blob: 474655a2aeae05cc98ba4c643253088ca9deb216 [file] [log] [blame]
Johannes Berg571ecf62007-07-27 15:43:22 +02001/*
2 * Copyright 2002-2005, Instant802 Networks, Inc.
3 * Copyright 2005-2006, Devicescape Software, Inc.
4 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
Johannes Berg84040802010-02-15 12:46:39 +02005 * Copyright 2007-2010 Johannes Berg <johannes@sipsolutions.net>
Johannes Bergd98ad832014-09-03 15:24:57 +03006 * Copyright 2013-2014 Intel Mobile Communications GmbH
Sara Sharon42e7f372017-02-06 15:28:42 +02007 * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
Johannes Berg571ecf62007-07-27 15:43:22 +02008 *
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License version 2 as
11 * published by the Free Software Foundation.
12 */
13
S.Çağlar Onurab466232008-02-14 17:36:47 +020014#include <linux/jiffies.h>
Tejun Heo5a0e3ad2010-03-24 17:04:11 +090015#include <linux/slab.h>
Johannes Berg571ecf62007-07-27 15:43:22 +020016#include <linux/kernel.h>
17#include <linux/skbuff.h>
18#include <linux/netdevice.h>
19#include <linux/etherdevice.h>
Johannes Bergd4e46a32007-09-14 11:10:24 -040020#include <linux/rcupdate.h>
Paul Gortmakerbc3b2d72011-07-15 11:47:34 -040021#include <linux/export.h>
Sara Sharon06470f72016-01-28 16:19:25 +020022#include <linux/bitops.h>
Johannes Berg571ecf62007-07-27 15:43:22 +020023#include <net/mac80211.h>
24#include <net/ieee80211_radiotap.h>
Johannes Bergd26ad372012-02-20 11:38:41 +010025#include <asm/unaligned.h>
Johannes Berg571ecf62007-07-27 15:43:22 +020026
27#include "ieee80211_i.h"
Johannes Berg24487982009-04-23 18:52:52 +020028#include "driver-ops.h"
Johannes Berg2c8dccc2008-04-08 15:14:40 -040029#include "led.h"
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +010030#include "mesh.h"
Johannes Berg571ecf62007-07-27 15:43:22 +020031#include "wep.h"
32#include "wpa.h"
33#include "tkip.h"
34#include "wme.h"
Johannes Berg1d8d3de2011-12-16 15:28:57 +010035#include "rate.h"
Johannes Berg571ecf62007-07-27 15:43:22 +020036
Johannes Berg5a490512015-04-22 17:10:38 +020037static inline void ieee80211_rx_stats(struct net_device *dev, u32 len)
38{
39 struct pcpu_sw_netstats *tstats = this_cpu_ptr(dev->tstats);
40
41 u64_stats_update_begin(&tstats->syncp);
42 tstats->rx_packets++;
43 tstats->rx_bytes += len;
44 u64_stats_update_end(&tstats->syncp);
45}
46
Johannes Berga6828492015-06-16 15:17:15 +020047static u8 *ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len,
48 enum nl80211_iftype type)
49{
50 __le16 fc = hdr->frame_control;
51
52 if (ieee80211_is_data(fc)) {
53 if (len < 24) /* drop incorrect hdr len (data) */
54 return NULL;
55
56 if (ieee80211_has_a4(fc))
57 return NULL;
58 if (ieee80211_has_tods(fc))
59 return hdr->addr1;
60 if (ieee80211_has_fromds(fc))
61 return hdr->addr2;
62
63 return hdr->addr3;
64 }
65
66 if (ieee80211_is_mgmt(fc)) {
67 if (len < 24) /* drop incorrect hdr len (mgmt) */
68 return NULL;
69 return hdr->addr3;
70 }
71
72 if (ieee80211_is_ctl(fc)) {
73 if (ieee80211_is_pspoll(fc))
74 return hdr->addr1;
75
76 if (ieee80211_is_back_req(fc)) {
77 switch (type) {
78 case NL80211_IFTYPE_STATION:
79 return hdr->addr2;
80 case NL80211_IFTYPE_AP:
81 case NL80211_IFTYPE_AP_VLAN:
82 return hdr->addr1;
83 default:
84 break; /* fall through to the return */
85 }
86 }
87 }
88
89 return NULL;
90}
91
Johannes Bergb2e77712007-09-26 15:19:39 +020092/*
93 * monitor mode reception
94 *
95 * This function cleans up the SKB, i.e. it removes all the stuff
96 * only useful for monitoring.
97 */
98static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
Johannes Berg1f7bba72014-11-06 22:56:36 +010099 struct sk_buff *skb,
100 unsigned int rtap_vendor_space)
Johannes Bergb2e77712007-09-26 15:19:39 +0200101{
Johannes Berg30686bf2015-06-02 21:39:54 +0200102 if (ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)) {
Johannes Bergb2e77712007-09-26 15:19:39 +0200103 if (likely(skb->len > FCS_LEN))
Zhu Yie3cf8b32010-03-29 17:35:07 +0800104 __pskb_trim(skb, skb->len - FCS_LEN);
Johannes Bergb2e77712007-09-26 15:19:39 +0200105 else {
106 /* driver bug */
107 WARN_ON(1);
108 dev_kfree_skb(skb);
Dan Carpenter06247602012-11-27 20:31:19 +0300109 return NULL;
Johannes Bergb2e77712007-09-26 15:19:39 +0200110 }
111 }
112
Johannes Berg1f7bba72014-11-06 22:56:36 +0100113 __pskb_pull(skb, rtap_vendor_space);
114
Johannes Bergb2e77712007-09-26 15:19:39 +0200115 return skb;
116}
117
Johannes Berg1f7bba72014-11-06 22:56:36 +0100118static inline bool should_drop_frame(struct sk_buff *skb, int present_fcs_len,
119 unsigned int rtap_vendor_space)
Johannes Bergb2e77712007-09-26 15:19:39 +0200120{
Johannes Bergf1d58c22009-06-17 13:13:00 +0200121 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
Johannes Berg1f7bba72014-11-06 22:56:36 +0100122 struct ieee80211_hdr *hdr;
123
124 hdr = (void *)(skb->data + rtap_vendor_space);
Johannes Bergb2e77712007-09-26 15:19:39 +0200125
Johannes Berg4c298672012-07-05 11:34:31 +0200126 if (status->flag & (RX_FLAG_FAILED_FCS_CRC |
Grzegorz Bajorski17883042015-12-11 14:39:46 +0100127 RX_FLAG_FAILED_PLCP_CRC |
128 RX_FLAG_ONLY_MONITOR))
Zhao, Gang6b59db72014-04-21 12:52:59 +0800129 return true;
130
Johannes Berg1f7bba72014-11-06 22:56:36 +0100131 if (unlikely(skb->len < 16 + present_fcs_len + rtap_vendor_space))
Zhao, Gang6b59db72014-04-21 12:52:59 +0800132 return true;
133
Harvey Harrison87228f52008-06-11 14:21:59 -0700134 if (ieee80211_is_ctl(hdr->frame_control) &&
135 !ieee80211_is_pspoll(hdr->frame_control) &&
136 !ieee80211_is_back_req(hdr->frame_control))
Zhao, Gang6b59db72014-04-21 12:52:59 +0800137 return true;
138
139 return false;
Johannes Bergb2e77712007-09-26 15:19:39 +0200140}
141
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200142static int
Johannes Berg1f7bba72014-11-06 22:56:36 +0100143ieee80211_rx_radiotap_hdrlen(struct ieee80211_local *local,
144 struct ieee80211_rx_status *status,
145 struct sk_buff *skb)
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200146{
147 int len;
148
149 /* always present fields */
Johannes Berga144f372013-07-03 13:34:02 +0200150 len = sizeof(struct ieee80211_radiotap_header) + 8;
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200151
Johannes Berga144f372013-07-03 13:34:02 +0200152 /* allocate extra bitmaps */
Johannes Berga144f372013-07-03 13:34:02 +0200153 if (status->chains)
154 len += 4 * hweight8(status->chains);
Johannes Berg90b9e4462012-11-16 10:09:08 +0100155
156 if (ieee80211_have_rx_timestamp(status)) {
157 len = ALIGN(len, 8);
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200158 len += 8;
Johannes Berg90b9e4462012-11-16 10:09:08 +0100159 }
Johannes Berg30686bf2015-06-02 21:39:54 +0200160 if (ieee80211_hw_check(&local->hw, SIGNAL_DBM))
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200161 len += 1;
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200162
Johannes Berga144f372013-07-03 13:34:02 +0200163 /* antenna field, if we don't have per-chain info */
164 if (!status->chains)
165 len += 1;
166
Johannes Berg90b9e4462012-11-16 10:09:08 +0100167 /* padding for RX_FLAGS if necessary */
168 len = ALIGN(len, 2);
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200169
Johannes Berg6d744ba2011-01-27 14:13:17 +0100170 if (status->flag & RX_FLAG_HT) /* HT info */
171 len += 3;
172
Johannes Berg4c298672012-07-05 11:34:31 +0200173 if (status->flag & RX_FLAG_AMPDU_DETAILS) {
Johannes Berg90b9e4462012-11-16 10:09:08 +0100174 len = ALIGN(len, 4);
Johannes Berg4c298672012-07-05 11:34:31 +0200175 len += 8;
176 }
177
Johannes Berg51648922012-11-22 23:00:18 +0100178 if (status->flag & RX_FLAG_VHT) {
179 len = ALIGN(len, 2);
180 len += 12;
181 }
182
Johannes Berg99ee7ca2016-08-29 23:25:17 +0300183 if (local->hw.radiotap_timestamp.units_pos >= 0) {
184 len = ALIGN(len, 8);
185 len += 12;
186 }
187
Johannes Berga144f372013-07-03 13:34:02 +0200188 if (status->chains) {
189 /* antenna and antenna signal fields */
190 len += 2 * hweight8(status->chains);
191 }
192
Johannes Berg1f7bba72014-11-06 22:56:36 +0100193 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
194 struct ieee80211_vendor_radiotap *rtap = (void *)skb->data;
195
196 /* vendor presence bitmap */
197 len += 4;
198 /* alignment for fixed 6-byte vendor data header */
199 len = ALIGN(len, 2);
200 /* vendor data header */
201 len += 6;
202 if (WARN_ON(rtap->align == 0))
203 rtap->align = 1;
204 len = ALIGN(len, rtap->align);
205 len += rtap->len + rtap->pad;
206 }
207
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200208 return len;
209}
210
Johannes Berg87cfeaa2017-04-13 14:23:49 +0200211static void ieee80211_handle_mu_mimo_mon(struct ieee80211_sub_if_data *sdata,
212 struct sk_buff *skb,
213 int rtap_vendor_space)
214{
215 struct {
216 struct ieee80211_hdr_3addr hdr;
217 u8 category;
218 u8 action_code;
219 } __packed action;
220
221 if (!sdata)
222 return;
223
224 BUILD_BUG_ON(sizeof(action) != IEEE80211_MIN_ACTION_SIZE + 1);
225
226 if (skb->len < rtap_vendor_space + sizeof(action) +
227 VHT_MUMIMO_GROUPS_DATA_LEN)
228 return;
229
230 if (!is_valid_ether_addr(sdata->u.mntr.mu_follow_addr))
231 return;
232
233 skb_copy_bits(skb, rtap_vendor_space, &action, sizeof(action));
234
235 if (!ieee80211_is_action(action.hdr.frame_control))
236 return;
237
238 if (action.category != WLAN_CATEGORY_VHT)
239 return;
240
241 if (action.action_code != WLAN_VHT_ACTION_GROUPID_MGMT)
242 return;
243
244 if (!ether_addr_equal(action.hdr.addr1, sdata->u.mntr.mu_follow_addr))
245 return;
246
247 skb = skb_copy(skb, GFP_ATOMIC);
248 if (!skb)
249 return;
250
251 skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
252 skb_queue_tail(&sdata->skb_queue, skb);
253 ieee80211_queue_work(&sdata->local->hw, &sdata->work);
254}
255
Johannes Berg00ea6de2012-09-05 15:54:51 +0200256/*
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200257 * ieee80211_add_rx_radiotap_header - add radiotap header
258 *
259 * add a radiotap header containing all the fields which the hardware provided.
260 */
261static void
262ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
263 struct sk_buff *skb,
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200264 struct ieee80211_rate *rate,
Felix Fietkau973ef212012-04-16 14:56:48 +0200265 int rtap_len, bool has_fcs)
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200266{
Johannes Bergf1d58c22009-06-17 13:13:00 +0200267 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200268 struct ieee80211_radiotap_header *rthdr;
269 unsigned char *pos;
Johannes Berga144f372013-07-03 13:34:02 +0200270 __le32 *it_present;
271 u32 it_present_val;
Johannes Berg6a86b9c2009-10-28 09:58:52 +0100272 u16 rx_flags = 0;
Simon Wunderlicha5e70692013-07-08 16:55:52 +0200273 u16 channel_flags = 0;
Johannes Berga144f372013-07-03 13:34:02 +0200274 int mpdulen, chain;
275 unsigned long chains = status->chains;
Johannes Berg1f7bba72014-11-06 22:56:36 +0100276 struct ieee80211_vendor_radiotap rtap = {};
277
278 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
279 rtap = *(struct ieee80211_vendor_radiotap *)skb->data;
280 /* rtap.len and rtap.pad are undone immediately */
281 skb_pull(skb, sizeof(rtap) + rtap.len + rtap.pad);
282 }
Thomas Pedersenf4bda332012-11-13 10:46:27 -0800283
284 mpdulen = skb->len;
Johannes Berg30686bf2015-06-02 21:39:54 +0200285 if (!(has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)))
Thomas Pedersenf4bda332012-11-13 10:46:27 -0800286 mpdulen += FCS_LEN;
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200287
288 rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len);
Johannes Berg1f7bba72014-11-06 22:56:36 +0100289 memset(rthdr, 0, rtap_len - rtap.len - rtap.pad);
Johannes Berga144f372013-07-03 13:34:02 +0200290 it_present = &rthdr->it_present;
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200291
292 /* radiotap header, set always present flags */
Emmanuel Grumbach0059b2b2014-02-05 16:36:01 +0200293 rthdr->it_len = cpu_to_le16(rtap_len);
Johannes Berga144f372013-07-03 13:34:02 +0200294 it_present_val = BIT(IEEE80211_RADIOTAP_FLAGS) |
295 BIT(IEEE80211_RADIOTAP_CHANNEL) |
296 BIT(IEEE80211_RADIOTAP_RX_FLAGS);
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200297
Johannes Berga144f372013-07-03 13:34:02 +0200298 if (!status->chains)
299 it_present_val |= BIT(IEEE80211_RADIOTAP_ANTENNA);
300
301 for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
302 it_present_val |=
303 BIT(IEEE80211_RADIOTAP_EXT) |
304 BIT(IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE);
305 put_unaligned_le32(it_present_val, it_present);
306 it_present++;
307 it_present_val = BIT(IEEE80211_RADIOTAP_ANTENNA) |
308 BIT(IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
309 }
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200310
Johannes Berg1f7bba72014-11-06 22:56:36 +0100311 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
312 it_present_val |= BIT(IEEE80211_RADIOTAP_VENDOR_NAMESPACE) |
313 BIT(IEEE80211_RADIOTAP_EXT);
314 put_unaligned_le32(it_present_val, it_present);
315 it_present++;
316 it_present_val = rtap.present;
317 }
318
Johannes Berga144f372013-07-03 13:34:02 +0200319 put_unaligned_le32(it_present_val, it_present);
320
321 pos = (void *)(it_present + 1);
322
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200323 /* the order of the following fields is important */
324
325 /* IEEE80211_RADIOTAP_TSFT */
Thomas Pedersenf4bda332012-11-13 10:46:27 -0800326 if (ieee80211_have_rx_timestamp(status)) {
Johannes Berg90b9e4462012-11-16 10:09:08 +0100327 /* padding */
328 while ((pos - (u8 *)rthdr) & 7)
329 *pos++ = 0;
Thomas Pedersenf4bda332012-11-13 10:46:27 -0800330 put_unaligned_le64(
331 ieee80211_calculate_rx_timestamp(local, status,
332 mpdulen, 0),
333 pos);
Johannes Berg1df332e2012-10-26 00:09:11 +0200334 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200335 pos += 8;
336 }
337
338 /* IEEE80211_RADIOTAP_FLAGS */
Johannes Berg30686bf2015-06-02 21:39:54 +0200339 if (has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS))
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200340 *pos |= IEEE80211_RADIOTAP_F_FCS;
Johannes Bergaae89832009-03-13 12:52:10 +0100341 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
342 *pos |= IEEE80211_RADIOTAP_F_BADFCS;
Bruno Randolfb4f28bb2008-07-30 17:19:55 +0200343 if (status->flag & RX_FLAG_SHORTPRE)
344 *pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200345 pos++;
346
347 /* IEEE80211_RADIOTAP_RATE */
Johannes Berg56146182012-11-09 15:07:02 +0100348 if (!rate || status->flag & (RX_FLAG_HT | RX_FLAG_VHT)) {
Jouni Malinen0fb8ca42008-12-12 14:38:33 +0200349 /*
Johannes Bergf8d1ccf2011-11-08 12:28:33 +0100350 * Without rate information don't add it. If we have,
Mohammed Shafi Shajakhan38f37be2011-02-07 10:10:04 +0530351 * MCS information is a separate field in radiotap,
Johannes Berg73b48092011-04-18 17:05:21 +0200352 * added below. The byte here is needed as padding
353 * for the channel though, so initialise it to 0.
Jouni Malinen0fb8ca42008-12-12 14:38:33 +0200354 */
355 *pos = 0;
Jouni Malinen8d6f6582008-12-15 10:37:50 +0200356 } else {
Simon Wunderlich2103dec2013-07-08 16:55:53 +0200357 int shift = 0;
Jouni Malinenebe6c7b2009-01-10 11:47:33 +0200358 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
Simon Wunderlich2103dec2013-07-08 16:55:53 +0200359 if (status->flag & RX_FLAG_10MHZ)
360 shift = 1;
361 else if (status->flag & RX_FLAG_5MHZ)
362 shift = 2;
363 *pos = DIV_ROUND_UP(rate->bitrate, 5 * (1 << shift));
Jouni Malinen8d6f6582008-12-15 10:37:50 +0200364 }
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200365 pos++;
366
367 /* IEEE80211_RADIOTAP_CHANNEL */
Johannes Berg6a86b9c2009-10-28 09:58:52 +0100368 put_unaligned_le16(status->freq, pos);
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200369 pos += 2;
Simon Wunderlicha5e70692013-07-08 16:55:52 +0200370 if (status->flag & RX_FLAG_10MHZ)
371 channel_flags |= IEEE80211_CHAN_HALF;
372 else if (status->flag & RX_FLAG_5MHZ)
373 channel_flags |= IEEE80211_CHAN_QUARTER;
374
Johannes Berg57fbcce2016-04-12 15:56:15 +0200375 if (status->band == NL80211_BAND_5GHZ)
Simon Wunderlicha5e70692013-07-08 16:55:52 +0200376 channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ;
Johannes Berg56146182012-11-09 15:07:02 +0100377 else if (status->flag & (RX_FLAG_HT | RX_FLAG_VHT))
Simon Wunderlicha5e70692013-07-08 16:55:52 +0200378 channel_flags |= IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
Johannes Bergf8d1ccf2011-11-08 12:28:33 +0100379 else if (rate && rate->flags & IEEE80211_RATE_ERP_G)
Simon Wunderlicha5e70692013-07-08 16:55:52 +0200380 channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ;
Johannes Bergf8d1ccf2011-11-08 12:28:33 +0100381 else if (rate)
Mathy Vanhoef3a5c5e82015-01-20 15:05:08 +0100382 channel_flags |= IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ;
Johannes Bergf8d1ccf2011-11-08 12:28:33 +0100383 else
Simon Wunderlicha5e70692013-07-08 16:55:52 +0200384 channel_flags |= IEEE80211_CHAN_2GHZ;
385 put_unaligned_le16(channel_flags, pos);
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200386 pos += 2;
387
388 /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
Johannes Berg30686bf2015-06-02 21:39:54 +0200389 if (ieee80211_hw_check(&local->hw, SIGNAL_DBM) &&
Felix Fietkaufe8431f2012-03-01 18:00:07 +0100390 !(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200391 *pos = status->signal;
392 rthdr->it_present |=
393 cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
394 pos++;
395 }
396
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200397 /* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */
398
Johannes Berga144f372013-07-03 13:34:02 +0200399 if (!status->chains) {
400 /* IEEE80211_RADIOTAP_ANTENNA */
401 *pos = status->antenna;
402 pos++;
403 }
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200404
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200405 /* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */
406
407 /* IEEE80211_RADIOTAP_RX_FLAGS */
408 /* ensure 2 byte alignment for the 2 byte field as required */
Johannes Berg6a86b9c2009-10-28 09:58:52 +0100409 if ((pos - (u8 *)rthdr) & 1)
Johannes Berg90b9e4462012-11-16 10:09:08 +0100410 *pos++ = 0;
Johannes Bergaae89832009-03-13 12:52:10 +0100411 if (status->flag & RX_FLAG_FAILED_PLCP_CRC)
Johannes Berg6a86b9c2009-10-28 09:58:52 +0100412 rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP;
413 put_unaligned_le16(rx_flags, pos);
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200414 pos += 2;
Johannes Berg6d744ba2011-01-27 14:13:17 +0100415
416 if (status->flag & RX_FLAG_HT) {
Oleksij Rempel786677d2013-05-24 12:05:45 +0200417 unsigned int stbc;
418
Johannes Berg6d744ba2011-01-27 14:13:17 +0100419 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_MCS);
Johannes Bergac55d2f2012-05-10 09:09:10 +0200420 *pos++ = local->hw.radiotap_mcs_details;
Johannes Berg6d744ba2011-01-27 14:13:17 +0100421 *pos = 0;
422 if (status->flag & RX_FLAG_SHORT_GI)
423 *pos |= IEEE80211_RADIOTAP_MCS_SGI;
424 if (status->flag & RX_FLAG_40MHZ)
425 *pos |= IEEE80211_RADIOTAP_MCS_BW_40;
Johannes Bergac55d2f2012-05-10 09:09:10 +0200426 if (status->flag & RX_FLAG_HT_GF)
427 *pos |= IEEE80211_RADIOTAP_MCS_FMT_GF;
Emmanuel Grumbach63c361f2014-02-05 12:48:53 +0200428 if (status->flag & RX_FLAG_LDPC)
429 *pos |= IEEE80211_RADIOTAP_MCS_FEC_LDPC;
Oleksij Rempel786677d2013-05-24 12:05:45 +0200430 stbc = (status->flag & RX_FLAG_STBC_MASK) >> RX_FLAG_STBC_SHIFT;
431 *pos |= stbc << IEEE80211_RADIOTAP_MCS_STBC_SHIFT;
Johannes Berg6d744ba2011-01-27 14:13:17 +0100432 pos++;
433 *pos++ = status->rate_idx;
434 }
Johannes Berg4c298672012-07-05 11:34:31 +0200435
436 if (status->flag & RX_FLAG_AMPDU_DETAILS) {
437 u16 flags = 0;
438
439 /* ensure 4 byte alignment */
440 while ((pos - (u8 *)rthdr) & 3)
441 pos++;
442 rthdr->it_present |=
443 cpu_to_le32(1 << IEEE80211_RADIOTAP_AMPDU_STATUS);
444 put_unaligned_le32(status->ampdu_reference, pos);
445 pos += 4;
Johannes Berg4c298672012-07-05 11:34:31 +0200446 if (status->flag & RX_FLAG_AMPDU_LAST_KNOWN)
447 flags |= IEEE80211_RADIOTAP_AMPDU_LAST_KNOWN;
448 if (status->flag & RX_FLAG_AMPDU_IS_LAST)
449 flags |= IEEE80211_RADIOTAP_AMPDU_IS_LAST;
450 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_ERROR)
451 flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_ERR;
452 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
453 flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_KNOWN;
454 put_unaligned_le16(flags, pos);
455 pos += 2;
456 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
457 *pos++ = status->ampdu_delimiter_crc;
458 else
459 *pos++ = 0;
460 *pos++ = 0;
461 }
Johannes Berg90b9e4462012-11-16 10:09:08 +0100462
Johannes Berg51648922012-11-22 23:00:18 +0100463 if (status->flag & RX_FLAG_VHT) {
464 u16 known = local->hw.radiotap_vht_details;
465
466 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_VHT);
Johannes Berg51648922012-11-22 23:00:18 +0100467 put_unaligned_le16(known, pos);
468 pos += 2;
469 /* flags */
470 if (status->flag & RX_FLAG_SHORT_GI)
471 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_SGI;
Emmanuel Grumbach63c361f2014-02-05 12:48:53 +0200472 /* in VHT, STBC is binary */
473 if (status->flag & RX_FLAG_STBC_MASK)
474 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_STBC;
Emmanuel Grumbachfb378c22014-03-04 10:35:25 +0200475 if (status->vht_flag & RX_VHT_FLAG_BF)
476 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_BEAMFORMED;
Johannes Berg51648922012-11-22 23:00:18 +0100477 pos++;
478 /* bandwidth */
Emmanuel Grumbach1b8d2422014-02-05 16:37:11 +0200479 if (status->vht_flag & RX_VHT_FLAG_80MHZ)
Johannes Berg51648922012-11-22 23:00:18 +0100480 *pos++ = 4;
Emmanuel Grumbach1b8d2422014-02-05 16:37:11 +0200481 else if (status->vht_flag & RX_VHT_FLAG_160MHZ)
Johannes Berg51648922012-11-22 23:00:18 +0100482 *pos++ = 11;
483 else if (status->flag & RX_FLAG_40MHZ)
484 *pos++ = 1;
485 else /* 20 MHz */
486 *pos++ = 0;
487 /* MCS/NSS */
488 *pos = (status->rate_idx << 4) | status->vht_nss;
489 pos += 4;
490 /* coding field */
Emmanuel Grumbach63c361f2014-02-05 12:48:53 +0200491 if (status->flag & RX_FLAG_LDPC)
492 *pos |= IEEE80211_RADIOTAP_CODING_LDPC_USER0;
Johannes Berg51648922012-11-22 23:00:18 +0100493 pos++;
494 /* group ID */
495 pos++;
496 /* partial_aid */
497 pos += 2;
498 }
499
Johannes Berg99ee7ca2016-08-29 23:25:17 +0300500 if (local->hw.radiotap_timestamp.units_pos >= 0) {
501 u16 accuracy = 0;
502 u8 flags = IEEE80211_RADIOTAP_TIMESTAMP_FLAG_32BIT;
503
504 rthdr->it_present |=
505 cpu_to_le32(1 << IEEE80211_RADIOTAP_TIMESTAMP);
506
507 /* ensure 8 byte alignment */
508 while ((pos - (u8 *)rthdr) & 7)
509 pos++;
510
511 put_unaligned_le64(status->device_timestamp, pos);
512 pos += sizeof(u64);
513
514 if (local->hw.radiotap_timestamp.accuracy >= 0) {
515 accuracy = local->hw.radiotap_timestamp.accuracy;
516 flags |= IEEE80211_RADIOTAP_TIMESTAMP_FLAG_ACCURACY;
517 }
518 put_unaligned_le16(accuracy, pos);
519 pos += sizeof(u16);
520
521 *pos++ = local->hw.radiotap_timestamp.units_pos;
522 *pos++ = flags;
523 }
524
Johannes Berga144f372013-07-03 13:34:02 +0200525 for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
526 *pos++ = status->chain_signal[chain];
527 *pos++ = chain;
528 }
Johannes Berg1f7bba72014-11-06 22:56:36 +0100529
530 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
531 /* ensure 2 byte alignment for the vendor field as required */
532 if ((pos - (u8 *)rthdr) & 1)
533 *pos++ = 0;
534 *pos++ = rtap.oui[0];
535 *pos++ = rtap.oui[1];
536 *pos++ = rtap.oui[2];
537 *pos++ = rtap.subns;
538 put_unaligned_le16(rtap.len, pos);
539 pos += 2;
540 /* align the actual payload as requested */
541 while ((pos - (u8 *)rthdr) & (rtap.align - 1))
542 *pos++ = 0;
543 /* data (and possible padding) already follows */
544 }
Bruno Randolf601ae7f2008-05-08 19:22:43 +0200545}
546
Johannes Bergb2e77712007-09-26 15:19:39 +0200547/*
548 * This function copies a received frame to all monitor interfaces and
549 * returns a cleaned-up SKB that no longer includes the FCS nor the
550 * radiotap header the driver might have added.
551 */
552static struct sk_buff *
553ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
Johannes Berg8318d782008-01-24 19:38:38 +0100554 struct ieee80211_rate *rate)
Johannes Bergb2e77712007-09-26 15:19:39 +0200555{
Johannes Bergf1d58c22009-06-17 13:13:00 +0200556 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb);
Johannes Bergb2e77712007-09-26 15:19:39 +0200557 struct ieee80211_sub_if_data *sdata;
Johannes Berg1f7bba72014-11-06 22:56:36 +0100558 int rt_hdrlen, needed_headroom;
Johannes Bergb2e77712007-09-26 15:19:39 +0200559 struct sk_buff *skb, *skb2;
560 struct net_device *prev_dev = NULL;
561 int present_fcs_len = 0;
Johannes Berg1f7bba72014-11-06 22:56:36 +0100562 unsigned int rtap_vendor_space = 0;
Aviya Erenfeld42bd20d2016-08-29 23:25:16 +0300563 struct ieee80211_sub_if_data *monitor_sdata =
564 rcu_dereference(local->monitor_sdata);
Johannes Berg1f7bba72014-11-06 22:56:36 +0100565
566 if (unlikely(status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA)) {
567 struct ieee80211_vendor_radiotap *rtap = (void *)origskb->data;
568
569 rtap_vendor_space = sizeof(*rtap) + rtap->len + rtap->pad;
570 }
Johannes Bergb2e77712007-09-26 15:19:39 +0200571
572 /*
573 * First, we may need to make a copy of the skb because
574 * (1) we need to modify it for radiotap (if not present), and
575 * (2) the other RX handlers will modify the skb we got.
576 *
577 * We don't need to, of course, if we aren't going to return
578 * the SKB because it has a bad FCS/PLCP checksum.
579 */
Johannes Berg0869aea2009-10-28 10:03:35 +0100580
Johannes Berg30686bf2015-06-02 21:39:54 +0200581 if (ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS))
Johannes Bergb2e77712007-09-26 15:19:39 +0200582 present_fcs_len = FCS_LEN;
583
Johannes Berg1f7bba72014-11-06 22:56:36 +0100584 /* ensure hdr->frame_control and vendor radiotap data are in skb head */
585 if (!pskb_may_pull(origskb, 2 + rtap_vendor_space)) {
Zhu Yie3cf8b32010-03-29 17:35:07 +0800586 dev_kfree_skb(origskb);
587 return NULL;
588 }
589
Grzegorz Bajorski17883042015-12-11 14:39:46 +0100590 if (!local->monitors || (status->flag & RX_FLAG_SKIP_MONITOR)) {
Johannes Berg1f7bba72014-11-06 22:56:36 +0100591 if (should_drop_frame(origskb, present_fcs_len,
592 rtap_vendor_space)) {
Johannes Bergb2e77712007-09-26 15:19:39 +0200593 dev_kfree_skb(origskb);
594 return NULL;
595 }
596
Johannes Berg1f7bba72014-11-06 22:56:36 +0100597 return remove_monitor_info(local, origskb, rtap_vendor_space);
Johannes Bergb2e77712007-09-26 15:19:39 +0200598 }
599
Johannes Berg87cfeaa2017-04-13 14:23:49 +0200600 ieee80211_handle_mu_mimo_mon(monitor_sdata, origskb, rtap_vendor_space);
601
Helmut Schaa751413e2012-12-05 14:36:12 +0100602 /* room for the radiotap header based on driver features */
Johannes Berg1f7bba72014-11-06 22:56:36 +0100603 rt_hdrlen = ieee80211_rx_radiotap_hdrlen(local, status, origskb);
604 needed_headroom = rt_hdrlen - rtap_vendor_space;
Helmut Schaa751413e2012-12-05 14:36:12 +0100605
Johannes Berg1f7bba72014-11-06 22:56:36 +0100606 if (should_drop_frame(origskb, present_fcs_len, rtap_vendor_space)) {
Johannes Bergb2e77712007-09-26 15:19:39 +0200607 /* only need to expand headroom if necessary */
608 skb = origskb;
609 origskb = NULL;
610
611 /*
612 * This shouldn't trigger often because most devices have an
613 * RX header they pull before we get here, and that should
614 * be big enough for our radiotap information. We should
615 * probably export the length to drivers so that we can have
616 * them allocate enough headroom to start with.
