_SET_NOACK_MAP)
121 C2S(NL80211_CMD_CH_SWITCH_NOTIFY)
122 C2S(NL80211_CMD_START_P2P_DEVICE)
123 C2S(NL80211_CMD_STOP_P2P_DEVICE)
124 C2S(NL80211_CMD_CONN_FAILED)
125 C2S(NL80211_CMD_SET_MCAST_RATE)
126 C2S(NL80211_CMD_SET_MAC_ACL)
127 C2S(NL80211_CMD_RADAR_DETECT)
128 C2S(NL80211_CMD_GET_PROTOCOL_FEATURES)
129 C2S(NL80211_CMD_UPDATE_FT_IES)
130 C2S(NL80211_CMD_FT_EVENT)
131 C2S(NL80211_CMD_CRIT_PROTOCOL_START)
132 C2S(NL80211_CMD_CRIT_PROTOCOL_STOP)
133 C2S(NL80211_CMD_GET_COALESCE)
134 C2S(NL80211_CMD_SET_COALESCE)
135 C2S(NL80211_CMD_CHANNEL_SWITCH)
136 C2S(NL80211_CMD_VENDOR)
137 C2S(NL80211_CMD_SET_QOS_MAP)
138 C2S(NL80211_CMD_ADD_TX_TS)
139 C2S(NL80211_CMD_DEL_TX_TS)
140 C2S(NL80211_CMD_GET_MPP)
141 C2S(NL80211_CMD_JOIN_OCB)
142 C2S(NL80211_CMD_LEAVE_OCB)
143 C2S(NL80211_CMD_CH_SWITCH_STARTED_NOTIFY)
144 C2S(NL80211_CMD_TDLS_CHANNEL_SWITCH)
145 C2S(NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH)
146 C2S(NL80211_CMD_WIPHY_REG_CHANGE)
147 C2S(NL80211_CMD_ABORT_SCAN)
148 C2S(NL80211_CMD_START_NAN)
149 C2S(NL80211_CMD_STOP_NAN)
150 C2S(NL80211_CMD_ADD_NAN_FUNCTION)
151 C2S(NL80211_CMD_DEL_NAN_FUNCTION)
152 C2S(NL80211_CMD_CHANGE_NAN_CONFIG)
153 C2S(NL80211_CMD_NAN_MATCH)
154 C2S(NL80211_CMD_SET_MULTICAST_TO_UNICAST)
155 C2S(NL80211_CMD_UPDATE_CONNECT_PARAMS)
156 C2S(NL80211_CMD_SET_PMK)
157 C2S(NL80211_CMD_DEL_PMK)
158 C2S(NL80211_CMD_PORT_AUTHORIZED)
159 C2S(NL80211_CMD_RELOAD_REGDB)
160 C2S(NL80211_CMD_EXTERNAL_AUTH)
161 C2S(NL80211_CMD_STA_OPMODE_CHANGED)
162 C2S(NL80211_CMD_CONTROL_PORT_FRAME)
163 C2S(NL80211_CMD_GET_FTM_RESPONDER_STATS)
164 C2S(NL80211_CMD_PEER_MEASUREMENT_START)
165 C2S(NL80211_CMD_PEER_MEASUREMENT_RESULT)
166 C2S(NL80211_CMD_PEER_MEASUREMENT_COMPLETE)
167 C2S(NL80211_CMD_NOTIFY_RADAR)
168 C2S(NL80211_CMD_UPDATE_OWE_INFO)
169 C2S(NL80211_CMD_PROBE_MESH_LINK)
170 C2S(NL80211_CMD_SET_TID_CONFIG)
171 C2S(NL80211_CMD_UNPROT_BEACON)
172 C2S(NL80211_CMD_CONTROL_PORT_FRAME_TX_STATUS)
173 C2S(NL80211_CMD_SET_SAR_SPECS)
174 C2S(NL80211_CMD_OBSS_COLOR_COLLISION)
175 C2S(NL80211_CMD_COLOR_CHANGE_REQUEST)
176 C2S(NL80211_CMD_COLOR_CHANGE_STARTED)
177 C2S(NL80211_CMD_COLOR_CHANGE_ABORTED)
178 C2S(NL80211_CMD_COLOR_CHANGE_COMPLETED)
179 C2S(NL80211_CMD_SET_FILS_AAD)
180 C2S(NL80211_CMD_ASSOC_COMEBACK)
181 C2S(NL80211_CMD_ADD_LINK)
182 C2S(NL80211_CMD_REMOVE_LINK)
183 C2S(NL80211_CMD_ADD_LINK_STA)
184 C2S(NL80211_CMD_MODIFY_LINK_STA)
185 C2S(NL80211_CMD_REMOVE_LINK_STA)
186 C2S(NL80211_CMD_SET_HW_TIMESTAMP)
187 C2S(NL80211_CMD_LINKS_REMOVED)
188 C2S(NL80211_CMD_SET_TID_TO_LINK_MAPPING)
189 C2S(NL80211_CMD_ASSOC_MLO_RECONF)
190 C2S(NL80211_CMD_EPCS_CFG)
191 C2S(__NL80211_CMD_AFTER_LAST)
192 }
193 #undef C2S
194
195 return "NL80211_CMD_UNKNOWN";
196 }
197
198
mlme_event_auth(struct wpa_driver_nl80211_data * drv,const u8 * frame,size_t len)199 static void mlme_event_auth(struct wpa_driver_nl80211_data *drv,
200 const u8 *frame, size_t len)
201 {
202 const struct ieee80211_mgmt *mgmt;
203 union wpa_event_data event;
204
205 if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME) &&
206 drv->force_connect_cmd) {
207 /*
208 * Avoid reporting two association events that would confuse
209 * the core code.
210 */
211 wpa_printf(MSG_DEBUG,
212 "nl80211: Ignore auth event when using driver SME");
213 return;
214 }
215
216 wpa_printf(MSG_DEBUG, "nl80211: Authenticate event");
217 mgmt = (const struct ieee80211_mgmt *) frame;
218 if (len < 24 + sizeof(mgmt->u.auth)) {
219 wpa_printf(MSG_DEBUG, "nl80211: Too short association event "
220 "frame");
221 return;
222 }
223
224 os_memcpy(drv->auth_bssid, mgmt->sa, ETH_ALEN);
225 os_memset(drv->auth_attempt_bssid, 0, ETH_ALEN);
226 os_memset(&event, 0, sizeof(event));
227 os_memcpy(event.auth.peer, mgmt->sa, ETH_ALEN);
228 event.auth.auth_type = le_to_host16(mgmt->u.auth.auth_alg);
229 event.auth.auth_transaction =
230 le_to_host16(mgmt->u.auth.auth_transaction);
231 event.auth.status_code = le_to_host16(mgmt->u.auth.status_code);
232 if (len > 24 + sizeof(mgmt->u.auth)) {
233 event.auth.ies = mgmt->u.auth.variable;
234 event.auth.ies_len = len - 24 - sizeof(mgmt->u.auth);
235 }
236
237 wpa_supplicant_event(drv->ctx, EVENT_AUTH, &event);
238 }
239
240
nl80211_parse_wmm_params(struct nlattr * wmm_attr,struct wmm_params * wmm_params)241 static void nl80211_parse_wmm_params(struct nlattr *wmm_attr,
242 struct wmm_params *wmm_params)
243 {
244 struct nlattr *wmm_info[NL80211_STA_WME_MAX + 1];
245 static struct nla_policy wme_policy[NL80211_STA_WME_MAX + 1] = {
246 [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
247 };
248
249 if (!wmm_attr ||
250 nla_parse_nested(wmm_info, NL80211_STA_WME_MAX, wmm_attr,
251 wme_policy) ||
252 !wmm_info[NL80211_STA_WME_UAPSD_QUEUES])
253 return;
254
255 wmm_params->uapsd_queues =
256 nla_get_u8(wmm_info[NL80211_STA_WME_UAPSD_QUEUES]);
257 wmm_params->info_bitmap |= WMM_PARAMS_UAPSD_QUEUES_INFO;
258 }
259
260
mlme_event_assoc(struct wpa_driver_nl80211_data * drv,const u8 * frame,size_t len,struct nlattr * wmm,struct nlattr * req_ie)261 static void mlme_event_assoc(struct wpa_driver_nl80211_data *drv,
262 const u8 *frame, size_t len, struct nlattr *wmm,
263 struct nlattr *req_ie)
264 {
265 const struct ieee80211_mgmt *mgmt;
266 union wpa_event_data event;
267 u16 status;
268 int ssid_len;
269
270 if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME) &&
271 drv->force_connect_cmd) {
272 /*
273 * Avoid reporting two association events that would confuse
274 * the core code.
275 */
276 wpa_printf(MSG_DEBUG,
277 "nl80211: Ignore assoc event when using driver SME");
278 return;
279 }
280
281 wpa_printf(MSG_DEBUG, "nl80211: Associate event");
282 mgmt = (const struct ieee80211_mgmt *) frame;
283 if (len < 24 + sizeof(mgmt->u.assoc_resp)) {
284 wpa_printf(MSG_DEBUG, "nl80211: Too short association event "
285 "frame");
286 return;
287 }
288
289 status = le_to_host16(mgmt->u.assoc_resp.status_code);
290 if (status != WLAN_STATUS_SUCCESS) {
291 os_memset(&event, 0, sizeof(event));
292 event.assoc_reject.bssid = mgmt->bssid;
293 if (len > 24 + sizeof(mgmt->u.assoc_resp)) {
294 event.assoc_reject.resp_ies =
295 (u8 *) mgmt->u.assoc_resp.variable;
296 event.assoc_reject.resp_ies_len =
297 len - 24 - sizeof(mgmt->u.assoc_resp);
298 }
299 event.assoc_reject.status_code = status;
300
301 wpa_supplicant_event(drv->ctx, EVENT_ASSOC_REJECT, &event);
302 return;
303 }
304
305 drv->associated = 1;
306 os_memcpy(drv->bssid, mgmt->sa, ETH_ALEN);
307 os_memcpy(drv->prev_bssid, mgmt->sa, ETH_ALEN);
308
309 os_memset(&event, 0, sizeof(event));
310 event.assoc_info.resp_frame = frame;
311 event.assoc_info.resp_frame_len = len;
312 if (len > 24 + sizeof(mgmt->u.assoc_resp)) {
313 event.assoc_info.resp_ies = (u8 *) mgmt->u.assoc_resp.variable;
314 event.assoc_info.resp_ies_len =
315 len - 24 - sizeof(mgmt->u.assoc_resp);
316 }
317
318 if (req_ie) {
319 event.assoc_info.req_ies = nla_data(req_ie);
320 event.assoc_info.req_ies_len = nla_len(req_ie);
321 }
322
323 /* When this association was initiated outside of wpa_supplicant,
324 * drv->ssid needs to be set here to satisfy later checking. */
325 ssid_len = nl80211_get_assoc_ssid(drv, drv->ssid);
326 if (ssid_len > 0) {
327 drv->ssid_len = ssid_len;
328 wpa_printf(MSG_DEBUG,
329 "nl80211: Set drv->ssid based on scan res info to '%s'",
330 wpa_ssid_txt(drv->ssid, drv->ssid_len));
331 }
332
333 event.assoc_info.freq = drv->assoc_freq;
334 drv->first_bss->flink->freq = drv->assoc_freq;
335
336 nl80211_parse_wmm_params(wmm, &event.assoc_info.wmm_params);
337
338 wpa_supplicant_event(drv->ctx, EVENT_ASSOC, &event);
339 }
340
341
342 #ifdef CONFIG_DRIVER_NL80211_QCA
343
qca_drv_connect_fail_reason_code_handler(struct nl_msg * msg,void * arg)344 static int qca_drv_connect_fail_reason_code_handler(struct nl_msg *msg,
345 void *arg)
346 {
347 struct nlattr *tb[NL80211_ATTR_MAX + 1];
348 struct nlattr *tb_sta_info[QCA_WLAN_VENDOR_ATTR_GET_STA_INFO_MAX + 1];
349 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
350 u32 *reason_code = arg;
351
352 *reason_code = 0;
353 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
354 genlmsg_attrlen(gnlh, 0), NULL);
355
356 if (!tb[NL80211_ATTR_VENDOR_DATA]) {
357 wpa_printf(MSG_ERROR, "%s: Vendor data not found", __func__);
358 return NL_SKIP;
359 }
360
361 nla_parse(tb_sta_info, QCA_WLAN_VENDOR_ATTR_GET_STA_INFO_MAX,
362 nla_data(tb[NL80211_ATTR_VENDOR_DATA]),
363 nla_len(tb[NL80211_ATTR_VENDOR_DATA]), NULL);
364
365 if (!tb_sta_info[QCA_WLAN_VENDOR_ATTR_GET_STA_INFO_CONNECT_FAIL_REASON_CODE]) {
366 wpa_printf(MSG_INFO, "%s: Vendor attr not found", __func__);
367 return NL_SKIP;
368 }
369
370 *reason_code = nla_get_u32(tb_sta_info[QCA_WLAN_VENDOR_ATTR_GET_STA_INFO_CONNECT_FAIL_REASON_CODE]);
371
372 return NL_SKIP;
373 }
374
375
376 static enum qca_sta_connect_fail_reason_codes
drv_get_connect_fail_reason_code(struct wpa_driver_nl80211_data * drv)377 drv_get_connect_fail_reason_code(struct wpa_driver_nl80211_data *drv)
378 {
379 enum qca_sta_connect_fail_reason_codes reason_code;
380 struct nl_msg *msg;
381 int ret;
382
383 msg = nl80211_drv_msg(drv, 0, NL80211_CMD_VENDOR);
384 if (!msg || nla_put_u32(msg, NL80211_ATTR_VENDOR_ID, OUI_QCA) ||
385 nla_put_u32(msg, NL80211_ATTR_VENDOR_SUBCMD,
386 QCA_NL80211_VENDOR_SUBCMD_GET_STA_INFO)) {
387 nlmsg_free(msg);
388 return 0;
389 }
390
391 ret = send_and_recv_resp(drv, msg,
392 qca_drv_connect_fail_reason_code_handler,
393 &reason_code);
394 if (ret)
395 wpa_printf(MSG_DEBUG,
396 "nl80211: Get connect fail reason_code failed: ret=%d (%s)",
397 ret, strerror(-ret));
398
399 return reason_code;
400 }
401
402
403 static enum sta_connect_fail_reason_codes
convert_connect_fail_reason_codes(enum qca_sta_connect_fail_reason_codes reason_code)404 convert_connect_fail_reason_codes(enum qca_sta_connect_fail_reason_codes
405 reason_code)
406 {
407 switch (reason_code) {
408 case QCA_STA_CONNECT_FAIL_REASON_NO_BSS_FOUND:
409 return STA_CONNECT_FAIL_REASON_NO_BSS_FOUND;
410 case QCA_STA_CONNECT_FAIL_REASON_AUTH_TX_FAIL:
411 return STA_CONNECT_FAIL_REASON_AUTH_TX_FAIL;
412 case QCA_STA_CONNECT_FAIL_REASON_AUTH_NO_ACK_RECEIVED:
413 return STA_CONNECT_FAIL_REASON_AUTH_NO_ACK_RECEIVED;
414 case QCA_STA_CONNECT_FAIL_REASON_AUTH_NO_RESP_RECEIVED:
415 return STA_CONNECT_FAIL_REASON_AUTH_NO_RESP_RECEIVED;
416 case QCA_STA_CONNECT_FAIL_REASON_ASSOC_REQ_TX_FAIL:
417 return STA_CONNECT_FAIL_REASON_ASSOC_REQ_TX_FAIL;
418 case QCA_STA_CONNECT_FAIL_REASON_ASSOC_NO_ACK_RECEIVED:
419 return STA_CONNECT_FAIL_REASON_ASSOC_NO_ACK_RECEIVED;
420 case QCA_STA_CONNECT_FAIL_REASON_ASSOC_NO_RESP_RECEIVED:
421 return STA_CONNECT_FAIL_REASON_ASSOC_NO_RESP_RECEIVED;
422 default:
423 return STA_CONNECT_FAIL_REASON_UNSPECIFIED;
424 }
425 }
426
427
qca_nl80211_link_reconfig_event(struct wpa_driver_nl80211_data * drv,u8 * data,size_t len)428 static void qca_nl80211_link_reconfig_event(struct wpa_driver_nl80211_data *drv,
429 u8 *data, size_t len)
430 {
431 struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_LINK_RECONFIG_MAX + 1];
432 u16 removed_links;
433 u8 *ap_mld;
434 int i;
435
436 if (!data)
437 return;
438
439 if (nla_parse(tb, QCA_WLAN_VENDOR_ATTR_LINK_RECONFIG_MAX,
440 (struct nlattr *) data, len, NULL) ||
441 !tb[QCA_WLAN_VENDOR_ATTR_LINK_RECONFIG_AP_MLD_ADDR])
442 return;
443
444 ap_mld = nla_data(tb[QCA_WLAN_VENDOR_ATTR_LINK_RECONFIG_AP_MLD_ADDR]);
445 wpa_printf(MSG_DEBUG, "nl80211: AP MLD address " MACSTR
446 " received in link reconfig event", MAC2STR(ap_mld));
447 if (!drv->sta_mlo_info.valid_links ||
448 !ether_addr_equal(drv->sta_mlo_info.ap_mld_addr, ap_mld)) {
449 if (drv->pending_link_reconfig_data == data) {
450 wpa_printf(MSG_DEBUG,
451 "nl80211: Drop pending link reconfig event since AP MLD not matched even after new connect/roam event");
452 os_free(drv->pending_link_reconfig_data);
453 drv->pending_link_reconfig_data = NULL;
454 return;
455 }
456
457 wpa_printf(MSG_DEBUG,
458 "nl80211: Cache new link reconfig event till next connect/roam event");
459 if (drv->pending_link_reconfig_data) {
460 wpa_printf(MSG_DEBUG, "nl80211: Override old link reconfig event data");
461 os_free(drv->pending_link_reconfig_data);
462 }
463 drv->pending_link_reconfig_data = os_memdup(data, len);
464 if (!drv->pending_link_reconfig_data)
465 return;
466 drv->pending_link_reconfig_data_len = len;
467 return;
468 }
469
470 if (!tb[QCA_WLAN_VENDOR_ATTR_LINK_RECONFIG_REMOVED_LINKS])
471 return;
472 removed_links = nla_get_u16(
473 tb[QCA_WLAN_VENDOR_ATTR_LINK_RECONFIG_REMOVED_LINKS]);
474
475 drv->sta_mlo_info.valid_links &= ~removed_links;
476
477 /*
478 * Set default BSSID to the BSSID of the lowest link ID of remaining
479 * links when the link used for (re)association is removed.
