1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright 2002-2005, Instant802 Networks, Inc. 4 * Copyright 2005-2006, Devicescape Software, Inc. 5 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz> 6 * Copyright 2007-2010 Johannes Berg <johannes@sipsolutions.net> 7 * Copyright 2013-2014 Intel Mobile Communications GmbH 8 * Copyright(c) 2015 - 2017 Intel Deutschland GmbH 9 * Copyright (C) 2018-2022 Intel Corporation 10 */ 11 12 #include <linux/jiffies.h> 13 #include <linux/slab.h> 14 #include <linux/kernel.h> 15 #include <linux/skbuff.h> 16 #include <linux/netdevice.h> 17 #include <linux/etherdevice.h> 18 #include <linux/rcupdate.h> 19 #include <linux/export.h> 20 #include <linux/kcov.h> 21 #include <linux/bitops.h> 22 #include <net/mac80211.h> 23 #include <net/ieee80211_radiotap.h> 24 #include <asm/unaligned.h> 25 26 #include "ieee80211_i.h" 27 #include "driver-ops.h" 28 #include "led.h" 29 #include "mesh.h" 30 #include "wep.h" 31 #include "wpa.h" 32 #include "tkip.h" 33 #include "wme.h" 34 #include "rate.h" 35 36 /* 37 * monitor mode reception 38 * 39 * This function cleans up the SKB, i.e. it removes all the stuff 40 * only useful for monitoring. 41 */ 42 static struct sk_buff *ieee80211_clean_skb(struct sk_buff *skb, 43 unsigned int present_fcs_len, 44 unsigned int rtap_space) 45 { 46 struct ieee80211_hdr *hdr; 47 unsigned int hdrlen; 48 __le16 fc; 49 50 if (present_fcs_len) 51 __pskb_trim(skb, skb->len - present_fcs_len); 52 __pskb_pull(skb, rtap_space); 53 54 hdr = (void *)skb->data; 55 fc = hdr->frame_control; 56 57 /* 58 * Remove the HT-Control field (if present) on management 59 * frames after we've sent the frame to monitoring. We 60 * (currently) don't need it, and don't properly parse 61 * frames with it present, due to the assumption of a 62 * fixed management header length. 63 */ 64 if (likely(!ieee80211_is_mgmt(fc) || !ieee80211_has_order(fc))) 65 return skb; 66 67 hdrlen = ieee80211_hdrlen(fc); 68 hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_ORDER); 69 70 if (!pskb_may_pull(skb, hdrlen)) { 71 dev_kfree_skb(skb); 72 return NULL; 73 } 74 75 memmove(skb->data + IEEE80211_HT_CTL_LEN, skb->data, 76 hdrlen - IEEE80211_HT_CTL_LEN); 77 __pskb_pull(skb, IEEE80211_HT_CTL_LEN); 78 79 return skb; 80 } 81 82 static inline bool should_drop_frame(struct sk_buff *skb, int present_fcs_len, 83 unsigned int rtap_space) 84 { 85 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 86 struct ieee80211_hdr *hdr; 87 88 hdr = (void *)(skb->data + rtap_space); 89 90 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | 91 RX_FLAG_FAILED_PLCP_CRC | 92 RX_FLAG_ONLY_MONITOR | 93 RX_FLAG_NO_PSDU)) 94 return true; 95 96 if (unlikely(skb->len < 16 + present_fcs_len + rtap_space)) 97 return true; 98 99 if (ieee80211_is_ctl(hdr->frame_control) && 100 !ieee80211_is_pspoll(hdr->frame_control) && 101 !ieee80211_is_back_req(hdr->frame_control)) 102 return true; 103 104 return false; 105 } 106 107 static int 108 ieee80211_rx_radiotap_hdrlen(struct ieee80211_local *local, 109 struct ieee80211_rx_status *status, 110 struct sk_buff *skb) 111 { 112 int len; 113 114 /* always present fields */ 115 len = sizeof(struct ieee80211_radiotap_header) + 8; 116 117 /* allocate extra bitmaps */ 118 if (status->chains) 119 len += 4 * hweight8(status->chains); 120 /* vendor presence bitmap */ 121 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) 122 len += 4; 123 124 if (ieee80211_have_rx_timestamp(status)) { 125 len = ALIGN(len, 8); 126 len += 8; 127 } 128 if (ieee80211_hw_check(&local->hw, SIGNAL_DBM)) 129 len += 1; 130 131 /* antenna field, if we don't have per-chain info */ 132 if (!status->chains) 133 len += 1; 134 135 /* padding for RX_FLAGS if necessary */ 136 len = ALIGN(len, 2); 137 138 if (status->encoding == RX_ENC_HT) /* HT info */ 139 len += 3; 140 141 if (status->flag & RX_FLAG_AMPDU_DETAILS) { 142 len = ALIGN(len, 4); 143 len += 8; 144 } 145 146 if (status->encoding == RX_ENC_VHT) { 147 len = ALIGN(len, 2); 148 len += 12; 149 } 150 151 if (local->hw.radiotap_timestamp.units_pos >= 0) { 152 len = ALIGN(len, 8); 153 len += 12; 154 } 155 156 if (status->encoding == RX_ENC_HE && 157 status->flag & RX_FLAG_RADIOTAP_HE) { 158 len = ALIGN(len, 2); 159 len += 12; 160 BUILD_BUG_ON(sizeof(struct ieee80211_radiotap_he) != 12); 161 } 162 163 if (status->encoding == RX_ENC_HE && 164 status->flag & RX_FLAG_RADIOTAP_HE_MU) { 165 len = ALIGN(len, 2); 166 len += 12; 167 BUILD_BUG_ON(sizeof(struct ieee80211_radiotap_he_mu) != 12); 168 } 169 170 if (status->flag & RX_FLAG_NO_PSDU) 171 len += 1; 172 173 if (status->flag & RX_FLAG_RADIOTAP_LSIG) { 174 len = ALIGN(len, 2); 175 len += 4; 176 BUILD_BUG_ON(sizeof(struct ieee80211_radiotap_lsig) != 4); 177 } 178 179 if (status->chains) { 180 /* antenna and antenna signal fields */ 181 len += 2 * hweight8(status->chains); 182 } 183 184 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) { 185 struct ieee80211_vendor_radiotap *rtap; 186 int vendor_data_offset = 0; 187 188 /* 189 * The position to look at depends on the existence (or non- 190 * existence) of other elements, so take that into account... 191 */ 192 if (status->flag & RX_FLAG_RADIOTAP_HE) 193 vendor_data_offset += 194 sizeof(struct ieee80211_radiotap_he); 195 if (status->flag & RX_FLAG_RADIOTAP_HE_MU) 196 vendor_data_offset += 197 sizeof(struct ieee80211_radiotap_he_mu); 198 if (status->flag & RX_FLAG_RADIOTAP_LSIG) 199 vendor_data_offset += 200 sizeof(struct ieee80211_radiotap_lsig); 201 202 rtap = (void *)&skb->data[vendor_data_offset]; 203 204 /* alignment for fixed 6-byte vendor data header */ 205 len = ALIGN(len, 2); 206 /* vendor data header */ 207 len += 6; 208 if (WARN_ON(rtap->align == 0)) 209 rtap->align = 1; 210 len = ALIGN(len, rtap->align); 211 len += rtap->len + rtap->pad; 212 } 213 214 return len; 215 } 216 217 static void __ieee80211_queue_skb_to_iface(struct ieee80211_sub_if_data *sdata, 218 struct sta_info *sta, 219 struct sk_buff *skb) 220 { 221 skb_queue_tail(&sdata->skb_queue, skb); 222 ieee80211_queue_work(&sdata->local->hw, &sdata->work); 223 if (sta) 224 sta->deflink.rx_stats.packets++; 225 } 226 227 static void ieee80211_queue_skb_to_iface(struct ieee80211_sub_if_data *sdata, 228 struct sta_info *sta, 229 struct sk_buff *skb) 230 { 231 skb->protocol = 0; 232 __ieee80211_queue_skb_to_iface(sdata, sta, skb); 233 } 234 235 static void ieee80211_handle_mu_mimo_mon(struct ieee80211_sub_if_data *sdata, 236 struct sk_buff *skb, 237 int rtap_space) 238 { 239 struct { 240 struct ieee80211_hdr_3addr hdr; 241 u8 category; 242 u8 action_code; 243 } __packed __aligned(2) action; 244 245 if (!sdata) 246 return; 247 248 BUILD_BUG_ON(sizeof(action) != IEEE80211_MIN_ACTION_SIZE + 1); 249 250 if (skb->len < rtap_space + sizeof(action) + 251 VHT_MUMIMO_GROUPS_DATA_LEN) 252 return; 253 254 if (!is_valid_ether_addr(sdata->u.mntr.mu_follow_addr)) 255 return; 256 257 skb_copy_bits(skb, rtap_space, &action, sizeof(action)); 258 259 if (!ieee80211_is_action(action.hdr.frame_control)) 260 return; 261 262 if (action.category != WLAN_CATEGORY_VHT) 263 return; 264 265 if (action.action_code != WLAN_VHT_ACTION_GROUPID_MGMT) 266 return; 267 268 if (!ether_addr_equal(action.hdr.addr1, sdata->u.mntr.mu_follow_addr)) 269 return; 270 271 skb = skb_copy(skb, GFP_ATOMIC); 272 if (!skb) 273 return; 274 275 ieee80211_queue_skb_to_iface(sdata, NULL, skb); 276 } 277 278 /* 279 * ieee80211_add_rx_radiotap_header - add radiotap header 280 * 281 * add a radiotap header containing all the fields which the hardware provided. 282 */ 283 static void 284 ieee80211_add_rx_radiotap_header(struct ieee80211_local *local, 285 struct sk_buff *skb, 286 struct ieee80211_rate *rate, 287 int rtap_len, bool has_fcs) 288 { 289 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 290 struct ieee80211_radiotap_header *rthdr; 291 unsigned char *pos; 292 __le32 *it_present; 293 u32 it_present_val; 294 u16 rx_flags = 0; 295 u16 channel_flags = 0; 296 int mpdulen, chain; 297 unsigned long chains = status->chains; 298 struct ieee80211_vendor_radiotap rtap = {}; 299 struct ieee80211_radiotap_he he = {}; 300 struct ieee80211_radiotap_he_mu he_mu = {}; 301 struct ieee80211_radiotap_lsig lsig = {}; 302 303 if (status->flag & RX_FLAG_RADIOTAP_HE) { 304 he = *(struct ieee80211_radiotap_he *)skb->data; 305 skb_pull(skb, sizeof(he)); 306 WARN_ON_ONCE(status->encoding != RX_ENC_HE); 307 } 308 309 if (status->flag & RX_FLAG_RADIOTAP_HE_MU) { 310 he_mu = *(struct ieee80211_radiotap_he_mu *)skb->data; 311 skb_pull(skb, sizeof(he_mu)); 312 } 313 314 if (status->flag & RX_FLAG_RADIOTAP_LSIG) { 315 lsig = *(struct ieee80211_radiotap_lsig *)skb->data; 316 skb_pull(skb, sizeof(lsig)); 317 } 318 319 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) { 320 rtap = *(struct ieee80211_vendor_radiotap *)skb->data; 321 /* rtap.len and rtap.pad are undone immediately */ 322 skb_pull(skb, sizeof(rtap) + rtap.len + rtap.pad); 323 } 324 325 mpdulen = skb->len; 326 if (!(has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS))) 327 mpdulen += FCS_LEN; 328 329 rthdr = skb_push(skb, rtap_len); 330 memset(rthdr, 0, rtap_len - rtap.len - rtap.pad); 331 it_present = &rthdr->it_present; 332 333 /* radiotap header, set always present flags */ 334 rthdr->it_len = cpu_to_le16(rtap_len); 335 it_present_val = BIT(IEEE80211_RADIOTAP_FLAGS) | 336 BIT(IEEE80211_RADIOTAP_CHANNEL) | 337 BIT(IEEE80211_RADIOTAP_RX_FLAGS); 338 339 if (!status->chains) 340 it_present_val |= BIT(IEEE80211_RADIOTAP_ANTENNA); 341 342 for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) { 343 it_present_val |= 344 BIT(IEEE80211_RADIOTAP_EXT) | 345 BIT(IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE); 346 put_unaligned_le32(it_present_val, it_present); 347 it_present++; 348 it_present_val = BIT(IEEE80211_RADIOTAP_ANTENNA) | 349 BIT(IEEE80211_RADIOTAP_DBM_ANTSIGNAL); 350 } 351 352 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) { 353 it_present_val |= BIT(IEEE80211_RADIOTAP_VENDOR_NAMESPACE) | 354 BIT(IEEE80211_RADIOTAP_EXT); 355 put_unaligned_le32(it_present_val, it_present); 356 it_present++; 357 it_present_val = rtap.present; 358 } 359 360 put_unaligned_le32(it_present_val, it_present); 361 362 /* This references through an offset into it_optional[] rather 363 * than via it_present otherwise later uses of pos will cause 364 * the compiler to think we have walked past the end of the 365 * struct member. 366 */ 367 pos = (void *)&rthdr->it_optional[it_present + 1 - rthdr->it_optional]; 368 369 /* the order of the following fields is important */ 370 371 /* IEEE80211_RADIOTAP_TSFT */ 372 if (ieee80211_have_rx_timestamp(status)) { 373 /* padding */ 374 while ((pos - (u8 *)rthdr) & 7) 375 *pos++ = 0; 376 put_unaligned_le64( 377 ieee80211_calculate_rx_timestamp(local, status, 378 mpdulen, 0), 379 pos); 380 rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_TSFT)); 381 pos += 8; 382 } 383 384 /* IEEE80211_RADIOTAP_FLAGS */ 385 if (has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)) 386 *pos |= IEEE80211_RADIOTAP_F_FCS; 387 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC)) 388 *pos |= IEEE80211_RADIOTAP_F_BADFCS; 389 if (status->enc_flags & RX_ENC_FLAG_SHORTPRE) 390 *pos |= IEEE80211_RADIOTAP_F_SHORTPRE; 391 pos++; 392 393 /* IEEE80211_RADIOTAP_RATE */ 394 if (!rate || status->encoding != RX_ENC_LEGACY) { 395 /* 396 * Without rate information don't add it. If we have, 397 * MCS information is a separate field in radiotap, 398 * added below. The byte here is needed as padding 399 * for the channel though, so initialise it to 0. 400 */ 401 *pos = 0; 402 } else { 403 int shift = 0; 404 rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_RATE)); 405 if (status->bw == RATE_INFO_BW_10) 406 shift = 1; 407 else if (status->bw == RATE_INFO_BW_5) 408 shift = 2; 409 *pos = DIV_ROUND_UP(rate->bitrate, 5 * (1 << shift)); 410 } 411 pos++; 412 413 /* IEEE80211_RADIOTAP_CHANNEL */ 414 /* TODO: frequency offset in KHz */ 415 put_unaligned_le16(status->freq, pos); 416 pos += 2; 417 if (status->bw == RATE_INFO_BW_10) 418 channel_flags |= IEEE80211_CHAN_HALF; 419 else if (status->bw == RATE_INFO_BW_5) 420 channel_flags |= IEEE80211_CHAN_QUARTER; 421 422 if (status->band == NL80211_BAND_5GHZ || 423 status->band == NL80211_BAND_6GHZ) 424 channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ; 425 else if (status->encoding != RX_ENC_LEGACY) 426 channel_flags |= IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ; 427 else if (rate && rate->flags & IEEE80211_RATE_ERP_G) 428 channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ; 429 else if (rate) 430 channel_flags |= IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ; 431 else 432 channel_flags |= IEEE80211_CHAN_2GHZ; 433 put_unaligned_le16(channel_flags, pos); 434 pos += 2; 435 436 /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */ 437 if (ieee80211_hw_check(&local->hw, SIGNAL_DBM) && 438 !(status->flag & RX_FLAG_NO_SIGNAL_VAL)) { 439 *pos = status->signal; 440 rthdr->it_present |= 441 cpu_to_le32(BIT(IEEE80211_RADIOTAP_DBM_ANTSIGNAL)); 442 pos++; 443 } 444 445 /* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */ 446 447 if (!status->chains) { 448 /* IEEE80211_RADIOTAP_ANTENNA */ 449 *pos = status->antenna; 450 pos++; 451 } 452 453 /* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */ 454 455 /* IEEE80211_RADIOTAP_RX_FLAGS */ 456 /* ensure 2 byte alignment for the 2 byte field as required */ 457 if ((pos - (u8 *)rthdr) & 1) 458 *pos++ = 0; 459 if (status->flag & RX_FLAG_FAILED_PLCP_CRC) 460 rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP; 461 put_unaligned_le16(rx_flags, pos); 462 pos += 2; 463 464 if (status->encoding == RX_ENC_HT) { 465 unsigned int stbc; 466 467 rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_MCS)); 468 *pos = local->hw.radiotap_mcs_details; 469 if (status->enc_flags & RX_ENC_FLAG_HT_GF) 470 *pos |= IEEE80211_RADIOTAP_MCS_HAVE_FMT; 471 if (status->enc_flags & RX_ENC_FLAG_LDPC) 472 *pos |= IEEE80211_RADIOTAP_MCS_HAVE_FEC; 473 pos++; 474 *pos = 0; 475 if (status->enc_flags & RX_ENC_FLAG_SHORT_GI) 476 *pos |= IEEE80211_RADIOTAP_MCS_SGI; 477 if (status->bw == RATE_INFO_BW_40) 478 *pos |= IEEE80211_RADIOTAP_MCS_BW_40; 479 if (status->enc_flags & RX_ENC_FLAG_HT_GF) 480 *pos |= IEEE80211_RADIOTAP_MCS_FMT_GF; 481 if (status->enc_flags & RX_ENC_FLAG_LDPC) 482 *pos |= IEEE80211_RADIOTAP_MCS_FEC_LDPC; 483 stbc = (status->enc_flags & RX_ENC_FLAG_STBC_MASK) >> RX_ENC_FLAG_STBC_SHIFT; 484 *pos |= stbc << IEEE80211_RADIOTAP_MCS_STBC_SHIFT; 485 pos++; 486 *pos++ = status->rate_idx; 487 } 488 489 if (status->flag & RX_FLAG_AMPDU_DETAILS) { 490 u16 flags = 0; 491 492 /* ensure 4 byte alignment */ 493 while ((pos - (u8 *)rthdr) & 3) 494 pos++; 495 rthdr->it_present |= 496 cpu_to_le32(BIT(IEEE80211_RADIOTAP_AMPDU_STATUS)); 497 put_unaligned_le32(status->ampdu_reference, pos); 498 pos += 4; 499 if (status->flag & RX_FLAG_AMPDU_LAST_KNOWN) 500 flags |= IEEE80211_RADIOTAP_AMPDU_LAST_KNOWN; 501 if (status->flag & RX_FLAG_AMPDU_IS_LAST) 502 flags |= IEEE80211_RADIOTAP_AMPDU_IS_LAST; 503 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_ERROR) 504 flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_ERR; 505 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN) 506 flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_KNOWN; 507 if (status->flag & RX_FLAG_AMPDU_EOF_BIT_KNOWN) 508 flags |= IEEE80211_RADIOTAP_AMPDU_EOF_KNOWN; 509 if (status->flag & RX_FLAG_AMPDU_EOF_BIT) 510 flags |= IEEE80211_RADIOTAP_AMPDU_EOF; 511 put_unaligned_le16(flags, pos); 512 pos += 2; 513 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN) 514 *pos++ = status->ampdu_delimiter_crc; 515 else 516 *pos++ = 0; 517 *pos++ = 0; 