617 */
618 if (skb_headroom(skb) < needed_headroom &&
Johannes Bergc49e5ea2007-12-11 21:33:42 +0100619 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
Johannes Bergb2e77712007-09-26 15:19:39 +0200620 dev_kfree_skb(skb);
621 return NULL;
622 }
623 } else {
624 /*
625 * Need to make a copy and possibly remove radiotap header
626 * and FCS from the original.
627 */
628 skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC);
629
Johannes Berg1f7bba72014-11-06 22:56:36 +0100630 origskb = remove_monitor_info(local, origskb,
631 rtap_vendor_space);
Johannes Bergb2e77712007-09-26 15:19:39 +0200632
633 if (!skb)
634 return origskb;
635 }
636
Johannes Berg0869aea2009-10-28 10:03:35 +0100637 /* prepend radiotap information */
Johannes Berg1f7bba72014-11-06 22:56:36 +0100638 ieee80211_add_rx_radiotap_header(local, skb, rate, rt_hdrlen, true);
Johannes Bergb2e77712007-09-26 15:19:39 +0200639
Johannes Bergce3edf6d02007-12-19 01:31:22 +0100640 skb_reset_mac_header(skb);
Johannes Bergb2e77712007-09-26 15:19:39 +0200641 skb->ip_summed = CHECKSUM_UNNECESSARY;
642 skb->pkt_type = PACKET_OTHERHOST;
643 skb->protocol = htons(ETH_P_802_2);
644
645 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
Johannes Berg05c914f2008-09-11 00:01:58 +0200646 if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
Johannes Bergb2e77712007-09-26 15:19:39 +0200647 continue;
648
Aviya Erenfeldd8212182016-08-29 23:25:15 +0300649 if (sdata->u.mntr.flags & MONITOR_FLAG_COOK_FRAMES)
Michael Wu3d30d942008-01-31 19:48:27 +0100650 continue;
651
Johannes Berg9607e6b2009-12-23 13:15:31 +0100652 if (!ieee80211_sdata_running(sdata))
Johannes Berg47846c92009-11-25 17:46:19 +0100653 continue;
654
Johannes Bergb2e77712007-09-26 15:19:39 +0200655 if (prev_dev) {
656 skb2 = skb_clone(skb, GFP_ATOMIC);
657 if (skb2) {
658 skb2->dev = prev_dev;
John W. Linville5548a8a2010-06-24 14:25:56 -0400659 netif_receive_skb(skb2);
Johannes Bergb2e77712007-09-26 15:19:39 +0200660 }
661 }
662
663 prev_dev = sdata->dev;
Johannes Berg5a490512015-04-22 17:10:38 +0200664 ieee80211_rx_stats(sdata->dev, skb->len);
Johannes Bergb2e77712007-09-26 15:19:39 +0200665 }
666
667 if (prev_dev) {
668 skb->dev = prev_dev;
John W. Linville5548a8a2010-06-24 14:25:56 -0400669 netif_receive_skb(skb);
Johannes Bergb2e77712007-09-26 15:19:39 +0200670 } else
671 dev_kfree_skb(skb);
672
673 return origskb;
674}
675
Johannes Berg5cf121c2008-02-25 16:27:43 +0100676static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
Johannes Berg6e0d1142007-07-27 15:43:22 +0200677{
Harvey Harrison238f74a2008-07-02 11:05:34 -0700678 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
Johannes Berg554891e2010-09-24 12:38:25 +0200679 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
Johannes Berg9e262972011-07-07 18:45:03 +0200680 int tid, seqno_idx, security_idx;
Johannes Berg6e0d1142007-07-27 15:43:22 +0200681
682 /* does the frame have a qos control field? */
Harvey Harrison238f74a2008-07-02 11:05:34 -0700683 if (ieee80211_is_data_qos(hdr->frame_control)) {
684 u8 *qc = ieee80211_get_qos_ctl(hdr);
Johannes Berg6e0d1142007-07-27 15:43:22 +0200685 /* frame has qos control */
Harvey Harrison238f74a2008-07-02 11:05:34 -0700686 tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
Johannes Berg04b7dcf2011-06-22 10:06:59 +0200687 if (*qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT)
Johannes Berg554891e2010-09-24 12:38:25 +0200688 status->rx_flags |= IEEE80211_RX_AMSDU;
Johannes Berg9e262972011-07-07 18:45:03 +0200689
690 seqno_idx = tid;
691 security_idx = tid;
Johannes Berg6e0d1142007-07-27 15:43:22 +0200692 } else {
Johannes Berg1411f9b2008-07-10 10:11:02 +0200693 /*
694 * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):
695 *
696 * Sequence numbers for management frames, QoS data
697 * frames with a broadcast/multicast address in the
698 * Address 1 field, and all non-QoS data frames sent
699 * by QoS STAs are assigned using an additional single
700 * modulo-4096 counter, [...]
701 *
702 * We also use that counter for non-QoS STAs.
703 */
Johannes Berg5a306f52012-11-14 23:22:21 +0100704 seqno_idx = IEEE80211_NUM_TIDS;
Johannes Berg9e262972011-07-07 18:45:03 +0200705 security_idx = 0;
706 if (ieee80211_is_mgmt(hdr->frame_control))
Johannes Berg5a306f52012-11-14 23:22:21 +0100707 security_idx = IEEE80211_NUM_TIDS;
Johannes Berg9e262972011-07-07 18:45:03 +0200708 tid = 0;
Johannes Berg6e0d1142007-07-27 15:43:22 +0200709 }
Johannes Berg52865dfd2007-07-27 15:43:22 +0200710
Johannes Berg9e262972011-07-07 18:45:03 +0200711 rx->seqno_idx = seqno_idx;
712 rx->security_idx = security_idx;
Johannes Berg6e0d1142007-07-27 15:43:22 +0200713 /* Set skb->priority to 1d tag if highest order bit of TID is not set.
714 * For now, set skb->priority to 0 for other cases. */
715 rx->skb->priority = (tid > 7) ? 0 : tid;
Johannes Berg38f37142008-01-29 17:07:43 +0100716}
Johannes Berg6e0d1142007-07-27 15:43:22 +0200717
Johannes Bergd1c3a372009-01-07 00:26:10 +0100718/**
719 * DOC: Packet alignment
720 *
721 * Drivers always need to pass packets that are aligned to two-byte boundaries
722 * to the stack.
723 *
724 * Additionally, should, if possible, align the payload data in a way that
725 * guarantees that the contained IP header is aligned to a four-byte
726 * boundary. In the case of regular frames, this simply means aligning the
727 * payload to a four-byte boundary (because either the IP header is directly
728 * contained, or IV/RFC1042 headers that have a length divisible by four are
Kalle Valo59d9cb02009-12-17 13:54:57 +0100729 * in front of it). If the payload data is not properly aligned and the
730 * architecture doesn't support efficient unaligned operations, mac80211
731 * will align the data.
Johannes Bergd1c3a372009-01-07 00:26:10 +0100732 *
733 * With A-MSDU frames, however, the payload data address must yield two modulo
734 * four because there are 14-byte 802.3 headers within the A-MSDU frames that
735 * push the IP header further back to a multiple of four again. Thankfully, the
736 * specs were sane enough this time around to require padding each A-MSDU
737 * subframe to a length that is a multiple of four.
738 *
Lucas De Marchi25985ed2011-03-30 22:57:33 -0300739 * Padding like Atheros hardware adds which is between the 802.11 header and
Johannes Bergd1c3a372009-01-07 00:26:10 +0100740 * the payload is not supported, the driver is required to move the 802.11
741 * header to be directly in front of the payload in that case.
742 */
743static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
Johannes Berg38f37142008-01-29 17:07:43 +0100744{
Kalle Valo59d9cb02009-12-17 13:54:57 +0100745#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
Johannes Berg441275e2015-11-06 12:34:24 +0100746 WARN_ON_ONCE((unsigned long)rx->skb->data & 1);
Johannes Bergd1c3a372009-01-07 00:26:10 +0100747#endif
Johannes Berg6e0d1142007-07-27 15:43:22 +0200748}
749
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +0200750
Johannes Berg571ecf62007-07-27 15:43:22 +0200751/* rx handlers */
752
Jouni Malinen3cfcf6ac2009-01-08 13:32:02 +0200753static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
754{
755 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
756
Johannes Bergd8ca16d2014-01-23 16:20:29 +0100757 if (is_multicast_ether_addr(hdr->addr1))
Jouni Malinen3cfcf6ac2009-01-08 13:32:02 +0200758 return 0;
759
Johannes Bergd8ca16d2014-01-23 16:20:29 +0100760 return ieee80211_is_robust_mgmt_frame(skb);
Jouni Malinen3cfcf6ac2009-01-08 13:32:02 +0200761}
762
763
764static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb)
765{
766 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
767
Johannes Bergd8ca16d2014-01-23 16:20:29 +0100768 if (!is_multicast_ether_addr(hdr->addr1))
Jouni Malinen3cfcf6ac2009-01-08 13:32:02 +0200769 return 0;
770
Johannes Bergd8ca16d2014-01-23 16:20:29 +0100771 return ieee80211_is_robust_mgmt_frame(skb);
Jouni Malinen3cfcf6ac2009-01-08 13:32:02 +0200772}
773
774
775/* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */
776static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
777{
778 struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data;
779 struct ieee80211_mmie *mmie;
Jouni Malinen56c52da2015-01-24 19:52:08 +0200780 struct ieee80211_mmie_16 *mmie16;
Jouni Malinen3cfcf6ac2009-01-08 13:32:02 +0200781
Johannes Berg1df332e2012-10-26 00:09:11 +0200782 if (skb->len < 24 + sizeof(*mmie) || !is_multicast_ether_addr(hdr->da))
Jouni Malinen3cfcf6ac2009-01-08 13:32:02 +0200783 return -1;
784
Johannes Bergd8ca16d2014-01-23 16:20:29 +0100785 if (!ieee80211_is_robust_mgmt_frame(skb))
Jouni Malinen3cfcf6ac2009-01-08 13:32:02 +0200786 return -1; /* not a robust management frame */
787
788 mmie = (struct ieee80211_mmie *)
789 (skb->data + skb->len - sizeof(*mmie));
Jouni Malinen56c52da2015-01-24 19:52:08 +0200790 if (mmie->element_id == WLAN_EID_MMIE &&
791 mmie->length == sizeof(*mmie) - 2)
792 return le16_to_cpu(mmie->key_id);
Jouni Malinen3cfcf6ac2009-01-08 13:32:02 +0200793
Jouni Malinen56c52da2015-01-24 19:52:08 +0200794 mmie16 = (struct ieee80211_mmie_16 *)
795 (skb->data + skb->len - sizeof(*mmie16));
796 if (skb->len >= 24 + sizeof(*mmie16) &&
797 mmie16->element_id == WLAN_EID_MMIE &&
798 mmie16->length == sizeof(*mmie16) - 2)
799 return le16_to_cpu(mmie16->key_id);
800
801 return -1;
Jouni Malinen3cfcf6ac2009-01-08 13:32:02 +0200802}
803
Johannes Berg2c61cf92016-03-17 15:02:55 +0200804static int ieee80211_get_cs_keyid(const struct ieee80211_cipher_scheme *cs,
805 struct sk_buff *skb)
Max Stepanov2475b1cc2013-03-24 14:23:27 +0200806{
807 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
808 __le16 fc;
809 int hdrlen;
810 u8 keyid;
811
812 fc = hdr->frame_control;
813 hdrlen = ieee80211_hdrlen(fc);
814
815 if (skb->len < hdrlen + cs->hdr_len)
816 return -EINVAL;
817
818 skb_copy_bits(skb, hdrlen + cs->key_idx_off, &keyid, 1);
819 keyid &= cs->key_idx_mask;
820 keyid >>= cs->key_idx_shift;
821
822 return keyid;
823}
824
Johannes Berg1df332e2012-10-26 00:09:11 +0200825static ieee80211_rx_result ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100826{
Harvey Harrisona7767f92008-07-02 16:30:51 -0700827 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
Johannes Berg47846c92009-11-25 17:46:19 +0100828 char *dev_addr = rx->sdata->vif.addr;
Johannes Bergd6d1a5a2008-02-25 16:24:38 +0100829
Harvey Harrisona7767f92008-07-02 16:30:51 -0700830 if (ieee80211_is_data(hdr->frame_control)) {
Javier Cardona3c5772a2009-08-10 12:15:48 -0700831 if (is_multicast_ether_addr(hdr->addr1)) {
832 if (ieee80211_has_tods(hdr->frame_control) ||
Johannes Berg1df332e2012-10-26 00:09:11 +0200833 !ieee80211_has_fromds(hdr->frame_control))
Javier Cardona3c5772a2009-08-10 12:15:48 -0700834 return RX_DROP_MONITOR;
Joe Perchesb203ca32012-05-08 18:56:52 +0000835 if (ether_addr_equal(hdr->addr3, dev_addr))
Javier Cardona3c5772a2009-08-10 12:15:48 -0700836 return RX_DROP_MONITOR;
837 } else {
838 if (!ieee80211_has_a4(hdr->frame_control))
839 return RX_DROP_MONITOR;
Joe Perchesb203ca32012-05-08 18:56:52 +0000840 if (ether_addr_equal(hdr->addr4, dev_addr))
Javier Cardona3c5772a2009-08-10 12:15:48 -0700841 return RX_DROP_MONITOR;
842 }
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100843 }
844
845 /* If there is not an established peer link and this is not a peer link
846 * establisment frame, beacon or probe, drop the frame.
847 */
848
Javier Cardona57cf8042011-05-13 10:45:43 -0700849 if (!rx->sta || sta_plink_state(rx->sta) != NL80211_PLINK_ESTAB) {
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100850 struct ieee80211_mgmt *mgmt;
Johannes Bergd6d1a5a2008-02-25 16:24:38 +0100851
Harvey Harrisona7767f92008-07-02 16:30:51 -0700852 if (!ieee80211_is_mgmt(hdr->frame_control))
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100853 return RX_DROP_MONITOR;
854
Harvey Harrisona7767f92008-07-02 16:30:51 -0700855 if (ieee80211_is_action(hdr->frame_control)) {
Javier Cardonad3aaec8a2011-05-03 16:57:09 -0700856 u8 category;
Johannes Berg9b395bc2012-10-26 00:36:40 +0200857
858 /* make sure category field is present */
859 if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE)
860 return RX_DROP_MONITOR;
861
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100862 mgmt = (struct ieee80211_mgmt *)hdr;
Javier Cardonad3aaec8a2011-05-03 16:57:09 -0700863 category = mgmt->u.action.category;
864 if (category != WLAN_CATEGORY_MESH_ACTION &&
Johannes Berg1df332e2012-10-26 00:09:11 +0200865 category != WLAN_CATEGORY_SELF_PROTECTED)
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100866 return RX_DROP_MONITOR;
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100867 return RX_CONTINUE;
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100868 }
869
Harvey Harrisona7767f92008-07-02 16:30:51 -0700870 if (ieee80211_is_probe_req(hdr->frame_control) ||
871 ieee80211_is_probe_resp(hdr->frame_control) ||
Javier Cardona71839122011-04-07 15:08:31 -0700872 ieee80211_is_beacon(hdr->frame_control) ||
873 ieee80211_is_auth(hdr->frame_control))
Harvey Harrisona7767f92008-07-02 16:30:51 -0700874 return RX_CONTINUE;
875
876 return RX_DROP_MONITOR;
Harvey Harrisona7767f92008-07-02 16:30:51 -0700877 }
878
Johannes Berg902acc72008-02-23 15:17:19 +0100879 return RX_CONTINUE;
880}
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +0100881
Johannes Bergfb4ea052016-01-28 16:19:24 +0200882static inline bool ieee80211_rx_reorder_ready(struct tid_ampdu_rx *tid_agg_rx,
883 int index)
884{
885 struct sk_buff_head *frames = &tid_agg_rx->reorder_buf[index];
886 struct sk_buff *tail = skb_peek_tail(frames);
887 struct ieee80211_rx_status *status;
888
Sara Sharon06470f72016-01-28 16:19:25 +0200889 if (tid_agg_rx->reorder_buf_filtered & BIT_ULL(index))
890 return true;
891
Johannes Bergfb4ea052016-01-28 16:19:24 +0200892 if (!tail)
893 return false;
894
895 status = IEEE80211_SKB_RXCB(tail);
896 if (status->flag & RX_FLAG_AMSDU_MORE)
897 return false;
898
899 return true;
900}
901
Johannes Bergd3b2fb52012-06-22 12:48:38 +0200902static void ieee80211_release_reorder_frame(struct ieee80211_sub_if_data *sdata,
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100903 struct tid_ampdu_rx *tid_agg_rx,
Christian Lamparterf9e124f2013-02-04 17:44:44 +0000904 int index,
905 struct sk_buff_head *frames)
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100906{
Michal Kazior83eb9352014-07-16 12:09:31 +0200907 struct sk_buff_head *skb_list = &tid_agg_rx->reorder_buf[index];
908 struct sk_buff *skb;
Christian Lamparter4cfda472010-12-27 23:21:26 +0100909 struct ieee80211_rx_status *status;
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100910
Johannes Bergdd318572010-11-29 11:09:16 +0100911 lockdep_assert_held(&tid_agg_rx->reorder_lock);
912
Michal Kazior83eb9352014-07-16 12:09:31 +0200913 if (skb_queue_empty(skb_list))
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100914 goto no_frame;
915
Johannes Bergfb4ea052016-01-28 16:19:24 +0200916 if (!ieee80211_rx_reorder_ready(tid_agg_rx, index)) {
Michal Kazior83eb9352014-07-16 12:09:31 +0200917 __skb_queue_purge(skb_list);
918 goto no_frame;
919 }
920
921 /* release frames from the reorder ring buffer */
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100922 tid_agg_rx->stored_mpdu_num--;
Michal Kazior83eb9352014-07-16 12:09:31 +0200923 while ((skb = __skb_dequeue(skb_list))) {
924 status = IEEE80211_SKB_RXCB(skb);
925 status->rx_flags |= IEEE80211_RX_DEFERRED_RELEASE;
926 __skb_queue_tail(frames, skb);
927 }
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100928
929no_frame:
Sara Sharon06470f72016-01-28 16:19:25 +0200930 tid_agg_rx->reorder_buf_filtered &= ~BIT_ULL(index);
Johannes Berg9a886582013-02-15 19:25:00 +0100931 tid_agg_rx->head_seq_num = ieee80211_sn_inc(tid_agg_rx->head_seq_num);
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100932}
933
Johannes Bergd3b2fb52012-06-22 12:48:38 +0200934static void ieee80211_release_reorder_frames(struct ieee80211_sub_if_data *sdata,
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100935 struct tid_ampdu_rx *tid_agg_rx,
Christian Lamparterf9e124f2013-02-04 17:44:44 +0000936 u16 head_seq_num,
937 struct sk_buff_head *frames)
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100938{
939 int index;
940
Johannes Bergdd318572010-11-29 11:09:16 +0100941 lockdep_assert_held(&tid_agg_rx->reorder_lock);
942
Johannes Berg9a886582013-02-15 19:25:00 +0100943 while (ieee80211_sn_less(tid_agg_rx->head_seq_num, head_seq_num)) {
Karl Beldan2e3049b2013-10-24 15:53:32 +0200944 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
Christian Lamparterf9e124f2013-02-04 17:44:44 +0000945 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
946 frames);
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100947 }
948}
949
950/*
951 * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If
952 * the skb was added to the buffer longer than this time ago, the earlier
953 * frames that have not yet been received are assumed to be lost and the skb
954 * can be released for processing. This may also release other skb's from the
955 * reorder buffer if there are no additional gaps between the frames.
Christian Lamparter2bff8eb2010-08-05 01:36:41 +0200956 *
957 * Callers must hold tid_agg_rx->reorder_lock.
Johannes Berg1edfb1a2009-11-25 17:46:16 +0100958 */
959#define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)
960
Johannes Bergd3b2fb52012-06-22 12:48:38 +0200961static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata,
Christian Lamparterf9e124f2013-02-04 17:44:44 +0000962 struct tid_ampdu_rx *tid_agg_rx,
963 struct sk_buff_head *frames)
Christian Lamparteraa0c8632010-08-05 01:36:04 +0200964{
Michal Kazior83eb9352014-07-16 12:09:31 +0200965 int index, i, j;
Christian Lamparteraa0c8632010-08-05 01:36:04 +0200966
Johannes Bergdd318572010-11-29 11:09:16 +0100967 lockdep_assert_held(&tid_agg_rx->reorder_lock);
968
Christian Lamparteraa0c8632010-08-05 01:36:04 +0200969 /* release the buffer until next missing frame */
Karl Beldan2e3049b2013-10-24 15:53:32 +0200970 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
Johannes Bergfb4ea052016-01-28 16:19:24 +0200971 if (!ieee80211_rx_reorder_ready(tid_agg_rx, index) &&
Eliad Peller07ae2df2012-02-01 18:48:09 +0200972 tid_agg_rx->stored_mpdu_num) {
Christian Lamparteraa0c8632010-08-05 01:36:04 +0200973 /*
974 * No buffers ready to be released, but check whether any
975 * frames in the reorder buffer have timed out.
976 */
Christian Lamparteraa0c8632010-08-05 01:36:04 +0200977 int skipped = 1;
978 for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
979 j = (j + 1) % tid_agg_rx->buf_size) {
Johannes Bergfb4ea052016-01-28 16:19:24 +0200980 if (!ieee80211_rx_reorder_ready(tid_agg_rx, j)) {
Christian Lamparteraa0c8632010-08-05 01:36:04 +0200981 skipped++;
982 continue;
983 }
Daniel Halperin499fe9a2011-03-24 16:01:48 -0700984 if (skipped &&
985 !time_after(jiffies, tid_agg_rx->reorder_time[j] +
Christian Lamparteraa0c8632010-08-05 01:36:04 +0200986 HT_RX_REORDER_BUF_TIMEOUT))
Christian Lamparter2bff8eb2010-08-05 01:36:41 +0200987 goto set_release_timer;
Christian Lamparteraa0c8632010-08-05 01:36:04 +0200988
Michal Kazior83eb9352014-07-16 12:09:31 +0200989 /* don't leave incomplete A-MSDUs around */
990 for (i = (index + 1) % tid_agg_rx->buf_size; i != j;
991 i = (i + 1) % tid_agg_rx->buf_size)
992 __skb_queue_purge(&tid_agg_rx->reorder_buf[i]);
993
Johannes Bergbdcbd8e2012-06-22 11:29:50 +0200994 ht_dbg_ratelimited(sdata,
995 "release an RX reorder frame due to timeout on earlier frames\n");
Christian Lamparterf9e124f2013-02-04 17:44:44 +0000996 ieee80211_release_reorder_frame(sdata, tid_agg_rx, j,
997 frames);
Christian Lamparteraa0c8632010-08-05 01:36:04 +0200998
999 /*
1000 * Increment the head seq# also for the skipped slots.
1001 */
1002 tid_agg_rx->head_seq_num =
Johannes Berg9a886582013-02-15 19:25:00 +01001003 (tid_agg_rx->head_seq_num +
1004 skipped) & IEEE80211_SN_MASK;
Christian Lamparteraa0c8632010-08-05 01:36:04 +02001005 skipped = 0;
1006 }
Johannes Bergfb4ea052016-01-28 16:19:24 +02001007 } else while (ieee80211_rx_reorder_ready(tid_agg_rx, index)) {
Christian Lamparterf9e124f2013-02-04 17:44:44 +00001008 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
1009 frames);
Karl Beldan2e3049b2013-10-24 15:53:32 +02001010 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
Christian Lamparteraa0c8632010-08-05 01:36:04 +02001011 }
Christian Lamparter2bff8eb2010-08-05 01:36:41 +02001012
1013 if (tid_agg_rx->stored_mpdu_num) {
Karl Beldan2e3049b2013-10-24 15:53:32 +02001014 j = index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
Christian Lamparter2bff8eb2010-08-05 01:36:41 +02001015
1016 for (; j != (index - 1) % tid_agg_rx->buf_size;
1017 j = (j + 1) % tid_agg_rx->buf_size) {
Johannes Bergfb4ea052016-01-28 16:19:24 +02001018 if (ieee80211_rx_reorder_ready(tid_agg_rx, j))
Christian Lamparter2bff8eb2010-08-05 01:36:41 +02001019 break;
1020 }
1021
1022 set_release_timer:
1023
Johannes Berg788211d2015-04-01 14:20:42 +02001024 if (!tid_agg_rx->removed)
1025 mod_timer(&tid_agg_rx->reorder_timer,
1026 tid_agg_rx->reorder_time[j] + 1 +
1027 HT_RX_REORDER_BUF_TIMEOUT);
Christian Lamparter2bff8eb2010-08-05 01:36:41 +02001028 } else {
1029 del_timer(&tid_agg_rx->reorder_timer);
1030 }
Christian Lamparteraa0c8632010-08-05 01:36:04 +02001031}
1032
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001033/*
1034 * As this function belongs to the RX path it must be under
1035 * rcu_read_lock protection. It returns false if the frame
1036 * can be processed immediately, true if it was consumed.
1037 */
Johannes Bergd3b2fb52012-06-22 12:48:38 +02001038static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata,
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001039 struct tid_ampdu_rx *tid_agg_rx,
Christian Lamparterf9e124f2013-02-04 17:44:44 +00001040 struct sk_buff *skb,
1041 struct sk_buff_head *frames)
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001042{
1043 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
Michal Kazior83eb9352014-07-16 12:09:31 +02001044 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001045 u16 sc = le16_to_cpu(hdr->seq_ctrl);
1046 u16 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
1047 u16 head_seq_num, buf_size;
1048 int index;
Christian Lamparter2bff8eb2010-08-05 01:36:41 +02001049 bool ret = true;
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001050
Johannes Bergdd318572010-11-29 11:09:16 +01001051 spin_lock(&tid_agg_rx->reorder_lock);
1052
Michal Kazior4549cf22014-09-02 14:05:10 +02001053 /*
1054 * Offloaded BA sessions have no known starting sequence number so pick
1055 * one from first Rxed frame for this tid after BA was started.
1056 */
1057 if (unlikely(tid_agg_rx->auto_seq)) {
1058 tid_agg_rx->auto_seq = false;
1059 tid_agg_rx->ssn = mpdu_seq_num;
1060 tid_agg_rx->head_seq_num = mpdu_seq_num;
1061 }
1062
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001063 buf_size = tid_agg_rx->buf_size;
1064 head_seq_num = tid_agg_rx->head_seq_num;
1065
Sara Sharon42e7f372017-02-06 15:28:42 +02001066 /*
1067 * If the current MPDU's SN is smaller than the SSN, it shouldn't
1068 * be reordered.
1069 */
1070 if (unlikely(!tid_agg_rx->started)) {
1071 if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) {
1072 ret = false;
1073 goto out;
1074 }
1075 tid_agg_rx->started = true;
1076 }
1077
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001078 /* frame with out of date sequence number */
Johannes Berg9a886582013-02-15 19:25:00 +01001079 if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) {
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001080 dev_kfree_skb(skb);
Christian Lamparter2bff8eb2010-08-05 01:36:41 +02001081 goto out;
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001082 }
1083
1084 /*
1085 * If frame the sequence number exceeds our buffering window
1086 * size release some previous frames to make room for this one.
1087 */
Johannes Berg9a886582013-02-15 19:25:00 +01001088 if (!ieee80211_sn_less(mpdu_seq_num, head_seq_num + buf_size)) {
1089 head_seq_num = ieee80211_sn_inc(
1090 ieee80211_sn_sub(mpdu_seq_num, buf_size));
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001091 /* release stored frames up to new head to stack */
Johannes Bergd3b2fb52012-06-22 12:48:38 +02001092 ieee80211_release_reorder_frames(sdata, tid_agg_rx,
Christian Lamparterf9e124f2013-02-04 17:44:44 +00001093 head_seq_num, frames);
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001094 }
1095
1096 /* Now the new frame is always in the range of the reordering buffer */
1097
Karl Beldan2e3049b2013-10-24 15:53:32 +02001098 index = mpdu_seq_num % tid_agg_rx->buf_size;
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001099
1100 /* check if we already stored this frame */
Johannes Bergfb4ea052016-01-28 16:19:24 +02001101 if (ieee80211_rx_reorder_ready(tid_agg_rx, index)) {
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001102 dev_kfree_skb(skb);
Christian Lamparter2bff8eb2010-08-05 01:36:41 +02001103 goto out;
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001104 }
1105
1106 /*
1107 * If the current MPDU is in the right order and nothing else
1108 * is stored we can process it directly, no need to buffer it.
Johannes Bergc835b212011-03-15 23:17:01 +01001109 * If it is first but there's something stored, we may be able
1110 * to release frames after this one.
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001111 */
1112 if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
1113 tid_agg_rx->stored_mpdu_num == 0) {
Michal Kazior83eb9352014-07-16 12:09:31 +02001114 if (!(status->flag & RX_FLAG_AMSDU_MORE))
1115 tid_agg_rx->head_seq_num =
1116 ieee80211_sn_inc(tid_agg_rx->head_seq_num);
Christian Lamparter2bff8eb2010-08-05 01:36:41 +02001117 ret = false;
1118 goto out;
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001119 }
1120
1121 /* put the frame in the reordering buffer */
Michal Kazior83eb9352014-07-16 12:09:31 +02001122 __skb_queue_tail(&tid_agg_rx->reorder_buf[index], skb);
1123 if (!(status->flag & RX_FLAG_AMSDU_MORE)) {
1124 tid_agg_rx->reorder_time[index] = jiffies;
1125 tid_agg_rx->stored_mpdu_num++;
1126 ieee80211_sta_reorder_release(sdata, tid_agg_rx, frames);
1127 }
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001128
Christian Lamparter2bff8eb2010-08-05 01:36:41 +02001129 out:
1130 spin_unlock(&tid_agg_rx->reorder_lock);
1131 return ret;
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001132}
1133
1134/*
1135 * Reorder MPDUs from A-MPDUs, keeping them on a buffer. Returns
1136 * true if the MPDU was buffered, false if it should be processed.