480 */
481 if (removed_links & BIT(drv->sta_mlo_info.assoc_link_id)) {
482 for_each_link(drv->sta_mlo_info.valid_links, i) {
483 os_memcpy(drv->bssid, drv->sta_mlo_info.links[i].bssid,
484 ETH_ALEN);
485 drv->sta_mlo_info.assoc_link_id = i;
486 break;
487 }
488 }
489
490 wpa_printf(MSG_DEBUG, "nl80211: Removed MLO links bitmap: 0x%x",
491 removed_links);
492
493 wpa_supplicant_event(drv->ctx, EVENT_LINK_RECONFIG, NULL);
494 }
495
496
497 static void
nl80211_parse_qca_vendor_mlo_link_info(struct driver_sta_mlo_info * mlo,struct nlattr * mlo_links)498 nl80211_parse_qca_vendor_mlo_link_info(struct driver_sta_mlo_info *mlo,
499 struct nlattr *mlo_links)
500 {
501 struct nlattr *link;
502 int rem_links;
503
504 nla_for_each_nested(link, mlo_links, rem_links) {
505 struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_MLO_LINK_MAX + 1];
506 int link_id;
507
508 nla_parse(tb,QCA_WLAN_VENDOR_ATTR_MLO_LINK_MAX, nla_data(link),
509 nla_len(link), NULL);
510
511 if (!tb[QCA_WLAN_VENDOR_ATTR_MLO_LINK_ID] ||
512 !tb[QCA_WLAN_VENDOR_ATTR_MLO_LINK_MAC_ADDR] ||
513 !tb[QCA_WLAN_VENDOR_ATTR_MLO_LINK_BSSID])
514 continue;
515
516 link_id = nla_get_u8(tb[QCA_WLAN_VENDOR_ATTR_MLO_LINK_ID]);
517 if (link_id >= MAX_NUM_MLD_LINKS)
518 continue;
519
520 mlo->valid_links |= BIT(link_id);
521 os_memcpy(mlo->links[link_id].addr,
522 nla_data(tb[QCA_WLAN_VENDOR_ATTR_MLO_LINK_MAC_ADDR]),
523 ETH_ALEN);
524 os_memcpy(mlo->links[link_id].bssid,
525 nla_data(tb[QCA_WLAN_VENDOR_ATTR_MLO_LINK_BSSID]),
526 ETH_ALEN);
527 wpa_printf(MSG_DEBUG, "nl80211: MLO link[%u] addr " MACSTR
528 " bssid " MACSTR,
529 link_id, MAC2STR(mlo->links[link_id].addr),
530 MAC2STR(mlo->links[link_id].bssid));
531 }
532 }
533
534 #endif /* CONFIG_DRIVER_NL80211_QCA */
535
536
nl80211_parse_mlo_link_info(struct driver_sta_mlo_info * mlo,struct nlattr * mlo_links)537 static void nl80211_parse_mlo_link_info(struct driver_sta_mlo_info *mlo,
538 struct nlattr *mlo_links)
539 {
540 struct nlattr *link;
541 int rem_links;
542
543 nla_for_each_nested(link, mlo_links, rem_links) {
544 struct nlattr *tb[NL80211_ATTR_MAX + 1];
545 int link_id;
546
547 nla_parse(tb, NL80211_ATTR_MAX, nla_data(link), nla_len(link),
548 NULL);
549
550 if (!tb[NL80211_ATTR_MLO_LINK_ID] || !tb[NL80211_ATTR_MAC] ||
551 !tb[NL80211_ATTR_BSSID])
552 continue;
553
554 link_id = nla_get_u8(tb[NL80211_ATTR_MLO_LINK_ID]);
555 if (link_id >= MAX_NUM_MLD_LINKS)
556 continue;
557
558 if (tb[NL80211_ATTR_STATUS_CODE]) {
559 /* Set requested links only when status indicated */
560 mlo->req_links |= BIT(link_id);
561 if (nla_get_u16(tb[NL80211_ATTR_STATUS_CODE]) ==
562 WLAN_STATUS_SUCCESS)
563 mlo->valid_links |= BIT(link_id);
564 } else {
565 mlo->valid_links |= BIT(link_id);
566 }
567
568 os_memcpy(mlo->links[link_id].addr,
569 nla_data(tb[NL80211_ATTR_MAC]), ETH_ALEN);
570 os_memcpy(mlo->links[link_id].bssid,
571 nla_data(tb[NL80211_ATTR_BSSID]), ETH_ALEN);
572 wpa_printf(MSG_DEBUG, "nl80211: MLO link[%u] addr " MACSTR
573 " bssid " MACSTR,
574 link_id, MAC2STR(mlo->links[link_id].addr),
575 MAC2STR(mlo->links[link_id].bssid));
576 }
577 }
578
579
580 struct links_info {
581 /* bitmap of link IDs in Per-STA profile subelements */
582 u16 non_assoc_links;
583 u8 addr[MAX_NUM_MLD_LINKS][ETH_ALEN];
584 };
585
586
nl80211_get_basic_mle_links_info(const u8 * mle,size_t mle_len,struct links_info * info)587 static void nl80211_get_basic_mle_links_info(const u8 *mle, size_t mle_len,
588 struct links_info *info)
589 {
590 size_t rem_len;
591 const u8 *pos;
592
593 if (mle_len < MULTI_LINK_CONTROL_LEN + 1 ||
594 mle_len - MULTI_LINK_CONTROL_LEN < mle[MULTI_LINK_CONTROL_LEN])
595 return;
596
597 /* Skip Common Info */
598 pos = mle + MULTI_LINK_CONTROL_LEN + mle[MULTI_LINK_CONTROL_LEN];
599 rem_len = mle_len -
600 (MULTI_LINK_CONTROL_LEN + mle[MULTI_LINK_CONTROL_LEN]);
601
602 /* Parse Subelements */
603 while (rem_len > 2) {
604 size_t ie_len = 2 + pos[1];
605
606 if (rem_len < ie_len)
607 break;
608
609 if (pos[0] == MULTI_LINK_SUB_ELEM_ID_PER_STA_PROFILE) {
610 u8 link_id;
611 const u8 *sta_profile;
612 u16 sta_ctrl;
613
614 if (pos[1] < BASIC_MLE_STA_PROF_STA_MAC_IDX + ETH_ALEN)
615 goto next_subelem;
616
617 sta_profile = &pos[2];
618 sta_ctrl = WPA_GET_LE16(sta_profile);
619 link_id = sta_ctrl & BASIC_MLE_STA_CTRL_LINK_ID_MASK;
620 if (link_id >= MAX_NUM_MLD_LINKS)
621 goto next_subelem;
622
623 if (!(sta_ctrl & BASIC_MLE_STA_CTRL_PRES_STA_MAC))
624 goto next_subelem;
625
626 info->non_assoc_links |= BIT(link_id);
627 os_memcpy(info->addr[link_id],
628 &sta_profile[BASIC_MLE_STA_PROF_STA_MAC_IDX],
629 ETH_ALEN);
630 }
631 next_subelem:
632 pos += ie_len;
633 rem_len -= ie_len;
634 }
635 }
636
637
nl80211_update_rejected_links_info(struct driver_sta_mlo_info * mlo,struct nlattr * req_ie,struct nlattr * resp_ie)638 static int nl80211_update_rejected_links_info(struct driver_sta_mlo_info *mlo,
639 struct nlattr *req_ie,
640 struct nlattr *resp_ie)
641 {
642 int i;
643 struct wpabuf *mle;
644 struct ieee802_11_elems req_elems, resp_elems;
645 struct links_info req_info, resp_info;
646
647 if (!req_ie || !resp_ie) {
648 wpa_printf(MSG_INFO,
649 "nl80211: MLO: (Re)Association Request/Response frame elements not available");
650 return -1;
651 }
652
653 if (ieee802_11_parse_elems(nla_data(req_ie), nla_len(req_ie),
654 &req_elems, 0) == ParseFailed ||
655 ieee802_11_parse_elems(nla_data(resp_ie), nla_len(resp_ie),
656 &resp_elems, 0) == ParseFailed) {
657 wpa_printf(MSG_INFO,
658 "nl80211: MLO: Failed to parse (Re)Association Request/Response elements");
659 return -1;
660 }
661
662 mle = ieee802_11_defrag(req_elems.basic_mle, req_elems.basic_mle_len,
663 true);
664 if (!mle) {
665 wpa_printf(MSG_INFO,
666 "nl80211: MLO: Basic Multi-Link element not found in Association Request");
667 return -1;
668 }
669 os_memset(&req_info, 0, sizeof(req_info));
670 nl80211_get_basic_mle_links_info(wpabuf_head(mle), wpabuf_len(mle),
671 &req_info);
672 wpabuf_free(mle);
673
674 mle = ieee802_11_defrag(resp_elems.basic_mle, resp_elems.basic_mle_len,
675 true);
676 if (!mle) {
677 wpa_printf(MSG_ERROR,
678 "nl80211: MLO: Basic Multi-Link element not found in Association Response");
679 return -1;
680 }
681 os_memset(&resp_info, 0, sizeof(resp_info));
682 nl80211_get_basic_mle_links_info(wpabuf_head(mle), wpabuf_len(mle),
683 &resp_info);
684 wpabuf_free(mle);
685
686 if (req_info.non_assoc_links != resp_info.non_assoc_links) {
687 wpa_printf(MSG_ERROR,
688 "nl80211: MLO: Association Request and Response links bitmaps not equal (0x%x != 0x%x)",
689 req_info.non_assoc_links,
690 resp_info.non_assoc_links);
691 return -1;
692 }
693
694 mlo->req_links = BIT(mlo->assoc_link_id) | req_info.non_assoc_links;
695 if ((mlo->req_links & mlo->valid_links) != mlo->valid_links) {
696 wpa_printf(MSG_ERROR,
697 "nl80211: MLO: Accepted links are not a subset of requested links (req_links=0x%x valid_links=0x%x non_assoc_links=0x%x assoc_link_id=0x%x)",
698 mlo->req_links, mlo->valid_links,
699 req_info.non_assoc_links, BIT(mlo->assoc_link_id));
700 return -1;
701 }
702
703 /* Get MLO links info for rejected links */
704 for_each_link((mlo->req_links & ~mlo->valid_links), i) {
705 os_memcpy(mlo->links[i].bssid, resp_info.addr[i], ETH_ALEN);
706 os_memcpy(mlo->links[i].addr, req_info.addr[i], ETH_ALEN);
707 }
708
709 return 0;
710 }
711
712
nl80211_get_assoc_link_id(const u8 * data,u8 len)713 static int nl80211_get_assoc_link_id(const u8 *data, u8 len)
714 {
715 u16 control;
716
717 if (len < 2)
718 return -1;
719
720 control = WPA_GET_LE16(data);
721 if (!(control & BASIC_MULTI_LINK_CTRL_PRES_LINK_ID))
722 return -1;
723
724 #define BASIC_ML_IE_COMMON_INFO_LINK_ID_IDX \
725 (2 + /* Multi-Link Control field */ \
726 1 + /* Common Info Length field (Basic) */ \
727 ETH_ALEN) /* MLD MAC Address field (Basic) */
728 if (len <= BASIC_ML_IE_COMMON_INFO_LINK_ID_IDX)
729 return -1;
730
731 return data[BASIC_ML_IE_COMMON_INFO_LINK_ID_IDX] & 0x0F;
732 }
733
734
nl80211_parse_mlo_info(struct wpa_driver_nl80211_data * drv,bool qca_roam_auth,struct nlattr * addr,struct nlattr * mlo_links,struct nlattr * req_ie,struct nlattr * resp_ie)735 static void nl80211_parse_mlo_info(struct wpa_driver_nl80211_data *drv,
736 bool qca_roam_auth,
737 struct nlattr *addr,
738 struct nlattr *mlo_links,
739 struct nlattr *req_ie,
740 struct nlattr *resp_ie)
741 {
742 const u8 *ml_ie;
743 struct driver_sta_mlo_info *mlo = &drv->sta_mlo_info;
744 int res;
745
746 if (!addr || !mlo_links || !resp_ie)
747 return;
748
749 ml_ie = get_ml_ie(nla_data(resp_ie), nla_len(resp_ie),
750 MULTI_LINK_CONTROL_TYPE_BASIC);
751 if (!ml_ie)
752 return;
753
754 res = nl80211_get_assoc_link_id(&ml_ie[3], ml_ie[1] - 1);
755 if (res < 0 || res >= MAX_NUM_MLD_LINKS) {
756 wpa_printf(MSG_DEBUG,
757 "nl80211: Could not find a valid association Link ID (res=%d)",
758 res);
759 return;
760 }
761 drv->sta_mlo_info.assoc_link_id = res;
762
763 os_memcpy(mlo->ap_mld_addr, nla_data(addr), ETH_ALEN);
764 wpa_printf(MSG_DEBUG, "nl80211: AP MLD MAC Address " MACSTR,
765 MAC2STR(mlo->ap_mld_addr));
766
767 if (!qca_roam_auth)
768 nl80211_parse_mlo_link_info(mlo, mlo_links);
769 #ifdef CONFIG_DRIVER_NL80211_QCA
770 if (qca_roam_auth)
771 nl80211_parse_qca_vendor_mlo_link_info(mlo, mlo_links);
772 #endif /* CONFIG_DRIVER_NL80211_QCA */
773
774 if (!(mlo->valid_links & BIT(mlo->assoc_link_id)) ||
775 (!mlo->req_links &&
776 nl80211_update_rejected_links_info(mlo, req_ie, resp_ie))) {
777 wpa_printf(MSG_INFO, "nl80211: Invalid MLO connection info");
778 mlo->valid_links = 0;
779 return;
780 }
781
782 os_memcpy(drv->bssid, mlo->links[drv->sta_mlo_info.assoc_link_id].bssid,
783 ETH_ALEN);
784 os_memcpy(drv->prev_bssid, drv->bssid, ETH_ALEN);
785 }
786
787
788 #ifdef CONFIG_DRIVER_NL80211_QCA
789 static void
qca_nl80211_tid_to_link_map_event(struct wpa_driver_nl80211_data * drv,u8 * data,size_t len)790 qca_nl80211_tid_to_link_map_event(struct wpa_driver_nl80211_data *drv,
791 u8 *data, size_t len)
792 {
793 struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_TID_TO_LINK_MAP_MAX + 1];
794 struct nlattr *tids;
795 union wpa_event_data event;
796 u8 *ap_mld;
797 int i, rem, tidnum = 0;
798
799 os_memset(&event, 0, sizeof(event));
800
801 if (nla_parse(tb, QCA_WLAN_VENDOR_ATTR_TID_TO_LINK_MAP_MAX,
802 (struct nlattr *) data, len, NULL) ||
803 !tb[QCA_WLAN_VENDOR_ATTR_TID_TO_LINK_MAP_AP_MLD_ADDR])
804 return;
805
806 ap_mld = nla_data(tb[QCA_WLAN_VENDOR_ATTR_TID_TO_LINK_MAP_AP_MLD_ADDR]);
807
808 wpa_printf(MSG_DEBUG, "nl80211: AP MLD address " MACSTR
809 " received in TID to link mapping event", MAC2STR(ap_mld));
810 if (!drv->sta_mlo_info.valid_links ||
811 !ether_addr_equal(drv->sta_mlo_info.ap_mld_addr, ap_mld)) {
812 if (drv->pending_t2lm_data == data) {
813 wpa_printf(MSG_DEBUG,
814 "nl80211: Drop pending TID-to-link mapping event since AP MLD not matched even after new connect/roam event");
815 os_free(drv->pending_t2lm_data);
816 drv->pending_t2lm_data = NULL;
817 return;
818 }
819 wpa_printf(MSG_DEBUG,
820 "nl80211: Cache new TID-to-link map event until the next connect/roam event");
821 if (drv->pending_t2lm_data) {
822 wpa_printf(MSG_DEBUG,
823 "nl80211: Override old TID-to-link map event data");
824 os_free(drv->pending_t2lm_data);
825 }
826 drv->pending_t2lm_data = os_memdup(data, len);
827 if (!drv->pending_t2lm_data)
828 return;
829 drv->pending_t2lm_data_len = len;
830 return;
831 }
832
833 if (!tb[QCA_WLAN_VENDOR_ATTR_TID_TO_LINK_MAP_STATUS]) {
834 wpa_printf(MSG_DEBUG, "nl80211: Default TID-to-link map");
835 event.t2l_map_info.default_map = true;
836 goto out;
837 }
838
839 event.t2l_map_info.default_map = false;
840
841 nla_for_each_nested(tids,
842 tb[QCA_WLAN_VENDOR_ATTR_TID_TO_LINK_MAP_STATUS],
843 rem) {
844 u16 uplink, downlink;
845 struct nlattr *tid[QCA_WLAN_VENDOR_ATTR_LINK_TID_MAP_STATUS_MAX + 1];
846
847 if (nla_parse_nested(
848 tid, QCA_WLAN_VENDOR_ATTR_LINK_TID_MAP_STATUS_MAX,
849 tids, NULL)) {
850 wpa_printf(MSG_DEBUG,
851 "nl80211: TID-to-link: nla_parse_nested() failed");
852 return;
853 }
854
855 if (!tid[QCA_WLAN_VENDOR_ATTR_LINK_TID_MAP_STATUS_UPLINK]) {
856 wpa_printf(MSG_DEBUG,
857 "nl80211: TID-to-link: uplink not present for tid: %d",
858 tidnum);
859 return;
860 }
861 uplink = nla_get_u16(tid[QCA_WLAN_VENDOR_ATTR_LINK_TID_MAP_STATUS_UPLINK]);
862
863 if (!tid[QCA_WLAN_VENDOR_ATTR_LINK_TID_MAP_STATUS_DOWNLINK]) {
864 wpa_printf(MSG_DEBUG,
865 "nl80211: TID-to-link: downlink not present for tid: %d",
866 tidnum);
867 return;
868 }
869 downlink = nla_get_u16(tid[QCA_WLAN_VENDOR_ATTR_LINK_TID_MAP_STATUS_DOWNLINK]);
870
871 wpa_printf(MSG_DEBUG,
872 "nl80211: TID-to-link: Received uplink %x downlink %x",
873 uplink, downlink);
874 for_each_link(drv->sta_mlo_info.valid_links, i) {
875 if (uplink & BIT(i))
876 event.t2l_map_info.t2lmap[i].uplink |=
877 BIT(tidnum);
878 if (downlink & BIT(i))
879 event.t2l_map_info.t2lmap[i].downlink |=
880 BIT(tidnum);
881 }
882
883 tidnum++;
884 }
885
886 out:
887 drv->sta_mlo_info.default_map = event.t2l_map_info.default_map;
888
889 event.t2l_map_info.valid_links = drv->sta_mlo_info.valid_links;
890 for (i = 0; i < MAX_NUM_MLD_LINKS && !drv->sta_mlo_info.default_map;
891 i++) {
892 if (!(drv->sta_mlo_info.valid_links & BIT(i)))
893 continue;
894
895 drv->sta_mlo_info.links[i].t2lmap.uplink =
896 event.t2l_map_info.t2lmap[i].uplink;
897 drv->sta_mlo_info.links[i].t2lmap.downlink =
898 event.t2l_map_info.t2lmap[i].downlink;
899 }
900
901 wpa_supplicant_event(drv->ctx, EVENT_TID_LINK_MAP, &event);
902 }
903 #endif /* CONFIG_DRIVER_NL80211_QCA */
904
905
mlme_event_connect(struct wpa_driver_nl80211_data * drv,enum nl80211_commands cmd,bool qca_roam_auth,struct nlattr * status,struct nlattr * addr,struct nlattr * req_ie,struct nlattr * resp_ie,struct nlattr * timed_out,struct nlattr * timeout_reason,struct nlattr * authorized,struct nlattr * key_replay_ctr,struct nlattr * ptk_kck,struct nlattr * ptk_kek,struct nlattr * subnet_status,struct nlattr * fils_erp_next_seq_num,struct nlattr * fils_pmk,struct nlattr * fils_pmkid,struct nlattr * mlo_links)906 static void mlme_event_connect(struct wpa_driver_nl80211_data *drv,
907 enum nl80211_commands cmd, bool qca_roam_auth,
908 struct nlattr *status,
909 struct nlattr *addr, struct nlattr *req_ie,
910 struct nlattr *resp_ie,
911 struct nlattr *timed_out,
912 struct nlattr *timeout_reason,
913 struct nlattr *authorized,
914 struct nlattr *key_replay_ctr,
915 struct nlattr *ptk_kck,
916 struct nlattr *ptk_kek,
917 struct nlattr *subnet_status,
918 struct nlattr *fils_erp_next_seq_num,
919 struct nlattr *fils_pmk,
920 struct nlattr *fils_pmkid,
921 struct nlattr *mlo_links)
922 {
923 union wpa_event_data event;
924 const u8 *ssid = NULL;
925 u16 status_code;
926 int ssid_len;
927
928 if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) {
929 /*
930 * Avoid reporting two association events that would confuse
931 * the core code.
932 */
933 wpa_printf(MSG_DEBUG, "nl80211: Ignore connect event (cmd=%d) "
934 "when using userspace SME", cmd);
935 return;
936 }
937
938 drv->connect_reassoc = 0;
939
940 status_code = status ? nla_get_u16(status) : WLAN_STATUS_SUCCESS;
941
942 if (cmd == NL80211_CMD_CONNECT) {
943 wpa_printf(MSG_DEBUG,
944 "nl80211: Connect event (status=%u ignore_next_local_disconnect=%d)",
945 status_code, drv->ignore_next_local_disconnect);
946 } else if (cmd == NL80211_CMD_ROAM) {
947 wpa_printf(MSG_DEBUG, "nl80211: Roam event");
948 }
949
950 os_memset(&event, 0, sizeof(event));
951 if (cmd == NL80211_CMD_CONNECT && status_code != WLAN_STATUS_SUCCESS) {
952 if (addr)
953 event.assoc_reject.bssid = nla_data(addr);
954 if (drv->ignore_next_local_disconnect) {
955 drv->ignore_next_local_disconnect = 0;
956 if (!event.assoc_reject.bssid ||
957 !ether_addr_equal(event.assoc_reject.bssid,
958 drv->auth_attempt_bssid)) {
959 /*
960 * Ignore the event that came without a BSSID or
961 * for the old connection since this is likely
962 * not relevant to the new Connect command.
963 */
964 wpa_printf(MSG_DEBUG,
965 "nl80211: Ignore connection failure event triggered during reassociation");
966 return;
967 }
968 }
969 if (resp_ie) {
970 event.assoc_reject.resp_ies = nla_data(resp_ie);
971 event.assoc_reject.resp_ies_len = nla_len(resp_ie);
972 }
973 event.assoc_reject.status_code = status_code;
974 event.assoc_reject.timed_out = timed_out != NULL;
975 if (timed_out && timeout_reason) {
976 enum nl80211_timeout_reason reason;
977
978 reason = nla_get_u32(timeout_reason);
979 switch (reason) {
980 case NL80211_TIMEOUT_SCAN:
981 event.assoc_reject.timeout_reason = "scan";
982 break;
983 case NL80211_TIMEOUT_AUTH:
984 event.assoc_reject.timeout_reason = "auth";
985 break;
986 case NL80211_TIMEOUT_ASSOC:
987 event.assoc_reject.timeout_reason = "assoc";
988 break;
989 default:
990 break;
991 }
992 }
993 if (fils_erp_next_seq_num)
994 event.assoc_reject.fils_erp_next_seq_num =
995 nla_get_u16(fils_erp_next_seq_num);
996
997 #ifdef CONFIG_DRIVER_NL80211_QCA
998 if (drv->get_sta_info_vendor_cmd_avail) {
999 enum qca_sta_connect_fail_reason_codes reason_code;
1000
1001 reason_code = drv_get_connect_fail_reason_code(drv);
1002 event.assoc_reject.reason_code =
1003 convert_connect_fail_reason_codes(reason_code);
1004 }
1005 #endif /* CONFIG_DRIVER_NL80211_QCA */
1006
1007 wpa_supplicant_event(drv->ctx, EVENT_ASSOC_REJECT, &event);
1008 return;
1009 }
1010
1011 drv->associated = 1;
1012 os_memset(&drv->sta_mlo_info, 0, sizeof(drv->sta_mlo_info));
1013 nl80211_parse_mlo_info(drv, qca_roam_auth, addr, mlo_links, req_ie,
1014 resp_ie);
1015 if (!drv->sta_mlo_info.valid_links && addr) {
1016 os_memcpy(drv->bssid, nla_data(addr), ETH_ALEN);
1017 os_memcpy(drv->prev_bssid, drv->bssid, ETH_ALEN);
1018 }
1019
1020 if (req_ie) {
1021 event.assoc_info.req_ies = nla_data(req_ie);
1022 event.assoc_info.req_ies_len = nla_len(req_ie);
1023
1024 if (cmd == NL80211_CMD_ROAM) {
1025 ssid = get_ie(event.assoc_info.req_ies,
1026 event.assoc_info.req_ies_len,
1027 WLAN_EID_SSID);
1028 if (ssid && ssid[1] > 0 && ssid[1] <= 32) {
1029 drv->ssid_len = ssid[1];
1030 os_memcpy(drv->ssid, ssid + 2, ssid[1]);
1031 wpa_printf(MSG_DEBUG,
1032 "nl80211: Set drv->ssid based on req_ie to '%s'",
1033 wpa_ssid_txt(drv->ssid,
1034 drv->ssid_len));
1035 }
1036 }
1037 }
1038 if (resp_ie) {
1039 event.assoc_info.resp_ies = nla_data(resp_ie);
1040 event.assoc_info.resp_ies_len = nla_len(resp_ie);
1041 }
1042
1043 event.assoc_info.freq = nl80211_get_assoc_freq(drv);
1044 drv->first_bss->flink->freq = drv->assoc_freq;
1045
1046 if ((!ssid || ssid[1] == 0 || ssid[1] > 32) &&
1047 (ssid_len = nl80211_get_assoc_ssid(drv, drv->ssid)) > 0) {
1048 /* When this connection was initiated outside of wpa_supplicant,
1049 * drv->ssid needs to be set here to satisfy later checking. */
1050 drv->ssid_len = ssid_len;
1051 wpa_printf(MSG_DEBUG,
1052 "nl80211: Set drv->ssid based on scan res info to '%s'",
1053 wpa_ssid_txt(drv->ssid, drv->ssid_len));
1054 }
1055
1056 if (authorized && nla_get_u8(authorized)) {
1057 event.assoc_info.authorized = 1;
1058 wpa_printf(MSG_DEBUG, "nl80211: connection authorized");
1059 }
1060 if (key_replay_ctr) {
1061 event.assoc_info.key_replay_ctr = nla_data(key_replay_ctr);
1062 event.assoc_info.key_replay_ctr_len = nla_len(key_replay_ctr);
1063 }
1064 if (ptk_kck) {
1065 event.assoc_info.ptk_kck = nla_data(ptk_kck);
1066 event.assoc_info.ptk_kck_len = nla_len(ptk_kck);
1067 }
1068 if (ptk_kek) {
1069 event.assoc_info.ptk_kek = nla_data(ptk_kek);
1070 event.assoc_info.ptk_kek_len = nla_len(ptk_kek);
1071 }
1072
1073 if (subnet_status) {
1074 /*
1075 * At least for now, this is only available from
1076 * QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_SUBNET_STATUS and that
1077 * attribute has the same values 0, 1, 2 as are used in the
1078 * variable here, so no mapping between different values are
1079 * needed.
1080 */
1081 event.assoc_info.subnet_status = nla_get_u8(subnet_status);
1082 }
1083
1084 if (fils_erp_next_seq_num)
1085 event.assoc_info.fils_erp_next_seq_num =
1086 nla_get_u16(fils_erp_next_seq_num);
1087
1088 if (fils_pmk) {
1089 event.assoc_info.fils_pmk = nla_data(fils_pmk);
1090 event.assoc_info.fils_pmk_len = nla_len(fils_pmk);
1091 }
1092
1093 if (fils_pmkid)
1094 event.assoc_info.fils_pmkid = nla_data(fils_pmkid);
1095
1096 wpa_supplicant_event(drv->ctx, EVENT_ASSOC, &event);
1097
1098 /* Avoid a race condition by stopping to ignore any following
1099 * disconnection events now that the driver has indicated it is
1100 * connected since that connection could have been triggered by a roam
1101 * operation that happened in parallel with the disconnection request.
1102 */
1103 drv->ignore_next_local_disconnect = 0;
1104 drv->sta_mlo_info.default_map = true;
1105
1106 #ifdef CONFIG_DRIVER_NL80211_QCA
1107 if (drv->pending_t2lm_data)
1108 qca_nl80211_tid_to_link_map_event(drv, drv->pending_t2lm_data,
1109 drv->pending_t2lm_data_len);
1110 else
1111 drv->sta_mlo_info.default_map = true;
1112
1113 if (drv->pending_link_reconfig_data)
1114 qca_nl80211_link_reconfig_event(
1115 drv, drv->pending_link_reconfig_data,
1116 drv->pending_link_reconfig_data_len);
1117 #endif /* CONFIG_DRIVER_NL80211_QCA */
1118 }
1119
1120
mlme_event_disconnect(struct wpa_driver_nl80211_data * drv,struct nlattr * reason,struct nlattr * addr,struct nlattr * by_ap)1121 static void mlme_event_disconnect(struct wpa_driver_nl80211_data *drv,
1122 struct nlattr *reason, struct nlattr *addr,
1123 struct nlattr *by_ap)
1124 {
1125 union wpa_event_data data;
1126 unsigned int locally_generated = by_ap == NULL;
1127
1128 if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) {
1129 /*
1130 * Avoid reporting two disassociation events that could
1131 * confuse the core code.