518 } 519 520 if (status->encoding == RX_ENC_VHT) { 521 u16 known = local->hw.radiotap_vht_details; 522 523 rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_VHT)); 524 put_unaligned_le16(known, pos); 525 pos += 2; 526 /* flags */ 527 if (status->enc_flags & RX_ENC_FLAG_SHORT_GI) 528 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_SGI; 529 /* in VHT, STBC is binary */ 530 if (status->enc_flags & RX_ENC_FLAG_STBC_MASK) 531 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_STBC; 532 if (status->enc_flags & RX_ENC_FLAG_BF) 533 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_BEAMFORMED; 534 pos++; 535 /* bandwidth */ 536 switch (status->bw) { 537 case RATE_INFO_BW_80: 538 *pos++ = 4; 539 break; 540 case RATE_INFO_BW_160: 541 *pos++ = 11; 542 break; 543 case RATE_INFO_BW_40: 544 *pos++ = 1; 545 break; 546 default: 547 *pos++ = 0; 548 } 549 /* MCS/NSS */ 550 *pos = (status->rate_idx << 4) | status->nss; 551 pos += 4; 552 /* coding field */ 553 if (status->enc_flags & RX_ENC_FLAG_LDPC) 554 *pos |= IEEE80211_RADIOTAP_CODING_LDPC_USER0; 555 pos++; 556 /* group ID */ 557 pos++; 558 /* partial_aid */ 559 pos += 2; 560 } 561 562 if (local->hw.radiotap_timestamp.units_pos >= 0) { 563 u16 accuracy = 0; 564 u8 flags = IEEE80211_RADIOTAP_TIMESTAMP_FLAG_32BIT; 565 566 rthdr->it_present |= 567 cpu_to_le32(BIT(IEEE80211_RADIOTAP_TIMESTAMP)); 568 569 /* ensure 8 byte alignment */ 570 while ((pos - (u8 *)rthdr) & 7) 571 pos++; 572 573 put_unaligned_le64(status->device_timestamp, pos); 574 pos += sizeof(u64); 575 576 if (local->hw.radiotap_timestamp.accuracy >= 0) { 577 accuracy = local->hw.radiotap_timestamp.accuracy; 578 flags |= IEEE80211_RADIOTAP_TIMESTAMP_FLAG_ACCURACY; 579 } 580 put_unaligned_le16(accuracy, pos); 581 pos += sizeof(u16); 582 583 *pos++ = local->hw.radiotap_timestamp.units_pos; 584 *pos++ = flags; 585 } 586 587 if (status->encoding == RX_ENC_HE && 588 status->flag & RX_FLAG_RADIOTAP_HE) { 589 #define HE_PREP(f, val) le16_encode_bits(val, IEEE80211_RADIOTAP_HE_##f) 590 591 if (status->enc_flags & RX_ENC_FLAG_STBC_MASK) { 592 he.data6 |= HE_PREP(DATA6_NSTS, 593 FIELD_GET(RX_ENC_FLAG_STBC_MASK, 594 status->enc_flags)); 595 he.data3 |= HE_PREP(DATA3_STBC, 1); 596 } else { 597 he.data6 |= HE_PREP(DATA6_NSTS, status->nss); 598 } 599 600 #define CHECK_GI(s) \ 601 BUILD_BUG_ON(IEEE80211_RADIOTAP_HE_DATA5_GI_##s != \ 602 (int)NL80211_RATE_INFO_HE_GI_##s) 603 604 CHECK_GI(0_8); 605 CHECK_GI(1_6); 606 CHECK_GI(3_2); 607 608 he.data3 |= HE_PREP(DATA3_DATA_MCS, status->rate_idx); 609 he.data3 |= HE_PREP(DATA3_DATA_DCM, status->he_dcm); 610 he.data3 |= HE_PREP(DATA3_CODING, 611 !!(status->enc_flags & RX_ENC_FLAG_LDPC)); 612 613 he.data5 |= HE_PREP(DATA5_GI, status->he_gi); 614 615 switch (status->bw) { 616 case RATE_INFO_BW_20: 617 he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC, 618 IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_20MHZ); 619 break; 620 case RATE_INFO_BW_40: 621 he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC, 622 IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_40MHZ); 623 break; 624 case RATE_INFO_BW_80: 625 he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC, 626 IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_80MHZ); 627 break; 628 case RATE_INFO_BW_160: 629 he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC, 630 IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_160MHZ); 631 break; 632 case RATE_INFO_BW_HE_RU: 633 #define CHECK_RU_ALLOC(s) \ 634 BUILD_BUG_ON(IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_##s##T != \ 635 NL80211_RATE_INFO_HE_RU_ALLOC_##s + 4) 636 637 CHECK_RU_ALLOC(26); 638 CHECK_RU_ALLOC(52); 639 CHECK_RU_ALLOC(106); 640 CHECK_RU_ALLOC(242); 641 CHECK_RU_ALLOC(484); 642 CHECK_RU_ALLOC(996); 643 CHECK_RU_ALLOC(2x996); 644 645 he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC, 646 status->he_ru + 4); 647 break; 648 default: 649 WARN_ONCE(1, "Invalid SU BW %d\n", status->bw); 650 } 651 652 /* ensure 2 byte alignment */ 653 while ((pos - (u8 *)rthdr) & 1) 654 pos++; 655 rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_HE)); 656 memcpy(pos, &he, sizeof(he)); 657 pos += sizeof(he); 658 } 659 660 if (status->encoding == RX_ENC_HE && 661 status->flag & RX_FLAG_RADIOTAP_HE_MU) { 662 /* ensure 2 byte alignment */ 663 while ((pos - (u8 *)rthdr) & 1) 664 pos++; 665 rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_HE_MU)); 666 memcpy(pos, &he_mu, sizeof(he_mu)); 667 pos += sizeof(he_mu); 668 } 669 670 if (status->flag & RX_FLAG_NO_PSDU) { 671 rthdr->it_present |= 672 cpu_to_le32(BIT(IEEE80211_RADIOTAP_ZERO_LEN_PSDU)); 673 *pos++ = status->zero_length_psdu_type; 674 } 675 676 if (status->flag & RX_FLAG_RADIOTAP_LSIG) { 677 /* ensure 2 byte alignment */ 678 while ((pos - (u8 *)rthdr) & 1) 679 pos++; 680 rthdr->it_present |= cpu_to_le32(BIT(IEEE80211_RADIOTAP_LSIG)); 681 memcpy(pos, &lsig, sizeof(lsig)); 682 pos += sizeof(lsig); 683 } 684 685 for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) { 686 *pos++ = status->chain_signal[chain]; 687 *pos++ = chain; 688 } 689 690 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) { 691 /* ensure 2 byte alignment for the vendor field as required */ 692 if ((pos - (u8 *)rthdr) & 1) 693 *pos++ = 0; 694 *pos++ = rtap.oui[0]; 695 *pos++ = rtap.oui[1]; 696 *pos++ = rtap.oui[2]; 697 *pos++ = rtap.subns; 698 put_unaligned_le16(rtap.len, pos); 699 pos += 2; 700 /* align the actual payload as requested */ 701 while ((pos - (u8 *)rthdr) & (rtap.align - 1)) 702 *pos++ = 0; 703 /* data (and possible padding) already follows */ 704 } 705 } 706 707 static struct sk_buff * 708 ieee80211_make_monitor_skb(struct ieee80211_local *local, 709 struct sk_buff **origskb, 710 struct ieee80211_rate *rate, 711 int rtap_space, bool use_origskb) 712 { 713 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(*origskb); 714 int rt_hdrlen, needed_headroom; 715 struct sk_buff *skb; 716 717 /* room for the radiotap header based on driver features */ 718 rt_hdrlen = ieee80211_rx_radiotap_hdrlen(local, status, *origskb); 719 needed_headroom = rt_hdrlen - rtap_space; 720 721 if (use_origskb) { 722 /* only need to expand headroom if necessary */ 723 skb = *origskb; 724 *origskb = NULL; 725 726 /* 727 * This shouldn't trigger often because most devices have an 728 * RX header they pull before we get here, and that should 729 * be big enough for our radiotap information. We should 730 * probably export the length to drivers so that we can have 731 * them allocate enough headroom to start with. 732 */ 733 if (skb_headroom(skb) < needed_headroom && 734 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) { 735 dev_kfree_skb(skb); 736 return NULL; 737 } 738 } else { 739 /* 740 * Need to make a copy and possibly remove radiotap header 741 * and FCS from the original. 742 */ 743 skb = skb_copy_expand(*origskb, needed_headroom + NET_SKB_PAD, 744 0, GFP_ATOMIC); 745 746 if (!skb) 747 return NULL; 748 } 749 750 /* prepend radiotap information */ 751 ieee80211_add_rx_radiotap_header(local, skb, rate, rt_hdrlen, true); 752 753 skb_reset_mac_header(skb); 754 skb->ip_summed = CHECKSUM_UNNECESSARY; 755 skb->pkt_type = PACKET_OTHERHOST; 756 skb->protocol = htons(ETH_P_802_2); 757 758 return skb; 759 } 760 761 /* 762 * This function copies a received frame to all monitor interfaces and 763 * returns a cleaned-up SKB that no longer includes the FCS nor the 764 * radiotap header the driver might have added. 765 */ 766 static struct sk_buff * 767 ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb, 768 struct ieee80211_rate *rate) 769 { 770 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb); 771 struct ieee80211_sub_if_data *sdata; 772 struct sk_buff *monskb = NULL; 773 int present_fcs_len = 0; 774 unsigned int rtap_space = 0; 775 struct ieee80211_sub_if_data *monitor_sdata = 776 rcu_dereference(local->monitor_sdata); 777 bool only_monitor = false; 778 unsigned int min_head_len; 779 780 if (status->flag & RX_FLAG_RADIOTAP_HE) 781 rtap_space += sizeof(struct ieee80211_radiotap_he); 782 783 if (status->flag & RX_FLAG_RADIOTAP_HE_MU) 784 rtap_space += sizeof(struct ieee80211_radiotap_he_mu); 785 786 if (status->flag & RX_FLAG_RADIOTAP_LSIG) 787 rtap_space += sizeof(struct ieee80211_radiotap_lsig); 788 789 if (unlikely(status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA)) { 790 struct ieee80211_vendor_radiotap *rtap = 791 (void *)(origskb->data + rtap_space); 792 793 rtap_space += sizeof(*rtap) + rtap->len + rtap->pad; 794 } 795 796 min_head_len = rtap_space; 797 798 /* 799 * First, we may need to make a copy of the skb because 800 * (1) we need to modify it for radiotap (if not present), and 801 * (2) the other RX handlers will modify the skb we got. 802 * 803 * We don't need to, of course, if we aren't going to return 804 * the SKB because it has a bad FCS/PLCP checksum. 805 */ 806 807 if (!(status->flag & RX_FLAG_NO_PSDU)) { 808 if (ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)) { 809 if (unlikely(origskb->len <= FCS_LEN + rtap_space)) { 810 /* driver bug */ 811 WARN_ON(1); 812 dev_kfree_skb(origskb); 813 return NULL; 814 } 815 present_fcs_len = FCS_LEN; 816 } 817 818 /* also consider the hdr->frame_control */ 819 min_head_len += 2; 820 } 821 822 /* ensure that the expected data elements are in skb head */ 823 if (!pskb_may_pull(origskb, min_head_len)) { 824 dev_kfree_skb(origskb); 825 return NULL; 826 } 827 828 only_monitor = should_drop_frame(origskb, present_fcs_len, rtap_space); 829 830 if (!local->monitors || (status->flag & RX_FLAG_SKIP_MONITOR)) { 831 if (only_monitor) { 832 dev_kfree_skb(origskb); 833 return NULL; 834 } 835 836 return ieee80211_clean_skb(origskb, present_fcs_len, 837 rtap_space); 838 } 839 840 ieee80211_handle_mu_mimo_mon(monitor_sdata, origskb, rtap_space); 841 842 list_for_each_entry_rcu(sdata, &local->mon_list, u.mntr.list) { 843 bool last_monitor = list_is_last(&sdata->u.mntr.list, 844 &local->mon_list); 845 846 if (!monskb) 847 monskb = ieee80211_make_monitor_skb(local, &origskb, 848 rate, rtap_space, 849 only_monitor && 850 last_monitor); 851 852 if (monskb) { 853 struct sk_buff *skb; 854 855 if (last_monitor) { 856 skb = monskb; 857 monskb = NULL; 858 } else { 859 skb = skb_clone(monskb, GFP_ATOMIC); 860 } 861 862 if (skb) { 863 skb->dev = sdata->dev; 864 dev_sw_netstats_rx_add(skb->dev, skb->len); 865 netif_receive_skb(skb); 866 } 867 } 868 869 if (last_monitor) 870 break; 871 } 872 873 /* this happens if last_monitor was erroneously false */ 874 dev_kfree_skb(monskb); 875 876 /* ditto */ 877 if (!origskb) 878 return NULL; 879 880 return ieee80211_clean_skb(origskb, present_fcs_len, rtap_space); 881 } 882 883 static void ieee80211_parse_qos(struct ieee80211_rx_data *rx) 884 { 885 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 886 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 887 int tid, seqno_idx, security_idx; 888 889 /* does the frame have a qos control field? */ 890 if (ieee80211_is_data_qos(hdr->frame_control)) { 891 u8 *qc = ieee80211_get_qos_ctl(hdr); 892 /* frame has qos control */ 893 tid = *qc & IEEE80211_QOS_CTL_TID_MASK; 894 if (*qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT) 895 status->rx_flags |= IEEE80211_RX_AMSDU; 896 897 seqno_idx = tid; 898 security_idx = tid; 899 } else { 900 /* 901 * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"): 902 * 903 * Sequence numbers for management frames, QoS data 904 * frames with a broadcast/multicast address in the 905 * Address 1 field, and all non-QoS data frames sent 906 * by QoS STAs are assigned using an additional single 907 * modulo-4096 counter, [...] 908 * 909 * We also use that counter for non-QoS STAs. 910 */ 911 seqno_idx = IEEE80211_NUM_TIDS; 912 security_idx = 0; 913 if (ieee80211_is_mgmt(hdr->frame_control)) 914 security_idx = IEEE80211_NUM_TIDS; 915 tid = 0; 916 } 917 918 rx->seqno_idx = seqno_idx; 919 rx->security_idx = security_idx; 920 /* Set skb->priority to 1d tag if highest order bit of TID is not set. 921 * For now, set skb->priority to 0 for other cases. */ 922 rx->skb->priority = (tid > 7) ? 0 : tid; 923 } 924 925 /** 926 * DOC: Packet alignment 927 * 928 * Drivers always need to pass packets that are aligned to two-byte boundaries 929 * to the stack. 930 * 931 * Additionally, should, if possible, align the payload data in a way that 932 * guarantees that the contained IP header is aligned to a four-byte 933 * boundary. In the case of regular frames, this simply means aligning the 934 * payload to a four-byte boundary (because either the IP header is directly 935 * contained, or IV/RFC1042 headers that have a length divisible by four are 936 * in front of it). If the payload data is not properly aligned and the 937 * architecture doesn't support efficient unaligned operations, mac80211 938 * will align the data. 939 * 940 * With A-MSDU frames, however, the payload data address must yield two modulo 941 * four because there are 14-byte 802.3 headers within the A-MSDU frames that 942 * push the IP header further back to a multiple of four again. Thankfully, the 943 * specs were sane enough this time around to require padding each A-MSDU 944 * subframe to a length that is a multiple of four. 945 * 946 * Padding like Atheros hardware adds which is between the 802.11 header and 947 * the payload is not supported, the driver is required to move the 802.11 948 * header to be directly in front of the payload in that case. 949 */ 950 static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx) 951 { 952 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG 953 WARN_ON_ONCE((unsigned long)rx->skb->data & 1); 954 #endif 955 } 956 957 958 /* rx handlers */ 959 960 static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb) 961 { 962 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 963 964 if (is_multicast_ether_addr(hdr->addr1)) 965 return 0; 966 967 return ieee80211_is_robust_mgmt_frame(skb); 968 } 969 970 971 static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb) 972 { 973 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 974 975 if (!is_multicast_ether_addr(hdr->addr1)) 976 return 0; 977 978 return ieee80211_is_robust_mgmt_frame(skb); 979 } 980 981 982 /* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */ 983 static int ieee80211_get_mmie_keyidx(struct sk_buff *skb) 984 { 985 struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data; 986 struct ieee80211_mmie *mmie; 987 struct ieee80211_mmie_16 *mmie16; 988 989 if (skb->len < 24 + sizeof(*mmie) || !is_multicast_ether_addr(hdr->da)) 990 return -1; 991 992 if (!ieee80211_is_robust_mgmt_frame(skb) && 993 !ieee80211_is_beacon(hdr->frame_control)) 994 return -1; /* not a robust management frame */ 995 996 mmie = (struct ieee80211_mmie *) 997 (skb->data + skb->len - sizeof(*mmie)); 998 if (mmie->element_id == WLAN_EID_MMIE && 999 mmie->length == sizeof(*mmie) - 2) 1000 return le16_to_cpu(mmie->key_id); 1001 1002 mmie16 = (struct ieee80211_mmie_16 *) 1003 (skb->data + skb->len - sizeof(*mmie16)); 1004 if (skb->len >= 24 + sizeof(*mmie16) && 1005 mmie16->element_id == WLAN_EID_MMIE && 1006 mmie16->length == sizeof(*mmie16) - 2) 1007 return le16_to_cpu(mmie16->key_id); 1008 1009 return -1; 1010 } 1011 1012 static int ieee80211_get_keyid(struct sk_buff *skb) 1013 { 1014 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; 1015 __le16 fc = hdr->frame_control; 1016 int hdrlen = ieee80211_hdrlen(fc); 1017 u8 keyid; 1018 1019 /* WEP, TKIP, CCMP and GCMP */ 1020 if (unlikely(skb->len < hdrlen + IEEE80211_WEP_IV_LEN)) 1021 return -EINVAL; 1022 1023 skb_copy_bits(skb, hdrlen + 3, &keyid, 1); 1024 1025 keyid >>= 6; 1026 1027 return keyid; 1028 } 1029 1030 static ieee80211_rx_result ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx) 1031 { 1032 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 1033 char *dev_addr = rx->sdata->vif.addr; 1034 1035 if (ieee80211_is_data(hdr->frame_control)) { 1036 if (is_multicast_ether_addr(hdr->addr1)) { 1037 if (ieee80211_has_tods(hdr->frame_control) || 1038 !ieee80211_has_fromds(hdr->frame_control)) 1039 return RX_DROP_MONITOR; 1040 if (ether_addr_equal(hdr->addr3, dev_addr)) 1041 return RX_DROP_MONITOR; 1042 } else { 1043 if (!ieee80211_has_a4(hdr->frame_control)) 1044 return RX_DROP_MONITOR; 1045 if (ether_addr_equal(hdr->addr4, dev_addr)) 1046 return RX_DROP_MONITOR; 1047 } 1048 } 1049 1050 /* If there is not an established peer link and this is not a peer link 1051 * establisment frame, beacon or probe, drop the frame. 