blob: c0731650c170c9ef847e32a246aef42bd56eb7ed [file] [log] [blame]
Johannes Berg571ecf62007-07-27 15:43:22 +02001/*
2 * Copyright 2002-2005, Instant802 Networks, Inc.
3 * Copyright 2005-2006, Devicescape Software, Inc.
4 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
Johannes Berg84040802010-02-15 12:46:39 +02005 * Copyright 2007-2010 Johannes Berg <johannes@sipsolutions.net>
Johannes Bergd98ad832014-09-03 15:24:57 +03006 * Copyright 2013-2014 Intel Mobile Communications GmbH
Sara Sharon42e7f372017-02-06 15:28:42 +02007 * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
Johannes Berg571ecf62007-07-27 15:43:22 +02008 *
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License version 2 as
11 * published by the Free Software Foundation.
12 */
13
S.Çağlar Onurab466232008-02-14 17:36:47 +020014#include <linux/jiffies.h>
Tejun Heo5a0e3ad2010-03-24 17:04:11 +090015#include <linux/slab.h>
Johannes Berg571ecf62007-07-27 15:43:22 +020016#include <linux/kernel.h>
17#include <linux/skbuff.h>
18#include <linux/netdevice.h>
19#include <linux/etherdevice.h>
Johannes Bergd4e46a32007-09-14 11:10:24 -040020#include <linux/rcupdate.h>
Paul Gortmakerbc3b2d72011-07-15 11:47:34 -040021#include <linux/export.h>
Sara Sharon06470f72016-01-28 16:19:25 +020022#include <linux/bitops.h>
Johannes Berg571ecf62007-07-27 15:43:22 +020023#include <net/mac80211.h>
24#include <net/ieee80211_radiotap.h>
Johannes Bergd26ad372012-02-20 11:38:41 +010025#include <asm/unaligned.h>
Johannes Berg571ecf62007-07-27 15:43:22 +020026
27#include "ieee80211_i.h"
Johannes Berg24487982009-04-23 18:52:52 +020028#include "driver-ops.h"
Johannes Berg2c8dccc2008-04-08 15:14:40 -040029#include "led.h"
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +010030#include "mesh.h"
Johannes Berg571ecf62007-07-27 15:43:22 +020031#include "wep.h"
32#include "wpa.h"
33#include "tkip.h"
34#include "wme.h"
Johannes Berg1d8d3de2011-12-16 15:28:57 +010035#include "rate.h"
Johannes Berg571ecf62007-07-27 15:43:22 +020036
Johannes Berg5a490512015-04-22 17:10:38 +020037static inline void ieee80211_rx_stats(struct net_device *dev, u32 len)
38{
39 struct pcpu_sw_netstats *tstats = this_cpu_ptr(dev->tstats);
40
41 u64_stats_update_begin(&tstats->syncp);
42 tstats->rx_packets++;
43 tstats->rx_bytes += len;
44 u64_stats_update_end(&tstats->syncp);
45}
46
Johannes Berga6828492015-06-16 15:17:15 +020047static u8 *ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len,
48 enum nl80211_iftype type)
49{
50 __le16 fc = hdr->frame_control;
51
52 if (ieee80211_is_data(fc)) {
53 if (len < 24) /* drop incorrect hdr len (data) */
54 return NULL;
55
56 if (ieee80211_has_a4(fc))
57 return NULL;
58 if (ieee80211_has_tods(fc))
59 return hdr->addr1;
60 if (ieee80211_has_fromds(fc))
61 return hdr->addr2;
62
63 return hdr->addr3;
64 }
65
66 if (ieee80211_is_mgmt(fc)) {
67 if (len < 24) /* drop incorrect hdr len (mgmt) */
68 return NULL;
69 return hdr->addr3;
70 }
71
72 if (ieee80211_is_ctl(fc)) {
73 if (ieee80211_is_pspoll(fc))
74 return hdr->addr1;
75
76 if (ieee80211_is_back_req(fc)) {
77 switch (type) {
78 case NL80211_IFTYPE_STATION:
79 return hdr->addr2;
80 case NL80211_IFTYPE_AP:
81 case NL80211_IFTYPE_AP_VLAN:
82 return hdr->addr1;
83 default:
84 break; /* fall through to the return */
85 }
86 }
87 }
88
89 return NULL;
90}
91
Johannes Bergb2e77712007-09-26 15:19:39 +020092/*
93 * monitor mode reception
94 *
95 * This function cleans up the SKB, i.e. it removes all the stuff
96 * only useful for monitoring.
97 */
98static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
Johannes Berg1f7bba72014-11-06 22:56:36 +010099 struct sk_buff *skb,
100 unsigned int rtap_vendor_space)
Johannes Bergb2e77712007-09-26 15:19:39 +0200101{
Johannes Berg30686bf2015-06-02 21:39:54 +0200102 if (ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)) {
Johannes Bergb2e77712007-09-26 15:19:39 +0200103 if (likely(skb->len > FCS_LEN))
Zhu Yie3cf8b32010-03-29 17:35:07 +0800104 __pskb_trim(skb, skb->len - FCS_LEN);
Johannes Bergb2e77712007-09-26 15:19:39 +0200105 else {
106 /* driver bug */
107 WARN_ON(1);
108 dev_kfree_skb(skb);
Dan Carpenter06247602012-11-27 20:31:19 +0300109 return NULL;
Johannes Bergb2e77712007-09-26 15:19:39 +0200110 }
111 }
112
Johannes Berg1f7bba72014-11-06 22:56:36 +0100113 __pskb_pull(skb, rtap_vendor_space);
114
Johannes Bergb2e77712007-09-26 15:19:39 +0200115 return skb;
116}
117
Johannes Berg1f7bba72014-11-06 22:56:36 +0100118static inline bool should_drop_frame(struct sk_buff *skb, int present_fcs_len,
119 unsigned int rtap_vendor_space)
Johannes Bergb2e77712007-09-26 15:19:39 +0200120{
Johannes Bergf1d58c22009-06-17 13:13:00 +0200121 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
Johannes Berg1f7bba72014-11-06 22:56:36 +0100122 struct ieee80211_hdr *hdr;
123
124 hdr = (void *)(skb->data + rtap_vendor_space);
Johannes Bergb2e77712007-09-26 15:19:39 +0200125
Johannes Berg4c298672012-07-05 11:34:31 +0200126 if (status->flag & (RX_FLAG_FAILED_FCS_CRC |
Grzegorz Bajorski17883042015-12-11 14:39:46 +0100127 RX_FLAG_FAILED_PLCP_CRC |
128 RX_FLAG_ONLY_MONITOR))
Zhao, Gang6b59db72014-04-21 12:52:59 +0800129 return true;
130
Johannes Berg1f7bba72014-11-06 22:56:36 +0100131 if (unlikely(skb->len < 16 + present_fcs_len + rtap_vendor_space))
Zhao, Gang6b59db72014-04-21 12:52:59 +0800132 return true;
133
Harvey Harrison87228f52008-06-11 14:21:59 -0700134 if (ieee80211_is_ctl(hdr->frame_control) &&
135 !ieee80211_is_pspoll(hdr->frame_control) &&
136 !ieee80211_is_back_req(hdr->frame_control))
Zhao, Gang6b59db72014-04-21 12:52:59 +0800137 return true;
138
139 return false;
Johannes Bergb2e77712007-09-26 15:19:39 +0200140}
141
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200142static int
Johannes Berg1f7bba72014-11-06 22:56:36 +0100143ieee80211_rx_radiotap_hdrlen(struct ieee80211_local *local,
144 struct ieee80211_rx_status *status,
145 struct sk_buff *skb)
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200146{
147 int len;
148
149 /* always present fields */
Johannes Berga144f372013-07-03 13:34:02 +0200150 len = sizeof(struct ieee80211_radiotap_header) + 8;
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200151
Johannes Berga144f372013-07-03 13:34:02 +0200152 /* allocate extra bitmaps */
Johannes Berga144f372013-07-03 13:34:02 +0200153 if (status->chains)
154 len += 4 * hweight8(status->chains);
Johannes Berg90b9e4462012-11-16 10:09:08 +0100155
156 if (ieee80211_have_rx_timestamp(status)) {
157 len = ALIGN(len, 8);
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200158 len += 8;
Johannes Berg90b9e4462012-11-16 10:09:08 +0100159 }
Johannes Berg30686bf2015-06-02 21:39:54 +0200160 if (ieee80211_hw_check(&local->hw, SIGNAL_DBM))
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200161 len += 1;
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200162
Johannes Berga144f372013-07-03 13:34:02 +0200163 /* antenna field, if we don't have per-chain info */
164 if (!status->chains)
165 len += 1;
166
Johannes Berg90b9e4462012-11-16 10:09:08 +0100167 /* padding for RX_FLAGS if necessary */
168 len = ALIGN(len, 2);
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200169
Johannes Berg6d744ba2011-01-27 14:13:17 +0100170 if (status->flag & RX_FLAG_HT) /* HT info */
171 len += 3;
172
Johannes Berg4c298672012-07-05 11:34:31 +0200173 if (status->flag & RX_FLAG_AMPDU_DETAILS) {
Johannes Berg90b9e4462012-11-16 10:09:08 +0100174 len = ALIGN(len, 4);
Johannes Berg4c298672012-07-05 11:34:31 +0200175 len += 8;
176 }
177
Johannes Berg51648922012-11-22 23:00:18 +0100178 if (status->flag & RX_FLAG_VHT) {
179 len = ALIGN(len, 2);
180 len += 12;
181 }
182
Johannes Berg99ee7ca2016-08-29 23:25:17 +0300183 if (local->hw.radiotap_timestamp.units_pos >= 0) {
184 len = ALIGN(len, 8);
185 len += 12;
186 }
187
Johannes Berga144f372013-07-03 13:34:02 +0200188 if (status->chains) {
189 /* antenna and antenna signal fields */
190 len += 2 * hweight8(status->chains);
191 }
192
Johannes Berg1f7bba72014-11-06 22:56:36 +0100193 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
194 struct ieee80211_vendor_radiotap *rtap = (void *)skb->data;
195
196 /* vendor presence bitmap */
197 len += 4;
198 /* alignment for fixed 6-byte vendor data header */
199 len = ALIGN(len, 2);
200 /* vendor data header */
201 len += 6;
202 if (WARN_ON(rtap->align == 0))
203 rtap->align = 1;
204 len = ALIGN(len, rtap->align);
205 len += rtap->len + rtap->pad;
206 }
207
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200208 return len;
209}
210
Johannes Berg87cfeaa2017-04-13 14:23:49 +0200211static void ieee80211_handle_mu_mimo_mon(struct ieee80211_sub_if_data *sdata,
212 struct sk_buff *skb,
213 int rtap_vendor_space)
214{
215 struct {
216 struct ieee80211_hdr_3addr hdr;
217 u8 category;
218 u8 action_code;
219 } __packed action;
220
221 if (!sdata)
222 return;
223
224 BUILD_BUG_ON(sizeof(action) != IEEE80211_MIN_ACTION_SIZE + 1);
225
226 if (skb->len < rtap_vendor_space + sizeof(action) +
227 VHT_MUMIMO_GROUPS_DATA_LEN)
228 return;
229
230 if (!is_valid_ether_addr(sdata->u.mntr.mu_follow_addr))
231 return;
232
233 skb_copy_bits(skb, rtap_vendor_space, &action, sizeof(action));
234
235 if (!ieee80211_is_action(action.hdr.frame_control))
236 return;
237
238 if (action.category != WLAN_CATEGORY_VHT)
239 return;
240
241 if (action.action_code != WLAN_VHT_ACTION_GROUPID_MGMT)
242 return;
243
244 if (!ether_addr_equal(action.hdr.addr1, sdata->u.mntr.mu_follow_addr))
245 return;
246
247 skb = skb_copy(skb, GFP_ATOMIC);
248 if (!skb)
249 return;
250
251 skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
252 skb_queue_tail(&sdata->skb_queue, skb);
253 ieee80211_queue_work(&sdata->local->hw, &sdata->work);
254}
255
Johannes Berg00ea6de2012-09-05 15:54:51 +0200256/*
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200257 * ieee80211_add_rx_radiotap_header - add radiotap header
258 *
259 * add a radiotap header containing all the fields which the hardware provided.
260 */
261static void
262ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
263 struct sk_buff *skb,
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200264 struct ieee80211_rate *rate,
Felix Fietkau973ef212012-04-16 14:56:48 +0200265 int rtap_len, bool has_fcs)
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200266{
Johannes Bergf1d58c22009-06-17 13:13:00 +0200267 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200268 struct ieee80211_radiotap_header *rthdr;
269 unsigned char *pos;
Johannes Berga144f372013-07-03 13:34:02 +0200270 __le32 *it_present;
271 u32 it_present_val;
Johannes Berg6a86b9c2009-10-28 09:58:52 +0100272 u16 rx_flags = 0;
Simon Wunderlicha5e70692013-07-08 16:55:52 +0200273 u16 channel_flags = 0;
Johannes Berga144f372013-07-03 13:34:02 +0200274 int mpdulen, chain;
275 unsigned long chains = status->chains;
Johannes Berg1f7bba72014-11-06 22:56:36 +0100276 struct ieee80211_vendor_radiotap rtap = {};
277
278 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
279 rtap = *(struct ieee80211_vendor_radiotap *)skb->data;
280 /* rtap.len and rtap.pad are undone immediately */
281 skb_pull(skb, sizeof(rtap) + rtap.len + rtap.pad);
282 }
Thomas Pedersenf4bda332012-11-13 10:46:27 -0800283
284 mpdulen = skb->len;
Johannes Berg30686bf2015-06-02 21:39:54 +0200285 if (!(has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)))
Thomas Pedersenf4bda332012-11-13 10:46:27 -0800286 mpdulen += FCS_LEN;
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200287
288 rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len);
Johannes Berg1f7bba72014-11-06 22:56:36 +0100289 memset(rthdr, 0, rtap_len - rtap.len - rtap.pad);
Johannes Berga144f372013-07-03 13:34:02 +0200290 it_present = &rthdr->it_present;
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200291
292 /* radiotap header, set always present flags */
Emmanuel Grumbach0059b2b2014-02-05 16:36:01 +0200293 rthdr->it_len = cpu_to_le16(rtap_len);
Johannes Berga144f372013-07-03 13:34:02 +0200294 it_present_val = BIT(IEEE80211_RADIOTAP_FLAGS) |
295 BIT(IEEE80211_RADIOTAP_CHANNEL) |
296 BIT(IEEE80211_RADIOTAP_RX_FLAGS);
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200297
Johannes Berga144f372013-07-03 13:34:02 +0200298 if (!status->chains)
299 it_present_val |= BIT(IEEE80211_RADIOTAP_ANTENNA);
300
301 for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
302 it_present_val |=
303 BIT(IEEE80211_RADIOTAP_EXT) |
304 BIT(IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE);
305 put_unaligned_le32(it_present_val, it_present);
306 it_present++;
307 it_present_val = BIT(IEEE80211_RADIOTAP_ANTENNA) |
308 BIT(IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
309 }
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200310
Johannes Berg1f7bba72014-11-06 22:56:36 +0100311 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
312 it_present_val |= BIT(IEEE80211_RADIOTAP_VENDOR_NAMESPACE) |
313 BIT(IEEE80211_RADIOTAP_EXT);
314 put_unaligned_le32(it_present_val, it_present);
315 it_present++;
316 it_present_val = rtap.present;
317 }
318
Johannes Berga144f372013-07-03 13:34:02 +0200319 put_unaligned_le32(it_present_val, it_present);
320
321 pos = (void *)(it_present + 1);
322
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200323 /* the order of the following fields is important */
324
325 /* IEEE80211_RADIOTAP_TSFT */
Thomas Pedersenf4bda332012-11-13 10:46:27 -0800326 if (ieee80211_have_rx_timestamp(status)) {
Johannes Berg90b9e4462012-11-16 10:09:08 +0100327 /* padding */
328 while ((pos - (u8 *)rthdr) & 7)
329 *pos++ = 0;
Thomas Pedersenf4bda332012-11-13 10:46:27 -0800330 put_unaligned_le64(
331 ieee80211_calculate_rx_timestamp(local, status,
332 mpdulen, 0),
333 pos);
Johannes Berg1df332e2012-10-26 00:09:11 +0200334 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200335 pos += 8;
336 }
337
338 /* IEEE80211_RADIOTAP_FLAGS */
Johannes Berg30686bf2015-06-02 21:39:54 +0200339 if (has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS))
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200340 *pos |= IEEE80211_RADIOTAP_F_FCS;
Johannes Bergaae89832009-03-13 12:52:10 +0100341 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
342 *pos |= IEEE80211_RADIOTAP_F_BADFCS;
Bruno Randolfb4f28bb2008-07-30 17:19:55 +0200343 if (status->flag & RX_FLAG_SHORTPRE)
344 *pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200345 pos++;
346
347 /* IEEE80211_RADIOTAP_RATE */
Johannes Berg56146182012-11-09 15:07:02 +0100348 if (!rate || status->flag & (RX_FLAG_HT | RX_FLAG_VHT)) {
Jouni Malinen0fb8ca42008-12-12 14:38:33 +0200349 /*
Johannes Bergf8d1ccf2011-11-08 12:28:33 +0100350 * Without rate information don't add it. If we have,
Mohammed Shafi Shajakhan38f37be2011-02-07 10:10:04 +0530351 * MCS information is a separate field in radiotap,
Johannes Berg73b48092011-04-18 17:05:21 +0200352 * added below. The byte here is needed as padding
353 * for the channel though, so initialise it to 0.
Jouni Malinen0fb8ca42008-12-12 14:38:33 +0200354 */
355 *pos = 0;
Jouni Malinen8d6f6582008-12-15 10:37:50 +0200356 } else {
Simon Wunderlich2103dec2013-07-08 16:55:53 +0200357 int shift = 0;
Jouni Malinenebe6c7b2009-01-10 11:47:33 +0200358 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
Simon Wunderlich2103dec2013-07-08 16:55:53 +0200359 if (status->flag & RX_FLAG_10MHZ)
360 shift = 1;
361 else if (status->flag & RX_FLAG_5MHZ)
362 shift = 2;
363 *pos = DIV_ROUND_UP(rate->bitrate, 5 * (1 << shift));
Jouni Malinen8d6f6582008-12-15 10:37:50 +0200364 }
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200365 pos++;
366
367 /* IEEE80211_RADIOTAP_CHANNEL */
Johannes Berg6a86b9c2009-10-28 09:58:52 +0100368 put_unaligned_le16(status->freq, pos);
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200369 pos += 2;
Simon Wunderlicha5e70692013-07-08 16:55:52 +0200370 if (status->flag & RX_FLAG_10MHZ)
371 channel_flags |= IEEE80211_CHAN_HALF;
372 else if (status->flag & RX_FLAG_5MHZ)
373 channel_flags |= IEEE80211_CHAN_QUARTER;
374
Johannes Berg57fbcce2016-04-12 15:56:15 +0200375 if (status->band == NL80211_BAND_5GHZ)
Simon Wunderlicha5e70692013-07-08 16:55:52 +0200376 channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ;
Johannes Berg56146182012-11-09 15:07:02 +0100377 else if (status->flag & (RX_FLAG_HT | RX_FLAG_VHT))
Simon Wunderlicha5e70692013-07-08 16:55:52 +0200378 channel_flags |= IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
Johannes Bergf8d1ccf2011-11-08 12:28:33 +0100379 else if (rate && rate->flags & IEEE80211_RATE_ERP_G)
Simon Wunderlicha5e70692013-07-08 16:55:52 +0200380 channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ;
Johannes Bergf8d1ccf2011-11-08 12:28:33 +0100381 else if (rate)
Mathy Vanhoef3a5c5e82015-01-20 15:05:08 +0100382 channel_flags |= IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ;
Johannes Bergf8d1ccf2011-11-08 12:28:33 +0100383 else
Simon Wunderlicha5e70692013-07-08 16:55:52 +0200384 channel_flags |= IEEE80211_CHAN_2GHZ;
385 put_unaligned_le16(channel_flags, pos);
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200386 pos += 2;
387
388 /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
Johannes Berg30686bf2015-06-02 21:39:54 +0200389 if (ieee80211_hw_check(&local->hw, SIGNAL_DBM) &&
Felix Fietkaufe8431f2012-03-01 18:00:07 +0100390 !(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200391 *pos = status->signal;
392 rthdr->it_present |=
393 cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
394 pos++;
395 }
396
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200397 /* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */
398
Johannes Berga144f372013-07-03 13:34:02 +0200399 if (!status->chains) {
400 /* IEEE80211_RADIOTAP_ANTENNA */
401 *pos = status->antenna;
402 pos++;
403 }
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200404
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200405 /* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */
406
407 /* IEEE80211_RADIOTAP_RX_FLAGS */
408 /* ensure 2 byte alignment for the 2 byte field as required */
Johannes Berg6a86b9c2009-10-28 09:58:52 +0100409 if ((pos - (u8 *)rthdr) & 1)
Johannes Berg90b9e4462012-11-16 10:09:08 +0100410 *pos++ = 0;
Johannes Bergaae89832009-03-13 12:52:10 +0100411 if (status->flag & RX_FLAG_FAILED_PLCP_CRC)
Johannes Berg6a86b9c2009-10-28 09:58:52 +0100412 rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP;
413 put_unaligned_le16(rx_flags, pos);
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200414 pos += 2;
Johannes Berg6d744ba2011-01-27 14:13:17 +0100415
416 if (status->flag & RX_FLAG_HT) {
Oleksij Rempel786677d2013-05-24 12:05:45 +0200417 unsigned int stbc;
418
Johannes Berg6d744ba2011-01-27 14:13:17 +0100419 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_MCS);
Johannes Bergac55d2f2012-05-10 09:09:10 +0200420 *pos++ = local->hw.radiotap_mcs_details;
Johannes Berg6d744ba2011-01-27 14:13:17 +0100421 *pos = 0;
422 if (status->flag & RX_FLAG_SHORT_GI)
423 *pos |= IEEE80211_RADIOTAP_MCS_SGI;
424 if (status->flag & RX_FLAG_40MHZ)
425 *pos |= IEEE80211_RADIOTAP_MCS_BW_40;
Johannes Bergac55d2f2012-05-10 09:09:10 +0200426 if (status->flag & RX_FLAG_HT_GF)
427 *pos |= IEEE80211_RADIOTAP_MCS_FMT_GF;
Emmanuel Grumbach63c361f2014-02-05 12:48:53 +0200428 if (status->flag & RX_FLAG_LDPC)
429 *pos |= IEEE80211_RADIOTAP_MCS_FEC_LDPC;
Oleksij Rempel786677d2013-05-24 12:05:45 +0200430 stbc = (status->flag & RX_FLAG_STBC_MASK) >> RX_FLAG_STBC_SHIFT;
431 *pos |= stbc << IEEE80211_RADIOTAP_MCS_STBC_SHIFT;
Johannes Berg6d744ba2011-01-27 14:13:17 +0100432 pos++;
433 *pos++ = status->rate_idx;
434 }
Johannes Berg4c298672012-07-05 11:34:31 +0200435
436 if (status->flag & RX_FLAG_AMPDU_DETAILS) {
437 u16 flags = 0;
438
439 /* ensure 4 byte alignment */
440 while ((pos - (u8 *)rthdr) & 3)
441 pos++;
442 rthdr->it_present |=
443 cpu_to_le32(1 << IEEE80211_RADIOTAP_AMPDU_STATUS);
444 put_unaligned_le32(status->ampdu_reference, pos);
445 pos += 4;
Johannes Berg4c298672012-07-05 11:34:31 +0200446 if (status->flag & RX_FLAG_AMPDU_LAST_KNOWN)
447 flags |= IEEE80211_RADIOTAP_AMPDU_LAST_KNOWN;
448 if (status->flag & RX_FLAG_AMPDU_IS_LAST)
449 flags |= IEEE80211_RADIOTAP_AMPDU_IS_LAST;
450 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_ERROR)
451 flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_ERR;
452 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
453 flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_KNOWN;
454 put_unaligned_le16(flags, pos);
455 pos += 2;
456 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
457 *pos++ = status->ampdu_delimiter_crc;
458 else
459 *pos++ = 0;
460 *pos++ = 0;
461 }
Johannes Berg90b9e4462012-11-16 10:09:08 +0100462
Johannes Berg51648922012-11-22 23:00:18 +0100463 if (status->flag & RX_FLAG_VHT) {
464 u16 known = local->hw.radiotap_vht_details;
465
466 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_VHT);
Johannes Berg51648922012-11-22 23:00:18 +0100467 put_unaligned_le16(known, pos);
468 pos += 2;
469 /* flags */
470 if (status->flag & RX_FLAG_SHORT_GI)
471 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_SGI;
Emmanuel Grumbach63c361f2014-02-05 12:48:53 +0200472 /* in VHT, STBC is binary */
473 if (status->flag & RX_FLAG_STBC_MASK)
474 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_STBC;
Emmanuel Grumbachfb378c22014-03-04 10:35:25 +0200475 if (status->vht_flag & RX_VHT_FLAG_BF)
476 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_BEAMFORMED;
Johannes Berg51648922012-11-22 23:00:18 +0100477 pos++;
478 /* bandwidth */
Emmanuel Grumbach1b8d2422014-02-05 16:37:11 +0200479 if (status->vht_flag & RX_VHT_FLAG_80MHZ)
Johannes Berg51648922012-11-22 23:00:18 +0100480 *pos++ = 4;
Emmanuel Grumbach1b8d2422014-02-05 16:37:11 +0200481 else if (status->vht_flag & RX_VHT_FLAG_160MHZ)
Johannes Berg51648922012-11-22 23:00:18 +0100482 *pos++ = 11;
483 else if (status->flag & RX_FLAG_40MHZ)
484 *pos++ = 1;
485 else /* 20 MHz */
486 *pos++ = 0;
487 /* MCS/NSS */
488 *pos = (status->rate_idx << 4) | status->vht_nss;
489 pos += 4;
490 /* coding field */
Emmanuel Grumbach63c361f2014-02-05 12:48:53 +0200491 if (status->flag & RX_FLAG_LDPC)
492 *pos |= IEEE80211_RADIOTAP_CODING_LDPC_USER0;
Johannes Berg51648922012-11-22 23:00:18 +0100493 pos++;
494 /* group ID */
495 pos++;
496 /* partial_aid */
497 pos += 2;
498 }
499
Johannes Berg99ee7ca2016-08-29 23:25:17 +0300500 if (local->hw.radiotap_timestamp.units_pos >= 0) {
501 u16 accuracy = 0;
502 u8 flags = IEEE80211_RADIOTAP_TIMESTAMP_FLAG_32BIT;
503
504 rthdr->it_present |=
505 cpu_to_le32(1 << IEEE80211_RADIOTAP_TIMESTAMP);
506
507 /* ensure 8 byte alignment */
508 while ((pos - (u8 *)rthdr) & 7)
509 pos++;
510
511 put_unaligned_le64(status->device_timestamp, pos);
512 pos += sizeof(u64);
513
514 if (local->hw.radiotap_timestamp.accuracy >= 0) {
515 accuracy = local->hw.radiotap_timestamp.accuracy;
516 flags |= IEEE80211_RADIOTAP_TIMESTAMP_FLAG_ACCURACY;
517 }
518 put_unaligned_le16(accuracy, pos);
519 pos += sizeof(u16);
520
521 *pos++ = local->hw.radiotap_timestamp.units_pos;
522 *pos++ = flags;
523 }
524
Johannes Berga144f372013-07-03 13:34:02 +0200525 for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
526 *pos++ = status->chain_signal[chain];
527 *pos++ = chain;
528 }
Johannes Berg1f7bba72014-11-06 22:56:36 +0100529
530 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
531 /* ensure 2 byte alignment for the vendor field as required */
532 if ((pos - (u8 *)rthdr) & 1)
533 *pos++ = 0;
534 *pos++ = rtap.oui[0];
535 *pos++ = rtap.oui[1];
536 *pos++ = rtap.oui[2];
537 *pos++ = rtap.subns;
538 put_unaligned_le16(rtap.len, pos);
539 pos += 2;
540 /* align the actual payload as requested */
541 while ((pos - (u8 *)rthdr) & (rtap.align - 1))
542 *pos++ = 0;
543 /* data (and possible padding) already follows */
544 }
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200545}
546
Johannes Bergb2e77712007-09-26 15:19:39 +0200547/*
548 * This function copies a received frame to all monitor interfaces and
549 * returns a cleaned-up SKB that no longer includes the FCS nor the
550 * radiotap header the driver might have added.
551 */
552static struct sk_buff *
553ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
Johannes Berg8318d782008-01-24 19:38:38 +0100554 struct ieee80211_rate *rate)
Johannes Bergb2e77712007-09-26 15:19:39 +0200555{
Johannes Bergf1d58c22009-06-17 13:13:00 +0200556 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb);
Johannes Bergb2e77712007-09-26 15:19:39 +0200557 struct ieee80211_sub_if_data *sdata;
Johannes Berg1f7bba72014-11-06 22:56:36 +0100558 int rt_hdrlen, needed_headroom;
Johannes Bergb2e77712007-09-26 15:19:39 +0200559 struct sk_buff *skb, *skb2;
560 struct net_device *prev_dev = NULL;
561 int present_fcs_len = 0;
Johannes Berg1f7bba72014-11-06 22:56:36 +0100562 unsigned int rtap_vendor_space = 0;
Aviya Erenfeld42bd20d2016-08-29 23:25:16 +0300563 struct ieee80211_sub_if_data *monitor_sdata =
564 rcu_dereference(local->monitor_sdata);
Johannes Berg1f7bba72014-11-06 22:56:36 +0100565
566 if (unlikely(status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA)) {
567 struct ieee80211_vendor_radiotap *rtap = (void *)origskb->data;
568
569 rtap_vendor_space = sizeof(*rtap) + rtap->len + rtap->pad;
570 }
Johannes Bergb2e77712007-09-26 15:19:39 +0200571
572 /*
573 * First, we may need to make a copy of the skb because
574 * (1) we need to modify it for radiotap (if not present), and
575 * (2) the other RX handlers will modify the skb we got.
576 *
577 * We don't need to, of course, if we aren't going to return
578 * the SKB because it has a bad FCS/PLCP checksum.