1132 */
1133 wpa_printf(MSG_DEBUG, "nl80211: Ignore disconnect "
1134 "event when using userspace SME");
1135 return;
1136 }
1137
1138 if (drv->ignore_next_local_disconnect) {
1139 drv->ignore_next_local_disconnect = 0;
1140 if (locally_generated) {
1141 wpa_printf(MSG_DEBUG, "nl80211: Ignore disconnect "
1142 "event triggered during reassociation");
1143 return;
1144 }
1145 wpa_printf(MSG_WARNING, "nl80211: Was expecting local "
1146 "disconnect but got another disconnect "
1147 "event first");
1148 }
1149
1150 wpa_printf(MSG_DEBUG, "nl80211: Disconnect event");
1151 nl80211_mark_disconnected(drv);
1152 os_memset(&data, 0, sizeof(data));
1153 if (reason)
1154 data.deauth_info.reason_code = nla_get_u16(reason);
1155 data.deauth_info.locally_generated = by_ap == NULL;
1156 wpa_supplicant_event(drv->ctx, EVENT_DEAUTH, &data);
1157 }
1158
1159
calculate_chan_offset(int width,int freq,int cf1,int cf2)1160 static int calculate_chan_offset(int width, int freq, int cf1, int cf2)
1161 {
1162 int freq1 = 0;
1163
1164 switch (convert2width(width)) {
1165 case CHAN_WIDTH_20_NOHT:
1166 case CHAN_WIDTH_20:
1167 return 0;
1168 case CHAN_WIDTH_40:
1169 freq1 = cf1 - 10;
1170 break;
1171 case CHAN_WIDTH_80:
1172 freq1 = cf1 - 30;
1173 break;
1174 case CHAN_WIDTH_160:
1175 freq1 = cf1 - 70;
1176 break;
1177 case CHAN_WIDTH_80P80:
1178 freq1 = cf1 - 30;
1179 break;
1180 case CHAN_WIDTH_320:
1181 freq1 = cf1 - 150;
1182 break;
1183 case CHAN_WIDTH_UNKNOWN:
1184 case CHAN_WIDTH_2160:
1185 case CHAN_WIDTH_4320:
1186 case CHAN_WIDTH_6480:
1187 case CHAN_WIDTH_8640:
1188 /* FIXME: implement this */
1189 return 0;
1190 }
1191
1192 return (abs(freq - freq1) / 20) % 2 == 0 ? 1 : -1;
1193 }
1194
1195
mlme_event_ch_switch(struct wpa_driver_nl80211_data * drv,struct nlattr * ifindex,struct nlattr * link,struct nlattr * freq,struct nlattr * type,struct nlattr * bw,struct nlattr * cf1,struct nlattr * cf2,struct nlattr * punct_bitmap,int finished)1196 static void mlme_event_ch_switch(struct wpa_driver_nl80211_data *drv,
1197 struct nlattr *ifindex, struct nlattr *link,
1198 struct nlattr *freq, struct nlattr *type,
1199 struct nlattr *bw, struct nlattr *cf1,
1200 struct nlattr *cf2,
1201 struct nlattr *punct_bitmap,
1202 int finished)
1203 {
1204 struct i802_bss *bss;
1205 union wpa_event_data data;
1206 int ht_enabled = 1;
1207 int chan_offset = 0;
1208 int ifidx;
1209
1210 if (!freq)
1211 return;
1212
1213 ifidx = nla_get_u32(ifindex);
1214 bss = get_bss_ifindex(drv, ifidx);
1215 if (bss == NULL) {
1216 wpa_printf(MSG_WARNING, "nl80211: Unknown ifindex (%d) for channel switch, ignoring",
1217 ifidx);
1218 return;
1219 }
1220
1221 wpa_printf(MSG_DEBUG, "nl80211: Channel switch%s event for %s",
1222 finished ? "" : " started", bss->ifname);
1223
1224 if (type) {
1225 enum nl80211_channel_type ch_type = nla_get_u32(type);
1226
1227 wpa_printf(MSG_DEBUG, "nl80211: Channel type: %d", ch_type);
1228 switch (ch_type) {
1229 case NL80211_CHAN_NO_HT:
1230 ht_enabled = 0;
1231 break;
1232 case NL80211_CHAN_HT20:
1233 break;
1234 case NL80211_CHAN_HT40PLUS:
1235 chan_offset = 1;
1236 break;
1237 case NL80211_CHAN_HT40MINUS:
1238 chan_offset = -1;
1239 break;
1240 }
1241 } else if (bw && cf1) {
1242 /* This can happen for example with VHT80 ch switch */
1243 chan_offset = calculate_chan_offset(nla_get_u32(bw),
1244 nla_get_u32(freq),
1245 nla_get_u32(cf1),
1246 cf2 ? nla_get_u32(cf2) : 0);
1247 wpa_printf(MSG_DEBUG, "nl80211: Calculated channel offset: %d",
1248 chan_offset);
1249 } else {
1250 wpa_printf(MSG_WARNING, "nl80211: Unknown secondary channel information - following channel definition calculations may fail");
1251 }
1252
1253 os_memset(&data, 0, sizeof(data));
1254 data.ch_switch.freq = nla_get_u32(freq);
1255 if (is_6ghz_freq(data.ch_switch.freq))
1256 ht_enabled = 0;
1257 data.ch_switch.ht_enabled = ht_enabled;
1258 data.ch_switch.ch_offset = chan_offset;
1259 if (punct_bitmap)
1260 data.ch_switch.punct_bitmap = (u16) nla_get_u32(punct_bitmap);
1261 if (bw)
1262 data.ch_switch.ch_width = convert2width(nla_get_u32(bw));
1263 if (cf1)
1264 data.ch_switch.cf1 = nla_get_u32(cf1);
1265 if (cf2)
1266 data.ch_switch.cf2 = nla_get_u32(cf2);
1267
1268 if (link) {
1269 data.ch_switch.link_id = nla_get_u8(link);
1270 wpa_printf(MSG_DEBUG, "nl80211: Link ID: %d",
1271 data.ch_switch.link_id);
1272 } else {
1273 data.ch_switch.link_id = NL80211_DRV_LINK_ID_NA;
1274 }
1275
1276 if (finished) {
1277 if (data.ch_switch.link_id != NL80211_DRV_LINK_ID_NA) {
1278 struct i802_link *mld_link;
1279
1280 mld_link = nl80211_get_link(bss,
1281 data.ch_switch.link_id);
1282 mld_link->freq = data.ch_switch.freq;
1283 if (bw)
1284 mld_link->bandwidth = channel_width_to_int(
1285 data.ch_switch.ch_width);
1286 } else {
1287 bss->flink->freq = data.ch_switch.freq;
1288 if (bw)
1289 bss->flink->bandwidth = channel_width_to_int(
1290 data.ch_switch.ch_width);
1291 }
1292 }
1293
1294 if (link && is_sta_interface(drv->nlmode)) {
1295 u8 link_id = data.ch_switch.link_id;
1296
1297 if (link_id < MAX_NUM_MLD_LINKS &&
1298 drv->sta_mlo_info.valid_links & BIT(link_id)) {
1299 drv->sta_mlo_info.links[link_id].freq =
1300 data.ch_switch.freq;
1301 wpa_supplicant_event(
1302 bss->ctx,
1303 finished ? EVENT_LINK_CH_SWITCH :
1304 EVENT_LINK_CH_SWITCH_STARTED, &data);
1305 }
1306
1307 if (link_id != drv->sta_mlo_info.assoc_link_id)
1308 return;
1309 }
1310
1311 if (link && is_ap_interface(drv->nlmode) &&
1312 !nl80211_link_valid(bss->valid_links, data.ch_switch.link_id)) {
1313 wpa_printf(MSG_WARNING,
1314 "nl80211: Unknown link ID (%d) for channel switch (%s), ignoring",
1315 data.ch_switch.link_id, bss->ifname);
1316 return;
1317 }
1318
1319 drv->assoc_freq = data.ch_switch.freq;
1320
1321 wpa_supplicant_event(bss->ctx, finished ?
1322 EVENT_CH_SWITCH : EVENT_CH_SWITCH_STARTED, &data);
1323 }
1324
1325
mlme_timeout_event(struct wpa_driver_nl80211_data * drv,enum nl80211_commands cmd,struct nlattr * addr)1326 static void mlme_timeout_event(struct wpa_driver_nl80211_data *drv,
1327 enum nl80211_commands cmd, struct nlattr *addr)
1328 {
1329 union wpa_event_data event;
1330 enum wpa_event_type ev;
1331
1332 if (nla_len(addr) != ETH_ALEN)
1333 return;
1334
1335 wpa_printf(MSG_DEBUG, "nl80211: MLME event %d; timeout with " MACSTR,
1336 cmd, MAC2STR((u8 *) nla_data(addr)));
1337
1338 if (cmd == NL80211_CMD_AUTHENTICATE)
1339 ev = EVENT_AUTH_TIMED_OUT;
1340 else if (cmd == NL80211_CMD_ASSOCIATE)
1341 ev = EVENT_ASSOC_TIMED_OUT;
1342 else
1343 return;
1344
1345 os_memset(&event, 0, sizeof(event));
1346 os_memcpy(event.timeout_event.addr, nla_data(addr), ETH_ALEN);
1347 wpa_supplicant_event(drv->ctx, ev, &event);
1348 }
1349
1350
mlme_event_mgmt(struct i802_bss * bss,struct nlattr * freq,struct nlattr * sig,const u8 * frame,size_t len,int link_id)1351 static void mlme_event_mgmt(struct i802_bss *bss,
1352 struct nlattr *freq, struct nlattr *sig,
1353 const u8 *frame, size_t len,
1354 int link_id)
1355 {
1356 struct wpa_driver_nl80211_data *drv = bss->drv;
1357 const struct ieee80211_mgmt *mgmt;
1358 union wpa_event_data event;
1359 u16 fc, stype;
1360 int ssi_signal = 0;
1361 int rx_freq = 0;
1362
1363 wpa_printf(MSG_MSGDUMP, "nl80211: Frame event");
1364 mgmt = (const struct ieee80211_mgmt *) frame;
1365 if (len < 24) {
1366 wpa_printf(MSG_DEBUG, "nl80211: Too short management frame");
1367 return;
1368 }
1369
1370 fc = le_to_host16(mgmt->frame_control);
1371 stype = WLAN_FC_GET_STYPE(fc);
1372
1373 if (sig)
1374 ssi_signal = (s32) nla_get_u32(sig);
1375
1376 os_memset(&event, 0, sizeof(event));
1377 if (freq) {
1378 event.rx_mgmt.freq = nla_get_u32(freq);
1379 rx_freq = drv->last_mgmt_freq = event.rx_mgmt.freq;
1380 }
1381 wpa_printf(MSG_DEBUG,
1382 "nl80211: RX frame da=" MACSTR " sa=" MACSTR " bssid=" MACSTR
1383 " freq=%d ssi_signal=%d fc=0x%x seq_ctrl=0x%x stype=%u (%s) len=%u",
1384 MAC2STR(mgmt->da), MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid),
1385 rx_freq, ssi_signal, fc,
1386 le_to_host16(mgmt->seq_ctrl), stype, fc2str(fc),
1387 (unsigned int) len);
1388 event.rx_mgmt.frame = frame;
1389 event.rx_mgmt.frame_len = len;
1390 event.rx_mgmt.ssi_signal = ssi_signal;
1391 event.rx_mgmt.drv_priv = bss;
1392 event.rx_mgmt.ctx = bss->ctx;
1393 event.rx_mgmt.link_id = link_id;
1394
1395 wpa_supplicant_event(drv->ctx, EVENT_RX_MGMT, &event);
1396 }
1397
1398
mlme_event_mgmt_tx_status(struct i802_bss * bss,struct nlattr * cookie,const u8 * frame,size_t len,struct nlattr * ack)1399 static void mlme_event_mgmt_tx_status(struct i802_bss *bss,
1400 struct nlattr *cookie, const u8 *frame,
1401 size_t len, struct nlattr *ack)
1402 {
1403 union wpa_event_data event;
1404 const struct ieee80211_hdr *hdr = (const struct ieee80211_hdr *) frame;
1405 struct wpa_driver_nl80211_data *drv = bss->drv;
1406 u16 fc = le_to_host16(hdr->frame_control);
1407 u64 cookie_val = 0;
1408
1409 if (cookie)
1410 cookie_val = nla_get_u64(cookie);
1411 wpa_printf(MSG_DEBUG,
1412 "nl80211: Frame TX status event A1=" MACSTR
1413 " %sstype=%d cookie=0x%llx%s ack=%d",
1414 MAC2STR(hdr->addr1),
1415 WLAN_FC_GET_TYPE(fc) != WLAN_FC_TYPE_MGMT ? "not-mgmt " : "",
1416 WLAN_FC_GET_STYPE(fc), (long long unsigned int) cookie_val,
1417 cookie ? "" : "(N/A)", ack != NULL);
1418
1419 if (cookie_val && cookie_val == drv->eapol_tx_cookie &&
1420 len >= ETH_HLEN &&
1421 WPA_GET_BE16(frame + 2 * ETH_ALEN) == ETH_P_PAE) {
1422 wpa_printf(MSG_DEBUG,
1423 "nl80211: Work around misdelivered control port TX status for EAPOL");
1424 nl80211_control_port_frame_tx_status(bss, frame, len, ack,
1425 cookie);
1426 return;
1427 }
1428
1429 if (WLAN_FC_GET_TYPE(fc) != WLAN_FC_TYPE_MGMT)
1430 return;
1431
1432 if (!is_ap_interface(drv->nlmode) &&
1433 WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_ACTION) {
1434 if (!cookie)
1435 return;
1436
1437 wpa_printf(MSG_DEBUG,
1438 "nl80211: Frame TX status: cookie=0x%llx%s (ack=%d)",
1439 (long long unsigned int) cookie_val,
1440 cookie_val == drv->send_frame_cookie ?
1441 " (match)" : " (unknown)", ack != NULL);
1442 if (cookie_val != drv->send_frame_cookie)
1443 return;
1444 } else if (!is_ap_interface(drv->nlmode) &&
1445 WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_AUTH) {
1446 wpa_printf(MSG_DEBUG,
1447 "nl80211: Authentication frame TX status: ack=%d",
1448 !!ack);
1449 }
1450
1451 os_memset(&event, 0, sizeof(event));
1452 event.tx_status.type = WLAN_FC_GET_TYPE(fc);
1453 event.tx_status.stype = WLAN_FC_GET_STYPE(fc);
1454 event.tx_status.dst = hdr->addr1;
1455 event.tx_status.data = frame;
1456 event.tx_status.data_len = len;
1457 event.tx_status.ack = ack != NULL;
1458 event.tx_status.link_id = cookie_val == drv->send_frame_cookie ?
1459 drv->send_frame_link_id : NL80211_DRV_LINK_ID_NA;
1460 wpa_supplicant_event(bss->ctx, EVENT_TX_STATUS, &event);
1461 }
1462
1463
mlme_event_deauth_disassoc(struct wpa_driver_nl80211_data * drv,enum wpa_event_type type,const u8 * frame,size_t len)1464 static void mlme_event_deauth_disassoc(struct wpa_driver_nl80211_data *drv,
1465 enum wpa_event_type type,
1466 const u8 *frame, size_t len)
1467 {
1468 const struct ieee80211_mgmt *mgmt;
1469 union wpa_event_data event;
1470 const u8 *bssid = NULL;
1471 u16 reason_code = 0;
1472
1473 if (type == EVENT_DEAUTH)
1474 wpa_printf(MSG_DEBUG, "nl80211: Deauthenticate event");
1475 else
1476 wpa_printf(MSG_DEBUG, "nl80211: Disassociate event");
1477
1478 mgmt = (const struct ieee80211_mgmt *) frame;
1479 if (len >= 24) {
1480 bssid = mgmt->bssid;
1481
1482 if ((drv->capa.flags & WPA_DRIVER_FLAGS_SME) &&
1483 !drv->associated &&
1484 !ether_addr_equal(bssid, drv->auth_bssid) &&
1485 !ether_addr_equal(bssid, drv->auth_attempt_bssid) &&
1486 ether_addr_equal(bssid, drv->prev_bssid)) {
1487 /*
1488 * Avoid issues with some roaming cases where
1489 * disconnection event for the old AP may show up after
1490 * we have started connection with the new AP.
1491 * In case of locally generated event clear
1492 * ignore_next_local_deauth as well, to avoid next local
1493 * deauth event be wrongly ignored.
1494 */
1495 if (ether_addr_equal(mgmt->sa, drv->first_bss->addr) ||
1496 (!is_zero_ether_addr(drv->first_bss->prev_addr) &&
1497 ether_addr_equal(mgmt->sa,
1498 drv->first_bss->prev_addr))) {
1499 wpa_printf(MSG_DEBUG,
1500 "nl80211: Received a locally generated deauth event. Clear ignore_next_local_deauth flag");
1501 drv->ignore_next_local_deauth = 0;
1502 } else {
1503 wpa_printf(MSG_DEBUG,
1504 "nl80211: Ignore deauth/disassoc event from old AP " MACSTR " when already authenticating with " MACSTR,
1505 MAC2STR(bssid),
1506 MAC2STR(drv->auth_attempt_bssid));
1507 }
1508 return;
1509 }
1510
1511 if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME) &&
1512 drv->connect_reassoc && drv->associated &&
1513 ether_addr_equal(bssid, drv->prev_bssid) &&
1514 !ether_addr_equal(bssid, drv->auth_attempt_bssid)) {
1515 /*
1516 * Avoid issues with some roaming cases where
1517 * disconnection event for the old AP may show up after
1518 * we have started connection with the new AP.
1519 */
1520 wpa_printf(MSG_DEBUG,
1521 "nl80211: Ignore deauth/disassoc event from old AP "
1522 MACSTR
1523 " when already connecting with " MACSTR,
1524 MAC2STR(bssid),
1525 MAC2STR(drv->auth_attempt_bssid));
1526 return;
1527 }
1528
1529 if (drv->associated != 0 &&
1530 !ether_addr_equal(bssid, drv->bssid) &&
1531 !ether_addr_equal(bssid, drv->auth_bssid)) {
1532 /*
1533 * We have presumably received this deauth as a
1534 * response to a clear_state_mismatch() outgoing
1535 * deauth. Don't let it take us offline!
1536 */
1537 wpa_printf(MSG_DEBUG, "nl80211: Deauth received "
1538 "from Unknown BSSID " MACSTR " -- ignoring",
1539 MAC2STR(bssid));
1540 return;
1541 }
1542 }
1543
1544 nl80211_mark_disconnected(drv);
1545 os_memset(&event, 0, sizeof(event));
1546
1547 /* Note: Same offset for Reason Code in both frame subtypes */
1548 if (len >= 24 + sizeof(mgmt->u.deauth))
1549 reason_code = le_to_host16(mgmt->u.deauth.reason_code);
1550
1551 if (type == EVENT_DISASSOC) {
1552 event.disassoc_info.locally_generated =
1553 ether_addr_equal(mgmt->sa, drv->first_bss->addr);
1554 event.disassoc_info.addr = bssid;
1555 event.disassoc_info.reason_code = reason_code;
1556 if (frame + len > mgmt->u.disassoc.variable) {
1557 event.disassoc_info.ie = mgmt->u.disassoc.variable;
1558 event.disassoc_info.ie_len = frame + len -
1559 mgmt->u.disassoc.variable;
1560 }
1561 } else {
1562 event.deauth_info.locally_generated =
1563 ether_addr_equal(mgmt->sa, drv->first_bss->addr);
1564 if (drv->ignore_deauth_event) {
1565 wpa_printf(MSG_DEBUG, "nl80211: Ignore deauth event due to previous forced deauth-during-auth");
1566 drv->ignore_deauth_event = 0;
1567 if (event.deauth_info.locally_generated)
1568 drv->ignore_next_local_deauth = 0;
1569 return;
1570 }
1571 if (drv->ignore_next_local_deauth) {
1572 drv->ignore_next_local_deauth = 0;
1573 if (event.deauth_info.locally_generated) {
1574 wpa_printf(MSG_DEBUG, "nl80211: Ignore deauth event triggered due to own deauth request");
1575 return;
1576 }
1577 wpa_printf(MSG_WARNING, "nl80211: Was expecting local deauth but got another disconnect event first");
1578 }
1579 event.deauth_info.addr = bssid;
1580 event.deauth_info.reason_code = reason_code;
1581 if (frame + len > mgmt->u.deauth.variable) {
1582 event.deauth_info.ie = mgmt->u.deauth.variable;
1583 event.deauth_info.ie_len = frame + len -
1584 mgmt->u.deauth.variable;
1585 }
1586 }
1587
1588 wpa_supplicant_event(drv->ctx, type, &event);
1589 }
1590
1591
mlme_event_unprot_disconnect(struct wpa_driver_nl80211_data * drv,enum wpa_event_type type,const u8 * frame,size_t len)1592 static void mlme_event_unprot_disconnect(struct wpa_driver_nl80211_data *drv,
1593 enum wpa_event_type type,
1594 const u8 *frame, size_t len)
1595 {
1596 const struct ieee80211_mgmt *mgmt;
1597 union wpa_event_data event;
1598 u16 reason_code = 0;
1599
1600 if (type == EVENT_UNPROT_DEAUTH)
1601 wpa_printf(MSG_DEBUG, "nl80211: Unprot Deauthenticate event");
1602 else
1603 wpa_printf(MSG_DEBUG, "nl80211: Unprot Disassociate event");
1604
1605 if (len < 24)
1606 return;
1607
1608 mgmt = (const struct ieee80211_mgmt *) frame;
1609
1610 os_memset(&event, 0, sizeof(event));
1611 /* Note: Same offset for Reason Code in both frame subtypes */
1612 if (len >= 24 + sizeof(mgmt->u.deauth))
1613 reason_code = le_to_host16(mgmt->u.deauth.reason_code);
1614
1615 if (type == EVENT_UNPROT_DISASSOC) {
1616 event.unprot_disassoc.sa = mgmt->sa;
1617 event.unprot_disassoc.da = mgmt->da;
1618 event.unprot_disassoc.reason_code = reason_code;
1619 } else {
1620 event.unprot_deauth.sa = mgmt->sa;
1621 event.unprot_deauth.da = mgmt->da;
1622 event.unprot_deauth.reason_code = reason_code;
1623 }
1624
1625 wpa_supplicant_event(drv->ctx, type, &event);
1626 }
1627
1628
mlme_event_unprot_beacon(struct wpa_driver_nl80211_data * drv,const u8 * frame,size_t len)1629 static void mlme_event_unprot_beacon(struct wpa_driver_nl80211_data *drv,
1630 const u8 *frame, size_t len)
1631 {
1632 const struct ieee80211_mgmt *mgmt;
1633 union wpa_event_data event;
1634
1635 if (len < 24)
1636 return;
1637
1638 mgmt = (const struct ieee80211_mgmt *) frame;
1639
1640 os_memset(&event, 0, sizeof(event));
1641 event.unprot_beacon.sa = mgmt->sa;
1642 wpa_supplicant_event(drv->ctx, EVENT_UNPROT_BEACON, &event);
1643 }
1644
1645
1646 static s8
nl80211_get_link_id_by_freq(struct i802_bss * bss,unsigned int freq)1647 nl80211_get_link_id_by_freq(struct i802_bss *bss, unsigned int freq)
1648 {
1649 unsigned int i;
1650
1651 for_each_link(bss->valid_links, i) {
1652 if ((unsigned int) bss->links[i].freq == freq)
1653 return i;
1654 }
1655
1656 return NL80211_DRV_LINK_ID_NA;
1657 }
1658
1659
mlme_event(struct i802_bss * bss,enum nl80211_commands cmd,struct nlattr * frame,struct nlattr * addr,struct nlattr * timed_out,struct nlattr * freq,struct nlattr * ack,struct nlattr * cookie,struct nlattr * sig,struct nlattr * wmm,struct nlattr * req_ie,struct nlattr * link)1660 static void mlme_event(struct i802_bss *bss,
1661 enum nl80211_commands cmd, struct nlattr *frame,
1662 struct nlattr *addr, struct nlattr *timed_out,
1663 struct nlattr *freq, struct nlattr *ack,
1664 struct nlattr *cookie, struct nlattr *sig,
1665 struct nlattr *wmm, struct nlattr *req_ie,
1666 struct nlattr *link)
1667 {
1668 struct wpa_driver_nl80211_data *drv = bss->drv;
1669 u16 stype = 0, auth_type = 0;
1670 const u8 *data;
1671 size_t len;
1672 int link_id = -1;
1673 struct i802_link *mld_link = NULL;
1674
1675 if (timed_out && addr) {
1676 mlme_timeout_event(drv, cmd, addr);
1677 return;
1678 }
1679
1680 if (frame == NULL) {
1681 wpa_printf(MSG_DEBUG,
1682 "nl80211: MLME event %d (%s) without frame data",
1683 cmd, nl80211_command_to_string(cmd));
1684 return;
1685 }
1686
1687 /* Determine the MLD link either by an explicitly provided link id or
1688 * finding a match based on the frequency. */
1689 if (link)
1690 link_id = nla_get_u8(link);
1691 else if (freq)
1692 link_id = nl80211_get_link_id_by_freq(bss, nla_get_u32(freq));
1693
1694 if (nl80211_link_valid(bss->valid_links, link_id))
1695 mld_link = nl80211_get_link(bss, link_id);
1696
1697 data = nla_data(frame);
1698 len = nla_len(frame);
1699 if (len < 4 + 2 * ETH_ALEN) {
1700 wpa_printf(MSG_MSGDUMP, "nl80211: MLME event %d (%s) on %s("
1701 MACSTR ") - too short",
1702 cmd, nl80211_command_to_string(cmd), bss->ifname,
1703 MAC2STR(bss->addr));
1704 return;
1705 }
1706 wpa_printf(MSG_MSGDUMP, "nl80211: MLME event %d (%s) on %s(" MACSTR
1707 ") A1=" MACSTR " A2=" MACSTR " on link_id=%d", cmd,
1708 nl80211_command_to_string(cmd), bss->ifname,
1709 MAC2STR(bss->addr), MAC2STR(data + 4),
1710 MAC2STR(data + 4 + ETH_ALEN), link_id);
1711
1712 /* PASN Authentication frame can be received with a different source MAC
1713 * address. Allow NL80211_CMD_FRAME event with foreign addresses also.
