Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 433b957a authored by Arend van Spriel's avatar Arend van Spriel Committed by Greg Kroah-Hartman
Browse files

brcmfmac: add subtype check for event handling in data path 



commit a4176ec356c73a46c07c181c6d04039fafa34a9f upstream.

For USB there is no separate channel being used to pass events
from firmware to the host driver and as such are passed over the
data path. In order to detect mock event messages an additional
check is needed on event subtype. This check is added conditionally
using unlikely() keyword.

Reviewed-by: default avatarHante Meuleman <hante.meuleman@broadcom.com>
Reviewed-by: default avatarPieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
Reviewed-by: default avatarFranky Lin <franky.lin@broadcom.com>
Signed-off-by: default avatarArend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
Signed-off-by: default avatarBen Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 76e7e98e

drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c

+3 −2
Original line number Diff line number Diff line
@@ -339,7 +339,8 @@ void brcmf_rx_frame(struct device *dev, struct sk_buff *skb, bool handle_event) 
	} else {

		/* Process special event packets */

		if (handle_event)

			brcmf_fweh_process_skb(ifp->drvr, skb);

			brcmf_fweh_process_skb(ifp->drvr, skb,

					       BCMILCP_SUBTYPE_VENDOR_LONG);



		brcmf_netif_rx(ifp, skb);

	}
@@ -356,7 +357,7 @@ void brcmf_rx_event(struct device *dev, struct sk_buff *skb) 
	if (brcmf_rx_hdrpull(drvr, skb, &ifp))

		return;



	brcmf_fweh_process_skb(ifp->drvr, skb);

	brcmf_fweh_process_skb(ifp->drvr, skb, 0);

	brcmu_pkt_buf_free_skb(skb);

}

drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.h

+12 −4
Original line number Diff line number Diff line
@@ -181,7 +181,7 @@ enum brcmf_fweh_event_code { 
 */

#define BRCM_OUI				"\x00\x10\x18"

#define BCMILCP_BCM_SUBTYPE_EVENT		1



#define BCMILCP_SUBTYPE_VENDOR_LONG		32769



/**

 * struct brcm_ethhdr - broadcom specific ether header.
@@ -302,10 +302,10 @@ void brcmf_fweh_process_event(struct brcmf_pub *drvr, 
void brcmf_fweh_p2pdev_setup(struct brcmf_if *ifp, bool ongoing);



static inline void brcmf_fweh_process_skb(struct brcmf_pub *drvr,

					  struct sk_buff *skb)

					  struct sk_buff *skb, u16 stype)

{

	struct brcmf_event *event_packet;

	u16 usr_stype;

	u16 subtype, usr_stype;



	/* only process events when protocol matches */

	if (skb->protocol != cpu_to_be16(ETH_P_LINK_CTL))
@@ -314,8 +314,16 @@ static inline void brcmf_fweh_process_skb(struct brcmf_pub *drvr, 
	if ((skb->len + ETH_HLEN) < sizeof(*event_packet))

		return;



	/* check for BRCM oui match */

	event_packet = (struct brcmf_event *)skb_mac_header(skb);



	/* check subtype if needed */

	if (unlikely(stype)) {

		subtype = get_unaligned_be16(&event_packet->hdr.subtype);

		if (subtype != stype)

			return;

	}



	/* check for BRCM oui match */

	if (memcmp(BRCM_OUI, &event_packet->hdr.oui[0],

		   sizeof(event_packet->hdr.oui)))

		return;

drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c

+1 −1
Original line number Diff line number Diff line
@@ -1114,7 +1114,7 @@ static void brcmf_msgbuf_process_event(struct brcmf_msgbuf *msgbuf, void *buf) 


	skb->protocol = eth_type_trans(skb, ifp->ndev);



	brcmf_fweh_process_skb(ifp->drvr, skb);

	brcmf_fweh_process_skb(ifp->drvr, skb, 0);



exit:

	brcmu_pkt_buf_free_skb(skb);