1052 */ 1053 1054 if (!rx->sta || sta_plink_state(rx->sta) != NL80211_PLINK_ESTAB) { 1055 struct ieee80211_mgmt *mgmt; 1056 1057 if (!ieee80211_is_mgmt(hdr->frame_control)) 1058 return RX_DROP_MONITOR; 1059 1060 if (ieee80211_is_action(hdr->frame_control)) { 1061 u8 category; 1062 1063 /* make sure category field is present */ 1064 if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE) 1065 return RX_DROP_MONITOR; 1066 1067 mgmt = (struct ieee80211_mgmt *)hdr; 1068 category = mgmt->u.action.category; 1069 if (category != WLAN_CATEGORY_MESH_ACTION && 1070 category != WLAN_CATEGORY_SELF_PROTECTED) 1071 return RX_DROP_MONITOR; 1072 return RX_CONTINUE; 1073 } 1074 1075 if (ieee80211_is_probe_req(hdr->frame_control) || 1076 ieee80211_is_probe_resp(hdr->frame_control) || 1077 ieee80211_is_beacon(hdr->frame_control) || 1078 ieee80211_is_auth(hdr->frame_control)) 1079 return RX_CONTINUE; 1080 1081 return RX_DROP_MONITOR; 1082 } 1083 1084 return RX_CONTINUE; 1085 } 1086 1087 static inline bool ieee80211_rx_reorder_ready(struct tid_ampdu_rx *tid_agg_rx, 1088 int index) 1089 { 1090 struct sk_buff_head *frames = &tid_agg_rx->reorder_buf[index]; 1091 struct sk_buff *tail = skb_peek_tail(frames); 1092 struct ieee80211_rx_status *status; 1093 1094 if (tid_agg_rx->reorder_buf_filtered & BIT_ULL(index)) 1095 return true; 1096 1097 if (!tail) 1098 return false; 1099 1100 status = IEEE80211_SKB_RXCB(tail); 1101 if (status->flag & RX_FLAG_AMSDU_MORE) 1102 return false; 1103 1104 return true; 1105 } 1106 1107 static void ieee80211_release_reorder_frame(struct ieee80211_sub_if_data *sdata, 1108 struct tid_ampdu_rx *tid_agg_rx, 1109 int index, 1110 struct sk_buff_head *frames) 1111 { 1112 struct sk_buff_head *skb_list = &tid_agg_rx->reorder_buf[index]; 1113 struct sk_buff *skb; 1114 struct ieee80211_rx_status *status; 1115 1116 lockdep_assert_held(&tid_agg_rx->reorder_lock); 1117 1118 if (skb_queue_empty(skb_list)) 1119 goto no_frame; 1120 1121 if (!ieee80211_rx_reorder_ready(tid_agg_rx, index)) { 1122 __skb_queue_purge(skb_list); 1123 goto no_frame; 1124 } 1125 1126 /* release frames from the reorder ring buffer */ 1127 tid_agg_rx->stored_mpdu_num--; 1128 while ((skb = __skb_dequeue(skb_list))) { 1129 status = IEEE80211_SKB_RXCB(skb); 1130 status->rx_flags |= IEEE80211_RX_DEFERRED_RELEASE; 1131 __skb_queue_tail(frames, skb); 1132 } 1133 1134 no_frame: 1135 tid_agg_rx->reorder_buf_filtered &= ~BIT_ULL(index); 1136 tid_agg_rx->head_seq_num = ieee80211_sn_inc(tid_agg_rx->head_seq_num); 1137 } 1138 1139 static void ieee80211_release_reorder_frames(struct ieee80211_sub_if_data *sdata, 1140 struct tid_ampdu_rx *tid_agg_rx, 1141 u16 head_seq_num, 1142 struct sk_buff_head *frames) 1143 { 1144 int index; 1145 1146 lockdep_assert_held(&tid_agg_rx->reorder_lock); 1147 1148 while (ieee80211_sn_less(tid_agg_rx->head_seq_num, head_seq_num)) { 1149 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size; 1150 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index, 1151 frames); 1152 } 1153 } 1154 1155 /* 1156 * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If 1157 * the skb was added to the buffer longer than this time ago, the earlier 1158 * frames that have not yet been received are assumed to be lost and the skb 1159 * can be released for processing. This may also release other skb's from the 1160 * reorder buffer if there are no additional gaps between the frames. 1161 * 1162 * Callers must hold tid_agg_rx->reorder_lock. 1163 */ 1164 #define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10) 1165 1166 static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata, 1167 struct tid_ampdu_rx *tid_agg_rx, 1168 struct sk_buff_head *frames) 1169 { 1170 int index, i, j; 1171 1172 lockdep_assert_held(&tid_agg_rx->reorder_lock); 1173 1174 /* release the buffer until next missing frame */ 1175 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size; 1176 if (!ieee80211_rx_reorder_ready(tid_agg_rx, index) && 1177 tid_agg_rx->stored_mpdu_num) { 1178 /* 1179 * No buffers ready to be released, but check whether any 1180 * frames in the reorder buffer have timed out. 1181 */ 1182 int skipped = 1; 1183 for (j = (index + 1) % tid_agg_rx->buf_size; j != index; 1184 j = (j + 1) % tid_agg_rx->buf_size) { 1185 if (!ieee80211_rx_reorder_ready(tid_agg_rx, j)) { 1186 skipped++; 1187 continue; 1188 } 1189 if (skipped && 1190 !time_after(jiffies, tid_agg_rx->reorder_time[j] + 1191 HT_RX_REORDER_BUF_TIMEOUT)) 1192 goto set_release_timer; 1193 1194 /* don't leave incomplete A-MSDUs around */ 1195 for (i = (index + 1) % tid_agg_rx->buf_size; i != j; 1196 i = (i + 1) % tid_agg_rx->buf_size) 1197 __skb_queue_purge(&tid_agg_rx->reorder_buf[i]); 1198 1199 ht_dbg_ratelimited(sdata, 1200 "release an RX reorder frame due to timeout on earlier frames\n"); 1201 ieee80211_release_reorder_frame(sdata, tid_agg_rx, j, 1202 frames); 1203 1204 /* 1205 * Increment the head seq# also for the skipped slots. 1206 */ 1207 tid_agg_rx->head_seq_num = 1208 (tid_agg_rx->head_seq_num + 1209 skipped) & IEEE80211_SN_MASK; 1210 skipped = 0; 1211 } 1212 } else while (ieee80211_rx_reorder_ready(tid_agg_rx, index)) { 1213 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index, 1214 frames); 1215 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size; 1216 } 1217 1218 if (tid_agg_rx->stored_mpdu_num) { 1219 j = index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size; 1220 1221 for (; j != (index - 1) % tid_agg_rx->buf_size; 1222 j = (j + 1) % tid_agg_rx->buf_size) { 1223 if (ieee80211_rx_reorder_ready(tid_agg_rx, j)) 1224 break; 1225 } 1226 1227 set_release_timer: 1228 1229 if (!tid_agg_rx->removed) 1230 mod_timer(&tid_agg_rx->reorder_timer, 1231 tid_agg_rx->reorder_time[j] + 1 + 1232 HT_RX_REORDER_BUF_TIMEOUT); 1233 } else { 1234 del_timer(&tid_agg_rx->reorder_timer); 1235 } 1236 } 1237 1238 /* 1239 * As this function belongs to the RX path it must be under 1240 * rcu_read_lock protection. It returns false if the frame 1241 * can be processed immediately, true if it was consumed. 1242 */ 1243 static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata, 1244 struct tid_ampdu_rx *tid_agg_rx, 1245 struct sk_buff *skb, 1246 struct sk_buff_head *frames) 1247 { 1248 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 1249 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 1250 u16 sc = le16_to_cpu(hdr->seq_ctrl); 1251 u16 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4; 1252 u16 head_seq_num, buf_size; 1253 int index; 1254 bool ret = true; 1255 1256 spin_lock(&tid_agg_rx->reorder_lock); 1257 1258 /* 1259 * Offloaded BA sessions have no known starting sequence number so pick 1260 * one from first Rxed frame for this tid after BA was started. 1261 */ 1262 if (unlikely(tid_agg_rx->auto_seq)) { 1263 tid_agg_rx->auto_seq = false; 1264 tid_agg_rx->ssn = mpdu_seq_num; 1265 tid_agg_rx->head_seq_num = mpdu_seq_num; 1266 } 1267 1268 buf_size = tid_agg_rx->buf_size; 1269 head_seq_num = tid_agg_rx->head_seq_num; 1270 1271 /* 1272 * If the current MPDU's SN is smaller than the SSN, it shouldn't 1273 * be reordered. 1274 */ 1275 if (unlikely(!tid_agg_rx->started)) { 1276 if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) { 1277 ret = false; 1278 goto out; 1279 } 1280 tid_agg_rx->started = true; 1281 } 1282 1283 /* frame with out of date sequence number */ 1284 if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) { 1285 dev_kfree_skb(skb); 1286 goto out; 1287 } 1288 1289 /* 1290 * If frame the sequence number exceeds our buffering window 1291 * size release some previous frames to make room for this one. 1292 */ 1293 if (!ieee80211_sn_less(mpdu_seq_num, head_seq_num + buf_size)) { 1294 head_seq_num = ieee80211_sn_inc( 1295 ieee80211_sn_sub(mpdu_seq_num, buf_size)); 1296 /* release stored frames up to new head to stack */ 1297 ieee80211_release_reorder_frames(sdata, tid_agg_rx, 1298 head_seq_num, frames); 1299 } 1300 1301 /* Now the new frame is always in the range of the reordering buffer */ 1302 1303 index = mpdu_seq_num % tid_agg_rx->buf_size; 1304 1305 /* check if we already stored this frame */ 1306 if (ieee80211_rx_reorder_ready(tid_agg_rx, index)) { 1307 dev_kfree_skb(skb); 1308 goto out; 1309 } 1310 1311 /* 1312 * If the current MPDU is in the right order and nothing else 1313 * is stored we can process it directly, no need to buffer it. 1314 * If it is first but there's something stored, we may be able 1315 * to release frames after this one. 1316 */ 1317 if (mpdu_seq_num == tid_agg_rx->head_seq_num && 1318 tid_agg_rx->stored_mpdu_num == 0) { 1319 if (!(status->flag & RX_FLAG_AMSDU_MORE)) 1320 tid_agg_rx->head_seq_num = 1321 ieee80211_sn_inc(tid_agg_rx->head_seq_num); 1322 ret = false; 1323 goto out; 1324 } 1325 1326 /* put the frame in the reordering buffer */ 1327 __skb_queue_tail(&tid_agg_rx->reorder_buf[index], skb); 1328 if (!(status->flag & RX_FLAG_AMSDU_MORE)) { 1329 tid_agg_rx->reorder_time[index] = jiffies; 1330 tid_agg_rx->stored_mpdu_num++; 1331 ieee80211_sta_reorder_release(sdata, tid_agg_rx, frames); 1332 } 1333 1334 out: 1335 spin_unlock(&tid_agg_rx->reorder_lock); 1336 return ret; 1337 } 1338 1339 /* 1340 * Reorder MPDUs from A-MPDUs, keeping them on a buffer. Returns 1341 * true if the MPDU was buffered, false if it should be processed. 1342 */ 1343 static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx, 1344 struct sk_buff_head *frames) 1345 { 1346 struct sk_buff *skb = rx->skb; 1347 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 1348 struct sta_info *sta = rx->sta; 1349 struct tid_ampdu_rx *tid_agg_rx; 1350 u16 sc; 1351 u8 tid, ack_policy; 1352 1353 if (!ieee80211_is_data_qos(hdr->frame_control) || 1354 is_multicast_ether_addr(hdr->addr1)) 1355 goto dont_reorder; 1356 1357 /* 1358 * filter the QoS data rx stream according to 1359 * STA/TID and check if this STA/TID is on aggregation 1360 */ 1361 1362 if (!sta) 1363 goto dont_reorder; 1364 1365 ack_policy = *ieee80211_get_qos_ctl(hdr) & 1366 IEEE80211_QOS_CTL_ACK_POLICY_MASK; 1367 tid = ieee80211_get_tid(hdr); 1368 1369 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]); 1370 if (!tid_agg_rx) { 1371 if (ack_policy == IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK && 1372 !test_bit(tid, rx->sta->ampdu_mlme.agg_session_valid) && 1373 !test_and_set_bit(tid, rx->sta->ampdu_mlme.unexpected_agg)) 1374 ieee80211_send_delba(rx->sdata, rx->sta->sta.addr, tid, 1375 WLAN_BACK_RECIPIENT, 1376 WLAN_REASON_QSTA_REQUIRE_SETUP); 1377 goto dont_reorder; 1378 } 1379 1380 /* qos null data frames are excluded */ 1381 if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC))) 1382 goto dont_reorder; 1383 1384 /* not part of a BA session */ 1385 if (ack_policy == IEEE80211_QOS_CTL_ACK_POLICY_NOACK) 1386 goto dont_reorder; 1387 1388 /* new, potentially un-ordered, ampdu frame - process it */ 1389 1390 /* reset session timer */ 1391 if (tid_agg_rx->timeout) 1392 tid_agg_rx->last_rx = jiffies; 1393 1394 /* if this mpdu is fragmented - terminate rx aggregation session */ 1395 sc = le16_to_cpu(hdr->seq_ctrl); 1396 if (sc & IEEE80211_SCTL_FRAG) { 1397 ieee80211_queue_skb_to_iface(rx->sdata, NULL, skb); 1398 return; 1399 } 1400 1401 /* 1402 * No locking needed -- we will only ever process one 1403 * RX packet at a time, and thus own tid_agg_rx. All 1404 * other code manipulating it needs to (and does) make 1405 * sure that we cannot get to it any more before doing 1406 * anything with it. 1407 */ 1408 if (ieee80211_sta_manage_reorder_buf(rx->sdata, tid_agg_rx, skb, 1409 frames)) 1410 return; 1411 1412 dont_reorder: 1413 __skb_queue_tail(frames, skb); 1414 } 1415 1416 static ieee80211_rx_result debug_noinline 1417 ieee80211_rx_h_check_dup(struct ieee80211_rx_data *rx) 1418 { 1419 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 1420 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 1421 1422 if (status->flag & RX_FLAG_DUP_VALIDATED) 1423 return RX_CONTINUE; 1424 1425 /* 1426 * Drop duplicate 802.11 retransmissions 1427 * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery") 1428 */ 1429 1430 if (rx->skb->len < 24) 1431 return RX_CONTINUE; 1432 1433 if (ieee80211_is_ctl(hdr->frame_control) || 1434 ieee80211_is_any_nullfunc(hdr->frame_control) || 1435 is_multicast_ether_addr(hdr->addr1)) 1436 return RX_CONTINUE; 1437 1438 if (!rx->sta) 1439 return RX_CONTINUE; 1440 1441 if (unlikely(ieee80211_has_retry(hdr->frame_control) && 1442 rx->sta->last_seq_ctrl[rx->seqno_idx] == hdr->seq_ctrl)) { 1443 I802_DEBUG_INC(rx->local->dot11FrameDuplicateCount); 1444 rx->sta->deflink.rx_stats.num_duplicates++; 1445 return RX_DROP_UNUSABLE; 1446 } else if (!(status->flag & RX_FLAG_AMSDU_MORE)) { 1447 rx->sta->last_seq_ctrl[rx->seqno_idx] = hdr->seq_ctrl; 1448 } 1449 1450 return RX_CONTINUE; 1451 } 1452 1453 static ieee80211_rx_result debug_noinline 1454 ieee80211_rx_h_check(struct ieee80211_rx_data *rx) 1455 { 1456 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 1457 1458 /* Drop disallowed frame classes based on STA auth/assoc state; 1459 * IEEE 802.11, Chap 5.5. 1460 * 1461 * mac80211 filters only based on association state, i.e. it drops 1462 * Class 3 frames from not associated stations. hostapd sends 1463 * deauth/disassoc frames when needed. In addition, hostapd is 1464 * responsible for filtering on both auth and assoc states. 1465 */ 1466 1467 if (ieee80211_vif_is_mesh(&rx->sdata->vif)) 1468 return ieee80211_rx_mesh_check(rx); 1469 1470 if (unlikely((ieee80211_is_data(hdr->frame_control) || 1471 ieee80211_is_pspoll(hdr->frame_control)) && 1472 rx->sdata->vif.type != NL80211_IFTYPE_ADHOC && 1473 rx->sdata->vif.type != NL80211_IFTYPE_OCB && 1474 (!