1137 */
Christian Lamparterf9e124f2013-02-04 17:44:44 +00001138static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx,
1139 struct sk_buff_head *frames)
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001140{
Johannes Berg2569a822009-11-25 17:46:17 +01001141 struct sk_buff *skb = rx->skb;
1142 struct ieee80211_local *local = rx->local;
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001143 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
Johannes Berg2569a822009-11-25 17:46:17 +01001144 struct sta_info *sta = rx->sta;
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001145 struct tid_ampdu_rx *tid_agg_rx;
1146 u16 sc;
Thomas Pedersen6cc00d52011-11-03 21:11:11 -07001147 u8 tid, ack_policy;
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001148
Johannes Berg051a41f2013-11-20 11:28:27 +01001149 if (!ieee80211_is_data_qos(hdr->frame_control) ||
1150 is_multicast_ether_addr(hdr->addr1))
Johannes Berg2569a822009-11-25 17:46:17 +01001151 goto dont_reorder;
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001152
1153 /*
1154 * filter the QoS data rx stream according to
1155 * STA/TID and check if this STA/TID is on aggregation
1156 */
1157
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001158 if (!sta)
Johannes Berg2569a822009-11-25 17:46:17 +01001159 goto dont_reorder;
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001160
Thomas Pedersen6cc00d52011-11-03 21:11:11 -07001161 ack_policy = *ieee80211_get_qos_ctl(hdr) &
1162 IEEE80211_QOS_CTL_ACK_POLICY_MASK;
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001163 tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
1164
Johannes Berga87f7362010-06-10 10:21:38 +02001165 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
Johannes Bergbfe40fa2016-08-29 23:25:18 +03001166 if (!tid_agg_rx) {
1167 if (ack_policy == IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK &&
1168 !test_bit(tid, rx->sta->ampdu_mlme.agg_session_valid) &&
1169 !test_and_set_bit(tid, rx->sta->ampdu_mlme.unexpected_agg))
1170 ieee80211_send_delba(rx->sdata, rx->sta->sta.addr, tid,
1171 WLAN_BACK_RECIPIENT,
1172 WLAN_REASON_QSTA_REQUIRE_SETUP);
Johannes Berga87f7362010-06-10 10:21:38 +02001173 goto dont_reorder;
Johannes Bergbfe40fa2016-08-29 23:25:18 +03001174 }
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001175
1176 /* qos null data frames are excluded */
1177 if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
Johannes Berga87f7362010-06-10 10:21:38 +02001178 goto dont_reorder;
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001179
Thomas Pedersen6cc00d52011-11-03 21:11:11 -07001180 /* not part of a BA session */
1181 if (ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK &&
1182 ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_NORMAL)
1183 goto dont_reorder;
1184
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001185 /* new, potentially un-ordered, ampdu frame - process it */
1186
1187 /* reset session timer */
1188 if (tid_agg_rx->timeout)
Felix Fietkau12d3952f2012-03-18 22:58:06 +01001189 tid_agg_rx->last_rx = jiffies;
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001190
1191 /* if this mpdu is fragmented - terminate rx aggregation session */
1192 sc = le16_to_cpu(hdr->seq_ctrl);
1193 if (sc & IEEE80211_SCTL_FRAG) {
Johannes Bergc1475ca2010-06-10 10:21:37 +02001194 skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
Johannes Berg344eec62010-06-10 10:21:36 +02001195 skb_queue_tail(&rx->sdata->skb_queue, skb);
1196 ieee80211_queue_work(&local->hw, &rx->sdata->work);
Johannes Berg2569a822009-11-25 17:46:17 +01001197 return;
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001198 }
1199
Johannes Berga87f7362010-06-10 10:21:38 +02001200 /*
1201 * No locking needed -- we will only ever process one
1202 * RX packet at a time, and thus own tid_agg_rx. All
1203 * other code manipulating it needs to (and does) make
1204 * sure that we cannot get to it any more before doing
1205 * anything with it.
1206 */
Christian Lamparterf9e124f2013-02-04 17:44:44 +00001207 if (ieee80211_sta_manage_reorder_buf(rx->sdata, tid_agg_rx, skb,
1208 frames))
Johannes Berg2569a822009-11-25 17:46:17 +01001209 return;
1210
1211 dont_reorder:
Christian Lamparterf9e124f2013-02-04 17:44:44 +00001212 __skb_queue_tail(frames, skb);
Johannes Berg1edfb1a2009-11-25 17:46:16 +01001213}
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +01001214
Johannes Berg49461622008-06-30 15:10:45 +02001215static ieee80211_rx_result debug_noinline
Johannes Berg03954422014-11-11 16:49:25 +01001216ieee80211_rx_h_check_dup(struct ieee80211_rx_data *rx)
Johannes Berg571ecf62007-07-27 15:43:22 +02001217{
Harvey Harrisona7767f92008-07-02 16:30:51 -07001218 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
Johannes Berg554891e2010-09-24 12:38:25 +02001219 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
Johannes Berg571ecf62007-07-27 15:43:22 +02001220
Sara Sharonf9cfa5f2015-12-08 16:04:33 +02001221 if (status->flag & RX_FLAG_DUP_VALIDATED)
1222 return RX_CONTINUE;
1223
Johannes Berg6b0f3272013-07-11 22:33:26 +02001224 /*
1225 * Drop duplicate 802.11 retransmissions
1226 * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery")
1227 */
Johannes Berg03954422014-11-11 16:49:25 +01001228
1229 if (rx->skb->len < 24)
1230 return RX_CONTINUE;
1231
1232 if (ieee80211_is_ctl(hdr->frame_control) ||
1233 ieee80211_is_qos_nullfunc(hdr->frame_control) ||
1234 is_multicast_ether_addr(hdr->addr1))
1235 return RX_CONTINUE;
1236
Johannes Berga732fa72015-10-14 18:27:07 +02001237 if (!rx->sta)
1238 return RX_CONTINUE;
1239
1240 if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
1241 rx->sta->last_seq_ctrl[rx->seqno_idx] == hdr->seq_ctrl)) {
1242 I802_DEBUG_INC(rx->local->dot11FrameDuplicateCount);
Johannes Berge5a9f8d2015-10-16 17:54:47 +02001243 rx->sta->rx_stats.num_duplicates++;
Johannes Berga732fa72015-10-14 18:27:07 +02001244 return RX_DROP_UNUSABLE;
1245 } else if (!(status->flag & RX_FLAG_AMSDU_MORE)) {
1246 rx->sta->last_seq_ctrl[rx->seqno_idx] = hdr->seq_ctrl;
Johannes Berg571ecf62007-07-27 15:43:22 +02001247 }
1248
Johannes Berg03954422014-11-11 16:49:25 +01001249 return RX_CONTINUE;
1250}
1251
1252static ieee80211_rx_result debug_noinline
1253ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
1254{
1255 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1256
Johannes Berg571ecf62007-07-27 15:43:22 +02001257 /* Drop disallowed frame classes based on STA auth/assoc state;
1258 * IEEE 802.11, Chap 5.5.
1259 *
Johannes Bergccd7b362008-09-11 00:01:56 +02001260 * mac80211 filters only based on association state, i.e. it drops
1261 * Class 3 frames from not associated stations. hostapd sends
Johannes Berg571ecf62007-07-27 15:43:22 +02001262 * deauth/disassoc frames when needed. In addition, hostapd is
1263 * responsible for filtering on both auth and assoc states.
1264 */
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +01001265
Johannes Berg902acc72008-02-23 15:17:19 +01001266 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +01001267 return ieee80211_rx_mesh_check(rx);
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +01001268
Harvey Harrisona7767f92008-07-02 16:30:51 -07001269 if (unlikely((ieee80211_is_data(hdr->frame_control) ||
1270 ieee80211_is_pspoll(hdr->frame_control)) &&
Johannes Berg05c914f2008-09-11 00:01:58 +02001271 rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
Bill Jordan1be7fe82010-10-01 11:20:41 -04001272 rx->sdata->vif.type != NL80211_IFTYPE_WDS &&
Rostislav Lisovy239281f2014-11-03 10:33:19 +01001273 rx->sdata->vif.type != NL80211_IFTYPE_OCB &&
Johannes Bergc2c98fd2011-09-29 16:04:36 +02001274 (!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_ASSOC)))) {
Johannes Berg7852e362012-01-20 13:55:24 +01001275 /*
1276 * accept port control frames from the AP even when it's not
1277 * yet marked ASSOC to prevent a race where we don't set the
1278 * assoc bit quickly enough before it sends the first frame
1279 */
1280 if (rx->sta && rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
Guy Eilam2a33bee2011-08-17 15:18:15 +03001281 ieee80211_is_data_present(hdr->frame_control)) {
Johannes Berg6dbda2d2012-10-26 00:41:23 +02001282 unsigned int hdrlen;
1283 __be16 ethertype;
Guy Eilam2a33bee2011-08-17 15:18:15 +03001284
Johannes Berg6dbda2d2012-10-26 00:41:23 +02001285 hdrlen = ieee80211_hdrlen(hdr->frame_control);
1286
1287 if (rx->skb->len < hdrlen + 8)
1288 return RX_DROP_MONITOR;
1289
1290 skb_copy_bits(rx->skb, hdrlen + 6, &ethertype, 2);
1291 if (ethertype == rx->sdata->control_port_protocol)
Guy Eilam2a33bee2011-08-17 15:18:15 +03001292 return RX_CONTINUE;
1293 }
Johannes Berg21fc7562011-11-04 11:18:13 +01001294
1295 if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
1296 cfg80211_rx_spurious_frame(rx->sdata->dev,
1297 hdr->addr2,
1298 GFP_ATOMIC))
1299 return RX_DROP_UNUSABLE;
1300
Johannes Berge4c26ad2008-01-31 19:48:21 +01001301 return RX_DROP_MONITOR;
Guy Eilam2a33bee2011-08-17 15:18:15 +03001302 }
Johannes Berg571ecf62007-07-27 15:43:22 +02001303
Johannes Berg9ae54c82008-01-31 19:48:20 +01001304 return RX_CONTINUE;
Johannes Berg570bd532007-07-27 15:43:22 +02001305}
1306
1307
Johannes Berg49461622008-06-30 15:10:45 +02001308static ieee80211_rx_result debug_noinline
Kalle Valo572e0012009-02-10 17:09:31 +02001309ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx)
1310{
1311 struct ieee80211_local *local;
1312 struct ieee80211_hdr *hdr;
1313 struct sk_buff *skb;
1314
1315 local = rx->local;
1316 skb = rx->skb;
1317 hdr = (struct ieee80211_hdr *) skb->data;
1318
1319 if (!local->pspolling)
1320 return RX_CONTINUE;
1321
1322 if (!ieee80211_has_fromds(hdr->frame_control))
1323 /* this is not from AP */
1324 return RX_CONTINUE;
1325
1326 if (!ieee80211_is_data(hdr->frame_control))
1327 return RX_CONTINUE;
1328
1329 if (!ieee80211_has_moredata(hdr->frame_control)) {
1330 /* AP has no more frames buffered for us */
1331 local->pspolling = false;
1332 return RX_CONTINUE;
1333 }
1334
1335 /* more data bit is set, let's request a new frame from the AP */
1336 ieee80211_send_pspoll(local, rx->sdata);
1337
1338 return RX_CONTINUE;
1339}
1340
Marco Porschd012a602012-10-10 12:39:50 -07001341static void sta_ps_start(struct sta_info *sta)
Johannes Berg571ecf62007-07-27 15:43:22 +02001342{
Johannes Berg133b8222008-09-16 14:18:59 +02001343 struct ieee80211_sub_if_data *sdata = sta->sdata;
Christian Lamparter4571d3b2008-11-30 00:48:41 +01001344 struct ieee80211_local *local = sdata->local;
Marco Porschd012a602012-10-10 12:39:50 -07001345 struct ps_data *ps;
Felix Fietkauba8c3d62015-03-27 21:30:37 +01001346 int tid;
Joe Perches0795af52007-10-03 17:59:30 -07001347
Marco Porschd012a602012-10-10 12:39:50 -07001348 if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
1349 sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
1350 ps = &sdata->bss->ps;
1351 else
1352 return;
1353
1354 atomic_inc(&ps->num_sta_ps);
Johannes Bergc2c98fd2011-09-29 16:04:36 +02001355 set_sta_flag(sta, WLAN_STA_PS_STA);
Johannes Berg30686bf2015-06-02 21:39:54 +02001356 if (!ieee80211_hw_check(&local->hw, AP_LINK_PS))
Arik Nemtsovd057e5a2011-01-31 22:29:13 +02001357 drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta);
Johannes Bergbdcbd8e2012-06-22 11:29:50 +02001358 ps_dbg(sdata, "STA %pM aid %d enters power save mode\n",
1359 sta->sta.addr, sta->sta.aid);
Felix Fietkauba8c3d62015-03-27 21:30:37 +01001360
Johannes Berg17c18bf2015-03-21 15:25:43 +01001361 ieee80211_clear_fast_xmit(sta);
1362
Felix Fietkauba8c3d62015-03-27 21:30:37 +01001363 if (!sta->sta.txq[0])
1364 return;
1365
1366 for (tid = 0; tid < ARRAY_SIZE(sta->sta.txq); tid++) {
Toke Høiland-Jørgensenbb42f2d2016-09-22 19:04:20 +02001367 if (txq_has_queue(sta->sta.txq[tid]))
Felix Fietkauba8c3d62015-03-27 21:30:37 +01001368 set_bit(tid, &sta->txq_buffered_tids);
1369 else
1370 clear_bit(tid, &sta->txq_buffered_tids);
1371 }
Johannes Berg571ecf62007-07-27 15:43:22 +02001372}
1373
Marco Porschd012a602012-10-10 12:39:50 -07001374static void sta_ps_end(struct sta_info *sta)
Johannes Berg571ecf62007-07-27 15:43:22 +02001375{
Johannes Bergbdcbd8e2012-06-22 11:29:50 +02001376 ps_dbg(sta->sdata, "STA %pM aid %d exits power save mode\n",
1377 sta->sta.addr, sta->sta.aid);
Johannes Berg004c8722008-02-20 11:21:35 +01001378
Johannes Bergc2c98fd2011-09-29 16:04:36 +02001379 if (test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
Johannes Berge3685e02014-02-20 11:19:58 +01001380 /*
1381 * Clear the flag only if the other one is still set
1382 * so that the TX path won't start TX'ing new frames
1383 * directly ... In the case that the driver flag isn't
1384 * set ieee80211_sta_ps_deliver_wakeup() will clear it.
1385 */
1386 clear_sta_flag(sta, WLAN_STA_PS_STA);
Johannes Bergbdcbd8e2012-06-22 11:29:50 +02001387 ps_dbg(sta->sdata, "STA %pM aid %d driver-ps-blocked\n",
1388 sta->sta.addr, sta->sta.aid);
Johannes Bergaf818582009-11-06 11:35:50 +01001389 return;
1390 }
1391
Johannes Berg5ac2e352014-05-27 16:32:27 +02001392 set_sta_flag(sta, WLAN_STA_PS_DELIVER);
1393 clear_sta_flag(sta, WLAN_STA_PS_STA);
Johannes Bergaf818582009-11-06 11:35:50 +01001394 ieee80211_sta_ps_deliver_wakeup(sta);
Johannes Berg571ecf62007-07-27 15:43:22 +02001395}
1396
Johannes Bergcf471612015-06-16 16:16:38 +02001397int ieee80211_sta_ps_transition(struct ieee80211_sta *pubsta, bool start)
Arik Nemtsovd057e5a2011-01-31 22:29:13 +02001398{
Johannes Bergcf471612015-06-16 16:16:38 +02001399 struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
Arik Nemtsovd057e5a2011-01-31 22:29:13 +02001400 bool in_ps;
1401
Johannes Bergcf471612015-06-16 16:16:38 +02001402 WARN_ON(!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS));
Arik Nemtsovd057e5a2011-01-31 22:29:13 +02001403
1404 /* Don't let the same PS state be set twice */
Johannes Bergcf471612015-06-16 16:16:38 +02001405 in_ps = test_sta_flag(sta, WLAN_STA_PS_STA);
Arik Nemtsovd057e5a2011-01-31 22:29:13 +02001406 if ((start && in_ps) || (!start && !in_ps))
1407 return -EINVAL;
1408
1409 if (start)
Johannes Bergcf471612015-06-16 16:16:38 +02001410 sta_ps_start(sta);
Arik Nemtsovd057e5a2011-01-31 22:29:13 +02001411 else
Johannes Bergcf471612015-06-16 16:16:38 +02001412 sta_ps_end(sta);
Arik Nemtsovd057e5a2011-01-31 22:29:13 +02001413
1414 return 0;
1415}
1416EXPORT_SYMBOL(ieee80211_sta_ps_transition);
1417
Johannes Berg46fa38e2016-05-03 16:58:00 +03001418void ieee80211_sta_pspoll(struct ieee80211_sta *pubsta)
1419{
1420 struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1421
1422 if (test_sta_flag(sta, WLAN_STA_SP))
1423 return;
1424
1425 if (!test_sta_flag(sta, WLAN_STA_PS_DRIVER))
1426 ieee80211_sta_ps_deliver_poll_response(sta);
1427 else
1428 set_sta_flag(sta, WLAN_STA_PSPOLL);
1429}
1430EXPORT_SYMBOL(ieee80211_sta_pspoll);
1431
1432void ieee80211_sta_uapsd_trigger(struct ieee80211_sta *pubsta, u8 tid)
1433{
1434 struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1435 u8 ac = ieee802_1d_to_ac[tid & 7];
1436
1437 /*
1438 * If this AC is not trigger-enabled do nothing.
1439 *
1440 * NB: This could/should check a separate bitmap of trigger-
1441 * enabled queues, but for now we only implement uAPSD w/o
1442 * TSPEC changes to the ACs, so they're always the same.
1443 */
1444 if (!(sta->sta.uapsd_queues & BIT(ac)))
1445 return;
1446
1447 /* if we are in a service period, do nothing */
1448 if (test_sta_flag(sta, WLAN_STA_SP))
1449 return;
1450
1451 if (!test_sta_flag(sta, WLAN_STA_PS_DRIVER))
1452 ieee80211_sta_ps_deliver_uapsd(sta);
1453 else
1454 set_sta_flag(sta, WLAN_STA_UAPSD);
1455}
1456EXPORT_SYMBOL(ieee80211_sta_uapsd_trigger);
1457
Johannes Berg49461622008-06-30 15:10:45 +02001458static ieee80211_rx_result debug_noinline
Johannes Berg47086fc2011-09-29 16:04:33 +02001459ieee80211_rx_h_uapsd_and_pspoll(struct ieee80211_rx_data *rx)
1460{
1461 struct ieee80211_sub_if_data *sdata = rx->sdata;
1462 struct ieee80211_hdr *hdr = (void *)rx->skb->data;
1463 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
Johannes Berg47086fc2011-09-29 16:04:33 +02001464
Johannes Berg5c900672015-04-22 14:48:34 +02001465 if (!rx->sta)
Johannes Berg47086fc2011-09-29 16:04:33 +02001466 return RX_CONTINUE;
1467
1468 if (sdata->vif.type != NL80211_IFTYPE_AP &&
1469 sdata->vif.type != NL80211_IFTYPE_AP_VLAN)
1470 return RX_CONTINUE;
1471
1472 /*
1473 * The device handles station powersave, so don't do anything about
1474 * uAPSD and PS-Poll frames (the latter shouldn't even come up from
1475 * it to mac80211 since they're handled.)
1476 */
Johannes Berg30686bf2015-06-02 21:39:54 +02001477 if (ieee80211_hw_check(&sdata->local->hw, AP_LINK_PS))
Johannes Berg47086fc2011-09-29 16:04:33 +02001478 return RX_CONTINUE;
1479
1480 /*
1481 * Don't do anything if the station isn't already asleep. In
1482 * the uAPSD case, the station will probably be marked asleep,
1483 * in the PS-Poll case the station must be confused ...
1484 */
Johannes Bergc2c98fd2011-09-29 16:04:36 +02001485 if (!test_sta_flag(rx->sta, WLAN_STA_PS_STA))
Johannes Berg47086fc2011-09-29 16:04:33 +02001486 return RX_CONTINUE;
1487
1488 if (unlikely(ieee80211_is_pspoll(hdr->frame_control))) {
Johannes Berg46fa38e2016-05-03 16:58:00 +03001489 ieee80211_sta_pspoll(&rx->sta->sta);
Johannes Berg47086fc2011-09-29 16:04:33 +02001490
1491 /* Free PS Poll skb here instead of returning RX_DROP that would
1492 * count as an dropped frame. */
1493 dev_kfree_skb(rx->skb);
1494
1495 return RX_QUEUED;
1496 } else if (!ieee80211_has_morefrags(hdr->frame_control) &&
1497 !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
1498 ieee80211_has_pm(hdr->frame_control) &&
1499 (ieee80211_is_data_qos(hdr->frame_control) ||
1500 ieee80211_is_qos_nullfunc(hdr->frame_control))) {
Johannes Berg46fa38e2016-05-03 16:58:00 +03001501 u8 tid;
1502
Johannes Berg47086fc2011-09-29 16:04:33 +02001503 tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
Johannes Berg47086fc2011-09-29 16:04:33 +02001504
Johannes Berg46fa38e2016-05-03 16:58:00 +03001505 ieee80211_sta_uapsd_trigger(&rx->sta->sta, tid);
Johannes Berg47086fc2011-09-29 16:04:33 +02001506 }
1507
1508 return RX_CONTINUE;
1509}
1510
1511static ieee80211_rx_result debug_noinline
Johannes Berg5cf121c2008-02-25 16:27:43 +01001512ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
Johannes Berg571ecf62007-07-27 15:43:22 +02001513{
1514 struct sta_info *sta = rx->sta;
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01001515 struct sk_buff *skb = rx->skb;
1516 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1517 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
Felix Fietkauef0621e2013-04-22 16:29:31 +02001518 int i;
Johannes Berg571ecf62007-07-27 15:43:22 +02001519
1520 if (!sta)
Johannes Berg9ae54c82008-01-31 19:48:20 +01001521 return RX_CONTINUE;
Johannes Berg571ecf62007-07-27 15:43:22 +02001522
Johannes Bergb291ba12009-07-10 15:29:03 +02001523 /*
1524 * Update last_rx only for IBSS packets which are for the current
Antonio Quartullie584da5e2012-11-25 23:13:42 +01001525 * BSSID and for station already AUTHORIZED to avoid keeping the
1526 * current IBSS network alive in cases where other STAs start
1527 * using different BSSID. This will also give the station another
1528 * chance to restart the authentication/authorization in case
1529 * something went wrong the first time.
Johannes Bergb291ba12009-07-10 15:29:03 +02001530 */
Johannes Berg05c914f2008-09-11 00:01:58 +02001531 if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
Ron Rindjunsky71364712007-12-25 17:00:36 +02001532 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
Johannes Berg05c914f2008-09-11 00:01:58 +02001533 NL80211_IFTYPE_ADHOC);
Antonio Quartullie584da5e2012-11-25 23:13:42 +01001534 if (ether_addr_equal(bssid, rx->sdata->u.ibss.bssid) &&
1535 test_sta_flag(sta, WLAN_STA_AUTHORIZED)) {
Johannes Berge5a9f8d2015-10-16 17:54:47 +02001536 sta->rx_stats.last_rx = jiffies;
Henning Roggef4ebddf2014-05-01 10:03:46 +02001537 if (ieee80211_is_data(hdr->frame_control) &&
Johannes Berg4f6b1b32016-03-31 20:02:08 +03001538 !is_multicast_ether_addr(hdr->addr1))
1539 sta->rx_stats.last_rate =
1540 sta_stats_encode_rate(status);
Felix Fietkau3af63342011-02-27 22:08:01 +01001541 }
Rostislav Lisovy239281f2014-11-03 10:33:19 +01001542 } else if (rx->sdata->vif.type == NL80211_IFTYPE_OCB) {
Johannes Berge5a9f8d2015-10-16 17:54:47 +02001543 sta->rx_stats.last_rx = jiffies;
Johannes Bergb291ba12009-07-10 15:29:03 +02001544 } else if (!is_multicast_ether_addr(hdr->addr1)) {
1545 /*
Luis Carlos Cobo33b64eb2008-02-23 15:17:10 +01001546 * Mesh beacons will update last_rx when if they are found to
1547 * match the current local configuration when processed.
Johannes Berg571ecf62007-07-27 15:43:22 +02001548 */
Johannes Berge5a9f8d2015-10-16 17:54:47 +02001549 sta->rx_stats.last_rx = jiffies;
Johannes Berg4f6b1b32016-03-31 20:02:08 +03001550 if (ieee80211_is_data(hdr->frame_control))
1551 sta->rx_stats.last_rate = sta_stats_encode_rate(status);
Johannes Berg571ecf62007-07-27 15:43:22 +02001552 }
1553
Kalle Valo3cf335d2009-03-22 21:57:06 +02001554 if (rx->sdata->vif.type == NL80211_IFTYPE_STATION)
1555 ieee80211_sta_rx_notify(rx->sdata, hdr);
1556
Johannes Berge5a9f8d2015-10-16 17:54:47 +02001557 sta->rx_stats.fragments++;
Johannes Berg0f9c5a62016-03-31 20:02:09 +03001558
1559 u64_stats_update_begin(&rx->sta->rx_stats.syncp);
Johannes Berge5a9f8d2015-10-16 17:54:47 +02001560 sta->rx_stats.bytes += rx->skb->len;
Johannes Berg0f9c5a62016-03-31 20:02:09 +03001561 u64_stats_update_end(&rx->sta->rx_stats.syncp);
1562
Felix Fietkaufe8431f2012-03-01 18:00:07 +01001563 if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
Johannes Berge5a9f8d2015-10-16 17:54:47 +02001564 sta->rx_stats.last_signal = status->signal;
Johannes Berg0be6ed12016-03-31 20:02:05 +03001565 ewma_signal_add(&sta->rx_stats_avg.signal, -status->signal);
Felix Fietkaufe8431f2012-03-01 18:00:07 +01001566 }
Johannes Berg571ecf62007-07-27 15:43:22 +02001567
Felix Fietkauef0621e2013-04-22 16:29:31 +02001568 if (status->chains) {
Johannes Berge5a9f8d2015-10-16 17:54:47 +02001569 sta->rx_stats.chains = status->chains;
Felix Fietkauef0621e2013-04-22 16:29:31 +02001570 for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {
1571 int signal = status->chain_signal[i];
1572
1573 if (!(status->chains & BIT(i)))
1574 continue;
1575
Johannes Berge5a9f8d2015-10-16 17:54:47 +02001576 sta->rx_stats.chain_signal_last[i] = signal;
Johannes Berg0be6ed12016-03-31 20:02:05 +03001577 ewma_signal_add(&sta->rx_stats_avg.chain_signal[i],
Johannes Berge5a9f8d2015-10-16 17:54:47 +02001578 -signal);
Felix Fietkauef0621e2013-04-22 16:29:31 +02001579 }
1580 }
1581
Johannes Berg72eaa432008-11-26 15:02:58 +01001582 /*
1583 * Change STA power saving mode only at the end of a frame
1584 * exchange sequence.
1585 */
Johannes Berg30686bf2015-06-02 21:39:54 +02001586 if (!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS) &&
Arik Nemtsovd057e5a2011-01-31 22:29:13 +02001587 !ieee80211_has_morefrags(hdr->frame_control) &&
Emmanuel Grumbach2ec5b682017-06-08 14:00:49 +03001588 !ieee80211_is_back_req(hdr->frame_control) &&
Christian Lamparter4cfda472010-12-27 23:21:26 +01001589 !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
Johannes Berg05c914f2008-09-11 00:01:58 +02001590 (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
Johannes Bergb4ba5442014-01-24 14:41:44 +01001591 rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
Emmanuel Grumbach2ec5b682017-06-08 14:00:49 +03001592 /*
1593 * PM bit is only checked in frames where it isn't reserved,
Johannes Bergb4ba5442014-01-24 14:41:44 +01001594 * in AP mode it's reserved in non-bufferable management frames
1595 * (cf. IEEE 802.11-2012 8.2.4.1.7 Power Management field)
Emmanuel Grumbach2ec5b682017-06-08 14:00:49 +03001596 * BAR frames should be ignored as specified in
1597 * IEEE 802.11-2012 10.2.1.2.
Johannes Bergb4ba5442014-01-24 14:41:44 +01001598 */
1599 (!ieee80211_is_mgmt(hdr->frame_control) ||
1600 ieee80211_is_bufferable_mmpdu(hdr->frame_control))) {
Johannes Bergc2c98fd2011-09-29 16:04:36 +02001601 if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
Johannes Bergb4ba5442014-01-24 14:41:44 +01001602 if (!ieee80211_has_pm(hdr->frame_control))
Marco Porschd012a602012-10-10 12:39:50 -07001603 sta_ps_end(sta);
Johannes Berg72eaa432008-11-26 15:02:58 +01001604 } else {
1605 if (ieee80211_has_pm(hdr->frame_control))
Marco Porschd012a602012-10-10 12:39:50 -07001606 sta_ps_start(sta);
Johannes Berg72eaa432008-11-26 15:02:58 +01001607 }
Johannes Berg571ecf62007-07-27 15:43:22 +02001608 }
1609
Marco Porsch3f52b7e2013-01-30 18:14:08 +01001610 /* mesh power save support */
1611 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
1612 ieee80211_mps_rx_h_sta_process(sta, hdr);
1613
Johannes Berg22403de2009-10-30 12:55:03 +01001614 /*
1615 * Drop (qos-)data::nullfunc frames silently, since they
1616 * are used only to control station power saving mode.
1617 */
1618 if (ieee80211_is_nullfunc(hdr->frame_control) ||
1619 ieee80211_is_qos_nullfunc(hdr->frame_control)) {
Johannes Berg571ecf62007-07-27 15:43:22 +02001620 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
Felix Fietkaud5242152010-01-08 18:06:26 +01001621
1622 /*
1623 * If we receive a 4-addr nullfunc frame from a STA
Johannes Berge7f4a942011-11-04 11:18:20 +01001624 * that was not moved to a 4-addr STA vlan yet send
1625 * the event to userspace and for older hostapd drop
1626 * the frame to the monitor interface.
Felix Fietkaud5242152010-01-08 18:06:26 +01001627 */
1628 if (ieee80211_has_a4(hdr->frame_control) &&
1629 (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1630 (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
Johannes Berge7f4a942011-11-04 11:18:20 +01001631 !rx->sdata->u.vlan.sta))) {
1632 if (!test_and_set_sta_flag(sta, WLAN_STA_4ADDR_EVENT))
1633 cfg80211_rx_unexpected_4addr_frame(
1634 rx->sdata->dev, sta->sta.addr,
1635 GFP_ATOMIC);
Felix Fietkaud5242152010-01-08 18:06:26 +01001636 return RX_DROP_MONITOR;
Johannes Berge7f4a942011-11-04 11:18:20 +01001637 }
Johannes Berg22403de2009-10-30 12:55:03 +01001638 /*
1639 * Update counter and free packet here to avoid
1640 * counting this as a dropped packed.