579 */
Johannes Berg0869aea2009-10-28 10:03:35 +0100580
Johannes Berg30686bf2015-06-02 21:39:54 +0200581 if (ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS))
Johannes Bergb2e77712007-09-26 15:19:39 +0200582 present_fcs_len = FCS_LEN;
583
Johannes Berg1f7bba72014-11-06 22:56:36 +0100584 /* ensure hdr->frame_control and vendor radiotap data are in skb head */
585 if (!pskb_may_pull(origskb, 2 + rtap_vendor_space)) {
Zhu Yie3cf8b32010-03-29 17:35:07 +0800586 dev_kfree_skb(origskb);
587 return NULL;
588 }
589
Grzegorz Bajorski17883042015-12-11 14:39:46 +0100590 if (!local->monitors || (status->flag & RX_FLAG_SKIP_MONITOR)) {
Johannes Berg1f7bba72014-11-06 22:56:36 +0100591 if (should_drop_frame(origskb, present_fcs_len,
592 rtap_vendor_space)) {
Johannes Bergb2e77712007-09-26 15:19:39 +0200593 dev_kfree_skb(origskb);
594 return NULL;
595 }
596
Johannes Berg1f7bba72014-11-06 22:56:36 +0100597 return remove_monitor_info(local, origskb, rtap_vendor_space);
Johannes Bergb2e77712007-09-26 15:19:39 +0200598 }
599
Johannes Berg87cfeaa2017-04-13 14:23:49 +0200600 ieee80211_handle_mu_mimo_mon(monitor_sdata, origskb, rtap_vendor_space);
601
Helmut Schaa751413e2012-12-05 14:36:12 +0100602 /* room for the radiotap header based on driver features */
Johannes Berg1f7bba72014-11-06 22:56:36 +0100603 rt_hdrlen = ieee80211_rx_radiotap_hdrlen(local, status, origskb);
604 needed_headroom = rt_hdrlen - rtap_vendor_space;
Helmut Schaa751413e2012-12-05 14:36:12 +0100605
Johannes Berg1f7bba72014-11-06 22:56:36 +0100606 if (should_drop_frame(origskb, present_fcs_len, rtap_vendor_space)) {
Johannes Bergb2e77712007-09-26 15:19:39 +0200607 /* only need to expand headroom if necessary */
608 skb = origskb;
609 origskb = NULL;
610
611 /*
612 * This shouldn't trigger often because most devices have an
613 * RX header they pull before we get here, and that should
614 * be big enough for our radiotap information. We should
615 * probably export the length to drivers so that we can have
616 * them allocate enough headroom to start with.
617 */
618 if (skb_headroom(skb) < needed_headroom &&
Johannes Bergc49e5ea2007-12-11 21:33:42 +0100619 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
Johannes Bergb2e77712007-09-26 15:19:39 +0200620 dev_kfree_skb(skb);
621 return NULL;
622 }
623 } else {
624 /*
625 * Need to make a copy and possibly remove radiotap header
626 * and FCS from the original.
627 */
628 skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC);
629
Johannes Berg1f7bba72014-11-06 22:56:36 +0100630 origskb = remove_monitor_info(local, origskb,
631 rtap_vendor_space);
Johannes Bergb2e77712007-09-26 15:19:39 +0200632
633 if (!skb)
634 return origskb;
635 }
636
Johannes Berg0869aea2009-10-28 10:03:35 +0100637 /* prepend radiotap information */
Johannes Berg1f7bba72014-11-06 22:56:36 +0100638 ieee80211_add_rx_radiotap_header(local, skb, rate, rt_hdrlen, true);
Johannes Bergb2e77712007-09-26 15:19:39 +0200639
Johannes Bergce3edf6d02007-12-19 01:31:22 +0100640 skb_reset_mac_header(skb);
Johannes Bergb2e77712007-09-26 15:19:39 +0200641 skb->ip_summed = CHECKSUM_UNNECESSARY;
642 skb->pkt_type = PACKET_OTHERHOST;
643 skb->protocol = htons(ETH_P_802_2);
644
645 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
Johannes Berg05c914f2008-09-11 00:01:58 +0200646 if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
Johannes Bergb2e77712007-09-26 15:19:39 +0200647 continue;
648
Aviya Erenfeldd8212182016-08-29 23:25:15 +0300649 if (sdata->u.mntr.flags & MONITOR_FLAG_COOK_FRAMES)
Michael Wu3d30d942008-01-31 19:48:27 +0100650 continue;
651
Johannes Berg9607e6b2009-12-23 13:15:31 +0100652 if (!ieee80211_sdata_running(sdata))
Johannes Berg47846c92009-11-25 17:46:19 +0100653 continue;
654
Johannes Bergb2e77712007-09-26 15:19:39 +0200655 if (prev_dev) {
656 skb2 = skb_clone(skb, GFP_ATOMIC);
657 if (skb2) {
658 skb2->dev = prev_dev;
John W. Linville5548a8a2010-06-24 14:25:56 -0400659 netif_receive_skb(skb2);
Johannes Bergb2e77712007-09-26 15:19:39 +0200660 }
661 }
662
663 prev_dev = sdata->dev;
Johannes Berg5a490512015-04-22 17:10:38 +0200664 ieee80211_rx_stats(sdata->dev, skb->len);
Johannes Bergb2e77712007-09-26 15:19:39 +0200665 }
666
667 if (prev_dev) {
668 skb->dev = prev_dev;
John W. Linville5548a8a2010-06-24 14:25:56 -0400669 netif_receive_skb(skb);
Johannes Bergb2e77712007-09-26 15:19:39 +0200670 } else
671 dev_kfree_skb(skb);
672
673 return origskb;
674}
675
Johannes Berg5cf121c2008-02-25 16:27:43 +0100676static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
Johannes Berg6e0d1142007-07-27 15:43:22 +0200677{
Harvey Harrison238f74a2008-07-02 11:05:34 -0700678 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
Johannes Berg554891e2010-09-24 12:38:25 +0200679 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
Johannes Berg9e262972011-07-07 18:45:03 +0200680 int tid, seqno_idx, security_idx;
Johannes Berg6e0d1142007-07-27 15:43:22 +0200681
682 /* does the frame have a qos control field? */
Harvey Harrison238f74a2008-07-02 11:05:34 -0700683 if (ieee80211_is_data_qos(hdr->frame_control)) {
684 u8 *qc = ieee80211_get_qos_ctl(hdr);
Johannes Berg6e0d1142007-07-27 15:43:22 +0200685 /* frame has qos control */
Harvey Harrison238f74a2008-07-02 11:05:34 -0700686 tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
Johannes Berg04b7dcf2011-06-22 10:06:59 +0200687 if (*qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT)
Johannes Berg554891e2010-09-24 12:38:25 +0200688 status->rx_flags |= IEEE80211_RX_AMSDU;
Johannes Berg9e262972011-07-07 18:45:03 +0200689
690 seqno_idx = tid;
691 security_idx = tid;
Johannes Berg6e0d1142007-07-27 15:43:22 +0200692 } else {
Johannes Berg1411f9b2008-07-10 10:11:02 +0200693 /*
694 * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):
695 *
696 * Sequence numbers for management frames, QoS data
697 * frames with a broadcast/multicast address in the
698 * Address 1 field, and all non-QoS data frames sent
699 * by QoS STAs are assigned using an additional single
700 * modulo-4096 counter, [...]
701 *
702 * We also use that counter for non-QoS STAs.
703 */
Johannes Berg5a306f52012-11-14 23:22:21 +0100704 seqno_idx = IEEE80211_NUM_TIDS;
Johannes Berg9e262972011-07-07 18:45:03 +0200705 security_idx = 0;
706 if (ieee80211_is_mgmt(hdr->frame_control))
Johannes Berg5a306f52012-11-14 23:22:21 +0100707 security_idx = IEEE80211_NUM_TIDS;
Johannes Berg9e262972011-07-07 18:45:03 +0200708 tid = 0;
Johannes Berg6e0d1142007-07-27 15:43:22 +0200709 }
Johannes Berg52865dfd2007-07-27 15:43:22 +0200710
Johannes Berg9e262972011-07-07 18:45:03 +0200711 rx->seqno_idx = seqno_idx;
712 rx->security_idx = security_idx;
Johannes Berg6e0d1142007-07-27 15:43:22 +0200713 /* Set skb->priority to 1d tag if highest order bit of TID is not set.
714 * For now, set skb->priority to 0 for other cases. */
715 rx->skb->priority = (tid > 7) ? 0 : tid;
Johannes Berg38f37142008-01-29 17:07:43 +0100716}
Johannes Berg6e0d1142007-07-27 15:43:22 +0200717
Johannes Bergd1c3a372009-01-07 00:26:10 +0100718/**
719 * DOC: Packet alignment
720 *
721 * Drivers always need to pass packets that are aligned to two-byte boundaries
722 * to the stack.
723 *
724 * Additionally, should, if possible, align the payload data in a way that
725 * guarantees that the contained IP header is aligned to a four-byte
726 * boundary. In the case of regular frames, this simply means aligning the
727 * payload to a four-byte boundary (because either the IP header is directly
728 * contained, or IV/RFC1042 headers that have a length divisible by four are
Kalle Valo59d9cb02009-12-17 13:54:57 +0100729 * in front of it). If the payload data is not properly aligned and the
730 * architecture doesn't support efficient unaligned operations, mac80211
731 * will align the data.
Johannes Bergd1c3a372009-01-07 00:26:10 +0100732 *
733 * With A-MSDU frames, however, the payload data address must yield two modulo
734 * four because there are 14-byte 802.3 headers within the A-MSDU frames that
735 * push the IP header further back to a multiple of four again. Thankfully, the
736 * specs were sane enough this time around to require padding each A-MSDU
737 * subframe to a length that is a multiple of four.
738 *
Lucas De Marchi25985ed2011-03-30 22:57:33 -0300739 * Padding like Atheros hardware adds which is between the 802.11 header and
Johannes Bergd1c3a372009-01-07 00:26:10 +0100740 * the payload is not supported, the driver is required to move the 802.11
741 * header to be directly in front of the payload in that case.
742 */
743static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
Johannes Berg38f37142008-01-29 17:07:43 +0100744{
Kalle Valo59d9cb02009-12-17 13:54:57 +0100745#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
Johannes Berg441275e2015-11-06 12:34:24 +0100746 WARN_ON_ONCE((unsigned long)rx->skb->data & 1);
Johannes Bergd1c3a372009-01-07 00:26:10 +0100747#endif
Johannes Berg6e0d1142007-07-27 15:43:22 +0200748}
749
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +0200750
Johannes Berg571ecf62007-07-27 15:43:22 +0200751/* rx handlers */
752
Jouni Malinen3cfcf6ac2009-01-08 13:32:02 +0200753static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
754{
755 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
756
Johannes Bergd8ca16d2014-01-23 16:20:29 +0100757 if (is_multicast_ether_addr(hdr->addr1))
Jouni Malinen3cfcf6ac2009-01-08 13:32:02 +0200758 return 0;
759
Johannes Bergd8ca16d2014-01-23 16:20:29 +0100760 return ieee80211_is_robust_mgmt_frame(skb);
Jouni Malinen3cfcf6ac2009-01-08 13:32:02 +0200761}
762
763
764static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb)
765{
766 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
767
Johannes Bergd8ca16d2014-01-23 16:20:29 +0100768 if (!is_multicast_ether_addr(hdr->addr1))
Jouni Malinen3cfcf6ac2009-01-08 13:32:02 +0200769 return 0;
770
Johannes Bergd8ca16d2014-01-23 16:20:29 +0100771 return ieee80211_is_robust_mgmt_frame(skb);
Jouni Malinen3cfcf6ac2009-01-08 13:32:02 +0200772}
773
774
775/* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */
776static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
777{
778 struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data;
779 struct ieee80211_mmie *mmie;
Jouni Malinen56c52da2015-01-24 19:52:08 +0200780 struct ieee80211_mmie_16 *mmie16;
Jouni Malinen3cfcf6ac2009-01-08 13:32:02 +0200781
Johannes Berg1df332e2012-10-26 00:09:11 +0200782 if (skb->len < 24 + sizeof(*mmie) || !is_multicast_ether_addr(hdr->da))
Jouni Malinen3cfcf6ac2009-01-08 13:32:02 +0200783 return -1;
784
Johannes Bergd8ca16d2014-01-23 16:20:29 +0100785 if (!ieee80211_is_robust_mgmt_frame(skb))
Jouni Malinen3cfcf6ac2009-01-08 13:32:02 +0200786 return -1; /* not a robust management frame */
787
788 mmie = (struct ieee80211_mmie *)
789 (skb->data + skb->len - sizeof(*mmie));
Jouni Malinen56c52da2015-01-24 19:52:08 +0200790 if (mmie->element_id == WLAN_EID_MMIE &&
791 mmie->length == sizeof(*mmie) - 2)
792 return le16_to_cpu(mmie->key_id);
Jouni Malinen3cfcf6ac2009-01-08 13:32:02 +0200793
Jouni Malinen56c52da2015-01-24 19:52:08 +0200794 mmie16 = (struct ieee80211_mmie_16 *)
795 (skb->data + skb->len - sizeof(*mmie16));
796 if (skb->len >= 24 + sizeof(*mmie16) &&
797 mmie16->element_id == WLAN_EID_MMIE &&
798 mmie16->length == sizeof(*mmie16) - 2)
799 return le16_to_cpu(mmie16->key_id);
800
801 return -1;
Jouni Malinen3cfcf6ac2009-01-08 13:32:02 +0200802}
803
Johannes Berg2c61cf92016-03-17 15:02:55 +0200804static int ieee80211_get_cs_keyid(const struct ieee80211_cipher_scheme *cs,
805 struct sk_buff *skb)
Max Stepanov2475b1cc2013-03-24 14:23:27 +0200806{
807 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
808 __le16 fc;
809 int hdrlen;
810 u8 keyid;
811
812 fc = hdr->frame_control;
813 hdrlen = ieee80211_hdrlen(fc);
814
815 if (skb->len < hdrlen + cs->hdr_len)
816 return -EINVAL;
817
818 skb_copy_bits(skb, hdrlen + cs->key_idx_off, &keyid, 1);
819 keyid &= cs->key_idx_mask;
820 keyid >>= cs->key_idx_shift;
821
822 return keyid;
823}
824
Johannes Berg1df332e2012-10-26 00:09:11 +0200825static ieee80211_rx_result ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100826{
Harvey Harrisona7767f92008-07-02 16:30:51 -0700827 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
Johannes Berg47846c92009-11-25 17:46:19 +0100828 char *dev_addr = rx->sdata->vif.addr;
Johannes Bergd6d1a5a2008-02-25 16:24:38 +0100829
Harvey Harrisona7767f92008-07-02 16:30:51 -0700830 if (ieee80211_is_data(hdr->frame_control)) {
Javier Cardona3c5772a2009-08-10 12:15:48 -0700831 if (is_multicast_ether_addr(hdr->addr1)) {
832 if (ieee80211_has_tods(hdr->frame_control) ||
Johannes Berg1df332e2012-10-26 00:09:11 +0200833 !ieee80211_has_fromds(hdr->frame_control))
Javier Cardona3c5772a2009-08-10 12:15:48 -0700834 return RX_DROP_MONITOR;
Joe Perchesb203ca32012-05-08 18:56:52 +0000835 if (ether_addr_equal(hdr->addr3, dev_addr))
Javier Cardona3c5772a2009-08-10 12:15:48 -0700836 return RX_DROP_MONITOR;
837 } else {
838 if (!ieee80211_has_a4(hdr->frame_control))
839 return RX_DROP_MONITOR;
Joe Perchesb203ca32012-05-08 18:56:52 +0000840 if (ether_addr_equal(hdr->addr4, dev_addr))
Javier Cardona3c5772a2009-08-10 12:15:48 -0700841 return RX_DROP_MONITOR;
842 }
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100843 }
844
845 /* If there is not an established peer link and this is not a peer link
846 * establisment frame, beacon or probe, drop the frame.
847 */
848
Javier Cardona57cf8042011-05-13 10:45:43 -0700849 if (!rx->sta || sta_plink_state(rx->sta) != NL80211_PLINK_ESTAB) {
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100850 struct ieee80211_mgmt *mgmt;
Johannes Bergd6d1a5a2008-02-25 16:24:38 +0100851
Harvey Harrisona7767f92008-07-02 16:30:51 -0700852 if (!ieee80211_is_mgmt(hdr->frame_control))
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100853 return RX_DROP_MONITOR;
854
Harvey Harrisona7767f92008-07-02 16:30:51 -0700855 if (ieee80211_is_action(hdr->frame_control)) {
Javier Cardonad3aaec8a2011-05-03 16:57:09 -0700856 u8 category;
Johannes Berg9b395bc2012-10-26 00:36:40 +0200857
858 /* make sure category field is present */
859 if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE)
860 return RX_DROP_MONITOR;
861
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100862 mgmt = (struct ieee80211_mgmt *)hdr;
Javier Cardonad3aaec8a2011-05-03 16:57:09 -0700863 category = mgmt->u.action.category;
864 if (category != WLAN_CATEGORY_MESH_ACTION &&
Johannes Berg1df332e2012-10-26 00:09:11 +0200865 category != WLAN_CATEGORY_SELF_PROTECTED)
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100866 return RX_DROP_MONITOR;
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100867 return RX_CONTINUE;
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100868 }
869
Harvey Harrisona7767f92008-07-02 16:30:51 -0700870 if (ieee80211_is_probe_req(hdr->frame_control) ||
871 ieee80211_is_probe_resp(hdr->frame_control) ||
Javier Cardona71839122011-04-07 15:08:31 -0700872 ieee80211_is_beacon(hdr->frame_control) ||
873 ieee80211_is_auth(hdr->frame_control))
Harvey Harrisona7767f92008-07-02 16:30:51 -0700874 return RX_CONTINUE;
875
876 return RX_DROP_MONITOR;
Harvey Harrisona7767f92008-07-02 16:30:51 -0700877 }
878
Johannes Berg902acc72008-02-23 15:17:19 +0100879 return RX_CONTINUE;
880}
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100881
Johannes Bergfb4ea052016-01-28 16:19:24 +0200882static inline bool ieee80211_rx_reorder_ready(struct tid_ampdu_rx *tid_agg_rx,
883 int index)
884{
885 struct sk_buff_head *frames = &tid_agg_rx->reorder_buf[index];
886 struct sk_buff *tail = skb_peek_tail(frames);
887 struct ieee80211_rx_status *status;
888
Sara Sharon06470f72016-01-28 16:19:25 +0200889 if (tid_agg_rx->reorder_buf_filtered & BIT_ULL(index))
890 return true;
891
Johannes Bergfb4ea052016-01-28 16:19:24 +0200892 if (!tail)
893 return false;
894
895 status = IEEE80211_SKB_RXCB(tail);
896 if (status->flag & RX_FLAG_AMSDU_MORE)
897 return false;
898
899 return true;
900}
901
Johannes Bergd3b2fb52012-06-22 12:48:38 +0200902static void ieee80211_release_reorder_frame(struct ieee80211_sub_if_data *sdata,
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100903 struct tid_ampdu_rx *tid_agg_rx,
Christian Lamparterf9e124f2013-02-04 17:44:44 +0000904 int index,
905 struct sk_buff_head *frames)
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100906{
Michal Kazior83eb9352014-07-16 12:09:31 +0200907 struct sk_buff_head *skb_list = &tid_agg_rx->reorder_buf[index];
908 struct sk_buff *skb;
Christian Lamparter4cfda472010-12-27 23:21:26 +0100909 struct ieee80211_rx_status *status;
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100910
Johannes Bergdd318572010-11-29 11:09:16 +0100911 lockdep_assert_held(&tid_agg_rx->reorder_lock);
912
Michal Kazior83eb9352014-07-16 12:09:31 +0200913 if (skb_queue_empty(skb_list))
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100914 goto no_frame;
915
Johannes Bergfb4ea052016-01-28 16:19:24 +0200916 if (!ieee80211_rx_reorder_ready(tid_agg_rx, index)) {
Michal Kazior83eb9352014-07-16 12:09:31 +0200917 __skb_queue_purge(skb_list);
918 goto no_frame;
919 }
920
921 /* release frames from the reorder ring buffer */
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100922 tid_agg_rx->stored_mpdu_num--;
Michal Kazior83eb9352014-07-16 12:09:31 +0200923 while ((skb = __skb_dequeue(skb_list))) {
924 status = IEEE80211_SKB_RXCB(skb);
925 status->rx_flags |= IEEE80211_RX_DEFERRED_RELEASE;
926 __skb_queue_tail(frames, skb);
927 }
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100928
929no_frame:
Sara Sharon06470f72016-01-28 16:19:25 +0200930 tid_agg_rx->reorder_buf_filtered &= ~BIT_ULL(index);
Johannes Berg9a886582013-02-15 19:25:00 +0100931 tid_agg_rx->head_seq_num = ieee80211_sn_inc(tid_agg_rx->head_seq_num);
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100932}
933
Johannes Bergd3b2fb52012-06-22 12:48:38 +0200934static void ieee80211_release_reorder_frames(struct ieee80211_sub_if_data *sdata,
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100935 struct tid_ampdu_rx *tid_agg_rx,
Christian Lamparterf9e124f2013-02-04 17:44:44 +0000936 u16 head_seq_num,
937 struct sk_buff_head *frames)
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100938{
939 int index;
940
Johannes Bergdd318572010-11-29 11:09:16 +0100941 lockdep_assert_held(&tid_agg_rx->reorder_lock);
942
Johannes Berg9a886582013-02-15 19:25:00 +0100943 while (ieee80211_sn_less(tid_agg_rx->head_seq_num, head_seq_num)) {
Karl Beldan2e3049b2013-10-24 15:53:32 +0200944 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
Christian Lamparterf9e124f2013-02-04 17:44:44 +0000945 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
946 frames);
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100947 }
948}
949
950/*
951 * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If
952 * the skb was added to the buffer longer than this time ago, the earlier
953 * frames that have not yet been received are assumed to be lost and the skb
954 * can be released for processing. This may also release other skb's from the
955 * reorder buffer if there are no additional gaps between the frames.
Christian Lamparter2bff8eb2010-08-05 01:36:41 +0200956 *
957 * Callers must hold tid_agg_rx->reorder_lock.
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100958 */
959#define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)
960
Johannes Bergd3b2fb52012-06-22 12:48:38 +0200961static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata,
Christian Lamparterf9e124f2013-02-04 17:44:44 +0000962 struct tid_ampdu_rx *tid_agg_rx,
963 struct sk_buff_head *frames)
Christian Lamparteraa0c8632010-08-05 01:36:04 +0200964{
Michal Kazior83eb9352014-07-16 12:09:31 +0200965 int index, i, j;
Christian Lamparteraa0c8632010-08-05 01:36:04 +0200966
Johannes Bergdd318572010-11-29 11:09:16 +0100967 lockdep_assert_held(&tid_agg_rx->reorder_lock);
968
Christian Lamparteraa0c8632010-08-05 01:36:04 +0200969 /* release the buffer until next missing frame */
Karl Beldan2e3049b2013-10-24 15:53:32 +0200970 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
Johannes Bergfb4ea052016-01-28 16:19:24 +0200971 if (!ieee80211_rx_reorder_ready(tid_agg_rx, index) &&
Eliad Peller07ae2df2012-02-01 18:48:09 +0200972 tid_agg_rx->stored_mpdu_num) {
Christian Lamparteraa0c8632010-08-05 01:36:04 +0200973 /*
974 * No buffers ready to be released, but check whether any
975 * frames in the reorder buffer have timed out.
976 */
Christian Lamparteraa0c8632010-08-05 01:36:04 +0200977 int skipped = 1;
978 for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
979 j = (j + 1) % tid_agg_rx->buf_size) {
Johannes Bergfb4ea052016-01-28 16:19:24 +0200980 if (!ieee80211_rx_reorder_ready(tid_agg_rx, j)) {
Christian Lamparteraa0c8632010-08-05 01:36:04 +0200981 skipped++;
982 continue;
983 }
Daniel Halperin499fe9a2011-03-24 16:01:48 -0700984 if (skipped &&
985 !time_after(jiffies, tid_agg_rx->reorder_time[j] +
Christian Lamparteraa0c8632010-08-05 01:36:04 +0200986 HT_RX_REORDER_BUF_TIMEOUT))
Christian Lamparter2bff8eb2010-08-05 01:36:41 +0200987 goto set_release_timer;
Christian Lamparteraa0c8632010-08-05 01:36:04 +0200988
Michal Kazior83eb9352014-07-16 12:09:31 +0200989 /* don't leave incomplete A-MSDUs around */
990 for (i = (index + 1) % tid_agg_rx->buf_size; i != j;
991 i = (i + 1) % tid_agg_rx->buf_size)
992 __skb_queue_purge(&tid_agg_rx->reorder_buf[i]);
993
Johannes Bergbdcbd8e2012-06-22 11:29:50 +0200994 ht_dbg_ratelimited(sdata,
995 "release an RX reorder frame due to timeout on earlier frames\n");
Christian Lamparterf9e124f2013-02-04 17:44:44 +0000996 ieee80211_release_reorder_frame(sdata, tid_agg_rx, j,
997 frames);
Christian Lamparteraa0c8632010-08-05 01:36:04 +0200998
999 /*
1000 * Increment the head seq# also for the skipped slots.
1001 */
1002 tid_agg_rx->head_seq_num =
Johannes Berg9a886582013-02-15 19:25:00 +01001003 (tid_agg_rx->head_seq_num +
1004 skipped) & IEEE80211_SN_MASK;
Christian Lamparteraa0c8632010-08-05 01:36:04 +02001005 skipped = 0;
1006 }
Johannes Bergfb4ea052016-01-28 16:19:24 +02001007 } else while (ieee80211_rx_reorder_ready(tid_agg_rx, index)) {
Christian Lamparterf9e124f2013-02-04 17:44:44 +00001008 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
1009 frames);
Karl Beldan2e3049b2013-10-24 15:53:32 +02001010 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
Christian Lamparteraa0c8632010-08-05 01:36:04 +02001011 }
Christian Lamparter2bff8eb2010-08-05 01:36:41 +02001012
1013 if (tid_agg_rx->stored_mpdu_num) {
Karl Beldan2e3049b2013-10-24 15:53:32 +02001014 j = index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
Christian Lamparter2bff8eb2010-08-05 01:36:41 +02001015
1016 for (; j != (index - 1) % tid_agg_rx->buf_size;
1017 j = (j + 1) % tid_agg_rx->buf_size) {
Johannes Bergfb4ea052016-01-28 16:19:24 +02001018 if (ieee80211_rx_reorder_ready(tid_agg_rx, j))
Christian Lamparter2bff8eb2010-08-05 01:36:41 +02001019 break;
1020 }
1021
1022 set_release_timer:
1023
Johannes Berg788211d2015-04-01 14:20:42 +02001024 if (!tid_agg_rx->removed)
1025 mod_timer(&tid_agg_rx->reorder_timer,
1026 tid_agg_rx->reorder_time[j] + 1 +
1027 HT_RX_REORDER_BUF_TIMEOUT);
Christian Lamparter2bff8eb2010-08-05 01:36:41 +02001028 } else {
1029 del_timer(&tid_agg_rx->reorder_timer);
1030 }
Christian Lamparteraa0c8632010-08-05 01:36:04 +02001031}
1032
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001033/*
1034 * As this function belongs to the RX path it must be under
1035 * rcu_read_lock protection. It returns false if the frame
1036 * can be processed immediately, true if it was consumed.
1037 */
Johannes Bergd3b2fb52012-06-22 12:48:38 +02001038static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata,
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001039 struct tid_ampdu_rx *tid_agg_rx,
Christian Lamparterf9e124f2013-02-04 17:44:44 +00001040 struct sk_buff *skb,
1041 struct sk_buff_head *frames)
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001042{
1043 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
Michal Kazior83eb9352014-07-16 12:09:31 +02001044 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001045 u16 sc = le16_to_cpu(hdr->seq_ctrl);
1046 u16 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
1047 u16 head_seq_num, buf_size;
1048 int index;
Christian Lamparter2bff8eb2010-08-05 01:36:41 +02001049 bool ret = true;
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001050
Johannes Bergdd318572010-11-29 11:09:16 +01001051 spin_lock(&tid_agg_rx->reorder_lock);
1052
Michal Kazior4549cf22014-09-02 14:05:10 +02001053 /*
1054 * Offloaded BA sessions have no known starting sequence number so pick
1055 * one from first Rxed frame for this tid after BA was started.
1056 */
1057 if (unlikely(tid_agg_rx->auto_seq)) {
1058 tid_agg_rx->auto_seq = false;
1059 tid_agg_rx->ssn = mpdu_seq_num;
1060 tid_agg_rx->head_seq_num = mpdu_seq_num;
1061 }
1062
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001063 buf_size = tid_agg_rx->buf_size;
1064 head_seq_num = tid_agg_rx->head_seq_num;
1065
Sara Sharon42e7f372017-02-06 15:28:42 +02001066 /*
1067 * If the current MPDU's SN is smaller than the SSN, it shouldn't
1068 * be reordered.
1069 */
1070 if (unlikely(!tid_agg_rx->started)) {
1071 if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) {
1072 ret = false;
1073 goto out;
1074 }
1075 tid_agg_rx->started = true;
1076 }
1077
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001078 /* frame with out of date sequence number */
Johannes Berg9a886582013-02-15 19:25:00 +01001079 if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) {
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001080 dev_kfree_skb(skb);
Christian Lamparter2bff8eb2010-08-05 01:36:41 +02001081 goto out;
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001082 }
1083
1084 /*
1085 * If frame the sequence number exceeds our buffering window
1086 * size release some previous frames to make room for this one.
1087 */
Johannes Berg9a886582013-02-15 19:25:00 +01001088 if (!ieee80211_sn_less(mpdu_seq_num, head_seq_num + buf_size)) {
1089 head_seq_num = ieee80211_sn_inc(
1090 ieee80211_sn_sub(mpdu_seq_num, buf_size));
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001091 /* release stored frames up to new head to stack */
Johannes Bergd3b2fb52012-06-22 12:48:38 +02001092 ieee80211_release_reorder_frames(sdata, tid_agg_rx,
Christian Lamparterf9e124f2013-02-04 17:44:44 +00001093 head_seq_num, frames);
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001094 }
1095
1096 /* Now the new frame is always in the range of the reordering buffer */
1097
Karl Beldan2e3049b2013-10-24 15:53:32 +02001098 index = mpdu_seq_num % tid_agg_rx->buf_size;
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001099
1100 /* check if we already stored this frame */
Johannes Bergfb4ea052016-01-28 16:19:24 +02001101 if (ieee80211_rx_reorder_ready(tid_agg_rx, index)) {
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001102 dev_kfree_skb(skb);
Christian Lamparter2bff8eb2010-08-05 01:36:41 +02001103 goto out;
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001104 }
1105
1106 /*
1107 * If the current MPDU is in the right order and nothing else
1108 * is stored we can process it directly, no need to buffer it.
Johannes Bergc835b212011-03-15 23:17:01 +01001109 * If it is first but there's something stored, we may be able
1110 * to release frames after this one.
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001111 */
1112 if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
1113 tid_agg_rx->stored_mpdu_num == 0) {
Michal Kazior83eb9352014-07-16 12:09:31 +02001114 if (!(status->flag & RX_FLAG_AMSDU_MORE))
1115 tid_agg_rx->head_seq_num =
1116 ieee80211_sn_inc(tid_agg_rx->head_seq_num);
Christian Lamparter2bff8eb2010-08-05 01:36:41 +02001117 ret = false;
1118 goto out;
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001119 }
1120
1121 /* put the frame in the reordering buffer */
Michal Kazior83eb9352014-07-16 12:09:31 +02001122 __skb_queue_tail(&tid_agg_rx->reorder_buf[index], skb);
1123 if (!(status->flag & RX_FLAG_AMSDU_MORE)) {
1124 tid_agg_rx->reorder_time[index] = jiffies;
1125 tid_agg_rx->stored_mpdu_num++;
1126 ieee80211_sta_reorder_release(sdata, tid_agg_rx, frames);
1127 }
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001128
Christian Lamparter2bff8eb2010-08-05 01:36:41 +02001129 out:
1130 spin_unlock(&tid_agg_rx->reorder_lock);
1131 return ret;
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001132}
1133
1134/*
1135 * Reorder MPDUs from A-MPDUs, keeping them on a buffer. Returns
1136 * true if the MPDU was buffered, false if it should be processed.