1714 */
1715 if (cmd == NL80211_CMD_FRAME && len >= 24) {
1716 const struct ieee80211_mgmt *mgmt;
1717 u16 fc;
1718
1719 mgmt = (const struct ieee80211_mgmt *) data;
1720 fc = le_to_host16(mgmt->frame_control);
1721 stype = WLAN_FC_GET_STYPE(fc);
1722 auth_type = le_to_host16(mgmt->u.auth.auth_alg);
1723 }
1724
1725 if (cmd == NL80211_CMD_FRAME && stype == WLAN_FC_STYPE_AUTH &&
1726 auth_type == WLAN_AUTH_PASN) {
1727 wpa_printf(MSG_DEBUG,
1728 "nl80211: %s: Allow PASN frame for foreign address",
1729 bss->ifname);
1730 } else if (cmd != NL80211_CMD_FRAME_TX_STATUS &&
1731 !(data[4] & 0x01) &&
1732 !ether_addr_equal(bss->addr, data + 4) &&
1733 (is_zero_ether_addr(bss->rand_addr) ||
1734 !ether_addr_equal(bss->rand_addr, data + 4)) &&
1735 !ether_addr_equal(bss->addr, data + 4 + ETH_ALEN) &&
1736 (is_zero_ether_addr(drv->first_bss->prev_addr) ||
1737 !ether_addr_equal(bss->prev_addr, data + 4 + ETH_ALEN)) &&
1738 (!mld_link ||
1739 !ether_addr_equal(mld_link->addr, data + 4))) {
1740 wpa_printf(MSG_MSGDUMP, "nl80211: %s: Ignore MLME frame event "
1741 "for foreign address", bss->ifname);
1742 return;
1743 }
1744 wpa_hexdump(MSG_MSGDUMP, "nl80211: MLME event frame",
1745 nla_data(frame), nla_len(frame));
1746
1747 switch (cmd) {
1748 case NL80211_CMD_AUTHENTICATE:
1749 mlme_event_auth(drv, nla_data(frame), nla_len(frame));
1750 break;
1751 case NL80211_CMD_ASSOCIATE:
1752 mlme_event_assoc(drv, nla_data(frame), nla_len(frame), wmm,
1753 req_ie);
1754 break;
1755 case NL80211_CMD_DEAUTHENTICATE:
1756 mlme_event_deauth_disassoc(drv, EVENT_DEAUTH,
1757 nla_data(frame), nla_len(frame));
1758 break;
1759 case NL80211_CMD_DISASSOCIATE:
1760 mlme_event_deauth_disassoc(drv, EVENT_DISASSOC,
1761 nla_data(frame), nla_len(frame));
1762 break;
1763 case NL80211_CMD_FRAME:
1764 mlme_event_mgmt(bss, freq, sig, nla_data(frame),
1765 nla_len(frame), link_id);
1766 break;
1767 case NL80211_CMD_FRAME_TX_STATUS:
1768 mlme_event_mgmt_tx_status(bss, cookie, nla_data(frame),
1769 nla_len(frame), ack);
1770 break;
1771 case NL80211_CMD_UNPROT_DEAUTHENTICATE:
1772 mlme_event_unprot_disconnect(drv, EVENT_UNPROT_DEAUTH,
1773 nla_data(frame), nla_len(frame));
1774 break;
1775 case NL80211_CMD_UNPROT_DISASSOCIATE:
1776 mlme_event_unprot_disconnect(drv, EVENT_UNPROT_DISASSOC,
1777 nla_data(frame), nla_len(frame));
1778 break;
1779 case NL80211_CMD_UNPROT_BEACON:
1780 mlme_event_unprot_beacon(drv, nla_data(frame), nla_len(frame));
1781 break;
1782 default:
1783 break;
1784 }
1785 }
1786
1787
mlme_event_michael_mic_failure(struct i802_bss * bss,struct nlattr * tb[])1788 static void mlme_event_michael_mic_failure(struct i802_bss *bss,
1789 struct nlattr *tb[])
1790 {
1791 union wpa_event_data data;
1792
1793 wpa_printf(MSG_DEBUG, "nl80211: MLME event Michael MIC failure");
1794 os_memset(&data, 0, sizeof(data));
1795 if (tb[NL80211_ATTR_MAC]) {
1796 wpa_hexdump(MSG_DEBUG, "nl80211: Source MAC address",
1797 nla_data(tb[NL80211_ATTR_MAC]),
1798 nla_len(tb[NL80211_ATTR_MAC]));
1799 data.michael_mic_failure.src = nla_data(tb[NL80211_ATTR_MAC]);
1800 }
1801 if (tb[NL80211_ATTR_KEY_SEQ]) {
1802 wpa_hexdump(MSG_DEBUG, "nl80211: TSC",
1803 nla_data(tb[NL80211_ATTR_KEY_SEQ]),
1804 nla_len(tb[NL80211_ATTR_KEY_SEQ]));
1805 }
1806 if (tb[NL80211_ATTR_KEY_TYPE]) {
1807 enum nl80211_key_type key_type =
1808 nla_get_u32(tb[NL80211_ATTR_KEY_TYPE]);
1809 wpa_printf(MSG_DEBUG, "nl80211: Key Type %d", key_type);
1810 if (key_type == NL80211_KEYTYPE_PAIRWISE)
1811 data.michael_mic_failure.unicast = 1;
1812 } else
1813 data.michael_mic_failure.unicast = 1;
1814
1815 if (tb[NL80211_ATTR_KEY_IDX]) {
1816 u8 key_id = nla_get_u8(tb[NL80211_ATTR_KEY_IDX]);
1817 wpa_printf(MSG_DEBUG, "nl80211: Key Id %d", key_id);
1818 }
1819
1820 wpa_supplicant_event(bss->ctx, EVENT_MICHAEL_MIC_FAILURE, &data);
1821 }
1822
1823
mlme_event_join_ibss(struct wpa_driver_nl80211_data * drv,struct nlattr * tb[])1824 static void mlme_event_join_ibss(struct wpa_driver_nl80211_data *drv,
1825 struct nlattr *tb[])
1826 {
1827 unsigned int freq;
1828 union wpa_event_data event;
1829
1830 if (tb[NL80211_ATTR_MAC] == NULL) {
1831 wpa_printf(MSG_DEBUG, "nl80211: No address in IBSS joined "
1832 "event");
1833 return;
1834 }
1835 os_memcpy(drv->bssid, nla_data(tb[NL80211_ATTR_MAC]), ETH_ALEN);
1836
1837 drv->associated = 1;
1838 wpa_printf(MSG_DEBUG, "nl80211: IBSS " MACSTR " joined",
1839 MAC2STR(drv->bssid));
1840
1841 freq = nl80211_get_assoc_freq(drv);
1842 if (freq) {
1843 wpa_printf(MSG_DEBUG, "nl80211: IBSS on frequency %u MHz",
1844 freq);
1845 drv->first_bss->flink->freq = freq;
1846 }
1847
1848 os_memset(&event, 0, sizeof(event));
1849 event.assoc_info.freq = freq;
1850
1851 wpa_supplicant_event(drv->ctx, EVENT_ASSOC, &event);
1852 }
1853
1854
mlme_event_remain_on_channel(struct wpa_driver_nl80211_data * drv,int cancel_event,struct nlattr * tb[])1855 static void mlme_event_remain_on_channel(struct wpa_driver_nl80211_data *drv,
1856 int cancel_event, struct nlattr *tb[])
1857 {
1858 unsigned int freq, chan_type, duration;
1859 union wpa_event_data data;
1860 u64 cookie;
1861
1862 if (tb[NL80211_ATTR_WIPHY_FREQ])
1863 freq = nla_get_u32(tb[NL80211_ATTR_WIPHY_FREQ]);
1864 else
1865 freq = 0;
1866
1867 if (tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE])
1868 chan_type = nla_get_u32(tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1869 else
1870 chan_type = 0;
1871
1872 if (tb[NL80211_ATTR_DURATION])
1873 duration = nla_get_u32(tb[NL80211_ATTR_DURATION]);
1874 else
1875 duration = 0;
1876
1877 if (tb[NL80211_ATTR_COOKIE])
1878 cookie = nla_get_u64(tb[NL80211_ATTR_COOKIE]);
1879 else
1880 cookie = 0;
1881
1882 wpa_printf(MSG_DEBUG, "nl80211: Remain-on-channel event (cancel=%d "
1883 "freq=%u channel_type=%u duration=%u cookie=0x%llx (%s))",
1884 cancel_event, freq, chan_type, duration,
1885 (long long unsigned int) cookie,
1886 cookie == drv->remain_on_chan_cookie ? "match" : "unknown");
1887
1888 if (cookie != drv->remain_on_chan_cookie)
1889 return; /* not for us */
1890
1891 if (cancel_event)
1892 drv->pending_remain_on_chan = 0;
1893
1894 os_memset(&data, 0, sizeof(data));
1895 data.remain_on_channel.freq = freq;
1896 data.remain_on_channel.duration = duration;
1897 wpa_supplicant_event(drv->ctx, cancel_event ?
1898 EVENT_CANCEL_REMAIN_ON_CHANNEL :
1899 EVENT_REMAIN_ON_CHANNEL, &data);
1900 }
1901
1902
mlme_event_ft_event(struct wpa_driver_nl80211_data * drv,struct nlattr * tb[])1903 static void mlme_event_ft_event(struct wpa_driver_nl80211_data *drv,
1904 struct nlattr *tb[])
1905 {
1906 union wpa_event_data data;
1907
1908 os_memset(&data, 0, sizeof(data));
1909
1910 if (tb[NL80211_ATTR_IE]) {
1911 data.ft_ies.ies = nla_data(tb[NL80211_ATTR_IE]);
1912 data.ft_ies.ies_len = nla_len(tb[NL80211_ATTR_IE]);
1913 }
1914
1915 if (tb[NL80211_ATTR_IE_RIC]) {
1916 data.ft_ies.ric_ies = nla_data(tb[NL80211_ATTR_IE_RIC]);
1917 data.ft_ies.ric_ies_len = nla_len(tb[NL80211_ATTR_IE_RIC]);
1918 }
1919
1920 if (tb[NL80211_ATTR_MAC])
1921 os_memcpy(data.ft_ies.target_ap,
1922 nla_data(tb[NL80211_ATTR_MAC]), ETH_ALEN);
1923
1924 wpa_printf(MSG_DEBUG, "nl80211: FT event target_ap " MACSTR,
1925 MAC2STR(data.ft_ies.target_ap));
1926
1927 wpa_supplicant_event(drv->ctx, EVENT_FT_RESPONSE, &data);
1928 }
1929
1930
mlme_event_dh_event(struct wpa_driver_nl80211_data * drv,struct i802_bss * bss,struct nlattr * tb[])1931 static void mlme_event_dh_event(struct wpa_driver_nl80211_data *drv,
1932 struct i802_bss *bss,
1933 struct nlattr *tb[])
1934 {
1935 union wpa_event_data data;
1936 u8 *addr, *link_addr = NULL;
1937 int assoc_link_id = -1;
1938
1939 if (!is_ap_interface(drv->nlmode))
1940 return;
1941 if (!tb[NL80211_ATTR_MAC] || !tb[NL80211_ATTR_IE])
1942 return;
1943
1944 os_memset(&data, 0, sizeof(data));
1945 addr = nla_data(tb[NL80211_ATTR_MAC]);
1946
1947 if (!bss->valid_links &&
1948 (tb[NL80211_ATTR_MLO_LINK_ID] ||
1949 tb[NL80211_ATTR_MLD_ADDR])) {
1950 wpa_printf(MSG_ERROR,
1951 "nl80211: Link info not expected for DH event for non-MLD AP");
1952 return;
1953 }
1954
1955 if (tb[NL80211_ATTR_MLO_LINK_ID]) {
1956 assoc_link_id = nla_get_u8(tb[NL80211_ATTR_MLO_LINK_ID]);
1957 wpa_printf(MSG_DEBUG,
1958 "nl80211: STA assoc link ID %d in UPDATE_OWE_INFO event",
1959 assoc_link_id);
1960
1961 if (assoc_link_id != NL80211_DRV_LINK_ID_NA &&
1962 tb[NL80211_ATTR_MLD_ADDR]) {
1963 link_addr = addr;
1964 addr = nla_data(tb[NL80211_ATTR_MLD_ADDR]);
1965 wpa_printf(MSG_DEBUG,
1966 "nl80211: STA assoc link addr " MACSTR,
1967 MAC2STR(link_addr));
1968 }
1969 }
1970
1971 data.update_dh.peer = addr;
1972 data.update_dh.ie = nla_data(tb[NL80211_ATTR_IE]);
1973 data.update_dh.ie_len = nla_len(tb[NL80211_ATTR_IE]);
1974 data.update_dh.assoc_link_id = assoc_link_id;
1975 data.update_dh.link_addr = link_addr;
1976
1977 wpa_printf(MSG_DEBUG, "nl80211: DH event - peer " MACSTR,
1978 MAC2STR(data.update_dh.peer));
1979
1980 wpa_supplicant_event(bss->ctx, EVENT_UPDATE_DH, &data);
1981 }
1982
1983
send_scan_event(struct i802_bss * bss,int aborted,struct nlattr * tb[],int external_scan)1984 static void send_scan_event(struct i802_bss *bss, int aborted,
1985 struct nlattr *tb[], int external_scan)
1986 {
1987 struct wpa_driver_nl80211_data *drv = bss->drv;
1988 union wpa_event_data event;
1989 struct nlattr *nl;
1990 int rem;
1991 struct scan_info *info;
1992 #define MAX_REPORT_FREQS 110
1993 int freqs[MAX_REPORT_FREQS];
1994 int num_freqs = 0;
1995 struct i802_link *mld_link;
1996 void *ctx = bss->ctx;
1997
1998 if (!external_scan && drv->scan_for_auth) {
1999 drv->scan_for_auth = 0;
2000 wpa_printf(MSG_DEBUG, "nl80211: Scan results for missing "
2001 "cfg80211 BSS entry");
2002 wpa_driver_nl80211_authenticate_retry(drv);
2003 return;
2004 }
2005
2006 os_memset(&event, 0, sizeof(event));
2007 info = &event.scan_info;
2008 info->aborted = aborted;
2009 info->external_scan = external_scan;
2010 info->nl_scan_event = 1;
2011
2012 if (tb[NL80211_ATTR_SCAN_SSIDS]) {
2013 nla_for_each_nested(nl, tb[NL80211_ATTR_SCAN_SSIDS], rem) {
2014 struct wpa_driver_scan_ssid *s =
2015 &info->ssids[info->num_ssids];
2016 s->ssid = nla_data(nl);
2017 s->ssid_len = nla_len(nl);
2018 wpa_printf(MSG_DEBUG, "nl80211: Scan probed for SSID '%s'",
2019 wpa_ssid_txt(s->ssid, s->ssid_len));
2020 info->num_ssids++;
2021 if (info->num_ssids == WPAS_MAX_SCAN_SSIDS)
2022 break;
2023 }
2024 }
2025 if (tb[NL80211_ATTR_SCAN_FREQUENCIES]) {
2026 char msg[MAX_REPORT_FREQS * 5 + 1], *pos, *end;
2027 int res;
2028
2029 pos = msg;
2030 end = pos + sizeof(msg);
2031 *pos = '\0';
2032
2033 nla_for_each_nested(nl, tb[NL80211_ATTR_SCAN_FREQUENCIES], rem)
2034 {
2035 freqs[num_freqs] = nla_get_u32(nl);
2036 res = os_snprintf(pos, end - pos, " %d",
2037 freqs[num_freqs]);
2038 if (!os_snprintf_error(end - pos, res))
2039 pos += res;
2040 num_freqs++;
2041 if (num_freqs == MAX_REPORT_FREQS)
2042 break;
2043 }
2044 info->freqs = freqs;
2045 info->num_freqs = num_freqs;
2046 msg[sizeof(msg) - 1] = '\0';
2047 wpa_printf(MSG_DEBUG, "nl80211: Scan included frequencies:%s",
2048 msg);
2049 }
2050
2051 if (tb[NL80211_ATTR_SCAN_START_TIME_TSF] &&
2052 tb[NL80211_ATTR_SCAN_START_TIME_TSF_BSSID]) {
2053 info->scan_start_tsf =
2054 nla_get_u64(tb[NL80211_ATTR_SCAN_START_TIME_TSF]);
2055 os_memcpy(info->scan_start_tsf_bssid,
2056 nla_data(tb[NL80211_ATTR_SCAN_START_TIME_TSF_BSSID]),
2057 ETH_ALEN);
2058 }
2059
2060 /* Need to pass to the correct link ctx during AP MLD operation */
2061 if (is_ap_interface(drv->nlmode)) {
2062 mld_link = bss->scan_link;
2063 if (!mld_link) {
2064 wpa_printf(MSG_DEBUG,
2065 "nl80211: Scan event on unknown link");
2066 } else if (mld_link->ctx) {
2067 u8 link_id = nl80211_get_link_id_from_link(bss,
2068 mld_link);
2069
2070 wpa_printf(MSG_DEBUG,
2071 "nl80211: Scan event for link_id %d",
2072 link_id);
2073 ctx = mld_link->ctx;
2074 }
2075 }
2076
2077 wpa_supplicant_event(ctx, EVENT_SCAN_RESULTS, &event);
2078 }
2079
2080
nl80211_cqm_event(struct i802_bss * bss,struct nlattr * tb[])2081 static void nl80211_cqm_event(struct i802_bss *bss, struct nlattr *tb[])
2082 {
2083 struct wpa_driver_nl80211_data *drv = bss->drv;
2084 static struct nla_policy cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
2085 [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
2086 [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U8 },
2087 [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
2088 [NL80211_ATTR_CQM_PKT_LOSS_EVENT] = { .type = NLA_U32 },
2089 [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
2090 [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
2091 [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
2092 [NL80211_ATTR_CQM_BEACON_LOSS_EVENT] = { .type = NLA_FLAG },
2093 };
2094 struct nlattr *cqm[NL80211_ATTR_CQM_MAX + 1];
2095 enum nl80211_cqm_rssi_threshold_event event;
2096 union wpa_event_data ed;
2097 int res;
2098
2099 if (tb[NL80211_ATTR_CQM] == NULL ||
2100 nla_parse_nested(cqm, NL80211_ATTR_CQM_MAX, tb[NL80211_ATTR_CQM],
2101 cqm_policy)) {
2102 wpa_printf(MSG_DEBUG, "nl80211: Ignore invalid CQM event");
2103 return;
2104 }
2105
2106 os_memset(&ed, 0, sizeof(ed));
2107
2108 if (cqm[NL80211_ATTR_CQM_PKT_LOSS_EVENT]) {
2109 if (!tb[NL80211_ATTR_MAC])
2110 return;
2111 os_memcpy(ed.low_ack.addr, nla_data(tb[NL80211_ATTR_MAC]),
2112 ETH_ALEN);
2113 ed.low_ack.num_packets =
2114 nla_get_u32(cqm[NL80211_ATTR_CQM_PKT_LOSS_EVENT]);
2115 wpa_printf(MSG_DEBUG, "nl80211: Packet loss event for " MACSTR
2116 " (num_packets %u)",
2117 MAC2STR(ed.low_ack.addr), ed.low_ack.num_packets);
2118 wpa_supplicant_event(bss->ctx, EVENT_STATION_LOW_ACK, &ed);
2119 return;
2120 }
2121
2122 if (cqm[NL80211_ATTR_CQM_BEACON_LOSS_EVENT]) {
2123 wpa_printf(MSG_DEBUG, "nl80211: Beacon loss event");
2124 wpa_supplicant_event(drv->ctx, EVENT_BEACON_LOSS, NULL);
2125 return;
2126 }
2127
2128 if (cqm[NL80211_ATTR_CQM_TXE_RATE] &&
2129 cqm[NL80211_ATTR_CQM_TXE_PKTS] &&
2130 cqm[NL80211_ATTR_CQM_TXE_INTVL] &&
2131 cqm[NL80211_ATTR_MAC]) {
2132 wpa_printf(MSG_DEBUG, "nl80211: CQM TXE event for " MACSTR
2133 " (rate: %u pkts: %u interval: %u)",
2134 MAC2STR((u8 *) nla_data(cqm[NL80211_ATTR_MAC])),
2135 nla_get_u32(cqm[NL80211_ATTR_CQM_TXE_RATE]),
2136 nla_get_u32(cqm[NL80211_ATTR_CQM_TXE_PKTS]),
2137 nla_get_u32(cqm[NL80211_ATTR_CQM_TXE_INTVL]));
2138 return;
2139 }
2140
2141 if (cqm[NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] == NULL) {
2142 wpa_printf(MSG_DEBUG,
2143 "nl80211: Not a CQM RSSI threshold event");
2144 return;
2145 }
2146 event = nla_get_u32(cqm[NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT]);
2147
2148 if (event == NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH) {
2149 wpa_printf(MSG_DEBUG, "nl80211: Connection quality monitor "
2150 "event: RSSI high");
2151 ed.signal_change.above_threshold = 1;
2152 } else if (event == NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW) {
2153 wpa_printf(MSG_DEBUG, "nl80211: Connection quality monitor "
2154 "event: RSSI low");
2155 ed.signal_change.above_threshold = 0;
2156 } else {
2157 wpa_printf(MSG_DEBUG,
2158 "nl80211: Unknown CQM RSSI threshold event: %d",
2159 event);
2160 return;
2161 }
2162
2163 /*
2164 * nl80211_get_link_signal() and nl80211_get_link_noise() set default
2165 * values in case querying the driver fails.