1641 */
Johannes Berge5a9f8d2015-10-16 17:54:47 +02001642 sta->rx_stats.packets++;
Johannes Berg571ecf62007-07-27 15:43:22 +02001643 dev_kfree_skb(rx->skb);
Johannes Berg9ae54c82008-01-31 19:48:20 +01001644 return RX_QUEUED;
Johannes Berg571ecf62007-07-27 15:43:22 +02001645 }
1646
Johannes Berg9ae54c82008-01-31 19:48:20 +01001647 return RX_CONTINUE;
Johannes Berg571ecf62007-07-27 15:43:22 +02001648} /* ieee80211_rx_h_sta_process */
1649
Johan Almbladh86c228a2013-08-14 15:29:46 +02001650static ieee80211_rx_result debug_noinline
1651ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
1652{
1653 struct sk_buff *skb = rx->skb;
1654 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1655 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1656 int keyidx;
1657 int hdrlen;
1658 ieee80211_rx_result result = RX_DROP_UNUSABLE;
1659 struct ieee80211_key *sta_ptk = NULL;
1660 int mmie_keyidx = -1;
1661 __le16 fc;
Max Stepanov2475b1cc2013-03-24 14:23:27 +02001662 const struct ieee80211_cipher_scheme *cs = NULL;
Johan Almbladh86c228a2013-08-14 15:29:46 +02001663
1664 /*
1665 * Key selection 101
1666 *
1667 * There are four types of keys:
1668 * - GTK (group keys)
1669 * - IGTK (group keys for management frames)
1670 * - PTK (pairwise keys)
1671 * - STK (station-to-station pairwise keys)
1672 *
1673 * When selecting a key, we have to distinguish between multicast
1674 * (including broadcast) and unicast frames, the latter can only
1675 * use PTKs and STKs while the former always use GTKs and IGTKs.
1676 * Unless, of course, actual WEP keys ("pre-RSNA") are used, then
1677 * unicast frames can also use key indices like GTKs. Hence, if we
1678 * don't have a PTK/STK we check the key index for a WEP key.
1679 *
1680 * Note that in a regular BSS, multicast frames are sent by the
1681 * AP only, associated stations unicast the frame to the AP first
1682 * which then multicasts it on their behalf.
1683 *
1684 * There is also a slight problem in IBSS mode: GTKs are negotiated
1685 * with each station, that is something we don't currently handle.
1686 * The spec seems to expect that one negotiates the same key with
1687 * every station but there's no such requirement; VLANs could be
1688 * possible.
1689 */
1690
Johan Almbladh86c228a2013-08-14 15:29:46 +02001691 /* start without a key */
1692 rx->key = NULL;
Johan Almbladh86c228a2013-08-14 15:29:46 +02001693 fc = hdr->frame_control;
1694
Max Stepanov2475b1cc2013-03-24 14:23:27 +02001695 if (rx->sta) {
1696 int keyid = rx->sta->ptk_idx;
1697
1698 if (ieee80211_has_protected(fc) && rx->sta->cipher_scheme) {
1699 cs = rx->sta->cipher_scheme;
Johannes Berg2c61cf92016-03-17 15:02:55 +02001700 keyid = ieee80211_get_cs_keyid(cs, rx->skb);
Max Stepanov2475b1cc2013-03-24 14:23:27 +02001701 if (unlikely(keyid < 0))
1702 return RX_DROP_UNUSABLE;
1703 }
1704 sta_ptk = rcu_dereference(rx->sta->ptk[keyid]);
1705 }
1706
Johan Almbladh86c228a2013-08-14 15:29:46 +02001707 if (!ieee80211_has_protected(fc))
1708 mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);
1709
1710 if (!is_multicast_ether_addr(hdr->addr1) && sta_ptk) {
1711 rx->key = sta_ptk;
1712 if ((status->flag & RX_FLAG_DECRYPTED) &&
1713 (status->flag & RX_FLAG_IV_STRIPPED))
1714 return RX_CONTINUE;
1715 /* Skip decryption if the frame is not protected. */
1716 if (!ieee80211_has_protected(fc))
1717 return RX_CONTINUE;
1718 } else if (mmie_keyidx >= 0) {
1719 /* Broadcast/multicast robust management frame / BIP */
1720 if ((status->flag & RX_FLAG_DECRYPTED) &&
1721 (status->flag & RX_FLAG_IV_STRIPPED))
1722 return RX_CONTINUE;
1723
1724 if (mmie_keyidx < NUM_DEFAULT_KEYS ||
1725 mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
1726 return RX_DROP_MONITOR; /* unexpected BIP keyidx */
Masashi Honma46f6b062016-06-22 19:55:20 +09001727 if (rx->sta) {
1728 if (ieee80211_is_group_privacy_action(skb) &&
1729 test_sta_flag(rx->sta, WLAN_STA_MFP))
1730 return RX_DROP_MONITOR;
1731
Johan Almbladh86c228a2013-08-14 15:29:46 +02001732 rx->key = rcu_dereference(rx->sta->gtk[mmie_keyidx]);
Masashi Honma46f6b062016-06-22 19:55:20 +09001733 }
Johan Almbladh86c228a2013-08-14 15:29:46 +02001734 if (!rx->key)
1735 rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]);
1736 } else if (!ieee80211_has_protected(fc)) {
1737 /*
1738 * The frame was not protected, so skip decryption. However, we
1739 * need to set rx->key if there is a key that could have been
1740 * used so that the frame may be dropped if encryption would
1741 * have been expected.
1742 */
1743 struct ieee80211_key *key = NULL;
1744 struct ieee80211_sub_if_data *sdata = rx->sdata;
1745 int i;
1746
1747 if (ieee80211_is_mgmt(fc) &&
1748 is_multicast_ether_addr(hdr->addr1) &&
1749 (key = rcu_dereference(rx->sdata->default_mgmt_key)))
1750 rx->key = key;
1751 else {
1752 if (rx->sta) {
1753 for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
1754 key = rcu_dereference(rx->sta->gtk[i]);
1755 if (key)
1756 break;
1757 }
1758 }
1759 if (!key) {
1760 for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
1761 key = rcu_dereference(sdata->keys[i]);
1762 if (key)
1763 break;
1764 }
1765 }
1766 if (key)
1767 rx->key = key;
1768 }
1769 return RX_CONTINUE;
1770 } else {
1771 u8 keyid;
Max Stepanov2475b1cc2013-03-24 14:23:27 +02001772
Johan Almbladh86c228a2013-08-14 15:29:46 +02001773 /*
1774 * The device doesn't give us the IV so we won't be
1775 * able to look up the key. That's ok though, we
1776 * don't need to decrypt the frame, we just won't
1777 * be able to keep statistics accurate.
1778 * Except for key threshold notifications, should
1779 * we somehow allow the driver to tell us which key
1780 * the hardware used if this flag is set?
1781 */
1782 if ((status->flag & RX_FLAG_DECRYPTED) &&
1783 (status->flag & RX_FLAG_IV_STRIPPED))
1784 return RX_CONTINUE;
1785
1786 hdrlen = ieee80211_hdrlen(fc);
1787
Max Stepanov2475b1cc2013-03-24 14:23:27 +02001788 if (cs) {
Johannes Berg2c61cf92016-03-17 15:02:55 +02001789 keyidx = ieee80211_get_cs_keyid(cs, rx->skb);
Johan Almbladh86c228a2013-08-14 15:29:46 +02001790
Max Stepanov2475b1cc2013-03-24 14:23:27 +02001791 if (unlikely(keyidx < 0))
1792 return RX_DROP_UNUSABLE;
1793 } else {
1794 if (rx->skb->len < 8 + hdrlen)
1795 return RX_DROP_UNUSABLE; /* TODO: count this? */
1796 /*
1797 * no need to call ieee80211_wep_get_keyidx,
1798 * it verifies a bunch of things we've done already
1799 */
1800 skb_copy_bits(rx->skb, hdrlen + 3, &keyid, 1);
1801 keyidx = keyid >> 6;
1802 }
Johan Almbladh86c228a2013-08-14 15:29:46 +02001803
1804 /* check per-station GTK first, if multicast packet */
1805 if (is_multicast_ether_addr(hdr->addr1) && rx->sta)
1806 rx->key = rcu_dereference(rx->sta->gtk[keyidx]);
1807
1808 /* if not found, try default key */
1809 if (!rx->key) {
1810 rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
1811
1812 /*
1813 * RSNA-protected unicast frames should always be
1814 * sent with pairwise or station-to-station keys,
1815 * but for WEP we allow using a key index as well.
1816 */
1817 if (rx->key &&
1818 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1819 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 &&
1820 !is_multicast_ether_addr(hdr->addr1))
1821 rx->key = NULL;
1822 }
1823 }
1824
1825 if (rx->key) {
1826 if (unlikely(rx->key->flags & KEY_FLAG_TAINTED))
1827 return RX_DROP_MONITOR;
1828
Johan Almbladh86c228a2013-08-14 15:29:46 +02001829 /* TODO: add threshold stuff again */
1830 } else {
1831 return RX_DROP_MONITOR;
1832 }
1833
1834 switch (rx->key->conf.cipher) {
1835 case WLAN_CIPHER_SUITE_WEP40:
1836 case WLAN_CIPHER_SUITE_WEP104:
1837 result = ieee80211_crypto_wep_decrypt(rx);
1838 break;
1839 case WLAN_CIPHER_SUITE_TKIP:
1840 result = ieee80211_crypto_tkip_decrypt(rx);
1841 break;
1842 case WLAN_CIPHER_SUITE_CCMP:
Jouni Malinen2b2ba0d2015-01-24 19:52:07 +02001843 result = ieee80211_crypto_ccmp_decrypt(
1844 rx, IEEE80211_CCMP_MIC_LEN);
1845 break;
1846 case WLAN_CIPHER_SUITE_CCMP_256:
1847 result = ieee80211_crypto_ccmp_decrypt(
1848 rx, IEEE80211_CCMP_256_MIC_LEN);
Johan Almbladh86c228a2013-08-14 15:29:46 +02001849 break;
1850 case WLAN_CIPHER_SUITE_AES_CMAC:
1851 result = ieee80211_crypto_aes_cmac_decrypt(rx);
1852 break;
Jouni Malinen56c52da2015-01-24 19:52:08 +02001853 case WLAN_CIPHER_SUITE_BIP_CMAC_256:
1854 result = ieee80211_crypto_aes_cmac_256_decrypt(rx);
1855 break;
Jouni Malinen8ade5382015-01-24 19:52:09 +02001856 case WLAN_CIPHER_SUITE_BIP_GMAC_128:
1857 case WLAN_CIPHER_SUITE_BIP_GMAC_256:
1858 result = ieee80211_crypto_aes_gmac_decrypt(rx);
1859 break;
Jouni Malinen00b9cfa2015-01-24 19:52:06 +02001860 case WLAN_CIPHER_SUITE_GCMP:
1861 case WLAN_CIPHER_SUITE_GCMP_256:
1862 result = ieee80211_crypto_gcmp_decrypt(rx);
1863 break;
Johan Almbladh86c228a2013-08-14 15:29:46 +02001864 default:
Max Stepanov2475b1cc2013-03-24 14:23:27 +02001865 result = ieee80211_crypto_hw_decrypt(rx);
Johan Almbladh86c228a2013-08-14 15:29:46 +02001866 }
1867
1868 /* the hdr variable is invalid after the decrypt handlers */
1869
1870 /* either the frame has been decrypted or will be dropped */
1871 status->flag |= RX_FLAG_DECRYPTED;
1872
1873 return result;
1874}
1875
Johannes Berg571ecf62007-07-27 15:43:22 +02001876static inline struct ieee80211_fragment_entry *
1877ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
1878 unsigned int frag, unsigned int seq, int rx_queue,
1879 struct sk_buff **skb)
1880{
1881 struct ieee80211_fragment_entry *entry;
Johannes Berg571ecf62007-07-27 15:43:22 +02001882
Johannes Berg571ecf62007-07-27 15:43:22 +02001883 entry = &sdata->fragments[sdata->fragment_next++];
1884 if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
1885 sdata->fragment_next = 0;
1886
Johannes Bergbdcbd8e2012-06-22 11:29:50 +02001887 if (!skb_queue_empty(&entry->skb_list))
Johannes Berg571ecf62007-07-27 15:43:22 +02001888 __skb_queue_purge(&entry->skb_list);
Johannes Berg571ecf62007-07-27 15:43:22 +02001889
1890 __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
1891 *skb = NULL;
1892 entry->first_frag_time = jiffies;
1893 entry->seq = seq;
1894 entry->rx_queue = rx_queue;
1895 entry->last_frag = frag;
Johannes Berg9acc54b2016-02-26 22:13:40 +01001896 entry->check_sequential_pn = false;
Johannes Berg571ecf62007-07-27 15:43:22 +02001897 entry->extra_len = 0;
1898
1899 return entry;
1900}
1901
1902static inline struct ieee80211_fragment_entry *
1903ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
Harvey Harrisonb73d70a2008-07-15 18:44:12 -07001904 unsigned int frag, unsigned int seq,
Johannes Berg571ecf62007-07-27 15:43:22 +02001905 int rx_queue, struct ieee80211_hdr *hdr)
1906{
1907 struct ieee80211_fragment_entry *entry;
1908 int i, idx;
1909
1910 idx = sdata->fragment_next;
1911 for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
1912 struct ieee80211_hdr *f_hdr;
Johannes Berg571ecf62007-07-27 15:43:22 +02001913
1914 idx--;
1915 if (idx < 0)
1916 idx = IEEE80211_FRAGMENT_MAX - 1;
1917
1918 entry = &sdata->fragments[idx];
1919 if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
1920 entry->rx_queue != rx_queue ||
1921 entry->last_frag + 1 != frag)
1922 continue;
1923
Harvey Harrisonb73d70a2008-07-15 18:44:12 -07001924 f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data;
Johannes Berg571ecf62007-07-27 15:43:22 +02001925
Harvey Harrisonb73d70a2008-07-15 18:44:12 -07001926 /*
1927 * Check ftype and addresses are equal, else check next fragment
1928 */
1929 if (((hdr->frame_control ^ f_hdr->frame_control) &
1930 cpu_to_le16(IEEE80211_FCTL_FTYPE)) ||
Joe Perchesb203ca32012-05-08 18:56:52 +00001931 !ether_addr_equal(hdr->addr1, f_hdr->addr1) ||
1932 !ether_addr_equal(hdr->addr2, f_hdr->addr2))
Johannes Berg571ecf62007-07-27 15:43:22 +02001933 continue;
1934
S.Çağlar Onurab466232008-02-14 17:36:47 +02001935 if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
Johannes Berg571ecf62007-07-27 15:43:22 +02001936 __skb_queue_purge(&entry->skb_list);
1937 continue;
1938 }
1939 return entry;
1940 }
1941
1942 return NULL;
1943}
1944
Johannes Berg49461622008-06-30 15:10:45 +02001945static ieee80211_rx_result debug_noinline
Johannes Berg5cf121c2008-02-25 16:27:43 +01001946ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
Johannes Berg571ecf62007-07-27 15:43:22 +02001947{
1948 struct ieee80211_hdr *hdr;
1949 u16 sc;
Harvey Harrison358c8d92008-07-15 18:44:13 -07001950 __le16 fc;
Johannes Berg571ecf62007-07-27 15:43:22 +02001951 unsigned int frag, seq;
1952 struct ieee80211_fragment_entry *entry;
1953 struct sk_buff *skb;
Johannes Berg554891e2010-09-24 12:38:25 +02001954 struct ieee80211_rx_status *status;
Johannes Berg571ecf62007-07-27 15:43:22 +02001955
Harvey Harrisonb73d70a2008-07-15 18:44:12 -07001956 hdr = (struct ieee80211_hdr *)rx->skb->data;
Harvey Harrison358c8d92008-07-15 18:44:13 -07001957 fc = hdr->frame_control;
Javier Cardonaf7fbf702012-10-25 11:10:18 -07001958
1959 if (ieee80211_is_ctl(fc))
1960 return RX_CONTINUE;
1961
Johannes Berg571ecf62007-07-27 15:43:22 +02001962 sc = le16_to_cpu(hdr->seq_ctrl);
1963 frag = sc & IEEE80211_SCTL_FRAG;
1964
Johannes Bergb8fff402014-11-03 13:57:46 +01001965 if (is_multicast_ether_addr(hdr->addr1)) {
Johannes Bergc206ca62015-04-22 20:47:28 +02001966 I802_DEBUG_INC(rx->local->dot11MulticastReceivedFrameCount);
Andreas Müllerd0259332014-12-12 12:11:11 +01001967 goto out_no_led;
Johannes Berg571ecf62007-07-27 15:43:22 +02001968 }
Johannes Bergb8fff402014-11-03 13:57:46 +01001969
Andreas Müllerd0259332014-12-12 12:11:11 +01001970 if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
1971 goto out;
1972
Johannes Berg571ecf62007-07-27 15:43:22 +02001973 I802_DEBUG_INC(rx->local->rx_handlers_fragments);
1974
Zhu Yie3cf8b32010-03-29 17:35:07 +08001975 if (skb_linearize(rx->skb))
1976 return RX_DROP_UNUSABLE;
1977
Abhijeet Kolekar058897a2010-05-11 11:22:11 -07001978 /*
1979 * skb_linearize() might change the skb->data and
1980 * previously cached variables (in this case, hdr) need to
1981 * be refreshed with the new data.
1982 */
1983 hdr = (struct ieee80211_hdr *)rx->skb->data;
Johannes Berg571ecf62007-07-27 15:43:22 +02001984 seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
1985
1986 if (frag == 0) {
1987 /* This is the first fragment of a new frame. */
1988 entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
Johannes Berg9e262972011-07-07 18:45:03 +02001989 rx->seqno_idx, &(rx->skb));
Jouni Malinen2b2ba0d2015-01-24 19:52:07 +02001990 if (rx->key &&
1991 (rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP ||
Johannes Berg9acc54b2016-02-26 22:13:40 +01001992 rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP_256 ||
1993 rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP ||
1994 rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP_256) &&
Harvey Harrison358c8d92008-07-15 18:44:13 -07001995 ieee80211_has_protected(fc)) {
Johannes Berg9e262972011-07-07 18:45:03 +02001996 int queue = rx->security_idx;
Johannes Berg9acc54b2016-02-26 22:13:40 +01001997
1998 /* Store CCMP/GCMP PN so that we can verify that the
1999 * next fragment has a sequential PN value.
2000 */
2001 entry->check_sequential_pn = true;
Johannes Berg571ecf62007-07-27 15:43:22 +02002002 memcpy(entry->last_pn,
Jouni Malinen91902522010-06-11 10:27:33 -07002003 rx->key->u.ccmp.rx_pn[queue],
Johannes Berg4325f6c2013-05-08 13:09:08 +02002004 IEEE80211_CCMP_PN_LEN);
Johannes Berg9acc54b2016-02-26 22:13:40 +01002005 BUILD_BUG_ON(offsetof(struct ieee80211_key,
2006 u.ccmp.rx_pn) !=
2007 offsetof(struct ieee80211_key,
2008 u.gcmp.rx_pn));
2009 BUILD_BUG_ON(sizeof(rx->key->u.ccmp.rx_pn[queue]) !=
2010 sizeof(rx->key->u.gcmp.rx_pn[queue]));
2011 BUILD_BUG_ON(IEEE80211_CCMP_PN_LEN !=
2012 IEEE80211_GCMP_PN_LEN);
Johannes Berg571ecf62007-07-27 15:43:22 +02002013 }
Johannes Berg9ae54c82008-01-31 19:48:20 +01002014 return RX_QUEUED;
Johannes Berg571ecf62007-07-27 15:43:22 +02002015 }
2016
2017 /* This is a fragment for a frame that should already be pending in
2018 * fragment cache. Add this fragment to the end of the pending entry.
2019 */
Johannes Berg9e262972011-07-07 18:45:03 +02002020 entry = ieee80211_reassemble_find(rx->sdata, frag, seq,
2021 rx->seqno_idx, hdr);
Johannes Berg571ecf62007-07-27 15:43:22 +02002022 if (!entry) {
2023 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
Johannes Berge4c26ad2008-01-31 19:48:21 +01002024 return RX_DROP_MONITOR;
Johannes Berg571ecf62007-07-27 15:43:22 +02002025 }
2026
Johannes Berg9acc54b2016-02-26 22:13:40 +01002027 /* "The receiver shall discard MSDUs and MMPDUs whose constituent
2028 * MPDU PN values are not incrementing in steps of 1."
2029 * see IEEE P802.11-REVmc/D5.0, 12.5.3.4.4, item d (for CCMP)
2030 * and IEEE P802.11-REVmc/D5.0, 12.5.5.4.4, item d (for GCMP)
2031 */
2032 if (entry->check_sequential_pn) {
Johannes Berg571ecf62007-07-27 15:43:22 +02002033 int i;
Johannes Berg4325f6c2013-05-08 13:09:08 +02002034 u8 pn[IEEE80211_CCMP_PN_LEN], *rpn;
Jouni Malinen91902522010-06-11 10:27:33 -07002035 int queue;
Johannes Berg9acc54b2016-02-26 22:13:40 +01002036
Jouni Malinen2b2ba0d2015-01-24 19:52:07 +02002037 if (!rx->key ||
2038 (rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP &&
Johannes Berg9acc54b2016-02-26 22:13:40 +01002039 rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP_256 &&
2040 rx->key->conf.cipher != WLAN_CIPHER_SUITE_GCMP &&
2041 rx->key->conf.cipher != WLAN_CIPHER_SUITE_GCMP_256))
Johannes Berge4c26ad2008-01-31 19:48:21 +01002042 return RX_DROP_UNUSABLE;
Johannes Berg4325f6c2013-05-08 13:09:08 +02002043 memcpy(pn, entry->last_pn, IEEE80211_CCMP_PN_LEN);
2044 for (i = IEEE80211_CCMP_PN_LEN - 1; i >= 0; i--) {
Johannes Berg571ecf62007-07-27 15:43:22 +02002045 pn[i]++;
2046 if (pn[i])
2047 break;
2048 }
Johannes Berg9e262972011-07-07 18:45:03 +02002049 queue = rx->security_idx;
Jouni Malinen91902522010-06-11 10:27:33 -07002050 rpn = rx->key->u.ccmp.rx_pn[queue];
Johannes Berg4325f6c2013-05-08 13:09:08 +02002051 if (memcmp(pn, rpn, IEEE80211_CCMP_PN_LEN))
Johannes Berge4c26ad2008-01-31 19:48:21 +01002052 return RX_DROP_UNUSABLE;
Johannes Berg4325f6c2013-05-08 13:09:08 +02002053 memcpy(entry->last_pn, pn, IEEE80211_CCMP_PN_LEN);
Johannes Berg571ecf62007-07-27 15:43:22 +02002054 }
2055
Harvey Harrison358c8d92008-07-15 18:44:13 -07002056 skb_pull(rx->skb, ieee80211_hdrlen(fc));
Johannes Berg571ecf62007-07-27 15:43:22 +02002057 __skb_queue_tail(&entry->skb_list, rx->skb);
2058 entry->last_frag = frag;
2059 entry->extra_len += rx->skb->len;
Harvey Harrison358c8d92008-07-15 18:44:13 -07002060 if (ieee80211_has_morefrags(fc)) {
Johannes Berg571ecf62007-07-27 15:43:22 +02002061 rx->skb = NULL;
Johannes Berg9ae54c82008-01-31 19:48:20 +01002062 return RX_QUEUED;
Johannes Berg571ecf62007-07-27 15:43:22 +02002063 }
2064
2065 rx->skb = __skb_dequeue(&entry->skb_list);
2066 if (skb_tailroom(rx->skb) < entry->extra_len) {
Johannes Bergf1160432015-04-22 20:25:20 +02002067 I802_DEBUG_INC(rx->local->rx_expand_skb_head_defrag);
Johannes Berg571ecf62007-07-27 15:43:22 +02002068 if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
2069 GFP_ATOMIC))) {
2070 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
2071 __skb_queue_purge(&entry->skb_list);
Johannes Berge4c26ad2008-01-31 19:48:21 +01002072 return RX_DROP_UNUSABLE;
Johannes Berg571ecf62007-07-27 15:43:22 +02002073 }
2074 }
2075 while ((skb = __skb_dequeue(&entry->skb_list))) {
2076 memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len);
2077 dev_kfree_skb(skb);
2078 }
2079
2080 /* Complete frame has been reassembled - process it now */
Johannes Berg554891e2010-09-24 12:38:25 +02002081 status = IEEE80211_SKB_RXCB(rx->skb);
Johannes Berg571ecf62007-07-27 15:43:22 +02002082
2083 out:
Andreas Müllerd0259332014-12-12 12:11:11 +01002084 ieee80211_led_rx(rx->local);
2085 out_no_led:
Johannes Berg571ecf62007-07-27 15:43:22 +02002086 if (rx->sta)
Johannes Berge5a9f8d2015-10-16 17:54:47 +02002087 rx->sta->rx_stats.packets++;
Johannes Berg9ae54c82008-01-31 19:48:20 +01002088 return RX_CONTINUE;
Johannes Berg571ecf62007-07-27 15:43:22 +02002089}
2090
Johannes Berg1df332e2012-10-26 00:09:11 +02002091static int ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
Johannes Berg571ecf62007-07-27 15:43:22 +02002092{
Johannes Berg1df332e2012-10-26 00:09:11 +02002093 if (unlikely(!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_AUTHORIZED)))
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002094 return -EACCES;
Johannes Berg571ecf62007-07-27 15:43:22 +02002095
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002096 return 0;
Johannes Berg571ecf62007-07-27 15:43:22 +02002097}
2098
Johannes Berg1df332e2012-10-26 00:09:11 +02002099static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
Johannes Berg571ecf62007-07-27 15:43:22 +02002100{
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01002101 struct sk_buff *skb = rx->skb;
2102 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2103
Johannes Berg3017b802007-08-28 17:01:53 -04002104 /*
Johannes Berg7848ba72007-09-14 11:10:25 -04002105 * Pass through unencrypted frames if the hardware has
2106 * decrypted them already.
Johannes Berg3017b802007-08-28 17:01:53 -04002107 */
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01002108 if (status->flag & RX_FLAG_DECRYPTED)
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002109 return 0;
Johannes Berg571ecf62007-07-27 15:43:22 +02002110
2111 /* Drop unencrypted frames if key is set. */
Harvey Harrison358c8d92008-07-15 18:44:13 -07002112 if (unlikely(!ieee80211_has_protected(fc) &&
2113 !ieee80211_is_nullfunc(fc) &&
Johannes Berge8f4fb72015-03-20 11:37:36 +01002114 ieee80211_is_data(fc) && rx->key))
Jouni Malinen3cfcf6ac2009-01-08 13:32:02 +02002115 return -EACCES;
Johannes Bergbef5d1c2010-02-16 11:05:00 +01002116
2117 return 0;
2118}
2119
Johannes Berg1df332e2012-10-26 00:09:11 +02002120static int ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)
Johannes Bergbef5d1c2010-02-16 11:05:00 +01002121{
2122 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
Jouni Malinene3efca02010-03-28 22:31:15 -07002123 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
Johannes Bergbef5d1c2010-02-16 11:05:00 +01002124 __le16 fc = hdr->frame_control;
Johannes Bergbef5d1c2010-02-16 11:05:00 +01002125
Jouni Malinene3efca02010-03-28 22:31:15 -07002126 /*
2127 * Pass through unencrypted frames if the hardware has
2128 * decrypted them already.
2129 */
2130 if (status->flag & RX_FLAG_DECRYPTED)
2131 return 0;
Johannes Bergbef5d1c2010-02-16 11:05:00 +01002132
Johannes Bergc2c98fd2011-09-29 16:04:36 +02002133 if (rx->sta && test_sta_flag(rx->sta, WLAN_STA_MFP)) {
Jouni Malinend211e902010-03-28 22:29:52 -07002134 if (unlikely(!ieee80211_has_protected(fc) &&
2135 ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
Jouni Malinencf4e5942010-12-16 00:52:40 +02002136 rx->key)) {
Johannes Berg6ff57cf2013-05-16 00:55:00 +02002137 if (ieee80211_is_deauth(fc) ||
2138 ieee80211_is_disassoc(fc))
2139 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
2140 rx->skb->data,
2141 rx->skb->len);
Jouni Malinenf2ca3ea2009-05-08 12:36:03 +03002142 return -EACCES;
Jouni Malinencf4e5942010-12-16 00:52:40 +02002143 }
Jouni Malinenf2ca3ea2009-05-08 12:36:03 +03002144 /* BIP does not use Protected field, so need to check MMIE */
Joe Perchesf64f9e72009-11-29 16:55:45 -08002145 if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
Jouni Malinencf4e5942010-12-16 00:52:40 +02002146 ieee80211_get_mmie_keyidx(rx->skb) < 0)) {
Johannes Berg6ff57cf2013-05-16 00:55:00 +02002147 if (ieee80211_is_deauth(fc) ||
2148 ieee80211_is_disassoc(fc))
2149 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
2150 rx->skb->data,
2151 rx->skb->len);
Jouni Malinenf2ca3ea2009-05-08 12:36:03 +03002152 return -EACCES;
Jouni Malinencf4e5942010-12-16 00:52:40 +02002153 }
Jouni Malinenf2ca3ea2009-05-08 12:36:03 +03002154 /*
2155 * When using MFP, Action frames are not allowed prior to
2156 * having configured keys.
2157 */
2158 if (unlikely(ieee80211_is_action(fc) && !rx->key &&
Johannes Bergd8ca16d2014-01-23 16:20:29 +01002159 ieee80211_is_robust_mgmt_frame(rx->skb)))
Jouni Malinenf2ca3ea2009-05-08 12:36:03 +03002160 return -EACCES;
2161 }
Johannes Bergb3fc9c62008-04-13 10:12:47 +02002162
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002163 return 0;
Johannes Berg571ecf62007-07-27 15:43:22 +02002164}
2165
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002166static int
Felix Fietkau4114fa22011-04-12 19:15:22 +02002167__ieee80211_data_to_8023(struct ieee80211_rx_data *rx, bool *port_control)
Johannes Berg571ecf62007-07-27 15:43:22 +02002168{
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01002169 struct ieee80211_sub_if_data *sdata = rx->sdata;
Felix Fietkauf14543ee2009-11-10 20:10:05 +01002170 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
Felix Fietkaufbb327c2011-01-18 15:48:48 +01002171 bool check_port_control = false;
2172 struct ethhdr *ehdr;
2173 int ret;
Felix Fietkauf14543ee2009-11-10 20:10:05 +01002174
Felix Fietkau4114fa22011-04-12 19:15:22 +02002175 *port_control = false;
Johannes Berg9bc383d2009-11-19 11:55:19 +01002176 if (ieee80211_has_a4(hdr->frame_control) &&
2177 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta)
Felix Fietkauf14543ee2009-11-10 20:10:05 +01002178 return -1;
Johannes Berg9bc383d2009-11-19 11:55:19 +01002179
Felix Fietkaufbb327c2011-01-18 15:48:48 +01002180 if (sdata->vif.type == NL80211_IFTYPE_STATION &&
2181 !!sdata->u.mgd.use_4addr != !!ieee80211_has_a4(hdr->frame_control)) {
2182
2183 if (!sdata->u.mgd.use_4addr)
2184 return -1;
2185 else
2186 check_port_control = true;
2187 }
2188
Johannes Berg9bc383d2009-11-19 11:55:19 +01002189 if (is_multicast_ether_addr(hdr->addr1) &&
Felix Fietkaufbb327c2011-01-18 15:48:48 +01002190 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta)
Felix Fietkauf14543ee2009-11-10 20:10:05 +01002191 return -1;
Johannes Berg571ecf62007-07-27 15:43:22 +02002192
Felix Fietkaufbb327c2011-01-18 15:48:48 +01002193 ret = ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type);
Felix Fietkau4114fa22011-04-12 19:15:22 +02002194 if (ret < 0)
Felix Fietkaufbb327c2011-01-18 15:48:48 +01002195 return ret;
2196
2197 ehdr = (struct ethhdr *) rx->skb->data;
Felix Fietkau4114fa22011-04-12 19:15:22 +02002198 if (ehdr->h_proto == rx->sdata->control_port_protocol)
2199 *port_control = true;
2200 else if (check_port_control)
Felix Fietkaufbb327c2011-01-18 15:48:48 +01002201 return -1;
2202
2203 return 0;
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002204}
Johannes Berg571ecf62007-07-27 15:43:22 +02002205
Johannes Bergce3edf6d02007-12-19 01:31:22 +01002206/*
2207 * requires that rx->skb is a frame with ethernet header
2208 */
Harvey Harrison358c8d92008-07-15 18:44:13 -07002209static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
Johannes Bergce3edf6d02007-12-19 01:31:22 +01002210{
Senthil Balasubramanianc97c23e2008-05-28 23:15:32 +05302211 static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
Johannes Bergce3edf6d02007-12-19 01:31:22 +01002212 = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
2213 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
2214
2215 /*
2216 * Allow EAPOL frames to us/the PAE group address regardless
2217 * of whether the frame was encrypted or not.