1137 */
Christian Lamparterf9e124f2013-02-04 17:44:44 +00001138static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx,
1139 struct sk_buff_head *frames)
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001140{
Johannes Berg2569a822009-11-25 17:46:17 +01001141 struct sk_buff *skb = rx->skb;
1142 struct ieee80211_local *local = rx->local;
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001143 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
Johannes Berg2569a822009-11-25 17:46:17 +01001144 struct sta_info *sta = rx->sta;
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001145 struct tid_ampdu_rx *tid_agg_rx;
1146 u16 sc;
Thomas Pedersen6cc00d52011-11-03 21:11:11 -07001147 u8 tid, ack_policy;
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001148
Johannes Berg051a41f2013-11-20 11:28:27 +01001149 if (!ieee80211_is_data_qos(hdr->frame_control) ||
1150 is_multicast_ether_addr(hdr->addr1))
Johannes Berg2569a822009-11-25 17:46:17 +01001151 goto dont_reorder;
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001152
1153 /*
1154 * filter the QoS data rx stream according to
1155 * STA/TID and check if this STA/TID is on aggregation
1156 */
1157
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001158 if (!sta)
Johannes Berg2569a822009-11-25 17:46:17 +01001159 goto dont_reorder;
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001160
Thomas Pedersen6cc00d52011-11-03 21:11:11 -07001161 ack_policy = *ieee80211_get_qos_ctl(hdr) &
1162 IEEE80211_QOS_CTL_ACK_POLICY_MASK;
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001163 tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
1164
Johannes Berga87f7362010-06-10 10:21:38 +02001165 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
Johannes Bergbfe40fa2016-08-29 23:25:18 +03001166 if (!tid_agg_rx) {
1167 if (ack_policy == IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK &&
1168 !test_bit(tid, rx->sta->ampdu_mlme.agg_session_valid) &&
1169 !test_and_set_bit(tid, rx->sta->ampdu_mlme.unexpected_agg))
1170 ieee80211_send_delba(rx->sdata, rx->sta->sta.addr, tid,
1171 WLAN_BACK_RECIPIENT,
1172 WLAN_REASON_QSTA_REQUIRE_SETUP);
Johannes Berga87f7362010-06-10 10:21:38 +02001173 goto dont_reorder;
Johannes Bergbfe40fa2016-08-29 23:25:18 +03001174 }
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001175
1176 /* qos null data frames are excluded */
1177 if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
Johannes Berga87f7362010-06-10 10:21:38 +02001178 goto dont_reorder;
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001179
Thomas Pedersen6cc00d52011-11-03 21:11:11 -07001180 /* not part of a BA session */
1181 if (ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK &&
1182 ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_NORMAL)
1183 goto dont_reorder;
1184
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001185 /* new, potentially un-ordered, ampdu frame - process it */
1186
1187 /* reset session timer */
1188 if (tid_agg_rx->timeout)
Felix Fietkau12d3952f2012-03-18 22:58:06 +01001189 tid_agg_rx->last_rx = jiffies;
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001190
1191 /* if this mpdu is fragmented - terminate rx aggregation session */
1192 sc = le16_to_cpu(hdr->seq_ctrl);
1193 if (sc & IEEE80211_SCTL_FRAG) {
Johannes Bergc1475ca2010-06-10 10:21:37 +02001194 skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
Johannes Berg344eec62010-06-10 10:21:36 +02001195 skb_queue_tail(&rx->sdata->skb_queue, skb);
1196 ieee80211_queue_work(&local->hw, &rx->sdata->work);
Johannes Berg2569a822009-11-25 17:46:17 +01001197 return;
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001198 }
1199
Johannes Berga87f7362010-06-10 10:21:38 +02001200 /*
1201 * No locking needed -- we will only ever process one
1202 * RX packet at a time, and thus own tid_agg_rx. All
1203 * other code manipulating it needs to (and does) make
1204 * sure that we cannot get to it any more before doing
1205 * anything with it.
1206 */
Christian Lamparterf9e124f2013-02-04 17:44:44 +00001207 if (ieee80211_sta_manage_reorder_buf(rx->sdata, tid_agg_rx, skb,
1208 frames))
Johannes Berg2569a822009-11-25 17:46:17 +01001209 return;
1210
1211 dont_reorder:
Christian Lamparterf9e124f2013-02-04 17:44:44 +00001212 __skb_queue_tail(frames, skb);
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001213}
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +01001214
Johannes Berg49461622008-06-30 15:10:45 +02001215static ieee80211_rx_result debug_noinline
Johannes Berg03954422014-11-11 16:49:25 +01001216ieee80211_rx_h_check_dup(struct ieee80211_rx_data *rx)
Johannes Berg571ecf62007-07-27 15:43:22 +02001217{
Harvey Harrisona7767f92008-07-02 16:30:51 -07001218 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
Johannes Berg554891e2010-09-24 12:38:25 +02001219 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
Johannes Berg571ecf62007-07-27 15:43:22 +02001220
Sara Sharonf9cfa5f2015-12-08 16:04:33 +02001221 if (status->flag & RX_FLAG_DUP_VALIDATED)
1222 return RX_CONTINUE;
1223
Johannes Berg6b0f3272013-07-11 22:33:26 +02001224 /*
1225 * Drop duplicate 802.11 retransmissions
1226 * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery")
1227 */
Johannes Berg03954422014-11-11 16:49:25 +01001228
1229 if (rx->skb->len < 24)
1230 return RX_CONTINUE;
1231
1232 if (ieee80211_is_ctl(hdr->frame_control) ||
1233 ieee80211_is_qos_nullfunc(hdr->frame_control) ||
1234 is_multicast_ether_addr(hdr->addr1))
1235 return RX_CONTINUE;
1236
Johannes Berga732fa72015-10-14 18:27:07 +02001237 if (!rx->sta)
1238 return RX_CONTINUE;
1239
1240 if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
1241 rx->sta->last_seq_ctrl[rx->seqno_idx] == hdr->seq_ctrl)) {
1242 I802_DEBUG_INC(rx->local->dot11FrameDuplicateCount);
Johannes Berge5a9f8d2015-10-16 17:54:47 +02001243 rx->sta->rx_stats.num_duplicates++;
Johannes Berga732fa72015-10-14 18:27:07 +02001244 return RX_DROP_UNUSABLE;
1245 } else if (!(status->flag & RX_FLAG_AMSDU_MORE)) {
1246 rx->sta->last_seq_ctrl[rx->seqno_idx] = hdr->seq_ctrl;
Johannes Berg571ecf62007-07-27 15:43:22 +02001247 }
1248
Johannes Berg03954422014-11-11 16:49:25 +01001249 return RX_CONTINUE;
1250}
1251
1252static ieee80211_rx_result debug_noinline
1253ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
1254{
1255 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1256
Johannes Berg571ecf62007-07-27 15:43:22 +02001257 /* Drop disallowed frame classes based on STA auth/assoc state;
1258 * IEEE 802.11, Chap 5.5.
1259 *
Johannes Bergccd7b362008-09-11 00:01:56 +02001260 * mac80211 filters only based on association state, i.e. it drops
1261 * Class 3 frames from not associated stations. hostapd sends
Johannes Berg571ecf62007-07-27 15:43:22 +02001262 * deauth/disassoc frames when needed. In addition, hostapd is
1263 * responsible for filtering on both auth and assoc states.
1264 */
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +01001265
Johannes Berg902acc72008-02-23 15:17:19 +01001266 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +01001267 return ieee80211_rx_mesh_check(rx);
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +01001268
Harvey Harrisona7767f92008-07-02 16:30:51 -07001269 if (unlikely((ieee80211_is_data(hdr->frame_control) ||
1270 ieee80211_is_pspoll(hdr->frame_control)) &&
Johannes Berg05c914f2008-09-11 00:01:58 +02001271 rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
Bill Jordan1be7fe82010-10-01 11:20:41 -04001272 rx->sdata->vif.type != NL80211_IFTYPE_WDS &&
Rostislav Lisovy239281f2014-11-03 10:33:19 +01001273 rx->sdata->vif.type != NL80211_IFTYPE_OCB &&
Johannes Bergc2c98fd2011-09-29 16:04:36 +02001274 (!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_ASSOC)))) {
Johannes Berg7852e362012-01-20 13:55:24 +01001275 /*
1276 * accept port control frames from the AP even when it's not
1277 * yet marked ASSOC to prevent a race where we don't set the
1278 * assoc bit quickly enough before it sends the first frame
1279 */
1280 if (rx->sta && rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
Guy Eilam2a33bee2011-08-17 15:18:15 +03001281 ieee80211_is_data_present(hdr->frame_control)) {
Johannes Berg6dbda2d2012-10-26 00:41:23 +02001282 unsigned int hdrlen;
1283 __be16 ethertype;
Guy Eilam2a33bee2011-08-17 15:18:15 +03001284
Johannes Berg6dbda2d2012-10-26 00:41:23 +02001285 hdrlen = ieee80211_hdrlen(hdr->frame_control);
1286
1287 if (rx->skb->len < hdrlen + 8)
1288 return RX_DROP_MONITOR;
1289
1290 skb_copy_bits(rx->skb, hdrlen + 6, &ethertype, 2);
1291 if (ethertype == rx->sdata->control_port_protocol)
Guy Eilam2a33bee2011-08-17 15:18:15 +03001292 return RX_CONTINUE;
1293 }
Johannes Berg21fc7562011-11-04 11:18:13 +01001294
1295 if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
1296 cfg80211_rx_spurious_frame(rx->sdata->dev,
1297 hdr->addr2,
1298 GFP_ATOMIC))
1299 return RX_DROP_UNUSABLE;
1300
Johannes Berge4c26ad2008-01-31 19:48:21 +01001301 return RX_DROP_MONITOR;
Guy Eilam2a33bee2011-08-17 15:18:15 +03001302 }
Johannes Berg571ecf62007-07-27 15:43:22 +02001303
Johannes Berg9ae54c82008-01-31 19:48:20 +01001304 return RX_CONTINUE;
Johannes Berg570bd532007-07-27 15:43:22 +02001305}
1306
1307
Johannes Berg49461622008-06-30 15:10:45 +02001308static ieee80211_rx_result debug_noinline
Kalle Valo572e0012009-02-10 17:09:31 +02001309ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx)
1310{
1311 struct ieee80211_local *local;
1312 struct ieee80211_hdr *hdr;
1313 struct sk_buff *skb;
1314
1315 local = rx->local;
1316 skb = rx->skb;
1317 hdr = (struct ieee80211_hdr *) skb->data;
1318
1319 if (!local->pspolling)
1320 return RX_CONTINUE;
1321
1322 if (!ieee80211_has_fromds(hdr->frame_control))
1323 /* this is not from AP */
1324 return RX_CONTINUE;
1325
1326 if (!ieee80211_is_data(hdr->frame_control))
1327 return RX_CONTINUE;
1328
1329 if (!ieee80211_has_moredata(hdr->frame_control)) {
1330 /* AP has no more frames buffered for us */
1331 local->pspolling = false;
1332 return RX_CONTINUE;
1333 }
1334
1335 /* more data bit is set, let's request a new frame from the AP */
1336 ieee80211_send_pspoll(local, rx->sdata);
1337
1338 return RX_CONTINUE;
1339}
1340
Marco Porschd012a602012-10-10 12:39:50 -07001341static void sta_ps_start(struct sta_info *sta)
Johannes Berg571ecf62007-07-27 15:43:22 +02001342{
Johannes Berg133b8222008-09-16 14:18:59 +02001343 struct ieee80211_sub_if_data *sdata = sta->sdata;
Christian Lamparter4571d3b2008-11-30 00:48:41 +01001344 struct ieee80211_local *local = sdata->local;
Marco Porschd012a602012-10-10 12:39:50 -07001345 struct ps_data *ps;
Felix Fietkauba8c3d62015-03-27 21:30:37 +01001346 int tid;
Joe Perches0795af52007-10-03 17:59:30 -07001347
Marco Porschd012a602012-10-10 12:39:50 -07001348 if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
1349 sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
1350 ps = &sdata->bss->ps;
1351 else
1352 return;
1353
1354 atomic_inc(&ps->num_sta_ps);
Johannes Bergc2c98fd2011-09-29 16:04:36 +02001355 set_sta_flag(sta, WLAN_STA_PS_STA);
Johannes Berg30686bf2015-06-02 21:39:54 +02001356 if (!ieee80211_hw_check(&local->hw, AP_LINK_PS))
Arik Nemtsovd057e5a2011-01-31 22:29:13 +02001357 drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta);
Johannes Bergbdcbd8e2012-06-22 11:29:50 +02001358 ps_dbg(sdata, "STA %pM aid %d enters power save mode\n",
1359 sta->sta.addr, sta->sta.aid);
Felix Fietkauba8c3d62015-03-27 21:30:37 +01001360
Johannes Berg17c18bf2015-03-21 15:25:43 +01001361 ieee80211_clear_fast_xmit(sta);
1362
Felix Fietkauba8c3d62015-03-27 21:30:37 +01001363 if (!sta->sta.txq[0])
1364 return;
1365
1366 for (tid = 0; tid < ARRAY_SIZE(sta->sta.txq); tid++) {
Toke Høiland-Jørgensenbb42f2d2016-09-22 19:04:20 +02001367 if (txq_has_queue(sta->sta.txq[tid]))
Felix Fietkauba8c3d62015-03-27 21:30:37 +01001368 set_bit(tid, &sta->txq_buffered_tids);
1369 else
1370 clear_bit(tid, &sta->txq_buffered_tids);
1371 }
Johannes Berg571ecf62007-07-27 15:43:22 +02001372}
1373
Marco Porschd012a602012-10-10 12:39:50 -07001374static void sta_ps_end(struct sta_info *sta)
Johannes Berg571ecf62007-07-27 15:43:22 +02001375{
Johannes Bergbdcbd8e2012-06-22 11:29:50 +02001376 ps_dbg(sta->sdata, "STA %pM aid %d exits power save mode\n",
1377 sta->sta.addr, sta->sta.aid);
Johannes Berg004c8722008-02-20 11:21:35 +01001378
Johannes Bergc2c98fd2011-09-29 16:04:36 +02001379 if (test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
Johannes Berge3685e02014-02-20 11:19:58 +01001380 /*
1381 * Clear the flag only if the other one is still set
1382 * so that the TX path won't start TX'ing new frames
1383 * directly ... In the case that the driver flag isn't
1384 * set ieee80211_sta_ps_deliver_wakeup() will clear it.
1385 */
1386 clear_sta_flag(sta, WLAN_STA_PS_STA);
Johannes Bergbdcbd8e2012-06-22 11:29:50 +02001387 ps_dbg(sta->sdata, "STA %pM aid %d driver-ps-blocked\n",
1388 sta->sta.addr, sta->sta.aid);
Johannes Bergaf818582009-11-06 11:35:50 +01001389 return;
1390 }
1391
Johannes Berg5ac2e352014-05-27 16:32:27 +02001392 set_sta_flag(sta, WLAN_STA_PS_DELIVER);
1393 clear_sta_flag(sta, WLAN_STA_PS_STA);
Johannes Bergaf818582009-11-06 11:35:50 +01001394 ieee80211_sta_ps_deliver_wakeup(sta);
Johannes Berg571ecf62007-07-27 15:43:22 +02001395}
1396
Johannes Bergcf471612015-06-16 16:16:38 +02001397int ieee80211_sta_ps_transition(struct ieee80211_sta *pubsta, bool start)
Arik Nemtsovd057e5a2011-01-31 22:29:13 +02001398{
Johannes Bergcf471612015-06-16 16:16:38 +02001399 struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
Arik Nemtsovd057e5a2011-01-31 22:29:13 +02001400 bool in_ps;
1401
Johannes Bergcf471612015-06-16 16:16:38 +02001402 WARN_ON(!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS));
Arik Nemtsovd057e5a2011-01-31 22:29:13 +02001403
1404 /* Don't let the same PS state be set twice */
Johannes Bergcf471612015-06-16 16:16:38 +02001405 in_ps = test_sta_flag(sta, WLAN_STA_PS_STA);
Arik Nemtsovd057e5a2011-01-31 22:29:13 +02001406 if ((start && in_ps) || (!start && !in_ps))
1407 return -EINVAL;
1408
1409 if (start)
Johannes Bergcf471612015-06-16 16:16:38 +02001410 sta_ps_start(sta);
Arik Nemtsovd057e5a2011-01-31 22:29:13 +02001411 else
Johannes Bergcf471612015-06-16 16:16:38 +02001412 sta_ps_end(sta);
Arik Nemtsovd057e5a2011-01-31 22:29:13 +02001413
1414 return 0;
1415}
1416EXPORT_SYMBOL(ieee80211_sta_ps_transition);
1417
Johannes Berg46fa38e2016-05-03 16:58:00 +03001418void ieee80211_sta_pspoll(struct ieee80211_sta *pubsta)
1419{
1420 struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1421
1422 if (test_sta_flag(sta, WLAN_STA_SP))
1423 return;
1424
1425 if (!test_sta_flag(sta, WLAN_STA_PS_DRIVER))
1426 ieee80211_sta_ps_deliver_poll_response(sta);
1427 else
1428 set_sta_flag(sta, WLAN_STA_PSPOLL);
1429}
1430EXPORT_SYMBOL(ieee80211_sta_pspoll);
1431
1432void ieee80211_sta_uapsd_trigger(struct ieee80211_sta *pubsta, u8 tid)
1433{
1434 struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1435 u8 ac = ieee802_1d_to_ac[tid & 7];
1436
1437 /*
1438 * If this AC is not trigger-enabled do nothing.
1439 *
1440 * NB: This could/should check a separate bitmap of trigger-
1441 * enabled queues, but for now we only implement uAPSD w/o
1442 * TSPEC changes to the ACs, so they're always the same.
1443 */
1444 if (!(sta->sta.uapsd_queues & BIT(ac)))
1445 return;
1446
1447 /* if we are in a service period, do nothing */
1448 if (test_sta_flag(sta, WLAN_STA_SP))
1449 return;
1450
1451 if (!test_sta_flag(sta, WLAN_STA_PS_DRIVER))
1452 ieee80211_sta_ps_deliver_uapsd(sta);
1453 else
1454 set_sta_flag(sta, WLAN_STA_UAPSD);
1455}
1456EXPORT_SYMBOL(ieee80211_sta_uapsd_trigger);
1457
Johannes Berg49461622008-06-30 15:10:45 +02001458static ieee80211_rx_result debug_noinline
Johannes Berg47086fc2011-09-29 16:04:33 +02001459ieee80211_rx_h_uapsd_and_pspoll(struct ieee80211_rx_data *rx)
1460{
1461 struct ieee80211_sub_if_data *sdata = rx->sdata;
1462 struct ieee80211_hdr *hdr = (void *)rx->skb->data;
1463 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
Johannes Berg47086fc2011-09-29 16:04:33 +02001464
Johannes Berg5c900672015-04-22 14:48:34 +02001465 if (!rx->sta)
Johannes Berg47086fc2011-09-29 16:04:33 +02001466 return RX_CONTINUE;
1467
1468 if (sdata->vif.type != NL80211_IFTYPE_AP &&
1469 sdata->vif.type != NL80211_IFTYPE_AP_VLAN)
1470 return RX_CONTINUE;
1471
1472 /*
1473 * The device handles station powersave, so don't do anything about
1474 * uAPSD and PS-Poll frames (the latter shouldn't even come up from
1475 * it to mac80211 since they're handled.)
1476 */
Johannes Berg30686bf2015-06-02 21:39:54 +02001477 if (ieee80211_hw_check(&sdata->local->hw, AP_LINK_PS))
Johannes Berg47086fc2011-09-29 16:04:33 +02001478 return RX_CONTINUE;
1479
1480 /*
1481 * Don't do anything if the station isn't already asleep. In
1482 * the uAPSD case, the station will probably be marked asleep,
1483 * in the PS-Poll case the station must be confused ...
1484 */
Johannes Bergc2c98fd2011-09-29 16:04:36 +02001485 if (!test_sta_flag(rx->sta, WLAN_STA_PS_STA))
Johannes Berg47086fc2011-09-29 16:04:33 +02001486 return RX_CONTINUE;
1487
1488 if (unlikely(ieee80211_is_pspoll(hdr->frame_control))) {
Johannes Berg46fa38e2016-05-03 16:58:00 +03001489 ieee80211_sta_pspoll(&rx->sta->sta);
Johannes Berg47086fc2011-09-29 16:04:33 +02001490
1491 /* Free PS Poll skb here instead of returning RX_DROP that would
1492 * count as an dropped frame. */
1493 dev_kfree_skb(rx->skb);
1494
1495 return RX_QUEUED;
1496 } else if (!ieee80211_has_morefrags(hdr->frame_control) &&
1497 !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
1498 ieee80211_has_pm(hdr->frame_control) &&
1499 (ieee80211_is_data_qos(hdr->frame_control) ||
1500 ieee80211_is_qos_nullfunc(hdr->frame_control))) {
Johannes Berg46fa38e2016-05-03 16:58:00 +03001501 u8 tid;
1502
Johannes Berg47086fc2011-09-29 16:04:33 +02001503 tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
Johannes Berg47086fc2011-09-29 16:04:33 +02001504
Johannes Berg46fa38e2016-05-03 16:58:00 +03001505 ieee80211_sta_uapsd_trigger(&rx->sta->sta, tid);
Johannes Berg47086fc2011-09-29 16:04:33 +02001506 }
1507
1508 return RX_CONTINUE;
1509}
1510
1511static ieee80211_rx_result debug_noinline
Johannes Berg5cf121c2008-02-25 16:27:43 +01001512ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
Johannes Berg571ecf62007-07-27 15:43:22 +02001513{
1514 struct sta_info *sta = rx->sta;
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01001515 struct sk_buff *skb = rx->skb;
1516 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1517 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
Felix Fietkauef0621e2013-04-22 16:29:31 +02001518 int i;
Johannes Berg571ecf62007-07-27 15:43:22 +02001519
1520 if (!sta)
Johannes Berg9ae54c82008-01-31 19:48:20 +01001521 return RX_CONTINUE;
Johannes Berg571ecf62007-07-27 15:43:22 +02001522
Johannes Bergb291ba12009-07-10 15:29:03 +02001523 /*
1524 * Update last_rx only for IBSS packets which are for the current
Antonio Quartullie584da5e2012-11-25 23:13:42 +01001525 * BSSID and for station already AUTHORIZED to avoid keeping the
1526 * current IBSS network alive in cases where other STAs start
1527 * using different BSSID. This will also give the station another
1528 * chance to restart the authentication/authorization in case
1529 * something went wrong the first time.
Johannes Bergb291ba12009-07-10 15:29:03 +02001530 */
Johannes Berg05c914f2008-09-11 00:01:58 +02001531 if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
Ron Rindjunsky71364712007-12-25 17:00:36 +02001532 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
Johannes Berg05c914f2008-09-11 00:01:58 +02001533 NL80211_IFTYPE_ADHOC);
Antonio Quartullie584da5e2012-11-25 23:13:42 +01001534 if (ether_addr_equal(bssid, rx->sdata->u.ibss.bssid) &&
1535 test_sta_flag(sta, WLAN_STA_AUTHORIZED)) {
Johannes Berge5a9f8d2015-10-16 17:54:47 +02001536 sta->rx_stats.last_rx = jiffies;
Henning Roggef4ebddf2014-05-01 10:03:46 +02001537 if (ieee80211_is_data(hdr->frame_control) &&
Johannes Berg4f6b1b32016-03-31 20:02:08 +03001538 !is_multicast_ether_addr(hdr->addr1))
1539 sta->rx_stats.last_rate =
1540 sta_stats_encode_rate(status);
Felix Fietkau3af63342011-02-27 22:08:01 +01001541 }
Rostislav Lisovy239281f2014-11-03 10:33:19 +01001542 } else if (rx->sdata->vif.type == NL80211_IFTYPE_OCB) {
Johannes Berge5a9f8d2015-10-16 17:54:47 +02001543 sta->rx_stats.last_rx = jiffies;
Johannes Bergb291ba12009-07-10 15:29:03 +02001544 } else if (!is_multicast_ether_addr(hdr->addr1)) {
1545 /*
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +01001546 * Mesh beacons will update last_rx when if they are found to
1547 * match the current local configuration when processed.
Johannes Berg571ecf62007-07-27 15:43:22 +02001548 */
Johannes Berge5a9f8d2015-10-16 17:54:47 +02001549 sta->rx_stats.last_rx = jiffies;
Johannes Berg4f6b1b32016-03-31 20:02:08 +03001550 if (ieee80211_is_data(hdr->frame_control))
1551 sta->rx_stats.last_rate = sta_stats_encode_rate(status);
Johannes Berg571ecf62007-07-27 15:43:22 +02001552 }
1553
Kalle Valo3cf335d2009-03-22 21:57:06 +02001554 if (rx->sdata->vif.type == NL80211_IFTYPE_STATION)
1555 ieee80211_sta_rx_notify(rx->sdata, hdr);
1556
Johannes Berge5a9f8d2015-10-16 17:54:47 +02001557 sta->rx_stats.fragments++;
Johannes Berg0f9c5a62016-03-31 20:02:09 +03001558
1559 u64_stats_update_begin(&rx->sta->rx_stats.syncp);
Johannes Berge5a9f8d2015-10-16 17:54:47 +02001560 sta->rx_stats.bytes += rx->skb->len;
Johannes Berg0f9c5a62016-03-31 20:02:09 +03001561 u64_stats_update_end(&rx->sta->rx_stats.syncp);
1562
Felix Fietkaufe8431f2012-03-01 18:00:07 +01001563 if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
Johannes Berge5a9f8d2015-10-16 17:54:47 +02001564 sta->rx_stats.last_signal = status->signal;
Johannes Berg0be6ed12016-03-31 20:02:05 +03001565 ewma_signal_add(&sta->rx_stats_avg.signal, -status->signal);
Felix Fietkaufe8431f2012-03-01 18:00:07 +01001566 }
Johannes Berg571ecf62007-07-27 15:43:22 +02001567
Felix Fietkauef0621e2013-04-22 16:29:31 +02001568 if (status->chains) {
Johannes Berge5a9f8d2015-10-16 17:54:47 +02001569 sta->rx_stats.chains = status->chains;
Felix Fietkauef0621e2013-04-22 16:29:31 +02001570 for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {
1571 int signal = status->chain_signal[i];
1572
1573 if (!(status->chains & BIT(i)))
1574 continue;
1575
Johannes Berge5a9f8d2015-10-16 17:54:47 +02001576 sta->rx_stats.chain_signal_last[i] = signal;
Johannes Berg0be6ed12016-03-31 20:02:05 +03001577 ewma_signal_add(&sta->rx_stats_avg.chain_signal[i],
Johannes Berge5a9f8d2015-10-16 17:54:47 +02001578 -signal);
Felix Fietkauef0621e2013-04-22 16:29:31 +02001579 }
1580 }
1581
Johannes Berg72eaa432008-11-26 15:02:58 +01001582 /*
1583 * Change STA power saving mode only at the end of a frame
1584 * exchange sequence.
1585 */
Johannes Berg30686bf2015-06-02 21:39:54 +02001586 if (!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS) &&
Arik Nemtsovd057e5a2011-01-31 22:29:13 +02001587 !ieee80211_has_morefrags(hdr->frame_control) &&
Emmanuel Grumbach2ec5b682017-06-08 14:00:49 +03001588 !ieee80211_is_back_req(hdr->frame_control) &&
Christian Lamparter4cfda472010-12-27 23:21:26 +01001589 !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
Johannes Berg05c914f2008-09-11 00:01:58 +02001590 (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
Johannes Bergb4ba5442014-01-24 14:41:44 +01001591 rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
Emmanuel Grumbach2ec5b682017-06-08 14:00:49 +03001592 /*
1593 * PM bit is only checked in frames where it isn't reserved,
Johannes Bergb4ba5442014-01-24 14:41:44 +01001594 * in AP mode it's reserved in non-bufferable management frames
1595 * (cf. IEEE 802.11-2012 8.2.4.1.7 Power Management field)
Emmanuel Grumbach2ec5b682017-06-08 14:00:49 +03001596 * BAR frames should be ignored as specified in
1597 * IEEE 802.11-2012 10.2.1.2.
Johannes Bergb4ba5442014-01-24 14:41:44 +01001598 */
1599 (!ieee80211_is_mgmt(hdr->frame_control) ||
1600 ieee80211_is_bufferable_mmpdu(hdr->frame_control))) {
Johannes Bergc2c98fd2011-09-29 16:04:36 +02001601 if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
Johannes Bergb4ba5442014-01-24 14:41:44 +01001602 if (!ieee80211_has_pm(hdr->frame_control))
Marco Porschd012a602012-10-10 12:39:50 -07001603 sta_ps_end(sta);
Johannes Berg72eaa432008-11-26 15:02:58 +01001604 } else {
1605 if (ieee80211_has_pm(hdr->frame_control))
Marco Porschd012a602012-10-10 12:39:50 -07001606 sta_ps_start(sta);
Johannes Berg72eaa432008-11-26 15:02:58 +01001607 }
Johannes Berg571ecf62007-07-27 15:43:22 +02001608 }
1609
Marco Porsch3f52b7e2013-01-30 18:14:08 +01001610 /* mesh power save support */
1611 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
1612 ieee80211_mps_rx_h_sta_process(sta, hdr);
1613
Johannes Berg22403de2009-10-30 12:55:03 +01001614 /*
1615 * Drop (qos-)data::nullfunc frames silently, since they
1616 * are used only to control station power saving mode.
1617 */
1618 if (ieee80211_is_nullfunc(hdr->frame_control) ||
1619 ieee80211_is_qos_nullfunc(hdr->frame_control)) {
Johannes Berg571ecf62007-07-27 15:43:22 +02001620 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
Felix Fietkaud5242152010-01-08 18:06:26 +01001621
1622 /*
1623 * If we receive a 4-addr nullfunc frame from a STA
Johannes Berge7f4a942011-11-04 11:18:20 +01001624 * that was not moved to a 4-addr STA vlan yet send
1625 * the event to userspace and for older hostapd drop
1626 * the frame to the monitor interface.
Felix Fietkaud5242152010-01-08 18:06:26 +01001627 */
1628 if (ieee80211_has_a4(hdr->frame_control) &&
1629 (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1630 (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
Johannes Berge7f4a942011-11-04 11:18:20 +01001631 !rx->sdata->u.vlan.sta))) {
1632 if (!test_and_set_sta_flag(sta, WLAN_STA_4ADDR_EVENT))
1633 cfg80211_rx_unexpected_4addr_frame(
1634 rx->sdata->dev, sta->sta.addr,
1635 GFP_ATOMIC);
Felix Fietkaud5242152010-01-08 18:06:26 +01001636 return RX_DROP_MONITOR;
Johannes Berge7f4a942011-11-04 11:18:20 +01001637 }
Johannes Berg22403de2009-10-30 12:55:03 +01001638 /*
1639 * Update counter and free packet here to avoid
1640 * counting this as a dropped packed.
