1 /*
2  * NXP Wireless LAN device driver: station RX data handling
3  *
4  * Copyright 2011-2020 NXP
5  *
6  * This software file (the "File") is distributed by NXP
7  * under the terms of the GNU General Public License Version 2, June 1991
8  * (the "License").  You may use, redistribute and/or modify this File in
9  * accordance with the terms and conditions of the License, a copy of which
10  * is available by writing to the Free Software Foundation, Inc.,
11  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
12  * worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
13  *
14  * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
15  * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
16  * ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
17  * this warranty disclaimer.
18  */
19 
20 #include <uapi/linux/ipv6.h>
21 #include <net/ndisc.h>
22 #include "decl.h"
23 #include "ioctl.h"
24 #include "util.h"
25 #include "fw.h"
26 #include "main.h"
27 #include "11n_aggr.h"
28 #include "11n_rxreorder.h"
29 
30 /* This function checks if a frame is IPv4 ARP or IPv6 Neighbour advertisement
31  * frame. If frame has both source and destination mac address as same, this
32  * function drops such gratuitous frames.
33  */
34 static bool
35 mwifiex_discard_gratuitous_arp(struct mwifiex_private *priv,
36 			       struct sk_buff *skb)
37 {
38 	const struct mwifiex_arp_eth_header *arp;
39 	struct ethhdr *eth;
40 	struct ipv6hdr *ipv6;
41 	struct icmp6hdr *icmpv6;
42 
43 	eth = (struct ethhdr *)skb->data;
44 	switch (ntohs(eth->h_proto)) {
45 	case ETH_P_ARP:
46 		arp = (void *)(skb->data + sizeof(struct ethhdr));
47 		if (arp->hdr.ar_op == htons(ARPOP_REPLY) ||
48 		    arp->hdr.ar_op == htons(ARPOP_REQUEST)) {
49 			if (!memcmp(arp->ar_sip, arp->ar_tip, 4))
50 				return true;
51 		}
52 		break;
53 	case ETH_P_IPV6:
54 		ipv6 = (void *)(skb->data + sizeof(struct ethhdr));
55 		icmpv6 = (void *)(skb->data + sizeof(struct ethhdr) +
56 				  sizeof(struct ipv6hdr));
57 		if (NDISC_NEIGHBOUR_ADVERTISEMENT == icmpv6->icmp6_type) {
58 			if (!memcmp(&ipv6->saddr, &ipv6->daddr,
59 				    sizeof(struct in6_addr)))
60 				return true;
61 		}
62 		break;
63 	default:
64 		break;
65 	}
66 
67 	return false;
68 }
69 
70 /*
71  * This function processes the received packet and forwards it
72  * to kernel/upper layer.
73  *
74  * This function parses through the received packet and determines
75  * if it is a debug packet or normal packet.
76  *
77  * For non-debug packets, the function chops off unnecessary leading
78  * header bytes, reconstructs the packet as an ethernet frame or
79  * 802.2/llc/snap frame as required, and sends it to kernel/upper layer.
80  *
81  * The completion callback is called after processing in complete.
82  */
83 int mwifiex_process_rx_packet(struct mwifiex_private *priv,
84 			      struct sk_buff *skb)
85 {
86 	int ret;
87 	struct rx_packet_hdr *rx_pkt_hdr;
88 	struct rxpd *local_rx_pd;
89 	int hdr_chop;
90 	struct ethhdr *eth;
91 	u16 rx_pkt_off, rx_pkt_len;
92 	u8 *offset;
93 	u8 adj_rx_rate = 0;
94 
95 	local_rx_pd = (struct rxpd *) (skb->data);
96 
97 	rx_pkt_off = le16_to_cpu(local_rx_pd->rx_pkt_offset);
98 	rx_pkt_len = le16_to_cpu(local_rx_pd->rx_pkt_length);
99 	rx_pkt_hdr = (void *)local_rx_pd + rx_pkt_off;
100 
101 	if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header,
102 		     sizeof(bridge_tunnel_header))) ||
103 	    (!memcmp(&rx_pkt_hdr->rfc1042_hdr, rfc1042_header,
104 		     sizeof(rfc1042_header)) &&
105 	     ntohs(rx_pkt_hdr->rfc1042_hdr.snap_type) != ETH_P_AARP &&
106 	     ntohs(rx_pkt_hdr->rfc1042_hdr.snap_type) != ETH_P_IPX)) {
107 		/*
108 		 *  Replace the 803 header and rfc1042 header (llc/snap) with an
109 		 *    EthernetII header, keep the src/dst and snap_type
110 		 *    (ethertype).