2218 */
Johannes Berga621fa42010-08-27 14:26:54 +03002219 if (ehdr->h_proto == rx->sdata->control_port_protocol &&
Joe Perches3bc79452012-05-08 18:56:53 +00002220 (ether_addr_equal(ehdr->h_dest, rx->sdata->vif.addr) ||
2221 ether_addr_equal(ehdr->h_dest, pae_group_addr)))
Johannes Bergce3edf6d02007-12-19 01:31:22 +01002222 return true;
2223
2224 if (ieee80211_802_1x_port_control(rx) ||
Harvey Harrison358c8d92008-07-15 18:44:13 -07002225 ieee80211_drop_unencrypted(rx, fc))
Johannes Bergce3edf6d02007-12-19 01:31:22 +01002226 return false;
2227
2228 return true;
2229}
2230
2231/*
2232 * requires that rx->skb is a frame with ethernet header
2233 */
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002234static void
Johannes Berg5cf121c2008-02-25 16:27:43 +01002235ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002236{
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01002237 struct ieee80211_sub_if_data *sdata = rx->sdata;
2238 struct net_device *dev = sdata->dev;
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002239 struct sk_buff *skb, *xmit_skb;
Johannes Bergce3edf6d02007-12-19 01:31:22 +01002240 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
2241 struct sta_info *dsta;
Johannes Berg571ecf62007-07-27 15:43:22 +02002242
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002243 skb = rx->skb;
2244 xmit_skb = NULL;
Johannes Berg571ecf62007-07-27 15:43:22 +02002245
Johannes Berg5a490512015-04-22 17:10:38 +02002246 ieee80211_rx_stats(dev, skb->len);
2247
Johannes Bergde8f18d2016-03-31 20:02:03 +03002248 if (rx->sta) {
2249 /* The seqno index has the same property as needed
2250 * for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS
2251 * for non-QoS-data frames. Here we know it's a data
2252 * frame, so count MSDUs.
2253 */
Johannes Berg0f9c5a62016-03-31 20:02:09 +03002254 u64_stats_update_begin(&rx->sta->rx_stats.syncp);
Johannes Bergde8f18d2016-03-31 20:02:03 +03002255 rx->sta->rx_stats.msdu[rx->seqno_idx]++;
Johannes Berg0f9c5a62016-03-31 20:02:09 +03002256 u64_stats_update_end(&rx->sta->rx_stats.syncp);
Johannes Bergde8f18d2016-03-31 20:02:03 +03002257 }
2258
Johannes Berg05c914f2008-09-11 00:01:58 +02002259 if ((sdata->vif.type == NL80211_IFTYPE_AP ||
2260 sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
Johannes Berg213cd112008-09-11 00:01:54 +02002261 !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
Johannes Berg9bc383d2009-11-19 11:55:19 +01002262 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) {
Johannes Bergce3edf6d02007-12-19 01:31:22 +01002263 if (is_multicast_ether_addr(ehdr->h_dest)) {
2264 /*
2265 * send multicast frames both to higher layers in
2266 * local net stack and back to the wireless medium
2267 */
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002268 xmit_skb = skb_copy(skb, GFP_ATOMIC);
Joe Perchese87cc472012-05-13 21:56:26 +00002269 if (!xmit_skb)
Johannes Bergbdcbd8e2012-06-22 11:29:50 +02002270 net_info_ratelimited("%s: failed to clone multicast frame\n",
Joe Perchese87cc472012-05-13 21:56:26 +00002271 dev->name);
Johannes Berg571ecf62007-07-27 15:43:22 +02002272 } else {
Johannes Bergabe60632009-11-25 17:46:18 +01002273 dsta = sta_info_get(sdata, skb->data);
2274 if (dsta) {
Johannes Bergce3edf6d02007-12-19 01:31:22 +01002275 /*
2276 * The destination station is associated to
2277 * this AP (in this VLAN), so send the frame
2278 * directly to it and do not pass it to local
2279 * net stack.
Johannes Berg571ecf62007-07-27 15:43:22 +02002280 */
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002281 xmit_skb = skb;
Johannes Berg571ecf62007-07-27 15:43:22 +02002282 skb = NULL;
2283 }
Johannes Berg571ecf62007-07-27 15:43:22 +02002284 }
2285 }
2286
Kalle Valo59d9cb02009-12-17 13:54:57 +01002287#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
Johannes Berg9e890a1f2013-12-04 09:16:31 +01002288 if (skb) {
2289 /* 'align' will only take the values 0 or 2 here since all
2290 * frames are required to be aligned to 2-byte boundaries
2291 * when being passed to mac80211; the code here works just
2292 * as well if that isn't true, but mac80211 assumes it can
2293 * access fields as 2-byte aligned (e.g. for ether_addr_equal)
Johannes Bergd1c3a372009-01-07 00:26:10 +01002294 */
Johannes Berg9e890a1f2013-12-04 09:16:31 +01002295 int align;
2296
2297 align = (unsigned long)(skb->data + sizeof(struct ethhdr)) & 3;
Johannes Bergd1c3a372009-01-07 00:26:10 +01002298 if (align) {
2299 if (WARN_ON(skb_headroom(skb) < 3)) {
2300 dev_kfree_skb(skb);
2301 skb = NULL;
2302 } else {
2303 u8 *data = skb->data;
Zhu Yi8ce0b582009-10-28 13:13:52 -07002304 size_t len = skb_headlen(skb);
2305 skb->data -= align;
2306 memmove(skb->data, data, len);
2307 skb_set_tail_pointer(skb, len);
Johannes Bergd1c3a372009-01-07 00:26:10 +01002308 }
2309 }
Johannes Berg9e890a1f2013-12-04 09:16:31 +01002310 }
Johannes Bergd1c3a372009-01-07 00:26:10 +01002311#endif
2312
Johannes Berg9e890a1f2013-12-04 09:16:31 +01002313 if (skb) {
2314 /* deliver to local stack */
2315 skb->protocol = eth_type_trans(skb, dev);
2316 memset(skb->cb, 0, sizeof(skb->cb));
Johannes Bergaf9f9b22015-06-11 16:02:32 +02002317 if (rx->napi)
2318 napi_gro_receive(rx->napi, skb);
Johannes Berg06d181a2014-02-04 20:51:09 +01002319 else
2320 netif_receive_skb(skb);
Johannes Berg571ecf62007-07-27 15:43:22 +02002321 }
2322
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002323 if (xmit_skb) {
Helmut Schaaaef6c922011-12-21 09:11:35 +01002324 /*
2325 * Send to wireless media and increase priority by 256 to
2326 * keep the received priority instead of reclassifying
2327 * the frame (see cfg80211_classify8021d).
2328 */
2329 xmit_skb->priority += 256;
YOSHIFUJI Hideakif831e902007-12-12 03:54:23 +09002330 xmit_skb->protocol = htons(ETH_P_802_3);
Johannes Bergce3edf6d02007-12-19 01:31:22 +01002331 skb_reset_network_header(xmit_skb);
2332 skb_reset_mac_header(xmit_skb);
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002333 dev_queue_xmit(xmit_skb);
Johannes Berg571ecf62007-07-27 15:43:22 +02002334 }
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002335}
2336
Johannes Berg49461622008-06-30 15:10:45 +02002337static ieee80211_rx_result debug_noinline
Johannes Berg5cf121c2008-02-25 16:27:43 +01002338ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02002339{
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01002340 struct net_device *dev = rx->sdata->dev;
Zhu Yieaf85ca2009-12-01 10:18:37 +08002341 struct sk_buff *skb = rx->skb;
Harvey Harrison358c8d92008-07-15 18:44:13 -07002342 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
2343 __le16 fc = hdr->frame_control;
Zhu Yieaf85ca2009-12-01 10:18:37 +08002344 struct sk_buff_head frame_list;
Johannes Berg554891e2010-09-24 12:38:25 +02002345 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
Johannes Berg7f6990c2016-10-05 15:29:49 +02002346 struct ethhdr ethhdr;
Johannes Berge2b52272016-10-05 16:42:06 +02002347 const u8 *check_da = ethhdr.h_dest, *check_sa = ethhdr.h_source;
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02002348
Harvey Harrison358c8d92008-07-15 18:44:13 -07002349 if (unlikely(!ieee80211_is_data(fc)))
Johannes Berg9ae54c82008-01-31 19:48:20 +01002350 return RX_CONTINUE;
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02002351
Harvey Harrison358c8d92008-07-15 18:44:13 -07002352 if (unlikely(!ieee80211_is_data_present(fc)))
Johannes Berge4c26ad2008-01-31 19:48:21 +01002353 return RX_DROP_MONITOR;
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02002354
Johannes Berg554891e2010-09-24 12:38:25 +02002355 if (!(status->rx_flags & IEEE80211_RX_AMSDU))
Johannes Berg9ae54c82008-01-31 19:48:20 +01002356 return RX_CONTINUE;
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02002357
Johannes Bergea720932016-10-05 10:14:42 +02002358 if (unlikely(ieee80211_has_a4(hdr->frame_control))) {
2359 switch (rx->sdata->vif.type) {
2360 case NL80211_IFTYPE_AP_VLAN:
2361 if (!rx->sdata->u.vlan.sta)
2362 return RX_DROP_UNUSABLE;
2363 break;
2364 case NL80211_IFTYPE_STATION:
2365 if (!rx->sdata->u.mgd.use_4addr)
2366 return RX_DROP_UNUSABLE;
2367 break;
2368 default:
2369 return RX_DROP_UNUSABLE;
2370 }
Johannes Berge2b52272016-10-05 16:42:06 +02002371 check_da = NULL;
2372 check_sa = NULL;
2373 } else switch (rx->sdata->vif.type) {
2374 case NL80211_IFTYPE_AP:
2375 case NL80211_IFTYPE_AP_VLAN:
2376 check_da = NULL;
2377 break;
2378 case NL80211_IFTYPE_STATION:
2379 if (!rx->sta ||
2380 !test_sta_flag(rx->sta, WLAN_STA_TDLS_PEER))
2381 check_sa = NULL;
2382 break;
2383 case NL80211_IFTYPE_MESH_POINT:
2384 check_sa = NULL;
2385 break;
2386 default:
2387 break;
Johannes Bergea720932016-10-05 10:14:42 +02002388 }
Zhu Yieaf85ca2009-12-01 10:18:37 +08002389
Johannes Bergea720932016-10-05 10:14:42 +02002390 if (is_multicast_ether_addr(hdr->addr1))
Johannes Berge4c26ad2008-01-31 19:48:21 +01002391 return RX_DROP_UNUSABLE;
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02002392
2393 skb->dev = dev;
Zhu Yieaf85ca2009-12-01 10:18:37 +08002394 __skb_queue_head_init(&frame_list);
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02002395
Johannes Berg7f6990c2016-10-05 15:29:49 +02002396 if (ieee80211_data_to_8023_exthdr(skb, &ethhdr,
2397 rx->sdata->vif.addr,
2398 rx->sdata->vif.type))
2399 return RX_DROP_UNUSABLE;
2400
Zhu Yieaf85ca2009-12-01 10:18:37 +08002401 ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
2402 rx->sdata->vif.type,
Johannes Berg8b935ee2016-10-05 16:17:01 +02002403 rx->local->hw.extra_tx_headroom,
Johannes Berge2b52272016-10-05 16:42:06 +02002404 check_da, check_sa);
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02002405
Zhu Yieaf85ca2009-12-01 10:18:37 +08002406 while (!skb_queue_empty(&frame_list)) {
2407 rx->skb = __skb_dequeue(&frame_list);
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02002408
Harvey Harrison358c8d92008-07-15 18:44:13 -07002409 if (!ieee80211_frame_allowed(rx, fc)) {
Zhu Yieaf85ca2009-12-01 10:18:37 +08002410 dev_kfree_skb(rx->skb);
Johannes Bergce3edf6d02007-12-19 01:31:22 +01002411 continue;
2412 }
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02002413
2414 ieee80211_deliver_skb(rx);
2415 }
2416
Johannes Berg9ae54c82008-01-31 19:48:20 +01002417 return RX_QUEUED;
Ron Rindjunskyfd4c7f22007-11-26 16:14:33 +02002418}
2419
Ingo Molnarbf94e172008-10-12 23:51:38 -07002420#ifdef CONFIG_MAC80211_MESH
Davide Pesaventob0dee572008-09-27 17:29:12 +02002421static ieee80211_rx_result
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02002422ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
2423{
Thomas Pedersen30789eb2011-11-24 17:15:26 -08002424 struct ieee80211_hdr *fwd_hdr, *hdr;
2425 struct ieee80211_tx_info *info;
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02002426 struct ieee80211s_hdr *mesh_hdr;
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02002427 struct sk_buff *skb = rx->skb, *fwd_skb;
Johannes Berg3b8d81e02009-06-17 17:43:56 +02002428 struct ieee80211_local *local = rx->local;
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01002429 struct ieee80211_sub_if_data *sdata = rx->sdata;
Thomas Pedersen30789eb2011-11-24 17:15:26 -08002430 struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
Michal Kaziorcf440122016-01-25 14:43:24 +01002431 u16 ac, q, hdrlen;
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02002432
2433 hdr = (struct ieee80211_hdr *) skb->data;
2434 hdrlen = ieee80211_hdrlen(hdr->frame_control);
Johannes Berg9b395bc2012-10-26 00:36:40 +02002435
2436 /* make sure fixed part of mesh header is there, also checks skb len */
2437 if (!pskb_may_pull(rx->skb, hdrlen + 6))
2438 return RX_DROP_MONITOR;
2439
2440 mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
2441
2442 /* make sure full mesh header is there, also checks skb len */
2443 if (!pskb_may_pull(rx->skb,
2444 hdrlen + ieee80211_get_mesh_hdrlen(mesh_hdr)))
2445 return RX_DROP_MONITOR;
2446
2447 /* reload pointers */
2448 hdr = (struct ieee80211_hdr *) skb->data;
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02002449 mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
2450
Bob Copelandd0c22112015-03-02 14:28:52 -05002451 if (ieee80211_drop_unencrypted(rx, hdr->frame_control))
2452 return RX_DROP_MONITOR;
2453
Thomas Pedersen2157fdd2011-09-01 12:32:14 -07002454 /* frame is in RMC, don't forward */
2455 if (ieee80211_is_data(hdr->frame_control) &&
2456 is_multicast_ether_addr(hdr->addr1) &&
Johannes Bergbf7cd942013-02-15 14:40:31 +01002457 mesh_rmc_check(rx->sdata, hdr->addr3, mesh_hdr))
Thomas Pedersen2157fdd2011-09-01 12:32:14 -07002458 return RX_DROP_MONITOR;
2459
Johannes Berg5c900672015-04-22 14:48:34 +02002460 if (!ieee80211_is_data(hdr->frame_control))
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02002461 return RX_CONTINUE;
2462
2463 if (!mesh_hdr->ttl)
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02002464 return RX_DROP_MONITOR;
2465
Javier Cardona43b7b312009-10-15 18:10:51 -07002466 if (mesh_hdr->flags & MESH_FLAGS_AE) {
YanBo79617de2008-09-22 13:30:32 +08002467 struct mesh_path *mppath;
Javier Cardona43b7b312009-10-15 18:10:51 -07002468 char *proxied_addr;
2469 char *mpp_addr;
2470
2471 if (is_multicast_ether_addr(hdr->addr1)) {
2472 mpp_addr = hdr->addr3;
2473 proxied_addr = mesh_hdr->eaddr1;
Rajkumar Manoharan6568f8f2017-05-14 21:41:55 -07002474 } else if ((mesh_hdr->flags & MESH_FLAGS_AE) ==
2475 MESH_FLAGS_AE_A5_A6) {
Johannes Berg9b395bc2012-10-26 00:36:40 +02002476 /* has_a4 already checked in ieee80211_rx_mesh_check */
Javier Cardona43b7b312009-10-15 18:10:51 -07002477 mpp_addr = hdr->addr4;
2478 proxied_addr = mesh_hdr->eaddr2;
Johannes Berg9b395bc2012-10-26 00:36:40 +02002479 } else {
2480 return RX_DROP_MONITOR;
Javier Cardona43b7b312009-10-15 18:10:51 -07002481 }
YanBo79617de2008-09-22 13:30:32 +08002482
YanBo79617de2008-09-22 13:30:32 +08002483 rcu_read_lock();
Johannes Bergbf7cd942013-02-15 14:40:31 +01002484 mppath = mpp_path_lookup(sdata, proxied_addr);
YanBo79617de2008-09-22 13:30:32 +08002485 if (!mppath) {
Johannes Bergbf7cd942013-02-15 14:40:31 +01002486 mpp_path_add(sdata, proxied_addr, mpp_addr);
YanBo79617de2008-09-22 13:30:32 +08002487 } else {
2488 spin_lock_bh(&mppath->state_lock);
Joe Perchesb203ca32012-05-08 18:56:52 +00002489 if (!ether_addr_equal(mppath->mpp, mpp_addr))
Javier Cardona43b7b312009-10-15 18:10:51 -07002490 memcpy(mppath->mpp, mpp_addr, ETH_ALEN);
Henning Roggeab1c7902016-02-03 13:58:37 +01002491 mppath->exp_time = jiffies;
YanBo79617de2008-09-22 13:30:32 +08002492 spin_unlock_bh(&mppath->state_lock);
2493 }
2494 rcu_read_unlock();
2495 }
2496
Javier Cardona3c5772a2009-08-10 12:15:48 -07002497 /* Frame has reached destination. Don't forward */
2498 if (!is_multicast_ether_addr(hdr->addr1) &&
Joe Perchesb203ca32012-05-08 18:56:52 +00002499 ether_addr_equal(sdata->vif.addr, hdr->addr3))
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02002500 return RX_CONTINUE;
2501
Michal Kaziorcf440122016-01-25 14:43:24 +01002502 ac = ieee80211_select_queue_80211(sdata, skb, hdr);
2503 q = sdata->vif.hw_queue[ac];
Thomas Pedersend3c15972011-11-24 17:15:23 -08002504 if (ieee80211_queue_stopped(&local->hw, q)) {
Thomas Pedersen30789eb2011-11-24 17:15:26 -08002505 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion);
Thomas Pedersend3c15972011-11-24 17:15:23 -08002506 return RX_DROP_MONITOR;
2507 }
2508 skb_set_queue_mapping(skb, q);
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02002509
Thomas Pedersen30789eb2011-11-24 17:15:26 -08002510 if (!--mesh_hdr->ttl) {
2511 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl);
Javier Cardona2ac64cd2012-10-24 12:43:31 -07002512 goto out;
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02002513 }
2514
Chun-Yeow Yeohd6655082012-03-02 02:03:19 +08002515 if (!ifmsh->mshcfg.dot11MeshForwarding)
2516 goto out;
2517
Thomas Pedersen30789eb2011-11-24 17:15:26 -08002518 fwd_skb = skb_copy(skb, GFP_ATOMIC);
2519 if (!fwd_skb) {
Johannes Bergbdcbd8e2012-06-22 11:29:50 +02002520 net_info_ratelimited("%s: failed to clone mesh frame\n",
Joe Perchese87cc472012-05-13 21:56:26 +00002521 sdata->name);
Thomas Pedersen30789eb2011-11-24 17:15:26 -08002522 goto out;
2523 }
2524
2525 fwd_hdr = (struct ieee80211_hdr *) fwd_skb->data;
Thomas Pedersen9d6d6f42013-04-08 11:06:12 -07002526 fwd_hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_RETRY);
Thomas Pedersen30789eb2011-11-24 17:15:26 -08002527 info = IEEE80211_SKB_CB(fwd_skb);
2528 memset(info, 0, sizeof(*info));
2529 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
2530 info->control.vif = &rx->sdata->vif;
2531 info->control.jiffies = jiffies;
2532 if (is_multicast_ether_addr(fwd_hdr->addr1)) {
2533 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_mcast);
2534 memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
Marco Porsch3f52b7e2013-01-30 18:14:08 +01002535 /* update power mode indication when forwarding */
2536 ieee80211_mps_set_frame_flags(sdata, NULL, fwd_hdr);
Johannes Bergbf7cd942013-02-15 14:40:31 +01002537 } else if (!mesh_nexthop_lookup(sdata, fwd_skb)) {
Marco Porsch3f52b7e2013-01-30 18:14:08 +01002538 /* mesh power mode flags updated in mesh_nexthop_lookup */
Thomas Pedersen30789eb2011-11-24 17:15:26 -08002539 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast);
2540 } else {
2541 /* unable to resolve next hop */
Johannes Bergbf7cd942013-02-15 14:40:31 +01002542 mesh_path_error_tx(sdata, ifmsh->mshcfg.element_ttl,
Chun-Yeow Yeohf63f8422013-11-13 15:39:12 +08002543 fwd_hdr->addr3, 0,
2544 WLAN_REASON_MESH_PATH_NOFORWARD,
2545 fwd_hdr->addr2);
Thomas Pedersen30789eb2011-11-24 17:15:26 -08002546 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_no_route);
Jesper Juhl74b8cc32012-01-14 21:52:17 +01002547 kfree_skb(fwd_skb);
Thomas Pedersen30789eb2011-11-24 17:15:26 -08002548 return RX_DROP_MONITOR;
2549 }
2550
2551 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
2552 ieee80211_add_pending_skb(local, fwd_skb);
Johannes Bergb51aff02010-12-22 10:15:07 +01002553 out:
Johannes Bergdf140462015-04-22 14:40:58 +02002554 if (is_multicast_ether_addr(hdr->addr1))
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02002555 return RX_CONTINUE;
Johannes Bergdf140462015-04-22 14:40:58 +02002556 return RX_DROP_MONITOR;
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02002557}
Ingo Molnarbf94e172008-10-12 23:51:38 -07002558#endif
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02002559
2560static ieee80211_rx_result debug_noinline
Johannes Berg5cf121c2008-02-25 16:27:43 +01002561ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002562{
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01002563 struct ieee80211_sub_if_data *sdata = rx->sdata;
Vivek Natarajane15276a2010-02-08 17:47:01 +05302564 struct ieee80211_local *local = rx->local;
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01002565 struct net_device *dev = sdata->dev;
Harvey Harrison358c8d92008-07-15 18:44:13 -07002566 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
2567 __le16 fc = hdr->frame_control;
Felix Fietkau4114fa22011-04-12 19:15:22 +02002568 bool port_control;
Johannes Bergce3edf6d02007-12-19 01:31:22 +01002569 int err;
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002570
Harvey Harrison358c8d92008-07-15 18:44:13 -07002571 if (unlikely(!ieee80211_is_data(hdr->frame_control)))
Johannes Berg9ae54c82008-01-31 19:48:20 +01002572 return RX_CONTINUE;
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002573
Harvey Harrison358c8d92008-07-15 18:44:13 -07002574 if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
Johannes Berge4c26ad2008-01-31 19:48:21 +01002575 return RX_DROP_MONITOR;
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002576
Felix Fietkauf14543ee2009-11-10 20:10:05 +01002577 /*
Johannes Berge7f4a942011-11-04 11:18:20 +01002578 * Send unexpected-4addr-frame event to hostapd. For older versions,
2579 * also drop the frame to cooked monitor interfaces.
Felix Fietkauf14543ee2009-11-10 20:10:05 +01002580 */
2581 if (ieee80211_has_a4(hdr->frame_control) &&
Johannes Berge7f4a942011-11-04 11:18:20 +01002582 sdata->vif.type == NL80211_IFTYPE_AP) {
2583 if (rx->sta &&
2584 !test_and_set_sta_flag(rx->sta, WLAN_STA_4ADDR_EVENT))
2585 cfg80211_rx_unexpected_4addr_frame(
2586 rx->sdata->dev, rx->sta->sta.addr, GFP_ATOMIC);
Felix Fietkauf14543ee2009-11-10 20:10:05 +01002587 return RX_DROP_MONITOR;
Johannes Berge7f4a942011-11-04 11:18:20 +01002588 }
Felix Fietkauf14543ee2009-11-10 20:10:05 +01002589
Felix Fietkau4114fa22011-04-12 19:15:22 +02002590 err = __ieee80211_data_to_8023(rx, &port_control);
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002591 if (unlikely(err))
Johannes Berge4c26ad2008-01-31 19:48:21 +01002592 return RX_DROP_UNUSABLE;
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002593
Harvey Harrison358c8d92008-07-15 18:44:13 -07002594 if (!ieee80211_frame_allowed(rx, fc))
Johannes Berge4c26ad2008-01-31 19:48:21 +01002595 return RX_DROP_MONITOR;
Johannes Bergce3edf6d02007-12-19 01:31:22 +01002596
Arik Nemtsov8a4d32f2014-11-09 18:50:20 +02002597 /* directly handle TDLS channel switch requests/responses */
2598 if (unlikely(((struct ethhdr *)rx->skb->data)->h_proto ==
2599 cpu_to_be16(ETH_P_TDLS))) {
2600 struct ieee80211_tdls_data *tf = (void *)rx->skb->data;
2601
2602 if (pskb_may_pull(rx->skb,
2603 offsetof(struct ieee80211_tdls_data, u)) &&
2604 tf->payload_type == WLAN_TDLS_SNAP_RFTYPE &&
2605 tf->category == WLAN_CATEGORY_TDLS &&
2606 (tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_REQUEST ||
2607 tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_RESPONSE)) {
Arik Nemtsovc8ff71e2015-07-08 15:41:45 +03002608 skb_queue_tail(&local->skb_queue_tdls_chsw, rx->skb);
2609 schedule_work(&local->tdls_chsw_work);
Arik Nemtsov8a4d32f2014-11-09 18:50:20 +02002610 if (rx->sta)
Johannes Berge5a9f8d2015-10-16 17:54:47 +02002611 rx->sta->rx_stats.packets++;
Arik Nemtsov8a4d32f2014-11-09 18:50:20 +02002612
2613 return RX_QUEUED;
2614 }
2615 }
2616
Felix Fietkau4114fa22011-04-12 19:15:22 +02002617 if (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
2618 unlikely(port_control) && sdata->bss) {
2619 sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
2620 u.ap);
2621 dev = sdata->dev;
2622 rx->sdata = sdata;
2623 }
2624
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002625 rx->skb->dev = dev;
2626
Johannes Berg602fae42016-03-17 15:02:52 +02002627 if (!ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS) &&
2628 local->ps_sdata && local->hw.conf.dynamic_ps_timeout > 0 &&
Rajkumar Manoharan8c99f692011-02-02 22:57:53 +05302629 !is_multicast_ether_addr(
2630 ((struct ethhdr *)rx->skb->data)->h_dest) &&
2631 (!local->scanning &&
Johannes Berg602fae42016-03-17 15:02:52 +02002632 !test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state)))
2633 mod_timer(&local->dynamic_ps_timer, jiffies +
2634 msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
Vivek Natarajane15276a2010-02-08 17:47:01 +05302635
Ron Rindjunsky76ee65b2007-11-22 19:49:12 +02002636 ieee80211_deliver_skb(rx);
Johannes Berg571ecf62007-07-27 15:43:22 +02002637
Johannes Berg9ae54c82008-01-31 19:48:20 +01002638 return RX_QUEUED;
Johannes Berg571ecf62007-07-27 15:43:22 +02002639}
2640
Johannes Berg49461622008-06-30 15:10:45 +02002641static ieee80211_rx_result debug_noinline
Christian Lamparterf9e124f2013-02-04 17:44:44 +00002642ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames)
Ron Rindjunsky71364712007-12-25 17:00:36 +02002643{
Ron Rindjunsky71364712007-12-25 17:00:36 +02002644 struct sk_buff *skb = rx->skb;
Harvey Harrisona7767f92008-07-02 16:30:51 -07002645 struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
Ron Rindjunsky71364712007-12-25 17:00:36 +02002646 struct tid_ampdu_rx *tid_agg_rx;
2647 u16 start_seq_num;
2648 u16 tid;
2649
Harvey Harrisona7767f92008-07-02 16:30:51 -07002650 if (likely(!ieee80211_is_ctl(bar->frame_control)))
Johannes Berg9ae54c82008-01-31 19:48:20 +01002651 return RX_CONTINUE;
Ron Rindjunsky71364712007-12-25 17:00:36 +02002652
Harvey Harrisona7767f92008-07-02 16:30:51 -07002653 if (ieee80211_is_back_req(bar->frame_control)) {
Johannes Berg8ae59772010-05-30 14:52:58 +02002654 struct {
2655 __le16 control, start_seq_num;
2656 } __packed bar_data;
Emmanuel Grumbach63822462015-04-20 22:53:37 +03002657 struct ieee80211_event event = {
2658 .type = BAR_RX_EVENT,
2659 };
Johannes Berg8ae59772010-05-30 14:52:58 +02002660
Ron Rindjunsky71364712007-12-25 17:00:36 +02002661 if (!rx->sta)
Johannes Berga02ae752009-11-16 12:00:40 +01002662 return RX_DROP_MONITOR;
Johannes Berg8ae59772010-05-30 14:52:58 +02002663
2664 if (skb_copy_bits(skb, offsetof(struct ieee80211_bar, control),
2665 &bar_data, sizeof(bar_data)))
2666 return RX_DROP_MONITOR;
2667
Johannes Berg8ae59772010-05-30 14:52:58 +02002668 tid = le16_to_cpu(bar_data.control) >> 12;
Johannes Berga87f7362010-06-10 10:21:38 +02002669
Johannes Berg53f24972016-08-29 23:25:19 +03002670 if (!test_bit(tid, rx->sta->ampdu_mlme.agg_session_valid) &&
2671 !test_and_set_bit(tid, rx->sta->ampdu_mlme.unexpected_agg))
2672 ieee80211_send_delba(rx->sdata, rx->sta->sta.addr, tid,
2673 WLAN_BACK_RECIPIENT,
2674 WLAN_REASON_QSTA_REQUIRE_SETUP);
2675
Johannes Berga87f7362010-06-10 10:21:38 +02002676 tid_agg_rx = rcu_dereference(rx->sta->ampdu_mlme.tid_rx[tid]);
2677 if (!tid_agg_rx)
Johannes Berga02ae752009-11-16 12:00:40 +01002678 return RX_DROP_MONITOR;
Ron Rindjunsky71364712007-12-25 17:00:36 +02002679
Johannes Berg8ae59772010-05-30 14:52:58 +02002680 start_seq_num = le16_to_cpu(bar_data.start_seq_num) >> 4;
Emmanuel Grumbach63822462015-04-20 22:53:37 +03002681 event.u.ba.tid = tid;
2682 event.u.ba.ssn = start_seq_num;
2683 event.u.ba.sta = &rx->sta->sta;
Ron Rindjunsky71364712007-12-25 17:00:36 +02002684
2685 /* reset session timer */
Johannes Berg20ad19d2009-02-10 21:25:45 +01002686 if (tid_agg_rx->timeout)
2687 mod_timer(&tid_agg_rx->session_timer,
2688 TU_TO_EXP_TIME(tid_agg_rx->timeout));
Ron Rindjunsky71364712007-12-25 17:00:36 +02002689
Johannes Bergdd318572010-11-29 11:09:16 +01002690 spin_lock(&tid_agg_rx->reorder_lock);
Johannes Berga02ae752009-11-16 12:00:40 +01002691 /* release stored frames up to start of BAR */
Johannes Bergd3b2fb52012-06-22 12:48:38 +02002692 ieee80211_release_reorder_frames(rx->sdata, tid_agg_rx,
Christian Lamparterf9e124f2013-02-04 17:44:44 +00002693 start_seq_num, frames);
Johannes Bergdd318572010-11-29 11:09:16 +01002694 spin_unlock(&tid_agg_rx->reorder_lock);
2695
Emmanuel Grumbach63822462015-04-20 22:53:37 +03002696 drv_event_callback(rx->local, rx->sdata, &event);
2697
Johannes Berga02ae752009-11-16 12:00:40 +01002698 kfree_skb(skb);
2699 return RX_QUEUED;
Ron Rindjunsky71364712007-12-25 17:00:36 +02002700 }
2701
Johannes Berg08daeca2010-05-30 14:53:43 +02002702 /*
2703 * After this point, we only want management frames,
2704 * so we can drop all remaining control frames to
2705 * cooked monitor interfaces.