1641 */
Johannes Berge5a9f8d2015-10-16 17:54:47 +02001642 sta->rx_stats.packets++;
Johannes Berg571ecf62007-07-27 15:43:22 +02001643 dev_kfree_skb(rx->skb);
Johannes Berg9ae54c82008-01-31 19:48:20 +01001644 return RX_QUEUED;
Johannes Berg571ecf62007-07-27 15:43:22 +02001645 }
1646
Johannes Berg9ae54c82008-01-31 19:48:20 +01001647 return RX_CONTINUE;
Johannes Berg571ecf62007-07-27 15:43:22 +02001648} /* ieee80211_rx_h_sta_process */
1649
Johan Almbladh86c228a2013-08-14 15:29:46 +02001650static ieee80211_rx_result debug_noinline
1651ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
1652{
1653 struct sk_buff *skb = rx->skb;
1654 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1655 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1656 int keyidx;
1657 int hdrlen;
1658 ieee80211_rx_result result = RX_DROP_UNUSABLE;
1659 struct ieee80211_key *sta_ptk = NULL;
1660 int mmie_keyidx = -1;
1661 __le16 fc;
Max Stepanov2475b1cc2013-03-24 14:23:27 +02001662 const struct ieee80211_cipher_scheme *cs = NULL;
Johan Almbladh86c228a2013-08-14 15:29:46 +02001663
1664 /*
1665 * Key selection 101
1666 *
1667 * There are four types of keys:
1668 * - GTK (group keys)
1669 * - IGTK (group keys for management frames)
1670 * - PTK (pairwise keys)
1671 * - STK (station-to-station pairwise keys)
1672 *
1673 * When selecting a key, we have to distinguish between multicast
1674 * (including broadcast) and unicast frames, the latter can only
1675 * use PTKs and STKs while the former always use GTKs and IGTKs.
1676 * Unless, of course, actual WEP keys ("pre-RSNA") are used, then
1677 * unicast frames can also use key indices like GTKs. Hence, if we
1678 * don't have a PTK/STK we check the key index for a WEP key.
1679 *
1680 * Note that in a regular BSS, multicast frames are sent by the
1681 * AP only, associated stations unicast the frame to the AP first
1682 * which then multicasts it on their behalf.
1683 *
1684 * There is also a slight problem in IBSS mode: GTKs are negotiated
1685 * with each station, that is something we don't currently handle.
1686 * The spec seems to expect that one negotiates the same key with
1687 * every station but there's no such requirement; VLANs could be
1688 * possible.
1689 */
1690
Johan Almbladh86c228a2013-08-14 15:29:46 +02001691 /* start without a key */
1692 rx->key = NULL;
Johan Almbladh86c228a2013-08-14 15:29:46 +02001693 fc = hdr->frame_control;
1694
Max Stepanov2475b1cc2013-03-24 14:23:27 +02001695 if (rx->sta) {
1696 int keyid = rx->sta->ptk_idx;
1697
1698 if (ieee80211_has_protected(fc) && rx->sta->cipher_scheme) {
1699 cs = rx->sta->cipher_scheme;
Johannes Berg2c61cf92016-03-17 15:02:55 +02001700 keyid = ieee80211_get_cs_keyid(cs, rx->skb);
Max Stepanov2475b1cc2013-03-24 14:23:27 +02001701 if (unlikely(keyid < 0))
1702 return RX_DROP_UNUSABLE;
1703 }
1704 sta_ptk = rcu_dereference(rx->sta->ptk[keyid]);
1705 }
1706
Johan Almbladh86c228a2013-08-14 15:29:46 +02001707 if (!ieee80211_has_protected(fc))
1708 mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);
1709
1710 if (!is_multicast_ether_addr(hdr->addr1) && sta_ptk) {
1711 rx->key = sta_ptk;
1712 if ((status->flag & RX_FLAG_DECRYPTED) &&
1713 (status->flag & RX_FLAG_IV_STRIPPED))
1714 return RX_CONTINUE;
1715 /* Skip decryption if the frame is not protected. */
1716 if (!ieee80211_has_protected(fc))
1717 return RX_CONTINUE;
1718 } else if (mmie_keyidx >= 0) {
1719 /* Broadcast/multicast robust management frame / BIP */
1720 if ((status->flag & RX_FLAG_DECRYPTED) &&
1721 (status->flag & RX_FLAG_IV_STRIPPED))
1722 return RX_CONTINUE;
1723
1724 if (mmie_keyidx < NUM_DEFAULT_KEYS ||
1725 mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
1726 return RX_DROP_MONITOR; /* unexpected BIP keyidx */
Masashi Honma46f6b062016-06-22 19:55:20 +09001727 if (rx->sta) {
1728 if (ieee80211_is_group_privacy_action(skb) &&
1729 test_sta_flag(rx->sta, WLAN_STA_MFP))
1730 return RX_DROP_MONITOR;
1731
Johan Almbladh86c228a2013-08-14 15:29:46 +02001732 rx->key = rcu_dereference(rx->sta->gtk[mmie_keyidx]);
Masashi Honma46f6b062016-06-22 19:55:20 +09001733 }
Johan Almbladh86c228a2013-08-14 15:29:46 +02001734 if (!rx->key)
1735 rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]);
1736 } else if (!ieee80211_has_protected(fc)) {
1737 /*
1738 * The frame was not protected, so skip decryption. However, we
1739 * need to set rx->key if there is a key that could have been
1740 * used so that the frame may be dropped if encryption would
1741 * have been expected.
1742 */
1743 struct ieee80211_key *key = NULL;
1744 struct ieee80211_sub_if_data *sdata = rx->sdata;
1745 int i;
1746
1747 if (ieee80211_is_mgmt(fc) &&
1748 is_multicast_ether_addr(hdr->addr1) &&
1749 (key = rcu_dereference(rx->sdata->default_mgmt_key)))
1750 rx->key = key;
1751 else {
1752 if (rx->sta) {
1753 for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
1754 key = rcu_dereference(rx->sta->gtk[i]);
1755 if (key)
1756 break;
1757 }
1758 }
1759 if (!key) {
1760 for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
1761 key = rcu_dereference(sdata->keys[i]);
1762 if (key)
1763 break;
1764 }
1765 }
1766 if (key)
1767 rx->key = key;
1768 }
1769 return RX_CONTINUE;
1770 } else {
1771 u8 keyid;
Max Stepanov2475b1cc2013-03-24 14:23:27 +02001772
Johan Almbladh86c228a2013-08-14 15:29:46 +02001773 /*
1774 * The device doesn't give us the IV so we won't be
1775 * able to look up the key. That's ok though, we
1776 * don't need to decrypt the frame, we just won't
1777 * be able to keep statistics accurate.
1778 * Except for key threshold notifications, should
1779 * we somehow allow the driver to tell us which key
1780 * the hardware used if this flag is set?
1781 */
1782 if ((status->flag & RX_FLAG_DECRYPTED) &&
1783 (status->flag & RX_FLAG_IV_STRIPPED))
1784 return RX_CONTINUE;
1785
1786 hdrlen = ieee80211_hdrlen(fc);
1787
Max Stepanov2475b1cc2013-03-24 14:23:27 +02001788 if (cs) {
Johannes Berg2c61cf92016-03-17 15:02:55 +02001789 keyidx = ieee80211_get_cs_keyid(cs, rx->skb);
Johan Almbladh86c228a2013-08-14 15:29:46 +02001790
Max Stepanov2475b1cc2013-03-24 14:23:27 +02001791 if (unlikely(keyidx < 0))
1792 return RX_DROP_UNUSABLE;
1793 } else {
1794 if (rx->skb->len < 8 + hdrlen)
1795 return RX_DROP_UNUSABLE; /* TODO: count this? */
1796 /*
1797 * no need to call ieee80211_wep_get_keyidx,
1798 * it verifies a bunch of things we've done already
1799 */
1800 skb_copy_bits(rx->skb, hdrlen + 3, &keyid, 1);
1801 keyidx = keyid >> 6;
1802 }
Johan Almbladh86c228a2013-08-14 15:29:46 +02001803
1804 /* check per-station GTK first, if multicast packet */
1805 if (is_multicast_ether_addr(hdr->addr1) && rx->sta)
1806 rx->key = rcu_dereference(rx->sta->gtk[keyidx]);
1807
1808 /* if not found, try default key */
1809 if (!rx->key) {
1810 rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
1811
1812 /*
1813 * RSNA-protected unicast frames should always be
1814 * sent with pairwise or station-to-station keys,
1815 * but for WEP we allow using a key index as well.
1816 */
1817 if (rx->key &&
1818 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1819 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 &&
1820 !is_multicast_ether_addr(hdr->addr1))
1821 rx->key = NULL;
1822 }
1823 }
1824
1825 if (rx->key) {
1826 if (unlikely(rx->key->flags & KEY_FLAG_TAINTED))
1827 return RX_DROP_MONITOR;
1828
Johan Almbladh86c228a2013-08-14 15:29:46 +02001829 /* TODO: add threshold stuff again */
1830 } else {
1831 return RX_DROP_MONITOR;
1832 }
1833
1834 switch (rx->key->conf.cipher) {
1835 case WLAN_CIPHER_SUITE_WEP40:
1836 case WLAN_CIPHER_SUITE_WEP104:
1837 result = ieee80211_crypto_wep_decrypt(rx);
1838 break;
1839 case WLAN_CIPHER_SUITE_TKIP:
1840 result = ieee80211_crypto_tkip_decrypt(rx);
1841 break;
1842 case WLAN_CIPHER_SUITE_CCMP:
Jouni Malinen2b2ba0d2015-01-24 19:52:07 +02001843 result = ieee80211_crypto_ccmp_decrypt(
1844 rx, IEEE80211_CCMP_MIC_LEN);
1845 break;
1846 case WLAN_CIPHER_SUITE_CCMP_256:
1847 result = ieee80211_crypto_ccmp_decrypt(
1848 rx, IEEE80211_CCMP_256_MIC_LEN);
Johan Almbladh86c228a2013-08-14 15:29:46 +02001849 break;
1850 case WLAN_CIPHER_SUITE_AES_CMAC:
1851 result = ieee80211_crypto_aes_cmac_decrypt(rx);
1852 break;
Jouni Malinen56c52da2015-01-24 19:52:08 +02001853 case WLAN_CIPHER_SUITE_BIP_CMAC_256:
1854 result = ieee80211_crypto_aes_cmac_256_decrypt(rx);
1855 break;
Jouni Malinen8ade5382015-01-24 19:52:09 +02001856 case WLAN_CIPHER_SUITE_BIP_GMAC_128:
1857 case WLAN_CIPHER_SUITE_BIP_GMAC_256:
1858 result = ieee80211_crypto_aes_gmac_decrypt(rx);
1859 break;
Jouni Malinen00b9cfa2015-01-24 19:52:06 +02001860 case WLAN_CIPHER_SUITE_GCMP:
1861 case WLAN_CIPHER_SUITE_GCMP_256:
1862 result = ieee80211_crypto_gcmp_decrypt(rx);
1863 break;
Johan Almbladh86c228a2013-08-14 15:29:46 +02001864 default:
Max Stepanov2475b1cc2013-03-24 14:23:27 +02001865 result = ieee80211_crypto_hw_decrypt(rx);
Johan Almbladh86c228a2013-08-14 15:29:46 +02001866 }
1867
1868 /* the hdr variable is invalid after the decrypt handlers */
1869
1870 /* either the frame has been decrypted or will be dropped */
1871 status->flag |= RX_FLAG_DECRYPTED;
1872
1873 return result;
1874}
1875
Johannes Berg571ecf62007-07-27 15:43:22 +02001876static inline struct ieee80211_fragment_entry *
1877ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
1878 unsigned int frag, unsigned int seq, int rx_queue,
1879 struct sk_buff **skb)
1880{
1881 struct ieee80211_fragment_entry *entry;
Johannes Berg571ecf62007-07-27 15:43:22 +02001882
Johannes Berg571ecf62007-07-27 15:43:22 +02001883 entry = &sdata->fragments[sdata->fragment_next++];
1884 if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
1885 sdata->fragment_next = 0;
1886
Johannes Bergbdcbd8e2012-06-22 11:29:50 +02001887 if (!skb_queue_empty(&entry->skb_list))
Johannes Berg571ecf62007-07-27 15:43:22 +02001888 __skb_queue_purge(&entry->skb_list);
Johannes Berg571ecf62007-07-27 15:43:22 +02001889
1890 __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
1891 *skb = NULL;
1892 entry->first_frag_time = jiffies;
1893 entry->seq = seq;
1894 entry->rx_queue = rx_queue;
1895 entry->last_frag = frag;
Johannes Berg9acc54b2016-02-26 22:13:40 +01001896 entry->check_sequential_pn = false;
Johannes Berg571ecf62007-07-27 15:43:22 +02001897 entry->extra_len = 0;
1898
1899 return entry;
1900}
1901
1902static inline struct ieee80211_fragment_entry *
1903ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
Harvey Harrisonb73d70a2008-07-15 18:44:12 -07001904 unsigned int frag, unsigned int seq,
Johannes Berg571ecf62007-07-27 15:43:22 +02001905 int rx_queue, struct ieee80211_hdr *hdr)
1906{
1907 struct ieee80211_fragment_entry *entry;
1908 int i, idx;
1909
1910 idx = sdata->fragment_next;
1911 for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
1912 struct ieee80211_hdr *f_hdr;
Johannes Berg571ecf62007-07-27 15:43:22 +02001913
1914 idx--;
1915 if (idx < 0)
1916 idx = IEEE80211_FRAGMENT_MAX - 1;
1917
1918 entry = &sdata->fragments[idx];
1919 if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
1920 entry->rx_queue != rx_queue ||
1921 entry->last_frag + 1 != frag)
1922 continue;
1923
Harvey Harrisonb73d70a2008-07-15 18:44:12 -07001924 f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data;
Johannes Berg571ecf62007-07-27 15:43:22 +02001925
Harvey Harrisonb73d70a2008-07-15 18:44:12 -07001926 /*
1927 * Check ftype and addresses are equal, else check next fragment
1928 */
1929 if (((hdr->frame_control ^ f_hdr->frame_control) &
1930 cpu_to_le16(IEEE80211_FCTL_FTYPE)) ||
Joe Perchesb203ca32012-05-08 18:56:52 +00001931 !ether_addr_equal(hdr->addr1, f_hdr->addr1) ||
1932 !ether_addr_equal(hdr->addr2, f_hdr->addr2))
Johannes Berg571ecf62007-07-27 15:43:22 +02001933 continue;
1934
S.Çağlar Onurab466232008-02-14 17:36:47 +02001935 if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
Johannes Berg571ecf62007-07-27 15:43:22 +02001936 __skb_queue_purge(&entry->skb_list);
1937 continue;
1938 }
1939 return entry;
1940 }
1941
1942 return NULL;
1943}
1944
Johannes Berg49461622008-06-30 15:10:45 +02001945static ieee80211_rx_result debug_noinline
Johannes Berg5cf121c2008-02-25 16:27:43 +01001946ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
Johannes Berg571ecf62007-07-27 15:43:22 +02001947{
1948 struct ieee80211_hdr *hdr;
1949 u16 sc;
Harvey Harrison358c8d92008-07-15 18:44:13 -07001950 __le16 fc;
Johannes Berg571ecf62007-07-27 15:43:22 +02001951 unsigned int frag, seq;
1952 struct ieee80211_fragment_entry *entry;
1953 struct sk_buff *skb;
Johannes Berg554891e2010-09-24 12:38:25 +02001954 struct ieee80211_rx_status *status;
Johannes Berg571ecf62007-07-27 15:43:22 +02001955
Harvey Harrisonb73d70a2008-07-15 18:44:12 -07001956 hdr = (struct ieee80211_hdr *)rx->skb->data;
Harvey Harrison358c8d92008-07-15 18:44:13 -07001957 fc = hdr->frame_control;
Javier Cardonaf7fbf702012-10-25 11:10:18 -07001958
1959 if (ieee80211_is_ctl(fc))
1960 return RX_CONTINUE;
1961
Johannes Berg571ecf62007-07-27 15:43:22 +02001962 sc = le16_to_cpu(hdr->seq_ctrl);
1963 frag = sc & IEEE80211_SCTL_FRAG;
1964
Johannes Bergb8fff402014-11-03 13:57:46 +01001965 if (is_multicast_ether_addr(hdr->addr1)) {
Johannes Bergc206ca62015-04-22 20:47:28 +02001966 I802_DEBUG_INC(rx->local->dot11MulticastReceivedFrameCount);
Andreas Müllerd0259332014-12-12 12:11:11 +01001967 goto out_no_led;
Johannes Berg571ecf62007-07-27 15:43:22 +02001968 }
Johannes Bergb8fff402014-11-03 13:57:46 +01001969
Andreas Müllerd0259332014-12-12 12:11:11 +01001970 if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
1971 goto out;
1972
Johannes Berg571ecf62007-07-27 15:43:22 +02001973 I802_DEBUG_INC(rx->local->rx_handlers_fragments);
1974
Zhu Yie3cf8b32010-03-29 17:35:07 +08001975 if (skb_linearize(rx->skb))
1976 return RX_DROP_UNUSABLE;
1977
Abhijeet Kolekar058897a2010-05-11 11:22:11 -07001978 /*
1979 * skb_linearize() might change the skb->data and
1980 * previously cached variables (in this case, hdr) need to
1981 * be refreshed with the new data.
1982 */
1983 hdr = (struct ieee80211_hdr *)rx->skb->data;
Johannes Berg571ecf62007-07-27 15:43:22 +02001984 seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
1985
1986 if (frag == 0) {
1987 /* This is the first fragment of a new frame. */
1988 entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
Johannes Berg9e262972011-07-07 18:45:03 +02001989 rx->seqno_idx, &(rx->skb));
Jouni Malinen2b2ba0d2015-01-24 19:52:07 +02001990 if (rx->key &&
1991 (rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP ||
Johannes Berg9acc54b2016-02-26 22:13:40 +01001992 rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP_256 ||
1993 rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP ||
1994 rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP_256) &&
Harvey Harrison358c8d92008-07-15 18:44:13 -07001995 ieee80211_has_protected(fc)) {
Johannes Berg9e262972011-07-07 18:45:03 +02001996 int queue = rx->security_idx;
Johannes Berg9acc54b2016-02-26 22:13:40 +01001997
1998 /* Store CCMP/GCMP PN so that we can verify that the
1999 * next fragment has a sequential PN value.
2000 */
2001 entry->check_sequential_pn = true;
Johannes Berg571ecf62007-07-27 15:43:22 +02002002 memcpy(entry->last_pn,
Jouni Malinen91902522010-06-11 10:27:33 -07002003 rx->key->u.ccmp.rx_pn[queue],
Johannes Berg4325f6c2013-05-08 13:09:08 +02002004 IEEE80211_CCMP_PN_LEN);
Johannes Berg9acc54b2016-02-26 22:13:40 +01002005 BUILD_BUG_ON(offsetof(struct ieee80211_key,
2006 u.ccmp.rx_pn) !=
2007 offsetof(struct ieee80211_key,
2008 u.gcmp.rx_pn));
2009 BUILD_BUG_ON(sizeof(rx->key->u.ccmp.rx_pn[queue]) !=
2010 sizeof(rx->key->u.gcmp.rx_pn[queue]));
2011 BUILD_BUG_ON(IEEE80211_CCMP_PN_LEN !=
2012 IEEE80211_GCMP_PN_LEN);
Johannes Berg571ecf62007-07-27 15:43:22 +02002013 }
Johannes Berg9ae54c82008-01-31 19:48:20 +01002014 return RX_QUEUED;
Johannes Berg571ecf62007-07-27 15:43:22 +02002015 }
2016
2017 /* This is a fragment for a frame that should already be pending in
2018 * fragment cache. Add this fragment to the end of the pending entry.
2019 */
Johannes Berg9e262972011-07-07 18:45:03 +02002020 entry = ieee80211_reassemble_find(rx->sdata, frag, seq,
2021 rx->seqno_idx, hdr);
Johannes Berg571ecf62007-07-27 15:43:22 +02002022 if (!entry) {
2023 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
Johannes Berge4c26ad2008-01-31 19:48:21 +01002024 return RX_DROP_MONITOR;
Johannes Berg571ecf62007-07-27 15:43:22 +02002025 }
2026
Johannes Berg9acc54b2016-02-26 22:13:40 +01002027 /* "The receiver shall discard MSDUs and MMPDUs whose constituent
2028 * MPDU PN values are not incrementing in steps of 1."
2029 * see IEEE P802.11-REVmc/D5.0, 12.5.3.4.4, item d (for CCMP)
2030 * and IEEE P802.11-REVmc/D5.0, 12.5.5.4.4, item d (for GCMP)
2031 */
2032 if (entry->check_sequential_pn) {
Johannes Berg571ecf62007-07-27 15:43:22 +02002033 int i;
Johannes Berg4325f6c2013-05-08 13:09:08 +02002034 u8 pn[IEEE80211_CCMP_PN_LEN], *rpn;
Jouni Malinen91902522010-06-11 10:27:33 -07002035 int queue;
Johannes Berg9acc54b2016-02-26 22:13:40 +01002036
Jouni Malinen2b2ba0d2015-01-24 19:52:07 +02002037 if (!rx->key ||
2038 (rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP &&
Johannes Berg9acc54b2016-02-26 22:13:40 +01002039 rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP_256 &&
2040 rx->key->conf.cipher != WLAN_CIPHER_SUITE_GCMP &&
2041 rx->key->conf.cipher != WLAN_CIPHER_SUITE_GCMP_256))
Johannes Berge4c26ad2008-01-31 19:48:21 +01002042 return RX_DROP_UNUSABLE;
Johannes Berg4325f6c2013-05-08 13:09:08 +02002043 memcpy(pn, entry->last_pn, IEEE80211_CCMP_PN_LEN);
2044 for (i = IEEE80211_CCMP_PN_LEN - 1; i >= 0; i--) {
Johannes Berg571ecf62007-07-27 15:43:22 +02002045 pn[i]++;
2046 if (pn[i])
2047 break;
2048 }
Johannes Berg9e262972011-07-07 18:45:03 +02002049 queue = rx->security_idx;
Jouni Malinen91902522010-06-11 10:27:33 -07002050 rpn = rx->key->u.ccmp.rx_pn[queue];
Johannes Berg4325f6c2013-05-08 13:09:08 +02002051 if (memcmp(pn, rpn, IEEE80211_CCMP_PN_LEN))
Johannes Berge4c26ad2008-01-31 19:48:21 +01002052 return RX_DROP_UNUSABLE;
Johannes Berg4325f6c2013-05-08 13:09:08 +02002053 memcpy(entry->last_pn, pn, IEEE80211_CCMP_PN_LEN);
Johannes Berg571ecf62007-07-27 15:43:22 +02002054 }
2055
Harvey Harrison358c8d92008-07-15 18:44:13 -07002056 skb_pull(rx->skb, ieee80211_hdrlen(fc));
Johannes Berg571ecf62007-07-27 15:43:22 +02002057 __skb_queue_tail(&entry->skb_list, rx->skb);
2058 entry->last_frag = frag;
2059 entry->extra_len += rx->skb->len;
Harvey Harrison358c8d92008-07-15 18:44:13 -07002060 if (ieee80211_has_morefrags(fc)) {
Johannes Berg571ecf62007-07-27 15:43:22 +02002061 rx->skb = NULL;
Johannes Berg9ae54c82008-01-31 19:48:20 +01002062 return RX_QUEUED;
Johannes Berg571ecf62007-07-27 15:43:22 +02002063 }
2064
2065 rx->skb = __skb_dequeue(&entry->skb_list);
2066 if (skb_tailroom(rx->skb) < entry->extra_len) {
Johannes Bergf1160432015-04-22 20:25:20 +02002067 I802_DEBUG_INC(rx->local->rx_expand_skb_head_defrag);
Johannes Berg571ecf62007-07-27 15:43:22 +02002068 if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
2069 GFP_ATOMIC))) {
2070 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
2071 __skb_queue_purge(&entry->skb_list);
Johannes Berge4c26ad2008-01-31 19:48:21 +01002072 return RX_DROP_UNUSABLE;
Johannes Berg571ecf62007-07-27 15:43:22 +02002073 }
2074 }
2075 while ((skb = __skb_dequeue(&entry->skb_list))) {
2076 memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len);
2077 dev_kfree_skb(skb);
2078 }
2079
2080 /* Complete frame has been reassembled - process it now */
Johannes Berg554891e2010-09-24 12:38:25 +02002081 status = IEEE80211_SKB_RXCB(rx->skb);
Johannes Berg571ecf62007-07-27 15:43:22 +02002082
2083 out:
Andreas Müllerd0259332014-12-12 12:11:11 +01002084 ieee80211_led_rx(rx->local);
2085 out_no_led:
Johannes Berg571ecf62007-07-27 15:43:22 +02002086 if (rx->sta)
Johannes Berge5a9f8d2015-10-16 17:54:47 +02002087 rx->sta->rx_stats.packets++;
Johannes Berg9ae54c82008-01-31 19:48:20 +01002088 return RX_CONTINUE;
Johannes Berg571ecf62007-07-27 15:43:22 +02002089}
2090
Johannes Berg1df332e2012-10-26 00:09:11 +02002091static int ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
Johannes Berg571ecf62007-07-27 15:43:22 +02002092{
Johannes Berg1df332e2012-10-26 00:09:11 +02002093 if (unlikely(!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_AUTHORIZED)))
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002094 return -EACCES;
Johannes Berg571ecf62007-07-27 15:43:22 +02002095
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002096 return 0;
Johannes Berg571ecf62007-07-27 15:43:22 +02002097}
2098
Johannes Berg1df332e2012-10-26 00:09:11 +02002099static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
Johannes Berg571ecf62007-07-27 15:43:22 +02002100{
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01002101 struct sk_buff *skb = rx->skb;
2102 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2103
Johannes Berg3017b802007-08-28 17:01:53 -04002104 /*
Johannes Berg7848ba72007-09-14 11:10:25 -04002105 * Pass through unencrypted frames if the hardware has
2106 * decrypted them already.
Johannes Berg3017b802007-08-28 17:01:53 -04002107 */
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01002108 if (status->flag & RX_FLAG_DECRYPTED)
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002109 return 0;
Johannes Berg571ecf62007-07-27 15:43:22 +02002110
2111 /* Drop unencrypted frames if key is set. */
Harvey Harrison358c8d92008-07-15 18:44:13 -07002112 if (unlikely(!ieee80211_has_protected(fc) &&
2113 !ieee80211_is_nullfunc(fc) &&
Johannes Berge8f4fb72015-03-20 11:37:36 +01002114 ieee80211_is_data(fc) && rx->key))
Jouni Malinen3cfcf6ac2009-01-08 13:32:02 +02002115 return -EACCES;
Johannes Bergbef5d1c2010-02-16 11:05:00 +01002116
2117 return 0;
2118}
2119
Johannes Berg1df332e2012-10-26 00:09:11 +02002120static int ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)
Johannes Bergbef5d1c2010-02-16 11:05:00 +01002121{
2122 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
Jouni Malinene3efca02010-03-28 22:31:15 -07002123 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
Johannes Bergbef5d1c2010-02-16 11:05:00 +01002124 __le16 fc = hdr->frame_control;
Johannes Bergbef5d1c2010-02-16 11:05:00 +01002125
Jouni Malinene3efca02010-03-28 22:31:15 -07002126 /*
2127 * Pass through unencrypted frames if the hardware has
2128 * decrypted them already.
2129 */
2130 if (status->flag & RX_FLAG_DECRYPTED)
2131 return 0;
Johannes Bergbef5d1c2010-02-16 11:05:00 +01002132
Johannes Bergc2c98fd2011-09-29 16:04:36 +02002133 if (rx->sta && test_sta_flag(rx->sta, WLAN_STA_MFP)) {
Jouni Malinend211e902010-03-28 22:29:52 -07002134 if (unlikely(!ieee80211_has_protected(fc) &&
2135 ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
Jouni Malinencf4e5942010-12-16 00:52:40 +02002136 rx->key)) {
Johannes Berg6ff57cf2013-05-16 00:55:00 +02002137 if (ieee80211_is_deauth(fc) ||
2138 ieee80211_is_disassoc(fc))
2139 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
2140 rx->skb->data,
2141 rx->skb->len);
Jouni Malinenf2ca3ea2009-05-08 12:36:03 +03002142 return -EACCES;
Jouni Malinencf4e5942010-12-16 00:52:40 +02002143 }
Jouni Malinenf2ca3ea2009-05-08 12:36:03 +03002144 /* BIP does not use Protected field, so need to check MMIE */
Joe Perchesf64f9e72009-11-29 16:55:45 -08002145 if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
Jouni Malinencf4e5942010-12-16 00:52:40 +02002146 ieee80211_get_mmie_keyidx(rx->skb) < 0)) {
Johannes Berg6ff57cf2013-05-16 00:55:00 +02002147 if (ieee80211_is_deauth(fc) ||
2148 ieee80211_is_disassoc(fc))
2149 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
2150 rx->skb->data,
2151 rx->skb->len);
Jouni Malinenf2ca3ea2009-05-08 12:36:03 +03002152 return -EACCES;
Jouni Malinencf4e5942010-12-16 00:52:40 +02002153 }
Jouni Malinenf2ca3ea2009-05-08 12:36:03 +03002154 /*
2155 * When using MFP, Action frames are not allowed prior to
2156 * having configured keys.
2157 */
2158 if (unlikely(ieee80211_is_action(fc) && !rx->key &&
Johannes Bergd8ca16d2014-01-23 16:20:29 +01002159 ieee80211_is_robust_mgmt_frame(rx->skb)))
Jouni Malinenf2ca3ea2009-05-08 12:36:03 +03002160 return -EACCES;
2161 }
Johannes Bergb3fc9c62008-04-13 10:12:47 +02002162
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002163 return 0;
Johannes Berg571ecf62007-07-27 15:43:22 +02002164}
2165
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002166static int
Felix Fietkau4114fa22011-04-12 19:15:22 +02002167__ieee80211_data_to_8023(struct ieee80211_rx_data *rx, bool *port_control)
Johannes Berg571ecf62007-07-27 15:43:22 +02002168{
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01002169 struct ieee80211_sub_if_data *sdata = rx->sdata;
Felix Fietkauf14543ee2009-11-10 20:10:05 +01002170 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
Felix Fietkaufbb327c2011-01-18 15:48:48 +01002171 bool check_port_control = false;
2172 struct ethhdr *ehdr;
2173 int ret;
Felix Fietkauf14543ee2009-11-10 20:10:05 +01002174
Felix Fietkau4114fa22011-04-12 19:15:22 +02002175 *port_control = false;
Johannes Berg9bc383d2009-11-19 11:55:19 +01002176 if (ieee80211_has_a4(hdr->frame_control) &&
2177 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta)
Felix Fietkauf14543ee2009-11-10 20:10:05 +01002178 return -1;
Johannes Berg9bc383d2009-11-19 11:55:19 +01002179
Felix Fietkaufbb327c2011-01-18 15:48:48 +01002180 if (sdata->vif.type == NL80211_IFTYPE_STATION &&
2181 !!sdata->u.mgd.use_4addr != !!ieee80211_has_a4(hdr->frame_control)) {
2182
2183 if (!sdata->u.mgd.use_4addr)
2184 return -1;
2185 else
2186 check_port_control = true;
2187 }
2188
Johannes Berg9bc383d2009-11-19 11:55:19 +01002189 if (is_multicast_ether_addr(hdr->addr1) &&
Felix Fietkaufbb327c2011-01-18 15:48:48 +01002190 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta)
Felix Fietkauf14543ee2009-11-10 20:10:05 +01002191 return -1;
Johannes Berg571ecf62007-07-27 15:43:22 +02002192
Felix Fietkaufbb327c2011-01-18 15:48:48 +01002193 ret = ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type);
Felix Fietkau4114fa22011-04-12 19:15:22 +02002194 if (ret < 0)
Felix Fietkaufbb327c2011-01-18 15:48:48 +01002195 return ret;
2196
2197 ehdr = (struct ethhdr *) rx->skb->data;
Felix Fietkau4114fa22011-04-12 19:15:22 +02002198 if (ehdr->h_proto == rx->sdata->control_port_protocol)
2199 *port_control = true;
2200 else if (check_port_control)
Felix Fietkaufbb327c2011-01-18 15:48:48 +01002201 return -1;
2202
2203 return 0;
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002204}
Johannes Berg571ecf62007-07-27 15:43:22 +02002205
Johannes Bergce3edf6d02007-12-19 01:31:22 +01002206/*
2207 * requires that rx->skb is a frame with ethernet header
2208 */
Harvey Harrison358c8d92008-07-15 18:44:13 -07002209static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
Johannes Bergce3edf6d02007-12-19 01:31:22 +01002210{
Senthil Balasubramanianc97c23e2008-05-28 23:15:32 +05302211 static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
Johannes Bergce3edf6d02007-12-19 01:31:22 +01002212 = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
2213 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
2214
2215 /*
2216 * Allow EAPOL frames to us/the PAE group address regardless
2217 * of whether the frame was encrypted or not.