111 		 *  The firmware only passes up SNAP frames converting
112 		 *    all RX Data from 802.11 to 802.2/LLC/SNAP frames.
113 		 *  To create the Ethernet II, just move the src, dst address
114 		 *    right before the snap_type.
115 		 */
116 		eth = (struct ethhdr *)
117 			((u8 *) &rx_pkt_hdr->eth803_hdr
118 			 + sizeof(rx_pkt_hdr->eth803_hdr) +
119 			 sizeof(rx_pkt_hdr->rfc1042_hdr)
120 			 - sizeof(rx_pkt_hdr->eth803_hdr.h_dest)
121 			 - sizeof(rx_pkt_hdr->eth803_hdr.h_source)
122 			 - sizeof(rx_pkt_hdr->rfc1042_hdr.snap_type));
123 
124 		memcpy(eth->h_source, rx_pkt_hdr->eth803_hdr.h_source,
125 		       sizeof(eth->h_source));
126 		memcpy(eth->h_dest, rx_pkt_hdr->eth803_hdr.h_dest,
127 		       sizeof(eth->h_dest));
128 
129 		/* Chop off the rxpd + the excess memory from the 802.2/llc/snap
130 		   header that was removed. */
131 		hdr_chop = (u8 *) eth - (u8 *) local_rx_pd;
132 	} else {
133 		/* Chop off the rxpd */
134 		hdr_chop = (u8 *) &rx_pkt_hdr->eth803_hdr -
135 			(u8 *) local_rx_pd;
136 	}
137 
138 	/* Chop off the leading header bytes so the it points to the start of
139 	   either the reconstructed EthII frame or the 802.2/llc/snap frame */
140 	skb_pull(skb, hdr_chop);
141 
142 	if (priv->hs2_enabled &&
143 	    mwifiex_discard_gratuitous_arp(priv, skb)) {
144 		mwifiex_dbg(priv->adapter, INFO, "Bypassed Gratuitous ARP\n");
145 		dev_kfree_skb_any(skb);
146 		return 0;
147 	}
148 
149 	if (ISSUPP_TDLS_ENABLED(priv->adapter->fw_cap_info) &&
150 	    ntohs(rx_pkt_hdr->eth803_hdr.h_proto) == ETH_P_TDLS) {
151 		offset = (u8 *)local_rx_pd + rx_pkt_off;
152 		mwifiex_process_tdls_action_frame(priv, offset, rx_pkt_len);
153 	}
154 
155 	/* Only stash RX bitrate for unicast packets. */
156 	if (likely(!is_multicast_ether_addr(rx_pkt_hdr->eth803_hdr.h_dest))) {
157 		priv->rxpd_rate = local_rx_pd->rx_rate;
158 		priv->rxpd_htinfo = local_rx_pd->ht_info;
159 	}
160 
161 	if (GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_STA ||
162 	    GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_UAP) {
163 		adj_rx_rate = mwifiex_adjust_data_rate(priv,
164 						       local_rx_pd->rx_rate,
165 						       local_rx_pd->ht_info);
166 		mwifiex_hist_data_add(priv, adj_rx_rate, local_rx_pd->snr,
167 				      local_rx_pd->nf);
168 	}
169 
170 	ret = mwifiex_recv_packet(priv, skb);
171 	if (ret == -1)
172 		mwifiex_dbg(priv->adapter, ERROR,
173 			    "recv packet failed\n");
174 
175 	return ret;
176 }
177 
178 /*
179  * This function processes the received buffer.
180  *
181  * The function looks into the RxPD and performs sanity tests on the
182  * received buffer to ensure its a valid packet, before processing it
183  * further. If the packet is determined to be aggregated, it is
184  * de-aggregated accordingly. Non-unicast packets are sent directly to
185  * the kernel/upper layers. Unicast packets are handed over to the
186  * Rx reordering routine if 11n is enabled.
187  *
188  * The completion callback is called after processing in complete.