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_ASSOC)))) { 1475 /* 1476 * accept port control frames from the AP even when it's not 1477 * yet marked ASSOC to prevent a race where we don't set the 1478 * assoc bit quickly enough before it sends the first frame 1479 */ 1480 if (rx->sta && rx->sdata->vif.type == NL80211_IFTYPE_STATION && 1481 ieee80211_is_data_present(hdr->frame_control)) { 1482 unsigned int hdrlen; 1483 __be16 ethertype; 1484 1485 hdrlen = ieee80211_hdrlen(hdr->frame_control); 1486 1487 if (rx->skb->len < hdrlen + 8) 1488 return RX_DROP_MONITOR; 1489 1490 skb_copy_bits(rx->skb, hdrlen + 6, ðertype, 2); 1491 if (ethertype == rx->sdata->control_port_protocol) 1492 return RX_CONTINUE; 1493 } 1494 1495 if (rx->sdata->vif.type == NL80211_IFTYPE_AP && 1496 cfg80211_rx_spurious_frame(rx->sdata->dev, 1497 hdr->addr2, 1498 GFP_ATOMIC)) 1499 return RX_DROP_UNUSABLE; 1500 1501 return RX_DROP_MONITOR; 1502 } 1503 1504 return RX_CONTINUE; 1505 } 1506 1507 1508 static ieee80211_rx_result debug_noinline 1509 ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx) 1510 { 1511 struct ieee80211_local *local; 1512 struct ieee80211_hdr *hdr; 1513 struct sk_buff *skb; 1514 1515 local = rx->local; 1516 skb = rx->skb; 1517 hdr = (struct ieee80211_hdr *) skb->data; 1518 1519 if (!local->pspolling) 1520 return RX_CONTINUE; 1521 1522 if (!ieee80211_has_fromds(hdr->frame_control)) 1523 /* this is not from AP */ 1524 return RX_CONTINUE; 1525 1526 if (!ieee80211_is_data(hdr->frame_control)) 1527 return RX_CONTINUE; 1528 1529 if (!ieee80211_has_moredata(hdr->frame_control)) { 1530 /* AP has no more frames buffered for us */ 1531 local->pspolling = false; 1532 return RX_CONTINUE; 1533 } 1534 1535 /* more data bit is set, let's request a new frame from the AP */ 1536 ieee80211_send_pspoll(local, rx->sdata); 1537 1538 return RX_CONTINUE; 1539 } 1540 1541 static void sta_ps_start(struct sta_info *sta) 1542 { 1543 struct ieee80211_sub_if_data *sdata = sta->sdata; 1544 struct ieee80211_local *local = sdata->local; 1545 struct ps_data *ps; 1546 int tid; 1547 1548 if (sta->sdata->vif.type == NL80211_IFTYPE_AP || 1549 sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) 1550 ps = &sdata->bss->ps; 1551 else 1552 return; 1553 1554 atomic_inc(&ps->num_sta_ps); 1555 set_sta_flag(sta, WLAN_STA_PS_STA); 1556 if (!ieee80211_hw_check(&local->hw, AP_LINK_PS)) 1557 drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta); 1558 ps_dbg(sdata, "STA %pM aid %d enters power save mode\n", 1559 sta->sta.addr, sta->sta.aid); 1560 1561 ieee80211_clear_fast_xmit(sta); 1562 1563 if (!sta->sta.txq[0]) 1564 return; 1565 1566 for (tid = 0; tid < IEEE80211_NUM_TIDS; tid++) { 1567 struct ieee80211_txq *txq = sta->sta.txq[tid]; 1568 1569 ieee80211_unschedule_txq(&local->hw, txq, false); 1570 1571 if (txq_has_queue(txq)) 1572 set_bit(tid, &sta->txq_buffered_tids); 1573 else 1574 clear_bit(tid, &sta->txq_buffered_tids); 1575 } 1576 } 1577 1578 static void sta_ps_end(struct sta_info *sta) 1579 { 1580 ps_dbg(sta->sdata, "STA %pM aid %d exits power save mode\n", 1581 sta->sta.addr, sta->sta.aid); 1582 1583 if (test_sta_flag(sta, WLAN_STA_PS_DRIVER)) { 1584 /* 1585 * Clear the flag only if the other one is still set 1586 * so that the TX path won't start TX'ing new frames 1587 * directly ... In the case that the driver flag isn't 1588 * set ieee80211_sta_ps_deliver_wakeup() will clear it. 1589 */ 1590 clear_sta_flag(sta, WLAN_STA_PS_STA); 1591 ps_dbg(sta->sdata, "STA %pM aid %d driver-ps-blocked\n", 1592 sta->sta.addr, sta->sta.aid); 1593 return; 1594 } 1595 1596 set_sta_flag(sta, WLAN_STA_PS_DELIVER); 1597 clear_sta_flag(sta, WLAN_STA_PS_STA); 1598 ieee80211_sta_ps_deliver_wakeup(sta); 1599 } 1600 1601 int ieee80211_sta_ps_transition(struct ieee80211_sta *pubsta, bool start) 1602 { 1603 struct sta_info *sta = container_of(pubsta, struct sta_info, sta); 1604 bool in_ps; 1605 1606 WARN_ON(!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS)); 1607 1608 /* Don't let the same PS state be set twice */ 1609 in_ps = test_sta_flag(sta, WLAN_STA_PS_STA); 1610 if ((start && in_ps) || (!start && !in_ps)) 1611 return -EINVAL; 1612 1613 if (start) 1614 sta_ps_start(sta); 1615 else 1616 sta_ps_end(sta); 1617 1618 return 0; 1619 } 1620 EXPORT_SYMBOL(ieee80211_sta_ps_transition); 1621 1622 void ieee80211_sta_pspoll(struct ieee80211_sta *pubsta) 1623 { 1624 struct sta_info *sta = container_of(pubsta, struct sta_info, sta); 1625 1626 if (test_sta_flag(sta, WLAN_STA_SP)) 1627 return; 1628 1629 if (!test_sta_flag(sta, WLAN_STA_PS_DRIVER)) 1630 ieee80211_sta_ps_deliver_poll_response(sta); 1631 else 1632 set_sta_flag(sta, WLAN_STA_PSPOLL); 1633 } 1634 EXPORT_SYMBOL(ieee80211_sta_pspoll); 1635 1636 void ieee80211_sta_uapsd_trigger(struct ieee80211_sta *pubsta, u8 tid) 1637 { 1638 struct sta_info *sta = container_of(pubsta, struct sta_info, sta); 1639 int ac = ieee80211_ac_from_tid(tid); 1640 1641 /* 1642 * If this AC is not trigger-enabled do nothing unless the 1643 * driver is calling us after it already checked. 1644 * 1645 * NB: This could/should check a separate bitmap of trigger- 1646 * enabled queues, but for now we only implement uAPSD w/o 1647 * TSPEC changes to the ACs, so they're always the same. 1648 */ 1649 if (!(sta->sta.uapsd_queues & ieee80211_ac_to_qos_mask[ac]) && 1650 tid != IEEE80211_NUM_TIDS) 1651 return; 1652 1653 /* if we are in a service period, do nothing */ 1654 if (test_sta_flag(sta, WLAN_STA_SP)) 1655 return; 1656 1657 if (!test_sta_flag(sta, WLAN_STA_PS_DRIVER)) 1658 ieee80211_sta_ps_deliver_uapsd(sta); 1659 else 1660 set_sta_flag(sta, WLAN_STA_UAPSD); 1661 } 1662 EXPORT_SYMBOL(ieee80211_sta_uapsd_trigger); 1663 1664 static ieee80211_rx_result debug_noinline 1665 ieee80211_rx_h_uapsd_and_pspoll(struct ieee80211_rx_data *rx) 1666 { 1667 struct ieee80211_sub_if_data *sdata = rx->sdata; 1668 struct ieee80211_hdr *hdr = (void *)rx->skb->data; 1669 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 1670 1671 if (!rx->sta) 1672 return RX_CONTINUE; 1673 1674 if (sdata->vif.type != NL80211_IFTYPE_AP && 1675 sdata->vif.type != NL80211_IFTYPE_AP_VLAN) 1676 return RX_CONTINUE; 1677 1678 /* 1679 * The device handles station powersave, so don't do anything about 1680 * uAPSD and PS-Poll frames (the latter shouldn't even come up from 1681 * it to mac80211 since they're handled.) 1682 */ 1683 if (ieee80211_hw_check(&sdata->local->hw, AP_LINK_PS)) 1684 return RX_CONTINUE; 1685 1686 /* 1687 * Don't do anything if the station isn't already asleep. In 1688 * the uAPSD case, the station will probably be marked asleep, 1689 * in the PS-Poll case the station must be confused ... 1690 */ 1691 if (!test_sta_flag(rx->sta, WLAN_STA_PS_STA)) 1692 return RX_CONTINUE; 1693 1694 if (unlikely(ieee80211_is_pspoll(hdr->frame_control))) { 1695 ieee80211_sta_pspoll(&rx->sta->sta); 1696 1697 /* Free PS Poll skb here instead of returning RX_DROP that would 1698 * count as an dropped frame. */ 1699 dev_kfree_skb(rx->skb); 1700 1701 return RX_QUEUED; 1702 } else if (!ieee80211_has_morefrags(hdr->frame_control) && 1703 !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) && 1704 ieee80211_has_pm(hdr->frame_control) && 1705 (ieee80211_is_data_qos(hdr->frame_control) || 1706 ieee80211_is_qos_nullfunc(hdr->frame_control))) { 1707 u8 tid = ieee80211_get_tid(hdr); 1708 1709 ieee80211_sta_uapsd_trigger(&rx->sta->sta, tid); 1710 } 1711 1712 return RX_CONTINUE; 1713 } 1714 1715 static ieee80211_rx_result debug_noinline 1716 ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx) 1717 { 1718 struct sta_info *sta = rx->sta; 1719 struct sk_buff *skb = rx->skb; 1720 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 1721 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; 1722 int i; 1723 1724 if (!sta) 1725 return RX_CONTINUE; 1726 1727 /* 1728 * Update last_rx only for IBSS packets which are for the current 1729 * BSSID and for station already AUTHORIZED to avoid keeping the 1730 * current IBSS network alive in cases where other STAs start 1731 * using different BSSID. This will also give the station another 1732 * chance to restart the authentication/authorization in case 1733 * something went wrong the first time. 1734 */ 1735 if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) { 1736 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len, 1737 NL80211_IFTYPE_ADHOC); 1738 if (ether_addr_equal(bssid, rx->sdata->u.ibss.bssid) && 1739 test_sta_flag(sta, WLAN_STA_AUTHORIZED)) { 1740 sta->deflink.rx_stats.last_rx = jiffies; 1741 if (ieee80211_is_data(hdr->frame_control) && 1742 !is_multicast_ether_addr(hdr->addr1)) 1743 sta->deflink.rx_stats.last_rate = 1744 sta_stats_encode_rate(status); 1745 } 1746 } else if (rx->sdata->vif.type == NL80211_IFTYPE_OCB) { 1747 sta->deflink.rx_stats.last_rx = jiffies; 1748 } else if (!ieee80211_is_s1g_beacon(hdr->frame_control) && 1749 !is_multicast_ether_addr(hdr->addr1)) { 1750 /* 1751 * Mesh beacons will update last_rx when if they are found to 1752 * match the current local configuration when processed. 1753 */ 1754 sta->deflink.rx_stats.last_rx = jiffies; 1755 if (ieee80211_is_data(hdr->frame_control)) 1756 sta->deflink.rx_stats.last_rate = sta_stats_encode_rate(status); 1757 } 1758 1759 sta->deflink.rx_stats.fragments++; 1760 1761 u64_stats_update_begin(&rx->sta->deflink.rx_stats.syncp); 1762 sta->deflink.rx_stats.bytes += rx->skb->len; 1763 u64_stats_update_end(&rx->sta->deflink.rx_stats.syncp); 1764 1765 if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) { 1766 sta->deflink.rx_stats.last_signal = status->signal; 1767 ewma_signal_add(&sta->deflink.rx_stats_avg.signal, 1768 -status->signal); 1769 } 1770 1771 if (status->chains) { 1772 sta->deflink.rx_stats.chains = status->chains; 1773 for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) { 1774 int signal = status->chain_signal[i]; 1775 1776 if (!(status->chains & BIT(i))) 1777 continue; 1778 1779 sta->deflink.rx_stats.chain_signal_last[i] = signal; 1780 ewma_signal_add(&sta->deflink.rx_stats_avg.chain_signal[i], 1781 -signal); 1782 } 1783 } 1784 1785 if (ieee80211_is_s1g_beacon(hdr->frame_control)) 1786 return RX_CONTINUE; 1787 1788 /* 1789 * Change STA power saving mode only at the end of a frame 1790 * exchange sequence, and only for a data or management 1791 * frame as specified in IEEE 802.11-2016 11.2.3.2 1792 */ 1793 if (!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS) && 1794 !ieee80211_has_morefrags(hdr->frame_control) && 1795 !is_multicast_ether_addr(hdr->addr1) && 1796 (ieee80211_is_mgmt(hdr->frame_control) || 1797 ieee80211_is_data(hdr->frame_control)) && 1798 !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) && 1799 (rx->sdata->vif.type == NL80211_IFTYPE_AP || 1800 rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) { 1801 if (test_sta_flag(sta, WLAN_STA_PS_STA)) { 1802 if (!ieee80211_has_pm(hdr->frame_control)) 1803 sta_ps_end(sta); 1804 } else { 1805 if (ieee80211_has_pm(hdr->frame_control)) 1806 sta_ps_start(sta); 1807 } 1808 } 1809 1810 /* mesh power save support */ 1811 if (ieee80211_vif_is_mesh(&rx->sdata->vif)) 1812 ieee80211_mps_rx_h_sta_process(sta, hdr); 1813 1814 /* 1815 * Drop (qos-)data::nullfunc frames silently, since they 1816 * are used only to control station power saving mode. 1817 */ 1818 if (ieee80211_is_any_nullfunc(hdr->frame_control)) { 1819 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc); 1820 1821 /* 1822 * If we receive a 4-addr nullfunc frame from a STA 1823 * that was not moved to a 4-addr STA vlan yet send 1824 * the event to userspace and for older hostapd drop 1825 * the frame to the monitor interface. 1826 */ 1827 if (ieee80211_has_a4(hdr->frame_control) && 1828 (rx->sdata->vif.type == NL80211_IFTYPE_AP || 1829 (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN && 1830 !rx->sdata->u.vlan.sta))) { 1831 if (!test_and_set_sta_flag(sta, WLAN_STA_4ADDR_EVENT)) 1832 cfg80211_rx_unexpected_4addr_frame( 1833 rx->sdata->dev, sta->sta.addr, 1834 GFP_ATOMIC); 1835 return RX_DROP_MONITOR; 1836 } 1837 /* 1838 * Update counter and free packet here to avoid 1839 * counting this as a dropped packed. 1840 */ 1841 sta->deflink.rx_stats.packets++; 1842 dev_kfree_skb(rx->skb); 1843 return RX_QUEUED; 1844 } 1845 1846 return RX_CONTINUE; 1847 } /* ieee80211_rx_h_sta_process */ 1848 1849 static struct ieee80211_key * 1850 ieee80211_rx_get_bigtk(struct ieee80211_rx_data *rx, int idx) 1851 { 1852 struct ieee80211_key *key = NULL; 1853 struct ieee80211_sub_if_data *sdata = rx->sdata; 1854 int idx2; 1855 1856 /* Make sure key gets set if either BIGTK key index is set so that 1857 * ieee80211_drop_unencrypted_mgmt() can properly drop both unprotected 1858 * Beacon frames and Beacon frames that claim to use another BIGTK key 1859 * index (i.e., a key that we do not have). 1860 */ 1861 1862 if (idx < 0) { 1863 idx = NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS; 1864 idx2 = idx + 1; 1865 } else { 1866 if (idx == NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS) 1867 idx2 = idx + 1; 1868 else 1869 idx2 = idx - 1; 1870 } 1871 1872 if (rx->sta) 1873 key = rcu_dereference(rx->sta->deflink.gtk[idx]); 1874 if (!key) 1875 key = rcu_dereference(sdata->keys[idx]); 1876 if (!key && rx->sta) 1877 key = rcu_dereference(rx->sta->deflink.gtk[idx2]); 1878 if (!key) 1879 key = rcu_dereference(sdata->keys[idx2]); 1880 1881 return key; 1882 } 1883 1884 static ieee80211_rx_result debug_noinline 1885 ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx) 1886 { 1887 struct sk_buff *skb = rx->skb; 1888 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 1889 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; 1890 int keyidx; 1891 ieee80211_rx_result result = RX_DROP_UNUSABLE; 1892 struct ieee80211_key *sta_ptk = NULL; 1893 struct ieee80211_key *ptk_idx = NULL; 1894 int mmie_keyidx = -1; 1895 __le16 fc; 1896 1897 if (ieee80211_is_ext(hdr->frame_control)) 1898 return RX_CONTINUE; 1899 1900 /* 1901 * Key selection 101 1902 * 1903 * There are five types of keys: 1904 * - GTK (group keys) 1905 * - IGTK (group keys for management frames) 1906 * - BIGTK (group keys for Beacon frames) 1907 * - PTK (pairwise keys) 1908 * - STK (station-to-station pairwise keys) 1909 * 1910 * When selecting a key, we have to distinguish between multicast 1911 * (including broadcast) and unicast frames, the latter can only 1912 * use PTKs and STKs while the former always use GTKs, IGTKs, and 1913 * BIGTKs. Unless, of course, actual WEP keys ("pre-RSNA") are used, 1914 * then unicast frames can also use key indices like GTKs. Hence, if we 1915 * don't have a PTK/STK we check the key index for a WEP key. 1916 * 1917 * Note that in a regular BSS, multicast frames are sent by the 1918 * AP only, associated stations unicast the frame to the AP first 1919 * which then multicasts it on their behalf. 1920 * 1921 * There is also a slight problem in IBSS mode: GTKs are negotiated 1922 * with each station, that is something we don't currently handle. 1923 * The spec seems to expect that one negotiates the same key with 1924 * every station but there's no such requirement; VLANs could be 1925 * possible. 1926 */ 1927 1928 /* start without a key */ 1929 rx->key = NULL; 1930 fc = hdr->frame_control; 1931 1932 if (rx->sta) { 1933 int keyid = rx->sta->ptk_idx; 1934 sta_ptk = rcu_dereference(rx->sta->ptk[keyid]); 1935 1936 if (ieee80211_has_protected(fc) && 1937 !(status->flag & RX_FLAG_IV_STRIPPED)) { 1938 keyid = ieee80211_get_keyid(rx->skb); 1939 1940 if (unlikely(keyid < 0)) 1941 return RX_DROP_UNUSABLE; 1942 1943 ptk_idx = rcu_dereference(rx->sta->ptk[keyid]); 1944 } 1945 } 1946 1947 if (!ieee80211_has_protected(fc)) 1948 mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb); 1949 1950 if (!is_multicast_ether_addr(hdr->addr1) && sta_ptk) { 1951 rx->key = ptk_idx ? ptk_idx : sta_ptk; 1952 if ((status->flag & RX_FLAG_DECRYPTED) && 1953 (status->flag & RX_FLAG_IV_STRIPPED)) 1954 return RX_CONTINUE; 1955 /* Skip decryption if the frame is not protected. */ 1956 if (!ieee80211_has_protected(fc)) 1957 return RX_CONTINUE; 1958 } else if (mmie_keyidx >= 0 && ieee80211_is_beacon(fc)) { 1959 /* Broadcast/multicast robust management frame / BIP */ 1960 if ((status->flag & RX_FLAG_DECRYPTED) && 1961 (status->flag & RX_FLAG_IV_STRIPPED)) 1962 return RX_CONTINUE; 1963 1964 if (mmie_keyidx < NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS || 1965 mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS + 1966 NUM_DEFAULT_BEACON_KEYS) { 1967 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev, 1968 skb->data, 1969 skb->len); 1970 return RX_DROP_MONITOR; /* unexpected BIP keyidx */ 1971 } 1972 1973 rx->key = ieee80211_rx_get_bigtk(rx, mmie_keyidx); 1974 if (!rx->key) 1975 return RX_CONTINUE; /* Beacon protection not in use */ 1976 } else if (mmie_keyidx >= 0) { 1977 /* Broadcast/multicast robust management frame / BIP */ 1978 if ((status->flag & RX_FLAG_DECRYPTED) && 1979 (status->flag & RX_FLAG_IV_STRIPPED)) 1980 return RX_CONTINUE; 1981 1982 if (mmie_keyidx < NUM_DEFAULT_KEYS || 1983 mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS) 1984 return RX_DROP_MONITOR; /* unexpected BIP keyidx */ 1985 if (rx->sta) { 1986 if (ieee80211_is_group_privacy_action(skb) && 1987 test_sta_flag(rx->sta, WLAN_STA_MFP)) 1988 return RX_DROP_MONITOR; 1989 1990 rx->key = rcu_dereference(rx->sta->deflink.gtk[mmie_keyidx]); 1991 } 1992 if (!rx->key) 1993 rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]); 1994 } else if (!ieee80211_has_protected(fc)) { 1995 /* 1996 * The frame was not protected, so skip decryption. However, we 1997 * need to set rx->key if there is a key that could have been 1998 * used so that the frame may be dropped if encryption would 1999 * have been expected. 