2218 */
Johannes Berga621fa42010-08-27 14:26:54 +03002219 if (ehdr->h_proto == rx->sdata->control_port_protocol &&
Joe Perches3bc79452012-05-08 18:56:53 +00002220 (ether_addr_equal(ehdr->h_dest, rx->sdata->vif.addr) ||
2221 ether_addr_equal(ehdr->h_dest, pae_group_addr)))
Johannes Bergce3edf6d02007-12-19 01:31:22 +01002222 return true;
2223
2224 if (ieee80211_802_1x_port_control(rx) ||
Harvey Harrison358c8d92008-07-15 18:44:13 -07002225 ieee80211_drop_unencrypted(rx, fc))
Johannes Bergce3edf6d02007-12-19 01:31:22 +01002226 return false;
2227
2228 return true;
2229}
2230
2231/*
2232 * requires that rx->skb is a frame with ethernet header
2233 */
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002234static void
Johannes Berg5cf121c2008-02-25 16:27:43 +01002235ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002236{
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01002237 struct ieee80211_sub_if_data *sdata = rx->sdata;
2238 struct net_device *dev = sdata->dev;
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002239 struct sk_buff *skb, *xmit_skb;
Johannes Bergce3edf6d02007-12-19 01:31:22 +01002240 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
2241 struct sta_info *dsta;
Johannes Berg571ecf62007-07-27 15:43:22 +02002242
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002243 skb = rx->skb;
2244 xmit_skb = NULL;
Johannes Berg571ecf62007-07-27 15:43:22 +02002245
Johannes Berg5a490512015-04-22 17:10:38 +02002246 ieee80211_rx_stats(dev, skb->len);
2247
Johannes Bergde8f18d2016-03-31 20:02:03 +03002248 if (rx->sta) {
2249 /* The seqno index has the same property as needed
2250 * for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS
2251 * for non-QoS-data frames. Here we know it's a data
2252 * frame, so count MSDUs.
2253 */
Johannes Berg0f9c5a62016-03-31 20:02:09 +03002254 u64_stats_update_begin(&rx->sta->rx_stats.syncp);
Johannes Bergde8f18d2016-03-31 20:02:03 +03002255 rx->sta->rx_stats.msdu[rx->seqno_idx]++;
Johannes Berg0f9c5a62016-03-31 20:02:09 +03002256 u64_stats_update_end(&rx->sta->rx_stats.syncp);
Johannes Bergde8f18d2016-03-31 20:02:03 +03002257 }
2258
Johannes Berg05c914f2008-09-11 00:01:58 +02002259 if ((sdata->vif.type == NL80211_IFTYPE_AP ||
2260 sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
Johannes Berg213cd112008-09-11 00:01:54 +02002261 !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
Johannes Berg9bc383d2009-11-19 11:55:19 +01002262 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) {
Johannes Bergce3edf6d02007-12-19 01:31:22 +01002263 if (is_multicast_ether_addr(ehdr->h_dest)) {
2264 /*
2265 * send multicast frames both to higher layers in
2266 * local net stack and back to the wireless medium
2267 */
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002268 xmit_skb = skb_copy(skb, GFP_ATOMIC);
Joe Perchese87cc472012-05-13 21:56:26 +00002269 if (!xmit_skb)
Johannes Bergbdcbd8e2012-06-22 11:29:50 +02002270 net_info_ratelimited("%s: failed to clone multicast frame\n",
Joe Perchese87cc472012-05-13 21:56:26 +00002271 dev->name);
Johannes Berg571ecf62007-07-27 15:43:22 +02002272 } else {
Johannes Bergabe60632009-11-25 17:46:18 +01002273 dsta = sta_info_get(sdata, skb->data);
2274 if (dsta) {
Johannes Bergce3edf6d02007-12-19 01:31:22 +01002275 /*
2276 * The destination station is associated to
2277 * this AP (in this VLAN), so send the frame
2278 * directly to it and do not pass it to local
2279 * net stack.
Johannes Berg571ecf62007-07-27 15:43:22 +02002280 */
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002281 xmit_skb = skb;
Johannes Berg571ecf62007-07-27 15:43:22 +02002282 skb = NULL;
2283 }
Johannes Berg571ecf62007-07-27 15:43:22 +02002284 }
2285 }
2286
Kalle Valo59d9cb02009-12-17 13:54:57 +01002287#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
Johannes Berg9e890a1f2013-12-04 09:16:31 +01002288 if (skb) {
2289 /* 'align' will only take the values 0 or 2 here since all
2290 * frames are required to be aligned to 2-byte boundaries
2291 * when being passed to mac80211; the code here works just
2292 * as well if that isn't true, but mac80211 assumes it can
2293 * access fields as 2-byte aligned (e.g. for ether_addr_equal)
Johannes Bergd1c3a372009-01-07 00:26:10 +01002294 */
Johannes Berg9e890a1f2013-12-04 09:16:31 +01002295 int align;
2296
2297 align = (unsigned long)(skb->data + sizeof(struct ethhdr)) & 3;
Johannes Bergd1c3a372009-01-07 00:26:10 +01002298 if (align) {
2299 if (WARN_ON(skb_headroom(skb) < 3)) {
2300 dev_kfree_skb(skb);
2301 skb = NULL;
2302 } else {
2303 u8 *data = skb->data;
Zhu Yi8ce0b582009-10-28 13:13:52 -07002304 size_t len = skb_headlen(skb);
2305 skb->data -= align;
2306 memmove(skb->data, data, len);
2307 skb_set_tail_pointer(skb, len);
Johannes Bergd1c3a372009-01-07 00:26:10 +01002308 }
2309 }
Johannes Berg9e890a1f2013-12-04 09:16:31 +01002310 }
Johannes Bergd1c3a372009-01-07 00:26:10 +01002311#endif
2312
Johannes Berg9e890a1f2013-12-04 09:16:31 +01002313 if (skb) {
2314 /* deliver to local stack */
2315 skb->protocol = eth_type_trans(skb, dev);
2316 memset(skb->cb, 0, sizeof(skb->cb));
Johannes Bergaf9f9b22015-06-11 16:02:32 +02002317 if (rx->napi)
2318 napi_gro_receive(rx->napi, skb);
Johannes Berg06d181a2014-02-04 20:51:09 +01002319 else
2320 netif_receive_skb(skb);
Johannes Berg571ecf62007-07-27 15:43:22 +02002321 }
2322
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002323 if (xmit_skb) {
Helmut Schaaaef6c922011-12-21 09:11:35 +01002324 /*
2325 * Send to wireless media and increase priority by 256 to
2326 * keep the received priority instead of reclassifying
2327 * the frame (see cfg80211_classify8021d).
2328 */
2329 xmit_skb->priority += 256;
YOSHIFUJI Hideakif831e902007-12-12 03:54:23 +09002330 xmit_skb->protocol = htons(ETH_P_802_3);
Johannes Bergce3edf6d02007-12-19 01:31:22 +01002331 skb_reset_network_header(xmit_skb);
2332 skb_reset_mac_header(xmit_skb);
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002333 dev_queue_xmit(xmit_skb);
Johannes Berg571ecf62007-07-27 15:43:22 +02002334 }
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002335}
2336
Johannes Berg49461622008-06-30 15:10:45 +02002337static ieee80211_rx_result debug_noinline
Johannes Berg5cf121c2008-02-25 16:27:43 +01002338ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02002339{
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01002340 struct net_device *dev = rx->sdata->dev;
Zhu Yieaf85ca2009-12-01 10:18:37 +08002341 struct sk_buff *skb = rx->skb;
Harvey Harrison358c8d92008-07-15 18:44:13 -07002342 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
2343 __le16 fc = hdr->frame_control;
Zhu Yieaf85ca2009-12-01 10:18:37 +08002344 struct sk_buff_head frame_list;
Johannes Berg554891e2010-09-24 12:38:25 +02002345 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
Johannes Berg7f6990c2016-10-05 15:29:49 +02002346 struct ethhdr ethhdr;
Johannes Berge2b52272016-10-05 16:42:06 +02002347 const u8 *check_da = ethhdr.h_dest, *check_sa = ethhdr.h_source;
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02002348
Harvey Harrison358c8d92008-07-15 18:44:13 -07002349 if (unlikely(!ieee80211_is_data(fc)))
Johannes Berg9ae54c82008-01-31 19:48:20 +01002350 return RX_CONTINUE;
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02002351
Harvey Harrison358c8d92008-07-15 18:44:13 -07002352 if (unlikely(!ieee80211_is_data_present(fc)))
Johannes Berge4c26ad2008-01-31 19:48:21 +01002353 return RX_DROP_MONITOR;
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02002354
Johannes Berg554891e2010-09-24 12:38:25 +02002355 if (!(status->rx_flags & IEEE80211_RX_AMSDU))
Johannes Berg9ae54c82008-01-31 19:48:20 +01002356 return RX_CONTINUE;
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02002357
Johannes Bergea720932016-10-05 10:14:42 +02002358 if (unlikely(ieee80211_has_a4(hdr->frame_control))) {
2359 switch (rx->sdata->vif.type) {
2360 case NL80211_IFTYPE_AP_VLAN:
2361 if (!rx->sdata->u.vlan.sta)
2362 return RX_DROP_UNUSABLE;
2363 break;
2364 case NL80211_IFTYPE_STATION:
2365 if (!rx->sdata->u.mgd.use_4addr)
2366 return RX_DROP_UNUSABLE;
2367 break;
2368 default:
2369 return RX_DROP_UNUSABLE;
2370 }
Johannes Berge2b52272016-10-05 16:42:06 +02002371 check_da = NULL;
2372 check_sa = NULL;
2373 } else switch (rx->sdata->vif.type) {
2374 case NL80211_IFTYPE_AP:
2375 case NL80211_IFTYPE_AP_VLAN:
2376 check_da = NULL;
2377 break;
2378 case NL80211_IFTYPE_STATION:
2379 if (!rx->sta ||
2380 !test_sta_flag(rx->sta, WLAN_STA_TDLS_PEER))
2381 check_sa = NULL;
2382 break;
2383 case NL80211_IFTYPE_MESH_POINT:
2384 check_sa = NULL;
2385 break;
2386 default:
2387 break;
Johannes Bergea720932016-10-05 10:14:42 +02002388 }
Zhu Yieaf85ca2009-12-01 10:18:37 +08002389
Johannes Bergea720932016-10-05 10:14:42 +02002390 if (is_multicast_ether_addr(hdr->addr1))
Johannes Berge4c26ad2008-01-31 19:48:21 +01002391 return RX_DROP_UNUSABLE;
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02002392
2393 skb->dev = dev;
Zhu Yieaf85ca2009-12-01 10:18:37 +08002394 __skb_queue_head_init(&frame_list);
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02002395
Johannes Berg7f6990c2016-10-05 15:29:49 +02002396 if (ieee80211_data_to_8023_exthdr(skb, &ethhdr,
2397 rx->sdata->vif.addr,
2398 rx->sdata->vif.type))
2399 return RX_DROP_UNUSABLE;
2400
Zhu Yieaf85ca2009-12-01 10:18:37 +08002401 ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
2402 rx->sdata->vif.type,
Johannes Berg8b935ee2016-10-05 16:17:01 +02002403 rx->local->hw.extra_tx_headroom,
Johannes Berge2b52272016-10-05 16:42:06 +02002404 check_da, check_sa);
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02002405
Zhu Yieaf85ca2009-12-01 10:18:37 +08002406 while (!skb_queue_empty(&frame_list)) {
2407 rx->skb = __skb_dequeue(&frame_list);
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02002408
Harvey Harrison358c8d92008-07-15 18:44:13 -07002409 if (!ieee80211_frame_allowed(rx, fc)) {
Zhu Yieaf85ca2009-12-01 10:18:37 +08002410 dev_kfree_skb(rx->skb);
Johannes Bergce3edf6d02007-12-19 01:31:22 +01002411 continue;
2412 }
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02002413
2414 ieee80211_deliver_skb(rx);
2415 }
2416
Johannes Berg9ae54c82008-01-31 19:48:20 +01002417 return RX_QUEUED;
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02002418}
2419
Ingo Molnarbf94e172008-10-12 23:51:38 -07002420#ifdef CONFIG_MAC80211_MESH
Davide Pesaventob0dee572008-09-27 17:29:12 +02002421static ieee80211_rx_result
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02002422ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
2423{
Thomas Pedersen30789eb2011-11-24 17:15:26 -08002424 struct ieee80211_hdr *fwd_hdr, *hdr;
2425 struct ieee80211_tx_info *info;
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02002426 struct ieee80211s_hdr *mesh_hdr;
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02002427 struct sk_buff *skb = rx->skb, *fwd_skb;
Johannes Berg3b8d81e02009-06-17 17:43:56 +02002428 struct ieee80211_local *local = rx->local;
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01002429 struct ieee80211_sub_if_data *sdata = rx->sdata;
Thomas Pedersen30789eb2011-11-24 17:15:26 -08002430 struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
Michal Kaziorcf440122016-01-25 14:43:24 +01002431 u16 ac, q, hdrlen;
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02002432
2433 hdr = (struct ieee80211_hdr *) skb->data;
2434 hdrlen = ieee80211_hdrlen(hdr->frame_control);
Johannes Berg9b395bc2012-10-26 00:36:40 +02002435
2436 /* make sure fixed part of mesh header is there, also checks skb len */
2437 if (!pskb_may_pull(rx->skb, hdrlen + 6))
2438 return RX_DROP_MONITOR;
2439
2440 mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
2441
2442 /* make sure full mesh header is there, also checks skb len */
2443 if (!pskb_may_pull(rx->skb,
2444 hdrlen + ieee80211_get_mesh_hdrlen(mesh_hdr)))
2445 return RX_DROP_MONITOR;
2446
2447 /* reload pointers */
2448 hdr = (struct ieee80211_hdr *) skb->data;
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02002449 mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
2450
Bob Copelandd0c22112015-03-02 14:28:52 -05002451 if (ieee80211_drop_unencrypted(rx, hdr->frame_control))
2452 return RX_DROP_MONITOR;
2453
Thomas Pedersen2157fdd2011-09-01 12:32:14 -07002454 /* frame is in RMC, don't forward */
2455 if (ieee80211_is_data(hdr->frame_control) &&
2456 is_multicast_ether_addr(hdr->addr1) &&
Johannes Bergbf7cd942013-02-15 14:40:31 +01002457 mesh_rmc_check(rx->sdata, hdr->addr3, mesh_hdr))
Thomas Pedersen2157fdd2011-09-01 12:32:14 -07002458 return RX_DROP_MONITOR;
2459
Johannes Berg5c900672015-04-22 14:48:34 +02002460 if (!ieee80211_is_data(hdr->frame_control))
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02002461 return RX_CONTINUE;
2462
2463 if (!mesh_hdr->ttl)
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02002464 return RX_DROP_MONITOR;
2465
Javier Cardona43b7b312009-10-15 18:10:51 -07002466 if (mesh_hdr->flags & MESH_FLAGS_AE) {
YanBo79617de2008-09-22 13:30:32 +08002467 struct mesh_path *mppath;
Javier Cardona43b7b312009-10-15 18:10:51 -07002468 char *proxied_addr;
2469 char *mpp_addr;
2470
2471 if (is_multicast_ether_addr(hdr->addr1)) {
2472 mpp_addr = hdr->addr3;
2473 proxied_addr = mesh_hdr->eaddr1;
Johannes Berg9b395bc2012-10-26 00:36:40 +02002474 } else if (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6) {
2475 /* has_a4 already checked in ieee80211_rx_mesh_check */
Javier Cardona43b7b312009-10-15 18:10:51 -07002476 mpp_addr = hdr->addr4;
2477 proxied_addr = mesh_hdr->eaddr2;
Johannes Berg9b395bc2012-10-26 00:36:40 +02002478 } else {
2479 return RX_DROP_MONITOR;
Javier Cardona43b7b312009-10-15 18:10:51 -07002480 }
YanBo79617de2008-09-22 13:30:32 +08002481
YanBo79617de2008-09-22 13:30:32 +08002482 rcu_read_lock();
Johannes Bergbf7cd942013-02-15 14:40:31 +01002483 mppath = mpp_path_lookup(sdata, proxied_addr);
YanBo79617de2008-09-22 13:30:32 +08002484 if (!mppath) {
Johannes Bergbf7cd942013-02-15 14:40:31 +01002485 mpp_path_add(sdata, proxied_addr, mpp_addr);
YanBo79617de2008-09-22 13:30:32 +08002486 } else {
2487 spin_lock_bh(&mppath->state_lock);
Joe Perchesb203ca32012-05-08 18:56:52 +00002488 if (!ether_addr_equal(mppath->mpp, mpp_addr))
Javier Cardona43b7b312009-10-15 18:10:51 -07002489 memcpy(mppath->mpp, mpp_addr, ETH_ALEN);
Henning Roggeab1c7902016-02-03 13:58:37 +01002490 mppath->exp_time = jiffies;
YanBo79617de2008-09-22 13:30:32 +08002491 spin_unlock_bh(&mppath->state_lock);
2492 }
2493 rcu_read_unlock();
2494 }
2495
Javier Cardona3c5772a2009-08-10 12:15:48 -07002496 /* Frame has reached destination. Don't forward */
2497 if (!is_multicast_ether_addr(hdr->addr1) &&
Joe Perchesb203ca32012-05-08 18:56:52 +00002498 ether_addr_equal(sdata->vif.addr, hdr->addr3))
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02002499 return RX_CONTINUE;
2500
Michal Kaziorcf440122016-01-25 14:43:24 +01002501 ac = ieee80211_select_queue_80211(sdata, skb, hdr);
2502 q = sdata->vif.hw_queue[ac];
Thomas Pedersend3c15972011-11-24 17:15:23 -08002503 if (ieee80211_queue_stopped(&local->hw, q)) {
Thomas Pedersen30789eb2011-11-24 17:15:26 -08002504 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion);
Thomas Pedersend3c15972011-11-24 17:15:23 -08002505 return RX_DROP_MONITOR;
2506 }
2507 skb_set_queue_mapping(skb, q);
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02002508
Thomas Pedersen30789eb2011-11-24 17:15:26 -08002509 if (!--mesh_hdr->ttl) {
2510 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl);
Javier Cardona2ac64cd2012-10-24 12:43:31 -07002511 goto out;
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02002512 }
2513
Chun-Yeow Yeohd6655082012-03-02 02:03:19 +08002514 if (!ifmsh->mshcfg.dot11MeshForwarding)
2515 goto out;
2516
Thomas Pedersen30789eb2011-11-24 17:15:26 -08002517 fwd_skb = skb_copy(skb, GFP_ATOMIC);
2518 if (!fwd_skb) {
Johannes Bergbdcbd8e2012-06-22 11:29:50 +02002519 net_info_ratelimited("%s: failed to clone mesh frame\n",
Joe Perchese87cc472012-05-13 21:56:26 +00002520 sdata->name);
Thomas Pedersen30789eb2011-11-24 17:15:26 -08002521 goto out;
2522 }
2523
2524 fwd_hdr = (struct ieee80211_hdr *) fwd_skb->data;
Thomas Pedersen9d6d6f42013-04-08 11:06:12 -07002525 fwd_hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_RETRY);
Thomas Pedersen30789eb2011-11-24 17:15:26 -08002526 info = IEEE80211_SKB_CB(fwd_skb);
2527 memset(info, 0, sizeof(*info));
2528 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
2529 info->control.vif = &rx->sdata->vif;
2530 info->control.jiffies = jiffies;
2531 if (is_multicast_ether_addr(fwd_hdr->addr1)) {
2532 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_mcast);
2533 memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
Marco Porsch3f52b7e2013-01-30 18:14:08 +01002534 /* update power mode indication when forwarding */
2535 ieee80211_mps_set_frame_flags(sdata, NULL, fwd_hdr);
Johannes Bergbf7cd942013-02-15 14:40:31 +01002536 } else if (!mesh_nexthop_lookup(sdata, fwd_skb)) {
Marco Porsch3f52b7e2013-01-30 18:14:08 +01002537 /* mesh power mode flags updated in mesh_nexthop_lookup */
Thomas Pedersen30789eb2011-11-24 17:15:26 -08002538 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast);
2539 } else {
2540 /* unable to resolve next hop */
Johannes Bergbf7cd942013-02-15 14:40:31 +01002541 mesh_path_error_tx(sdata, ifmsh->mshcfg.element_ttl,
Chun-Yeow Yeohf63f8422013-11-13 15:39:12 +08002542 fwd_hdr->addr3, 0,
2543 WLAN_REASON_MESH_PATH_NOFORWARD,
2544 fwd_hdr->addr2);
Thomas Pedersen30789eb2011-11-24 17:15:26 -08002545 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_no_route);
Jesper Juhl74b8cc32012-01-14 21:52:17 +01002546 kfree_skb(fwd_skb);
Thomas Pedersen30789eb2011-11-24 17:15:26 -08002547 return RX_DROP_MONITOR;
2548 }
2549
2550 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
2551 ieee80211_add_pending_skb(local, fwd_skb);
Johannes Bergb51aff02010-12-22 10:15:07 +01002552 out:
Johannes Bergdf140462015-04-22 14:40:58 +02002553 if (is_multicast_ether_addr(hdr->addr1))
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02002554 return RX_CONTINUE;
Johannes Bergdf140462015-04-22 14:40:58 +02002555 return RX_DROP_MONITOR;
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02002556}
Ingo Molnarbf94e172008-10-12 23:51:38 -07002557#endif
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02002558
2559static ieee80211_rx_result debug_noinline
Johannes Berg5cf121c2008-02-25 16:27:43 +01002560ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002561{
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01002562 struct ieee80211_sub_if_data *sdata = rx->sdata;
Vivek Natarajane15276a2010-02-08 17:47:01 +05302563 struct ieee80211_local *local = rx->local;
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01002564 struct net_device *dev = sdata->dev;
Harvey Harrison358c8d92008-07-15 18:44:13 -07002565 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
2566 __le16 fc = hdr->frame_control;
Felix Fietkau4114fa22011-04-12 19:15:22 +02002567 bool port_control;
Johannes Bergce3edf6d02007-12-19 01:31:22 +01002568 int err;
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002569
Harvey Harrison358c8d92008-07-15 18:44:13 -07002570 if (unlikely(!ieee80211_is_data(hdr->frame_control)))
Johannes Berg9ae54c82008-01-31 19:48:20 +01002571 return RX_CONTINUE;
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002572
Harvey Harrison358c8d92008-07-15 18:44:13 -07002573 if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
Johannes Berge4c26ad2008-01-31 19:48:21 +01002574 return RX_DROP_MONITOR;
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002575
Felix Fietkauf14543ee2009-11-10 20:10:05 +01002576 /*
Johannes Berge7f4a942011-11-04 11:18:20 +01002577 * Send unexpected-4addr-frame event to hostapd. For older versions,
2578 * also drop the frame to cooked monitor interfaces.
Felix Fietkauf14543ee2009-11-10 20:10:05 +01002579 */
2580 if (ieee80211_has_a4(hdr->frame_control) &&
Johannes Berge7f4a942011-11-04 11:18:20 +01002581 sdata->vif.type == NL80211_IFTYPE_AP) {
2582 if (rx->sta &&
2583 !test_and_set_sta_flag(rx->sta, WLAN_STA_4ADDR_EVENT))
2584 cfg80211_rx_unexpected_4addr_frame(
2585 rx->sdata->dev, rx->sta->sta.addr, GFP_ATOMIC);
Felix Fietkauf14543ee2009-11-10 20:10:05 +01002586 return RX_DROP_MONITOR;
Johannes Berge7f4a942011-11-04 11:18:20 +01002587 }
Felix Fietkauf14543ee2009-11-10 20:10:05 +01002588
Felix Fietkau4114fa22011-04-12 19:15:22 +02002589 err = __ieee80211_data_to_8023(rx, &port_control);
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002590 if (unlikely(err))
Johannes Berge4c26ad2008-01-31 19:48:21 +01002591 return RX_DROP_UNUSABLE;
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002592
Harvey Harrison358c8d92008-07-15 18:44:13 -07002593 if (!ieee80211_frame_allowed(rx, fc))
Johannes Berge4c26ad2008-01-31 19:48:21 +01002594 return RX_DROP_MONITOR;
Johannes Bergce3edf6d02007-12-19 01:31:22 +01002595
Arik Nemtsov8a4d32f2014-11-09 18:50:20 +02002596 /* directly handle TDLS channel switch requests/responses */
2597 if (unlikely(((struct ethhdr *)rx->skb->data)->h_proto ==
2598 cpu_to_be16(ETH_P_TDLS))) {
2599 struct ieee80211_tdls_data *tf = (void *)rx->skb->data;
2600
2601 if (pskb_may_pull(rx->skb,
2602 offsetof(struct ieee80211_tdls_data, u)) &&
2603 tf->payload_type == WLAN_TDLS_SNAP_RFTYPE &&
2604 tf->category == WLAN_CATEGORY_TDLS &&
2605 (tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_REQUEST ||
2606 tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_RESPONSE)) {
Arik Nemtsovc8ff71e2015-07-08 15:41:45 +03002607 skb_queue_tail(&local->skb_queue_tdls_chsw, rx->skb);
2608 schedule_work(&local->tdls_chsw_work);
Arik Nemtsov8a4d32f2014-11-09 18:50:20 +02002609 if (rx->sta)
Johannes Berge5a9f8d2015-10-16 17:54:47 +02002610 rx->sta->rx_stats.packets++;
Arik Nemtsov8a4d32f2014-11-09 18:50:20 +02002611
2612 return RX_QUEUED;
2613 }
2614 }
2615
Felix Fietkau4114fa22011-04-12 19:15:22 +02002616 if (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
2617 unlikely(port_control) && sdata->bss) {
2618 sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
2619 u.ap);
2620 dev = sdata->dev;
2621 rx->sdata = sdata;
2622 }
2623
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002624 rx->skb->dev = dev;
2625
Johannes Berg602fae42016-03-17 15:02:52 +02002626 if (!ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS) &&
2627 local->ps_sdata && local->hw.conf.dynamic_ps_timeout > 0 &&
Rajkumar Manoharan8c99f692011-02-02 22:57:53 +05302628 !is_multicast_ether_addr(
2629 ((struct ethhdr *)rx->skb->data)->h_dest) &&
2630 (!local->scanning &&
Johannes Berg602fae42016-03-17 15:02:52 +02002631 !test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state)))
2632 mod_timer(&local->dynamic_ps_timer, jiffies +
2633 msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
Vivek Natarajane15276a2010-02-08 17:47:01 +05302634
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002635 ieee80211_deliver_skb(rx);
Johannes Berg571ecf62007-07-27 15:43:22 +02002636
Johannes Berg9ae54c82008-01-31 19:48:20 +01002637 return RX_QUEUED;
Johannes Berg571ecf62007-07-27 15:43:22 +02002638}
2639
Johannes Berg49461622008-06-30 15:10:45 +02002640static ieee80211_rx_result debug_noinline
Christian Lamparterf9e124f2013-02-04 17:44:44 +00002641ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames)
Ron Rindjunsky71364712007-12-25 17:00:36 +02002642{
Ron Rindjunsky71364712007-12-25 17:00:36 +02002643 struct sk_buff *skb = rx->skb;
Harvey Harrisona7767f92008-07-02 16:30:51 -07002644 struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
Ron Rindjunsky71364712007-12-25 17:00:36 +02002645 struct tid_ampdu_rx *tid_agg_rx;
2646 u16 start_seq_num;
2647 u16 tid;
2648
Harvey Harrisona7767f92008-07-02 16:30:51 -07002649 if (likely(!ieee80211_is_ctl(bar->frame_control)))
Johannes Berg9ae54c82008-01-31 19:48:20 +01002650 return RX_CONTINUE;
Ron Rindjunsky71364712007-12-25 17:00:36 +02002651
Harvey Harrisona7767f92008-07-02 16:30:51 -07002652 if (ieee80211_is_back_req(bar->frame_control)) {
Johannes Berg8ae59772010-05-30 14:52:58 +02002653 struct {
2654 __le16 control, start_seq_num;
2655 } __packed bar_data;
Emmanuel Grumbach63822462015-04-20 22:53:37 +03002656 struct ieee80211_event event = {
2657 .type = BAR_RX_EVENT,
2658 };
Johannes Berg8ae59772010-05-30 14:52:58 +02002659
Ron Rindjunsky71364712007-12-25 17:00:36 +02002660 if (!rx->sta)
Johannes Berga02ae752009-11-16 12:00:40 +01002661 return RX_DROP_MONITOR;
Johannes Berg8ae59772010-05-30 14:52:58 +02002662
2663 if (skb_copy_bits(skb, offsetof(struct ieee80211_bar, control),
2664 &bar_data, sizeof(bar_data)))
2665 return RX_DROP_MONITOR;
2666
Johannes Berg8ae59772010-05-30 14:52:58 +02002667 tid = le16_to_cpu(bar_data.control) >> 12;
Johannes Berga87f7362010-06-10 10:21:38 +02002668
Johannes Berg53f24972016-08-29 23:25:19 +03002669 if (!test_bit(tid, rx->sta->ampdu_mlme.agg_session_valid) &&
2670 !test_and_set_bit(tid, rx->sta->ampdu_mlme.unexpected_agg))
2671 ieee80211_send_delba(rx->sdata, rx->sta->sta.addr, tid,
2672 WLAN_BACK_RECIPIENT,
2673 WLAN_REASON_QSTA_REQUIRE_SETUP);
2674
Johannes Berga87f7362010-06-10 10:21:38 +02002675 tid_agg_rx = rcu_dereference(rx->sta->ampdu_mlme.tid_rx[tid]);
2676 if (!tid_agg_rx)
Johannes Berga02ae752009-11-16 12:00:40 +01002677 return RX_DROP_MONITOR;
Ron Rindjunsky71364712007-12-25 17:00:36 +02002678
Johannes Berg8ae59772010-05-30 14:52:58 +02002679 start_seq_num = le16_to_cpu(bar_data.start_seq_num) >> 4;
Emmanuel Grumbach63822462015-04-20 22:53:37 +03002680 event.u.ba.tid = tid;
2681 event.u.ba.ssn = start_seq_num;
2682 event.u.ba.sta = &rx->sta->sta;
Ron Rindjunsky71364712007-12-25 17:00:36 +02002683
2684 /* reset session timer */
Johannes Berg20ad19d2009-02-10 21:25:45 +01002685 if (tid_agg_rx->timeout)
2686 mod_timer(&tid_agg_rx->session_timer,
2687 TU_TO_EXP_TIME(tid_agg_rx->timeout));
Ron Rindjunsky71364712007-12-25 17:00:36 +02002688
Johannes Bergdd318572010-11-29 11:09:16 +01002689 spin_lock(&tid_agg_rx->reorder_lock);
Johannes Berga02ae752009-11-16 12:00:40 +01002690 /* release stored frames up to start of BAR */
Johannes Bergd3b2fb52012-06-22 12:48:38 +02002691 ieee80211_release_reorder_frames(rx->sdata, tid_agg_rx,
Christian Lamparterf9e124f2013-02-04 17:44:44 +00002692 start_seq_num, frames);
Johannes Bergdd318572010-11-29 11:09:16 +01002693 spin_unlock(&tid_agg_rx->reorder_lock);
2694
Emmanuel Grumbach63822462015-04-20 22:53:37 +03002695 drv_event_callback(rx->local, rx->sdata, &event);
2696
Johannes Berga02ae752009-11-16 12:00:40 +01002697 kfree_skb(skb);
2698 return RX_QUEUED;
Ron Rindjunsky71364712007-12-25 17:00:36 +02002699 }
2700
Johannes Berg08daeca2010-05-30 14:53:43 +02002701 /*
2702 * After this point, we only want management frames,
2703 * so we can drop all remaining control frames to
2704 * cooked monitor interfaces.