189  */
190 int mwifiex_process_sta_rx_packet(struct mwifiex_private *priv,
191 				  struct sk_buff *skb)
192 {
193 	struct mwifiex_adapter *adapter = priv->adapter;
194 	int ret = 0;
195 	struct rxpd *local_rx_pd;
196 	struct rx_packet_hdr *rx_pkt_hdr;
197 	u8 ta[ETH_ALEN];
198 	u16 rx_pkt_type, rx_pkt_offset, rx_pkt_length, seq_num;
199 	struct mwifiex_sta_node *sta_ptr;
200 
201 	local_rx_pd = (struct rxpd *) (skb->data);
202 	rx_pkt_type = le16_to_cpu(local_rx_pd->rx_pkt_type);
203 	rx_pkt_offset = le16_to_cpu(local_rx_pd->rx_pkt_offset);
204 	rx_pkt_length = le16_to_cpu(local_rx_pd->rx_pkt_length);
205 	seq_num = le16_to_cpu(local_rx_pd->seq_num);
206 
207 	rx_pkt_hdr = (void *)local_rx_pd + rx_pkt_offset;
208 
209 	if ((rx_pkt_offset + rx_pkt_length) > (u16) skb->len) {
210 		mwifiex_dbg(adapter, ERROR,
211 			    "wrong rx packet: len=%d, rx_pkt_offset=%d, rx_pkt_length=%d\n",
212 			    skb->len, rx_pkt_offset, rx_pkt_length);
213 		priv->stats.rx_dropped++;
214 		dev_kfree_skb_any(skb);
215 		return ret;
216 	}
217 
218 	if (rx_pkt_type == PKT_TYPE_MGMT) {
219 		ret = mwifiex_process_mgmt_packet(priv, skb);
220 		if (ret)
221 			mwifiex_dbg(adapter, DATA, "Rx of mgmt packet failed");
222 		dev_kfree_skb_any(skb);
223 		return ret;
224 	}
225 
226 	/*
227 	 * If the packet is not an unicast packet then send the packet
228 	 * directly to os. Don't pass thru rx reordering
229 	 */
230 	if ((!IS_11N_ENABLED(priv) &&
231 	     !(ISSUPP_TDLS_ENABLED(priv->adapter->fw_cap_info) &&
232 	       !(local_rx_pd->flags & MWIFIEX_RXPD_FLAGS_TDLS_PACKET))) ||
233 	    !ether_addr_equal_unaligned(priv->curr_addr, rx_pkt_hdr->eth803_hdr.h_dest)) {
234 		mwifiex_process_rx_packet(priv, skb);
235 		return ret;
236 	}
237 
238 	if (mwifiex_queuing_ra_based(priv) ||
239 	    (ISSUPP_TDLS_ENABLED(priv->adapter->fw_cap_info) &&
240 	     local_rx_pd->flags & MWIFIEX_RXPD_FLAGS_TDLS_PACKET)) {
241 		memcpy(ta, rx_pkt_hdr->eth803_hdr.h_source, ETH_ALEN);
242 		if (local_rx_pd->flags & MWIFIEX_RXPD_FLAGS_TDLS_PACKET &&
243 		    local_rx_pd->priority < MAX_NUM_TID) {
244 			sta_ptr = mwifiex_get_sta_entry(priv, ta);
245 			if (sta_ptr)
246 				sta_ptr->rx_seq[local_rx_pd->priority] =
247 					      le16_to_cpu(local_rx_pd->seq_num);
248 			mwifiex_auto_tdls_update_peer_signal(priv, ta,
249 							     local_rx_pd->snr,
250 							     local_rx_pd->nf);
251 		}
252 	} else {
253 		if (rx_pkt_type != PKT_TYPE_BAR &&
254 		    local_rx_pd->priority < MAX_NUM_TID)
255 			priv->rx_seq[local_rx_pd->priority] = seq_num;
256 		memcpy(ta, priv->curr_bss_params.bss_descriptor.mac_address,
257 		       ETH_ALEN);
258 	}
259 
260 	/* Reorder and send to OS */
261 	ret = mwifiex_11n_rx_reorder_pkt(priv, seq_num, local_rx_pd->priority,
262 					 ta, (u8) rx_pkt_type, skb);
263 
264 	if (ret || (rx_pkt_type == PKT_TYPE_BAR))
265 		dev_kfree_skb_any(skb);
266 
267 	if (ret)
268 		priv->stats.rx_dropped++;
269 
270 	return ret;
271 }
272