2000 */ 2001 struct ieee80211_key *key = NULL; 2002 struct ieee80211_sub_if_data *sdata = rx->sdata; 2003 int i; 2004 2005 if (ieee80211_is_beacon(fc)) { 2006 key = ieee80211_rx_get_bigtk(rx, -1); 2007 } else if (ieee80211_is_mgmt(fc) && 2008 is_multicast_ether_addr(hdr->addr1)) { 2009 key = rcu_dereference(rx->sdata->default_mgmt_key); 2010 } else { 2011 if (rx->sta) { 2012 for (i = 0; i < NUM_DEFAULT_KEYS; i++) { 2013 key = rcu_dereference(rx->sta->deflink.gtk[i]); 2014 if (key) 2015 break; 2016 } 2017 } 2018 if (!key) { 2019 for (i = 0; i < NUM_DEFAULT_KEYS; i++) { 2020 key = rcu_dereference(sdata->keys[i]); 2021 if (key) 2022 break; 2023 } 2024 } 2025 } 2026 if (key) 2027 rx->key = key; 2028 return RX_CONTINUE; 2029 } else { 2030 /* 2031 * The device doesn't give us the IV so we won't be 2032 * able to look up the key. That's ok though, we 2033 * don't need to decrypt the frame, we just won't 2034 * be able to keep statistics accurate. 2035 * Except for key threshold notifications, should 2036 * we somehow allow the driver to tell us which key 2037 * the hardware used if this flag is set? 2038 */ 2039 if ((status->flag & RX_FLAG_DECRYPTED) && 2040 (status->flag & RX_FLAG_IV_STRIPPED)) 2041 return RX_CONTINUE; 2042 2043 keyidx = ieee80211_get_keyid(rx->skb); 2044 2045 if (unlikely(keyidx < 0)) 2046 return RX_DROP_UNUSABLE; 2047 2048 /* check per-station GTK first, if multicast packet */ 2049 if (is_multicast_ether_addr(hdr->addr1) && rx->sta) 2050 rx->key = rcu_dereference(rx->sta->deflink.gtk[keyidx]); 2051 2052 /* if not found, try default key */ 2053 if (!rx->key) { 2054 rx->key = rcu_dereference(rx->sdata->keys[keyidx]); 2055 2056 /* 2057 * RSNA-protected unicast frames should always be 2058 * sent with pairwise or station-to-station keys, 2059 * but for WEP we allow using a key index as well. 2060 */ 2061 if (rx->key && 2062 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 && 2063 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 && 2064 !is_multicast_ether_addr(hdr->addr1)) 2065 rx->key = NULL; 2066 } 2067 } 2068 2069 if (rx->key) { 2070 if (unlikely(rx->key->flags & KEY_FLAG_TAINTED)) 2071 return RX_DROP_MONITOR; 2072 2073 /* TODO: add threshold stuff again */ 2074 } else { 2075 return RX_DROP_MONITOR; 2076 } 2077 2078 switch (rx->key->conf.cipher) { 2079 case WLAN_CIPHER_SUITE_WEP40: 2080 case WLAN_CIPHER_SUITE_WEP104: 2081 result = ieee80211_crypto_wep_decrypt(rx); 2082 break; 2083 case WLAN_CIPHER_SUITE_TKIP: 2084 result = ieee80211_crypto_tkip_decrypt(rx); 2085 break; 2086 case WLAN_CIPHER_SUITE_CCMP: 2087 result = ieee80211_crypto_ccmp_decrypt( 2088 rx, IEEE80211_CCMP_MIC_LEN); 2089 break; 2090 case WLAN_CIPHER_SUITE_CCMP_256: 2091 result = ieee80211_crypto_ccmp_decrypt( 2092 rx, IEEE80211_CCMP_256_MIC_LEN); 2093 break; 2094 case WLAN_CIPHER_SUITE_AES_CMAC: 2095 result = ieee80211_crypto_aes_cmac_decrypt(rx); 2096 break; 2097 case WLAN_CIPHER_SUITE_BIP_CMAC_256: 2098 result = ieee80211_crypto_aes_cmac_256_decrypt(rx); 2099 break; 2100 case WLAN_CIPHER_SUITE_BIP_GMAC_128: 2101 case WLAN_CIPHER_SUITE_BIP_GMAC_256: 2102 result = ieee80211_crypto_aes_gmac_decrypt(rx); 2103 break; 2104 case WLAN_CIPHER_SUITE_GCMP: 2105 case WLAN_CIPHER_SUITE_GCMP_256: 2106 result = ieee80211_crypto_gcmp_decrypt(rx); 2107 break; 2108 default: 2109 result = RX_DROP_UNUSABLE; 2110 } 2111 2112 /* the hdr variable is invalid after the decrypt handlers */ 2113 2114 /* either the frame has been decrypted or will be dropped */ 2115 status->flag |= RX_FLAG_DECRYPTED; 2116 2117 if (unlikely(ieee80211_is_beacon(fc) && result == RX_DROP_UNUSABLE)) 2118 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev, 2119 skb->data, skb->len); 2120 2121 return result; 2122 } 2123 2124 void ieee80211_init_frag_cache(struct ieee80211_fragment_cache *cache) 2125 { 2126 int i; 2127 2128 for (i = 0; i < ARRAY_SIZE(cache->entries); i++) 2129 skb_queue_head_init(&cache->entries[i].skb_list); 2130 } 2131 2132 void ieee80211_destroy_frag_cache(struct ieee80211_fragment_cache *cache) 2133 { 2134 int i; 2135 2136 for (i = 0; i < ARRAY_SIZE(cache->entries); i++) 2137 __skb_queue_purge(&cache->entries[i].skb_list); 2138 } 2139 2140 static inline struct ieee80211_fragment_entry * 2141 ieee80211_reassemble_add(struct ieee80211_fragment_cache *cache, 2142 unsigned int frag, unsigned int seq, int rx_queue, 2143 struct sk_buff **skb) 2144 { 2145 struct ieee80211_fragment_entry *entry; 2146 2147 entry = &cache->entries[cache->next++]; 2148 if (cache->next >= IEEE80211_FRAGMENT_MAX) 2149 cache->next = 0; 2150 2151 __skb_queue_purge(&entry->skb_list); 2152 2153 __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */ 2154 *skb = NULL; 2155 entry->first_frag_time = jiffies; 2156 entry->seq = seq; 2157 entry->rx_queue = rx_queue; 2158 entry->last_frag = frag; 2159 entry->check_sequential_pn = false; 2160 entry->extra_len = 0; 2161 2162 return entry; 2163 } 2164 2165 static inline struct ieee80211_fragment_entry * 2166 ieee80211_reassemble_find(struct ieee80211_fragment_cache *cache, 2167 unsigned int frag, unsigned int seq, 2168 int rx_queue, struct ieee80211_hdr *hdr) 2169 { 2170 struct ieee80211_fragment_entry *entry; 2171 int i, idx; 2172 2173 idx = cache->next; 2174 for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) { 2175 struct ieee80211_hdr *f_hdr; 2176 struct sk_buff *f_skb; 2177 2178 idx--; 2179 if (idx < 0) 2180 idx = IEEE80211_FRAGMENT_MAX - 1; 2181 2182 entry = &cache->entries[idx]; 2183 if (skb_queue_empty(&entry->skb_list) || entry->seq != seq || 2184 entry->rx_queue != rx_queue || 2185 entry->last_frag + 1 != frag) 2186 continue; 2187 2188 f_skb = __skb_peek(&entry->skb_list); 2189 f_hdr = (struct ieee80211_hdr *) f_skb->data; 2190 2191 /* 2192 * Check ftype and addresses are equal, else check next fragment 2193 */ 2194 if (((hdr->frame_control ^ f_hdr->frame_control) & 2195 cpu_to_le16(IEEE80211_FCTL_FTYPE)) || 2196 !ether_addr_equal(hdr->addr1, f_hdr->addr1) || 2197 !ether_addr_equal(hdr->addr2, f_hdr->addr2)) 2198 continue; 2199 2200 if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) { 2201 __skb_queue_purge(&entry->skb_list); 2202 continue; 2203 } 2204 return entry; 2205 } 2206 2207 return NULL; 2208 } 2209 2210 static bool requires_sequential_pn(struct ieee80211_rx_data *rx, __le16 fc) 2211 { 2212 return rx->key && 2213 (rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP || 2214 rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP_256 || 2215 rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP || 2216 rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP_256) && 2217 ieee80211_has_protected(fc); 2218 } 2219 2220 static ieee80211_rx_result debug_noinline 2221 ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx) 2222 { 2223 struct ieee80211_fragment_cache *cache = &rx->sdata->frags; 2224 struct ieee80211_hdr *hdr; 2225 u16 sc; 2226 __le16 fc; 2227 unsigned int frag, seq; 2228 struct ieee80211_fragment_entry *entry; 2229 struct sk_buff *skb; 2230 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 2231 2232 hdr = (struct ieee80211_hdr *)rx->skb->data; 2233 fc = hdr->frame_control; 2234 2235 if (ieee80211_is_ctl(fc) || ieee80211_is_ext(fc)) 2236 return RX_CONTINUE; 2237 2238 sc = le16_to_cpu(hdr->seq_ctrl); 2239 frag = sc & IEEE80211_SCTL_FRAG; 2240 2241 if (rx->sta) 2242 cache = &rx->sta->frags; 2243 2244 if (likely(!ieee80211_has_morefrags(fc) && frag == 0)) 2245 goto out; 2246 2247 if (is_multicast_ether_addr(hdr->addr1)) 2248 return RX_DROP_MONITOR; 2249 2250 I802_DEBUG_INC(rx->local->rx_handlers_fragments); 2251 2252 if (skb_linearize(rx->skb)) 2253 return RX_DROP_UNUSABLE; 2254 2255 /* 2256 * skb_linearize() might change the skb->data and 2257 * previously cached variables (in this case, hdr) need to 2258 * be refreshed with the new data. 2259 */ 2260 hdr = (struct ieee80211_hdr *)rx->skb->data; 2261 seq = (sc & IEEE80211_SCTL_SEQ) >> 4; 2262 2263 if (frag == 0) { 2264 /* This is the first fragment of a new frame. */ 2265 entry = ieee80211_reassemble_add(cache, frag, seq, 2266 rx->seqno_idx, &(rx->skb)); 2267 if (requires_sequential_pn(rx, fc)) { 2268 int queue = rx->security_idx; 2269 2270 /* Store CCMP/GCMP PN so that we can verify that the 2271 * next fragment has a sequential PN value. 2272 */ 2273 entry->check_sequential_pn = true; 2274 entry->is_protected = true; 2275 entry->key_color = rx->key->color; 2276 memcpy(entry->last_pn, 2277 rx->key->u.ccmp.rx_pn[queue], 2278 IEEE80211_CCMP_PN_LEN); 2279 BUILD_BUG_ON(offsetof(struct ieee80211_key, 2280 u.ccmp.rx_pn) != 2281 offsetof(struct ieee80211_key, 2282 u.gcmp.rx_pn)); 2283 BUILD_BUG_ON(sizeof(rx->key->u.ccmp.rx_pn[queue]) != 2284 sizeof(rx->key->u.gcmp.rx_pn[queue])); 2285 BUILD_BUG_ON(IEEE80211_CCMP_PN_LEN != 2286 IEEE80211_GCMP_PN_LEN); 2287 } else if (rx->key && 2288 (ieee80211_has_protected(fc) || 2289 (status->flag & RX_FLAG_DECRYPTED))) { 2290 entry->is_protected = true; 2291 entry->key_color = rx->key->color; 2292 } 2293 return RX_QUEUED; 2294 } 2295 2296 /* This is a fragment for a frame that should already be pending in 2297 * fragment cache. Add this fragment to the end of the pending entry. 2298 */ 2299 entry = ieee80211_reassemble_find(cache, frag, seq, 2300 rx->seqno_idx, hdr); 2301 if (!entry) { 2302 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag); 2303 return RX_DROP_MONITOR; 2304 } 2305 2306 /* "The receiver shall discard MSDUs and MMPDUs whose constituent 2307 * MPDU PN values are not incrementing in steps of 1." 2308 * see IEEE P802.11-REVmc/D5.0, 12.5.3.4.4, item d (for CCMP) 2309 * and IEEE P802.11-REVmc/D5.0, 12.5.5.4.4, item d (for GCMP) 2310 */ 2311 if (entry->check_sequential_pn) { 2312 int i; 2313 u8 pn[IEEE80211_CCMP_PN_LEN], *rpn; 2314 2315 if (!requires_sequential_pn(rx, fc)) 2316 return RX_DROP_UNUSABLE; 2317 2318 /* Prevent mixed key and fragment cache attacks */ 2319 if (entry->key_color != rx->key->color) 2320 return RX_DROP_UNUSABLE; 2321 2322 memcpy(pn, entry->last_pn, IEEE80211_CCMP_PN_LEN); 2323 for (i = IEEE80211_CCMP_PN_LEN - 1; i >= 0; i--) { 2324 pn[i]++; 2325 if (pn[i]) 2326 break; 2327 } 2328 2329 rpn = rx->ccm_gcm.pn; 2330 if (memcmp(pn, rpn, IEEE80211_CCMP_PN_LEN)) 2331 return RX_DROP_UNUSABLE; 2332 memcpy(entry->last_pn, pn, IEEE80211_CCMP_PN_LEN); 2333 } else if (entry->is_protected && 2334 (!rx->key || 2335 (!ieee80211_has_protected(fc) && 2336 !(status->flag & RX_FLAG_DECRYPTED)) || 2337 rx->key->color != entry->key_color)) { 2338 /* Drop this as a mixed key or fragment cache attack, even 2339 * if for TKIP Michael MIC should protect us, and WEP is a 2340 * lost cause anyway. 2341 */ 2342 return RX_DROP_UNUSABLE; 2343 } else if (entry->is_protected && rx->key && 2344 entry->key_color != rx->key->color && 2345 (status->flag & RX_FLAG_DECRYPTED)) { 2346 return RX_DROP_UNUSABLE; 2347 } 2348 2349 skb_pull(rx->skb, ieee80211_hdrlen(fc)); 2350 __skb_queue_tail(&entry->skb_list, rx->skb); 2351 entry->last_frag = frag; 2352 entry->extra_len += rx->skb->len; 2353 if (ieee80211_has_morefrags(fc)) { 2354 rx->skb = NULL; 2355 return RX_QUEUED; 2356 } 2357 2358 rx->skb = __skb_dequeue(&entry->skb_list); 2359 if (skb_tailroom(rx->skb) < entry->extra_len) { 2360 I802_DEBUG_INC(rx->local->rx_expand_skb_head_defrag); 2361 if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len, 2362 GFP_ATOMIC))) { 2363 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag); 2364 __skb_queue_purge(&entry->skb_list); 2365 return RX_DROP_UNUSABLE; 2366 } 2367 } 2368 while ((skb = __skb_dequeue(&entry->skb_list))) { 2369 skb_put_data(rx->skb, skb->data, skb->len); 2370 dev_kfree_skb(skb); 2371 } 2372 2373 out: 2374 ieee80211_led_rx(rx->local); 2375 if (rx->sta) 2376 rx->sta->deflink.rx_stats.packets++; 2377 return RX_CONTINUE; 2378 } 2379 2380 static int ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx) 2381 { 2382 if (unlikely(!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_AUTHORIZED))) 2383 return -EACCES; 2384 2385 return 0; 2386 } 2387 2388 static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc) 2389 { 2390 struct ieee80211_hdr *hdr = (void *)rx->skb->data; 2391 struct sk_buff *skb = rx->skb; 2392 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 2393 2394 /* 2395 * Pass through unencrypted frames if the hardware has 2396 * decrypted them already. 2397 */ 2398 if (status->flag & RX_FLAG_DECRYPTED) 2399 return 0; 2400 2401 /* check mesh EAPOL frames first */ 2402 if (unlikely(rx->sta && ieee80211_vif_is_mesh(&rx->sdata->vif) && 2403 ieee80211_is_data(fc))) { 2404 struct ieee80211s_hdr *mesh_hdr; 2405 u16 hdr_len = ieee80211_hdrlen(fc); 2406 u16 ethertype_offset; 2407 __be16 ethertype; 2408 2409 if (!ether_addr_equal(hdr->addr1, rx->sdata->vif.addr)) 2410 goto drop_check; 2411 2412 /* make sure fixed part of mesh header is there, also checks skb len */ 2413 if (!pskb_may_pull(rx->skb, hdr_len + 6)) 2414 goto drop_check; 2415 2416 mesh_hdr = (struct ieee80211s_hdr *)(skb->data + hdr_len); 2417 ethertype_offset = hdr_len + ieee80211_get_mesh_hdrlen(mesh_hdr) + 2418 sizeof(rfc1042_header); 2419 2420 if (skb_copy_bits(rx->skb, ethertype_offset, ðertype, 2) == 0 && 2421 ethertype == rx->sdata->control_port_protocol) 2422 return 0; 2423 } 2424 2425 drop_check: 2426 /* Drop unencrypted frames if key is set. */ 2427 if (unlikely(!ieee80211_has_protected(fc) && 2428 !ieee80211_is_any_nullfunc(fc) && 2429 ieee80211_is_data(fc) && rx->key)) 2430 return -EACCES; 2431 2432 return 0; 2433 } 2434 2435 static int ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx) 2436 { 2437 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 2438 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 2439 __le16 fc = hdr->frame_control; 2440 2441 /* 2442 * Pass through unencrypted frames if the hardware has 2443 * decrypted them already. 