2705 */
2706 return RX_DROP_MONITOR;
Ron Rindjunsky71364712007-12-25 17:00:36 +02002707}
2708
Jouni Malinenf4f727a2009-01-10 11:46:53 +02002709static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
2710 struct ieee80211_mgmt *mgmt,
2711 size_t len)
Jouni Malinenfea14732009-01-08 13:32:06 +02002712{
2713 struct ieee80211_local *local = sdata->local;
2714 struct sk_buff *skb;
2715 struct ieee80211_mgmt *resp;
2716
Joe Perchesb203ca32012-05-08 18:56:52 +00002717 if (!ether_addr_equal(mgmt->da, sdata->vif.addr)) {
Jouni Malinenfea14732009-01-08 13:32:06 +02002718 /* Not to own unicast address */
2719 return;
2720 }
2721
Joe Perchesb203ca32012-05-08 18:56:52 +00002722 if (!ether_addr_equal(mgmt->sa, sdata->u.mgd.bssid) ||
2723 !ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid)) {
Johannes Berg77fdaa12009-07-07 03:45:17 +02002724 /* Not from the current AP or not associated yet. */
Jouni Malinenfea14732009-01-08 13:32:06 +02002725 return;
2726 }
2727
2728 if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) {
2729 /* Too short SA Query request frame */
2730 return;
2731 }
2732
2733 skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom);
2734 if (skb == NULL)
2735 return;
2736
2737 skb_reserve(skb, local->hw.extra_tx_headroom);
2738 resp = (struct ieee80211_mgmt *) skb_put(skb, 24);
2739 memset(resp, 0, 24);
2740 memcpy(resp->da, mgmt->sa, ETH_ALEN);
Johannes Berg47846c92009-11-25 17:46:19 +01002741 memcpy(resp->sa, sdata->vif.addr, ETH_ALEN);
Johannes Berg46900292009-02-15 12:44:28 +01002742 memcpy(resp->bssid, sdata->u.mgd.bssid, ETH_ALEN);
Jouni Malinenfea14732009-01-08 13:32:06 +02002743 resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
2744 IEEE80211_STYPE_ACTION);
2745 skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query));
2746 resp->u.action.category = WLAN_CATEGORY_SA_QUERY;
2747 resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE;
2748 memcpy(resp->u.action.u.sa_query.trans_id,
2749 mgmt->u.action.u.sa_query.trans_id,
2750 WLAN_SA_QUERY_TR_ID_LEN);
2751
Johannes Berg62ae67b2009-11-18 18:42:05 +01002752 ieee80211_tx_skb(sdata, skb);
Jouni Malinenfea14732009-01-08 13:32:06 +02002753}
2754
Johannes Berg49461622008-06-30 15:10:45 +02002755static ieee80211_rx_result debug_noinline
Johannes Berg2e161f72010-08-12 15:38:38 +02002756ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx)
2757{
2758 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
Johannes Berg554891e2010-09-24 12:38:25 +02002759 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
Johannes Berg2e161f72010-08-12 15:38:38 +02002760
2761 /*
2762 * From here on, look only at management frames.
2763 * Data and control frames are already handled,
2764 * and unknown (reserved) frames are useless.
2765 */
2766 if (rx->skb->len < 24)
2767 return RX_DROP_MONITOR;
2768
2769 if (!ieee80211_is_mgmt(mgmt->frame_control))
2770 return RX_DROP_MONITOR;
2771
Johannes Bergee971922011-11-04 11:18:18 +01002772 if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
2773 ieee80211_is_beacon(mgmt->frame_control) &&
2774 !(rx->flags & IEEE80211_RX_BEACON_REPORTED)) {
Johannes Berg804483e2012-03-05 22:18:41 +01002775 int sig = 0;
2776
Johannes Berg30686bf2015-06-02 21:39:54 +02002777 if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM))
Johannes Berg804483e2012-03-05 22:18:41 +01002778 sig = status->signal;
2779
Johannes Bergee971922011-11-04 11:18:18 +01002780 cfg80211_report_obss_beacon(rx->local->hw.wiphy,
2781 rx->skb->data, rx->skb->len,
Ben Greear37c73b52012-10-26 14:49:25 -07002782 status->freq, sig);
Johannes Bergee971922011-11-04 11:18:18 +01002783 rx->flags |= IEEE80211_RX_BEACON_REPORTED;
2784 }
2785
Johannes Berg2e161f72010-08-12 15:38:38 +02002786 if (ieee80211_drop_unencrypted_mgmt(rx))
2787 return RX_DROP_UNUSABLE;
2788
2789 return RX_CONTINUE;
2790}
2791
2792static ieee80211_rx_result debug_noinline
Johannes Bergde1ede72008-09-09 14:42:50 +02002793ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
2794{
2795 struct ieee80211_local *local = rx->local;
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01002796 struct ieee80211_sub_if_data *sdata = rx->sdata;
Johannes Bergde1ede72008-09-09 14:42:50 +02002797 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
Johannes Berg554891e2010-09-24 12:38:25 +02002798 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
Johannes Bergde1ede72008-09-09 14:42:50 +02002799 int len = rx->skb->len;
2800
2801 if (!ieee80211_is_action(mgmt->frame_control))
2802 return RX_CONTINUE;
2803
Jouni Malinen026331c2010-02-15 12:53:10 +02002804 /* drop too small frames */
2805 if (len < IEEE80211_MIN_ACTION_SIZE)
2806 return RX_DROP_UNUSABLE;
2807
Marco Porsch815b8092012-12-05 15:04:26 -08002808 if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC &&
Simon Wunderlichcd7760e2013-08-28 13:41:31 +02002809 mgmt->u.action.category != WLAN_CATEGORY_SELF_PROTECTED &&
2810 mgmt->u.action.category != WLAN_CATEGORY_SPECTRUM_MGMT)
Johannes Berg84040802010-02-15 12:46:39 +02002811 return RX_DROP_UNUSABLE;
Johannes Bergde1ede72008-09-09 14:42:50 +02002812
Johannes Bergde1ede72008-09-09 14:42:50 +02002813 switch (mgmt->u.action.category) {
Johannes Berg1d8d3de2011-12-16 15:28:57 +01002814 case WLAN_CATEGORY_HT:
2815 /* reject HT action frames from stations not supporting HT */
2816 if (!rx->sta->sta.ht_cap.ht_supported)
2817 goto invalid;
2818
2819 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
2820 sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
2821 sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
2822 sdata->vif.type != NL80211_IFTYPE_AP &&
2823 sdata->vif.type != NL80211_IFTYPE_ADHOC)
2824 break;
2825
Johannes Bergec61cd62012-12-28 12:12:10 +01002826 /* verify action & smps_control/chanwidth are present */
Johannes Berg1d8d3de2011-12-16 15:28:57 +01002827 if (len < IEEE80211_MIN_ACTION_SIZE + 2)
2828 goto invalid;
2829
2830 switch (mgmt->u.action.u.ht_smps.action) {
2831 case WLAN_HT_ACTION_SMPS: {
2832 struct ieee80211_supported_band *sband;
Johannes Bergaf0ed692013-02-12 14:21:00 +01002833 enum ieee80211_smps_mode smps_mode;
Johannes Berg1d8d3de2011-12-16 15:28:57 +01002834
2835 /* convert to HT capability */
2836 switch (mgmt->u.action.u.ht_smps.smps_control) {
2837 case WLAN_HT_SMPS_CONTROL_DISABLED:
Johannes Bergaf0ed692013-02-12 14:21:00 +01002838 smps_mode = IEEE80211_SMPS_OFF;
Johannes Berg1d8d3de2011-12-16 15:28:57 +01002839 break;
2840 case WLAN_HT_SMPS_CONTROL_STATIC:
Johannes Bergaf0ed692013-02-12 14:21:00 +01002841 smps_mode = IEEE80211_SMPS_STATIC;
Johannes Berg1d8d3de2011-12-16 15:28:57 +01002842 break;
2843 case WLAN_HT_SMPS_CONTROL_DYNAMIC:
Johannes Bergaf0ed692013-02-12 14:21:00 +01002844 smps_mode = IEEE80211_SMPS_DYNAMIC;
Johannes Berg1d8d3de2011-12-16 15:28:57 +01002845 break;
2846 default:
2847 goto invalid;
2848 }
Johannes Berg1d8d3de2011-12-16 15:28:57 +01002849
2850 /* if no change do nothing */
Johannes Bergaf0ed692013-02-12 14:21:00 +01002851 if (rx->sta->sta.smps_mode == smps_mode)
Johannes Berg1d8d3de2011-12-16 15:28:57 +01002852 goto handled;
Johannes Bergaf0ed692013-02-12 14:21:00 +01002853 rx->sta->sta.smps_mode = smps_mode;
Johannes Berg1d8d3de2011-12-16 15:28:57 +01002854
2855 sband = rx->local->hw.wiphy->bands[status->band];
2856
Johannes Berg64f68e52012-03-28 10:58:37 +02002857 rate_control_rate_update(local, sband, rx->sta,
2858 IEEE80211_RC_SMPS_CHANGED);
Johannes Berg1d8d3de2011-12-16 15:28:57 +01002859 goto handled;
2860 }
Johannes Bergec61cd62012-12-28 12:12:10 +01002861 case WLAN_HT_ACTION_NOTIFY_CHANWIDTH: {
2862 struct ieee80211_supported_band *sband;
2863 u8 chanwidth = mgmt->u.action.u.ht_notify_cw.chanwidth;
Eliad Peller1c45c5c2014-12-14 11:05:51 +02002864 enum ieee80211_sta_rx_bandwidth max_bw, new_bw;
Johannes Bergec61cd62012-12-28 12:12:10 +01002865
2866 /* If it doesn't support 40 MHz it can't change ... */
Johannes Berge1a0c6b2013-02-07 11:47:44 +01002867 if (!(rx->sta->sta.ht_cap.cap &
2868 IEEE80211_HT_CAP_SUP_WIDTH_20_40))
Johannes Bergec61cd62012-12-28 12:12:10 +01002869 goto handled;
2870
Johannes Berge1a0c6b2013-02-07 11:47:44 +01002871 if (chanwidth == IEEE80211_HT_CHANWIDTH_20MHZ)
Eliad Peller1c45c5c2014-12-14 11:05:51 +02002872 max_bw = IEEE80211_STA_RX_BW_20;
Johannes Bergec61cd62012-12-28 12:12:10 +01002873 else
Eliad Peller1c45c5c2014-12-14 11:05:51 +02002874 max_bw = ieee80211_sta_cap_rx_bw(rx->sta);
2875
2876 /* set cur_max_bandwidth and recalc sta bw */
2877 rx->sta->cur_max_bandwidth = max_bw;
2878 new_bw = ieee80211_sta_cur_vht_bw(rx->sta);
Johannes Berge1a0c6b2013-02-07 11:47:44 +01002879
2880 if (rx->sta->sta.bandwidth == new_bw)
2881 goto handled;
Johannes Bergec61cd62012-12-28 12:12:10 +01002882
Eliad Peller1c45c5c2014-12-14 11:05:51 +02002883 rx->sta->sta.bandwidth = new_bw;
Johannes Bergec61cd62012-12-28 12:12:10 +01002884 sband = rx->local->hw.wiphy->bands[status->band];
2885
2886 rate_control_rate_update(local, sband, rx->sta,
2887 IEEE80211_RC_BW_CHANGED);
2888 goto handled;
2889 }
Johannes Berg1d8d3de2011-12-16 15:28:57 +01002890 default:
2891 goto invalid;
2892 }
2893
2894 break;
Johannes Berg1b3a2e42013-03-26 15:17:18 +01002895 case WLAN_CATEGORY_PUBLIC:
2896 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
2897 goto invalid;
2898 if (sdata->vif.type != NL80211_IFTYPE_STATION)
2899 break;
2900 if (!rx->sta)
2901 break;
2902 if (!ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid))
2903 break;
2904 if (mgmt->u.action.u.ext_chan_switch.action_code !=
2905 WLAN_PUB_ACTION_EXT_CHANSW_ANN)
2906 break;
2907 if (len < offsetof(struct ieee80211_mgmt,
2908 u.action.u.ext_chan_switch.variable))
2909 goto invalid;
2910 goto queue;
Johannes Berg0af83d32012-12-27 18:55:36 +01002911 case WLAN_CATEGORY_VHT:
2912 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
2913 sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
2914 sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
2915 sdata->vif.type != NL80211_IFTYPE_AP &&
2916 sdata->vif.type != NL80211_IFTYPE_ADHOC)
2917 break;
2918
2919 /* verify action code is present */
2920 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
2921 goto invalid;
2922
2923 switch (mgmt->u.action.u.vht_opmode_notif.action_code) {
2924 case WLAN_VHT_ACTION_OPMODE_NOTIF: {
2925 u8 opmode;
2926
2927 /* verify opmode is present */
2928 if (len < IEEE80211_MIN_ACTION_SIZE + 2)
2929 goto invalid;
2930
2931 opmode = mgmt->u.action.u.vht_opmode_notif.operating_mode;
2932
2933 ieee80211_vht_handle_opmode(rx->sdata, rx->sta,
Eyal Shapiracf1e05c2015-12-08 16:04:36 +02002934 opmode, status->band);
Johannes Berg0af83d32012-12-27 18:55:36 +01002935 goto handled;
2936 }
Sara Sharon23a1f8d2015-12-08 16:04:31 +02002937 case WLAN_VHT_ACTION_GROUPID_MGMT: {
2938 if (len < IEEE80211_MIN_ACTION_SIZE + 25)
2939 goto invalid;
2940 goto queue;
2941 }
Johannes Berg0af83d32012-12-27 18:55:36 +01002942 default:
2943 break;
2944 }
2945 break;
Johannes Bergde1ede72008-09-09 14:42:50 +02002946 case WLAN_CATEGORY_BACK:
Johannes Berg8abd3f92009-02-10 21:25:47 +01002947 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
Thomas Pedersenae2772b2011-10-26 14:47:29 -07002948 sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
Johannes Berg8abd3f92009-02-10 21:25:47 +01002949 sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
Alexander Simon13c40c52011-11-30 16:56:34 +01002950 sdata->vif.type != NL80211_IFTYPE_AP &&
2951 sdata->vif.type != NL80211_IFTYPE_ADHOC)
Johannes Berg84040802010-02-15 12:46:39 +02002952 break;
Johannes Berg8abd3f92009-02-10 21:25:47 +01002953
Jouni Malinen026331c2010-02-15 12:53:10 +02002954 /* verify action_code is present */
2955 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
2956 break;
2957
Johannes Bergde1ede72008-09-09 14:42:50 +02002958 switch (mgmt->u.action.u.addba_req.action_code) {
2959 case WLAN_ACTION_ADDBA_REQ:
2960 if (len < (IEEE80211_MIN_ACTION_SIZE +
2961 sizeof(mgmt->u.action.u.addba_req)))
Johannes Bergbed7ee6e2010-06-10 10:21:35 +02002962 goto invalid;
2963 break;
Johannes Bergde1ede72008-09-09 14:42:50 +02002964 case WLAN_ACTION_ADDBA_RESP:
2965 if (len < (IEEE80211_MIN_ACTION_SIZE +
2966 sizeof(mgmt->u.action.u.addba_resp)))
Johannes Bergbed7ee6e2010-06-10 10:21:35 +02002967 goto invalid;
2968 break;
Johannes Bergde1ede72008-09-09 14:42:50 +02002969 case WLAN_ACTION_DELBA:
2970 if (len < (IEEE80211_MIN_ACTION_SIZE +
2971 sizeof(mgmt->u.action.u.delba)))
Johannes Bergbed7ee6e2010-06-10 10:21:35 +02002972 goto invalid;
2973 break;
2974 default:
2975 goto invalid;
Johannes Bergde1ede72008-09-09 14:42:50 +02002976 }
Johannes Bergbed7ee6e2010-06-10 10:21:35 +02002977
Johannes Berg8b58ff82010-06-10 10:21:51 +02002978 goto queue;
Johannes Berg39192c02008-09-09 14:49:03 +02002979 case WLAN_CATEGORY_SPECTRUM_MGMT:
Jouni Malinen026331c2010-02-15 12:53:10 +02002980 /* verify action_code is present */
2981 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
2982 break;
2983
Johannes Berg39192c02008-09-09 14:49:03 +02002984 switch (mgmt->u.action.u.measurement.action_code) {
2985 case WLAN_ACTION_SPCT_MSR_REQ:
Johannes Berg57fbcce2016-04-12 15:56:15 +02002986 if (status->band != NL80211_BAND_5GHZ)
Simon Wunderlichcd7760e2013-08-28 13:41:31 +02002987 break;
2988
Johannes Berg39192c02008-09-09 14:49:03 +02002989 if (len < (IEEE80211_MIN_ACTION_SIZE +
2990 sizeof(mgmt->u.action.u.measurement)))
Johannes Berg84040802010-02-15 12:46:39 +02002991 break;
Simon Wunderlichcd7760e2013-08-28 13:41:31 +02002992
Johannes Bergcc32abd2009-05-15 11:52:31 +02002993 if (sdata->vif.type != NL80211_IFTYPE_STATION)
Johannes Berg84040802010-02-15 12:46:39 +02002994 break;
Johannes Bergcc32abd2009-05-15 11:52:31 +02002995
Simon Wunderlichcd7760e2013-08-28 13:41:31 +02002996 ieee80211_process_measurement_req(sdata, mgmt, len);
2997 goto handled;
2998 case WLAN_ACTION_SPCT_CHL_SWITCH: {
2999 u8 *bssid;
3000 if (len < (IEEE80211_MIN_ACTION_SIZE +
3001 sizeof(mgmt->u.action.u.chan_switch)))
3002 break;
3003
3004 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
Chun-Yeow Yeohb8456a12013-10-17 15:55:02 -07003005 sdata->vif.type != NL80211_IFTYPE_ADHOC &&
3006 sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
Simon Wunderlichcd7760e2013-08-28 13:41:31 +02003007 break;
3008
3009 if (sdata->vif.type == NL80211_IFTYPE_STATION)
3010 bssid = sdata->u.mgd.bssid;
3011 else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
3012 bssid = sdata->u.ibss.bssid;
Chun-Yeow Yeohb8456a12013-10-17 15:55:02 -07003013 else if (sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
3014 bssid = mgmt->sa;
Simon Wunderlichcd7760e2013-08-28 13:41:31 +02003015 else
3016 break;
3017
3018 if (!ether_addr_equal(mgmt->bssid, bssid))
Johannes Berg84040802010-02-15 12:46:39 +02003019 break;
Sujithc481ec92009-01-06 09:28:37 +05303020
Johannes Berg8b58ff82010-06-10 10:21:51 +02003021 goto queue;
Simon Wunderlichcd7760e2013-08-28 13:41:31 +02003022 }
Johannes Berg39192c02008-09-09 14:49:03 +02003023 }
3024 break;
Jouni Malinenfea14732009-01-08 13:32:06 +02003025 case WLAN_CATEGORY_SA_QUERY:
3026 if (len < (IEEE80211_MIN_ACTION_SIZE +
3027 sizeof(mgmt->u.action.u.sa_query)))
Johannes Berg84040802010-02-15 12:46:39 +02003028 break;
3029
Jouni Malinenfea14732009-01-08 13:32:06 +02003030 switch (mgmt->u.action.u.sa_query.action) {
3031 case WLAN_ACTION_SA_QUERY_REQUEST:
3032 if (sdata->vif.type != NL80211_IFTYPE_STATION)
Johannes Berg84040802010-02-15 12:46:39 +02003033 break;
Jouni Malinenfea14732009-01-08 13:32:06 +02003034 ieee80211_process_sa_query_req(sdata, mgmt, len);
Johannes Berg84040802010-02-15 12:46:39 +02003035 goto handled;
Jouni Malinenfea14732009-01-08 13:32:06 +02003036 }
3037 break;
Thomas Pedersen8db09852011-08-12 20:01:00 -07003038 case WLAN_CATEGORY_SELF_PROTECTED:
Johannes Berg9b395bc2012-10-26 00:36:40 +02003039 if (len < (IEEE80211_MIN_ACTION_SIZE +
3040 sizeof(mgmt->u.action.u.self_prot.action_code)))
3041 break;
3042
Thomas Pedersen8db09852011-08-12 20:01:00 -07003043 switch (mgmt->u.action.u.self_prot.action_code) {
3044 case WLAN_SP_MESH_PEERING_OPEN:
3045 case WLAN_SP_MESH_PEERING_CLOSE:
3046 case WLAN_SP_MESH_PEERING_CONFIRM:
3047 if (!ieee80211_vif_is_mesh(&sdata->vif))
3048 goto invalid;
Thomas Pedersena6dad6a2013-03-04 13:06:12 -08003049 if (sdata->u.mesh.user_mpm)
Thomas Pedersen8db09852011-08-12 20:01:00 -07003050 /* userspace handles this frame */
3051 break;
3052 goto queue;
3053 case WLAN_SP_MGK_INFORM:
3054 case WLAN_SP_MGK_ACK:
3055 if (!ieee80211_vif_is_mesh(&sdata->vif))
3056 goto invalid;
3057 break;
3058 }
3059 break;
Javier Cardonad3aaec8a2011-05-03 16:57:09 -07003060 case WLAN_CATEGORY_MESH_ACTION:
Johannes Berg9b395bc2012-10-26 00:36:40 +02003061 if (len < (IEEE80211_MIN_ACTION_SIZE +
3062 sizeof(mgmt->u.action.u.mesh_action.action_code)))
3063 break;
3064
Johannes Berg77a121c2010-06-10 10:21:34 +02003065 if (!ieee80211_vif_is_mesh(&sdata->vif))
3066 break;
Thomas Pedersen25d49e42011-08-11 19:35:15 -07003067 if (mesh_action_is_path_sel(mgmt) &&
Johannes Berg1df332e2012-10-26 00:09:11 +02003068 !mesh_path_sel_is_hwmp(sdata))
Javier Cardonac7108a72010-12-16 17:37:50 -08003069 break;
3070 goto queue;
Johannes Berg84040802010-02-15 12:46:39 +02003071 }
Jouni Malinen026331c2010-02-15 12:53:10 +02003072
Johannes Berg2e161f72010-08-12 15:38:38 +02003073 return RX_CONTINUE;
3074
Johannes Bergbed7ee6e2010-06-10 10:21:35 +02003075 invalid:
Johannes Berg554891e2010-09-24 12:38:25 +02003076 status->rx_flags |= IEEE80211_RX_MALFORMED_ACTION_FRM;
Johannes Berg2e161f72010-08-12 15:38:38 +02003077 /* will return in the next handlers */
3078 return RX_CONTINUE;
3079
3080 handled:
3081 if (rx->sta)
Johannes Berge5a9f8d2015-10-16 17:54:47 +02003082 rx->sta->rx_stats.packets++;
Johannes Berg2e161f72010-08-12 15:38:38 +02003083 dev_kfree_skb(rx->skb);
3084 return RX_QUEUED;
3085
3086 queue:
3087 rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
3088 skb_queue_tail(&sdata->skb_queue, rx->skb);
3089 ieee80211_queue_work(&local->hw, &sdata->work);
3090 if (rx->sta)
Johannes Berge5a9f8d2015-10-16 17:54:47 +02003091 rx->sta->rx_stats.packets++;
Johannes Berg2e161f72010-08-12 15:38:38 +02003092 return RX_QUEUED;
3093}
3094
3095static ieee80211_rx_result debug_noinline
3096ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx)
3097{
Johannes Berg554891e2010-09-24 12:38:25 +02003098 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
Johannes Berg804483e2012-03-05 22:18:41 +01003099 int sig = 0;
Johannes Berg2e161f72010-08-12 15:38:38 +02003100
3101 /* skip known-bad action frames and return them in the next handler */
Johannes Berg554891e2010-09-24 12:38:25 +02003102 if (status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM)
Johannes Berg2e161f72010-08-12 15:38:38 +02003103 return RX_CONTINUE;
Felix Fietkaud7907442010-01-07 20:23:53 +01003104
Jouni Malinen026331c2010-02-15 12:53:10 +02003105 /*
3106 * Getting here means the kernel doesn't know how to handle
3107 * it, but maybe userspace does ... include returned frames
3108 * so userspace can register for those to know whether ones
3109 * it transmitted were processed or returned.
3110 */
Jouni Malinen026331c2010-02-15 12:53:10 +02003111
Johannes Berg30686bf2015-06-02 21:39:54 +02003112 if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM))
Johannes Berg804483e2012-03-05 22:18:41 +01003113 sig = status->signal;
3114
Johannes Berg71bbc992012-06-15 15:30:18 +02003115 if (cfg80211_rx_mgmt(&rx->sdata->wdev, status->freq, sig,
Vladimir Kondratiev970fdfa2014-08-11 03:29:57 -07003116 rx->skb->data, rx->skb->len, 0)) {
Johannes Berg2e161f72010-08-12 15:38:38 +02003117 if (rx->sta)
Johannes Berge5a9f8d2015-10-16 17:54:47 +02003118 rx->sta->rx_stats.packets++;
Johannes Berg2e161f72010-08-12 15:38:38 +02003119 dev_kfree_skb(rx->skb);
3120 return RX_QUEUED;
3121 }
3122
Johannes Berg2e161f72010-08-12 15:38:38 +02003123 return RX_CONTINUE;
3124}
3125
3126static ieee80211_rx_result debug_noinline
3127ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
3128{
3129 struct ieee80211_local *local = rx->local;
3130 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
3131 struct sk_buff *nskb;
3132 struct ieee80211_sub_if_data *sdata = rx->sdata;
Johannes Berg554891e2010-09-24 12:38:25 +02003133 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
Johannes Berg2e161f72010-08-12 15:38:38 +02003134
3135 if (!ieee80211_is_action(mgmt->frame_control))
3136 return RX_CONTINUE;
3137
3138 /*
3139 * For AP mode, hostapd is responsible for handling any action
3140 * frames that we didn't handle, including returning unknown
3141 * ones. For all other modes we will return them to the sender,
3142 * setting the 0x80 bit in the action category, as required by
Johannes Berg4b5ebcc2012-06-27 15:38:56 +02003143 * 802.11-2012 9.24.4.
Johannes Berg2e161f72010-08-12 15:38:38 +02003144 * Newer versions of hostapd shall also use the management frame
3145 * registration mechanisms, but older ones still use cooked
3146 * monitor interfaces so push all frames there.
3147 */
Johannes Berg554891e2010-09-24 12:38:25 +02003148 if (!(status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) &&
Johannes Berg2e161f72010-08-12 15:38:38 +02003149 (sdata->vif.type == NL80211_IFTYPE_AP ||
3150 sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
3151 return RX_DROP_MONITOR;
Jouni Malinen026331c2010-02-15 12:53:10 +02003152
Johannes Berg4b5ebcc2012-06-27 15:38:56 +02003153 if (is_multicast_ether_addr(mgmt->da))
3154 return RX_DROP_MONITOR;
3155
Johannes Berg84040802010-02-15 12:46:39 +02003156 /* do not return rejected action frames */
3157 if (mgmt->u.action.category & 0x80)
3158 return RX_DROP_UNUSABLE;
3159
3160 nskb = skb_copy_expand(rx->skb, local->hw.extra_tx_headroom, 0,
3161 GFP_ATOMIC);
3162 if (nskb) {
John W. Linville292b4df2010-06-24 11:13:56 -04003163 struct ieee80211_mgmt *nmgmt = (void *)nskb->data;
Johannes Berg84040802010-02-15 12:46:39 +02003164
John W. Linville292b4df2010-06-24 11:13:56 -04003165 nmgmt->u.action.category |= 0x80;
3166 memcpy(nmgmt->da, nmgmt->sa, ETH_ALEN);
3167 memcpy(nmgmt->sa, rx->sdata->vif.addr, ETH_ALEN);
Johannes Berg84040802010-02-15 12:46:39 +02003168
3169 memset(nskb->cb, 0, sizeof(nskb->cb));
3170
Johannes Berg07e5a5f2013-03-07 13:22:05 +01003171 if (rx->sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) {
3172 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(nskb);
3173
3174 info->flags = IEEE80211_TX_CTL_TX_OFFCHAN |
3175 IEEE80211_TX_INTFL_OFFCHAN_TX_OK |
3176 IEEE80211_TX_CTL_NO_CCK_RATE;
Johannes Berg30686bf2015-06-02 21:39:54 +02003177 if (ieee80211_hw_check(&local->hw, QUEUE_CONTROL))
Johannes Berg07e5a5f2013-03-07 13:22:05 +01003178 info->hw_queue =
3179 local->hw.offchannel_tx_hw_queue;
3180 }
3181
3182 __ieee80211_tx_skb_tid_band(rx->sdata, nskb, 7,
3183 status->band);
Johannes Bergde1ede72008-09-09 14:42:50 +02003184 }
Johannes Berg39192c02008-09-09 14:49:03 +02003185 dev_kfree_skb(rx->skb);
3186 return RX_QUEUED;
Johannes Bergde1ede72008-09-09 14:42:50 +02003187}
3188
3189static ieee80211_rx_result debug_noinline
Johannes Berg5cf121c2008-02-25 16:27:43 +01003190ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
Johannes Berg571ecf62007-07-27 15:43:22 +02003191{
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01003192 struct ieee80211_sub_if_data *sdata = rx->sdata;
Johannes Berg77a121c2010-06-10 10:21:34 +02003193 struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
3194 __le16 stype;
Johannes Berg571ecf62007-07-27 15:43:22 +02003195
Johannes Berg77a121c2010-06-10 10:21:34 +02003196 stype = mgmt->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE);
Johannes Berg472dbc42008-09-11 00:01:49 +02003197
Johannes Berg77a121c2010-06-10 10:21:34 +02003198 if (!ieee80211_vif_is_mesh(&sdata->vif) &&
3199 sdata->vif.type != NL80211_IFTYPE_ADHOC &&
Rostislav Lisovy239281f2014-11-03 10:33:19 +01003200 sdata->vif.type != NL80211_IFTYPE_OCB &&
Johannes Berg77a121c2010-06-10 10:21:34 +02003201 sdata->vif.type != NL80211_IFTYPE_STATION)
3202 return RX_DROP_MONITOR;
Johannes Bergf9d540e2007-09-28 14:02:09 +02003203
Johannes Berg77a121c2010-06-10 10:21:34 +02003204 switch (stype) {
Johannes Berg66e67e42012-01-20 13:55:27 +01003205 case cpu_to_le16(IEEE80211_STYPE_AUTH):
Johannes Berg77a121c2010-06-10 10:21:34 +02003206 case cpu_to_le16(IEEE80211_STYPE_BEACON):
3207 case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
3208 /* process for all: mesh, mlme, ibss */
3209 break;
Johannes Berg66e67e42012-01-20 13:55:27 +01003210 case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
3211 case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
Johannes Berg77a121c2010-06-10 10:21:34 +02003212 case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
3213 case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
Christian Lamparter2c313332010-11-29 20:53:23 +01003214 if (is_multicast_ether_addr(mgmt->da) &&
3215 !is_broadcast_ether_addr(mgmt->da))
3216 return RX_DROP_MONITOR;
3217
Johannes Berg77a121c2010-06-10 10:21:34 +02003218 /* process only for station */
3219 if (sdata->vif.type != NL80211_IFTYPE_STATION)
3220 return RX_DROP_MONITOR;
3221 break;
3222 case cpu_to_le16(IEEE80211_STYPE_PROBE_REQ):
Thomas Pedersen9fb04b52013-02-14 11:20:14 -08003223 /* process only for ibss and mesh */
3224 if (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
3225 sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
Johannes Berg77a121c2010-06-10 10:21:34 +02003226 return RX_DROP_MONITOR;
3227 break;
3228 default:
3229 return RX_DROP_MONITOR;
3230 }
Johannes Berg46900292009-02-15 12:44:28 +01003231
Johannes Berg77a121c2010-06-10 10:21:34 +02003232 /* queue up frame and kick off work to process it */
Johannes Bergc1475ca2010-06-10 10:21:37 +02003233 rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
Johannes Berg77a121c2010-06-10 10:21:34 +02003234 skb_queue_tail(&sdata->skb_queue, rx->skb);
3235 ieee80211_queue_work(&rx->local->hw, &sdata->work);
Johannes Berg8b58ff82010-06-10 10:21:51 +02003236 if (rx->sta)
Johannes Berge5a9f8d2015-10-16 17:54:47 +02003237 rx->sta->rx_stats.packets++;
Johannes Berg77a121c2010-06-10 10:21:34 +02003238
3239 return RX_QUEUED;
Johannes Berg571ecf62007-07-27 15:43:22 +02003240}
3241
Johannes Berg5f0b7de2009-11-16 13:58:21 +01003242static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
3243 struct ieee80211_rate *rate)
Michael Wu3d30d942008-01-31 19:48:27 +01003244{
3245 struct ieee80211_sub_if_data *sdata;
3246 struct ieee80211_local *local = rx->local;
Michael Wu3d30d942008-01-31 19:48:27 +01003247 struct sk_buff *skb = rx->skb, *skb2;
3248 struct net_device *prev_dev = NULL;
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01003249 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
Johannes Berg293702a2012-03-02 13:18:19 +01003250 int needed_headroom;
Michael Wu3d30d942008-01-31 19:48:27 +01003251
Johannes Berg554891e2010-09-24 12:38:25 +02003252 /*
3253 * If cooked monitor has been processed already, then
3254 * don't do it again. If not, set the flag.