2166 */
2167 res = nl80211_get_link_signal(drv, drv->bssid, &ed.signal_change.data);
2168 if (res == 0) {
2169 wpa_printf(MSG_DEBUG, "nl80211: Signal: %d dBm txrate: %lu",
2170 ed.signal_change.data.signal,
2171 ed.signal_change.data.current_tx_rate);
2172 } else {
2173 wpa_printf(MSG_DEBUG,
2174 "nl80211: Querying the driver for signal info failed");
2175 }
2176
2177 res = nl80211_get_link_noise(drv, &ed.signal_change);
2178 if (res == 0) {
2179 wpa_printf(MSG_DEBUG, "nl80211: Noise: %d dBm",
2180 ed.signal_change.current_noise);
2181 } else {
2182 wpa_printf(MSG_DEBUG,
2183 "nl80211: Querying the driver for noise info failed");
2184 }
2185
2186 wpa_supplicant_event(drv->ctx, EVENT_SIGNAL_CHANGE, &ed);
2187 }
2188
2189
nl80211_new_peer_candidate(struct wpa_driver_nl80211_data * drv,struct nlattr ** tb)2190 static void nl80211_new_peer_candidate(struct wpa_driver_nl80211_data *drv,
2191 struct nlattr **tb)
2192 {
2193 const u8 *addr;
2194 union wpa_event_data data;
2195
2196 if (drv->nlmode != NL80211_IFTYPE_MESH_POINT ||
2197 !tb[NL80211_ATTR_MAC] || !tb[NL80211_ATTR_IE])
2198 return;
2199
2200 addr = nla_data(tb[NL80211_ATTR_MAC]);
2201 wpa_printf(MSG_DEBUG, "nl80211: New peer candidate " MACSTR,
2202 MAC2STR(addr));
2203
2204 os_memset(&data, 0, sizeof(data));
2205 data.mesh_peer.peer = addr;
2206 data.mesh_peer.ies = nla_data(tb[NL80211_ATTR_IE]);
2207 data.mesh_peer.ie_len = nla_len(tb[NL80211_ATTR_IE]);
2208 wpa_supplicant_event(drv->ctx, EVENT_NEW_PEER_CANDIDATE, &data);
2209 }
2210
2211
nl80211_new_station_event(struct wpa_driver_nl80211_data * drv,struct i802_bss * bss,struct nlattr ** tb)2212 static void nl80211_new_station_event(struct wpa_driver_nl80211_data *drv,
2213 struct i802_bss *bss,
2214 struct nlattr **tb)
2215 {
2216 u8 *peer_addr;
2217 union wpa_event_data data;
2218
2219 if (tb[NL80211_ATTR_MAC] == NULL)
2220 return;
2221 peer_addr = nla_data(tb[NL80211_ATTR_MAC]);
2222 wpa_printf(MSG_DEBUG, "nl80211: New station " MACSTR,
2223 MAC2STR(peer_addr));
2224
2225 if (is_ap_interface(drv->nlmode) && drv->device_ap_sme) {
2226 u8 *link_addr = NULL;
2227 int assoc_link_id = -1;
2228 u8 *req_ies = NULL, *resp_ies = NULL;
2229 size_t req_ies_len = 0, resp_ies_len = 0;
2230
2231 if (!bss->valid_links &&
2232 (tb[NL80211_ATTR_MLO_LINK_ID] ||
2233 tb[NL80211_ATTR_MLD_ADDR])) {
2234 wpa_printf(MSG_ERROR,
2235 "nl80211: MLO info not expected for new station event for non-MLD AP");
2236 return;
2237 }
2238
2239 if (tb[NL80211_ATTR_MLO_LINK_ID]) {
2240 assoc_link_id =
2241 nla_get_u8(tb[NL80211_ATTR_MLO_LINK_ID]);
2242 wpa_printf(MSG_DEBUG, "nl80211: STA assoc link ID %d",
2243 assoc_link_id);
2244 if (tb[NL80211_ATTR_MLD_ADDR]) {
2245 peer_addr = nla_data(tb[NL80211_ATTR_MLD_ADDR]);
2246 link_addr = nla_data(tb[NL80211_ATTR_MAC]);
2247 wpa_printf(MSG_DEBUG,
2248 "nl80211: STA MLD address " MACSTR,
2249 MAC2STR(peer_addr));
2250 }
2251 }
2252
2253 if (tb[NL80211_ATTR_IE]) {
2254 req_ies = nla_data(tb[NL80211_ATTR_IE]);
2255 req_ies_len = nla_len(tb[NL80211_ATTR_IE]);
2256 wpa_hexdump(MSG_DEBUG, "nl80211: Assoc Req IEs",
2257 req_ies, req_ies_len);
2258 }
2259
2260 if (tb[NL80211_ATTR_RESP_IE]) {
2261 resp_ies = nla_data(tb[NL80211_ATTR_RESP_IE]);
2262 resp_ies_len = nla_len(tb[NL80211_ATTR_RESP_IE]);
2263 wpa_hexdump(MSG_DEBUG, "nl80211: Assoc Resp IEs",
2264 resp_ies, resp_ies_len);
2265 }
2266
2267 drv_event_assoc(bss->ctx, peer_addr, req_ies, req_ies_len,
2268 resp_ies, resp_ies_len, link_addr,
2269 assoc_link_id, 0);
2270 return;
2271 }
2272
2273 if (drv->nlmode != NL80211_IFTYPE_ADHOC)
2274 return;
2275
2276 os_memset(&data, 0, sizeof(data));
2277 os_memcpy(data.ibss_rsn_start.peer, peer_addr, ETH_ALEN);
2278 wpa_supplicant_event(bss->ctx, EVENT_IBSS_RSN_START, &data);
2279 }
2280
2281
nl80211_del_station_event(struct wpa_driver_nl80211_data * drv,struct i802_bss * bss,struct nlattr ** tb)2282 static void nl80211_del_station_event(struct wpa_driver_nl80211_data *drv,
2283 struct i802_bss *bss,
2284 struct nlattr **tb)
2285 {
2286 u8 *addr;
2287 union wpa_event_data data;
2288
2289 if (tb[NL80211_ATTR_MAC] == NULL)
2290 return;
2291 addr = nla_data(tb[NL80211_ATTR_MAC]);
2292 wpa_printf(MSG_DEBUG, "nl80211: Delete station " MACSTR,
2293 MAC2STR(addr));
2294
2295 if (is_ap_interface(drv->nlmode) && drv->device_ap_sme) {
2296 drv_event_disassoc(bss->ctx, addr);
2297 return;
2298 }
2299
2300 if (drv->nlmode != NL80211_IFTYPE_ADHOC)
2301 return;
2302
2303 os_memset(&data, 0, sizeof(data));
2304 os_memcpy(data.ibss_peer_lost.peer, addr, ETH_ALEN);
2305 wpa_supplicant_event(bss->ctx, EVENT_IBSS_PEER_LOST, &data);
2306 }
2307
2308
nl80211_rekey_offload_event(struct wpa_driver_nl80211_data * drv,struct nlattr ** tb)2309 static void nl80211_rekey_offload_event(struct wpa_driver_nl80211_data *drv,
2310 struct nlattr **tb)
2311 {
2312 struct nlattr *rekey_info[NUM_NL80211_REKEY_DATA];
2313 static struct nla_policy rekey_policy[NUM_NL80211_REKEY_DATA] = {
2314 [NL80211_REKEY_DATA_KEK] = {
2315 .minlen = NL80211_KEK_LEN,
2316 .maxlen = NL80211_KEK_LEN,
2317 },
2318 [NL80211_REKEY_DATA_KCK] = {
2319 .minlen = NL80211_KCK_LEN,
2320 .maxlen = NL80211_KCK_LEN,
2321 },
2322 [NL80211_REKEY_DATA_REPLAY_CTR] = {
2323 .minlen = NL80211_REPLAY_CTR_LEN,
2324 .maxlen = NL80211_REPLAY_CTR_LEN,
2325 },
2326 };
2327 union wpa_event_data data;
2328
2329 if (!tb[NL80211_ATTR_MAC] ||
2330 !tb[NL80211_ATTR_REKEY_DATA] ||
2331 nla_parse_nested(rekey_info, MAX_NL80211_REKEY_DATA,
2332 tb[NL80211_ATTR_REKEY_DATA], rekey_policy) ||
2333 !rekey_info[NL80211_REKEY_DATA_REPLAY_CTR])
2334 return;
2335
2336 os_memset(&data, 0, sizeof(data));
2337 data.driver_gtk_rekey.bssid = nla_data(tb[NL80211_ATTR_MAC]);
2338 wpa_printf(MSG_DEBUG, "nl80211: Rekey offload event for BSSID " MACSTR,
2339 MAC2STR(data.driver_gtk_rekey.bssid));
2340 data.driver_gtk_rekey.replay_ctr =
2341 nla_data(rekey_info[NL80211_REKEY_DATA_REPLAY_CTR]);
2342 wpa_hexdump(MSG_DEBUG, "nl80211: Rekey offload - Replay Counter",
2343 data.driver_gtk_rekey.replay_ctr, NL80211_REPLAY_CTR_LEN);
2344 wpa_supplicant_event(drv->ctx, EVENT_DRIVER_GTK_REKEY, &data);
2345 }
2346
2347
nl80211_pmksa_candidate_event(struct wpa_driver_nl80211_data * drv,struct nlattr ** tb)2348 static void nl80211_pmksa_candidate_event(struct wpa_driver_nl80211_data *drv,
2349 struct nlattr **tb)
2350 {
2351 struct nlattr *cand[NUM_NL80211_PMKSA_CANDIDATE];
2352 static struct nla_policy cand_policy[NUM_NL80211_PMKSA_CANDIDATE] = {
2353 [NL80211_PMKSA_CANDIDATE_INDEX] = { .type = NLA_U32 },
2354 [NL80211_PMKSA_CANDIDATE_BSSID] = {
2355 .minlen = ETH_ALEN,
2356 .maxlen = ETH_ALEN,
2357 },
2358 [NL80211_PMKSA_CANDIDATE_PREAUTH] = { .type = NLA_FLAG },
2359 };
2360 union wpa_event_data data;
2361
2362 wpa_printf(MSG_DEBUG, "nl80211: PMKSA candidate event");
2363
2364 if (!tb[NL80211_ATTR_PMKSA_CANDIDATE] ||
2365 nla_parse_nested(cand, MAX_NL80211_PMKSA_CANDIDATE,
2366 tb[NL80211_ATTR_PMKSA_CANDIDATE], cand_policy) ||
2367 !cand[NL80211_PMKSA_CANDIDATE_INDEX] ||
2368 !cand[NL80211_PMKSA_CANDIDATE_BSSID])
2369 return;
2370
2371 os_memset(&data, 0, sizeof(data));
2372 os_memcpy(data.pmkid_candidate.bssid,
2373 nla_data(cand[NL80211_PMKSA_CANDIDATE_BSSID]), ETH_ALEN);
2374 data.pmkid_candidate.index =
2375 nla_get_u32(cand[NL80211_PMKSA_CANDIDATE_INDEX]);
2376 data.pmkid_candidate.preauth =
2377 cand[NL80211_PMKSA_CANDIDATE_PREAUTH] != NULL;
2378 wpa_supplicant_event(drv->ctx, EVENT_PMKID_CANDIDATE, &data);
2379 }
2380
2381
nl80211_client_probe_event(struct wpa_driver_nl80211_data * drv,struct nlattr ** tb)2382 static void nl80211_client_probe_event(struct wpa_driver_nl80211_data *drv,
2383 struct nlattr **tb)
2384 {
2385 union wpa_event_data data;
2386 const u8 *addr;
2387 u64 cookie = 0;
2388
2389 addr = nla_data(tb[NL80211_ATTR_MAC]);
2390 if (!addr)
2391 return;
2392 if (tb[NL80211_ATTR_COOKIE])
2393 cookie = nla_get_u64(tb[NL80211_ATTR_COOKIE]);
2394 wpa_printf(MSG_DEBUG, "nl80211: Probe client event (addr=" MACSTR
2395 " ack=%d cookie=%llu)", MAC2STR(addr),
2396 tb[NL80211_ATTR_ACK] != NULL,
2397 (long long unsigned int) cookie);
2398 if (!tb[NL80211_ATTR_ACK])
2399 return;
2400
2401 os_memset(&data, 0, sizeof(data));
2402 os_memcpy(data.client_poll.addr, addr, ETH_ALEN);
2403 wpa_supplicant_event(drv->ctx, EVENT_DRIVER_CLIENT_POLL_OK, &data);
2404 }
2405
2406
nl80211_tdls_oper_event(struct wpa_driver_nl80211_data * drv,struct nlattr ** tb)2407 static void nl80211_tdls_oper_event(struct wpa_driver_nl80211_data *drv,
2408 struct nlattr **tb)
2409 {
2410 union wpa_event_data data;
2411
2412 wpa_printf(MSG_DEBUG, "nl80211: TDLS operation event");
2413
2414 if (!tb[NL80211_ATTR_MAC] || !tb[NL80211_ATTR_TDLS_OPERATION])
2415 return;
2416
2417 os_memset(&data, 0, sizeof(data));
2418 os_memcpy(data.tdls.peer, nla_data(tb[NL80211_ATTR_MAC]), ETH_ALEN);
2419 switch (nla_get_u8(tb[NL80211_ATTR_TDLS_OPERATION])) {
2420 case NL80211_TDLS_SETUP:
2421 wpa_printf(MSG_DEBUG, "nl80211: TDLS setup request for peer "
2422 MACSTR, MAC2STR(data.tdls.peer));
2423 data.tdls.oper = TDLS_REQUEST_SETUP;
2424 break;
2425 case NL80211_TDLS_TEARDOWN:
2426 wpa_printf(MSG_DEBUG, "nl80211: TDLS teardown request for peer "
2427 MACSTR, MAC2STR(data.tdls.peer));
2428 data.tdls.oper = TDLS_REQUEST_TEARDOWN;
2429 break;
2430 case NL80211_TDLS_DISCOVERY_REQ:
2431 wpa_printf(MSG_DEBUG,
2432 "nl80211: TDLS discovery request for peer " MACSTR,
2433 MAC2STR(data.tdls.peer));
2434 data.tdls.oper = TDLS_REQUEST_DISCOVER;
2435 break;
2436 default:
2437 wpa_printf(MSG_DEBUG, "nl80211: Unsupported TDLS operatione "
2438 "event");
2439 return;
2440 }
2441 if (tb[NL80211_ATTR_REASON_CODE]) {
2442 data.tdls.reason_code =
2443 nla_get_u16(tb[NL80211_ATTR_REASON_CODE]);
2444 }
2445
2446 wpa_supplicant_event(drv->ctx, EVENT_TDLS, &data);
2447 }
2448
2449
nl80211_stop_ap(struct i802_bss * bss,struct nlattr ** tb)2450 static void nl80211_stop_ap(struct i802_bss *bss, struct nlattr **tb)
2451 {
2452 struct i802_link *mld_link = NULL;
2453 void *ctx = bss->ctx;
2454 int link_id = -1;
2455
2456 if (tb[NL80211_ATTR_MLO_LINK_ID]) {
2457 link_id = nla_get_u8(tb[NL80211_ATTR_MLO_LINK_ID]);
2458 if (!nl80211_link_valid(bss->valid_links, link_id)) {
2459 wpa_printf(MSG_DEBUG,
2460 "nl80211: Ignoring STOP_AP event for invalid link ID %d (valid: 0x%04x)",
2461 link_id, bss->valid_links);
2462 return;
2463 }
2464
2465 mld_link = nl80211_get_link(bss, link_id);
2466 wpa_printf(MSG_DEBUG,
2467 "nl80211: STOP_AP event on link %d", link_id);
2468 ctx = mld_link->ctx;
2469
2470 /* The driver would have already deleted the link and this call
2471 * will return an error. Ignore that since nl80211_remove_link()
2472 * is called here only to update the bss->links[] state. */
2473 nl80211_remove_link(bss, link_id);
2474 }
2475
2476 wpa_supplicant_event(ctx, EVENT_INTERFACE_UNAVAILABLE, NULL);
2477 }
2478
2479
nl80211_connect_failed_event(struct wpa_driver_nl80211_data * drv,struct nlattr ** tb)2480 static void nl80211_connect_failed_event(struct wpa_driver_nl80211_data *drv,
2481 struct nlattr **tb)
2482 {
2483 union wpa_event_data data;
2484 u32 reason;
2485
2486 wpa_printf(MSG_DEBUG, "nl80211: Connect failed event");
2487
2488 if (!tb[NL80211_ATTR_MAC] || !tb[NL80211_ATTR_CONN_FAILED_REASON])
2489 return;
2490
2491 os_memset(&data, 0, sizeof(data));
2492 os_memcpy(data.connect_failed_reason.addr,
2493 nla_data(tb[NL80211_ATTR_MAC]), ETH_ALEN);
2494
2495 reason = nla_get_u32(tb[NL80211_ATTR_CONN_FAILED_REASON]);
2496 switch (reason) {
2497 case NL80211_CONN_FAIL_MAX_CLIENTS:
2498 wpa_printf(MSG_DEBUG, "nl80211: Max client reached");
2499 data.connect_failed_reason.code = MAX_CLIENT_REACHED;
2500 break;
2501 case NL80211_CONN_FAIL_BLOCKED_CLIENT:
2502 wpa_printf(MSG_DEBUG, "nl80211: Blocked client " MACSTR
2503 " tried to connect",
2504 MAC2STR(data.connect_failed_reason.addr));
2505 data.connect_failed_reason.code = BLOCKED_CLIENT;
2506 break;
2507 default:
2508 wpa_printf(MSG_DEBUG, "nl8021l: Unknown connect failed reason "
2509 "%u", reason);
2510 return;
2511 }
2512
2513 wpa_supplicant_event(drv->ctx, EVENT_CONNECT_FAILED_REASON, &data);
2514 }
2515
2516
nl80211_process_radar_event(struct i802_bss * bss,union wpa_event_data * data,enum nl80211_radar_event event_type)2517 static void nl80211_process_radar_event(struct i802_bss *bss,
2518 union wpa_event_data *data,
2519 enum nl80211_radar_event event_type)
2520 {
2521 wpa_printf(MSG_DEBUG,
2522 "nl80211: DFS event on freq %d MHz, ht: %d, offset: %d, width: %d, cf1: %dMHz, cf2: %dMHz, link_id=%d",
2523 data->dfs_event.freq, data->dfs_event.ht_enabled,
2524 data->dfs_event.chan_offset, data->dfs_event.chan_width,
2525 data->dfs_event.cf1, data->dfs_event.cf2,
2526 data->dfs_event.link_id);
2527
2528 switch (event_type) {
2529 case NL80211_RADAR_DETECTED:
2530 wpa_supplicant_event(bss->ctx, EVENT_DFS_RADAR_DETECTED, data);
2531 break;
2532 case NL80211_RADAR_CAC_FINISHED:
2533 wpa_supplicant_event(bss->ctx, EVENT_DFS_CAC_FINISHED, data);
2534 break;
2535 case NL80211_RADAR_CAC_ABORTED:
2536 wpa_supplicant_event(bss->ctx, EVENT_DFS_CAC_ABORTED, data);
2537 break;
2538 case NL80211_RADAR_NOP_FINISHED:
2539 wpa_supplicant_event(bss->ctx, EVENT_DFS_NOP_FINISHED, data);
2540 break;
2541 case NL80211_RADAR_PRE_CAC_EXPIRED:
2542 wpa_supplicant_event(bss->ctx, EVENT_DFS_PRE_CAC_EXPIRED,
2543 data);
2544 break;
2545 case NL80211_RADAR_CAC_STARTED:
2546 wpa_supplicant_event(bss->ctx, EVENT_DFS_CAC_STARTED, data);
2547 break;
2548 default:
2549 wpa_printf(MSG_DEBUG,
2550 "nl80211: Unknown radar event %d received",
2551 event_type);
2552 break;
2553 }
2554 }
2555
2556
nl80211_radar_event(struct i802_bss * bss,struct nlattr ** tb)2557 static void nl80211_radar_event(struct i802_bss *bss, struct nlattr **tb)
2558 {
2559 struct wpa_driver_nl80211_data *drv = bss->drv;
2560 union wpa_event_data data;
2561 enum nl80211_radar_event event_type;
2562 struct i802_bss *bss_iter;
2563 int i;
2564 bool hit = false;
2565
2566 if (!tb[NL80211_ATTR_WIPHY_FREQ] || !tb[NL80211_ATTR_RADAR_EVENT])
2567 return;
2568
2569 os_memset(&data, 0, sizeof(data));
2570 data.dfs_event.freq = nla_get_u32(tb[NL80211_ATTR_WIPHY_FREQ]);
2571 event_type = nla_get_u32(tb[NL80211_ATTR_RADAR_EVENT]);
2572
2573 /* Check HT params */
2574 if (tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
2575 data.dfs_event.ht_enabled = 1;
2576 data.dfs_event.chan_offset = 0;
2577
2578 switch (nla_get_u32(tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE])) {
2579 case NL80211_CHAN_NO_HT:
2580 data.dfs_event.ht_enabled = 0;
2581 break;
2582 case NL80211_CHAN_HT20:
2583 break;
2584 case NL80211_CHAN_HT40PLUS:
2585 data.dfs_event.chan_offset = 1;
2586 break;
2587 case NL80211_CHAN_HT40MINUS:
2588 data.dfs_event.chan_offset = -1;
2589 break;
2590 }
2591 }
2592
2593 /* Get VHT params */
2594 if (tb[NL80211_ATTR_CHANNEL_WIDTH])
2595 data.dfs_event.chan_width =
2596 convert2width(nla_get_u32(
2597 tb[NL80211_ATTR_CHANNEL_WIDTH]));
2598 if (tb[NL80211_ATTR_CENTER_FREQ1])
2599 data.dfs_event.cf1 = nla_get_u32(tb[NL80211_ATTR_CENTER_FREQ1]);
2600 if (tb[NL80211_ATTR_CENTER_FREQ2])
2601 data.dfs_event.cf2 = nla_get_u32(tb[NL80211_ATTR_CENTER_FREQ2]);
2602
2603 wpa_printf(MSG_DEBUG,
2604 "nl80211: Checking suitable BSS for the DFS event");
2605
2606 /* It is possible to have the event without ifidx and wdev_id, e.g.,
2607 * with NL80211_RADAR_NOP_FINISHED and NL80211_RADAR_PRE_CAC_EXPIRED.
2608 * Hence need to check on all BSSs. */
2609 for (bss_iter = drv->first_bss; bss_iter; bss_iter = bss_iter->next) {
2610 /* Find a link match based on the frequency. If
2611 * NL80211_DRV_LINK_ID_NA is returned, either a match was not
2612 * found or the BSS could be operating as a non-MLO. */
2613 data.dfs_event.link_id = nl80211_get_link_id_by_freq(
2614 bss_iter, data.dfs_event.freq);
2615 /* If a link match is found, exit the loop after the handler is
2616 * called */
2617 if (data.dfs_event.link_id != NL80211_DRV_LINK_ID_NA)
2618 return nl80211_process_radar_event(bss_iter, &data,
2619 event_type);
2620 if (data.dfs_event.link_id == NL80211_DRV_LINK_ID_NA) {
2621 /* For non-MLO operation, frequency should still match
2622 */
2623 if (!bss_iter->valid_links &&
2624 bss_iter->links[0].freq == data.dfs_event.freq)
2625 return nl80211_process_radar_event(
2626 bss_iter, &data, event_type);
2627 }
2628
2629 /* For event like NL80211_RADAR_NOP_FINISHED, frequency
2630 * information will not match exactly the link frequency. Hence,
2631 * if the link frequency is 5 GHz, pass the event to it.
2632 */
2633 for_each_link_default(bss_iter->valid_links, i, 0) {
2634 if (bss_iter->links[i].freq < 5180 ||
2635 bss_iter->links[i].freq > 5900)
2636 continue;
2637
2638 data.dfs_event.link_id = bss_iter->valid_links ?
2639 i : NL80211_DRV_LINK_ID_NA;
2640
2641 /* Cannot just return after one match since if split
2642 * hardware is participating in MLO, possibly the event
2643 * is for 5 GHz upper band and this iteration has picked
2644 * a 5 GHz low band link, but 5 GHz freq check will be
2645 * true for both. Hence, iterate on all possible links.
2646 * The handler should take care whether the event is
2647 * actually for it. */
2648 nl80211_process_radar_event(bss_iter, &data,
2649 event_type);
2650
2651 hit = true;
2652 }
2653 }
2654
2655 if (hit)
2656 return;
2657
2658 wpa_printf(MSG_DEBUG, "nl80211: DFS event on unknown freq on %s",
2659 bss->ifname);
2660 }
2661
2662
nl80211_spurious_frame(struct i802_bss * bss,struct nlattr ** tb,int wds)2663 static void nl80211_spurious_frame(struct i802_bss *bss, struct nlattr **tb,
2664 int wds)
2665 {
2666 struct wpa_driver_nl80211_data *drv = bss->drv;
2667 union wpa_event_data event;
2668
2669 if (!tb[NL80211_ATTR_MAC])
2670 return;
2671
2672 os_memset(&event, 0, sizeof(event));
2673 event.rx_from_unknown.bssid = bss->addr;
2674 event.rx_from_unknown.addr = nla_data(tb[NL80211_ATTR_MAC]);
2675 event.rx_from_unknown.wds = wds;
2676
2677 wpa_supplicant_event(drv->ctx, EVENT_RX_FROM_UNKNOWN, &event);
2678 }
2679
2680 #ifdef CONFIG_DRIVER_NL80211_QCA
2681
qca_nl80211_avoid_freq(struct wpa_driver_nl80211_data * drv,const u8 * data,size_t len)2682 static void qca_nl80211_avoid_freq(struct wpa_driver_nl80211_data *drv,
2683 const u8 *data, size_t len)
2684 {
2685 u32 i, count;
2686 union wpa_event_data event;
2687 struct wpa_freq_range *range = NULL;
2688 const struct qca_avoid_freq_list *freq_range;
2689
2690 freq_range = (const struct qca_avoid_freq_list *) data;
2691 if (len < sizeof(freq_range->count))
2692 return;
2693
2694 count = freq_range->count;
2695 if (len < sizeof(freq_range->count) +
2696 count * sizeof(struct qca_avoid_freq_range)) {
2697 wpa_printf(MSG_DEBUG, "nl80211: Ignored too short avoid frequency list (len=%u)",
2698 (unsigned int) len);
2699 return;
2700 }
2701
2702 if (count > 0) {
2703 range = os_calloc(count, sizeof(struct wpa_freq_range));
2704 if (range == NULL)
2705 return;
2706 }
2707
2708 os_memset(&event, 0, sizeof(event));
2709 for (i = 0; i < count; i++) {
2710 unsigned int idx = event.freq_range.num;
2711 range[idx].min = freq_range->range[i].start_freq;
2712 range[idx].max = freq_range->range[i].end_freq;
2713 wpa_printf(MSG_DEBUG, "nl80211: Avoid frequency range: %u-%u",
2714 range[idx].min, range[idx].max);
2715 if (range[idx].min > range[idx].max) {
2716 wpa_printf(MSG_DEBUG, "nl80211: Ignore invalid frequency range");
2717 continue;
2718 }
2719 event.freq_range.num++;
2720 }
2721 event.freq_range.range = range;
2722
2723 wpa_supplicant_event(drv->ctx, EVENT_AVOID_FREQUENCIES, &event);
2724
2725 os_free(range);
2726 }
2727
2728
get_qca_hw_mode(u8 hw_mode)2729 static enum hostapd_hw_mode get_qca_hw_mode(u8 hw_mode)
2730 {
2731 switch (hw_mode) {
2732 case QCA_ACS_MODE_IEEE80211B:
2733 return HOSTAPD_MODE_IEEE80211B;
2734 case QCA_ACS_MODE_IEEE80211G:
2735 return HOSTAPD_MODE_IEEE80211G;
2736 case QCA_ACS_MODE_IEEE80211A:
2737 return HOSTAPD_MODE_IEEE80211A;
2738 case QCA_ACS_MODE_IEEE80211AD:
2739 return HOSTAPD_MODE_IEEE80211AD;
2740 case QCA_ACS_MODE_IEEE80211ANY:
2741 return HOSTAPD_MODE_IEEE80211ANY;
2742 default:
2743 return NUM_HOSTAPD_MODES;
2744 }
2745 }
2746
2747
chan_to_freq(struct wpa_driver_nl80211_data * drv,u8 chan,enum hostapd_hw_mode hw_mode)2748 static unsigned int chan_to_freq(struct wpa_driver_nl80211_data *drv,
2749 u8 chan, enum hostapd_hw_mode hw_mode)
2750 {
2751 if (hw_mode == NUM_HOSTAPD_MODES) {
2752 /* For drivers that do not report ACS_HW_MODE */
2753 u16 num_modes, flags;
2754 struct hostapd_hw_modes *modes;
2755 u8 dfs_domain;
2756 int i;
2757
2758 modes = nl80211_get_hw_feature_data(drv->first_bss, &num_modes,
2759 &flags, &dfs_domain);
2760 if (!modes) {
2761 wpa_printf(MSG_DEBUG,
2762 "nl80211: Fetching hardware mode failed");
2763 goto try_2_4_or_5;
2764 }
2765 if (num_modes == 1)
2766 hw_mode = modes[0].mode;
2767
2768 for (i = 0; i < num_modes; i++) {
2769 os_free(modes[i].channels);
2770 os_free(modes[i].rates);
2771 }
2772
2773 os_free(modes);
2774 }
2775
2776 if (hw_mode == HOSTAPD_MODE_IEEE80211AD) {
2777 if (chan >= 1 && chan <= 6)
2778 return 56160 + (2160 * chan);
2779 return 0;
2780 }
2781
2782 try_2_4_or_5:
2783 if (chan >= 1 && chan <= 13)
2784 return 2407 + 5 * chan;
2785 if (chan == 14)
2786 return 2484;
2787 if (chan >= 36 && chan <= 177)
2788 return 5000 + 5 * chan;
2789
2790 return 0;
2791 }
2792
2793
qca_nl80211_acs_select_ch(struct wpa_driver_nl80211_data * drv,const u8 * data,size_t len)2794 static void qca_nl80211_acs_select_ch(struct wpa_driver_nl80211_data *drv,
2795 const u8 *data, size_t len)
2796 {
2797 struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_ACS_MAX + 1];
2798 union wpa_event_data event;
2799 u8 chan;
2800
2801 wpa_printf(MSG_DEBUG,
2802 "nl80211: ACS channel selection vendor event received");
2803
2804 if (nla_parse(tb, QCA_WLAN_VENDOR_ATTR_ACS_MAX,
2805 (struct nlattr *) data, len, NULL) ||
2806 (!tb[QCA_WLAN_VENDOR_ATTR_ACS_PRIMARY_FREQUENCY] &&
2807 !tb[QCA_WLAN_VENDOR_ATTR_ACS_PRIMARY_CHANNEL]) ||
2808 (!tb[QCA_WLAN_VENDOR_ATTR_ACS_SECONDARY_FREQUENCY] &&
2809 !tb[QCA_WLAN_VENDOR_ATTR_ACS_SECONDARY_CHANNEL]))
2810 return;
2811
2812 os_memset(&event, 0, sizeof(event));
2813 event.acs_selected_channels.hw_mode = NUM_HOSTAPD_MODES;
2814
2815 if (tb[QCA_WLAN_VENDOR_ATTR_ACS_HW_MODE]) {
2816 u8 hw_mode = nla_get_u8(tb[QCA_WLAN_VENDOR_ATTR_ACS_HW_MODE]);
2817
2818 event.acs_selected_channels.hw_mode = get_qca_hw_mode(hw_mode);
2819 if (event.acs_selected_channels.hw_mode == NUM_HOSTAPD_MODES ||
2820 event.acs_selected_channels.hw_mode ==
2821 HOSTAPD_MODE_IEEE80211ANY) {
2822 wpa_printf(MSG_DEBUG,
2823 "nl80211: Invalid hw_mode %d in ACS selection event",
2824 hw_mode);
2825 return;
2826 }
2827 }
2828
2829 if (tb[QCA_WLAN_VENDOR_ATTR_ACS_PRIMARY_FREQUENCY]) {
2830 event.acs_selected_channels.pri_freq = nla_get_u32(
2831 tb[QCA_WLAN_VENDOR_ATTR_ACS_PRIMARY_FREQUENCY]);
2832 } else {
2833 chan = nla_get_u8(tb[QCA_WLAN_VENDOR_ATTR_ACS_PRIMARY_CHANNEL]);
2834 event.acs_selected_channels.pri_freq =
2835 chan_to_freq(drv, chan,
2836 event.acs_selected_channels.hw_mode);
2837 }
2838
2839 if (tb[QCA_WLAN_VENDOR_ATTR_ACS_SECONDARY_FREQUENCY]) {
2840 event.acs_selected_channels.sec_freq = nla_get_u32(
2841 tb[QCA_WLAN_VENDOR_ATTR_ACS_SECONDARY_FREQUENCY]);
2842 } else {
2843 chan = nla_get_u8(
2844 tb[QCA_WLAN_VENDOR_ATTR_ACS_SECONDARY_CHANNEL]);
2845 event.acs_selected_channels.sec_freq =
2846 chan_to_freq(drv, chan,
2847 event.acs_selected_channels.hw_mode);
2848 }
2849
2850 if (tb[QCA_WLAN_VENDOR_ATTR_ACS_EDMG_CHANNEL])
2851 event.acs_selected_channels.edmg_channel =
2852 nla_get_u8(tb[QCA_WLAN_VENDOR_ATTR_ACS_EDMG_CHANNEL]);
2853 if (tb[QCA_WLAN_VENDOR_ATTR_ACS_VHT_SEG0_CENTER_CHANNEL])
2854 event.acs_selected_channels.vht_seg0_center_ch =
2855 nla_get_u8(tb[QCA_WLAN_VENDOR_ATTR_ACS_VHT_SEG0_CENTER_CHANNEL]);
2856 if (tb[QCA_WLAN_VENDOR_ATTR_ACS_VHT_SEG1_CENTER_CHANNEL])
2857 event.acs_selected_channels.vht_seg1_center_ch =
2858 nla_get_u8(tb[QCA_WLAN_VENDOR_ATTR_ACS_VHT_SEG1_CENTER_CHANNEL]);
2859 if (tb[QCA_WLAN_VENDOR_ATTR_ACS_CHWIDTH])
2860 event.acs_selected_channels.ch_width =
2861 nla_get_u16(tb[QCA_WLAN_VENDOR_ATTR_ACS_CHWIDTH]);
2862 if (tb[QCA_WLAN_VENDOR_ATTR_ACS_PUNCTURE_BITMAP])
2863 event.acs_selected_channels.puncture_bitmap =
2864 nla_get_u16(tb[QCA_WLAN_VENDOR_ATTR_ACS_PUNCTURE_BITMAP]);
2865 if (tb[QCA_WLAN_VENDOR_ATTR_ACS_LINK_ID])
2866 event.acs_selected_channels.link_id =
2867 nla_get_u8(tb[QCA_WLAN_VENDOR_ATTR_ACS_LINK_ID]);
2868 else
2869 event.acs_selected_channels.link_id = -1;
2870
2871 wpa_printf(MSG_INFO,
2872 "nl80211: ACS Results: PFreq: %d SFreq: %d BW: %d VHT0: %d VHT1: %d HW_MODE: %d EDMGCH: %d PUNCBITMAP: 0x%x, LinkId: %d",
2873 event.acs_selected_channels.pri_freq,
2874 event.acs_selected_channels.sec_freq,
2875 event.acs_selected_channels.ch_width,
2876 event.acs_selected_channels.vht_seg0_center_ch,
2877 event.acs_selected_channels.vht_seg1_center_ch,
2878 event.acs_selected_channels.hw_mode,
2879 event.acs_selected_channels.edmg_channel,
2880 event.acs_selected_channels.puncture_bitmap,
2881 event.acs_selected_channels.link_id);
2882
2883 /* Ignore ACS channel list check for backwards compatibility */
2884
2885 wpa_supplicant_event(drv->ctx, EVENT_ACS_CHANNEL_SELECTED, &event);
2886 }
2887
2888
qca_nl80211_key_mgmt_auth(struct wpa_driver_nl80211_data * drv,const u8 * data,size_t len)2889 static void qca_nl80211_key_mgmt_auth(struct wpa_driver_nl80211_data *drv,
2890 const u8 *data, size_t len)
2891 {
2892 struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_MAX + 1];
2893 u8 *bssid;
2894
2895 wpa_printf(MSG_DEBUG,
2896 "nl80211: Key management roam+auth vendor event received");
2897
2898 if (nla_parse(tb, QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_MAX,
2899 (struct nlattr *) data, len, NULL) ||
2900 !tb[QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_BSSID] ||
2901 nla_len(tb[QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_BSSID]) != ETH_ALEN ||
2902 !tb[QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_REQ_IE] ||
2903 !tb[QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_RESP_IE] ||
2904 !tb[QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_AUTHORIZED])
2905 return;
2906
2907 bssid = nla_data(tb[QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_BSSID]);
2908 wpa_printf(MSG_DEBUG, " * roam BSSID " MACSTR, MAC2STR(bssid));
2909
2910 mlme_event_connect(drv, NL80211_CMD_ROAM, true, NULL,
2911 tb[QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_BSSID],
2912 tb[QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_REQ_IE],
2913 tb[QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_RESP_IE],
2914 NULL, NULL,
2915 tb[QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_AUTHORIZED],
2916 tb[QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_KEY_REPLAY_CTR],
2917 tb[QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_PTK_KCK],
2918 tb[QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_PTK_KEK],
2919 tb[QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_SUBNET_STATUS],
2920 tb[QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_FILS_ERP_NEXT_SEQ_NUM],
2921 tb[QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_PMK],
2922 tb[QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_PMKID],
2923 tb[QCA_WLAN_VENDOR_ATTR_ROAM_AUTH_MLO_LINKS]);
2924
2925 #ifdef ANDROID
2926 #ifdef ANDROID_LIB_EVENT
2927 wpa_driver_nl80211_driver_event(
2928 drv, OUI_QCA, QCA_NL80211_VENDOR_SUBCMD_KEY_MGMT_ROAM_AUTH,
2929 data, len);
2930 #endif /* ANDROID_LIB_EVENT */
2931 #endif /* ANDROID */
2932 }
2933
2934
2935 static void
qca_nl80211_key_mgmt_auth_handler(struct wpa_driver_nl80211_data * drv,const u8 * data,size_t len)2936 qca_nl80211_key_mgmt_auth_handler(struct wpa_driver_nl80211_data *drv,
2937 const u8 *data, size_t len)
2938 {
2939 if (!drv->roam_indication_done) {
2940 wpa_printf(MSG_DEBUG,
2941 "nl80211: Pending roam indication, delay processing roam+auth vendor event");
2942
2943 os_free(drv->pending_roam_data);
2944 drv->pending_roam_data = os_memdup(data, len);
2945 if (!drv->pending_roam_data)
2946 return;
2947 drv->pending_roam_data_len = len;
2948 return;
2949 }
2950 drv->roam_indication_done = false;
2951 qca_nl80211_key_mgmt_auth(drv, data, len);
2952 }
2953
2954
qca_nl80211_dfs_offload_radar_event(struct wpa_driver_nl80211_data * drv,u32 subcmd,u8 * msg,int length)2955 static void qca_nl80211_dfs_offload_radar_event(
2956 struct wpa_driver_nl80211_data *drv, u32 subcmd, u8 *msg, int length)
2957 {
2958 union wpa_event_data data;
2959 struct nlattr *tb[NL80211_ATTR_MAX + 1];
2960
2961 wpa_printf(MSG_DEBUG,
2962 "nl80211: DFS offload radar vendor event received");
2963
2964 if (nla_parse(tb, NL80211_ATTR_MAX,
2965 (struct nlattr *) msg, length, NULL))
2966 return;
2967
2968 if (!tb[NL80211_ATTR_WIPHY_FREQ]) {
2969 wpa_printf(MSG_INFO,
2970 "nl80211: Error parsing WIPHY_FREQ in FS offload radar vendor event");
2971 return;
2972 }
2973
2974 os_memset(&data, 0, sizeof(data));
2975 data.dfs_event.freq = nla_get_u32(tb[NL80211_ATTR_WIPHY_FREQ]);
2976 data.dfs_event.link_id = NL80211_DRV_LINK_ID_NA;
2977
2978 if (tb[NL80211_ATTR_MLO_LINK_ID]) {
2979 data.dfs_event.link_id =
2980 nla_get_u8(tb[NL80211_ATTR_MLO_LINK_ID]);
2981 } else if (data.dfs_event.freq) {
2982 data.dfs_event.link_id =
2983 nl80211_get_link_id_by_freq(drv->first_bss,
2984 data.dfs_event.freq);
2985 }
2986
2987 wpa_printf(MSG_DEBUG, "nl80211: DFS event on freq %d MHz, link=%d",
2988 data.dfs_event.freq, data.dfs_event.link_id);
2989
2990 /* Check HT params */
2991 if (tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
2992 data.dfs_event.ht_enabled = 1;
2993 data.dfs_event.chan_offset = 0;
2994
2995 switch (nla_get_u32(tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE])) {
2996 case NL80211_CHAN_NO_HT:
2997 data.dfs_event.ht_enabled = 0;
2998 break;
2999 case NL80211_CHAN_HT20:
3000 break;
3001 case NL80211_CHAN_HT40PLUS:
3002 data.dfs_event.chan_offset = 1;
3003 break;
3004 case NL80211_CHAN_HT40MINUS:
3005 data.dfs_event.chan_offset = -1;
3006 break;
3007 }
3008 }
3009
3010 /* Get VHT params */
3011 if (tb[NL80211_ATTR_CHANNEL_WIDTH])
3012 data.dfs_event.chan_width =
3013 convert2width(nla_get_u32(
3014 tb[NL80211_ATTR_CHANNEL_WIDTH]));
3015 if (tb[NL80211_ATTR_CENTER_FREQ1])
3016 data.dfs_event.cf1 = nla_get_u32(tb[NL80211_ATTR_CENTER_FREQ1]);
3017 if (tb[NL80211_ATTR_CENTER_FREQ2])
3018 data.dfs_event.cf2 = nla_get_u32(tb[NL80211_ATTR_CENTER_FREQ2]);
3019
3020 wpa_printf(MSG_DEBUG, "nl80211: DFS event on freq %d MHz, ht: %d, "
3021 "offset: %d, width: %d, cf1: %dMHz, cf2: %dMHz",
3022 data.dfs_event.freq, data.dfs_event.ht_enabled,
3023 data.dfs_event.chan_offset, data.dfs_event.chan_width,
3024 data.dfs_event.cf1, data.dfs_event.cf2);
3025
3026 switch (subcmd) {
3027 case QCA_NL80211_VENDOR_SUBCMD_DFS_OFFLOAD_RADAR_DETECTED:
3028 wpa_supplicant_event(drv->ctx, EVENT_DFS_RADAR_DETECTED, &data);
3029 break;
3030 case QCA_NL80211_VENDOR_SUBCMD_DFS_OFFLOAD_CAC_STARTED:
3031 wpa_supplicant_event(drv->ctx, EVENT_DFS_CAC_STARTED, &data);
3032 break;
3033 case QCA_NL80211_VENDOR_SUBCMD_DFS_OFFLOAD_CAC_FINISHED:
3034 wpa_supplicant_event(drv->ctx, EVENT_DFS_CAC_FINISHED, &data);
3035 break;
3036 case QCA_NL80211_VENDOR_SUBCMD_DFS_OFFLOAD_CAC_ABORTED:
3037 wpa_supplicant_event(drv->ctx, EVENT_DFS_CAC_ABORTED, &data);
3038 break;
3039 case QCA_NL80211_VENDOR_SUBCMD_DFS_OFFLOAD_CAC_NOP_FINISHED:
3040 wpa_supplicant_event(drv->ctx, EVENT_DFS_NOP_FINISHED, &data);
3041 break;
3042 default:
3043 wpa_printf(MSG_DEBUG,
3044 "nl80211: Unknown DFS offload radar event %d received",
3045 subcmd);
3046 break;
3047 }
3048 }
3049
3050
qca_nl80211_scan_trigger_event(struct wpa_driver_nl80211_data * drv,u8 * data,size_t len)3051 static void qca_nl80211_scan_trigger_event(struct wpa_driver_nl80211_data *drv,
3052 u8 *data, size_t len)
3053 {
3054 struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_SCAN_MAX + 1];
3055 u64 cookie = 0;
3056 union wpa_event_data event;
3057 struct scan_info *info;
3058
3059 if (nla_parse(tb, QCA_WLAN_VENDOR_ATTR_SCAN_MAX,
3060 (struct nlattr *) data, len, NULL) ||
3061 !tb[QCA_WLAN_VENDOR_ATTR_SCAN_COOKIE])
3062 return;
3063
3064 cookie = nla_get_u64(tb[QCA_WLAN_VENDOR_ATTR_SCAN_COOKIE]);
3065 if (cookie != drv->vendor_scan_cookie) {
3066 /* External scan trigger event, ignore */
3067 return;
3068 }
3069
3070 /* Cookie match, own scan */
3071 os_memset(&event, 0, sizeof(event));
3072 info = &event.scan_info;
3073 info->external_scan = 0;
3074 info->nl_scan_event = 0;
3075
3076 drv->scan_state = SCAN_STARTED;
3077 wpa_supplicant_event(drv->ctx, EVENT_SCAN_STARTED, &event);
3078 }
3079
3080
send_vendor_scan_event(struct wpa_driver_nl80211_data * drv,int aborted,struct nlattr * tb[],int external_scan)3081 static void send_vendor_scan_event(struct wpa_driver_nl80211_data *drv,
3082 int aborted, struct nlattr *tb[],
3083 int external_scan)
3084 {
3085 union wpa_event_data event;
3086 struct nlattr *nl;
3087 int rem;
3088 struct scan_info *info;
3089 int freqs[MAX_REPORT_FREQS];
3090 int num_freqs = 0;
3091
3092 os_memset(&event, 0, sizeof(event));
3093 info = &event.scan_info;
3094 info->aborted = aborted;
3095 info->external_scan = external_scan;
3096 info->scan_cookie = nla_get_u64(tb[QCA_WLAN_VENDOR_ATTR_SCAN_COOKIE]);
3097
3098 if (tb[QCA_WLAN_VENDOR_ATTR_SCAN_SSIDS]) {
3099 nla_for_each_nested(nl,
3100 tb[QCA_WLAN_VENDOR_ATTR_SCAN_SSIDS], rem) {
3101 struct wpa_driver_scan_ssid *s =
3102 &info->ssids[info->num_ssids];
3103 s->ssid = nla_data(nl);
3104 s->ssid_len = nla_len(nl);
3105 wpa_printf(MSG_DEBUG,
3106 "nl80211: Scan probed for SSID '%s'",
3107 wpa_ssid_txt(s->ssid, s->ssid_len));
3108 info->num_ssids++;
3109 if (info->num_ssids == WPAS_MAX_SCAN_SSIDS)
3110 break;
3111 }
3112 }
3113
3114 if (tb[QCA_WLAN_VENDOR_ATTR_SCAN_FREQUENCIES]) {
3115 char msg[500], *pos, *end;
3116 int res;
3117
3118 pos = msg;
3119 end = pos + sizeof(msg);
3120 *pos = '\0';
3121
3122 nla_for_each_nested(nl,
3123 tb[QCA_WLAN_VENDOR_ATTR_SCAN_FREQUENCIES],
3124 rem) {
3125 freqs[num_freqs] = nla_get_u32(nl);
3126 res = os_snprintf(pos, end - pos, " %d",
3127 freqs[num_freqs]);
3128 if (!os_snprintf_error(end - pos, res))
3129 pos += res;
3130 num_freqs++;
3131 if (num_freqs == MAX_REPORT_FREQS - 1)
3132 break;
3133 }
3134
3135 info->freqs = freqs;
3136 info->num_freqs = num_freqs;
3137 wpa_printf(MSG_DEBUG, "nl80211: Scan included frequencies:%s",
3138 msg);
3139 }
3140 wpa_supplicant_event(drv->ctx, EVENT_SCAN_RESULTS, &event);
3141 }
3142
3143
qca_nl80211_scan_done_event(struct wpa_driver_nl80211_data * drv,u8 * data,size_t len)3144 static void qca_nl80211_scan_done_event(struct wpa_driver_nl80211_data *drv,
3145 u8 *data, size_t len)
3146 {
3147 struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_SCAN_MAX + 1];
3148 u64 cookie = 0;
3149 enum scan_status status;
3150 int external_scan;
3151
3152 if (nla_parse(tb, QCA_WLAN_VENDOR_ATTR_SCAN_MAX,
3153 (struct nlattr *) data, len, NULL) ||
3154 !tb[QCA_WLAN_VENDOR_ATTR_SCAN_STATUS] ||
3155 !tb[QCA_WLAN_VENDOR_ATTR_SCAN_COOKIE])
3156 return;
3157
3158 status = nla_get_u8(tb[QCA_WLAN_VENDOR_ATTR_SCAN_STATUS]);
3159 if (status >= VENDOR_SCAN_STATUS_MAX)
3160 return; /* invalid status */
3161
3162 cookie = nla_get_u64(tb[QCA_WLAN_VENDOR_ATTR_SCAN_COOKIE]);
3163 if (cookie != drv->vendor_scan_cookie) {
3164 /* Event from an external scan, get scan results */
3165 external_scan = 1;
3166 } else {
3167 external_scan = 0;
3168 if (status == VENDOR_SCAN_STATUS_NEW_RESULTS)
3169 drv->scan_state = SCAN_COMPLETED;
3170 else
3171 drv->scan_state = SCAN_ABORTED;
3172
3173 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv,
3174 drv->first_bss->ctx);
3175 drv->vendor_scan_cookie = 0;
3176 drv->last_scan_cmd = 0;
3177 }
3178
3179 send_vendor_scan_event(drv, (status == VENDOR_SCAN_STATUS_ABORTED), tb,
3180 external_scan);
3181 }
3182
3183
qca_nl80211_p2p_lo_stop_event(struct wpa_driver_nl80211_data * drv,u8 * data,size_t len)3184 static void qca_nl80211_p2p_lo_stop_event(struct wpa_driver_nl80211_data *drv,
3185 u8 *data, size_t len)
3186 {
3187 struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_P2P_LISTEN_OFFLOAD_MAX + 1];
3188 union wpa_event_data event;
3189
3190 wpa_printf(MSG_DEBUG,
3191 "nl80211: P2P listen offload stop vendor event received");
3192
3193 if (nla_parse(tb, QCA_WLAN_VENDOR_ATTR_P2P_LISTEN_OFFLOAD_MAX,
3194 (struct nlattr *) data, len, NULL) ||
3195 !tb[QCA_WLAN_VENDOR_ATTR_P2P_LISTEN_OFFLOAD_STOP_REASON])
3196 return;
3197
3198 os_memset(&event, 0, sizeof(event));
3199 event.p2p_lo_stop.reason_code =
3200 nla_get_u8(tb[QCA_WLAN_VENDOR_ATTR_P2P_LISTEN_OFFLOAD_STOP_REASON]);
3201
3202 wpa_printf(MSG_DEBUG,
3203 "nl80211: P2P Listen offload stop reason: %d",
3204 event.p2p_lo_stop.reason_code);
3205 wpa_supplicant_event(drv->ctx, EVENT_P2P_LO_STOP, &event);
3206 }
3207
3208
3209 #ifdef CONFIG_PASN
3210
qca_nl80211_pasn_auth(struct wpa_driver_nl80211_data * drv,u8 * data,size_t len)3211 static void qca_nl80211_pasn_auth(struct wpa_driver_nl80211_data *drv,
3212 u8 *data, size_t len)
3213 {
3214 int ret = -EINVAL;
3215 struct nlattr *attr;
3216 struct nlattr *tb[QCA_WLAN_VENDOR_ATTR_MAX + 1];
3217 struct nlattr *cfg[QCA_WLAN_VENDOR_ATTR_PASN_PEER_MAX + 1];
3218 unsigned int n_peers = 0, idx = 0;
3219 int rem_conf;
3220 enum qca_wlan_vendor_pasn_action action;
3221 union wpa_event_data event;
3222
3223 if (nla_parse(tb, QCA_WLAN_VENDOR_ATTR_PASN_MAX,
3224 (struct nlattr *) data, len, NULL) ||
3225 !tb[QCA_WLAN_VENDOR_ATTR_PASN_PEERS] ||
3226 !tb[QCA_WLAN_VENDOR_ATTR_PASN_ACTION]) {
3227 return;
3228 }
3229
3230 os_memset(&event, 0, sizeof(event));
3231 action = nla_get_u32(tb[QCA_WLAN_VENDOR_ATTR_PASN_ACTION]);
3232 switch (action) {
3233 case QCA_WLAN_VENDOR_PASN_ACTION_AUTH:
3234 event.pasn_auth.action = PASN_ACTION_AUTH;
3235 break;
3236 case QCA_WLAN_VENDOR_PASN_ACTION_DELETE_SECURE_RANGING_CONTEXT:
3237 event.pasn_auth.action =
3238 PASN_ACTION_DELETE_SECURE_RANGING_CONTEXT;
3239 break;
3240 default:
3241 return;
3242 }
3243
3244 nla_for_each_nested(attr, tb[QCA_WLAN_VENDOR_ATTR_PASN_PEERS], rem_conf)
3245 n_peers++;
3246
3247 if (n_peers > WPAS_MAX_PASN_PEERS) {
3248 wpa_printf(MSG_DEBUG, "nl80211: PASN auth: too many peers (%d)",
3249 n_peers);
3250 return;
3251 }
3252
3253 nla_for_each_nested(attr, tb[QCA_WLAN_VENDOR_ATTR_PASN_PEERS],
3254 rem_conf) {
3255 struct nlattr *nl_src, *nl_peer;
3256
3257 ret = nla_parse_nested(cfg, QCA_WLAN_VENDOR_ATTR_PASN_PEER_MAX,
3258 attr, NULL);
3259 if (ret)
3260 return;
3261 nl_src = cfg[QCA_WLAN_VENDOR_ATTR_PASN_PEER_SRC_ADDR];
3262 nl_peer = cfg[QCA_WLAN_VENDOR_ATTR_PASN_PEER_MAC_ADDR];
3263 if (nl_src)
3264 os_memcpy(event.pasn_auth.peer[idx].own_addr,
3265 nla_data(nl_src), ETH_ALEN);
3266 if (nl_peer)
3267 os_memcpy(event.pasn_auth.peer[idx].peer_addr,
3268 nla_data(nl_peer), ETH_ALEN);
3269 if (cfg[QCA_WLAN_VENDOR_ATTR_PASN_PEER_LTF_KEYSEED_REQUIRED])
3270 event.pasn_auth.peer[idx].ltf_keyseed_required = true;
3271 idx++;
3272 }
3273 event.pasn_auth.num_peers = n_peers;
3274
3275 wpa_printf(MSG_DEBUG,
3276 "nl80211: PASN auth action: %u, num_bssids: %d",
3277 event.pasn_auth.action,
3278 event.pasn_auth.num_peers);
3279 wpa_supplicant_event(drv->ctx, EVENT_PASN_AUTH, &event);
3280 }
3281
3282 #endif /* CONFIG_PASN */
3283
3284 #endif /* CONFIG_DRIVER_NL80211_QCA */
3285
3286
nl80211_vendor_event_qca(struct wpa_driver_nl80211_data * drv,u32 subcmd,u8 * data,size_t len)3287 static void nl80211_vendor_event_qca(struct wpa_driver_nl80211_data *drv,
3288 u32 subcmd, u8 *data, size_t len)
3289 {