2706 */
2707 return RX_DROP_MONITOR;
Ron Rindjunsky71364712007-12-25 17:00:36 +02002708}
2709
Jouni Malinenf4f727a2009-01-10 11:46:53 +02002710static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
2711 struct ieee80211_mgmt *mgmt,
2712 size_t len)
Jouni Malinenfea14732009-01-08 13:32:06 +02002713{
2714 struct ieee80211_local *local = sdata->local;
2715 struct sk_buff *skb;
2716 struct ieee80211_mgmt *resp;
2717
Joe Perchesb203ca32012-05-08 18:56:52 +00002718 if (!ether_addr_equal(mgmt->da, sdata->vif.addr)) {
Jouni Malinenfea14732009-01-08 13:32:06 +02002719 /* Not to own unicast address */
2720 return;
2721 }
2722
Joe Perchesb203ca32012-05-08 18:56:52 +00002723 if (!ether_addr_equal(mgmt->sa, sdata->u.mgd.bssid) ||
2724 !ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid)) {
Johannes Berg77fdaa12009-07-07 03:45:17 +02002725 /* Not from the current AP or not associated yet. */
Jouni Malinenfea14732009-01-08 13:32:06 +02002726 return;
2727 }
2728
2729 if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) {
2730 /* Too short SA Query request frame */
2731 return;
2732 }
2733
2734 skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom);
2735 if (skb == NULL)
2736 return;
2737
2738 skb_reserve(skb, local->hw.extra_tx_headroom);
2739 resp = (struct ieee80211_mgmt *) skb_put(skb, 24);
2740 memset(resp, 0, 24);
2741 memcpy(resp->da, mgmt->sa, ETH_ALEN);
Johannes Berg47846c92009-11-25 17:46:19 +01002742 memcpy(resp->sa, sdata->vif.addr, ETH_ALEN);
Johannes Berg46900292009-02-15 12:44:28 +01002743 memcpy(resp->bssid, sdata->u.mgd.bssid, ETH_ALEN);
Jouni Malinenfea14732009-01-08 13:32:06 +02002744 resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
2745 IEEE80211_STYPE_ACTION);
2746 skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query));
2747 resp->u.action.category = WLAN_CATEGORY_SA_QUERY;
2748 resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE;
2749 memcpy(resp->u.action.u.sa_query.trans_id,
2750 mgmt->u.action.u.sa_query.trans_id,
2751 WLAN_SA_QUERY_TR_ID_LEN);
2752
Johannes Berg62ae67b2009-11-18 18:42:05 +01002753 ieee80211_tx_skb(sdata, skb);
Jouni Malinenfea14732009-01-08 13:32:06 +02002754}
2755
Johannes Berg49461622008-06-30 15:10:45 +02002756static ieee80211_rx_result debug_noinline
Johannes Berg2e161f72010-08-12 15:38:38 +02002757ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx)
2758{
2759 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
Johannes Berg554891e2010-09-24 12:38:25 +02002760 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
Johannes Berg2e161f72010-08-12 15:38:38 +02002761
2762 /*
2763 * From here on, look only at management frames.
2764 * Data and control frames are already handled,
2765 * and unknown (reserved) frames are useless.
2766 */
2767 if (rx->skb->len < 24)
2768 return RX_DROP_MONITOR;
2769
2770 if (!ieee80211_is_mgmt(mgmt->frame_control))
2771 return RX_DROP_MONITOR;
2772
Johannes Bergee971922011-11-04 11:18:18 +01002773 if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
2774 ieee80211_is_beacon(mgmt->frame_control) &&
2775 !(rx->flags & IEEE80211_RX_BEACON_REPORTED)) {
Johannes Berg804483e2012-03-05 22:18:41 +01002776 int sig = 0;
2777
Johannes Berg30686bf2015-06-02 21:39:54 +02002778 if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM))
Johannes Berg804483e2012-03-05 22:18:41 +01002779 sig = status->signal;
2780
Johannes Bergee971922011-11-04 11:18:18 +01002781 cfg80211_report_obss_beacon(rx->local->hw.wiphy,
2782 rx->skb->data, rx->skb->len,
Ben Greear37c73b52012-10-26 14:49:25 -07002783 status->freq, sig);
Johannes Bergee971922011-11-04 11:18:18 +01002784 rx->flags |= IEEE80211_RX_BEACON_REPORTED;
2785 }
2786
Johannes Berg2e161f72010-08-12 15:38:38 +02002787 if (ieee80211_drop_unencrypted_mgmt(rx))
2788 return RX_DROP_UNUSABLE;
2789
2790 return RX_CONTINUE;
2791}
2792
2793static ieee80211_rx_result debug_noinline
Johannes Bergde1ede72008-09-09 14:42:50 +02002794ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
2795{
2796 struct ieee80211_local *local = rx->local;
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01002797 struct ieee80211_sub_if_data *sdata = rx->sdata;
Johannes Bergde1ede72008-09-09 14:42:50 +02002798 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
Johannes Berg554891e2010-09-24 12:38:25 +02002799 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
Johannes Bergde1ede72008-09-09 14:42:50 +02002800 int len = rx->skb->len;
2801
2802 if (!ieee80211_is_action(mgmt->frame_control))
2803 return RX_CONTINUE;
2804
Jouni Malinen026331c2010-02-15 12:53:10 +02002805 /* drop too small frames */
2806 if (len < IEEE80211_MIN_ACTION_SIZE)
2807 return RX_DROP_UNUSABLE;
2808
Marco Porsch815b8092012-12-05 15:04:26 -08002809 if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC &&
Simon Wunderlichcd7760e2013-08-28 13:41:31 +02002810 mgmt->u.action.category != WLAN_CATEGORY_SELF_PROTECTED &&
2811 mgmt->u.action.category != WLAN_CATEGORY_SPECTRUM_MGMT)
Johannes Berg84040802010-02-15 12:46:39 +02002812 return RX_DROP_UNUSABLE;
Johannes Bergde1ede72008-09-09 14:42:50 +02002813
Johannes Bergde1ede72008-09-09 14:42:50 +02002814 switch (mgmt->u.action.category) {
Johannes Berg1d8d3de2011-12-16 15:28:57 +01002815 case WLAN_CATEGORY_HT:
2816 /* reject HT action frames from stations not supporting HT */
2817 if (!rx->sta->sta.ht_cap.ht_supported)
2818 goto invalid;
2819
2820 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
2821 sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
2822 sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
2823 sdata->vif.type != NL80211_IFTYPE_AP &&
2824 sdata->vif.type != NL80211_IFTYPE_ADHOC)
2825 break;
2826
Johannes Bergec61cd62012-12-28 12:12:10 +01002827 /* verify action & smps_control/chanwidth are present */
Johannes Berg1d8d3de2011-12-16 15:28:57 +01002828 if (len < IEEE80211_MIN_ACTION_SIZE + 2)
2829 goto invalid;
2830
2831 switch (mgmt->u.action.u.ht_smps.action) {
2832 case WLAN_HT_ACTION_SMPS: {
2833 struct ieee80211_supported_band *sband;
Johannes Bergaf0ed692013-02-12 14:21:00 +01002834 enum ieee80211_smps_mode smps_mode;
Johannes Berg1d8d3de2011-12-16 15:28:57 +01002835
2836 /* convert to HT capability */
2837 switch (mgmt->u.action.u.ht_smps.smps_control) {
2838 case WLAN_HT_SMPS_CONTROL_DISABLED:
Johannes Bergaf0ed692013-02-12 14:21:00 +01002839 smps_mode = IEEE80211_SMPS_OFF;
Johannes Berg1d8d3de2011-12-16 15:28:57 +01002840 break;
2841 case WLAN_HT_SMPS_CONTROL_STATIC:
Johannes Bergaf0ed692013-02-12 14:21:00 +01002842 smps_mode = IEEE80211_SMPS_STATIC;
Johannes Berg1d8d3de2011-12-16 15:28:57 +01002843 break;
2844 case WLAN_HT_SMPS_CONTROL_DYNAMIC:
Johannes Bergaf0ed692013-02-12 14:21:00 +01002845 smps_mode = IEEE80211_SMPS_DYNAMIC;
Johannes Berg1d8d3de2011-12-16 15:28:57 +01002846 break;
2847 default:
2848 goto invalid;
2849 }
Johannes Berg1d8d3de2011-12-16 15:28:57 +01002850
2851 /* if no change do nothing */
Johannes Bergaf0ed692013-02-12 14:21:00 +01002852 if (rx->sta->sta.smps_mode == smps_mode)
Johannes Berg1d8d3de2011-12-16 15:28:57 +01002853 goto handled;
Johannes Bergaf0ed692013-02-12 14:21:00 +01002854 rx->sta->sta.smps_mode = smps_mode;
Johannes Berg1d8d3de2011-12-16 15:28:57 +01002855
2856 sband = rx->local->hw.wiphy->bands[status->band];
2857
Johannes Berg64f68e52012-03-28 10:58:37 +02002858 rate_control_rate_update(local, sband, rx->sta,
2859 IEEE80211_RC_SMPS_CHANGED);
Johannes Berg1d8d3de2011-12-16 15:28:57 +01002860 goto handled;
2861 }
Johannes Bergec61cd62012-12-28 12:12:10 +01002862 case WLAN_HT_ACTION_NOTIFY_CHANWIDTH: {
2863 struct ieee80211_supported_band *sband;
2864 u8 chanwidth = mgmt->u.action.u.ht_notify_cw.chanwidth;
Eliad Peller1c45c5c2014-12-14 11:05:51 +02002865 enum ieee80211_sta_rx_bandwidth max_bw, new_bw;
Johannes Bergec61cd62012-12-28 12:12:10 +01002866
2867 /* If it doesn't support 40 MHz it can't change ... */
Johannes Berge1a0c6b2013-02-07 11:47:44 +01002868 if (!(rx->sta->sta.ht_cap.cap &
2869 IEEE80211_HT_CAP_SUP_WIDTH_20_40))
Johannes Bergec61cd62012-12-28 12:12:10 +01002870 goto handled;
2871
Johannes Berge1a0c6b2013-02-07 11:47:44 +01002872 if (chanwidth == IEEE80211_HT_CHANWIDTH_20MHZ)
Eliad Peller1c45c5c2014-12-14 11:05:51 +02002873 max_bw = IEEE80211_STA_RX_BW_20;
Johannes Bergec61cd62012-12-28 12:12:10 +01002874 else
Eliad Peller1c45c5c2014-12-14 11:05:51 +02002875 max_bw = ieee80211_sta_cap_rx_bw(rx->sta);
2876
2877 /* set cur_max_bandwidth and recalc sta bw */
2878 rx->sta->cur_max_bandwidth = max_bw;
2879 new_bw = ieee80211_sta_cur_vht_bw(rx->sta);
Johannes Berge1a0c6b2013-02-07 11:47:44 +01002880
2881 if (rx->sta->sta.bandwidth == new_bw)
2882 goto handled;
Johannes Bergec61cd62012-12-28 12:12:10 +01002883
Eliad Peller1c45c5c2014-12-14 11:05:51 +02002884 rx->sta->sta.bandwidth = new_bw;
Johannes Bergec61cd62012-12-28 12:12:10 +01002885 sband = rx->local->hw.wiphy->bands[status->band];
2886
2887 rate_control_rate_update(local, sband, rx->sta,
2888 IEEE80211_RC_BW_CHANGED);
2889 goto handled;
2890 }
Johannes Berg1d8d3de2011-12-16 15:28:57 +01002891 default:
2892 goto invalid;
2893 }
2894
2895 break;
Johannes Berg1b3a2e42013-03-26 15:17:18 +01002896 case WLAN_CATEGORY_PUBLIC:
2897 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
2898 goto invalid;
2899 if (sdata->vif.type != NL80211_IFTYPE_STATION)
2900 break;
2901 if (!rx->sta)
2902 break;
2903 if (!ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid))
2904 break;
2905 if (mgmt->u.action.u.ext_chan_switch.action_code !=
2906 WLAN_PUB_ACTION_EXT_CHANSW_ANN)
2907 break;
2908 if (len < offsetof(struct ieee80211_mgmt,
2909 u.action.u.ext_chan_switch.variable))
2910 goto invalid;
2911 goto queue;
Johannes Berg0af83d32012-12-27 18:55:36 +01002912 case WLAN_CATEGORY_VHT:
2913 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
2914 sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
2915 sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
2916 sdata->vif.type != NL80211_IFTYPE_AP &&
2917 sdata->vif.type != NL80211_IFTYPE_ADHOC)
2918 break;
2919
2920 /* verify action code is present */
2921 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
2922 goto invalid;
2923
2924 switch (mgmt->u.action.u.vht_opmode_notif.action_code) {
2925 case WLAN_VHT_ACTION_OPMODE_NOTIF: {
Johannes Berg0af83d32012-12-27 18:55:36 +01002926 /* verify opmode is present */
2927 if (len < IEEE80211_MIN_ACTION_SIZE + 2)
2928 goto invalid;
Johannes Berg6130fac2016-10-20 08:52:50 +02002929 goto queue;
Johannes Berg0af83d32012-12-27 18:55:36 +01002930 }
Sara Sharon23a1f8d2015-12-08 16:04:31 +02002931 case WLAN_VHT_ACTION_GROUPID_MGMT: {
2932 if (len < IEEE80211_MIN_ACTION_SIZE + 25)
2933 goto invalid;
2934 goto queue;
2935 }
Johannes Berg0af83d32012-12-27 18:55:36 +01002936 default:
2937 break;
2938 }
2939 break;
Johannes Bergde1ede72008-09-09 14:42:50 +02002940 case WLAN_CATEGORY_BACK:
Johannes Berg8abd3f92009-02-10 21:25:47 +01002941 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
Thomas Pedersenae2772b2011-10-26 14:47:29 -07002942 sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
Johannes Berg8abd3f92009-02-10 21:25:47 +01002943 sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
Alexander Simon13c40c52011-11-30 16:56:34 +01002944 sdata->vif.type != NL80211_IFTYPE_AP &&
2945 sdata->vif.type != NL80211_IFTYPE_ADHOC)
Johannes Berg84040802010-02-15 12:46:39 +02002946 break;
Johannes Berg8abd3f92009-02-10 21:25:47 +01002947
Jouni Malinen026331c2010-02-15 12:53:10 +02002948 /* verify action_code is present */
2949 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
2950 break;
2951
Johannes Bergde1ede72008-09-09 14:42:50 +02002952 switch (mgmt->u.action.u.addba_req.action_code) {
2953 case WLAN_ACTION_ADDBA_REQ:
2954 if (len < (IEEE80211_MIN_ACTION_SIZE +
2955 sizeof(mgmt->u.action.u.addba_req)))
Johannes Bergbed7ee6e2010-06-10 10:21:35 +02002956 goto invalid;
2957 break;
Johannes Bergde1ede72008-09-09 14:42:50 +02002958 case WLAN_ACTION_ADDBA_RESP:
2959 if (len < (IEEE80211_MIN_ACTION_SIZE +
2960 sizeof(mgmt->u.action.u.addba_resp)))
Johannes Bergbed7ee6e2010-06-10 10:21:35 +02002961 goto invalid;
2962 break;
Johannes Bergde1ede72008-09-09 14:42:50 +02002963 case WLAN_ACTION_DELBA:
2964 if (len < (IEEE80211_MIN_ACTION_SIZE +
2965 sizeof(mgmt->u.action.u.delba)))
Johannes Bergbed7ee6e2010-06-10 10:21:35 +02002966 goto invalid;
2967 break;
2968 default:
2969 goto invalid;
Johannes Bergde1ede72008-09-09 14:42:50 +02002970 }
Johannes Bergbed7ee6e2010-06-10 10:21:35 +02002971
Johannes Berg8b58ff82010-06-10 10:21:51 +02002972 goto queue;
Johannes Berg39192c02008-09-09 14:49:03 +02002973 case WLAN_CATEGORY_SPECTRUM_MGMT:
Jouni Malinen026331c2010-02-15 12:53:10 +02002974 /* verify action_code is present */
2975 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
2976 break;
2977
Johannes Berg39192c02008-09-09 14:49:03 +02002978 switch (mgmt->u.action.u.measurement.action_code) {
2979 case WLAN_ACTION_SPCT_MSR_REQ:
Johannes Berg57fbcce2016-04-12 15:56:15 +02002980 if (status->band != NL80211_BAND_5GHZ)
Simon Wunderlichcd7760e2013-08-28 13:41:31 +02002981 break;
2982
Johannes Berg39192c02008-09-09 14:49:03 +02002983 if (len < (IEEE80211_MIN_ACTION_SIZE +
2984 sizeof(mgmt->u.action.u.measurement)))
Johannes Berg84040802010-02-15 12:46:39 +02002985 break;
Simon Wunderlichcd7760e2013-08-28 13:41:31 +02002986
Johannes Bergcc32abd2009-05-15 11:52:31 +02002987 if (sdata->vif.type != NL80211_IFTYPE_STATION)
Johannes Berg84040802010-02-15 12:46:39 +02002988 break;
Johannes Bergcc32abd2009-05-15 11:52:31 +02002989
Simon Wunderlichcd7760e2013-08-28 13:41:31 +02002990 ieee80211_process_measurement_req(sdata, mgmt, len);
2991 goto handled;
2992 case WLAN_ACTION_SPCT_CHL_SWITCH: {
2993 u8 *bssid;
2994 if (len < (IEEE80211_MIN_ACTION_SIZE +
2995 sizeof(mgmt->u.action.u.chan_switch)))
2996 break;
2997
2998 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
Chun-Yeow Yeohb8456a12013-10-17 15:55:02 -07002999 sdata->vif.type != NL80211_IFTYPE_ADHOC &&
3000 sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
Simon Wunderlichcd7760e2013-08-28 13:41:31 +02003001 break;
3002
3003 if (sdata->vif.type == NL80211_IFTYPE_STATION)
3004 bssid = sdata->u.mgd.bssid;
3005 else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
3006 bssid = sdata->u.ibss.bssid;
Chun-Yeow Yeohb8456a12013-10-17 15:55:02 -07003007 else if (sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
3008 bssid = mgmt->sa;
Simon Wunderlichcd7760e2013-08-28 13:41:31 +02003009 else
3010 break;
3011
3012 if (!ether_addr_equal(mgmt->bssid, bssid))
Johannes Berg84040802010-02-15 12:46:39 +02003013 break;
Sujithc481ec92009-01-06 09:28:37 +05303014
Johannes Berg8b58ff82010-06-10 10:21:51 +02003015 goto queue;
Simon Wunderlichcd7760e2013-08-28 13:41:31 +02003016 }
Johannes Berg39192c02008-09-09 14:49:03 +02003017 }
3018 break;
Jouni Malinenfea14732009-01-08 13:32:06 +02003019 case WLAN_CATEGORY_SA_QUERY:
3020 if (len < (IEEE80211_MIN_ACTION_SIZE +
3021 sizeof(mgmt->u.action.u.sa_query)))
Johannes Berg84040802010-02-15 12:46:39 +02003022 break;
3023
Jouni Malinenfea14732009-01-08 13:32:06 +02003024 switch (mgmt->u.action.u.sa_query.action) {
3025 case WLAN_ACTION_SA_QUERY_REQUEST:
3026 if (sdata->vif.type != NL80211_IFTYPE_STATION)
Johannes Berg84040802010-02-15 12:46:39 +02003027 break;
Jouni Malinenfea14732009-01-08 13:32:06 +02003028 ieee80211_process_sa_query_req(sdata, mgmt, len);
Johannes Berg84040802010-02-15 12:46:39 +02003029 goto handled;
Jouni Malinenfea14732009-01-08 13:32:06 +02003030 }
3031 break;
Thomas Pedersen8db09852011-08-12 20:01:00 -07003032 case WLAN_CATEGORY_SELF_PROTECTED:
Johannes Berg9b395bc2012-10-26 00:36:40 +02003033 if (len < (IEEE80211_MIN_ACTION_SIZE +
3034 sizeof(mgmt->u.action.u.self_prot.action_code)))
3035 break;
3036
Thomas Pedersen8db09852011-08-12 20:01:00 -07003037 switch (mgmt->u.action.u.self_prot.action_code) {
3038 case WLAN_SP_MESH_PEERING_OPEN:
3039 case WLAN_SP_MESH_PEERING_CLOSE:
3040 case WLAN_SP_MESH_PEERING_CONFIRM:
3041 if (!ieee80211_vif_is_mesh(&sdata->vif))
3042 goto invalid;
Thomas Pedersena6dad6a2013-03-04 13:06:12 -08003043 if (sdata->u.mesh.user_mpm)
Thomas Pedersen8db09852011-08-12 20:01:00 -07003044 /* userspace handles this frame */
3045 break;
3046 goto queue;
3047 case WLAN_SP_MGK_INFORM:
3048 case WLAN_SP_MGK_ACK:
3049 if (!ieee80211_vif_is_mesh(&sdata->vif))
3050 goto invalid;
3051 break;
3052 }
3053 break;
Javier Cardonad3aaec8a2011-05-03 16:57:09 -07003054 case WLAN_CATEGORY_MESH_ACTION:
Johannes Berg9b395bc2012-10-26 00:36:40 +02003055 if (len < (IEEE80211_MIN_ACTION_SIZE +
3056 sizeof(mgmt->u.action.u.mesh_action.action_code)))
3057 break;
3058
Johannes Berg77a121c2010-06-10 10:21:34 +02003059 if (!ieee80211_vif_is_mesh(&sdata->vif))
3060 break;
Thomas Pedersen25d49e42011-08-11 19:35:15 -07003061 if (mesh_action_is_path_sel(mgmt) &&
Johannes Berg1df332e2012-10-26 00:09:11 +02003062 !mesh_path_sel_is_hwmp(sdata))
Javier Cardonac7108a72010-12-16 17:37:50 -08003063 break;
3064 goto queue;
Johannes Berg84040802010-02-15 12:46:39 +02003065 }
Jouni Malinen026331c2010-02-15 12:53:10 +02003066
Johannes Berg2e161f72010-08-12 15:38:38 +02003067 return RX_CONTINUE;
3068
Johannes Bergbed7ee6e2010-06-10 10:21:35 +02003069 invalid:
Johannes Berg554891e2010-09-24 12:38:25 +02003070 status->rx_flags |= IEEE80211_RX_MALFORMED_ACTION_FRM;
Johannes Berg2e161f72010-08-12 15:38:38 +02003071 /* will return in the next handlers */
3072 return RX_CONTINUE;
3073
3074 handled:
3075 if (rx->sta)
Johannes Berge5a9f8d2015-10-16 17:54:47 +02003076 rx->sta->rx_stats.packets++;
Johannes Berg2e161f72010-08-12 15:38:38 +02003077 dev_kfree_skb(rx->skb);
3078 return RX_QUEUED;
3079
3080 queue:
3081 rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
3082 skb_queue_tail(&sdata->skb_queue, rx->skb);
3083 ieee80211_queue_work(&local->hw, &sdata->work);
3084 if (rx->sta)
Johannes Berge5a9f8d2015-10-16 17:54:47 +02003085 rx->sta->rx_stats.packets++;
Johannes Berg2e161f72010-08-12 15:38:38 +02003086 return RX_QUEUED;
3087}
3088
3089static ieee80211_rx_result debug_noinline
3090ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx)
3091{
Johannes Berg554891e2010-09-24 12:38:25 +02003092 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
Johannes Berg804483e2012-03-05 22:18:41 +01003093 int sig = 0;
Johannes Berg2e161f72010-08-12 15:38:38 +02003094
3095 /* skip known-bad action frames and return them in the next handler */
Johannes Berg554891e2010-09-24 12:38:25 +02003096 if (status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM)
Johannes Berg2e161f72010-08-12 15:38:38 +02003097 return RX_CONTINUE;
Felix Fietkaud7907442010-01-07 20:23:53 +01003098
Jouni Malinen026331c2010-02-15 12:53:10 +02003099 /*
3100 * Getting here means the kernel doesn't know how to handle
3101 * it, but maybe userspace does ... include returned frames
3102 * so userspace can register for those to know whether ones
3103 * it transmitted were processed or returned.
3104 */
Jouni Malinen026331c2010-02-15 12:53:10 +02003105
Johannes Berg30686bf2015-06-02 21:39:54 +02003106 if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM))
Johannes Berg804483e2012-03-05 22:18:41 +01003107 sig = status->signal;
3108
Johannes Berg71bbc992012-06-15 15:30:18 +02003109 if (cfg80211_rx_mgmt(&rx->sdata->wdev, status->freq, sig,
Vladimir Kondratiev970fdfa2014-08-11 03:29:57 -07003110 rx->skb->data, rx->skb->len, 0)) {
Johannes Berg2e161f72010-08-12 15:38:38 +02003111 if (rx->sta)
Johannes Berge5a9f8d2015-10-16 17:54:47 +02003112 rx->sta->rx_stats.packets++;
Johannes Berg2e161f72010-08-12 15:38:38 +02003113 dev_kfree_skb(rx->skb);
3114 return RX_QUEUED;
3115 }
3116
Johannes Berg2e161f72010-08-12 15:38:38 +02003117 return RX_CONTINUE;
3118}
3119
3120static ieee80211_rx_result debug_noinline
3121ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
3122{
3123 struct ieee80211_local *local = rx->local;
3124 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
3125 struct sk_buff *nskb;
3126 struct ieee80211_sub_if_data *sdata = rx->sdata;
Johannes Berg554891e2010-09-24 12:38:25 +02003127 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
Johannes Berg2e161f72010-08-12 15:38:38 +02003128
3129 if (!ieee80211_is_action(mgmt->frame_control))
3130 return RX_CONTINUE;
3131
3132 /*
3133 * For AP mode, hostapd is responsible for handling any action
3134 * frames that we didn't handle, including returning unknown
3135 * ones. For all other modes we will return them to the sender,
3136 * setting the 0x80 bit in the action category, as required by
Johannes Berg4b5ebcc2012-06-27 15:38:56 +02003137 * 802.11-2012 9.24.4.
Johannes Berg2e161f72010-08-12 15:38:38 +02003138 * Newer versions of hostapd shall also use the management frame
3139 * registration mechanisms, but older ones still use cooked
3140 * monitor interfaces so push all frames there.
3141 */
Johannes Berg554891e2010-09-24 12:38:25 +02003142 if (!(status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) &&
Johannes Berg2e161f72010-08-12 15:38:38 +02003143 (sdata->vif.type == NL80211_IFTYPE_AP ||
3144 sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
3145 return RX_DROP_MONITOR;
Jouni Malinen026331c2010-02-15 12:53:10 +02003146
Johannes Berg4b5ebcc2012-06-27 15:38:56 +02003147 if (is_multicast_ether_addr(mgmt->da))
3148 return RX_DROP_MONITOR;
3149
Johannes Berg84040802010-02-15 12:46:39 +02003150 /* do not return rejected action frames */
3151 if (mgmt->u.action.category & 0x80)
3152 return RX_DROP_UNUSABLE;
3153
3154 nskb = skb_copy_expand(rx->skb, local->hw.extra_tx_headroom, 0,
3155 GFP_ATOMIC);
3156 if (nskb) {
John W. Linville292b4df2010-06-24 11:13:56 -04003157 struct ieee80211_mgmt *nmgmt = (void *)nskb->data;
Johannes Berg84040802010-02-15 12:46:39 +02003158
John W. Linville292b4df2010-06-24 11:13:56 -04003159 nmgmt->u.action.category |= 0x80;
3160 memcpy(nmgmt->da, nmgmt->sa, ETH_ALEN);
3161 memcpy(nmgmt->sa, rx->sdata->vif.addr, ETH_ALEN);
Johannes Berg84040802010-02-15 12:46:39 +02003162
3163 memset(nskb->cb, 0, sizeof(nskb->cb));
3164
Johannes Berg07e5a5f2013-03-07 13:22:05 +01003165 if (rx->sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) {
3166 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(nskb);
3167
3168 info->flags = IEEE80211_TX_CTL_TX_OFFCHAN |
3169 IEEE80211_TX_INTFL_OFFCHAN_TX_OK |
3170 IEEE80211_TX_CTL_NO_CCK_RATE;
Johannes Berg30686bf2015-06-02 21:39:54 +02003171 if (ieee80211_hw_check(&local->hw, QUEUE_CONTROL))
Johannes Berg07e5a5f2013-03-07 13:22:05 +01003172 info->hw_queue =
3173 local->hw.offchannel_tx_hw_queue;
3174 }
3175
3176 __ieee80211_tx_skb_tid_band(rx->sdata, nskb, 7,
3177 status->band);
Johannes Bergde1ede72008-09-09 14:42:50 +02003178 }
Johannes Berg39192c02008-09-09 14:49:03 +02003179 dev_kfree_skb(rx->skb);
3180 return RX_QUEUED;
Johannes Bergde1ede72008-09-09 14:42:50 +02003181}
3182
3183static ieee80211_rx_result debug_noinline
Johannes Berg5cf121c2008-02-25 16:27:43 +01003184ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
Johannes Berg571ecf62007-07-27 15:43:22 +02003185{
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01003186 struct ieee80211_sub_if_data *sdata = rx->sdata;
Johannes Berg77a121c2010-06-10 10:21:34 +02003187 struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
3188 __le16 stype;
Johannes Berg571ecf62007-07-27 15:43:22 +02003189
Johannes Berg77a121c2010-06-10 10:21:34 +02003190 stype = mgmt->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE);
Johannes Berg472dbc42008-09-11 00:01:49 +02003191
Johannes Berg77a121c2010-06-10 10:21:34 +02003192 if (!ieee80211_vif_is_mesh(&sdata->vif) &&
3193 sdata->vif.type != NL80211_IFTYPE_ADHOC &&
Rostislav Lisovy239281f2014-11-03 10:33:19 +01003194 sdata->vif.type != NL80211_IFTYPE_OCB &&
Johannes Berg77a121c2010-06-10 10:21:34 +02003195 sdata->vif.type != NL80211_IFTYPE_STATION)
3196 return RX_DROP_MONITOR;
Johannes Bergf9d540e2007-09-28 14:02:09 +02003197
Johannes Berg77a121c2010-06-10 10:21:34 +02003198 switch (stype) {
Johannes Berg66e67e42012-01-20 13:55:27 +01003199 case cpu_to_le16(IEEE80211_STYPE_AUTH):
Johannes Berg77a121c2010-06-10 10:21:34 +02003200 case cpu_to_le16(IEEE80211_STYPE_BEACON):
3201 case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
3202 /* process for all: mesh, mlme, ibss */
3203 break;
Johannes Berg66e67e42012-01-20 13:55:27 +01003204 case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
3205 case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
Johannes Berg77a121c2010-06-10 10:21:34 +02003206 case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
3207 case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
Christian Lamparter2c313332010-11-29 20:53:23 +01003208 if (is_multicast_ether_addr(mgmt->da) &&
3209 !is_broadcast_ether_addr(mgmt->da))
3210 return RX_DROP_MONITOR;
3211
Johannes Berg77a121c2010-06-10 10:21:34 +02003212 /* process only for station */
3213 if (sdata->vif.type != NL80211_IFTYPE_STATION)
3214 return RX_DROP_MONITOR;
3215 break;
3216 case cpu_to_le16(IEEE80211_STYPE_PROBE_REQ):
Thomas Pedersen9fb04b52013-02-14 11:20:14 -08003217 /* process only for ibss and mesh */
3218 if (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
3219 sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
Johannes Berg77a121c2010-06-10 10:21:34 +02003220 return RX_DROP_MONITOR;
3221 break;
3222 default:
3223 return RX_DROP_MONITOR;
3224 }
Johannes Berg46900292009-02-15 12:44:28 +01003225
Johannes Berg77a121c2010-06-10 10:21:34 +02003226 /* queue up frame and kick off work to process it */
Johannes Bergc1475ca2010-06-10 10:21:37 +02003227 rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
Johannes Berg77a121c2010-06-10 10:21:34 +02003228 skb_queue_tail(&sdata->skb_queue, rx->skb);
3229 ieee80211_queue_work(&rx->local->hw, &sdata->work);
Johannes Berg8b58ff82010-06-10 10:21:51 +02003230 if (rx->sta)
Johannes Berge5a9f8d2015-10-16 17:54:47 +02003231 rx->sta->rx_stats.packets++;
Johannes Berg77a121c2010-06-10 10:21:34 +02003232
3233 return RX_QUEUED;
Johannes Berg571ecf62007-07-27 15:43:22 +02003234}
3235
Johannes Berg5f0b7de2009-11-16 13:58:21 +01003236static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
3237 struct ieee80211_rate *rate)
Michael Wu3d30d942008-01-31 19:48:27 +01003238{
3239 struct ieee80211_sub_if_data *sdata;
3240 struct ieee80211_local *local = rx->local;
Michael Wu3d30d942008-01-31 19:48:27 +01003241 struct sk_buff *skb = rx->skb, *skb2;
3242 struct net_device *prev_dev = NULL;
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01003243 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
Johannes Berg293702a2012-03-02 13:18:19 +01003244 int needed_headroom;
Michael Wu3d30d942008-01-31 19:48:27 +01003245
Johannes Berg554891e2010-09-24 12:38:25 +02003246 /*
3247 * If cooked monitor has been processed already, then
3248 * don't do it again. If not, set the flag.