3255 */
3256 if (rx->flags & IEEE80211_RX_CMNTR)
John W. Linville7c1e1832010-09-24 15:52:49 -04003257 goto out_free_skb;
Johannes Berg554891e2010-09-24 12:38:25 +02003258 rx->flags |= IEEE80211_RX_CMNTR;
John W. Linville7c1e1832010-09-24 15:52:49 -04003259
Johannes Berg152c4772011-10-21 10:22:22 +02003260 /* If there are no cooked monitor interfaces, just free the SKB */
3261 if (!local->cooked_mntrs)
3262 goto out_free_skb;
3263
Johannes Berg1f7bba72014-11-06 22:56:36 +01003264 /* vendor data is long removed here */
3265 status->flag &= ~RX_FLAG_RADIOTAP_VENDOR_DATA;
Johannes Berg293702a2012-03-02 13:18:19 +01003266 /* room for the radiotap header based on driver features */
Johannes Berg1f7bba72014-11-06 22:56:36 +01003267 needed_headroom = ieee80211_rx_radiotap_hdrlen(local, status, skb);
Johannes Berg293702a2012-03-02 13:18:19 +01003268
3269 if (skb_headroom(skb) < needed_headroom &&
3270 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC))
Michael Wu3d30d942008-01-31 19:48:27 +01003271 goto out_free_skb;
3272
Johannes Berg293702a2012-03-02 13:18:19 +01003273 /* prepend radiotap information */
Felix Fietkau973ef212012-04-16 14:56:48 +02003274 ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom,
3275 false);
Michael Wu3d30d942008-01-31 19:48:27 +01003276
Zhang Shengjud57a5442016-03-03 01:16:56 +00003277 skb_reset_mac_header(skb);
Michael Wu3d30d942008-01-31 19:48:27 +01003278 skb->ip_summed = CHECKSUM_UNNECESSARY;
3279 skb->pkt_type = PACKET_OTHERHOST;
3280 skb->protocol = htons(ETH_P_802_2);
3281
3282 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
Johannes Berg9607e6b2009-12-23 13:15:31 +01003283 if (!ieee80211_sdata_running(sdata))
Michael Wu3d30d942008-01-31 19:48:27 +01003284 continue;
3285
Johannes Berg05c914f2008-09-11 00:01:58 +02003286 if (sdata->vif.type != NL80211_IFTYPE_MONITOR ||
Aviya Erenfeldd8212182016-08-29 23:25:15 +03003287 !(sdata->u.mntr.flags & MONITOR_FLAG_COOK_FRAMES))
Michael Wu3d30d942008-01-31 19:48:27 +01003288 continue;
3289
3290 if (prev_dev) {
3291 skb2 = skb_clone(skb, GFP_ATOMIC);
3292 if (skb2) {
3293 skb2->dev = prev_dev;
John W. Linville5548a8a2010-06-24 14:25:56 -04003294 netif_receive_skb(skb2);
Michael Wu3d30d942008-01-31 19:48:27 +01003295 }
3296 }
3297
3298 prev_dev = sdata->dev;
Johannes Berg5a490512015-04-22 17:10:38 +02003299 ieee80211_rx_stats(sdata->dev, skb->len);
Michael Wu3d30d942008-01-31 19:48:27 +01003300 }
3301
3302 if (prev_dev) {
3303 skb->dev = prev_dev;
John W. Linville5548a8a2010-06-24 14:25:56 -04003304 netif_receive_skb(skb);
Johannes Berg554891e2010-09-24 12:38:25 +02003305 return;
3306 }
Michael Wu3d30d942008-01-31 19:48:27 +01003307
3308 out_free_skb:
3309 dev_kfree_skb(skb);
3310}
3311
Christian Lamparteraa0c8632010-08-05 01:36:04 +02003312static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx,
3313 ieee80211_rx_result res)
3314{
3315 switch (res) {
3316 case RX_DROP_MONITOR:
3317 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
3318 if (rx->sta)
Johannes Berge5a9f8d2015-10-16 17:54:47 +02003319 rx->sta->rx_stats.dropped++;
Christian Lamparteraa0c8632010-08-05 01:36:04 +02003320 /* fall through */
3321 case RX_CONTINUE: {
3322 struct ieee80211_rate *rate = NULL;
3323 struct ieee80211_supported_band *sband;
3324 struct ieee80211_rx_status *status;
3325
3326 status = IEEE80211_SKB_RXCB((rx->skb));
3327
3328 sband = rx->local->hw.wiphy->bands[status->band];
Johannes Berg56146182012-11-09 15:07:02 +01003329 if (!(status->flag & RX_FLAG_HT) &&
3330 !(status->flag & RX_FLAG_VHT))
Christian Lamparteraa0c8632010-08-05 01:36:04 +02003331 rate = &sband->bitrates[status->rate_idx];
3332
3333 ieee80211_rx_cooked_monitor(rx, rate);
3334 break;
3335 }
3336 case RX_DROP_UNUSABLE:
3337 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
3338 if (rx->sta)
Johannes Berge5a9f8d2015-10-16 17:54:47 +02003339 rx->sta->rx_stats.dropped++;
Christian Lamparteraa0c8632010-08-05 01:36:04 +02003340 dev_kfree_skb(rx->skb);
3341 break;
3342 case RX_QUEUED:
3343 I802_DEBUG_INC(rx->sdata->local->rx_handlers_queued);
3344 break;
3345 }
3346}
3347
Christian Lamparterf9e124f2013-02-04 17:44:44 +00003348static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx,
3349 struct sk_buff_head *frames)
Christian Lamparteraa0c8632010-08-05 01:36:04 +02003350{
3351 ieee80211_rx_result res = RX_DROP_MONITOR;
3352 struct sk_buff *skb;
3353
3354#define CALL_RXH(rxh) \
3355 do { \
3356 res = rxh(rx); \
3357 if (res != RX_CONTINUE) \
3358 goto rxh_next; \
Johannes Berg8ebaa5b2016-03-31 20:02:04 +03003359 } while (0)
Christian Lamparteraa0c8632010-08-05 01:36:04 +02003360
Johannes Berg45ceeee2015-03-16 09:08:20 +01003361 /* Lock here to avoid hitting all of the data used in the RX
3362 * path (e.g. key data, station data, ...) concurrently when
3363 * a frame is released from the reorder buffer due to timeout
3364 * from the timer, potentially concurrently with RX from the
3365 * driver.
3366 */
Christian Lamparterf9e124f2013-02-04 17:44:44 +00003367 spin_lock_bh(&rx->local->rx_path_lock);
Christian Lamparter24a8fda2010-12-30 17:25:29 +01003368
Christian Lamparterf9e124f2013-02-04 17:44:44 +00003369 while ((skb = __skb_dequeue(frames))) {
Christian Lamparteraa0c8632010-08-05 01:36:04 +02003370 /*
3371 * all the other fields are valid across frames
3372 * that belong to an aMPDU since they are on the
3373 * same TID from the same station
3374 */
3375 rx->skb = skb;
3376
Johannes Berg8ebaa5b2016-03-31 20:02:04 +03003377 CALL_RXH(ieee80211_rx_h_check_more_data);
3378 CALL_RXH(ieee80211_rx_h_uapsd_and_pspoll);
3379 CALL_RXH(ieee80211_rx_h_sta_process);
3380 CALL_RXH(ieee80211_rx_h_decrypt);
3381 CALL_RXH(ieee80211_rx_h_defragment);
3382 CALL_RXH(ieee80211_rx_h_michael_mic_verify);
Christian Lamparteraa0c8632010-08-05 01:36:04 +02003383 /* must be after MMIC verify so header is counted in MPDU mic */
Christian Lamparteraa0c8632010-08-05 01:36:04 +02003384#ifdef CONFIG_MAC80211_MESH
3385 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
3386 CALL_RXH(ieee80211_rx_h_mesh_fwding);
3387#endif
Johannes Berg8ebaa5b2016-03-31 20:02:04 +03003388 CALL_RXH(ieee80211_rx_h_amsdu);
3389 CALL_RXH(ieee80211_rx_h_data);
Christian Lamparterf9e124f2013-02-04 17:44:44 +00003390
3391 /* special treatment -- needs the queue */
3392 res = ieee80211_rx_h_ctrl(rx, frames);
3393 if (res != RX_CONTINUE)
3394 goto rxh_next;
3395
Johannes Berg8ebaa5b2016-03-31 20:02:04 +03003396 CALL_RXH(ieee80211_rx_h_mgmt_check);
3397 CALL_RXH(ieee80211_rx_h_action);
3398 CALL_RXH(ieee80211_rx_h_userspace_mgmt);
3399 CALL_RXH(ieee80211_rx_h_action_return);
3400 CALL_RXH(ieee80211_rx_h_mgmt);
Christian Lamparteraa0c8632010-08-05 01:36:04 +02003401
3402 rxh_next:
3403 ieee80211_rx_handlers_result(rx, res);
Christian Lamparterf9e124f2013-02-04 17:44:44 +00003404
Christian Lamparteraa0c8632010-08-05 01:36:04 +02003405#undef CALL_RXH
3406 }
Christian Lamparter24a8fda2010-12-30 17:25:29 +01003407
Christian Lamparterf9e124f2013-02-04 17:44:44 +00003408 spin_unlock_bh(&rx->local->rx_path_lock);
Christian Lamparteraa0c8632010-08-05 01:36:04 +02003409}
Johannes Berg571ecf62007-07-27 15:43:22 +02003410
Johannes Berg4406c372010-09-24 11:21:06 +02003411static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
Johannes Berg58905292008-01-31 19:48:25 +01003412{
Christian Lamparterf9e124f2013-02-04 17:44:44 +00003413 struct sk_buff_head reorder_release;
Johannes Berg58905292008-01-31 19:48:25 +01003414 ieee80211_rx_result res = RX_DROP_MONITOR;
3415
Christian Lamparterf9e124f2013-02-04 17:44:44 +00003416 __skb_queue_head_init(&reorder_release);
3417
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02003418#define CALL_RXH(rxh) \
3419 do { \
3420 res = rxh(rx); \
3421 if (res != RX_CONTINUE) \
Johannes Berg2569a822009-11-25 17:46:17 +01003422 goto rxh_next; \
Johannes Berg8ebaa5b2016-03-31 20:02:04 +03003423 } while (0)
Johannes Berg58905292008-01-31 19:48:25 +01003424
Johannes Berg8ebaa5b2016-03-31 20:02:04 +03003425 CALL_RXH(ieee80211_rx_h_check_dup);
3426 CALL_RXH(ieee80211_rx_h_check);
Johannes Berg2569a822009-11-25 17:46:17 +01003427
Christian Lamparterf9e124f2013-02-04 17:44:44 +00003428 ieee80211_rx_reorder_ampdu(rx, &reorder_release);
Johannes Berg2569a822009-11-25 17:46:17 +01003429
Christian Lamparterf9e124f2013-02-04 17:44:44 +00003430 ieee80211_rx_handlers(rx, &reorder_release);
Christian Lamparteraa0c8632010-08-05 01:36:04 +02003431 return;
Johannes Berg49461622008-06-30 15:10:45 +02003432
Johannes Berg2569a822009-11-25 17:46:17 +01003433 rxh_next:
Christian Lamparteraa0c8632010-08-05 01:36:04 +02003434 ieee80211_rx_handlers_result(rx, res);
3435
3436#undef CALL_RXH
Johannes Berg58905292008-01-31 19:48:25 +01003437}
3438
Christian Lamparter2bff8eb2010-08-05 01:36:41 +02003439/*
Johannes Bergdd318572010-11-29 11:09:16 +01003440 * This function makes calls into the RX path, therefore
3441 * it has to be invoked under RCU read lock.
Christian Lamparter2bff8eb2010-08-05 01:36:41 +02003442 */
3443void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
3444{
Christian Lamparterf9e124f2013-02-04 17:44:44 +00003445 struct sk_buff_head frames;
Johannes Berg554891e2010-09-24 12:38:25 +02003446 struct ieee80211_rx_data rx = {
3447 .sta = sta,
3448 .sdata = sta->sdata,
3449 .local = sta->local,
Johannes Berg9e262972011-07-07 18:45:03 +02003450 /* This is OK -- must be QoS data frame */
3451 .security_idx = tid,
3452 .seqno_idx = tid,
Johannes Bergaf9f9b22015-06-11 16:02:32 +02003453 .napi = NULL, /* must be NULL to not have races */
Johannes Berg554891e2010-09-24 12:38:25 +02003454 };
Christian Lamparter2c15a0c2010-08-24 19:22:42 +02003455 struct tid_ampdu_rx *tid_agg_rx;
3456
3457 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
3458 if (!tid_agg_rx)
3459 return;
Christian Lamparter2bff8eb2010-08-05 01:36:41 +02003460
Christian Lamparterf9e124f2013-02-04 17:44:44 +00003461 __skb_queue_head_init(&frames);
3462
Christian Lamparter2c15a0c2010-08-24 19:22:42 +02003463 spin_lock(&tid_agg_rx->reorder_lock);
Christian Lamparterf9e124f2013-02-04 17:44:44 +00003464 ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames);
Christian Lamparter2c15a0c2010-08-24 19:22:42 +02003465 spin_unlock(&tid_agg_rx->reorder_lock);
Christian Lamparter2bff8eb2010-08-05 01:36:41 +02003466
Emmanuel Grumbachb497de62015-04-20 22:53:38 +03003467 if (!skb_queue_empty(&frames)) {
3468 struct ieee80211_event event = {
3469 .type = BA_FRAME_TIMEOUT,
3470 .u.ba.tid = tid,
3471 .u.ba.sta = &sta->sta,
3472 };
3473 drv_event_callback(rx.local, rx.sdata, &event);
3474 }
3475
Christian Lamparterf9e124f2013-02-04 17:44:44 +00003476 ieee80211_rx_handlers(&rx, &frames);
Christian Lamparter2bff8eb2010-08-05 01:36:41 +02003477}
3478
Sara Sharon06470f72016-01-28 16:19:25 +02003479void ieee80211_mark_rx_ba_filtered_frames(struct ieee80211_sta *pubsta, u8 tid,
3480 u16 ssn, u64 filtered,
3481 u16 received_mpdus)
3482{
3483 struct sta_info *sta;
3484 struct tid_ampdu_rx *tid_agg_rx;
3485 struct sk_buff_head frames;
3486 struct ieee80211_rx_data rx = {
3487 /* This is OK -- must be QoS data frame */
3488 .security_idx = tid,
3489 .seqno_idx = tid,
3490 };
3491 int i, diff;
3492
3493 if (WARN_ON(!pubsta || tid >= IEEE80211_NUM_TIDS))
3494 return;
3495
3496 __skb_queue_head_init(&frames);
3497
3498 sta = container_of(pubsta, struct sta_info, sta);
3499
3500 rx.sta = sta;
3501 rx.sdata = sta->sdata;
3502 rx.local = sta->local;
3503
3504 rcu_read_lock();
3505 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
3506 if (!tid_agg_rx)
3507 goto out;
3508
3509 spin_lock_bh(&tid_agg_rx->reorder_lock);
3510
3511 if (received_mpdus >= IEEE80211_SN_MODULO >> 1) {
3512 int release;
3513
3514 /* release all frames in the reorder buffer */
3515 release = (tid_agg_rx->head_seq_num + tid_agg_rx->buf_size) %
3516 IEEE80211_SN_MODULO;
3517 ieee80211_release_reorder_frames(sta->sdata, tid_agg_rx,
3518 release, &frames);
3519 /* update ssn to match received ssn */
3520 tid_agg_rx->head_seq_num = ssn;
3521 } else {
3522 ieee80211_release_reorder_frames(sta->sdata, tid_agg_rx, ssn,
3523 &frames);
3524 }
3525
3526 /* handle the case that received ssn is behind the mac ssn.
3527 * it can be tid_agg_rx->buf_size behind and still be valid */
3528 diff = (tid_agg_rx->head_seq_num - ssn) & IEEE80211_SN_MASK;
3529 if (diff >= tid_agg_rx->buf_size) {
3530 tid_agg_rx->reorder_buf_filtered = 0;
3531 goto release;
3532 }
3533 filtered = filtered >> diff;
3534 ssn += diff;
3535
3536 /* update bitmap */
3537 for (i = 0; i < tid_agg_rx->buf_size; i++) {
3538 int index = (ssn + i) % tid_agg_rx->buf_size;
3539
3540 tid_agg_rx->reorder_buf_filtered &= ~BIT_ULL(index);
3541 if (filtered & BIT_ULL(i))
3542 tid_agg_rx->reorder_buf_filtered |= BIT_ULL(index);
3543 }
3544
3545 /* now process also frames that the filter marking released */
3546 ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames);
3547
3548release:
3549 spin_unlock_bh(&tid_agg_rx->reorder_lock);
3550
3551 ieee80211_rx_handlers(&rx, &frames);
3552
3553 out:
3554 rcu_read_unlock();
3555}
3556EXPORT_SYMBOL(ieee80211_mark_rx_ba_filtered_frames);
3557
Johannes Berg571ecf62007-07-27 15:43:22 +02003558/* main receive path */
3559
Johannes Berga58fbe12015-04-22 15:08:39 +02003560static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx)
Johannes Berg23a24de2007-07-27 15:43:22 +02003561{
Johannes Berg20b01f82010-09-24 11:21:05 +02003562 struct ieee80211_sub_if_data *sdata = rx->sdata;
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01003563 struct sk_buff *skb = rx->skb;
Johannes Berga58fbe12015-04-22 15:08:39 +02003564 struct ieee80211_hdr *hdr = (void *)skb->data;
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01003565 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
3566 u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
Johannes Berg23a24de2007-07-27 15:43:22 +02003567 int multicast = is_multicast_ether_addr(hdr->addr1);
3568
Johannes Berg51fb61e2007-12-19 01:31:27 +01003569 switch (sdata->vif.type) {
Johannes Berg05c914f2008-09-11 00:01:58 +02003570 case NL80211_IFTYPE_STATION:
Johannes Berg9bc383d2009-11-19 11:55:19 +01003571 if (!bssid && !sdata->u.mgd.use_4addr)
Johannes Berg3c2723f52014-01-07 16:23:24 +01003572 return false;
Johannes Berga58fbe12015-04-22 15:08:39 +02003573 if (multicast)
3574 return true;
3575 return ether_addr_equal(sdata->vif.addr, hdr->addr1);
Johannes Berg05c914f2008-09-11 00:01:58 +02003576 case NL80211_IFTYPE_ADHOC:
Johannes Berg23a24de2007-07-27 15:43:22 +02003577 if (!bssid)
Johannes Berg3c2723f52014-01-07 16:23:24 +01003578 return false;
Felix Fietkau6329b8d2013-09-17 11:15:43 +02003579 if (ether_addr_equal(sdata->vif.addr, hdr->addr2) ||
3580 ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2))
Johannes Berg3c2723f52014-01-07 16:23:24 +01003581 return false;
Johannes Berga58fbe12015-04-22 15:08:39 +02003582 if (ieee80211_is_beacon(hdr->frame_control))
Johannes Berg3c2723f52014-01-07 16:23:24 +01003583 return true;
Johannes Berga58fbe12015-04-22 15:08:39 +02003584 if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid))
Johannes Berg3c2723f52014-01-07 16:23:24 +01003585 return false;
Johannes Berga58fbe12015-04-22 15:08:39 +02003586 if (!multicast &&
3587 !ether_addr_equal(sdata->vif.addr, hdr->addr1))
Johannes Bergdf140462015-04-22 14:40:58 +02003588 return false;
Johannes Berga58fbe12015-04-22 15:08:39 +02003589 if (!rx->sta) {
Jouni Malinen0fb8ca42008-12-12 14:38:33 +02003590 int rate_idx;
Johannes Berg56146182012-11-09 15:07:02 +01003591 if (status->flag & (RX_FLAG_HT | RX_FLAG_VHT))
3592 rate_idx = 0; /* TODO: HT/VHT rates */
Jouni Malinen0fb8ca42008-12-12 14:38:33 +02003593 else
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01003594 rate_idx = status->rate_idx;
Johannes Berg8bf11d82011-12-15 11:17:37 +01003595 ieee80211_ibss_rx_no_sta(sdata, bssid, hdr->addr2,
3596 BIT(rate_idx));
Jouni Malinen0fb8ca42008-12-12 14:38:33 +02003597 }
Johannes Berga58fbe12015-04-22 15:08:39 +02003598 return true;
Rostislav Lisovy239281f2014-11-03 10:33:19 +01003599 case NL80211_IFTYPE_OCB:
3600 if (!bssid)
3601 return false;
Bertold Van den Berghcc117292015-08-05 16:02:42 +02003602 if (!ieee80211_is_data_present(hdr->frame_control))
Rostislav Lisovy239281f2014-11-03 10:33:19 +01003603 return false;
Johannes Berga58fbe12015-04-22 15:08:39 +02003604 if (!is_broadcast_ether_addr(bssid))
Rostislav Lisovy239281f2014-11-03 10:33:19 +01003605 return false;
Johannes Berga58fbe12015-04-22 15:08:39 +02003606 if (!multicast &&
3607 !ether_addr_equal(sdata->dev->dev_addr, hdr->addr1))
Johannes Bergdf140462015-04-22 14:40:58 +02003608 return false;
Johannes Berga58fbe12015-04-22 15:08:39 +02003609 if (!rx->sta) {
Rostislav Lisovy239281f2014-11-03 10:33:19 +01003610 int rate_idx;
3611 if (status->flag & RX_FLAG_HT)
3612 rate_idx = 0; /* TODO: HT rates */
3613 else
3614 rate_idx = status->rate_idx;
3615 ieee80211_ocb_rx_no_sta(sdata, bssid, hdr->addr2,
3616 BIT(rate_idx));
3617 }
Johannes Berga58fbe12015-04-22 15:08:39 +02003618 return true;
Johannes Berg05c914f2008-09-11 00:01:58 +02003619 case NL80211_IFTYPE_MESH_POINT:
Johannes Berga58fbe12015-04-22 15:08:39 +02003620 if (multicast)
3621 return true;
3622 return ether_addr_equal(sdata->vif.addr, hdr->addr1);
Johannes Berg05c914f2008-09-11 00:01:58 +02003623 case NL80211_IFTYPE_AP_VLAN:
3624 case NL80211_IFTYPE_AP:
Johannes Berga58fbe12015-04-22 15:08:39 +02003625 if (!bssid)
3626 return ether_addr_equal(sdata->vif.addr, hdr->addr1);
3627
3628 if (!ieee80211_bssid_match(bssid, sdata->vif.addr)) {
Johannes Berg3df6eae2011-12-06 10:39:40 +01003629 /*
3630 * Accept public action frames even when the
3631 * BSSID doesn't match, this is used for P2P
3632 * and location updates. Note that mac80211
3633 * itself never looks at these frames.
3634 */
Johannes Berg2b9ccd42013-05-13 16:42:40 +02003635 if (!multicast &&
3636 !ether_addr_equal(sdata->vif.addr, hdr->addr1))
Johannes Berg3c2723f52014-01-07 16:23:24 +01003637 return false;
Johannes Bergd48b2962012-07-06 22:19:27 +02003638 if (ieee80211_is_public_action(hdr, skb->len))
Johannes Berg3c2723f52014-01-07 16:23:24 +01003639 return true;
Johannes Berg5c900672015-04-22 14:48:34 +02003640 return ieee80211_is_beacon(hdr->frame_control);
Johannes Berga58fbe12015-04-22 15:08:39 +02003641 }
3642
3643 if (!ieee80211_has_tods(hdr->frame_control)) {
Arik Nemtsovdb8e1732014-07-17 17:14:30 +03003644 /* ignore data frames to TDLS-peers */
3645 if (ieee80211_is_data(hdr->frame_control))
3646 return false;
3647 /* ignore action frames to TDLS-peers */
3648 if (ieee80211_is_action(hdr->frame_control) &&
Jouni Malinen1ec7bae2016-03-01 00:29:00 +02003649 !is_broadcast_ether_addr(bssid) &&
Arik Nemtsovdb8e1732014-07-17 17:14:30 +03003650 !ether_addr_equal(bssid, hdr->addr1))
3651 return false;
Johannes Berg23a24de2007-07-27 15:43:22 +02003652 }
Johannes Berge0411f12017-04-20 21:32:16 +02003653
3654 /*
3655 * 802.11-2016 Table 9-26 says that for data frames, A1 must be
3656 * the BSSID - we've checked that already but may have accepted
3657 * the wildcard (ff:ff:ff:ff:ff:ff).
3658 *
3659 * It also says:
3660 * The BSSID of the Data frame is determined as follows:
3661 * a) If the STA is contained within an AP or is associated
3662 * with an AP, the BSSID is the address currently in use
3663 * by the STA contained in the AP.
3664 *
3665 * So we should not accept data frames with an address that's
3666 * multicast.
3667 *
3668 * Accepting it also opens a security problem because stations
3669 * could encrypt it with the GTK and inject traffic that way.