3290 switch (subcmd) {
3291 case QCA_NL80211_VENDOR_SUBCMD_TEST:
3292 wpa_hexdump(MSG_DEBUG, "nl80211: QCA test event", data, len);
3293 break;
3294 #ifdef CONFIG_DRIVER_NL80211_QCA
3295 case QCA_NL80211_VENDOR_SUBCMD_AVOID_FREQUENCY:
3296 qca_nl80211_avoid_freq(drv, data, len);
3297 break;
3298 case QCA_NL80211_VENDOR_SUBCMD_KEY_MGMT_ROAM_AUTH:
3299 qca_nl80211_key_mgmt_auth_handler(drv, data, len);
3300 break;
3301 case QCA_NL80211_VENDOR_SUBCMD_DO_ACS:
3302 qca_nl80211_acs_select_ch(drv, data, len);
3303 break;
3304 case QCA_NL80211_VENDOR_SUBCMD_DFS_OFFLOAD_CAC_STARTED:
3305 case QCA_NL80211_VENDOR_SUBCMD_DFS_OFFLOAD_CAC_FINISHED:
3306 case QCA_NL80211_VENDOR_SUBCMD_DFS_OFFLOAD_CAC_ABORTED:
3307 case QCA_NL80211_VENDOR_SUBCMD_DFS_OFFLOAD_CAC_NOP_FINISHED:
3308 case QCA_NL80211_VENDOR_SUBCMD_DFS_OFFLOAD_RADAR_DETECTED:
3309 qca_nl80211_dfs_offload_radar_event(drv, subcmd, data, len);
3310 break;
3311 case QCA_NL80211_VENDOR_SUBCMD_TRIGGER_SCAN:
3312 qca_nl80211_scan_trigger_event(drv, data, len);
3313 break;
3314 case QCA_NL80211_VENDOR_SUBCMD_SCAN_DONE:
3315 qca_nl80211_scan_done_event(drv, data, len);
3316 break;
3317 case QCA_NL80211_VENDOR_SUBCMD_P2P_LISTEN_OFFLOAD_STOP:
3318 qca_nl80211_p2p_lo_stop_event(drv, data, len);
3319 break;
3320 #ifdef CONFIG_PASN
3321 case QCA_NL80211_VENDOR_SUBCMD_PASN:
3322 qca_nl80211_pasn_auth(drv, data, len);
3323 break;
3324 #endif /* CONFIG_PASN */
3325 case QCA_NL80211_VENDOR_SUBCMD_TID_TO_LINK_MAP:
3326 qca_nl80211_tid_to_link_map_event(drv, data, len);
3327 break;
3328 case QCA_NL80211_VENDOR_SUBCMD_LINK_RECONFIG:
3329 qca_nl80211_link_reconfig_event(drv, data, len);
3330 break;
3331 #endif /* CONFIG_DRIVER_NL80211_QCA */
3332 default:
3333 wpa_printf(MSG_DEBUG,
3334 "nl80211: Ignore unsupported QCA vendor event %u",
3335 subcmd);
3336 break;
3337 }
3338 }
3339
3340
3341 #if defined(CONFIG_DRIVER_NL80211_BRCM) || defined(CONFIG_DRIVER_NL80211_SYNA)
3342
brcm_nl80211_acs_select_ch(struct wpa_driver_nl80211_data * drv,const u8 * data,size_t len)3343 static void brcm_nl80211_acs_select_ch(struct wpa_driver_nl80211_data *drv,
3344 const u8 *data, size_t len)
3345 {
3346 struct nlattr *tb[BRCM_VENDOR_ATTR_ACS_LAST + 1];
3347 union wpa_event_data event;
3348
3349 wpa_printf(MSG_DEBUG,
3350 "nl80211: BRCM ACS channel selection vendor event received");
3351
3352 if (nla_parse(tb, BRCM_VENDOR_ATTR_ACS_LAST, (struct nlattr *) data,
3353 len, NULL) ||
3354 !tb[BRCM_VENDOR_ATTR_ACS_PRIMARY_FREQ] ||
3355 !tb[BRCM_VENDOR_ATTR_ACS_SECONDARY_FREQ])
3356 return;
3357
3358 os_memset(&event, 0, sizeof(event));
3359 if (tb[BRCM_VENDOR_ATTR_ACS_PRIMARY_FREQ])
3360 event.acs_selected_channels.pri_freq =
3361 nla_get_u32(tb[BRCM_VENDOR_ATTR_ACS_PRIMARY_FREQ]);
3362 if (tb[BRCM_VENDOR_ATTR_ACS_SECONDARY_FREQ])
3363 event.acs_selected_channels.sec_freq =
3364 nla_get_u32(tb[BRCM_VENDOR_ATTR_ACS_SECONDARY_FREQ]);
3365 if (tb[BRCM_VENDOR_ATTR_ACS_VHT_SEG0_CENTER_CHANNEL])
3366 event.acs_selected_channels.vht_seg0_center_ch =
3367 nla_get_u8(tb[BRCM_VENDOR_ATTR_ACS_VHT_SEG0_CENTER_CHANNEL]);
3368 if (tb[BRCM_VENDOR_ATTR_ACS_VHT_SEG0_CENTER_CHANNEL])
3369 event.acs_selected_channels.vht_seg1_center_ch =
3370 nla_get_u8(tb[BRCM_VENDOR_ATTR_ACS_VHT_SEG1_CENTER_CHANNEL]);
3371 if (tb[BRCM_VENDOR_ATTR_ACS_CHWIDTH])
3372 event.acs_selected_channels.ch_width =
3373 nla_get_u16(tb[BRCM_VENDOR_ATTR_ACS_CHWIDTH]);
3374 if (tb[BRCM_VENDOR_ATTR_ACS_HW_MODE]) {
3375 event.acs_selected_channels.hw_mode = nla_get_u8(tb[BRCM_VENDOR_ATTR_ACS_HW_MODE]);
3376 if (event.acs_selected_channels.hw_mode == NUM_HOSTAPD_MODES ||
3377 event.acs_selected_channels.hw_mode ==
3378 HOSTAPD_MODE_IEEE80211ANY) {
3379 wpa_printf(MSG_DEBUG,
3380 "nl80211: Invalid hw_mode %d in ACS selection event",
3381 event.acs_selected_channels.hw_mode);
3382 return;
3383 }
3384 }
3385
3386 wpa_printf(MSG_DEBUG,
3387 "nl80211: ACS Results: PCH: %d SCH: %d BW: %d VHT0: %d VHT1: %d HW_MODE: %d",
3388 event.acs_selected_channels.pri_freq,
3389 event.acs_selected_channels.sec_freq,
3390 event.acs_selected_channels.ch_width,
3391 event.acs_selected_channels.vht_seg0_center_ch,
3392 event.acs_selected_channels.vht_seg1_center_ch,
3393 event.acs_selected_channels.hw_mode);
3394 wpa_supplicant_event(drv->ctx, EVENT_ACS_CHANNEL_SELECTED, &event);
3395 }
3396
3397
nl80211_vendor_event_brcm(struct wpa_driver_nl80211_data * drv,u32 subcmd,u8 * data,size_t len)3398 static void nl80211_vendor_event_brcm(struct wpa_driver_nl80211_data *drv,
3399 u32 subcmd, u8 *data, size_t len)
3400 {
3401 wpa_printf(MSG_DEBUG, "nl80211: Got BRCM vendor event %u", subcmd);
3402 switch (subcmd) {
3403 case BRCM_VENDOR_EVENT_PRIV_STR:
3404 case BRCM_VENDOR_EVENT_HANGED:
3405 /* Dump the event on to the console */
3406 wpa_msg(NULL, MSG_INFO, "%s", data);
3407 break;
3408 case BRCM_VENDOR_EVENT_ACS:
3409 brcm_nl80211_acs_select_ch(drv, data, len);
3410 break;
3411 default:
3412 wpa_printf(MSG_DEBUG,
3413 "%s: Ignore unsupported BRCM vendor event %u",
3414 __func__, subcmd);
3415 break;
3416 }
3417 }
3418
3419 #endif /* CONFIG_DRIVER_NL80211_BRCM || CONFIG_DRIVER_NL80211_SYNA */
3420
3421
nl80211_vendor_event(struct wpa_driver_nl80211_data * drv,struct nlattr ** tb)3422 static void nl80211_vendor_event(struct wpa_driver_nl80211_data *drv,
3423 struct nlattr **tb)
3424 {
3425 u32 vendor_id, subcmd, wiphy = 0;
3426 int wiphy_idx;
3427 u8 *data = NULL;
3428 size_t len = 0;
3429
3430 if (!tb[NL80211_ATTR_VENDOR_ID] ||
3431 !tb[NL80211_ATTR_VENDOR_SUBCMD])
3432 return;
3433
3434 vendor_id = nla_get_u32(tb[NL80211_ATTR_VENDOR_ID]);
3435 subcmd = nla_get_u32(tb[NL80211_ATTR_VENDOR_SUBCMD]);
3436
3437 if (tb[NL80211_ATTR_WIPHY])
3438 wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
3439
3440 wpa_printf(MSG_DEBUG, "nl80211: Vendor event: wiphy=%u vendor_id=0x%x subcmd=%u",
3441 wiphy, vendor_id, subcmd);
3442
3443 if (tb[NL80211_ATTR_VENDOR_DATA]) {
3444 data = nla_data(tb[NL80211_ATTR_VENDOR_DATA]);
3445 len = nla_len(tb[NL80211_ATTR_VENDOR_DATA]);
3446 wpa_hexdump(MSG_MSGDUMP, "nl80211: Vendor data", data, len);
3447 }
3448
3449 wiphy_idx = nl80211_get_wiphy_index(drv->first_bss);
3450 if (wiphy_idx >= 0 && wiphy_idx != (int) wiphy) {
3451 wpa_printf(MSG_DEBUG, "nl80211: Ignore vendor event for foreign wiphy %u (own: %d)",
3452 wiphy, wiphy_idx);
3453 return;
3454 }
3455
3456 #ifdef ANDROID
3457 #ifdef ANDROID_LIB_EVENT
3458 /* Postpone QCA roam+auth event indication to the point when both that
3459 * and the NL80211_CMD_ROAM event have been received (see calls to
3460 * qca_nl80211_key_mgmt_auth() and drv->pending_roam_data). */
3461 if (!(vendor_id == OUI_QCA &&
3462 subcmd == QCA_NL80211_VENDOR_SUBCMD_KEY_MGMT_ROAM_AUTH))
3463 wpa_driver_nl80211_driver_event(drv, vendor_id, subcmd, data,
3464 len);
3465 #endif /* ANDROID_LIB_EVENT */
3466 #endif /* ANDROID */
3467
3468 switch (vendor_id) {
3469 case OUI_QCA:
3470 nl80211_vendor_event_qca(drv, subcmd, data, len);
3471 break;
3472 #if defined(CONFIG_DRIVER_NL80211_BRCM) || defined(CONFIG_DRIVER_NL80211_SYNA)
3473 case OUI_BRCM:
3474 nl80211_vendor_event_brcm(drv, subcmd, data, len);
3475 break;
3476 #endif /* CONFIG_DRIVER_NL80211_BRCM || CONFIG_DRIVER_NL80211_SYNA */
3477 default:
3478 wpa_printf(MSG_DEBUG, "nl80211: Ignore unsupported vendor event");
3479 break;
3480 }
3481 }
3482
3483
nl80211_reg_change_event(struct wpa_driver_nl80211_data * drv,struct nlattr * tb[])3484 static void nl80211_reg_change_event(struct wpa_driver_nl80211_data *drv,
3485 struct nlattr *tb[])
3486 {
3487 union wpa_event_data data;
3488 enum nl80211_reg_initiator init;
3489
3490 wpa_printf(MSG_DEBUG, "nl80211: Regulatory domain change");
3491
3492 if (tb[NL80211_ATTR_REG_INITIATOR] == NULL)
3493 return;
3494
3495 os_memset(&data, 0, sizeof(data));
3496 init = nla_get_u8(tb[NL80211_ATTR_REG_INITIATOR]);
3497 wpa_printf(MSG_DEBUG, " * initiator=%d", init);
3498 switch (init) {
3499 case NL80211_REGDOM_SET_BY_CORE:
3500 data.channel_list_changed.initiator = REGDOM_SET_BY_CORE;
3501 break;
3502 case NL80211_REGDOM_SET_BY_USER:
3503 data.channel_list_changed.initiator = REGDOM_SET_BY_USER;
3504 break;
3505 case NL80211_REGDOM_SET_BY_DRIVER:
3506 data.channel_list_changed.initiator = REGDOM_SET_BY_DRIVER;
3507 break;
3508 case NL80211_REGDOM_SET_BY_COUNTRY_IE:
3509 data.channel_list_changed.initiator = REGDOM_SET_BY_COUNTRY_IE;
3510 break;
3511 }
3512
3513 if (tb[NL80211_ATTR_REG_TYPE]) {
3514 enum nl80211_reg_type type;
3515 type = nla_get_u8(tb[NL80211_ATTR_REG_TYPE]);
3516 wpa_printf(MSG_DEBUG, " * type=%d", type);
3517 switch (type) {
3518 case NL80211_REGDOM_TYPE_COUNTRY:
3519 data.channel_list_changed.type = REGDOM_TYPE_COUNTRY;
3520 break;
3521 case NL80211_REGDOM_TYPE_WORLD:
3522 data.channel_list_changed.type = REGDOM_TYPE_WORLD;
3523 break;
3524 case NL80211_REGDOM_TYPE_CUSTOM_WORLD:
3525 data.channel_list_changed.type =
3526 REGDOM_TYPE_CUSTOM_WORLD;
3527 break;
3528 case NL80211_REGDOM_TYPE_INTERSECTION:
3529 data.channel_list_changed.type =
3530 REGDOM_TYPE_INTERSECTION;
3531 break;
3532 }
3533 }
3534
3535 if (tb[NL80211_ATTR_REG_ALPHA2]) {
3536 os_strlcpy(data.channel_list_changed.alpha2,
3537 nla_get_string(tb[NL80211_ATTR_REG_ALPHA2]),
3538 sizeof(data.channel_list_changed.alpha2));
3539 wpa_printf(MSG_DEBUG, " * alpha2=%s",
3540 data.channel_list_changed.alpha2);
3541 }
3542
3543 wpa_supplicant_event(drv->ctx, EVENT_CHANNEL_LIST_CHANGED, &data);
3544 }
3545
3546
nl80211_parse_freq_attrs(const char * title,struct nlattr * nl_freq,struct frequency_attrs * attrs)3547 static void nl80211_parse_freq_attrs(const char *title, struct nlattr *nl_freq,
3548 struct frequency_attrs *attrs)
3549 {
3550 static struct nla_policy freq_policy[NL80211_FREQUENCY_ATTR_MAX + 1] = {
3551 [NL80211_FREQUENCY_ATTR_FREQ] = { .type = NLA_U32 },
3552 [NL80211_FREQUENCY_ATTR_DISABLED] = { .type = NLA_FLAG },
3553 [NL80211_FREQUENCY_ATTR_NO_IR] = { .type = NLA_FLAG },
3554 [NL80211_FREQUENCY_ATTR_RADAR] = { .type = NLA_FLAG },
3555 [NL80211_FREQUENCY_ATTR_MAX_TX_POWER] = { .type = NLA_U32 },
3556 };
3557 struct nlattr *tb[NL80211_FREQUENCY_ATTR_MAX + 1];
3558 u32 freq = 0, max_tx_power = 0;
3559
3560 nla_parse(tb, NL80211_FREQUENCY_ATTR_MAX,
3561 nla_data(nl_freq), nla_len(nl_freq), freq_policy);
3562
3563 if (tb[NL80211_FREQUENCY_ATTR_FREQ])
3564 freq = nla_get_u32(tb[NL80211_FREQUENCY_ATTR_FREQ]);
3565 if (tb[NL80211_FREQUENCY_ATTR_MAX_TX_POWER])
3566 max_tx_power =
3567 nla_get_u32(tb[NL80211_FREQUENCY_ATTR_MAX_TX_POWER]);
3568
3569 wpa_printf(MSG_DEBUG,
3570 "nl80211: Channel (%s): freq=%u max_tx_power=%u%s%s%s",
3571 title, freq, max_tx_power,
3572 tb[NL80211_FREQUENCY_ATTR_DISABLED] ? " disabled" : "",
3573 tb[NL80211_FREQUENCY_ATTR_NO_IR] ? " no-IR" : "",
3574 tb[NL80211_FREQUENCY_ATTR_RADAR] ? " radar" : "");
3575
3576 attrs->freq = freq;
3577 attrs->max_tx_power = max_tx_power;
3578 if (tb[NL80211_FREQUENCY_ATTR_DISABLED])
3579 attrs->disabled = true;
3580 if (tb[NL80211_FREQUENCY_ATTR_NO_IR])
3581 attrs->no_ir = true;
3582 if (tb[NL80211_FREQUENCY_ATTR_RADAR])
3583 attrs->radar = true;
3584 }
3585
3586
nl80211_reg_beacon_hint_event(struct wpa_driver_nl80211_data * drv,struct nlattr * tb[])3587 static void nl80211_reg_beacon_hint_event(struct wpa_driver_nl80211_data *drv,
3588 struct nlattr *tb[])
3589 {
3590 union wpa_event_data data;
3591
3592 wpa_printf(MSG_DEBUG, "nl80211: Regulatory beacon hint");
3593 os_memset(&data, 0, sizeof(data));
3594 data.channel_list_changed.initiator = REGDOM_BEACON_HINT;
3595
3596 if (tb[NL80211_ATTR_FREQ_BEFORE])
3597 nl80211_parse_freq_attrs(
3598 "before", tb[NL80211_ATTR_FREQ_BEFORE],
3599 &data.channel_list_changed.beacon_hint_before);
3600 if (tb[NL80211_ATTR_FREQ_AFTER])
3601 nl80211_parse_freq_attrs(
3602 "after", tb[NL80211_ATTR_FREQ_AFTER],
3603 &data.channel_list_changed.beacon_hint_after);
3604
3605 wpa_supplicant_event(drv->ctx, EVENT_CHANNEL_LIST_CHANGED, &data);
3606 }
3607
3608
nl80211_external_auth(struct wpa_driver_nl80211_data * drv,struct nlattr ** tb)3609 static void nl80211_external_auth(struct wpa_driver_nl80211_data *drv,
3610 struct nlattr **tb)
3611 {
3612 union wpa_event_data event;
3613 enum nl80211_external_auth_action act;
3614 char mld_addr[50];
3615
3616 if (!tb[NL80211_ATTR_AKM_SUITES] ||
3617 !tb[NL80211_ATTR_EXTERNAL_AUTH_ACTION] ||
3618 !tb[NL80211_ATTR_BSSID] ||
3619 !tb[NL80211_ATTR_SSID])
3620 return;
3621
3622 os_memset(&event, 0, sizeof(event));
3623 act = nla_get_u32(tb[NL80211_ATTR_EXTERNAL_AUTH_ACTION]);
3624 switch (act) {
3625 case NL80211_EXTERNAL_AUTH_START:
3626 event.external_auth.action = EXT_AUTH_START;
3627 break;
3628 case NL80211_EXTERNAL_AUTH_ABORT:
3629 event.external_auth.action = EXT_AUTH_ABORT;
3630 break;
3631 default:
3632 return;
3633 }
3634
3635 event.external_auth.key_mgmt_suite =
3636 nla_get_u32(tb[NL80211_ATTR_AKM_SUITES]);
3637
3638 event.external_auth.ssid_len = nla_len(tb[NL80211_ATTR_SSID]);
3639 if (event.external_auth.ssid_len > SSID_MAX_LEN)
3640 return;
3641 event.external_auth.ssid = nla_data(tb[NL80211_ATTR_SSID]);
3642
3643 event.external_auth.bssid = nla_data(tb[NL80211_ATTR_BSSID]);
3644
3645 mld_addr[0] = '\0';
3646 if (tb[NL80211_ATTR_MLD_ADDR]) {
3647 event.external_auth.mld_addr =
3648 nla_data(tb[NL80211_ATTR_MLD_ADDR]);
3649 os_snprintf(mld_addr, sizeof(mld_addr), ", MLD ADDR: " MACSTR,
3650 MAC2STR(event.external_auth.mld_addr));
3651 }
3652
3653 wpa_printf(MSG_DEBUG,
3654 "nl80211: External auth action: %u, AKM: 0x%x, SSID: %s, BSSID: " MACSTR "%s",
3655 event.external_auth.action,
3656 event.external_auth.key_mgmt_suite,
3657 wpa_ssid_txt(event.external_auth.ssid,
3658 event.external_auth.ssid_len),
3659 MAC2STR(event.external_auth.bssid), mld_addr);
3660 wpa_supplicant_event(drv->ctx, EVENT_EXTERNAL_AUTH, &event);
3661 }
3662
3663
nl80211_port_authorized(struct wpa_driver_nl80211_data * drv,struct nlattr ** tb)3664 static void nl80211_port_authorized(struct wpa_driver_nl80211_data *drv,
3665 struct nlattr **tb)
3666 {
3667 const u8 *addr;
3668 union wpa_event_data event;
3669
3670 os_memset(&event, 0, sizeof(event));
3671
3672 if (!tb[NL80211_ATTR_MAC] ||
3673 nla_len(tb[NL80211_ATTR_MAC]) != ETH_ALEN) {
3674 wpa_printf(MSG_DEBUG,
3675 "nl80211: Ignore port authorized event without BSSID");
3676 return;
3677 }
3678
3679 addr = nla_data(tb[NL80211_ATTR_MAC]);
3680 if (is_ap_interface(drv->nlmode) && drv->device_ap_sme) {
3681 event.port_authorized.sta_addr = addr;
3682 wpa_printf(MSG_DEBUG,
3683 "nl80211: Port authorized for STA addr " MACSTR,
3684 MAC2STR(addr));
3685 } else if (is_sta_interface(drv->nlmode)) {
3686 const u8 *connected_addr;
3687
3688 connected_addr = drv->sta_mlo_info.valid_links ?
3689 drv->sta_mlo_info.ap_mld_addr : drv->bssid;
3690 if (!ether_addr_equal(addr, connected_addr)) {
3691 wpa_printf(MSG_DEBUG,
3692 "nl80211: Ignore port authorized event for "
3693 MACSTR " (not the currently connected BSSID "
3694 MACSTR ")",
3695 MAC2STR(addr), MAC2STR(connected_addr));
3696 return;
3697 }
3698 }
3699
3700 if (tb[NL80211_ATTR_TD_BITMAP]) {
3701 event.port_authorized.td_bitmap_len =
3702 nla_len(tb[NL80211_ATTR_TD_BITMAP]);
3703 if (event.port_authorized.td_bitmap_len > 0)
3704 event.port_authorized.td_bitmap =
3705 nla_data(tb[NL80211_ATTR_TD_BITMAP]);
3706 }
3707
3708 wpa_supplicant_event(drv->ctx, EVENT_PORT_AUTHORIZED, &event);
3709 }
3710
3711
nl80211_sta_opmode_change_event(struct wpa_driver_nl80211_data * drv,struct nlattr ** tb)3712 static void nl80211_sta_opmode_change_event(struct wpa_driver_nl80211_data *drv,
3713 struct nlattr **tb)
3714 {
3715 union wpa_event_data ed;
3716 u8 smps_mode, max_bw;
3717
3718 if (!tb[NL80211_ATTR_MAC] ||
3719 (!tb[NL80211_ATTR_CHANNEL_WIDTH] &&
3720 !tb[NL80211_ATTR_SMPS_MODE] &&
3721 !tb[NL80211_ATTR_NSS]))
3722 return;
3723
3724 ed.sta_opmode.smps_mode = SMPS_INVALID;
3725 ed.sta_opmode.chan_width = CHAN_WIDTH_UNKNOWN;
3726 ed.sta_opmode.rx_nss = 0xff;
3727 ed.sta_opmode.addr = nla_data(tb[NL80211_ATTR_MAC]);
3728
3729 if (tb[NL80211_ATTR_SMPS_MODE]) {
3730 smps_mode = nla_get_u8(tb[NL80211_ATTR_SMPS_MODE]);
3731 switch (smps_mode) {
3732 case NL80211_SMPS_OFF:
3733 ed.sta_opmode.smps_mode = SMPS_OFF;
3734 break;
3735 case NL80211_SMPS_STATIC:
3736 ed.sta_opmode.smps_mode = SMPS_STATIC;
3737 break;
3738 case NL80211_SMPS_DYNAMIC:
3739 ed.sta_opmode.smps_mode = SMPS_DYNAMIC;
3740 break;
3741 default:
3742 ed.sta_opmode.smps_mode = SMPS_INVALID;
3743 break;
3744 }
3745 }
3746
3747 if (tb[NL80211_ATTR_CHANNEL_WIDTH]) {
3748 max_bw = nla_get_u32(tb[NL80211_ATTR_CHANNEL_WIDTH]);
3749 switch (max_bw) {
3750 case NL80211_CHAN_WIDTH_20_NOHT:
3751 ed.sta_opmode.chan_width = CHAN_WIDTH_20_NOHT;
3752 break;
3753 case NL80211_CHAN_WIDTH_20:
3754 ed.sta_opmode.chan_width = CHAN_WIDTH_20;
3755 break;
3756 case NL80211_CHAN_WIDTH_40:
3757 ed.sta_opmode.chan_width = CHAN_WIDTH_40;
3758 break;
3759 case NL80211_CHAN_WIDTH_80:
3760 ed.sta_opmode.chan_width = CHAN_WIDTH_80;
3761 break;
3762 case NL80211_CHAN_WIDTH_80P80:
3763 ed.sta_opmode.chan_width = CHAN_WIDTH_80P80;
3764 break;
3765 case NL80211_CHAN_WIDTH_160:
3766 ed.sta_opmode.chan_width = CHAN_WIDTH_160;
3767 break;
3768 case NL80211_CHAN_WIDTH_320:
3769 ed.sta_opmode.chan_width = CHAN_WIDTH_320;
3770 break;
3771 default:
3772 ed.sta_opmode.chan_width = CHAN_WIDTH_UNKNOWN;
3773 break;
3774
3775 }
3776 }
3777
3778 if (tb[NL80211_ATTR_NSS])
3779 ed.sta_opmode.rx_nss = nla_get_u8(tb[NL80211_ATTR_NSS]);
3780
3781 wpa_supplicant_event(drv->ctx, EVENT_STATION_OPMODE_CHANGED, &ed);
3782 }
3783
3784
nl80211_control_port_frame(struct i802_bss * bss,struct nlattr ** tb)3785 static void nl80211_control_port_frame(struct i802_bss *bss, struct nlattr **tb)
3786 {
3787 u8 *src_addr;
3788 u16 ethertype;
3789 enum frame_encryption encrypted;
3790 int link_id;
3791
3792 if (!tb[NL80211_ATTR_MAC] ||
3793 !tb[NL80211_ATTR_FRAME] ||
3794 !tb[NL80211_ATTR_CONTROL_PORT_ETHERTYPE])
3795 return;
3796
3797 src_addr = nla_data(tb[NL80211_ATTR_MAC]);
3798 ethertype = nla_get_u16(tb[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
3799 encrypted = nla_get_flag(tb[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]) ?
3800 FRAME_NOT_ENCRYPTED : FRAME_ENCRYPTED;
3801
3802 if (tb[NL80211_ATTR_MLO_LINK_ID])
3803 link_id = nla_get_u8(tb[NL80211_ATTR_MLO_LINK_ID]);
3804 else
3805 link_id = -1;
3806
3807 switch (ethertype) {
3808 case ETH_P_RSN_PREAUTH:
3809 wpa_printf(MSG_INFO, "nl80211: Got pre-auth frame from "
3810 MACSTR " over control port unexpectedly",
3811 MAC2STR(src_addr));
3812 break;
3813 case ETH_P_PAE:
3814 drv_event_eapol_rx2(bss->ctx, src_addr,
3815 nla_data(tb[NL80211_ATTR_FRAME]),
3816 nla_len(tb[NL80211_ATTR_FRAME]),
3817 encrypted, link_id);
3818 break;
3819 default:
3820 wpa_printf(MSG_INFO,
3821 "nl80211: Unexpected ethertype 0x%04x from "
3822 MACSTR " over control port",
3823 ethertype, MAC2STR(src_addr));
3824 break;
3825 }
3826 }
3827
3828
3829 static void
nl80211_control_port_frame_tx_status(struct i802_bss * bss,const u8 * frame,size_t len,struct nlattr * ack,struct nlattr * cookie)3830 nl80211_control_port_frame_tx_status(struct i802_bss *bss,
3831 const u8 *frame, size_t len,
3832 struct nlattr *ack, struct nlattr *cookie)
3833 {
3834 struct wpa_driver_nl80211_data *drv = bss->drv;
3835 union wpa_event_data event;
3836
3837 if (!cookie || len < ETH_HLEN)
3838 return;
3839
3840 wpa_printf(MSG_DEBUG,
3841 "nl80211: Control port TX status (ack=%d), cookie=%llu",
3842 ack != NULL, (long long unsigned int) nla_get_u64(cookie));
3843
3844 os_memset(&event, 0, sizeof(event));
3845 event.eapol_tx_status.dst = frame;
3846 event.eapol_tx_status.data = frame + ETH_HLEN;
3847 event.eapol_tx_status.data_len = len - ETH_HLEN;
3848 event.eapol_tx_status.ack = ack != NULL;
3849 event.eapol_tx_status.link_id =
3850 nla_get_u64(cookie) == drv->eapol_tx_cookie ?