2444 */ 2445 if (status->flag & RX_FLAG_DECRYPTED) 2446 return 0; 2447 2448 if (rx->sta && test_sta_flag(rx->sta, WLAN_STA_MFP)) { 2449 if (unlikely(!ieee80211_has_protected(fc) && 2450 ieee80211_is_unicast_robust_mgmt_frame(rx->skb) && 2451 rx->key)) { 2452 if (ieee80211_is_deauth(fc) || 2453 ieee80211_is_disassoc(fc)) 2454 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev, 2455 rx->skb->data, 2456 rx->skb->len); 2457 return -EACCES; 2458 } 2459 /* BIP does not use Protected field, so need to check MMIE */ 2460 if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) && 2461 ieee80211_get_mmie_keyidx(rx->skb) < 0)) { 2462 if (ieee80211_is_deauth(fc) || 2463 ieee80211_is_disassoc(fc)) 2464 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev, 2465 rx->skb->data, 2466 rx->skb->len); 2467 return -EACCES; 2468 } 2469 if (unlikely(ieee80211_is_beacon(fc) && rx->key && 2470 ieee80211_get_mmie_keyidx(rx->skb) < 0)) { 2471 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev, 2472 rx->skb->data, 2473 rx->skb->len); 2474 return -EACCES; 2475 } 2476 /* 2477 * When using MFP, Action frames are not allowed prior to 2478 * having configured keys. 2479 */ 2480 if (unlikely(ieee80211_is_action(fc) && !rx->key && 2481 ieee80211_is_robust_mgmt_frame(rx->skb))) 2482 return -EACCES; 2483 } 2484 2485 return 0; 2486 } 2487 2488 static int 2489 __ieee80211_data_to_8023(struct ieee80211_rx_data *rx, bool *port_control) 2490 { 2491 struct ieee80211_sub_if_data *sdata = rx->sdata; 2492 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 2493 bool check_port_control = false; 2494 struct ethhdr *ehdr; 2495 int ret; 2496 2497 *port_control = false; 2498 if (ieee80211_has_a4(hdr->frame_control) && 2499 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta) 2500 return -1; 2501 2502 if (sdata->vif.type == NL80211_IFTYPE_STATION && 2503 !!sdata->u.mgd.use_4addr != !!ieee80211_has_a4(hdr->frame_control)) { 2504 2505 if (!sdata->u.mgd.use_4addr) 2506 return -1; 2507 else if (!ether_addr_equal(hdr->addr1, sdata->vif.addr)) 2508 check_port_control = true; 2509 } 2510 2511 if (is_multicast_ether_addr(hdr->addr1) && 2512 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta) 2513 return -1; 2514 2515 ret = ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type); 2516 if (ret < 0) 2517 return ret; 2518 2519 ehdr = (struct ethhdr *) rx->skb->data; 2520 if (ehdr->h_proto == rx->sdata->control_port_protocol) 2521 *port_control = true; 2522 else if (check_port_control) 2523 return -1; 2524 2525 return 0; 2526 } 2527 2528 /* 2529 * requires that rx->skb is a frame with ethernet header 2530 */ 2531 static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc) 2532 { 2533 static const u8 pae_group_addr[ETH_ALEN] __aligned(2) 2534 = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 }; 2535 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data; 2536 2537 /* 2538 * Allow EAPOL frames to us/the PAE group address regardless of 2539 * whether the frame was encrypted or not, and always disallow 2540 * all other destination addresses for them. 2541 */ 2542 if (unlikely(ehdr->h_proto == rx->sdata->control_port_protocol)) 2543 return ether_addr_equal(ehdr->h_dest, rx->sdata->vif.addr) || 2544 ether_addr_equal(ehdr->h_dest, pae_group_addr); 2545 2546 if (ieee80211_802_1x_port_control(rx) || 2547 ieee80211_drop_unencrypted(rx, fc)) 2548 return false; 2549 2550 return true; 2551 } 2552 2553 static void ieee80211_deliver_skb_to_local_stack(struct sk_buff *skb, 2554 struct ieee80211_rx_data *rx) 2555 { 2556 struct ieee80211_sub_if_data *sdata = rx->sdata; 2557 struct net_device *dev = sdata->dev; 2558 2559 if (unlikely((skb->protocol == sdata->control_port_protocol || 2560 (skb->protocol == cpu_to_be16(ETH_P_PREAUTH) && 2561 !sdata->control_port_no_preauth)) && 2562 sdata->control_port_over_nl80211)) { 2563 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 2564 bool noencrypt = !(status->flag & RX_FLAG_DECRYPTED); 2565 2566 cfg80211_rx_control_port(dev, skb, noencrypt); 2567 dev_kfree_skb(skb); 2568 } else { 2569 struct ethhdr *ehdr = (void *)skb_mac_header(skb); 2570 2571 memset(skb->cb, 0, sizeof(skb->cb)); 2572 2573 /* 2574 * 802.1X over 802.11 requires that the authenticator address 2575 * be used for EAPOL frames. However, 802.1X allows the use of 2576 * the PAE group address instead. If the interface is part of 2577 * a bridge and we pass the frame with the PAE group address, 2578 * then the bridge will forward it to the network (even if the 2579 * client was not associated yet), which isn't supposed to 2580 * happen. 2581 * To avoid that, rewrite the destination address to our own 2582 * address, so that the authenticator (e.g. hostapd) will see 2583 * the frame, but bridge won't forward it anywhere else. Note 2584 * that due to earlier filtering, the only other address can 2585 * be the PAE group address, unless the hardware allowed them 2586 * through in 802.3 offloaded mode. 2587 */ 2588 if (unlikely(skb->protocol == sdata->control_port_protocol && 2589 !ether_addr_equal(ehdr->h_dest, sdata->vif.addr))) 2590 ether_addr_copy(ehdr->h_dest, sdata->vif.addr); 2591 2592 /* deliver to local stack */ 2593 if (rx->list) 2594 list_add_tail(&skb->list, rx->list); 2595 else 2596 netif_receive_skb(skb); 2597 } 2598 } 2599 2600 /* 2601 * requires that rx->skb is a frame with ethernet header 2602 */ 2603 static void 2604 ieee80211_deliver_skb(struct ieee80211_rx_data *rx) 2605 { 2606 struct ieee80211_sub_if_data *sdata = rx->sdata; 2607 struct net_device *dev = sdata->dev; 2608 struct sk_buff *skb, *xmit_skb; 2609 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data; 2610 struct sta_info *dsta; 2611 2612 skb = rx->skb; 2613 xmit_skb = NULL; 2614 2615 dev_sw_netstats_rx_add(dev, skb->len); 2616 2617 if (rx->sta) { 2618 /* The seqno index has the same property as needed 2619 * for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS 2620 * for non-QoS-data frames. Here we know it's a data 2621 * frame, so count MSDUs. 2622 */ 2623 u64_stats_update_begin(&rx->sta->deflink.rx_stats.syncp); 2624 rx->sta->deflink.rx_stats.msdu[rx->seqno_idx]++; 2625 u64_stats_update_end(&rx->sta->deflink.rx_stats.syncp); 2626 } 2627 2628 if ((sdata->vif.type == NL80211_IFTYPE_AP || 2629 sdata->vif.type == NL80211_IFTYPE_AP_VLAN) && 2630 !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) && 2631 ehdr->h_proto != rx->sdata->control_port_protocol && 2632 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) { 2633 if (is_multicast_ether_addr(ehdr->h_dest) && 2634 ieee80211_vif_get_num_mcast_if(sdata) != 0) { 2635 /* 2636 * send multicast frames both to higher layers in 2637 * local net stack and back to the wireless medium 2638 */ 2639 xmit_skb = skb_copy(skb, GFP_ATOMIC); 2640 if (!xmit_skb) 2641 net_info_ratelimited("%s: failed to clone multicast frame\n", 2642 dev->name); 2643 } else if (!is_multicast_ether_addr(ehdr->h_dest) && 2644 !ether_addr_equal(ehdr->h_dest, ehdr->h_source)) { 2645 dsta = sta_info_get(sdata, ehdr->h_dest); 2646 if (dsta) { 2647 /* 2648 * The destination station is associated to 2649 * this AP (in this VLAN), so send the frame 2650 * directly to it and do not pass it to local 2651 * net stack. 2652 */ 2653 xmit_skb = skb; 2654 skb = NULL; 2655 } 2656 } 2657 } 2658 2659 #ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS 2660 if (skb) { 2661 /* 'align' will only take the values 0 or 2 here since all 2662 * frames are required to be aligned to 2-byte boundaries 2663 * when being passed to mac80211; the code here works just 2664 * as well if that isn't true, but mac80211 assumes it can 2665 * access fields as 2-byte aligned (e.g. for ether_addr_equal) 2666 */ 2667 int align; 2668 2669 align = (unsigned long)(skb->data + sizeof(struct ethhdr)) & 3; 2670 if (align) { 2671 if (WARN_ON(skb_headroom(skb) < 3)) { 2672 dev_kfree_skb(skb); 2673 skb = NULL; 2674 } else { 2675 u8 *data = skb->data; 2676 size_t len = skb_headlen(skb); 2677 skb->data -= align; 2678 memmove(skb->data, data, len); 2679 skb_set_tail_pointer(skb, len); 2680 } 2681 } 2682 } 2683 #endif 2684 2685 if (skb) { 2686 skb->protocol = eth_type_trans(skb, dev); 2687 ieee80211_deliver_skb_to_local_stack(skb, rx); 2688 } 2689 2690 if (xmit_skb) { 2691 /* 2692 * Send to wireless media and increase priority by 256 to 2693 * keep the received priority instead of reclassifying 2694 * the frame (see cfg80211_classify8021d). 2695 */ 2696 xmit_skb->priority += 256; 2697 xmit_skb->protocol = htons(ETH_P_802_3); 2698 skb_reset_network_header(xmit_skb); 2699 skb_reset_mac_header(xmit_skb); 2700 dev_queue_xmit(xmit_skb); 2701 } 2702 } 2703 2704 static ieee80211_rx_result debug_noinline 2705 __ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx, u8 data_offset) 2706 { 2707 struct net_device *dev = rx->sdata->dev; 2708 struct sk_buff *skb = rx->skb; 2709 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; 2710 __le16 fc = hdr->frame_control; 2711 struct sk_buff_head frame_list; 2712 struct ethhdr ethhdr; 2713 const u8 *check_da = ethhdr.h_dest, *check_sa = ethhdr.h_source; 2714 2715 if (unlikely(ieee80211_has_a4(hdr->frame_control))) { 2716 check_da = NULL; 2717 check_sa = NULL; 2718 } else switch (rx->sdata->vif.type) { 2719 case NL80211_IFTYPE_AP: 2720 case NL80211_IFTYPE_AP_VLAN: 2721 check_da = NULL; 2722 break; 2723 case NL80211_IFTYPE_STATION: 2724 if (!rx->sta || 2725 !test_sta_flag(rx->sta, WLAN_STA_TDLS_PEER)) 2726 check_sa = NULL; 2727 break; 2728 case NL80211_IFTYPE_MESH_POINT: 2729 check_sa = NULL; 2730 break; 2731 default: 2732 break; 2733 } 2734 2735 skb->dev = dev; 2736 __skb_queue_head_init(&frame_list); 2737 2738 if (ieee80211_data_to_8023_exthdr(skb, ðhdr, 2739 rx->sdata->vif.addr, 2740 rx->sdata->vif.type, 2741 data_offset, true)) 2742 return RX_DROP_UNUSABLE; 2743 2744 ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr, 2745 rx->sdata->vif.type, 2746 rx->local->hw.extra_tx_headroom, 2747 check_da, check_sa); 2748 2749 while (!skb_queue_empty(&frame_list)) { 2750 rx->skb = __skb_dequeue(&frame_list); 2751 2752 if (!ieee80211_frame_allowed(rx, fc)) { 2753 dev_kfree_skb(rx->skb); 2754 continue; 2755 } 2756 2757 ieee80211_deliver_skb(rx); 2758 } 2759 2760 return RX_QUEUED; 2761 } 2762 2763 static ieee80211_rx_result debug_noinline 2764 ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx) 2765 { 2766 struct sk_buff *skb = rx->skb; 2767 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 2768 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; 2769 __le16 fc = hdr->frame_control; 2770 2771 if (!(status->rx_flags & IEEE80211_RX_AMSDU)) 2772 return RX_CONTINUE; 2773 2774 if (unlikely(!ieee80211_is_data(fc))) 2775 return RX_CONTINUE; 2776 2777 if (unlikely(!ieee80211_is_data_present(fc))) 2778 return RX_DROP_MONITOR; 2779 2780 if (unlikely(ieee80211_has_a4(hdr->frame_control))) { 2781 switch (rx->sdata->vif.type) { 2782 case NL80211_IFTYPE_AP_VLAN: 2783 if (!rx->sdata->u.vlan.sta) 2784 return RX_DROP_UNUSABLE; 2785 break; 2786 case NL80211_IFTYPE_STATION: 2787 if (!rx->sdata->u.mgd.use_4addr) 2788 return RX_DROP_UNUSABLE; 2789 break; 2790 default: 2791 return RX_DROP_UNUSABLE; 2792 } 2793 } 2794 2795 if (is_multicast_ether_addr(hdr->addr1)) 2796 return RX_DROP_UNUSABLE; 2797 2798 if (rx->key) { 2799 /* 2800 * We should not receive A-MSDUs on pre-HT connections, 2801 * and HT connections cannot use old ciphers. Thus drop 2802 * them, as in those cases we couldn't even have SPP 2803 * A-MSDUs or such. 2804 */ 2805 switch (rx->key->conf.cipher) { 2806 case WLAN_CIPHER_SUITE_WEP40: 2807 case WLAN_CIPHER_SUITE_WEP104: 2808 case WLAN_CIPHER_SUITE_TKIP: 2809 return RX_DROP_UNUSABLE; 2810 default: 2811 break; 2812 } 2813 } 2814 2815 return __ieee80211_rx_h_amsdu(rx, 0); 2816 } 2817 2818 #ifdef CONFIG_MAC80211_MESH 2819 static ieee80211_rx_result 2820 ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx) 2821 { 2822 struct ieee80211_hdr *fwd_hdr, *hdr; 2823 struct ieee80211_tx_info *info; 2824 struct ieee80211s_hdr *mesh_hdr; 2825 struct sk_buff *skb = rx->skb, *fwd_skb; 2826 struct ieee80211_local *local = rx->local; 2827 struct ieee80211_sub_if_data *sdata = rx->sdata; 2828 struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh; 2829 u16 ac, q, hdrlen; 2830 int tailroom = 0; 2831 2832 hdr = (struct ieee80211_hdr *) skb->data; 2833 hdrlen = ieee80211_hdrlen(hdr->frame_control); 2834 2835 /* make sure fixed part of mesh header is there, also checks skb len */ 2836 if (!pskb_may_pull(rx->skb, hdrlen + 6)) 2837 return RX_DROP_MONITOR; 2838 2839 mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen); 2840 2841 /* make sure full mesh header is there, also checks skb len */ 2842 if (!pskb_may_pull(rx->skb, 2843 hdrlen + ieee80211_get_mesh_hdrlen(mesh_hdr))) 2844 return RX_DROP_MONITOR; 2845 2846 /* reload pointers */ 2847 hdr = (struct ieee80211_hdr *) skb->data; 2848 mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen); 2849 2850 if (ieee80211_drop_unencrypted(rx, hdr->frame_control)) 2851 return RX_DROP_MONITOR; 2852 2853 /* frame is in RMC, don't forward */ 2854 if (ieee80211_is_data(hdr->frame_control) && 2855 is_multicast_ether_addr(hdr->addr1) && 2856 mesh_rmc_check(rx->sdata, hdr->addr3, mesh_hdr)) 2857 return RX_DROP_MONITOR; 2858 2859 if (!ieee80211_is_data(hdr->frame_control)) 2860 return RX_CONTINUE; 2861 2862 if (!mesh_hdr->ttl) 2863 return RX_DROP_MONITOR; 2864 2865 if (mesh_hdr->flags & MESH_FLAGS_AE) { 2866 struct mesh_path *mppath; 2867 char *proxied_addr; 2868 char *mpp_addr; 2869 2870 if (is_multicast_ether_addr(hdr->addr1)) { 2871 mpp_addr = hdr->addr3; 2872 proxied_addr = mesh_hdr->eaddr1; 2873 } else if ((mesh_hdr->flags & MESH_FLAGS_AE) == 2874 MESH_FLAGS_AE_A5_A6) { 2875 /* has_a4 already checked in ieee80211_rx_mesh_check */ 2876 mpp_addr = hdr->addr4; 2877 proxied_addr = mesh_hdr->eaddr2; 2878 } else { 2879 return RX_DROP_MONITOR; 2880 } 2881 2882 rcu_read_lock(); 2883 mppath = mpp_path_lookup(sdata, proxied_addr); 2884 if (!mppath) { 2885 mpp_path_add(sdata, proxied_addr, mpp_addr); 2886 } else { 2887 spin_lock_bh(&mppath->state_lock); 2888 if (!ether_addr_equal(mppath->mpp, mpp_addr)) 2889 memcpy(mppath->mpp, mpp_addr, ETH_ALEN); 2890 mppath->exp_time = jiffies; 2891 spin_unlock_bh(&mppath->state_lock); 2892 } 2893 rcu_read_unlock(); 2894 } 2895 2896 /* Frame has reached destination. Don't forward */ 2897 if (!is_multicast_ether_addr(hdr->addr1) && 2898 ether_addr_equal(sdata->vif.addr, hdr->addr3)) 2899 return RX_CONTINUE; 2900 2901 ac = ieee802_1d_to_ac[skb->priority]; 2902 q = sdata->vif.hw_queue[ac]; 2903 if (ieee80211_queue_stopped(&local->hw, q)) { 2904 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion); 2905 return RX_DROP_MONITOR; 2906 } 2907 skb_set_queue_mapping(skb, ac); 2908 2909 if (!--mesh_hdr->ttl) { 2910 if (!is_multicast_ether_addr(hdr->addr1)) 2911 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, 2912 dropped_frames_ttl); 2913 goto out; 2914 } 2915 2916 if (!ifmsh->mshcfg.dot11MeshForwarding) 2917 goto out; 2918 2919 if (sdata->crypto_tx_tailroom_needed_cnt) 2920 tailroom = IEEE80211_ENCRYPT_TAILROOM; 2921 2922 fwd_skb = skb_copy_expand(skb, local->tx_headroom + 2923 IEEE80211_ENCRYPT_HEADROOM, 2924 tailroom, GFP_ATOMIC); 2925 if (!fwd_skb) 2926 goto out; 2927 2928 fwd_skb->dev = sdata->dev; 2929 fwd_hdr = (struct ieee80211_hdr *) fwd_skb->data; 2930 fwd_hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_RETRY); 2931 info = IEEE80211_SKB_CB(fwd_skb); 2932 memset(info, 0, sizeof(*info)); 2933 info->control.flags |= IEEE80211_TX_INTCFL_NEED_TXPROCESSING; 2934 info->control.vif = &rx->sdata->vif; 2935 info->control.jiffies = jiffies; 2936 if (is_multicast_ether_addr(fwd_hdr->addr1)) { 2937 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_mcast); 2938 memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN); 2939 /* update power mode indication when forwarding */ 2940 ieee80211_mps_set_frame_flags(sdata, NULL, fwd_hdr); 2941 } else if (!mesh_nexthop_lookup(sdata, fwd_skb)) { 2942 /* mesh power mode flags updated in mesh_nexthop_lookup */ 2943 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast); 2944 } else { 2945 /* unable to resolve next hop */ 2946 mesh_path_error_tx(sdata, ifmsh->mshcfg.element_ttl, 2947 fwd_hdr->addr3, 0, 2948 WLAN_REASON_MESH_PATH_NOFORWARD, 2949 fwd_hdr->addr2); 2950 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_no_route); 2951 kfree_skb(fwd_skb); 2952 return RX_DROP_MONITOR; 2953 } 2954 2955 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames); 2956 ieee80211_add_pending_skb(local, fwd_skb); 2957 out: 2958 if (is_multicast_ether_addr(hdr->addr1)) 2959 return RX_CONTINUE; 2960 return RX_DROP_MONITOR; 2961 } 2962 #endif 2963 2964 static ieee80211_rx_result debug_noinline 2965 ieee80211_rx_h_data(struct ieee80211_rx_data *rx) 2966 { 2967 struct ieee80211_sub_if_data *sdata = rx->sdata; 2968 struct ieee80211_local *local = rx->local; 2969 struct net_device *dev = sdata->dev; 2970 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 2971 __le16 fc = hdr->frame_control; 2972 bool port_control; 2973 int err; 2974 2975 if (unlikely(!ieee80211_is_data(hdr->frame_control))) 2976 return RX_CONTINUE; 2977 2978 if (unlikely(!ieee80211_is_data_present(hdr->frame_control))) 2979 return RX_DROP_MONITOR; 2980 2981 /* 2982 * Send unexpected-4addr-frame event to hostapd. For older versions, 2983 * also drop the frame to cooked monitor interfaces. 