3670 */
3671 if (ieee80211_is_data(hdr->frame_control) && multicast)
3672 return false;
3673
Johannes Berga58fbe12015-04-22 15:08:39 +02003674 return true;
Johannes Berg05c914f2008-09-11 00:01:58 +02003675 case NL80211_IFTYPE_WDS:
Harvey Harrisona7767f92008-07-02 16:30:51 -07003676 if (bssid || !ieee80211_is_data(hdr->frame_control))
Johannes Berg3c2723f52014-01-07 16:23:24 +01003677 return false;
Johannes Berga58fbe12015-04-22 15:08:39 +02003678 return ether_addr_equal(sdata->u.wds.remote_addr, hdr->addr2);
Johannes Bergf142c6b2012-06-18 20:07:15 +02003679 case NL80211_IFTYPE_P2P_DEVICE:
Johannes Berga58fbe12015-04-22 15:08:39 +02003680 return ieee80211_is_public_action(hdr, skb->len) ||
3681 ieee80211_is_probe_req(hdr->frame_control) ||
3682 ieee80211_is_probe_resp(hdr->frame_control) ||
3683 ieee80211_is_beacon(hdr->frame_control);
Ayala Bekercb3b7d82016-09-20 17:31:13 +03003684 case NL80211_IFTYPE_NAN:
3685 /* Currently no frames on NAN interface are allowed */
3686 return false;
Johannes Berg2ca27bc2010-09-16 14:58:23 +02003687 default:
Johannes Bergfb1c1cd2007-09-26 15:19:43 +02003688 break;
Johannes Berg23a24de2007-07-27 15:43:22 +02003689 }
3690
Johannes Berga58fbe12015-04-22 15:08:39 +02003691 WARN_ON_ONCE(1);
3692 return false;
Johannes Berg23a24de2007-07-27 15:43:22 +02003693}
3694
Johannes Berg49ddf8e2016-03-31 20:02:10 +03003695void ieee80211_check_fast_rx(struct sta_info *sta)
3696{
3697 struct ieee80211_sub_if_data *sdata = sta->sdata;
3698 struct ieee80211_local *local = sdata->local;
3699 struct ieee80211_key *key;
3700 struct ieee80211_fast_rx fastrx = {
3701 .dev = sdata->dev,
3702 .vif_type = sdata->vif.type,
3703 .control_port_protocol = sdata->control_port_protocol,
3704 }, *old, *new = NULL;
3705 bool assign = false;
3706
3707 /* use sparse to check that we don't return without updating */
3708 __acquire(check_fast_rx);
3709
3710 BUILD_BUG_ON(sizeof(fastrx.rfc1042_hdr) != sizeof(rfc1042_header));
3711 BUILD_BUG_ON(sizeof(fastrx.rfc1042_hdr) != ETH_ALEN);
3712 ether_addr_copy(fastrx.rfc1042_hdr, rfc1042_header);
3713 ether_addr_copy(fastrx.vif_addr, sdata->vif.addr);
3714
Johannes Bergc9c59622016-03-31 20:02:11 +03003715 fastrx.uses_rss = ieee80211_hw_check(&local->hw, USES_RSS);
3716
Johannes Berg49ddf8e2016-03-31 20:02:10 +03003717 /* fast-rx doesn't do reordering */
3718 if (ieee80211_hw_check(&local->hw, AMPDU_AGGREGATION) &&
3719 !ieee80211_hw_check(&local->hw, SUPPORTS_REORDERING_BUFFER))
3720 goto clear;
3721
3722 switch (sdata->vif.type) {
3723 case NL80211_IFTYPE_STATION:
3724 /* 4-addr is harder to deal with, later maybe */
3725 if (sdata->u.mgd.use_4addr)
3726 goto clear;
3727 /* software powersave is a huge mess, avoid all of it */
3728 if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK))
3729 goto clear;
3730 if (ieee80211_hw_check(&local->hw, SUPPORTS_PS) &&
3731 !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS))
3732 goto clear;
3733 if (sta->sta.tdls) {
3734 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr1);
3735 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr2);
3736 fastrx.expected_ds_bits = 0;
3737 } else {
3738 fastrx.sta_notify = sdata->u.mgd.probe_send_count > 0;
3739 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr1);
3740 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr3);
3741 fastrx.expected_ds_bits =
3742 cpu_to_le16(IEEE80211_FCTL_FROMDS);
3743 }
3744 break;
3745 case NL80211_IFTYPE_AP_VLAN:
3746 case NL80211_IFTYPE_AP:
3747 /* parallel-rx requires this, at least with calls to
3748 * ieee80211_sta_ps_transition()
3749 */
3750 if (!ieee80211_hw_check(&local->hw, AP_LINK_PS))
3751 goto clear;
3752 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3);
3753 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr2);
3754 fastrx.expected_ds_bits = cpu_to_le16(IEEE80211_FCTL_TODS);
3755
3756 fastrx.internal_forward =
3757 !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
3758 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN ||
3759 !sdata->u.vlan.sta);
3760 break;
3761 default:
3762 goto clear;
3763 }
3764
3765 if (!test_sta_flag(sta, WLAN_STA_AUTHORIZED))
3766 goto clear;
3767
3768 rcu_read_lock();
3769 key = rcu_dereference(sta->ptk[sta->ptk_idx]);
3770 if (key) {
3771 switch (key->conf.cipher) {
3772 case WLAN_CIPHER_SUITE_TKIP:
3773 /* we don't want to deal with MMIC in fast-rx */
3774 goto clear_rcu;
3775 case WLAN_CIPHER_SUITE_CCMP:
3776 case WLAN_CIPHER_SUITE_CCMP_256:
3777 case WLAN_CIPHER_SUITE_GCMP:
3778 case WLAN_CIPHER_SUITE_GCMP_256:
3779 break;
3780 default:
3781 /* we also don't want to deal with WEP or cipher scheme
3782 * since those require looking up the key idx in the
3783 * frame, rather than assuming the PTK is used
3784 * (we need to revisit this once we implement the real
3785 * PTK index, which is now valid in the spec, but we
3786 * haven't implemented that part yet)
3787 */
3788 goto clear_rcu;
3789 }
3790
3791 fastrx.key = true;
3792 fastrx.icv_len = key->conf.icv_len;
3793 }
3794
3795 assign = true;
3796 clear_rcu:
3797 rcu_read_unlock();
3798 clear:
3799 __release(check_fast_rx);
3800
3801 if (assign)
3802 new = kmemdup(&fastrx, sizeof(fastrx), GFP_KERNEL);
3803
3804 spin_lock_bh(&sta->lock);
3805 old = rcu_dereference_protected(sta->fast_rx, true);
3806 rcu_assign_pointer(sta->fast_rx, new);
3807 spin_unlock_bh(&sta->lock);
3808
3809 if (old)
3810 kfree_rcu(old, rcu_head);
3811}
3812
3813void ieee80211_clear_fast_rx(struct sta_info *sta)
3814{
3815 struct ieee80211_fast_rx *old;
3816
3817 spin_lock_bh(&sta->lock);
3818 old = rcu_dereference_protected(sta->fast_rx, true);
3819 RCU_INIT_POINTER(sta->fast_rx, NULL);
3820 spin_unlock_bh(&sta->lock);
3821
3822 if (old)
3823 kfree_rcu(old, rcu_head);
3824}
3825
3826void __ieee80211_check_fast_rx_iface(struct ieee80211_sub_if_data *sdata)
3827{
3828 struct ieee80211_local *local = sdata->local;
3829 struct sta_info *sta;
3830
3831 lockdep_assert_held(&local->sta_mtx);
3832
3833 list_for_each_entry_rcu(sta, &local->sta_list, list) {
3834 if (sdata != sta->sdata &&
3835 (!sta->sdata->bss || sta->sdata->bss != sdata->bss))
3836 continue;
3837 ieee80211_check_fast_rx(sta);
3838 }
3839}
3840
3841void ieee80211_check_fast_rx_iface(struct ieee80211_sub_if_data *sdata)
3842{
3843 struct ieee80211_local *local = sdata->local;
3844
3845 mutex_lock(&local->sta_mtx);
3846 __ieee80211_check_fast_rx_iface(sdata);
3847 mutex_unlock(&local->sta_mtx);
3848}
3849
3850static bool ieee80211_invoke_fast_rx(struct ieee80211_rx_data *rx,
3851 struct ieee80211_fast_rx *fast_rx)
3852{
3853 struct sk_buff *skb = rx->skb;
3854 struct ieee80211_hdr *hdr = (void *)skb->data;
3855 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
3856 struct sta_info *sta = rx->sta;
3857 int orig_len = skb->len;
3858 int snap_offs = ieee80211_hdrlen(hdr->frame_control);
3859 struct {
3860 u8 snap[sizeof(rfc1042_header)];
3861 __be16 proto;
3862 } *payload __aligned(2);
3863 struct {
3864 u8 da[ETH_ALEN];
3865 u8 sa[ETH_ALEN];
3866 } addrs __aligned(2);
Johannes Bergc9c59622016-03-31 20:02:11 +03003867 struct ieee80211_sta_rx_stats *stats = &sta->rx_stats;
3868
3869 if (fast_rx->uses_rss)
3870 stats = this_cpu_ptr(sta->pcpu_rx_stats);
Johannes Berg49ddf8e2016-03-31 20:02:10 +03003871
3872 /* for parallel-rx, we need to have DUP_VALIDATED, otherwise we write
3873 * to a common data structure; drivers can implement that per queue
3874 * but we don't have that information in mac80211
3875 */
3876 if (!(status->flag & RX_FLAG_DUP_VALIDATED))
3877 return false;
3878
3879#define FAST_RX_CRYPT_FLAGS (RX_FLAG_PN_VALIDATED | RX_FLAG_DECRYPTED)
3880
3881 /* If using encryption, we also need to have:
3882 * - PN_VALIDATED: similar, but the implementation is tricky
3883 * - DECRYPTED: necessary for PN_VALIDATED
3884 */
3885 if (fast_rx->key &&
3886 (status->flag & FAST_RX_CRYPT_FLAGS) != FAST_RX_CRYPT_FLAGS)
3887 return false;
3888
3889 /* we don't deal with A-MSDU deaggregation here */
3890 if (status->rx_flags & IEEE80211_RX_AMSDU)
3891 return false;
3892
3893 if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
3894 return false;
3895
3896 if (unlikely(ieee80211_is_frag(hdr)))
3897 return false;
3898
3899 /* Since our interface address cannot be multicast, this
3900 * implicitly also rejects multicast frames without the
3901 * explicit check.
3902 *
3903 * We shouldn't get any *data* frames not addressed to us
3904 * (AP mode will accept multicast *management* frames), but
3905 * punting here will make it go through the full checks in
3906 * ieee80211_accept_frame().
3907 */
3908 if (!ether_addr_equal(fast_rx->vif_addr, hdr->addr1))
3909 return false;
3910
3911 if ((hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_FROMDS |
3912 IEEE80211_FCTL_TODS)) !=
3913 fast_rx->expected_ds_bits)
3914 goto drop;
3915
3916 /* assign the key to drop unencrypted frames (later)
3917 * and strip the IV/MIC if necessary
3918 */
3919 if (fast_rx->key && !(status->flag & RX_FLAG_IV_STRIPPED)) {
3920 /* GCMP header length is the same */
3921 snap_offs += IEEE80211_CCMP_HDR_LEN;
3922 }
3923
3924 if (!pskb_may_pull(skb, snap_offs + sizeof(*payload)))
3925 goto drop;
3926 payload = (void *)(skb->data + snap_offs);
3927
3928 if (!ether_addr_equal(payload->snap, fast_rx->rfc1042_hdr))
3929 return false;
3930
3931 /* Don't handle these here since they require special code.
3932 * Accept AARP and IPX even though they should come with a
3933 * bridge-tunnel header - but if we get them this way then
3934 * there's little point in discarding them.
3935 */
3936 if (unlikely(payload->proto == cpu_to_be16(ETH_P_TDLS) ||
3937 payload->proto == fast_rx->control_port_protocol))
3938 return false;
3939
3940 /* after this point, don't punt to the slowpath! */
3941
3942 if (rx->key && !(status->flag & RX_FLAG_MIC_STRIPPED) &&
3943 pskb_trim(skb, skb->len - fast_rx->icv_len))
3944 goto drop;
3945
3946 if (unlikely(fast_rx->sta_notify)) {
3947 ieee80211_sta_rx_notify(rx->sdata, hdr);
3948 fast_rx->sta_notify = false;
3949 }
3950
3951 /* statistics part of ieee80211_rx_h_sta_process() */
Johannes Bergc9c59622016-03-31 20:02:11 +03003952 stats->last_rx = jiffies;
3953 stats->last_rate = sta_stats_encode_rate(status);
Johannes Berg49ddf8e2016-03-31 20:02:10 +03003954
Johannes Bergc9c59622016-03-31 20:02:11 +03003955 stats->fragments++;
Johannes Berg49ddf8e2016-03-31 20:02:10 +03003956
3957 if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
Johannes Bergc9c59622016-03-31 20:02:11 +03003958 stats->last_signal = status->signal;
3959 if (!fast_rx->uses_rss)
3960 ewma_signal_add(&sta->rx_stats_avg.signal,
3961 -status->signal);
Johannes Berg49ddf8e2016-03-31 20:02:10 +03003962 }
3963
3964 if (status->chains) {
3965 int i;
3966
Johannes Bergc9c59622016-03-31 20:02:11 +03003967 stats->chains = status->chains;
Johannes Berg49ddf8e2016-03-31 20:02:10 +03003968 for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {
3969 int signal = status->chain_signal[i];
3970
3971 if (!(status->chains & BIT(i)))
3972 continue;
3973
Johannes Bergc9c59622016-03-31 20:02:11 +03003974 stats->chain_signal_last[i] = signal;
3975 if (!fast_rx->uses_rss)
3976 ewma_signal_add(&sta->rx_stats_avg.chain_signal[i],
3977 -signal);
Johannes Berg49ddf8e2016-03-31 20:02:10 +03003978 }
3979 }
3980 /* end of statistics */
3981
3982 if (rx->key && !ieee80211_has_protected(hdr->frame_control))
3983 goto drop;
3984
3985 /* do the header conversion - first grab the addresses */
3986 ether_addr_copy(addrs.da, skb->data + fast_rx->da_offs);
3987 ether_addr_copy(addrs.sa, skb->data + fast_rx->sa_offs);
3988 /* remove the SNAP but leave the ethertype */
3989 skb_pull(skb, snap_offs + sizeof(rfc1042_header));
3990 /* push the addresses in front */
3991 memcpy(skb_push(skb, sizeof(addrs)), &addrs, sizeof(addrs));
3992
3993 skb->dev = fast_rx->dev;
3994
3995 ieee80211_rx_stats(fast_rx->dev, skb->len);
3996
3997 /* The seqno index has the same property as needed
3998 * for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS
3999 * for non-QoS-data frames. Here we know it's a data
4000 * frame, so count MSDUs.
4001 */
Johannes Bergc9c59622016-03-31 20:02:11 +03004002 u64_stats_update_begin(&stats->syncp);
4003 stats->msdu[rx->seqno_idx]++;
4004 stats->bytes += orig_len;
4005 u64_stats_update_end(&stats->syncp);
Johannes Berg49ddf8e2016-03-31 20:02:10 +03004006
4007 if (fast_rx->internal_forward) {
Johannes Bergbab10a52016-12-14 16:47:43 +01004008 struct sk_buff *xmit_skb = NULL;
4009 bool multicast = is_multicast_ether_addr(skb->data);
Johannes Berg49ddf8e2016-03-31 20:02:10 +03004010
Johannes Bergbab10a52016-12-14 16:47:43 +01004011 if (multicast) {
4012 xmit_skb = skb_copy(skb, GFP_ATOMIC);
4013 } else if (sta_info_get(rx->sdata, skb->data)) {
4014 xmit_skb = skb;
4015 skb = NULL;
4016 }
4017
4018 if (xmit_skb) {
Johannes Berg49ddf8e2016-03-31 20:02:10 +03004019 /*
4020 * Send to wireless media and increase priority by 256
4021 * to keep the received priority instead of
4022 * reclassifying the frame (see cfg80211_classify8021d).
4023 */
Johannes Bergbab10a52016-12-14 16:47:43 +01004024 xmit_skb->priority += 256;
4025 xmit_skb->protocol = htons(ETH_P_802_3);
4026 skb_reset_network_header(xmit_skb);
4027 skb_reset_mac_header(xmit_skb);
4028 dev_queue_xmit(xmit_skb);
Johannes Berg49ddf8e2016-03-31 20:02:10 +03004029 }
Johannes Bergbab10a52016-12-14 16:47:43 +01004030
4031 if (!skb)
4032 return true;
Johannes Berg49ddf8e2016-03-31 20:02:10 +03004033 }
4034
4035 /* deliver to local stack */
4036 skb->protocol = eth_type_trans(skb, fast_rx->dev);
4037 memset(skb->cb, 0, sizeof(skb->cb));
4038 if (rx->napi)
4039 napi_gro_receive(rx->napi, skb);
4040 else
4041 netif_receive_skb(skb);
4042
4043 return true;
4044 drop:
4045 dev_kfree_skb(skb);
Johannes Bergc9c59622016-03-31 20:02:11 +03004046 stats->dropped++;
Johannes Berg49ddf8e2016-03-31 20:02:10 +03004047 return true;
4048}
4049
Johannes Berg571ecf62007-07-27 15:43:22 +02004050/*
Johannes Berg4406c372010-09-24 11:21:06 +02004051 * This function returns whether or not the SKB
4052 * was destined for RX processing or not, which,
4053 * if consume is true, is equivalent to whether
4054 * or not the skb was consumed.
4055 */
4056static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,
4057 struct sk_buff *skb, bool consume)
4058{
4059 struct ieee80211_local *local = rx->local;
4060 struct ieee80211_sub_if_data *sdata = rx->sdata;
Johannes Berg4406c372010-09-24 11:21:06 +02004061
4062 rx->skb = skb;
Johannes Berg4406c372010-09-24 11:21:06 +02004063
Johannes Berg49ddf8e2016-03-31 20:02:10 +03004064 /* See if we can do fast-rx; if we have to copy we already lost,
4065 * so punt in that case. We should never have to deliver a data
4066 * frame to multiple interfaces anyway.
4067 *
4068 * We skip the ieee80211_accept_frame() call and do the necessary
4069 * checking inside ieee80211_invoke_fast_rx().
4070 */
4071 if (consume && rx->sta) {
4072 struct ieee80211_fast_rx *fast_rx;
4073
4074 fast_rx = rcu_dereference(rx->sta->fast_rx);
4075 if (fast_rx && ieee80211_invoke_fast_rx(rx, fast_rx))
4076 return true;
4077 }
4078
Johannes Berga58fbe12015-04-22 15:08:39 +02004079 if (!ieee80211_accept_frame(rx))
Johannes Berg4406c372010-09-24 11:21:06 +02004080 return false;
4081
Johannes Berg4406c372010-09-24 11:21:06 +02004082 if (!consume) {
4083 skb = skb_copy(skb, GFP_ATOMIC);
4084 if (!skb) {
4085 if (net_ratelimit())
4086 wiphy_debug(local->hw.wiphy,
Ben Greearb305dae2011-01-08 10:30:54 -08004087 "failed to copy skb for %s\n",
Johannes Berg4406c372010-09-24 11:21:06 +02004088 sdata->name);
4089 return true;
4090 }
4091
4092 rx->skb = skb;
4093 }
4094
4095 ieee80211_invoke_rx_handlers(rx);
4096 return true;
4097}
4098
4099/*
Zhao, Gang6b59db72014-04-21 12:52:59 +08004100 * This is the actual Rx frames handler. as it belongs to Rx path it must
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +02004101 * be called with rcu_read_lock protection.
Johannes Berg571ecf62007-07-27 15:43:22 +02004102 */
Ron Rindjunsky71ebb4a2008-01-21 12:39:12 +02004103static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
Johannes Bergd63b5482016-03-31 20:02:02 +03004104 struct ieee80211_sta *pubsta,
Johannes Bergaf9f9b22015-06-11 16:02:32 +02004105 struct sk_buff *skb,
4106 struct napi_struct *napi)
Johannes Berg571ecf62007-07-27 15:43:22 +02004107{
4108 struct ieee80211_local *local = hw_to_local(hw);
4109 struct ieee80211_sub_if_data *sdata;
Johannes Berg571ecf62007-07-27 15:43:22 +02004110 struct ieee80211_hdr *hdr;
Zhu Yie3cf8b32010-03-29 17:35:07 +08004111 __le16 fc;
Johannes Berg5cf121c2008-02-25 16:27:43 +01004112 struct ieee80211_rx_data rx;
Johannes Berg4406c372010-09-24 11:21:06 +02004113 struct ieee80211_sub_if_data *prev;
Herbert Xu83e7e4c2016-09-19 19:00:10 +08004114 struct rhlist_head *tmp;
Zhu Yie3cf8b32010-03-29 17:35:07 +08004115 int err = 0;
Johannes Berg571ecf62007-07-27 15:43:22 +02004116
Zhu Yie3cf8b32010-03-29 17:35:07 +08004117 fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
Johannes Berg571ecf62007-07-27 15:43:22 +02004118 memset(&rx, 0, sizeof(rx));
4119 rx.skb = skb;
4120 rx.local = local;
Johannes Bergaf9f9b22015-06-11 16:02:32 +02004121 rx.napi = napi;
Johannes Berg72abd812007-09-17 01:29:22 -04004122
Zhu Yie3cf8b32010-03-29 17:35:07 +08004123 if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc))
Johannes Bergc206ca62015-04-22 20:47:28 +02004124 I802_DEBUG_INC(local->dot11ReceivedFragmentCount);
Johannes Berg571ecf62007-07-27 15:43:22 +02004125
Johannes Berg4a4f1a52012-10-26 00:33:36 +02004126 if (ieee80211_is_mgmt(fc)) {
4127 /* drop frame if too short for header */
4128 if (skb->len < ieee80211_hdrlen(fc))
4129 err = -ENOBUFS;
4130 else
4131 err = skb_linearize(skb);
4132 } else {
Zhu Yie3cf8b32010-03-29 17:35:07 +08004133 err = !pskb_may_pull(skb, ieee80211_hdrlen(fc));
Johannes Berg4a4f1a52012-10-26 00:33:36 +02004134 }
Zhu Yie3cf8b32010-03-29 17:35:07 +08004135
4136 if (err) {
4137 dev_kfree_skb(skb);
4138 return;
4139 }
4140
4141 hdr = (struct ieee80211_hdr *)skb->data;
Johannes Berg38f37142008-01-29 17:07:43 +01004142 ieee80211_parse_qos(&rx);
Johannes Bergd1c3a372009-01-07 00:26:10 +01004143 ieee80211_verify_alignment(&rx);
Johannes Berg38f37142008-01-29 17:07:43 +01004144
Johannes Bergd48b2962012-07-06 22:19:27 +02004145 if (unlikely(ieee80211_is_probe_resp(hdr->frame_control) ||
4146 ieee80211_is_beacon(hdr->frame_control)))
4147 ieee80211_scan_rx(local, skb);
4148
Johannes Bergb507df22017-02-27 09:38:11 +01004149 if (ieee80211_is_data(fc)) {
Johannes Bergd63b5482016-03-31 20:02:02 +03004150 struct sta_info *sta, *prev_sta;
Johannes Berg7bedd0c2015-02-13 21:55:15 +01004151
Johannes Bergb507df22017-02-27 09:38:11 +01004152 if (pubsta) {
4153 rx.sta = container_of(pubsta, struct sta_info, sta);
4154 rx.sdata = rx.sta->sdata;
4155 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
4156 return;
4157 goto out;
4158 }
4159
Ben Greear56af3262010-09-23 10:22:24 -07004160 prev_sta = NULL;
Johannes Berg4406c372010-09-24 11:21:06 +02004161
Herbert Xu83e7e4c2016-09-19 19:00:10 +08004162 for_each_sta_info(local, hdr->addr2, sta, tmp) {
Ben Greear56af3262010-09-23 10:22:24 -07004163 if (!prev_sta) {
4164 prev_sta = sta;
4165 continue;
4166 }
4167
4168 rx.sta = prev_sta;
4169 rx.sdata = prev_sta->sdata;
Johannes Berg4406c372010-09-24 11:21:06 +02004170 ieee80211_prepare_and_rx_handle(&rx, skb, false);
Johannes Berg571ecf62007-07-27 15:43:22 +02004171
Ben Greear56af3262010-09-23 10:22:24 -07004172 prev_sta = sta;
Johannes Berg4406c372010-09-24 11:21:06 +02004173 }
Ben Greear56af3262010-09-23 10:22:24 -07004174
4175 if (prev_sta) {
4176 rx.sta = prev_sta;
4177 rx.sdata = prev_sta->sdata;
4178
Johannes Berg4406c372010-09-24 11:21:06 +02004179 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
Ben Greear56af3262010-09-23 10:22:24 -07004180 return;
Senthil Balasubramanian8e26d5a2010-11-30 20:15:38 +05304181 goto out;
Ben Greear56af3262010-09-23 10:22:24 -07004182 }
Johannes Berg4406c372010-09-24 11:21:06 +02004183 }
4184
Johannes Berg4b0dd982010-09-24 11:21:07 +02004185 prev = NULL;
Johannes Berg4406c372010-09-24 11:21:06 +02004186
Johannes Berg4b0dd982010-09-24 11:21:07 +02004187 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
4188 if (!ieee80211_sdata_running(sdata))
4189 continue;
Johannes Bergabe60632009-11-25 17:46:18 +01004190
Johannes Berg4b0dd982010-09-24 11:21:07 +02004191 if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
4192 sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
4193 continue;
Johannes Bergabe60632009-11-25 17:46:18 +01004194
Johannes Berg4b0dd982010-09-24 11:21:07 +02004195 /*
4196 * frame is destined for this interface, but if it's
4197 * not also for the previous one we handle that after
4198 * the loop to avoid copying the SKB once too much
4199 */
Johannes Bergb2e77712007-09-26 15:19:39 +02004200
Johannes Berg4b0dd982010-09-24 11:21:07 +02004201 if (!prev) {
Johannes Berg340e11f2007-07-27 15:43:22 +02004202 prev = sdata;
Johannes Berg4b0dd982010-09-24 11:21:07 +02004203 continue;
Johannes Berg8e6f00322007-07-27 15:43:22 +02004204 }
Felix Fietkau4bb29f82010-01-22 00:36:39 +01004205
Johannes Berg7852e362012-01-20 13:55:24 +01004206 rx.sta = sta_info_get_bss(prev, hdr->addr2);
Johannes Berg4b0dd982010-09-24 11:21:07 +02004207 rx.sdata = prev;
4208 ieee80211_prepare_and_rx_handle(&rx, skb, false);
Felix Fietkau4bb29f82010-01-22 00:36:39 +01004209
Johannes Berg4b0dd982010-09-24 11:21:07 +02004210 prev = sdata;
4211 }
Johannes Berg4406c372010-09-24 11:21:06 +02004212
Johannes Berg4b0dd982010-09-24 11:21:07 +02004213 if (prev) {
Johannes Berg7852e362012-01-20 13:55:24 +01004214 rx.sta = sta_info_get_bss(prev, hdr->addr2);
Johannes Berg4b0dd982010-09-24 11:21:07 +02004215 rx.sdata = prev;
4216
4217 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
4218 return;
Johannes Berg571ecf62007-07-27 15:43:22 +02004219 }
Johannes Berg4406c372010-09-24 11:21:06 +02004220
Senthil Balasubramanian8e26d5a2010-11-30 20:15:38 +05304221 out:
Johannes Berg4406c372010-09-24 11:21:06 +02004222 dev_kfree_skb(skb);
Johannes Berg571ecf62007-07-27 15:43:22 +02004223}
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +02004224
4225/*
4226 * This is the receive path handler. It is called by a low level driver when an
4227 * 802.11 MPDU is received from the hardware.
4228 */
Johannes Bergd63b5482016-03-31 20:02:02 +03004229void ieee80211_rx_napi(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta,
4230 struct sk_buff *skb, struct napi_struct *napi)
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +02004231{
4232 struct ieee80211_local *local = hw_to_local(hw);
Johannes Berg8318d782008-01-24 19:38:38 +01004233 struct ieee80211_rate *rate = NULL;
4234 struct ieee80211_supported_band *sband;
Johannes Bergf1d58c22009-06-17 13:13:00 +02004235 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
Johannes Berg8318d782008-01-24 19:38:38 +01004236
Johannes Bergd20ef632009-10-11 15:10:40 +02004237 WARN_ON_ONCE(softirq_count() == 0);
4238
Johannes Berg57fbcce2016-04-12 15:56:15 +02004239 if (WARN_ON(status->band >= NUM_NL80211_BANDS))
Johannes Berg77a980d2009-08-24 11:46:30 +02004240 goto drop;
Johannes Berg8318d782008-01-24 19:38:38 +01004241
4242 sband = local->hw.wiphy->bands[status->band];
Johannes Berg77a980d2009-08-24 11:46:30 +02004243 if (WARN_ON(!sband))
4244 goto drop;
Johannes Berg8318d782008-01-24 19:38:38 +01004245
Johannes Berg89c3a8a2009-07-28 18:10:17 +02004246 /*
4247 * If we're suspending, it is possible although not too likely
4248 * that we'd be receiving frames after having already partially
4249 * quiesced the stack. We can't process such frames then since
4250 * that might, for example, cause stations to be added or other
4251 * driver callbacks be invoked.
4252 */
Johannes Berg77a980d2009-08-24 11:46:30 +02004253 if (unlikely(local->quiescing || local->suspended))
4254 goto drop;
Johannes Berg89c3a8a2009-07-28 18:10:17 +02004255
Arik Nemtsov04800ad2012-06-06 11:25:02 +03004256 /* We might be during a HW reconfig, prevent Rx for the same reason */
4257 if (unlikely(local->in_reconfig))
4258 goto drop;
4259
Johannes Bergea77f122009-08-21 14:44:45 +02004260 /*
4261 * The same happens when we're not even started,
4262 * but that's worth a warning.
4263 */
Johannes Berg77a980d2009-08-24 11:46:30 +02004264 if (WARN_ON(!local->started))
4265 goto drop;
Johannes Bergea77f122009-08-21 14:44:45 +02004266
Johannes Bergfc885182010-07-30 13:23:12 +02004267 if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC))) {
Luis R. Rodrigueze5d6eb82009-11-09 16:03:22 -05004268 /*
Johannes Bergfc885182010-07-30 13:23:12 +02004269 * Validate the rate, unless a PLCP error means that
4270 * we probably can't have a valid rate here anyway.
Luis R. Rodrigueze5d6eb82009-11-09 16:03:22 -05004271 */
Johannes Bergfc885182010-07-30 13:23:12 +02004272
4273 if (status->flag & RX_FLAG_HT) {
4274 /*
4275 * rate_idx is MCS index, which can be [0-76]
4276 * as documented on:
4277 *
4278 * http://wireless.kernel.org/en/developers/Documentation/ieee80211/802.11n
4279 *
4280 * Anything else would be some sort of driver or
4281 * hardware error. The driver should catch hardware
4282 * errors.
4283 */
Johannes Berg444e38032012-09-30 17:08:35 +02004284 if (WARN(status->rate_idx > 76,
Johannes Bergfc885182010-07-30 13:23:12 +02004285 "Rate marked as an HT rate but passed "
4286 "status->rate_idx is not "
4287 "an MCS index [0-76]: %d (0x%02x)\n",
4288 status->rate_idx,
4289 status->rate_idx))
4290 goto drop;
Johannes Berg56146182012-11-09 15:07:02 +01004291 } else if (status->flag & RX_FLAG_VHT) {
4292 if (WARN_ONCE(status->rate_idx > 9 ||
4293 !status->vht_nss ||
4294 status->vht_nss > 8,
4295 "Rate marked as a VHT rate but data is invalid: MCS: %d, NSS: %d\n",
4296 status->rate_idx, status->vht_nss))
4297 goto drop;
Johannes Bergfc885182010-07-30 13:23:12 +02004298 } else {
Johannes Berg444e38032012-09-30 17:08:35 +02004299 if (WARN_ON(status->rate_idx >= sband->n_bitrates))
Johannes Bergfc885182010-07-30 13:23:12 +02004300 goto drop;
4301 rate = &sband->bitrates[status->rate_idx];
4302 }
Jouni Malinen0fb8ca42008-12-12 14:38:33 +02004303 }
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +02004304
Johannes Berg554891e2010-09-24 12:38:25 +02004305 status->rx_flags = 0;
4306
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +02004307 /*
4308 * key references and virtual interfaces are protected using RCU
4309 * and this requires that we are in a read-side RCU section during
4310 * receive processing
4311 */
4312 rcu_read_lock();
4313
4314 /*
4315 * Frames with failed FCS/PLCP checksum are not returned,
4316 * all other frames are returned without radiotap header
4317 * if it was previously present.
4318 * Also, frames with less than 16 bytes are dropped.
4319 */
Johannes Bergf1d58c22009-06-17 13:13:00 +02004320 skb = ieee80211_rx_monitor(local, skb, rate);
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +02004321 if (!skb) {
4322 rcu_read_unlock();
4323 return;
4324 }
4325
Johannes Berge1e54062010-11-30 08:58:45 +01004326 ieee80211_tpt_led_trig_rx(local,
4327 ((struct ieee80211_hdr *)skb->data)->frame_control,
4328 skb->len);
Johannes Bergd63b5482016-03-31 20:02:02 +03004329
4330 __ieee80211_rx_handle_packet(hw, pubsta, skb, napi);
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +02004331
4332 rcu_read_unlock();
Johannes Berg77a980d2009-08-24 11:46:30 +02004333
4334 return;
4335 drop:
4336 kfree_skb(skb);
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +02004337}
Johannes Bergaf9f9b22015-06-11 16:02:32 +02004338EXPORT_SYMBOL(ieee80211_rx_napi);
Johannes Berg571ecf62007-07-27 15:43:22 +02004339
4340/* This is a version of the rx handler that can be called from hard irq
4341 * context. Post the skb on the queue and schedule the tasklet */
Johannes Bergf1d58c22009-06-17 13:13:00 +02004342void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb)
Johannes Berg571ecf62007-07-27 15:43:22 +02004343{
4344 struct ieee80211_local *local = hw_to_local(hw);
4345
4346 BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));
4347
Johannes Berg571ecf62007-07-27 15:43:22 +02004348 skb->pkt_type = IEEE80211_RX_MSG;
4349 skb_queue_tail(&local->skb_queue, skb);
4350 tasklet_schedule(&local->tasklet);
4351}
4352EXPORT_SYMBOL(ieee80211_rx_irqsafe);