3249 */
3250 if (rx->flags & IEEE80211_RX_CMNTR)
John W. Linville7c1e1832010-09-24 15:52:49 -04003251 goto out_free_skb;
Johannes Berg554891e2010-09-24 12:38:25 +02003252 rx->flags |= IEEE80211_RX_CMNTR;
John W. Linville7c1e1832010-09-24 15:52:49 -04003253
Johannes Berg152c4772011-10-21 10:22:22 +02003254 /* If there are no cooked monitor interfaces, just free the SKB */
3255 if (!local->cooked_mntrs)
3256 goto out_free_skb;
3257
Johannes Berg1f7bba72014-11-06 22:56:36 +01003258 /* vendor data is long removed here */
3259 status->flag &= ~RX_FLAG_RADIOTAP_VENDOR_DATA;
Johannes Berg293702a2012-03-02 13:18:19 +01003260 /* room for the radiotap header based on driver features */
Johannes Berg1f7bba72014-11-06 22:56:36 +01003261 needed_headroom = ieee80211_rx_radiotap_hdrlen(local, status, skb);
Johannes Berg293702a2012-03-02 13:18:19 +01003262
3263 if (skb_headroom(skb) < needed_headroom &&
3264 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC))
Michael Wu3d30d942008-01-31 19:48:27 +01003265 goto out_free_skb;
3266
Johannes Berg293702a2012-03-02 13:18:19 +01003267 /* prepend radiotap information */
Felix Fietkau973ef212012-04-16 14:56:48 +02003268 ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom,
3269 false);
Michael Wu3d30d942008-01-31 19:48:27 +01003270
Zhang Shengjud57a5442016-03-03 01:16:56 +00003271 skb_reset_mac_header(skb);
Michael Wu3d30d942008-01-31 19:48:27 +01003272 skb->ip_summed = CHECKSUM_UNNECESSARY;
3273 skb->pkt_type = PACKET_OTHERHOST;
3274 skb->protocol = htons(ETH_P_802_2);
3275
3276 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
Johannes Berg9607e6b2009-12-23 13:15:31 +01003277 if (!ieee80211_sdata_running(sdata))
Michael Wu3d30d942008-01-31 19:48:27 +01003278 continue;
3279
Johannes Berg05c914f2008-09-11 00:01:58 +02003280 if (sdata->vif.type != NL80211_IFTYPE_MONITOR ||
Aviya Erenfeldd8212182016-08-29 23:25:15 +03003281 !(sdata->u.mntr.flags & MONITOR_FLAG_COOK_FRAMES))
Michael Wu3d30d942008-01-31 19:48:27 +01003282 continue;
3283
3284 if (prev_dev) {
3285 skb2 = skb_clone(skb, GFP_ATOMIC);
3286 if (skb2) {
3287 skb2->dev = prev_dev;
John W. Linville5548a8a2010-06-24 14:25:56 -04003288 netif_receive_skb(skb2);
Michael Wu3d30d942008-01-31 19:48:27 +01003289 }
3290 }
3291
3292 prev_dev = sdata->dev;
Johannes Berg5a490512015-04-22 17:10:38 +02003293 ieee80211_rx_stats(sdata->dev, skb->len);
Michael Wu3d30d942008-01-31 19:48:27 +01003294 }
3295
3296 if (prev_dev) {
3297 skb->dev = prev_dev;
John W. Linville5548a8a2010-06-24 14:25:56 -04003298 netif_receive_skb(skb);
Johannes Berg554891e2010-09-24 12:38:25 +02003299 return;
3300 }
Michael Wu3d30d942008-01-31 19:48:27 +01003301
3302 out_free_skb:
3303 dev_kfree_skb(skb);
3304}
3305
Christian Lamparteraa0c8632010-08-05 01:36:04 +02003306static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx,
3307 ieee80211_rx_result res)
3308{
3309 switch (res) {
3310 case RX_DROP_MONITOR:
3311 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
3312 if (rx->sta)
Johannes Berge5a9f8d2015-10-16 17:54:47 +02003313 rx->sta->rx_stats.dropped++;
Christian Lamparteraa0c8632010-08-05 01:36:04 +02003314 /* fall through */
3315 case RX_CONTINUE: {
3316 struct ieee80211_rate *rate = NULL;
3317 struct ieee80211_supported_band *sband;
3318 struct ieee80211_rx_status *status;
3319
3320 status = IEEE80211_SKB_RXCB((rx->skb));
3321
3322 sband = rx->local->hw.wiphy->bands[status->band];
Johannes Berg56146182012-11-09 15:07:02 +01003323 if (!(status->flag & RX_FLAG_HT) &&
3324 !(status->flag & RX_FLAG_VHT))
Christian Lamparteraa0c8632010-08-05 01:36:04 +02003325 rate = &sband->bitrates[status->rate_idx];
3326
3327 ieee80211_rx_cooked_monitor(rx, rate);
3328 break;
3329 }
3330 case RX_DROP_UNUSABLE:
3331 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
3332 if (rx->sta)
Johannes Berge5a9f8d2015-10-16 17:54:47 +02003333 rx->sta->rx_stats.dropped++;
Christian Lamparteraa0c8632010-08-05 01:36:04 +02003334 dev_kfree_skb(rx->skb);
3335 break;
3336 case RX_QUEUED:
3337 I802_DEBUG_INC(rx->sdata->local->rx_handlers_queued);
3338 break;
3339 }
3340}
3341
Christian Lamparterf9e124f2013-02-04 17:44:44 +00003342static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx,
3343 struct sk_buff_head *frames)
Christian Lamparteraa0c8632010-08-05 01:36:04 +02003344{
3345 ieee80211_rx_result res = RX_DROP_MONITOR;
3346 struct sk_buff *skb;
3347
3348#define CALL_RXH(rxh) \
3349 do { \
3350 res = rxh(rx); \
3351 if (res != RX_CONTINUE) \
3352 goto rxh_next; \
Johannes Berg8ebaa5b2016-03-31 20:02:04 +03003353 } while (0)
Christian Lamparteraa0c8632010-08-05 01:36:04 +02003354
Johannes Berg45ceeee2015-03-16 09:08:20 +01003355 /* Lock here to avoid hitting all of the data used in the RX
3356 * path (e.g. key data, station data, ...) concurrently when
3357 * a frame is released from the reorder buffer due to timeout
3358 * from the timer, potentially concurrently with RX from the
3359 * driver.
3360 */
Christian Lamparterf9e124f2013-02-04 17:44:44 +00003361 spin_lock_bh(&rx->local->rx_path_lock);
Christian Lamparter24a8fda2010-12-30 17:25:29 +01003362
Christian Lamparterf9e124f2013-02-04 17:44:44 +00003363 while ((skb = __skb_dequeue(frames))) {
Christian Lamparteraa0c8632010-08-05 01:36:04 +02003364 /*
3365 * all the other fields are valid across frames
3366 * that belong to an aMPDU since they are on the
3367 * same TID from the same station
3368 */
3369 rx->skb = skb;
3370
Johannes Berg8ebaa5b2016-03-31 20:02:04 +03003371 CALL_RXH(ieee80211_rx_h_check_more_data);
3372 CALL_RXH(ieee80211_rx_h_uapsd_and_pspoll);
3373 CALL_RXH(ieee80211_rx_h_sta_process);
3374 CALL_RXH(ieee80211_rx_h_decrypt);
3375 CALL_RXH(ieee80211_rx_h_defragment);
3376 CALL_RXH(ieee80211_rx_h_michael_mic_verify);
Christian Lamparteraa0c8632010-08-05 01:36:04 +02003377 /* must be after MMIC verify so header is counted in MPDU mic */
Christian Lamparteraa0c8632010-08-05 01:36:04 +02003378#ifdef CONFIG_MAC80211_MESH
3379 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
3380 CALL_RXH(ieee80211_rx_h_mesh_fwding);
3381#endif
Johannes Berg8ebaa5b2016-03-31 20:02:04 +03003382 CALL_RXH(ieee80211_rx_h_amsdu);
3383 CALL_RXH(ieee80211_rx_h_data);
Christian Lamparterf9e124f2013-02-04 17:44:44 +00003384
3385 /* special treatment -- needs the queue */
3386 res = ieee80211_rx_h_ctrl(rx, frames);
3387 if (res != RX_CONTINUE)
3388 goto rxh_next;
3389
Johannes Berg8ebaa5b2016-03-31 20:02:04 +03003390 CALL_RXH(ieee80211_rx_h_mgmt_check);
3391 CALL_RXH(ieee80211_rx_h_action);
3392 CALL_RXH(ieee80211_rx_h_userspace_mgmt);
3393 CALL_RXH(ieee80211_rx_h_action_return);
3394 CALL_RXH(ieee80211_rx_h_mgmt);
Christian Lamparteraa0c8632010-08-05 01:36:04 +02003395
3396 rxh_next:
3397 ieee80211_rx_handlers_result(rx, res);
Christian Lamparterf9e124f2013-02-04 17:44:44 +00003398
Christian Lamparteraa0c8632010-08-05 01:36:04 +02003399#undef CALL_RXH
3400 }
Christian Lamparter24a8fda2010-12-30 17:25:29 +01003401
Christian Lamparterf9e124f2013-02-04 17:44:44 +00003402 spin_unlock_bh(&rx->local->rx_path_lock);
Christian Lamparteraa0c8632010-08-05 01:36:04 +02003403}
Johannes Berg571ecf62007-07-27 15:43:22 +02003404
Johannes Berg4406c372010-09-24 11:21:06 +02003405static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
Johannes Berg58905292008-01-31 19:48:25 +01003406{
Christian Lamparterf9e124f2013-02-04 17:44:44 +00003407 struct sk_buff_head reorder_release;
Johannes Berg58905292008-01-31 19:48:25 +01003408 ieee80211_rx_result res = RX_DROP_MONITOR;
3409
Christian Lamparterf9e124f2013-02-04 17:44:44 +00003410 __skb_queue_head_init(&reorder_release);
3411
Luis Carlos Coboe32f85f2008-08-05 19:34:52 +02003412#define CALL_RXH(rxh) \
3413 do { \
3414 res = rxh(rx); \
3415 if (res != RX_CONTINUE) \
Johannes Berg2569a822009-11-25 17:46:17 +01003416 goto rxh_next; \
Johannes Berg8ebaa5b2016-03-31 20:02:04 +03003417 } while (0)
Johannes Berg58905292008-01-31 19:48:25 +01003418
Johannes Berg8ebaa5b2016-03-31 20:02:04 +03003419 CALL_RXH(ieee80211_rx_h_check_dup);
3420 CALL_RXH(ieee80211_rx_h_check);
Johannes Berg2569a822009-11-25 17:46:17 +01003421
Christian Lamparterf9e124f2013-02-04 17:44:44 +00003422 ieee80211_rx_reorder_ampdu(rx, &reorder_release);
Johannes Berg2569a822009-11-25 17:46:17 +01003423
Christian Lamparterf9e124f2013-02-04 17:44:44 +00003424 ieee80211_rx_handlers(rx, &reorder_release);
Christian Lamparteraa0c8632010-08-05 01:36:04 +02003425 return;
Johannes Berg49461622008-06-30 15:10:45 +02003426
Johannes Berg2569a822009-11-25 17:46:17 +01003427 rxh_next:
Christian Lamparteraa0c8632010-08-05 01:36:04 +02003428 ieee80211_rx_handlers_result(rx, res);
3429
3430#undef CALL_RXH
Johannes Berg58905292008-01-31 19:48:25 +01003431}
3432
Christian Lamparter2bff8eb2010-08-05 01:36:41 +02003433/*
Johannes Bergdd318572010-11-29 11:09:16 +01003434 * This function makes calls into the RX path, therefore
3435 * it has to be invoked under RCU read lock.
Christian Lamparter2bff8eb2010-08-05 01:36:41 +02003436 */
3437void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
3438{
Christian Lamparterf9e124f2013-02-04 17:44:44 +00003439 struct sk_buff_head frames;
Johannes Berg554891e2010-09-24 12:38:25 +02003440 struct ieee80211_rx_data rx = {
3441 .sta = sta,
3442 .sdata = sta->sdata,
3443 .local = sta->local,
Johannes Berg9e262972011-07-07 18:45:03 +02003444 /* This is OK -- must be QoS data frame */
3445 .security_idx = tid,
3446 .seqno_idx = tid,
Johannes Bergaf9f9b22015-06-11 16:02:32 +02003447 .napi = NULL, /* must be NULL to not have races */
Johannes Berg554891e2010-09-24 12:38:25 +02003448 };
Christian Lamparter2c15a0c2010-08-24 19:22:42 +02003449 struct tid_ampdu_rx *tid_agg_rx;
3450
3451 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
3452 if (!tid_agg_rx)
3453 return;
Christian Lamparter2bff8eb2010-08-05 01:36:41 +02003454
Christian Lamparterf9e124f2013-02-04 17:44:44 +00003455 __skb_queue_head_init(&frames);
3456
Christian Lamparter2c15a0c2010-08-24 19:22:42 +02003457 spin_lock(&tid_agg_rx->reorder_lock);
Christian Lamparterf9e124f2013-02-04 17:44:44 +00003458 ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames);
Christian Lamparter2c15a0c2010-08-24 19:22:42 +02003459 spin_unlock(&tid_agg_rx->reorder_lock);
Christian Lamparter2bff8eb2010-08-05 01:36:41 +02003460
Emmanuel Grumbachb497de62015-04-20 22:53:38 +03003461 if (!skb_queue_empty(&frames)) {
3462 struct ieee80211_event event = {
3463 .type = BA_FRAME_TIMEOUT,
3464 .u.ba.tid = tid,
3465 .u.ba.sta = &sta->sta,
3466 };
3467 drv_event_callback(rx.local, rx.sdata, &event);
3468 }
3469
Christian Lamparterf9e124f2013-02-04 17:44:44 +00003470 ieee80211_rx_handlers(&rx, &frames);
Christian Lamparter2bff8eb2010-08-05 01:36:41 +02003471}
3472
Sara Sharon06470f72016-01-28 16:19:25 +02003473void ieee80211_mark_rx_ba_filtered_frames(struct ieee80211_sta *pubsta, u8 tid,
3474 u16 ssn, u64 filtered,
3475 u16 received_mpdus)
3476{
3477 struct sta_info *sta;
3478 struct tid_ampdu_rx *tid_agg_rx;
3479 struct sk_buff_head frames;
3480 struct ieee80211_rx_data rx = {
3481 /* This is OK -- must be QoS data frame */
3482 .security_idx = tid,
3483 .seqno_idx = tid,
3484 };
3485 int i, diff;
3486
3487 if (WARN_ON(!pubsta || tid >= IEEE80211_NUM_TIDS))
3488 return;
3489
3490 __skb_queue_head_init(&frames);
3491
3492 sta = container_of(pubsta, struct sta_info, sta);
3493
3494 rx.sta = sta;
3495 rx.sdata = sta->sdata;
3496 rx.local = sta->local;
3497
3498 rcu_read_lock();
3499 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
3500 if (!tid_agg_rx)
3501 goto out;
3502
3503 spin_lock_bh(&tid_agg_rx->reorder_lock);
3504
3505 if (received_mpdus >= IEEE80211_SN_MODULO >> 1) {
3506 int release;
3507
3508 /* release all frames in the reorder buffer */
3509 release = (tid_agg_rx->head_seq_num + tid_agg_rx->buf_size) %
3510 IEEE80211_SN_MODULO;
3511 ieee80211_release_reorder_frames(sta->sdata, tid_agg_rx,
3512 release, &frames);
3513 /* update ssn to match received ssn */
3514 tid_agg_rx->head_seq_num = ssn;
3515 } else {
3516 ieee80211_release_reorder_frames(sta->sdata, tid_agg_rx, ssn,
3517 &frames);
3518 }
3519
3520 /* handle the case that received ssn is behind the mac ssn.
3521 * it can be tid_agg_rx->buf_size behind and still be valid */
3522 diff = (tid_agg_rx->head_seq_num - ssn) & IEEE80211_SN_MASK;
3523 if (diff >= tid_agg_rx->buf_size) {
3524 tid_agg_rx->reorder_buf_filtered = 0;
3525 goto release;
3526 }
3527 filtered = filtered >> diff;
3528 ssn += diff;
3529
3530 /* update bitmap */
3531 for (i = 0; i < tid_agg_rx->buf_size; i++) {
3532 int index = (ssn + i) % tid_agg_rx->buf_size;
3533
3534 tid_agg_rx->reorder_buf_filtered &= ~BIT_ULL(index);
3535 if (filtered & BIT_ULL(i))
3536 tid_agg_rx->reorder_buf_filtered |= BIT_ULL(index);
3537 }
3538
3539 /* now process also frames that the filter marking released */
3540 ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames);
3541
3542release:
3543 spin_unlock_bh(&tid_agg_rx->reorder_lock);
3544
3545 ieee80211_rx_handlers(&rx, &frames);
3546
3547 out:
3548 rcu_read_unlock();
3549}
3550EXPORT_SYMBOL(ieee80211_mark_rx_ba_filtered_frames);
3551
Johannes Berg571ecf62007-07-27 15:43:22 +02003552/* main receive path */
3553
Johannes Berga58fbe12015-04-22 15:08:39 +02003554static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx)
Johannes Berg23a24de2007-07-27 15:43:22 +02003555{
Johannes Berg20b01f82010-09-24 11:21:05 +02003556 struct ieee80211_sub_if_data *sdata = rx->sdata;
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01003557 struct sk_buff *skb = rx->skb;
Johannes Berga58fbe12015-04-22 15:08:39 +02003558 struct ieee80211_hdr *hdr = (void *)skb->data;
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01003559 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
3560 u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
Johannes Berg23a24de2007-07-27 15:43:22 +02003561 int multicast = is_multicast_ether_addr(hdr->addr1);
3562
Johannes Berg51fb61e2007-12-19 01:31:27 +01003563 switch (sdata->vif.type) {
Johannes Berg05c914f2008-09-11 00:01:58 +02003564 case NL80211_IFTYPE_STATION:
Johannes Berg9bc383d2009-11-19 11:55:19 +01003565 if (!bssid && !sdata->u.mgd.use_4addr)
Johannes Berg3c2723f52014-01-07 16:23:24 +01003566 return false;
Johannes Berga58fbe12015-04-22 15:08:39 +02003567 if (multicast)
3568 return true;
3569 return ether_addr_equal(sdata->vif.addr, hdr->addr1);
Johannes Berg05c914f2008-09-11 00:01:58 +02003570 case NL80211_IFTYPE_ADHOC:
Johannes Berg23a24de2007-07-27 15:43:22 +02003571 if (!bssid)
Johannes Berg3c2723f52014-01-07 16:23:24 +01003572 return false;
Felix Fietkau6329b8d2013-09-17 11:15:43 +02003573 if (ether_addr_equal(sdata->vif.addr, hdr->addr2) ||
3574 ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2))
Johannes Berg3c2723f52014-01-07 16:23:24 +01003575 return false;
Johannes Berga58fbe12015-04-22 15:08:39 +02003576 if (ieee80211_is_beacon(hdr->frame_control))
Johannes Berg3c2723f52014-01-07 16:23:24 +01003577 return true;
Johannes Berga58fbe12015-04-22 15:08:39 +02003578 if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid))
Johannes Berg3c2723f52014-01-07 16:23:24 +01003579 return false;
Johannes Berga58fbe12015-04-22 15:08:39 +02003580 if (!multicast &&
3581 !ether_addr_equal(sdata->vif.addr, hdr->addr1))
Johannes Bergdf140462015-04-22 14:40:58 +02003582 return false;
Johannes Berga58fbe12015-04-22 15:08:39 +02003583 if (!rx->sta) {
Jouni Malinen0fb8ca42008-12-12 14:38:33 +02003584 int rate_idx;
Johannes Berg56146182012-11-09 15:07:02 +01003585 if (status->flag & (RX_FLAG_HT | RX_FLAG_VHT))
3586 rate_idx = 0; /* TODO: HT/VHT rates */
Jouni Malinen0fb8ca42008-12-12 14:38:33 +02003587 else
Johannes Bergeb9fb5b2009-11-16 13:58:20 +01003588 rate_idx = status->rate_idx;
Johannes Berg8bf11d82011-12-15 11:17:37 +01003589 ieee80211_ibss_rx_no_sta(sdata, bssid, hdr->addr2,
3590 BIT(rate_idx));
Jouni Malinen0fb8ca42008-12-12 14:38:33 +02003591 }
Johannes Berga58fbe12015-04-22 15:08:39 +02003592 return true;
Rostislav Lisovy239281f2014-11-03 10:33:19 +01003593 case NL80211_IFTYPE_OCB:
3594 if (!bssid)
3595 return false;
Bertold Van den Berghcc117292015-08-05 16:02:42 +02003596 if (!ieee80211_is_data_present(hdr->frame_control))
Rostislav Lisovy239281f2014-11-03 10:33:19 +01003597 return false;
Johannes Berga58fbe12015-04-22 15:08:39 +02003598 if (!is_broadcast_ether_addr(bssid))
Rostislav Lisovy239281f2014-11-03 10:33:19 +01003599 return false;
Johannes Berga58fbe12015-04-22 15:08:39 +02003600 if (!multicast &&
3601 !ether_addr_equal(sdata->dev->dev_addr, hdr->addr1))
Johannes Bergdf140462015-04-22 14:40:58 +02003602 return false;
Johannes Berga58fbe12015-04-22 15:08:39 +02003603 if (!rx->sta) {
Rostislav Lisovy239281f2014-11-03 10:33:19 +01003604 int rate_idx;
3605 if (status->flag & RX_FLAG_HT)
3606 rate_idx = 0; /* TODO: HT rates */
3607 else
3608 rate_idx = status->rate_idx;
3609 ieee80211_ocb_rx_no_sta(sdata, bssid, hdr->addr2,
3610 BIT(rate_idx));
3611 }
Johannes Berga58fbe12015-04-22 15:08:39 +02003612 return true;
Johannes Berg05c914f2008-09-11 00:01:58 +02003613 case NL80211_IFTYPE_MESH_POINT:
Johannes Berg58c4ee82018-01-04 15:51:53 +01003614 if (ether_addr_equal(sdata->vif.addr, hdr->addr2))
3615 return false;
Johannes Berga58fbe12015-04-22 15:08:39 +02003616 if (multicast)
3617 return true;
3618 return ether_addr_equal(sdata->vif.addr, hdr->addr1);
Johannes Berg05c914f2008-09-11 00:01:58 +02003619 case NL80211_IFTYPE_AP_VLAN:
3620 case NL80211_IFTYPE_AP:
Johannes Berga58fbe12015-04-22 15:08:39 +02003621 if (!bssid)
3622 return ether_addr_equal(sdata->vif.addr, hdr->addr1);
3623
3624 if (!ieee80211_bssid_match(bssid, sdata->vif.addr)) {
Johannes Berg3df6eae2011-12-06 10:39:40 +01003625 /*
3626 * Accept public action frames even when the
3627 * BSSID doesn't match, this is used for P2P
3628 * and location updates. Note that mac80211
3629 * itself never looks at these frames.
3630 */
Johannes Berg2b9ccd42013-05-13 16:42:40 +02003631 if (!multicast &&
3632 !ether_addr_equal(sdata->vif.addr, hdr->addr1))
Johannes Berg3c2723f52014-01-07 16:23:24 +01003633 return false;
Johannes Bergd48b2962012-07-06 22:19:27 +02003634 if (ieee80211_is_public_action(hdr, skb->len))
Johannes Berg3c2723f52014-01-07 16:23:24 +01003635 return true;
Johannes Berg5c900672015-04-22 14:48:34 +02003636 return ieee80211_is_beacon(hdr->frame_control);
Johannes Berga58fbe12015-04-22 15:08:39 +02003637 }
3638
3639 if (!ieee80211_has_tods(hdr->frame_control)) {
Arik Nemtsovdb8e1732014-07-17 17:14:30 +03003640 /* ignore data frames to TDLS-peers */
3641 if (ieee80211_is_data(hdr->frame_control))
3642 return false;
3643 /* ignore action frames to TDLS-peers */
3644 if (ieee80211_is_action(hdr->frame_control) &&
Jouni Malinen1ec7bae2016-03-01 00:29:00 +02003645 !is_broadcast_ether_addr(bssid) &&
Arik Nemtsovdb8e1732014-07-17 17:14:30 +03003646 !ether_addr_equal(bssid, hdr->addr1))
3647 return false;
Johannes Berg23a24de2007-07-27 15:43:22 +02003648 }
Johannes Berge0411f12017-04-20 21:32:16 +02003649
3650 /*
3651 * 802.11-2016 Table 9-26 says that for data frames, A1 must be
3652 * the BSSID - we've checked that already but may have accepted
3653 * the wildcard (ff:ff:ff:ff:ff:ff).
3654 *
3655 * It also says:
3656 * The BSSID of the Data frame is determined as follows:
3657 * a) If the STA is contained within an AP or is associated
3658 * with an AP, the BSSID is the address currently in use
3659 * by the STA contained in the AP.
3660 *
3661 * So we should not accept data frames with an address that's
3662 * multicast.
3663 *
3664 * Accepting it also opens a security problem because stations
3665 * could encrypt it with the GTK and inject traffic that way.