3851 drv->eapol_tx_link_id : NL80211_DRV_LINK_ID_NA;
3852
3853 wpa_supplicant_event(bss->ctx, EVENT_EAPOL_TX_STATUS, &event);
3854 }
3855
3856
nl80211_frame_wait_cancel(struct wpa_driver_nl80211_data * drv,struct nlattr * cookie_attr)3857 static void nl80211_frame_wait_cancel(struct wpa_driver_nl80211_data *drv,
3858 struct nlattr *cookie_attr)
3859 {
3860 unsigned int i;
3861 u64 cookie;
3862 bool match = false;
3863
3864 if (!cookie_attr)
3865 return;
3866 cookie = nla_get_u64(cookie_attr);
3867
3868 for (i = 0; i < drv->num_send_frame_cookies; i++) {
3869 if (cookie == drv->send_frame_cookies[i]) {
3870 match = true;
3871 break;
3872 }
3873 }
3874 wpa_printf(MSG_DEBUG,
3875 "nl80211: TX frame wait expired for cookie 0x%llx%s%s",
3876 (long long unsigned int) cookie,
3877 match ? " (match)" : "",
3878 drv->send_frame_cookie == cookie ? " (match-saved)" : "");
3879 if (drv->send_frame_cookie == cookie) {
3880 drv->send_frame_cookie = (u64) -1;
3881 if (!match)
3882 goto send_event;
3883 }
3884 if (!match)
3885 return;
3886
3887 if (i < drv->num_send_frame_cookies - 1)
3888 os_memmove(&drv->send_frame_cookies[i],
3889 &drv->send_frame_cookies[i + 1],
3890 (drv->num_send_frame_cookies - i - 1) * sizeof(u64));
3891 drv->num_send_frame_cookies--;
3892
3893 send_event:
3894 wpa_supplicant_event(drv->ctx, EVENT_TX_WAIT_EXPIRE, NULL);
3895 }
3896
3897
nl80211_assoc_comeback(struct wpa_driver_nl80211_data * drv,struct nlattr * mac,struct nlattr * timeout)3898 static void nl80211_assoc_comeback(struct wpa_driver_nl80211_data *drv,
3899 struct nlattr *mac, struct nlattr *timeout)
3900 {
3901 if (!mac || !timeout)
3902 return;
3903 wpa_printf(MSG_DEBUG, "nl80211: Association comeback requested by "
3904 MACSTR " (timeout: %u ms)",
3905 MAC2STR((u8 *) nla_data(mac)), nla_get_u32(timeout));
3906 }
3907
3908
3909 #ifdef CONFIG_IEEE80211AX
3910
nl80211_obss_color_event(struct i802_bss * bss,enum nl80211_commands cmd,struct nlattr * tb[])3911 static void nl80211_obss_color_event(struct i802_bss *bss,
3912 enum nl80211_commands cmd,
3913 struct nlattr *tb[])
3914 {
3915 union wpa_event_data data;
3916 enum wpa_event_type event_type;
3917
3918 os_memset(&data, 0, sizeof(data));
3919 data.bss_color_collision.link_id = NL80211_DRV_LINK_ID_NA;
3920
3921 switch (cmd) {
3922 case NL80211_CMD_OBSS_COLOR_COLLISION:
3923 event_type = EVENT_BSS_COLOR_COLLISION;
3924 if (!tb[NL80211_ATTR_OBSS_COLOR_BITMAP])
3925 return;
3926 data.bss_color_collision.bitmap =
3927 nla_get_u64(tb[NL80211_ATTR_OBSS_COLOR_BITMAP]);
3928 wpa_printf(MSG_DEBUG,
3929 "nl80211: BSS color collision - bitmap %08llx",
3930 (long long unsigned int)
3931 data.bss_color_collision.bitmap);
3932 break;
3933 case NL80211_CMD_COLOR_CHANGE_STARTED:
3934 event_type = EVENT_CCA_STARTED_NOTIFY;
3935 wpa_printf(MSG_DEBUG, "nl80211: CCA started");
3936 break;
3937 case NL80211_CMD_COLOR_CHANGE_ABORTED:
3938 event_type = EVENT_CCA_ABORTED_NOTIFY;
3939 wpa_printf(MSG_DEBUG, "nl80211: CCA aborted");
3940 break;
3941 case NL80211_CMD_COLOR_CHANGE_COMPLETED:
3942 event_type = EVENT_CCA_NOTIFY;
3943 wpa_printf(MSG_DEBUG, "nl80211: CCA completed");
3944 break;
3945 default:
3946 wpa_printf(MSG_DEBUG, "nl80211: Unknown CCA command %d", cmd);
3947 return;
3948 }
3949
3950 if (tb[NL80211_ATTR_MLO_LINK_ID]) {
3951 data.bss_color_collision.link_id =
3952 nla_get_u8(tb[NL80211_ATTR_MLO_LINK_ID]);
3953
3954 if (!nl80211_link_valid(bss->valid_links,
3955 data.bss_color_collision.link_id)) {
3956 wpa_printf(MSG_DEBUG,
3957 "nl80211: Invalid BSS color event link ID %d",
3958 data.bss_color_collision.link_id);
3959 return;
3960 }
3961
3962 wpa_printf(MSG_DEBUG, "nl80211: BSS color event - Link ID %d",
3963 data.bss_color_collision.link_id);
3964 }
3965
3966 wpa_supplicant_event(bss->ctx, event_type, &data);
3967 }
3968
3969 #endif /* CONFIG_IEEE80211AX */
3970
3971
do_process_drv_event(struct i802_bss * bss,int cmd,struct nlattr ** tb)3972 static void do_process_drv_event(struct i802_bss *bss, int cmd,
3973 struct nlattr **tb)
3974 {
3975 struct wpa_driver_nl80211_data *drv = bss->drv;
3976 int external_scan_event = 0;
3977 struct nlattr *frame = tb[NL80211_ATTR_FRAME];
3978
3979 wpa_printf(MSG_DEBUG, "nl80211: Drv Event %d (%s) received for %s",
3980 cmd, nl80211_command_to_string(cmd), bss->ifname);
3981
3982 #ifdef CONFIG_DRIVER_NL80211_QCA
3983 if (cmd == NL80211_CMD_ROAM &&
3984 (drv->capa.flags & WPA_DRIVER_FLAGS_KEY_MGMT_OFFLOAD)) {
3985 if (drv->pending_roam_data) {
3986 wpa_printf(MSG_DEBUG,
3987 "nl80211: Process pending roam+auth vendor event");
3988 qca_nl80211_key_mgmt_auth(drv, drv->pending_roam_data,
3989 drv->pending_roam_data_len);
3990 os_free(drv->pending_roam_data);
3991 drv->pending_roam_data = NULL;
3992 return;
3993 }
3994 /*
3995 * Device will use roam+auth vendor event to indicate
3996 * roaming, so ignore the regular roam event.
3997 */
3998 drv->roam_indication_done = true;
3999 wpa_printf(MSG_DEBUG,
4000 "nl80211: Ignore roam event (cmd=%d), device will use vendor event roam+auth",
4001 cmd);
4002 return;
4003 }
4004 #endif /* CONFIG_DRIVER_NL80211_QCA */
4005
4006 if (drv->ap_scan_as_station != NL80211_IFTYPE_UNSPECIFIED &&
4007 (cmd == NL80211_CMD_NEW_SCAN_RESULTS ||
4008 cmd == NL80211_CMD_SCAN_ABORTED))
4009 nl80211_restore_ap_mode(bss);
4010
4011 switch (cmd) {
4012 case NL80211_CMD_TRIGGER_SCAN:
4013 wpa_dbg(bss->ctx, MSG_DEBUG, "nl80211: Scan trigger");
4014 drv->scan_state = SCAN_STARTED;
4015 if (drv->scan_for_auth) {
4016 /*
4017 * Cannot indicate EVENT_SCAN_STARTED here since we skip
4018 * EVENT_SCAN_RESULTS in scan_for_auth case and the
4019 * upper layer implementation could get confused about
4020 * scanning state.
4021 */
4022 wpa_printf(MSG_DEBUG, "nl80211: Do not indicate scan-start event due to internal scan_for_auth");
4023 break;
4024 }
4025 wpa_supplicant_event(bss->ctx, EVENT_SCAN_STARTED, NULL);
4026 break;
4027 case NL80211_CMD_START_SCHED_SCAN:
4028 wpa_dbg(bss->ctx, MSG_DEBUG, "nl80211: Sched scan started");
4029 drv->scan_state = SCHED_SCAN_STARTED;
4030 break;
4031 case NL80211_CMD_SCHED_SCAN_STOPPED:
4032 wpa_dbg(bss->ctx, MSG_DEBUG, "nl80211: Sched scan stopped");
4033 drv->scan_state = SCHED_SCAN_STOPPED;
4034 wpa_supplicant_event(bss->ctx, EVENT_SCHED_SCAN_STOPPED, NULL);
4035 break;
4036 case NL80211_CMD_NEW_SCAN_RESULTS:
4037 wpa_dbg(bss->ctx, MSG_DEBUG,
4038 "nl80211: New scan results available");
4039 if (drv->last_scan_cmd != NL80211_CMD_VENDOR)
4040 drv->scan_state = SCAN_COMPLETED;
4041 drv->scan_complete_events = 1;
4042 if (drv->last_scan_cmd == NL80211_CMD_TRIGGER_SCAN) {
4043 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout,
4044 drv, bss->ctx);
4045 drv->last_scan_cmd = 0;
4046 } else {
4047 external_scan_event = 1;
4048 }
4049 send_scan_event(bss, 0, tb, external_scan_event);
4050 break;
4051 case NL80211_CMD_SCHED_SCAN_RESULTS:
4052 wpa_dbg(bss->ctx, MSG_DEBUG,
4053 "nl80211: New sched scan results available");
4054 drv->scan_state = SCHED_SCAN_RESULTS;
4055 send_scan_event(bss, 0, tb, 0);
4056 break;
4057 case NL80211_CMD_SCAN_ABORTED:
4058 wpa_dbg(bss->ctx, MSG_DEBUG, "nl80211: Scan aborted");
4059 if (drv->last_scan_cmd != NL80211_CMD_VENDOR)
4060 drv->scan_state = SCAN_ABORTED;
4061 if (drv->last_scan_cmd == NL80211_CMD_TRIGGER_SCAN) {
4062 /*
4063 * Need to indicate that scan results are available in
4064 * order not to make wpa_supplicant stop its scanning.
4065 */
4066 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout,
4067 drv, bss->ctx);
4068 drv->last_scan_cmd = 0;
4069 } else {
4070 external_scan_event = 1;
4071 }
4072 send_scan_event(bss, 1, tb, external_scan_event);
4073 break;
4074 case NL80211_CMD_AUTHENTICATE:
4075 case NL80211_CMD_ASSOCIATE:
4076 case NL80211_CMD_DEAUTHENTICATE:
4077 case NL80211_CMD_DISASSOCIATE:
4078 case NL80211_CMD_FRAME:
4079 case NL80211_CMD_FRAME_TX_STATUS:
4080 case NL80211_CMD_UNPROT_DEAUTHENTICATE:
4081 case NL80211_CMD_UNPROT_DISASSOCIATE:
4082 mlme_event(bss, cmd, tb[NL80211_ATTR_FRAME],
4083 tb[NL80211_ATTR_MAC], tb[NL80211_ATTR_TIMED_OUT],
4084 tb[NL80211_ATTR_WIPHY_FREQ], tb[NL80211_ATTR_ACK],
4085 tb[NL80211_ATTR_COOKIE],
4086 tb[NL80211_ATTR_RX_SIGNAL_DBM],
4087 tb[NL80211_ATTR_STA_WME],
4088 tb[NL80211_ATTR_REQ_IE],
4089 tb[NL80211_ATTR_MLO_LINK_ID]);
4090 break;
4091 case NL80211_CMD_CONNECT:
4092 case NL80211_CMD_ROAM:
4093 mlme_event_connect(drv, cmd, false,
4094 tb[NL80211_ATTR_STATUS_CODE],
4095 tb[NL80211_ATTR_MAC],
4096 tb[NL80211_ATTR_REQ_IE],
4097 tb[NL80211_ATTR_RESP_IE],
4098 tb[NL80211_ATTR_TIMED_OUT],
4099 tb[NL80211_ATTR_TIMEOUT_REASON],
4100 NULL, NULL, NULL,
4101 tb[NL80211_ATTR_FILS_KEK],
4102 NULL,
4103 tb[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM],
4104 tb[NL80211_ATTR_PMK],
4105 tb[NL80211_ATTR_PMKID],
4106 tb[NL80211_ATTR_MLO_LINKS]);
4107 break;
4108 case NL80211_CMD_CH_SWITCH_STARTED_NOTIFY:
4109 mlme_event_ch_switch(drv,
4110 tb[NL80211_ATTR_IFINDEX],
4111 tb[NL80211_ATTR_MLO_LINK_ID],
4112 tb[NL80211_ATTR_WIPHY_FREQ],
4113 tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE],
4114 tb[NL80211_ATTR_CHANNEL_WIDTH],
4115 tb[NL80211_ATTR_CENTER_FREQ1],
4116 tb[NL80211_ATTR_CENTER_FREQ2],
4117 tb[NL80211_ATTR_PUNCT_BITMAP],
4118 0);
4119 break;
4120 case NL80211_CMD_CH_SWITCH_NOTIFY:
4121 mlme_event_ch_switch(drv,
4122 tb[NL80211_ATTR_IFINDEX],
4123 tb[NL80211_ATTR_MLO_LINK_ID],
4124 tb[NL80211_ATTR_WIPHY_FREQ],
4125 tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE],
4126 tb[NL80211_ATTR_CHANNEL_WIDTH],
4127 tb[NL80211_ATTR_CENTER_FREQ1],
4128 tb[NL80211_ATTR_CENTER_FREQ2],
4129 tb[NL80211_ATTR_PUNCT_BITMAP],
4130 1);
4131 break;
4132 case NL80211_CMD_DISCONNECT:
4133 mlme_event_disconnect(drv, tb[NL80211_ATTR_REASON_CODE],
4134 tb[NL80211_ATTR_MAC],
4135 tb[NL80211_ATTR_DISCONNECTED_BY_AP]);
4136 break;
4137 case NL80211_CMD_MICHAEL_MIC_FAILURE:
4138 mlme_event_michael_mic_failure(bss, tb);
4139 break;
4140 case NL80211_CMD_JOIN_IBSS:
4141 mlme_event_join_ibss(drv, tb);
4142 break;
4143 case NL80211_CMD_REMAIN_ON_CHANNEL:
4144 mlme_event_remain_on_channel(drv, 0, tb);
4145 break;
4146 case NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL:
4147 mlme_event_remain_on_channel(drv, 1, tb);
4148 break;
4149 case NL80211_CMD_NOTIFY_CQM:
4150 nl80211_cqm_event(bss, tb);
4151 break;
4152 case NL80211_CMD_REG_CHANGE:
4153 case NL80211_CMD_WIPHY_REG_CHANGE:
4154 nl80211_reg_change_event(drv, tb);
4155 break;
4156 case NL80211_CMD_REG_BEACON_HINT:
4157 nl80211_reg_beacon_hint_event(drv, tb);
4158 break;
4159 case NL80211_CMD_NEW_STATION:
4160 nl80211_new_station_event(drv, bss, tb);
4161 break;
4162 case NL80211_CMD_DEL_STATION:
4163 nl80211_del_station_event(drv, bss, tb);
4164 break;
4165 case NL80211_CMD_SET_REKEY_OFFLOAD:
4166 nl80211_rekey_offload_event(drv, tb);
4167 break;
4168 case NL80211_CMD_PMKSA_CANDIDATE:
4169 nl80211_pmksa_candidate_event(drv, tb);
4170 break;
4171 case NL80211_CMD_PROBE_CLIENT:
4172 nl80211_client_probe_event(drv, tb);
4173 break;
4174 case NL80211_CMD_TDLS_OPER:
4175 nl80211_tdls_oper_event(drv, tb);
4176 break;
4177 case NL80211_CMD_CONN_FAILED:
4178 nl80211_connect_failed_event(drv, tb);
4179 break;
4180 case NL80211_CMD_FT_EVENT:
4181 mlme_event_ft_event(drv, tb);
4182 break;
4183 case NL80211_CMD_RADAR_DETECT:
4184 nl80211_radar_event(bss, tb);
4185 break;
4186 case NL80211_CMD_STOP_AP:
4187 nl80211_stop_ap(bss, tb);
4188 break;
4189 case NL80211_CMD_VENDOR:
4190 nl80211_vendor_event(drv, tb);
4191 break;
4192 case NL80211_CMD_NEW_PEER_CANDIDATE:
4193 nl80211_new_peer_candidate(drv, tb);
4194 break;
4195 case NL80211_CMD_PORT_AUTHORIZED:
4196 nl80211_port_authorized(drv, tb);
4197 break;
4198 case NL80211_CMD_STA_OPMODE_CHANGED:
4199 nl80211_sta_opmode_change_event(drv, tb);
4200 break;
4201 case NL80211_CMD_UPDATE_OWE_INFO:
4202 mlme_event_dh_event(drv, bss, tb);
4203 break;
4204 case NL80211_CMD_UNPROT_BEACON:
4205 if (frame)
4206 mlme_event_unprot_beacon(drv, nla_data(frame),
4207 nla_len(frame));
4208 break;
4209 case NL80211_CMD_CONTROL_PORT_FRAME_TX_STATUS:
4210 if (!frame)
4211 break;
4212 nl80211_control_port_frame_tx_status(bss,
4213 nla_data(frame),
4214 nla_len(frame),
4215 tb[NL80211_ATTR_ACK],
4216 tb[NL80211_ATTR_COOKIE]);
4217 break;
4218 case NL80211_CMD_FRAME_WAIT_CANCEL:
4219 nl80211_frame_wait_cancel(drv, tb[NL80211_ATTR_COOKIE]);
4220 break;
4221 case NL80211_CMD_ASSOC_COMEBACK:
4222 nl80211_assoc_comeback(drv, tb[NL80211_ATTR_MAC],
4223 tb[NL80211_ATTR_TIMEOUT]);
4224 break;
4225 #ifdef CONFIG_IEEE80211AX
4226 case NL80211_CMD_OBSS_COLOR_COLLISION:
4227 case NL80211_CMD_COLOR_CHANGE_STARTED:
4228 case NL80211_CMD_COLOR_CHANGE_ABORTED:
4229 case NL80211_CMD_COLOR_CHANGE_COMPLETED:
4230 nl80211_obss_color_event(bss, cmd, tb);
4231 break;
4232 #endif /* CONFIG_IEEE80211AX */
4233 case NL80211_CMD_LINKS_REMOVED:
4234 wpa_supplicant_event(drv->ctx, EVENT_LINK_RECONFIG, NULL);
4235 break;
4236 default:
4237 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: Ignored unknown event "
4238 "(cmd=%d)", cmd);
4239 break;
4240 }
4241 }
4242
4243
nl80211_drv_in_list(struct nl80211_global * global,struct wpa_driver_nl80211_data * drv)4244 static bool nl80211_drv_in_list(struct nl80211_global *global,
4245 struct wpa_driver_nl80211_data *drv)
4246 {
4247 struct wpa_driver_nl80211_data *tmp;
4248
4249 dl_list_for_each(tmp, &global->interfaces,
4250 struct wpa_driver_nl80211_data, list) {
4251 if (drv == tmp)
4252 return true;
4253 }
4254
4255 return false;
4256 }
4257
4258
process_global_event(struct nl_msg * msg,void * arg)4259 int process_global_event(struct nl_msg *msg, void *arg)
4260 {
4261 struct nl80211_global *global = arg;
4262 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
4263 struct nlattr *tb[NL80211_ATTR_MAX + 1];
4264 struct wpa_driver_nl80211_data *drv, *tmp;
4265 int ifidx = -1, wiphy_idx = -1, wiphy_idx_rx = -1;
4266 struct i802_bss *bss;
4267 u64 wdev_id = 0;
4268 int wdev_id_set = 0;
4269 int wiphy_idx_set = 0;
4270 bool processed = false;
4271
4272 /* Event marker, all prior events have been processed */
4273 if (gnlh->cmd == NL80211_CMD_GET_PROTOCOL_FEATURES) {
4274 u32 seq = nlmsg_hdr(msg)->nlmsg_seq;
4275
4276 dl_list_for_each_safe(drv, tmp, &global->interfaces,
4277 struct wpa_driver_nl80211_data, list) {
4278 if (drv->ignore_next_local_deauth > 0 &&
4279 drv->ignore_next_local_deauth <= seq) {
4280 wpa_printf(MSG_DEBUG,
4281 "nl80211: No DEAUTHENTICATE event was ignored");
4282 drv->ignore_next_local_deauth = 0;
4283 }
4284
4285 if (drv->ignore_next_local_disconnect > 0 &&
4286 drv->ignore_next_local_disconnect <= seq) {
4287 wpa_printf(MSG_DEBUG,
4288 "nl80211: No DISCONNECT event was ignored");
4289 drv->ignore_next_local_disconnect = 0;
4290 }
4291 }
4292
4293 return NL_SKIP;
4294 }
4295
4296 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
4297 genlmsg_attrlen(gnlh, 0), NULL);
4298
4299 if (tb[NL80211_ATTR_IFINDEX])
4300 ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
4301 else if (tb[NL80211_ATTR_WDEV]) {
4302 wdev_id = nla_get_u64(tb[NL80211_ATTR_WDEV]);
4303 wdev_id_set = 1;
4304 } else if (tb[NL80211_ATTR_WIPHY]) {
4305 wiphy_idx_rx = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
4306 wiphy_idx_set = 1;
4307 }
4308
4309 dl_list_for_each_safe(drv, tmp, &global->interfaces,
4310 struct wpa_driver_nl80211_data, list) {
4311 for (bss = drv->first_bss; bss; bss = bss->next) {
4312 if (wiphy_idx_set)
4313 wiphy_idx = nl80211_get_wiphy_index(bss);
4314 if ((ifidx == -1 && !wiphy_idx_set && !wdev_id_set) ||
4315 ifidx == bss->ifindex ||
4316 (wiphy_idx_set && wiphy_idx == wiphy_idx_rx) ||
4317 (wdev_id_set && bss->wdev_id_set &&
4318 wdev_id == bss->wdev_id)) {
4319 processed = true;
4320 do_process_drv_event(bss, gnlh->cmd, tb);
4321 /* There are two types of events that may need
4322 * to be delivered to multiple interfaces:
4323 * 1. Events for a wiphy, as it can have
4324 * multiple interfaces.
4325 * 2. "Global" events, like
4326 * NL80211_CMD_REG_CHANGE.
4327 *
4328 * Terminate early only if the event is directed
4329 * to a specific interface or wdev. */
4330 if (ifidx != -1 || wdev_id_set)
4331 return NL_SKIP;
4332 /* The driver instance could have been removed,
4333 * e.g., due to NL80211_CMD_RADAR_DETECT event,
4334 * so need to stop the loop if that has
4335 * happened. */
4336 if (!nl80211_drv_in_list(global, drv))
4337 break;
4338 }
4339 }
4340 }
4341
4342 if (processed)
4343 return NL_SKIP;
4344
4345 wpa_printf(MSG_DEBUG,
4346 "nl80211: Ignored event %d (%s) for foreign interface (ifindex %d wdev 0x%llx wiphy %d)",
4347 gnlh->cmd, nl80211_command_to_string(gnlh->cmd),
4348 ifidx, (long long unsigned int) wdev_id, wiphy_idx_rx);
4349
4350 return NL_SKIP;
4351 }
4352
4353
process_bss_event(struct nl_msg * msg,void * arg)4354 int process_bss_event(struct nl_msg *msg, void *arg)
4355 {
4356 struct i802_bss *bss = arg;
4357 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
4358 struct nlattr *tb[NL80211_ATTR_MAX + 1];
4359
4360 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
4361 genlmsg_attrlen(gnlh, 0), NULL);
4362
4363 wpa_printf(MSG_DEBUG, "nl80211: BSS Event %d (%s) received for %s",
4364 gnlh->cmd, nl80211_command_to_string(gnlh->cmd),
4365 bss->ifname);
4366
4367 switch (gnlh->cmd) {
4368 case NL80211_CMD_FRAME:
4369 case NL80211_CMD_FRAME_TX_STATUS:
4370 mlme_event(bss, gnlh->cmd, tb[NL80211_ATTR_FRAME],
4371 tb[NL80211_ATTR_MAC], tb[NL80211_ATTR_TIMED_OUT],
4372 tb[NL80211_ATTR_WIPHY_FREQ], tb[NL80211_ATTR_ACK],
4373 tb[NL80211_ATTR_COOKIE],
4374 tb[NL80211_ATTR_RX_SIGNAL_DBM],
4375 tb[NL80211_ATTR_STA_WME], NULL,
4376 tb[NL80211_ATTR_MLO_LINK_ID]);
4377 break;
4378 case NL80211_CMD_UNEXPECTED_FRAME:
4379 nl80211_spurious_frame(bss, tb, 0);
4380 break;
4381 case NL80211_CMD_UNEXPECTED_4ADDR_FRAME:
4382 nl80211_spurious_frame(bss, tb, 1);
4383 break;
4384 case NL80211_CMD_EXTERNAL_AUTH:
4385 nl80211_external_auth(bss->drv, tb);
4386 break;
4387 case NL80211_CMD_CONTROL_PORT_FRAME:
4388 nl80211_control_port_frame(bss, tb);
4389 break;
4390 default:
4391 wpa_printf(MSG_DEBUG, "nl80211: Ignored unknown event "
4392 "(cmd=%d)", gnlh->cmd);
4393 break;
4394 }
4395
4396 return NL_SKIP;
4397 }
4398