3666 */
3667 if (ieee80211_is_data(hdr->frame_control) && multicast)
3668 return false;
3669
Johannes Berga58fbe12015-04-22 15:08:39 +02003670 return true;
Johannes Berg05c914f2008-09-11 00:01:58 +02003671 case NL80211_IFTYPE_WDS:
Harvey Harrisona7767f92008-07-02 16:30:51 -07003672 if (bssid || !ieee80211_is_data(hdr->frame_control))
Johannes Berg3c2723f52014-01-07 16:23:24 +01003673 return false;
Johannes Berga58fbe12015-04-22 15:08:39 +02003674 return ether_addr_equal(sdata->u.wds.remote_addr, hdr->addr2);
Johannes Bergf142c6b2012-06-18 20:07:15 +02003675 case NL80211_IFTYPE_P2P_DEVICE:
Johannes Berga58fbe12015-04-22 15:08:39 +02003676 return ieee80211_is_public_action(hdr, skb->len) ||
3677 ieee80211_is_probe_req(hdr->frame_control) ||
3678 ieee80211_is_probe_resp(hdr->frame_control) ||
3679 ieee80211_is_beacon(hdr->frame_control);
Ayala Bekercb3b7d82016-09-20 17:31:13 +03003680 case NL80211_IFTYPE_NAN:
3681 /* Currently no frames on NAN interface are allowed */
3682 return false;
Johannes Berg2ca27bc2010-09-16 14:58:23 +02003683 default:
Johannes Bergfb1c1cd2007-09-26 15:19:43 +02003684 break;
Johannes Berg23a24de2007-07-27 15:43:22 +02003685 }
3686
Johannes Berga58fbe12015-04-22 15:08:39 +02003687 WARN_ON_ONCE(1);
3688 return false;
Johannes Berg23a24de2007-07-27 15:43:22 +02003689}
3690
Johannes Berg49ddf8e2016-03-31 20:02:10 +03003691void ieee80211_check_fast_rx(struct sta_info *sta)
3692{
3693 struct ieee80211_sub_if_data *sdata = sta->sdata;
3694 struct ieee80211_local *local = sdata->local;
3695 struct ieee80211_key *key;
3696 struct ieee80211_fast_rx fastrx = {
3697 .dev = sdata->dev,
3698 .vif_type = sdata->vif.type,
3699 .control_port_protocol = sdata->control_port_protocol,
3700 }, *old, *new = NULL;
3701 bool assign = false;
3702
3703 /* use sparse to check that we don't return without updating */
3704 __acquire(check_fast_rx);
3705
3706 BUILD_BUG_ON(sizeof(fastrx.rfc1042_hdr) != sizeof(rfc1042_header));
3707 BUILD_BUG_ON(sizeof(fastrx.rfc1042_hdr) != ETH_ALEN);
3708 ether_addr_copy(fastrx.rfc1042_hdr, rfc1042_header);
3709 ether_addr_copy(fastrx.vif_addr, sdata->vif.addr);
3710
Johannes Bergc9c59622016-03-31 20:02:11 +03003711 fastrx.uses_rss = ieee80211_hw_check(&local->hw, USES_RSS);
3712
Johannes Berg49ddf8e2016-03-31 20:02:10 +03003713 /* fast-rx doesn't do reordering */
3714 if (ieee80211_hw_check(&local->hw, AMPDU_AGGREGATION) &&
3715 !ieee80211_hw_check(&local->hw, SUPPORTS_REORDERING_BUFFER))
3716 goto clear;
3717
3718 switch (sdata->vif.type) {
3719 case NL80211_IFTYPE_STATION:
3720 /* 4-addr is harder to deal with, later maybe */
3721 if (sdata->u.mgd.use_4addr)
3722 goto clear;
3723 /* software powersave is a huge mess, avoid all of it */
3724 if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK))
3725 goto clear;
3726 if (ieee80211_hw_check(&local->hw, SUPPORTS_PS) &&
3727 !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS))
3728 goto clear;
3729 if (sta->sta.tdls) {
3730 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr1);
3731 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr2);
3732 fastrx.expected_ds_bits = 0;
3733 } else {
3734 fastrx.sta_notify = sdata->u.mgd.probe_send_count > 0;
3735 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr1);
3736 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr3);
3737 fastrx.expected_ds_bits =
3738 cpu_to_le16(IEEE80211_FCTL_FROMDS);
3739 }
3740 break;
3741 case NL80211_IFTYPE_AP_VLAN:
3742 case NL80211_IFTYPE_AP:
3743 /* parallel-rx requires this, at least with calls to
3744 * ieee80211_sta_ps_transition()
3745 */
3746 if (!ieee80211_hw_check(&local->hw, AP_LINK_PS))
3747 goto clear;
3748 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3);
3749 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr2);
3750 fastrx.expected_ds_bits = cpu_to_le16(IEEE80211_FCTL_TODS);
3751
3752 fastrx.internal_forward =
3753 !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
3754 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN ||
3755 !sdata->u.vlan.sta);
3756 break;
3757 default:
3758 goto clear;
3759 }
3760
3761 if (!test_sta_flag(sta, WLAN_STA_AUTHORIZED))
3762 goto clear;
3763
3764 rcu_read_lock();
3765 key = rcu_dereference(sta->ptk[sta->ptk_idx]);
3766 if (key) {
3767 switch (key->conf.cipher) {
3768 case WLAN_CIPHER_SUITE_TKIP:
3769 /* we don't want to deal with MMIC in fast-rx */
3770 goto clear_rcu;
3771 case WLAN_CIPHER_SUITE_CCMP:
3772 case WLAN_CIPHER_SUITE_CCMP_256:
3773 case WLAN_CIPHER_SUITE_GCMP:
3774 case WLAN_CIPHER_SUITE_GCMP_256:
3775 break;
3776 default:
3777 /* we also don't want to deal with WEP or cipher scheme
3778 * since those require looking up the key idx in the
3779 * frame, rather than assuming the PTK is used
3780 * (we need to revisit this once we implement the real
3781 * PTK index, which is now valid in the spec, but we
3782 * haven't implemented that part yet)
3783 */
3784 goto clear_rcu;
3785 }
3786
3787 fastrx.key = true;
3788 fastrx.icv_len = key->conf.icv_len;
3789 }
3790
3791 assign = true;
3792 clear_rcu:
3793 rcu_read_unlock();
3794 clear:
3795 __release(check_fast_rx);
3796
3797 if (assign)
3798 new = kmemdup(&fastrx, sizeof(fastrx), GFP_KERNEL);
3799
3800 spin_lock_bh(&sta->lock);
3801 old = rcu_dereference_protected(sta->fast_rx, true);
3802 rcu_assign_pointer(sta->fast_rx, new);
3803 spin_unlock_bh(&sta->lock);
3804
3805 if (old)
3806 kfree_rcu(old, rcu_head);
3807}
3808
3809void ieee80211_clear_fast_rx(struct sta_info *sta)
3810{
3811 struct ieee80211_fast_rx *old;
3812
3813 spin_lock_bh(&sta->lock);
3814 old = rcu_dereference_protected(sta->fast_rx, true);
3815 RCU_INIT_POINTER(sta->fast_rx, NULL);
3816 spin_unlock_bh(&sta->lock);
3817
3818 if (old)
3819 kfree_rcu(old, rcu_head);
3820}
3821
3822void __ieee80211_check_fast_rx_iface(struct ieee80211_sub_if_data *sdata)
3823{
3824 struct ieee80211_local *local = sdata->local;
3825 struct sta_info *sta;
3826
3827 lockdep_assert_held(&local->sta_mtx);
3828
3829 list_for_each_entry_rcu(sta, &local->sta_list, list) {
3830 if (sdata != sta->sdata &&
3831 (!sta->sdata->bss || sta->sdata->bss != sdata->bss))
3832 continue;
3833 ieee80211_check_fast_rx(sta);
3834 }
3835}
3836
3837void ieee80211_check_fast_rx_iface(struct ieee80211_sub_if_data *sdata)
3838{
3839 struct ieee80211_local *local = sdata->local;
3840
3841 mutex_lock(&local->sta_mtx);
3842 __ieee80211_check_fast_rx_iface(sdata);
3843 mutex_unlock(&local->sta_mtx);
3844}
3845
3846static bool ieee80211_invoke_fast_rx(struct ieee80211_rx_data *rx,
3847 struct ieee80211_fast_rx *fast_rx)
3848{
3849 struct sk_buff *skb = rx->skb;
3850 struct ieee80211_hdr *hdr = (void *)skb->data;
3851 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
3852 struct sta_info *sta = rx->sta;
3853 int orig_len = skb->len;
3854 int snap_offs = ieee80211_hdrlen(hdr->frame_control);
3855 struct {
3856 u8 snap[sizeof(rfc1042_header)];
3857 __be16 proto;
3858 } *payload __aligned(2);
3859 struct {
3860 u8 da[ETH_ALEN];
3861 u8 sa[ETH_ALEN];
3862 } addrs __aligned(2);
Johannes Bergc9c59622016-03-31 20:02:11 +03003863 struct ieee80211_sta_rx_stats *stats = &sta->rx_stats;
3864
3865 if (fast_rx->uses_rss)
3866 stats = this_cpu_ptr(sta->pcpu_rx_stats);
Johannes Berg49ddf8e2016-03-31 20:02:10 +03003867
3868 /* for parallel-rx, we need to have DUP_VALIDATED, otherwise we write
3869 * to a common data structure; drivers can implement that per queue
3870 * but we don't have that information in mac80211
3871 */
3872 if (!(status->flag & RX_FLAG_DUP_VALIDATED))
3873 return false;
3874
3875#define FAST_RX_CRYPT_FLAGS (RX_FLAG_PN_VALIDATED | RX_FLAG_DECRYPTED)
3876
3877 /* If using encryption, we also need to have:
3878 * - PN_VALIDATED: similar, but the implementation is tricky
3879 * - DECRYPTED: necessary for PN_VALIDATED
3880 */
3881 if (fast_rx->key &&
3882 (status->flag & FAST_RX_CRYPT_FLAGS) != FAST_RX_CRYPT_FLAGS)
3883 return false;
3884
3885 /* we don't deal with A-MSDU deaggregation here */
3886 if (status->rx_flags & IEEE80211_RX_AMSDU)
3887 return false;
3888
3889 if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
3890 return false;
3891
3892 if (unlikely(ieee80211_is_frag(hdr)))
3893 return false;
3894
3895 /* Since our interface address cannot be multicast, this
3896 * implicitly also rejects multicast frames without the
3897 * explicit check.
3898 *
3899 * We shouldn't get any *data* frames not addressed to us
3900 * (AP mode will accept multicast *management* frames), but
3901 * punting here will make it go through the full checks in
3902 * ieee80211_accept_frame().
3903 */
3904 if (!ether_addr_equal(fast_rx->vif_addr, hdr->addr1))
3905 return false;
3906
3907 if ((hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_FROMDS |
3908 IEEE80211_FCTL_TODS)) !=
3909 fast_rx->expected_ds_bits)
Felix Fietkau6588cfd2018-02-23 10:06:03 +01003910 return false;
Johannes Berg49ddf8e2016-03-31 20:02:10 +03003911
3912 /* assign the key to drop unencrypted frames (later)
3913 * and strip the IV/MIC if necessary
3914 */
3915 if (fast_rx->key && !(status->flag & RX_FLAG_IV_STRIPPED)) {
3916 /* GCMP header length is the same */
3917 snap_offs += IEEE80211_CCMP_HDR_LEN;
3918 }
3919
3920 if (!pskb_may_pull(skb, snap_offs + sizeof(*payload)))
3921 goto drop;
3922 payload = (void *)(skb->data + snap_offs);
3923
3924 if (!ether_addr_equal(payload->snap, fast_rx->rfc1042_hdr))
3925 return false;
3926
3927 /* Don't handle these here since they require special code.
3928 * Accept AARP and IPX even though they should come with a
3929 * bridge-tunnel header - but if we get them this way then
3930 * there's little point in discarding them.
3931 */
3932 if (unlikely(payload->proto == cpu_to_be16(ETH_P_TDLS) ||
3933 payload->proto == fast_rx->control_port_protocol))
3934 return false;
3935
3936 /* after this point, don't punt to the slowpath! */
3937
3938 if (rx->key && !(status->flag & RX_FLAG_MIC_STRIPPED) &&
3939 pskb_trim(skb, skb->len - fast_rx->icv_len))
3940 goto drop;
3941
3942 if (unlikely(fast_rx->sta_notify)) {
3943 ieee80211_sta_rx_notify(rx->sdata, hdr);
3944 fast_rx->sta_notify = false;
3945 }
3946
3947 /* statistics part of ieee80211_rx_h_sta_process() */
Johannes Bergc9c59622016-03-31 20:02:11 +03003948 stats->last_rx = jiffies;
3949 stats->last_rate = sta_stats_encode_rate(status);
Johannes Berg49ddf8e2016-03-31 20:02:10 +03003950
Johannes Bergc9c59622016-03-31 20:02:11 +03003951 stats->fragments++;
Johannes Berg841e4e72017-02-20 08:59:16 +01003952 stats->packets++;
Johannes Berg49ddf8e2016-03-31 20:02:10 +03003953
3954 if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
Johannes Bergc9c59622016-03-31 20:02:11 +03003955 stats->last_signal = status->signal;
3956 if (!fast_rx->uses_rss)
3957 ewma_signal_add(&sta->rx_stats_avg.signal,
3958 -status->signal);
Johannes Berg49ddf8e2016-03-31 20:02:10 +03003959 }
3960
3961 if (status->chains) {
3962 int i;
3963
Johannes Bergc9c59622016-03-31 20:02:11 +03003964 stats->chains = status->chains;
Johannes Berg49ddf8e2016-03-31 20:02:10 +03003965 for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {
3966 int signal = status->chain_signal[i];
3967
3968 if (!(status->chains & BIT(i)))
3969 continue;
3970
Johannes Bergc9c59622016-03-31 20:02:11 +03003971 stats->chain_signal_last[i] = signal;
3972 if (!fast_rx->uses_rss)
3973 ewma_signal_add(&sta->rx_stats_avg.chain_signal[i],
3974 -signal);
Johannes Berg49ddf8e2016-03-31 20:02:10 +03003975 }
3976 }
3977 /* end of statistics */
3978
3979 if (rx->key && !ieee80211_has_protected(hdr->frame_control))
3980 goto drop;
3981
3982 /* do the header conversion - first grab the addresses */
3983 ether_addr_copy(addrs.da, skb->data + fast_rx->da_offs);
3984 ether_addr_copy(addrs.sa, skb->data + fast_rx->sa_offs);
3985 /* remove the SNAP but leave the ethertype */
3986 skb_pull(skb, snap_offs + sizeof(rfc1042_header));
3987 /* push the addresses in front */
3988 memcpy(skb_push(skb, sizeof(addrs)), &addrs, sizeof(addrs));
3989
3990 skb->dev = fast_rx->dev;
3991
3992 ieee80211_rx_stats(fast_rx->dev, skb->len);
3993
3994 /* The seqno index has the same property as needed
3995 * for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS
3996 * for non-QoS-data frames. Here we know it's a data
3997 * frame, so count MSDUs.
3998 */
Johannes Bergc9c59622016-03-31 20:02:11 +03003999 u64_stats_update_begin(&stats->syncp);
4000 stats->msdu[rx->seqno_idx]++;
4001 stats->bytes += orig_len;
4002 u64_stats_update_end(&stats->syncp);
Johannes Berg49ddf8e2016-03-31 20:02:10 +03004003
4004 if (fast_rx->internal_forward) {
Johannes Bergbab10a52016-12-14 16:47:43 +01004005 struct sk_buff *xmit_skb = NULL;
4006 bool multicast = is_multicast_ether_addr(skb->data);
Johannes Berg49ddf8e2016-03-31 20:02:10 +03004007
Johannes Bergbab10a52016-12-14 16:47:43 +01004008 if (multicast) {
4009 xmit_skb = skb_copy(skb, GFP_ATOMIC);
4010 } else if (sta_info_get(rx->sdata, skb->data)) {
4011 xmit_skb = skb;
4012 skb = NULL;
4013 }
4014
4015 if (xmit_skb) {
Johannes Berg49ddf8e2016-03-31 20:02:10 +03004016 /*
4017 * Send to wireless media and increase priority by 256
4018 * to keep the received priority instead of
4019 * reclassifying the frame (see cfg80211_classify8021d).
4020 */
Johannes Bergbab10a52016-12-14 16:47:43 +01004021 xmit_skb->priority += 256;
4022 xmit_skb->protocol = htons(ETH_P_802_3);
4023 skb_reset_network_header(xmit_skb);
4024 skb_reset_mac_header(xmit_skb);
4025 dev_queue_xmit(xmit_skb);
Johannes Berg49ddf8e2016-03-31 20:02:10 +03004026 }
Johannes Bergbab10a52016-12-14 16:47:43 +01004027
4028 if (!skb)
4029 return true;
Johannes Berg49ddf8e2016-03-31 20:02:10 +03004030 }
4031
4032 /* deliver to local stack */
4033 skb->protocol = eth_type_trans(skb, fast_rx->dev);
4034 memset(skb->cb, 0, sizeof(skb->cb));
4035 if (rx->napi)
4036 napi_gro_receive(rx->napi, skb);
4037 else
4038 netif_receive_skb(skb);
4039
4040 return true;
4041 drop:
4042 dev_kfree_skb(skb);
Johannes Bergc9c59622016-03-31 20:02:11 +03004043 stats->dropped++;
Johannes Berg49ddf8e2016-03-31 20:02:10 +03004044 return true;
4045}
4046
Johannes Berg571ecf62007-07-27 15:43:22 +02004047/*
Johannes Berg4406c372010-09-24 11:21:06 +02004048 * This function returns whether or not the SKB
4049 * was destined for RX processing or not, which,
4050 * if consume is true, is equivalent to whether
4051 * or not the skb was consumed.
4052 */
4053static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,
4054 struct sk_buff *skb, bool consume)
4055{
4056 struct ieee80211_local *local = rx->local;
4057 struct ieee80211_sub_if_data *sdata = rx->sdata;
Johannes Berg4406c372010-09-24 11:21:06 +02004058
4059 rx->skb = skb;
Johannes Berg4406c372010-09-24 11:21:06 +02004060
Johannes Berg49ddf8e2016-03-31 20:02:10 +03004061 /* See if we can do fast-rx; if we have to copy we already lost,
4062 * so punt in that case. We should never have to deliver a data
4063 * frame to multiple interfaces anyway.
4064 *
4065 * We skip the ieee80211_accept_frame() call and do the necessary
4066 * checking inside ieee80211_invoke_fast_rx().
4067 */
4068 if (consume && rx->sta) {
4069 struct ieee80211_fast_rx *fast_rx;
4070
4071 fast_rx = rcu_dereference(rx->sta->fast_rx);
4072 if (fast_rx && ieee80211_invoke_fast_rx(rx, fast_rx))
4073 return true;
4074 }
4075
Johannes Berga58fbe12015-04-22 15:08:39 +02004076 if (!ieee80211_accept_frame(rx))
Johannes Berg4406c372010-09-24 11:21:06 +02004077 return false;
4078
Johannes Berg4406c372010-09-24 11:21:06 +02004079 if (!consume) {
4080 skb = skb_copy(skb, GFP_ATOMIC);
4081 if (!skb) {
4082 if (net_ratelimit())
4083 wiphy_debug(local->hw.wiphy,
Ben Greearb305dae2011-01-08 10:30:54 -08004084 "failed to copy skb for %s\n",
Johannes Berg4406c372010-09-24 11:21:06 +02004085 sdata->name);
4086 return true;
4087 }
4088
4089 rx->skb = skb;
4090 }
4091
4092 ieee80211_invoke_rx_handlers(rx);
4093 return true;
4094}
4095
4096/*
Zhao, Gang6b59db72014-04-21 12:52:59 +08004097 * This is the actual Rx frames handler. as it belongs to Rx path it must
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +02004098 * be called with rcu_read_lock protection.
Johannes Berg571ecf62007-07-27 15:43:22 +02004099 */
Ron Rindjunsky71ebb4a2008-01-21 12:39:12 +02004100static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
Johannes Bergd63b5482016-03-31 20:02:02 +03004101 struct ieee80211_sta *pubsta,
Johannes Bergaf9f9b22015-06-11 16:02:32 +02004102 struct sk_buff *skb,
4103 struct napi_struct *napi)
Johannes Berg571ecf62007-07-27 15:43:22 +02004104{
4105 struct ieee80211_local *local = hw_to_local(hw);
4106 struct ieee80211_sub_if_data *sdata;
Johannes Berg571ecf62007-07-27 15:43:22 +02004107 struct ieee80211_hdr *hdr;
Zhu Yie3cf8b32010-03-29 17:35:07 +08004108 __le16 fc;
Johannes Berg5cf121c2008-02-25 16:27:43 +01004109 struct ieee80211_rx_data rx;
Johannes Berg4406c372010-09-24 11:21:06 +02004110 struct ieee80211_sub_if_data *prev;
Herbert Xu83e7e4c2016-09-19 19:00:10 +08004111 struct rhlist_head *tmp;
Zhu Yie3cf8b32010-03-29 17:35:07 +08004112 int err = 0;
Johannes Berg571ecf62007-07-27 15:43:22 +02004113
Zhu Yie3cf8b32010-03-29 17:35:07 +08004114 fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
Johannes Berg571ecf62007-07-27 15:43:22 +02004115 memset(&rx, 0, sizeof(rx));
4116 rx.skb = skb;
4117 rx.local = local;
Johannes Bergaf9f9b22015-06-11 16:02:32 +02004118 rx.napi = napi;
Johannes Berg72abd812007-09-17 01:29:22 -04004119
Zhu Yie3cf8b32010-03-29 17:35:07 +08004120 if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc))
Johannes Bergc206ca62015-04-22 20:47:28 +02004121 I802_DEBUG_INC(local->dot11ReceivedFragmentCount);
Johannes Berg571ecf62007-07-27 15:43:22 +02004122
Johannes Berg4a4f1a52012-10-26 00:33:36 +02004123 if (ieee80211_is_mgmt(fc)) {
4124 /* drop frame if too short for header */
4125 if (skb->len < ieee80211_hdrlen(fc))
4126 err = -ENOBUFS;
4127 else
4128 err = skb_linearize(skb);
4129 } else {
Zhu Yie3cf8b32010-03-29 17:35:07 +08004130 err = !pskb_may_pull(skb, ieee80211_hdrlen(fc));
Johannes Berg4a4f1a52012-10-26 00:33:36 +02004131 }
Zhu Yie3cf8b32010-03-29 17:35:07 +08004132
4133 if (err) {
4134 dev_kfree_skb(skb);
4135 return;
4136 }
4137
4138 hdr = (struct ieee80211_hdr *)skb->data;
Johannes Berg38f37142008-01-29 17:07:43 +01004139 ieee80211_parse_qos(&rx);
Johannes Bergd1c3a372009-01-07 00:26:10 +01004140 ieee80211_verify_alignment(&rx);
Johannes Berg38f37142008-01-29 17:07:43 +01004141
Johannes Bergd48b2962012-07-06 22:19:27 +02004142 if (unlikely(ieee80211_is_probe_resp(hdr->frame_control) ||
4143 ieee80211_is_beacon(hdr->frame_control)))
4144 ieee80211_scan_rx(local, skb);
4145
Johannes Bergb507df22017-02-27 09:38:11 +01004146 if (ieee80211_is_data(fc)) {
Johannes Bergd63b5482016-03-31 20:02:02 +03004147 struct sta_info *sta, *prev_sta;
Johannes Berg7bedd0c2015-02-13 21:55:15 +01004148
Johannes Bergb507df22017-02-27 09:38:11 +01004149 if (pubsta) {
4150 rx.sta = container_of(pubsta, struct sta_info, sta);
4151 rx.sdata = rx.sta->sdata;
4152 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
4153 return;
4154 goto out;
4155 }
4156
Ben Greear56af3262010-09-23 10:22:24 -07004157 prev_sta = NULL;
Johannes Berg4406c372010-09-24 11:21:06 +02004158
Herbert Xu83e7e4c2016-09-19 19:00:10 +08004159 for_each_sta_info(local, hdr->addr2, sta, tmp) {
Ben Greear56af3262010-09-23 10:22:24 -07004160 if (!prev_sta) {
4161 prev_sta = sta;
4162 continue;
4163 }
4164
4165 rx.sta = prev_sta;
4166 rx.sdata = prev_sta->sdata;
Johannes Berg4406c372010-09-24 11:21:06 +02004167 ieee80211_prepare_and_rx_handle(&rx, skb, false);
Johannes Berg571ecf62007-07-27 15:43:22 +02004168
Ben Greear56af3262010-09-23 10:22:24 -07004169 prev_sta = sta;
Johannes Berg4406c372010-09-24 11:21:06 +02004170 }
Ben Greear56af3262010-09-23 10:22:24 -07004171
4172 if (prev_sta) {
4173 rx.sta = prev_sta;
4174 rx.sdata = prev_sta->sdata;
4175
Johannes Berg4406c372010-09-24 11:21:06 +02004176 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
Ben Greear56af3262010-09-23 10:22:24 -07004177 return;
Senthil Balasubramanian8e26d5a2010-11-30 20:15:38 +05304178 goto out;
Ben Greear56af3262010-09-23 10:22:24 -07004179 }
Johannes Berg4406c372010-09-24 11:21:06 +02004180 }
4181
Johannes Berg4b0dd982010-09-24 11:21:07 +02004182 prev = NULL;
Johannes Berg4406c372010-09-24 11:21:06 +02004183
Johannes Berg4b0dd982010-09-24 11:21:07 +02004184 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
4185 if (!ieee80211_sdata_running(sdata))
4186 continue;
Johannes Bergabe60632009-11-25 17:46:18 +01004187
Johannes Berg4b0dd982010-09-24 11:21:07 +02004188 if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
4189 sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
4190 continue;
Johannes Bergabe60632009-11-25 17:46:18 +01004191
Johannes Berg4b0dd982010-09-24 11:21:07 +02004192 /*
4193 * frame is destined for this interface, but if it's
4194 * not also for the previous one we handle that after
4195 * the loop to avoid copying the SKB once too much
4196 */
Johannes Bergb2e77712007-09-26 15:19:39 +02004197
Johannes Berg4b0dd982010-09-24 11:21:07 +02004198 if (!prev) {
Johannes Berg340e11f2007-07-27 15:43:22 +02004199 prev = sdata;
Johannes Berg4b0dd982010-09-24 11:21:07 +02004200 continue;
Johannes Berg8e6f00322007-07-27 15:43:22 +02004201 }
Felix Fietkau4bb29f82010-01-22 00:36:39 +01004202
Johannes Berg7852e362012-01-20 13:55:24 +01004203 rx.sta = sta_info_get_bss(prev, hdr->addr2);
Johannes Berg4b0dd982010-09-24 11:21:07 +02004204 rx.sdata = prev;
4205 ieee80211_prepare_and_rx_handle(&rx, skb, false);
Felix Fietkau4bb29f82010-01-22 00:36:39 +01004206
Johannes Berg4b0dd982010-09-24 11:21:07 +02004207 prev = sdata;
4208 }
Johannes Berg4406c372010-09-24 11:21:06 +02004209
Johannes Berg4b0dd982010-09-24 11:21:07 +02004210 if (prev) {
Johannes Berg7852e362012-01-20 13:55:24 +01004211 rx.sta = sta_info_get_bss(prev, hdr->addr2);
Johannes Berg4b0dd982010-09-24 11:21:07 +02004212 rx.sdata = prev;
4213
4214 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
4215 return;
Johannes Berg571ecf62007-07-27 15:43:22 +02004216 }
Johannes Berg4406c372010-09-24 11:21:06 +02004217
Senthil Balasubramanian8e26d5a2010-11-30 20:15:38 +05304218 out:
Johannes Berg4406c372010-09-24 11:21:06 +02004219 dev_kfree_skb(skb);
Johannes Berg571ecf62007-07-27 15:43:22 +02004220}
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +02004221
4222/*
4223 * This is the receive path handler. It is called by a low level driver when an
4224 * 802.11 MPDU is received from the hardware.
4225 */
Johannes Bergd63b5482016-03-31 20:02:02 +03004226void ieee80211_rx_napi(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta,
4227 struct sk_buff *skb, struct napi_struct *napi)
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +02004228{
4229 struct ieee80211_local *local = hw_to_local(hw);
Johannes Berg8318d782008-01-24 19:38:38 +01004230 struct ieee80211_rate *rate = NULL;
4231 struct ieee80211_supported_band *sband;
Johannes Bergf1d58c22009-06-17 13:13:00 +02004232 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
Johannes Berg8318d782008-01-24 19:38:38 +01004233
Johannes Bergd20ef632009-10-11 15:10:40 +02004234 WARN_ON_ONCE(softirq_count() == 0);
4235
Johannes Berg57fbcce2016-04-12 15:56:15 +02004236 if (WARN_ON(status->band >= NUM_NL80211_BANDS))
Johannes Berg77a980d2009-08-24 11:46:30 +02004237 goto drop;
Johannes Berg8318d782008-01-24 19:38:38 +01004238
4239 sband = local->hw.wiphy->bands[status->band];
Johannes Berg77a980d2009-08-24 11:46:30 +02004240 if (WARN_ON(!sband))
4241 goto drop;
Johannes Berg8318d782008-01-24 19:38:38 +01004242
Johannes Berg89c3a8a2009-07-28 18:10:17 +02004243 /*
4244 * If we're suspending, it is possible although not too likely
4245 * that we'd be receiving frames after having already partially
4246 * quiesced the stack. We can't process such frames then since
4247 * that might, for example, cause stations to be added or other
4248 * driver callbacks be invoked.
4249 */
Johannes Berg77a980d2009-08-24 11:46:30 +02004250 if (unlikely(local->quiescing || local->suspended))
4251 goto drop;
Johannes Berg89c3a8a2009-07-28 18:10:17 +02004252
Arik Nemtsov04800ad2012-06-06 11:25:02 +03004253 /* We might be during a HW reconfig, prevent Rx for the same reason */
4254 if (unlikely(local->in_reconfig))
4255 goto drop;
4256
Johannes Bergea77f122009-08-21 14:44:45 +02004257 /*
4258 * The same happens when we're not even started,
4259 * but that's worth a warning.
4260 */
Johannes Berg77a980d2009-08-24 11:46:30 +02004261 if (WARN_ON(!local->started))
4262 goto drop;
Johannes Bergea77f122009-08-21 14:44:45 +02004263
Johannes Bergfc885182010-07-30 13:23:12 +02004264 if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC))) {
Luis R. Rodrigueze5d6eb82009-11-09 16:03:22 -05004265 /*
Johannes Bergfc885182010-07-30 13:23:12 +02004266 * Validate the rate, unless a PLCP error means that
4267 * we probably can't have a valid rate here anyway.
Luis R. Rodrigueze5d6eb82009-11-09 16:03:22 -05004268 */
Johannes Bergfc885182010-07-30 13:23:12 +02004269
4270 if (status->flag & RX_FLAG_HT) {
4271 /*
4272 * rate_idx is MCS index, which can be [0-76]
4273 * as documented on:
4274 *
4275 * http://wireless.kernel.org/en/developers/Documentation/ieee80211/802.11n
4276 *
4277 * Anything else would be some sort of driver or
4278 * hardware error. The driver should catch hardware
4279 * errors.
4280 */
Johannes Berg444e38032012-09-30 17:08:35 +02004281 if (WARN(status->rate_idx > 76,
Johannes Bergfc885182010-07-30 13:23:12 +02004282 "Rate marked as an HT rate but passed "
4283 "status->rate_idx is not "
4284 "an MCS index [0-76]: %d (0x%02x)\n",
4285 status->rate_idx,
4286 status->rate_idx))
4287 goto drop;
Johannes Berg56146182012-11-09 15:07:02 +01004288 } else if (status->flag & RX_FLAG_VHT) {
4289 if (WARN_ONCE(status->rate_idx > 9 ||
4290 !status->vht_nss ||
4291 status->vht_nss > 8,
4292 "Rate marked as a VHT rate but data is invalid: MCS: %d, NSS: %d\n",
4293 status->rate_idx, status->vht_nss))
4294 goto drop;
Johannes Bergfc885182010-07-30 13:23:12 +02004295 } else {
Johannes Berg444e38032012-09-30 17:08:35 +02004296 if (WARN_ON(status->rate_idx >= sband->n_bitrates))
Johannes Bergfc885182010-07-30 13:23:12 +02004297 goto drop;
4298 rate = &sband->bitrates[status->rate_idx];
4299 }
Jouni Malinen0fb8ca42008-12-12 14:38:33 +02004300 }
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +02004301
Johannes Berg554891e2010-09-24 12:38:25 +02004302 status->rx_flags = 0;
4303
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +02004304 /*
4305 * key references and virtual interfaces are protected using RCU
4306 * and this requires that we are in a read-side RCU section during
4307 * receive processing
4308 */
4309 rcu_read_lock();
4310
4311 /*
4312 * Frames with failed FCS/PLCP checksum are not returned,
4313 * all other frames are returned without radiotap header
4314 * if it was previously present.
4315 * Also, frames with less than 16 bytes are dropped.
4316 */
Johannes Bergf1d58c22009-06-17 13:13:00 +02004317 skb = ieee80211_rx_monitor(local, skb, rate);
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +02004318 if (!skb) {
4319 rcu_read_unlock();
4320 return;
4321 }
4322
Johannes Berge1e54062010-11-30 08:58:45 +01004323 ieee80211_tpt_led_trig_rx(local,
4324 ((struct ieee80211_hdr *)skb->data)->frame_control,
4325 skb->len);
Johannes Bergd63b5482016-03-31 20:02:02 +03004326
4327 __ieee80211_rx_handle_packet(hw, pubsta, skb, napi);
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +02004328
4329 rcu_read_unlock();
Johannes Berg77a980d2009-08-24 11:46:30 +02004330
4331 return;
4332 drop:
4333 kfree_skb(skb);
Ron Rindjunsky6368e4b2007-12-24 13:36:39 +02004334}
Johannes Bergaf9f9b22015-06-11 16:02:32 +02004335EXPORT_SYMBOL(ieee80211_rx_napi);
Johannes Berg571ecf62007-07-27 15:43:22 +02004336
4337/* This is a version of the rx handler that can be called from hard irq
4338 * context. Post the skb on the queue and schedule the tasklet */
Johannes Bergf1d58c22009-06-17 13:13:00 +02004339void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb)
Johannes Berg571ecf62007-07-27 15:43:22 +02004340{
4341 struct ieee80211_local *local = hw_to_local(hw);
4342
4343 BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));
4344
Johannes Berg571ecf62007-07-27 15:43:22 +02004345 skb->pkt_type = IEEE80211_RX_MSG;
4346 skb_queue_tail(&local->skb_queue, skb);
4347 tasklet_schedule(&local->tasklet);
4348}
4349EXPORT_SYMBOL(ieee80211_rx_irqsafe);