2984 */ 2985 if (ieee80211_has_a4(hdr->frame_control) && 2986 sdata->vif.type == NL80211_IFTYPE_AP) { 2987 if (rx->sta && 2988 !test_and_set_sta_flag(rx->sta, WLAN_STA_4ADDR_EVENT)) 2989 cfg80211_rx_unexpected_4addr_frame( 2990 rx->sdata->dev, rx->sta->sta.addr, GFP_ATOMIC); 2991 return RX_DROP_MONITOR; 2992 } 2993 2994 err = __ieee80211_data_to_8023(rx, &port_control); 2995 if (unlikely(err)) 2996 return RX_DROP_UNUSABLE; 2997 2998 if (!ieee80211_frame_allowed(rx, fc)) 2999 return RX_DROP_MONITOR; 3000 3001 /* directly handle TDLS channel switch requests/responses */ 3002 if (unlikely(((struct ethhdr *)rx->skb->data)->h_proto == 3003 cpu_to_be16(ETH_P_TDLS))) { 3004 struct ieee80211_tdls_data *tf = (void *)rx->skb->data; 3005 3006 if (pskb_may_pull(rx->skb, 3007 offsetof(struct ieee80211_tdls_data, u)) && 3008 tf->payload_type == WLAN_TDLS_SNAP_RFTYPE && 3009 tf->category == WLAN_CATEGORY_TDLS && 3010 (tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_REQUEST || 3011 tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_RESPONSE)) { 3012 rx->skb->protocol = cpu_to_be16(ETH_P_TDLS); 3013 __ieee80211_queue_skb_to_iface(sdata, rx->sta, rx->skb); 3014 return RX_QUEUED; 3015 } 3016 } 3017 3018 if (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN && 3019 unlikely(port_control) && sdata->bss) { 3020 sdata = container_of(sdata->bss, struct ieee80211_sub_if_data, 3021 u.ap); 3022 dev = sdata->dev; 3023 rx->sdata = sdata; 3024 } 3025 3026 rx->skb->dev = dev; 3027 3028 if (!ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS) && 3029 local->ps_sdata && local->hw.conf.dynamic_ps_timeout > 0 && 3030 !is_multicast_ether_addr( 3031 ((struct ethhdr *)rx->skb->data)->h_dest) && 3032 (!local->scanning && 3033 !test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))) 3034 mod_timer(&local->dynamic_ps_timer, jiffies + 3035 msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout)); 3036 3037 ieee80211_deliver_skb(rx); 3038 3039 return RX_QUEUED; 3040 } 3041 3042 static ieee80211_rx_result debug_noinline 3043 ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames) 3044 { 3045 struct sk_buff *skb = rx->skb; 3046 struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data; 3047 struct tid_ampdu_rx *tid_agg_rx; 3048 u16 start_seq_num; 3049 u16 tid; 3050 3051 if (likely(!ieee80211_is_ctl(bar->frame_control))) 3052 return RX_CONTINUE; 3053 3054 if (ieee80211_is_back_req(bar->frame_control)) { 3055 struct { 3056 __le16 control, start_seq_num; 3057 } __packed bar_data; 3058 struct ieee80211_event event = { 3059 .type = BAR_RX_EVENT, 3060 }; 3061 3062 if (!rx->sta) 3063 return RX_DROP_MONITOR; 3064 3065 if (skb_copy_bits(skb, offsetof(struct ieee80211_bar, control), 3066 &bar_data, sizeof(bar_data))) 3067 return RX_DROP_MONITOR; 3068 3069 tid = le16_to_cpu(bar_data.control) >> 12; 3070 3071 if (!test_bit(tid, rx->sta->ampdu_mlme.agg_session_valid) && 3072 !test_and_set_bit(tid, rx->sta->ampdu_mlme.unexpected_agg)) 3073 ieee80211_send_delba(rx->sdata, rx->sta->sta.addr, tid, 3074 WLAN_BACK_RECIPIENT, 3075 WLAN_REASON_QSTA_REQUIRE_SETUP); 3076 3077 tid_agg_rx = rcu_dereference(rx->sta->ampdu_mlme.tid_rx[tid]); 3078 if (!tid_agg_rx) 3079 return RX_DROP_MONITOR; 3080 3081 start_seq_num = le16_to_cpu(bar_data.start_seq_num) >> 4; 3082 event.u.ba.tid = tid; 3083 event.u.ba.ssn = start_seq_num; 3084 event.u.ba.sta = &rx->sta->sta; 3085 3086 /* reset session timer */ 3087 if (tid_agg_rx->timeout) 3088 mod_timer(&tid_agg_rx->session_timer, 3089 TU_TO_EXP_TIME(tid_agg_rx->timeout)); 3090 3091 spin_lock(&tid_agg_rx->reorder_lock); 3092 /* release stored frames up to start of BAR */ 3093 ieee80211_release_reorder_frames(rx->sdata, tid_agg_rx, 3094 start_seq_num, frames); 3095 spin_unlock(&tid_agg_rx->reorder_lock); 3096 3097 drv_event_callback(rx->local, rx->sdata, &event); 3098 3099 kfree_skb(skb); 3100 return RX_QUEUED; 3101 } 3102 3103 /* 3104 * After this point, we only want management frames, 3105 * so we can drop all remaining control frames to 3106 * cooked monitor interfaces. 3107 */ 3108 return RX_DROP_MONITOR; 3109 } 3110 3111 static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata, 3112 struct ieee80211_mgmt *mgmt, 3113 size_t len) 3114 { 3115 struct ieee80211_local *local = sdata->local; 3116 struct sk_buff *skb; 3117 struct ieee80211_mgmt *resp; 3118 3119 if (!ether_addr_equal(mgmt->da, sdata->vif.addr)) { 3120 /* Not to own unicast address */ 3121 return; 3122 } 3123 3124 if (!ether_addr_equal(mgmt->sa, sdata->u.mgd.bssid) || 3125 !ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid)) { 3126 /* Not from the current AP or not associated yet. */ 3127 return; 3128 } 3129 3130 if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) { 3131 /* Too short SA Query request frame */ 3132 return; 3133 } 3134 3135 skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom); 3136 if (skb == NULL) 3137 return; 3138 3139 skb_reserve(skb, local->hw.extra_tx_headroom); 3140 resp = skb_put_zero(skb, 24); 3141 memcpy(resp->da, mgmt->sa, ETH_ALEN); 3142 memcpy(resp->sa, sdata->vif.addr, ETH_ALEN); 3143 memcpy(resp->bssid, sdata->u.mgd.bssid, ETH_ALEN); 3144 resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | 3145 IEEE80211_STYPE_ACTION); 3146 skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query)); 3147 resp->u.action.category = WLAN_CATEGORY_SA_QUERY; 3148 resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE; 3149 memcpy(resp->u.action.u.sa_query.trans_id, 3150 mgmt->u.action.u.sa_query.trans_id, 3151 WLAN_SA_QUERY_TR_ID_LEN); 3152 3153 ieee80211_tx_skb(sdata, skb); 3154 } 3155 3156 static void 3157 ieee80211_rx_check_bss_color_collision(struct ieee80211_rx_data *rx) 3158 { 3159 struct ieee80211_mgmt *mgmt = (void *)rx->skb->data; 3160 const struct element *ie; 3161 size_t baselen; 3162 3163 if (!wiphy_ext_feature_isset(rx->local->hw.wiphy, 3164 NL80211_EXT_FEATURE_BSS_COLOR)) 3165 return; 3166 3167 if (ieee80211_hw_check(&rx->local->hw, DETECTS_COLOR_COLLISION)) 3168 return; 3169 3170 if (rx->sdata->vif.csa_active) 3171 return; 3172 3173 baselen = mgmt->u.beacon.variable - rx->skb->data; 3174 if (baselen > rx->skb->len) 3175 return; 3176 3177 ie = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION, 3178 mgmt->u.beacon.variable, 3179 rx->skb->len - baselen); 3180 if (ie && ie->datalen >= sizeof(struct ieee80211_he_operation) && 3181 ie->datalen >= ieee80211_he_oper_size(ie->data + 1)) { 3182 struct ieee80211_bss_conf *bss_conf = &rx->sdata->vif.bss_conf; 3183 const struct ieee80211_he_operation *he_oper; 3184 u8 color; 3185 3186 he_oper = (void *)(ie->data + 1); 3187 if (le32_get_bits(he_oper->he_oper_params, 3188 IEEE80211_HE_OPERATION_BSS_COLOR_DISABLED)) 3189 return; 3190 3191 color = le32_get_bits(he_oper->he_oper_params, 3192 IEEE80211_HE_OPERATION_BSS_COLOR_MASK); 3193 if (color == bss_conf->he_bss_color.color) 3194 ieeee80211_obss_color_collision_notify(&rx->sdata->vif, 3195 BIT_ULL(color)); 3196 } 3197 } 3198 3199 static ieee80211_rx_result debug_noinline 3200 ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx) 3201 { 3202 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data; 3203 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 3204 3205 if (ieee80211_is_s1g_beacon(mgmt->frame_control)) 3206 return RX_CONTINUE; 3207 3208 /* 3209 * From here on, look only at management frames. 3210 * Data and control frames are already handled, 3211 * and unknown (reserved) frames are useless. 3212 */ 3213 if (rx->skb->len < 24) 3214 return RX_DROP_MONITOR; 3215 3216 if (!ieee80211_is_mgmt(mgmt->frame_control)) 3217 return RX_DROP_MONITOR; 3218 3219 if (rx->sdata->vif.type == NL80211_IFTYPE_AP && 3220 ieee80211_is_beacon(mgmt->frame_control) && 3221 !(rx->flags & IEEE80211_RX_BEACON_REPORTED)) { 3222 int sig = 0; 3223 3224 /* sw bss color collision detection */ 3225 ieee80211_rx_check_bss_color_collision(rx); 3226 3227 if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM) && 3228 !(status->flag & RX_FLAG_NO_SIGNAL_VAL)) 3229 sig = status->signal; 3230 3231 cfg80211_report_obss_beacon_khz(rx->local->hw.wiphy, 3232 rx->skb->data, rx->skb->len, 3233 ieee80211_rx_status_to_khz(status), 3234 sig); 3235 rx->flags |= IEEE80211_RX_BEACON_REPORTED; 3236 } 3237 3238 if (ieee80211_drop_unencrypted_mgmt(rx)) 3239 return RX_DROP_UNUSABLE; 3240 3241 return RX_CONTINUE; 3242 } 3243 3244 static bool 3245 ieee80211_process_rx_twt_action(struct ieee80211_rx_data *rx) 3246 { 3247 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)rx->skb->data; 3248 struct ieee80211_sub_if_data *sdata = rx->sdata; 3249 3250 /* TWT actions are only supported in AP for the moment */ 3251 if (sdata->vif.type != NL80211_IFTYPE_AP) 3252 return false; 3253 3254 if (!rx->local->ops->add_twt_setup) 3255 return false; 3256 3257 if (!sdata->vif.bss_conf.twt_responder) 3258 return false; 3259 3260 if (!rx->sta) 3261 return false; 3262 3263 switch (mgmt->u.action.u.s1g.action_code) { 3264 case WLAN_S1G_TWT_SETUP: { 3265 struct ieee80211_twt_setup *twt; 3266 3267 if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE + 3268 1 + /* action code */ 3269 sizeof(struct ieee80211_twt_setup) + 3270 2 /* TWT req_type agrt */) 3271 break; 3272 3273 twt = (void *)mgmt->u.action.u.s1g.variable; 3274 if (twt->element_id != WLAN_EID_S1G_TWT) 3275 break; 3276 3277 if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE + 3278 4 + /* action code + token + tlv */ 3279 twt->length) 3280 break; 3281 3282 return true; /* queue the frame */ 3283 } 3284 case WLAN_S1G_TWT_TEARDOWN: 3285 if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE + 2) 3286 break; 3287 3288 return true; /* queue the frame */ 3289 default: 3290 break; 3291 } 3292 3293 return false; 3294 } 3295 3296 static ieee80211_rx_result debug_noinline 3297 ieee80211_rx_h_action(struct ieee80211_rx_data *rx) 3298 { 3299 struct ieee80211_local *local = rx->local; 3300 struct ieee80211_sub_if_data *sdata = rx->sdata; 3301 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data; 3302 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 3303 int len = rx->skb->len; 3304 3305 if (!ieee80211_is_action(mgmt->frame_control)) 3306 return RX_CONTINUE; 3307 3308 /* drop too small frames */ 3309 if (len < IEEE80211_MIN_ACTION_SIZE) 3310 return RX_DROP_UNUSABLE; 3311 3312 if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC && 3313 mgmt->u.action.category != WLAN_CATEGORY_SELF_PROTECTED && 3314 mgmt->u.action.category != WLAN_CATEGORY_SPECTRUM_MGMT) 3315 return RX_DROP_UNUSABLE; 3316 3317 switch (mgmt->u.action.category) { 3318 case WLAN_CATEGORY_HT: 3319 /* reject HT action frames from stations not supporting HT */ 3320 if (!rx->sta->sta.deflink.ht_cap.ht_supported) 3321 goto invalid; 3322 3323 if (sdata->vif.type != NL80211_IFTYPE_STATION && 3324 sdata->vif.type != NL80211_IFTYPE_MESH_POINT && 3325 sdata->vif.type != NL80211_IFTYPE_AP_VLAN && 3326 sdata->vif.type != NL80211_IFTYPE_AP && 3327 sdata->vif.type != NL80211_IFTYPE_ADHOC) 3328 break; 3329 3330 /* verify action & smps_control/chanwidth are present */ 3331 if (len < IEEE80211_MIN_ACTION_SIZE + 2) 3332 goto invalid; 3333 3334 switch (mgmt->u.action.u.ht_smps.action) { 3335 case WLAN_HT_ACTION_SMPS: { 3336 struct ieee80211_supported_band *sband; 3337 enum ieee80211_smps_mode smps_mode; 3338 struct sta_opmode_info sta_opmode = {}; 3339 3340 if (sdata->vif.type != NL80211_IFTYPE_AP && 3341 sdata->vif.type != NL80211_IFTYPE_AP_VLAN) 3342 goto handled; 3343 3344 /* convert to HT capability */ 3345 switch (mgmt->u.action.u.ht_smps.smps_control) { 3346 case WLAN_HT_SMPS_CONTROL_DISABLED: 3347 smps_mode = IEEE80211_SMPS_OFF; 3348 break; 3349 case WLAN_HT_SMPS_CONTROL_STATIC: 3350 smps_mode = IEEE80211_SMPS_STATIC; 3351 break; 3352 case WLAN_HT_SMPS_CONTROL_DYNAMIC: 3353 smps_mode = IEEE80211_SMPS_DYNAMIC; 3354 break; 3355 default: 3356 goto invalid; 3357 } 3358 3359 /* if no change do nothing */ 3360 if (rx->sta->sta.smps_mode == smps_mode) 3361 goto handled; 3362 rx->sta->sta.smps_mode = smps_mode; 3363 sta_opmode.smps_mode = 3364 ieee80211_smps_mode_to_smps_mode(smps_mode); 3365 sta_opmode.changed = STA_OPMODE_SMPS_MODE_CHANGED; 3366 3367 sband = rx->local->hw.wiphy->bands[status->band]; 3368 3369 rate_control_rate_update(local, sband, rx->sta, 3370 IEEE80211_RC_SMPS_CHANGED); 3371 cfg80211_sta_opmode_change_notify(sdata->dev, 3372 rx->sta->addr, 3373 &sta_opmode, 3374 GFP_ATOMIC); 3375 goto handled; 3376 } 3377 case WLAN_HT_ACTION_NOTIFY_CHANWIDTH: { 3378 struct ieee80211_supported_band *sband; 3379 u8 chanwidth = mgmt->u.action.u.ht_notify_cw.chanwidth; 3380 enum ieee80211_sta_rx_bandwidth max_bw, new_bw; 3381 struct sta_opmode_info sta_opmode = {}; 3382 3383 /* If it doesn't support 40 MHz it can't change ... */ 3384 if (!(rx->sta->sta.deflink.ht_cap.cap & 3385 IEEE80211_HT_CAP_SUP_WIDTH_20_40)) 3386 goto handled; 3387 3388 if (chanwidth == IEEE80211_HT_CHANWIDTH_20MHZ) 3389 max_bw = IEEE80211_STA_RX_BW_20; 3390 else 3391 max_bw = ieee80211_sta_cap_rx_bw(rx->sta); 3392 3393 /* set cur_max_bandwidth and recalc sta bw */ 3394 rx->sta->deflink.cur_max_bandwidth = max_bw; 3395 new_bw = ieee80211_sta_cur_vht_bw(rx->sta); 3396 3397 if (rx->sta->sta.deflink.bandwidth == new_bw) 3398 goto handled; 3399 3400 rx->sta->sta.deflink.bandwidth = new_bw; 3401 sband = rx->local->hw.wiphy->bands[status->band]; 3402 sta_opmode.bw = 3403 ieee80211_sta_rx_bw_to_chan_width(rx->sta); 3404 sta_opmode.changed = STA_OPMODE_MAX_BW_CHANGED; 3405 3406 rate_control_rate_update(local, sband, rx->sta, 3407 IEEE80211_RC_BW_CHANGED); 3408 cfg80211_sta_opmode_change_notify(sdata->dev, 3409 rx->sta->addr, 3410 &sta_opmode, 3411 GFP_ATOMIC); 3412 goto handled; 3413 } 3414 default: 3415 goto invalid; 3416 } 3417 3418 break; 3419 case WLAN_CATEGORY_PUBLIC: 3420 if (len < IEEE80211_MIN_ACTION_SIZE + 1) 3421 goto invalid; 3422 if (sdata->vif.type != NL80211_IFTYPE_STATION) 3423 break; 3424 if (!rx->sta) 3425 break; 3426 if (!ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid)) 3427 break; 3428 if (mgmt->u.action.u.ext_chan_switch.action_code != 3429 WLAN_PUB_ACTION_EXT_CHANSW_ANN) 3430 break; 3431 if (len < offsetof(struct ieee80211_mgmt, 3432 u.action.u.ext_chan_switch.variable)) 3433 goto invalid; 3434 goto queue; 3435 case WLAN_CATEGORY_VHT: 3436 if (sdata->vif.type != NL80211_IFTYPE_STATION && 3437 sdata->vif.type != NL80211_IFTYPE_MESH_POINT && 3438 sdata->vif.type != NL80211_IFTYPE_AP_VLAN && 3439 sdata->vif.type != NL80211_IFTYPE_AP && 3440 sdata->vif.type != NL80211_IFTYPE_ADHOC) 3441 break; 3442 3443 /* verify action code is present */ 3444 if (len < IEEE80211_MIN_ACTION_SIZE + 1) 3445 goto invalid; 3446 3447 switch (mgmt->u.action.u.vht_opmode_notif.action_code) { 3448 case WLAN_VHT_ACTION_OPMODE_NOTIF: { 3449 /* verify opmode is present */ 3450 if (len < IEEE80211_MIN_ACTION_SIZE + 2) 3451 goto invalid; 3452 goto queue; 3453 } 3454 case WLAN_VHT_ACTION_GROUPID_MGMT: { 3455 if (len < IEEE80211_MIN_ACTION_SIZE + 25) 3456 goto invalid; 3457 goto queue; 3458 } 3459 default: 3460 break; 3461 } 3462 break; 3463 case WLAN_CATEGORY_BACK: 3464 if (sdata->vif.type != NL80211_IFTYPE_STATION && 3465 sdata->vif.type != NL80211_IFTYPE_MESH_POINT && 3466 sdata->vif.type != NL80211_IFTYPE_AP_VLAN && 3467 sdata->vif.type != NL80211_IFTYPE_AP && 3468 sdata->vif.type != NL80211_IFTYPE_ADHOC) 3469 break; 3470 3471 /* verify action_code is present */ 3472 if (len < IEEE80211_MIN_ACTION_SIZE + 1) 3473 break; 3474 3475 switch (mgmt->u.action.u.addba_req.action_code) { 3476 case WLAN_ACTION_ADDBA_REQ: 3477 if (len < (IEEE80211_MIN_ACTION_SIZE + 3478 sizeof(mgmt->u.action.u.addba_req))) 3479 goto invalid; 3480 break; 3481 case WLAN_ACTION_ADDBA_RESP: 3482 if (len < (IEEE80211_MIN_ACTION_SIZE + 3483 sizeof(mgmt->u.action.u.addba_resp))) 3484 goto invalid; 3485 break; 3486 case WLAN_ACTION_DELBA: 3487 if (len < (IEEE80211_MIN_ACTION_SIZE + 3488 sizeof(mgmt->u.action.u.delba))) 3489 goto invalid; 3490 break; 3491 default: 3492 goto invalid; 3493 } 3494 3495 goto queue; 3496 case WLAN_CATEGORY_SPECTRUM_MGMT: 3497 /* verify action_code is present */ 3498 if (len < IEEE80211_MIN_ACTION_SIZE + 1) 3499 break; 3500 3501 switch (mgmt->u.action.u.measurement.action_code) { 3502 case WLAN_ACTION_SPCT_MSR_REQ: 3503 if (status->band != NL80211_BAND_5GHZ) 3504 break; 3505 3506 if (len < (IEEE80211_MIN_ACTION_SIZE + 3507 sizeof(mgmt->u.action.u.measurement))) 3508 break; 3509 3510 if (sdata->vif.type != NL80211_IFTYPE_STATION) 3511 break; 3512 3513 ieee80211_process_measurement_req(sdata, mgmt, len); 3514 goto handled; 3515 case WLAN_ACTION_SPCT_CHL_SWITCH: { 3516 u8 *bssid; 3517 if (len < (IEEE80211_MIN_ACTION_SIZE + 3518 sizeof(mgmt->u.action.u.chan_switch))) 3519 break; 3520 3521 if (sdata->vif.type != NL80211_IFTYPE_STATION && 3522 sdata->vif.type != NL80211_IFTYPE_ADHOC && 3523 sdata->vif.type != NL80211_IFTYPE_MESH_POINT) 3524 break; 3525 3526 if (sdata->vif.type == NL80211_IFTYPE_STATION) 3527 bssid = sdata->u.mgd.bssid; 3528 else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) 3529 bssid = sdata->u.ibss.bssid; 3530 else if (sdata->vif.type == NL80211_IFTYPE_MESH_POINT) 3531 bssid = mgmt->sa; 3532 else 3533 break; 3534 3535 if (!ether_addr_equal(mgmt->bssid, bssid)) 3536 break; 3537 3538 goto queue; 3539 } 3540 } 3541 break; 3542 case WLAN_CATEGORY_SELF_PROTECTED: 3543 if (len < (IEEE80211_MIN_ACTION_SIZE + 3544 sizeof(mgmt->u.action.u.self_prot.action_code))) 3545 break; 3546 3547 switch (mgmt->u.action.u.self_prot.action_code) { 3548 case WLAN_SP_MESH_PEERING_OPEN: 3549 case WLAN_SP_MESH_PEERING_CLOSE: 3550 case WLAN_SP_MESH_PEERING_CONFIRM: 3551 if (!ieee80211_vif_is_mesh(&sdata->vif)) 3552 goto invalid; 3553 if (sdata->u.mesh.user_mpm) 3554 /* userspace handles this frame */ 3555 break; 3556 goto queue; 3557 case WLAN_SP_MGK_INFORM: 3558 case WLAN_SP_MGK_ACK: 3559 if (!ieee80211_vif_is_mesh(&sdata->vif)) 3560 goto invalid; 3561 break; 3562 } 3563 break; 3564 case WLAN_CATEGORY_MESH_ACTION: 3565 if (len < (IEEE80211_MIN_ACTION_SIZE + 3566 sizeof(mgmt->u.action.u.mesh_action.action_code))) 3567 break; 3568 3569 if (!ieee80211_vif_is_mesh(&sdata->vif)) 3570 break; 3571 if (mesh_action_is_path_sel(mgmt) && 3572 !mesh_path_sel_is_hwmp(sdata)) 3573 break; 3574 goto queue; 3575 case WLAN_CATEGORY_S1G: 3576 switch (mgmt->u.action.u.s1g.action_code) { 3577 case WLAN_S1G_TWT_SETUP: 3578 case WLAN_S1G_TWT_TEARDOWN: 3579 if (ieee80211_process_rx_twt_action(rx)) 3580 goto queue; 3581 break; 3582 default: 3583 break; 3584 } 3585 break; 3586 } 3587 3588 return RX_CONTINUE; 3589 3590 invalid: 3591 status->rx_flags |= IEEE80211_RX_MALFORMED_ACTION_FRM; 3592 /* will return in the next handlers */ 3593 return RX_CONTINUE; 3594 3595 handled: 3596 if (rx->sta) 3597 rx->sta->deflink.rx_stats.packets++; 3598 dev_kfree_skb(rx->skb); 3599 return RX_QUEUED; 3600 3601 queue: 3602 ieee80211_queue_skb_to_iface(sdata, rx->sta, rx->skb); 3603 return RX_QUEUED; 3604 } 3605 3606 static ieee80211_rx_result debug_noinline 3607 ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx) 3608 { 3609 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 3610 int sig = 0; 3611 3612 /* skip known-bad action frames and return them in the next handler */ 3613 if (status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) 3614 return RX_CONTINUE; 3615 3616 /* 3617 * Getting here means the kernel doesn't know how to handle 3618 * it, but maybe userspace does ... include returned frames 3619 * so userspace can register for those to know whether ones 3620 * it transmitted were processed or returned. 3621 */ 3622 3623 if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM) && 3624 !(status->flag & RX_FLAG_NO_SIGNAL_VAL)) 3625 sig = status->signal; 3626 3627 if (cfg80211_rx_mgmt_khz(&rx->sdata->wdev, 3628 ieee80211_rx_status_to_khz(status), sig, 3629 rx->skb->data, rx->skb->len, 0)) { 3630 if (rx->sta) 3631 rx->sta->deflink.rx_stats.packets++; 3632 dev_kfree_skb(rx->skb); 3633 return RX_QUEUED; 3634 } 3635 3636 return RX_CONTINUE; 3637 } 3638 3639 static ieee80211_rx_result debug_noinline 3640 ieee80211_rx_h_action_post_userspace(struct ieee80211_rx_data *rx) 3641 { 3642 struct ieee80211_sub_if_data *sdata = rx->sdata; 3643 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data; 3644 int len = rx->skb->len; 3645 3646 if (!ieee80211_is_action(mgmt->frame_control)) 3647 return RX_CONTINUE; 3648 3649 switch (mgmt->u.action.category) { 3650 case WLAN_CATEGORY_SA_QUERY: 3651 if (len < (IEEE80211_MIN_ACTION_SIZE + 3652 sizeof(mgmt->u.action.u.sa_query))) 3653 break; 3654 3655 switch (mgmt->u.action.u.sa_query.action) { 3656 case WLAN_ACTION_SA_QUERY_REQUEST: 3657 if (sdata->vif.type != NL80211_IFTYPE_STATION) 3658 break; 3659 ieee80211_process_sa_query_req(sdata, mgmt, len); 3660 goto handled; 3661 } 3662 break; 3663 } 3664 3665 return RX_CONTINUE; 3666 3667 handled: 3668 if (rx->sta) 3669 rx->sta->deflink.rx_stats.packets++; 3670 dev_kfree_skb(rx->skb); 3671 return RX_QUEUED; 3672 } 3673 3674 static ieee80211_rx_result debug_noinline 3675 ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx) 3676 { 3677 struct ieee80211_local *local = rx->local; 3678 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data; 3679 struct sk_buff *nskb; 3680 struct ieee80211_sub_if_data *sdata = rx->sdata; 3681 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 3682 3683 if (!ieee80211_is_action(mgmt->frame_control)) 3684 return RX_CONTINUE; 3685 3686 /* 3687 * For AP mode, hostapd is responsible for handling any action 3688 * frames that we didn't handle, including returning unknown 3689 * ones. For all other modes we will return them to the sender, 3690 * setting the 0x80 bit in the action category, as required by 3691 * 802.11-2012 9.24.4. 3692 * Newer versions of hostapd shall also use the management frame 3693 * registration mechanisms, but older ones still use cooked 3694 * monitor interfaces so push all frames there. 3695 */ 3696 if (!(status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) && 3697 (sdata->vif.type == NL80211_IFTYPE_AP || 3698 sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) 3699 return RX_DROP_MONITOR; 3700 3701 if (is_multicast_ether_addr(mgmt->da)) 3702 return RX_DROP_MONITOR; 3703 3704 /* do not return rejected action frames */ 3705 if (mgmt->u.action.category & 0x80) 3706 return RX_DROP_UNUSABLE; 3707 3708 nskb = skb_copy_expand(rx->skb, local->hw.extra_tx_headroom, 0, 3709 GFP_ATOMIC); 3710 if (nskb) { 3711 struct ieee80211_mgmt *nmgmt = (void *)nskb->data; 3712 3713 nmgmt->u.action.category |= 0x80; 3714 memcpy(nmgmt->da, nmgmt->sa, ETH_ALEN); 3715 memcpy(nmgmt->sa, rx->sdata->vif.addr, ETH_ALEN); 3716 3717 memset(nskb->cb, 0, sizeof(nskb->cb)); 3718 3719 if (rx->sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) { 3720 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(nskb); 3721 3722 info->flags = IEEE80211_TX_CTL_TX_OFFCHAN | 3723 IEEE80211_TX_INTFL_OFFCHAN_TX_OK | 3724 IEEE80211_TX_CTL_NO_CCK_RATE; 3725 if (ieee80211_hw_check(&local->hw, QUEUE_CONTROL)) 3726 info->hw_queue = 3727 local->hw.offchannel_tx_hw_queue; 3728 } 3729 3730 __ieee80211_tx_skb_tid_band(rx->sdata, nskb, 7, 3731 status->band); 3732 } 3733 dev_kfree_skb(rx->skb); 3734 return RX_QUEUED; 3735 } 3736 3737 static ieee80211_rx_result debug_noinline 3738 ieee80211_rx_h_ext(struct ieee80211_rx_data *rx) 3739 { 3740 struct ieee80211_sub_if_data *sdata = rx->sdata; 3741 struct ieee80211_hdr *hdr = (void *)rx->skb->data; 3742 3743 if (!ieee80211_is_ext(hdr->frame_control)) 3744 return RX_CONTINUE; 3745 3746 if (sdata->vif.type != NL80211_IFTYPE_STATION) 3747 return RX_DROP_MONITOR; 3748 3749 /* for now only beacons are ext, so queue them */ 3750 ieee80211_queue_skb_to_iface(sdata, rx->sta, rx->skb); 3751 3752 return RX_QUEUED; 3753 } 3754 3755 static ieee80211_rx_result debug_noinline 3756 ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx) 3757 { 3758 struct ieee80211_sub_if_data *sdata = rx->sdata; 3759 struct ieee80211_mgmt *mgmt = (void *)rx->skb->data; 3760 __le16 stype; 3761 3762 stype = mgmt->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE); 3763 3764 if (!ieee80211_vif_is_mesh(&sdata->vif) && 3765 sdata->vif.type != NL80211_IFTYPE_ADHOC && 3766 sdata->vif.type != NL80211_IFTYPE_OCB && 3767 sdata->vif.type != NL80211_IFTYPE_STATION) 3768 return RX_DROP_MONITOR; 3769 3770 switch (stype) { 3771 case cpu_to_le16(IEEE80211_STYPE_AUTH): 3772 case cpu_to_le16(IEEE80211_STYPE_BEACON): 3773 case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP): 3774 /* process for all: mesh, mlme, ibss */ 3775 break; 3776 case cpu_to_le16(IEEE80211_STYPE_DEAUTH): 3777 if (is_multicast_ether_addr(mgmt->da) && 3778 !is_broadcast_ether_addr(mgmt->da)) 3779 return RX_DROP_MONITOR; 3780 3781 /* process only for station/IBSS */ 3782 if (sdata->vif.type != NL80211_IFTYPE_STATION && 3783 sdata->vif.type != NL80211_IFTYPE_ADHOC) 3784 return RX_DROP_MONITOR; 3785 break; 3786 case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP): 3787 case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP): 3788 case cpu_to_le16(IEEE80211_STYPE_DISASSOC): 3789 if (is_multicast_ether_addr(mgmt->da) && 3790 !is_broadcast_ether_addr(mgmt->da)) 3791 return RX_DROP_MONITOR; 3792 3793 /* process only for station */ 3794 if (sdata->vif.type != NL80211_IFTYPE_STATION) 3795 return RX_DROP_MONITOR; 3796 break; 3797 case cpu_to_le16(IEEE80211_STYPE_PROBE_REQ): 3798 /* process only for ibss and mesh */ 3799 if (sdata->vif.type != NL80211_IFTYPE_ADHOC && 3800 sdata->vif.type != NL80211_IFTYPE_MESH_POINT) 3801 return RX_DROP_MONITOR; 3802 break; 3803 default: 3804 return RX_DROP_MONITOR; 3805 } 3806 3807 ieee80211_queue_skb_to_iface(sdata, rx->sta, rx->skb); 3808 3809 return RX_QUEUED; 3810 } 3811 3812 static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx, 3813 struct ieee80211_rate *rate) 3814 { 3815 struct ieee80211_sub_if_data *sdata; 3816 struct ieee80211_local *local = rx->local; 3817 struct sk_buff *skb = rx->skb, *skb2; 3818 struct net_device *prev_dev = NULL; 3819 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 3820 int needed_headroom; 3821 3822 /* 3823 * If cooked monitor has been processed already, then 3824 * don't do it again. If not, set the flag. 3825 */ 3826 if (rx->flags & IEEE80211_RX_CMNTR) 3827 goto out_free_skb; 3828 rx->flags |= IEEE80211_RX_CMNTR; 3829 3830 /* If there are no cooked monitor interfaces, just free the SKB */ 3831 if (!local->cooked_mntrs) 3832 goto out_free_skb; 3833 3834 /* vendor data is long removed here */ 3835 status->flag &= ~RX_FLAG_RADIOTAP_VENDOR_DATA; 3836 /* room for the radiotap header based on driver features */ 3837 needed_headroom = ieee80211_rx_radiotap_hdrlen(local, status, skb); 3838 3839 if (skb_headroom(skb) < needed_headroom && 3840 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) 3841 goto out_free_skb; 3842 3843 /* prepend radiotap information */ 3844 ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom, 3845 false); 3846 3847 skb_reset_mac_header(skb); 3848 skb->ip_summed = CHECKSUM_UNNECESSARY; 3849 skb->pkt_type = PACKET_OTHERHOST; 3850 skb->protocol = htons(ETH_P_802_2); 3851 3852 list_for_each_entry_rcu(sdata, &local->interfaces, list) { 3853 if (!ieee80211_sdata_running(sdata)) 3854 continue; 3855 3856 if (sdata->vif.type != NL80211_IFTYPE_MONITOR || 3857 !(sdata->u.mntr.flags & MONITOR_FLAG_COOK_FRAMES)) 3858 continue; 3859 3860 if (prev_dev) { 3861 skb2 = skb_clone(skb, GFP_ATOMIC); 3862 if (skb2) { 3863 skb2->dev = prev_dev; 3864 netif_receive_skb(skb2); 3865 } 3866 } 3867 3868 prev_dev = sdata->dev; 3869 dev_sw_netstats_rx_add(sdata->dev, skb->len); 3870 } 3871 3872 if (prev_dev) { 3873 skb->dev = prev_dev; 3874 netif_receive_skb(skb); 3875 return; 3876 } 3877 3878 out_free_skb: 3879 dev_kfree_skb(skb); 3880 } 3881 3882 static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx, 3883 ieee80211_rx_result res) 3884 { 3885 switch (res) { 3886 case RX_DROP_MONITOR: 3887 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop); 3888 if (rx->sta) 3889 rx->sta->deflink.rx_stats.dropped++; 3890 fallthrough; 3891 case RX_CONTINUE: { 3892 struct ieee80211_rate *rate = NULL; 3893 struct ieee80211_supported_band *sband; 3894 struct ieee80211_rx_status *status; 3895 3896 status = IEEE80211_SKB_RXCB((rx->skb)); 3897 3898 sband = rx->local->hw.wiphy->bands[status->band]; 3899 if (status->encoding == RX_ENC_LEGACY) 3900 rate = &sband->bitrates[status->rate_idx]; 3901 3902 ieee80211_rx_cooked_monitor(rx, rate); 3903 break; 3904 } 3905 case RX_DROP_UNUSABLE: 3906 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop); 3907 if (rx->sta) 3908 rx->sta->deflink.rx_stats.dropped++; 3909 dev_kfree_skb(rx->skb); 3910 break; 3911 case RX_QUEUED: 3912 I802_DEBUG_INC(rx->sdata->local->rx_handlers_queued); 3913 break; 3914 } 3915 } 3916 3917 static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx, 3918 struct sk_buff_head *frames) 3919 { 3920 ieee80211_rx_result res = RX_DROP_MONITOR; 3921 struct sk_buff *skb; 3922 3923 #define CALL_RXH(rxh) \ 3924 do { \ 3925 res = rxh(rx); \ 3926 if (res != RX_CONTINUE) \ 3927 goto rxh_next; \ 3928 } while (0) 3929 3930 /* Lock here to avoid hitting all of the data used in the RX 3931 * path (e.g. key data, station data, ...) concurrently when 3932 * a frame is released from the reorder buffer due to timeout 3933 * from the timer, potentially concurrently with RX from the 3934 * driver. 3935 */ 3936 spin_lock_bh(&rx->local->rx_path_lock); 3937 3938 while ((skb = __skb_dequeue(frames))) { 3939 /* 3940 * all the other fields are valid across frames 3941 * that belong to an aMPDU since they are on the 3942 * same TID from the same station 3943 */ 3944 rx->skb = skb; 3945 3946 CALL_RXH(ieee80211_rx_h_check_more_data); 3947 CALL_RXH(ieee80211_rx_h_uapsd_and_pspoll); 3948 CALL_RXH(ieee80211_rx_h_sta_process); 3949 CALL_RXH(ieee80211_rx_h_decrypt); 3950 CALL_RXH(ieee80211_rx_h_defragment); 3951 CALL_RXH(ieee80211_rx_h_michael_mic_verify); 3952 /* must be after MMIC verify so header is counted in MPDU mic */ 3953 #ifdef CONFIG_MAC80211_MESH 3954 if (ieee80211_vif_is_mesh(&rx->sdata->vif)) 3955 CALL_RXH(ieee80211_rx_h_mesh_fwding); 3956 #endif 3957 CALL_RXH(ieee80211_rx_h_amsdu); 3958 CALL_RXH(ieee80211_rx_h_data); 3959 3960 /* special treatment -- needs the queue */ 3961 res = ieee80211_rx_h_ctrl(rx, frames); 3962 if (res != RX_CONTINUE) 3963 goto rxh_next; 3964 3965 CALL_RXH(ieee80211_rx_h_mgmt_check); 3966 CALL_RXH(ieee80211_rx_h_action); 3967 CALL_RXH(ieee80211_rx_h_userspace_mgmt); 3968 CALL_RXH(ieee80211_rx_h_action_post_userspace); 3969 CALL_RXH(ieee80211_rx_h_action_return); 3970 CALL_RXH(ieee80211_rx_h_ext); 3971 CALL_RXH(ieee80211_rx_h_mgmt); 3972 3973 rxh_next: 3974 ieee80211_rx_handlers_result(rx, res); 3975 3976 #undef CALL_RXH 3977 } 3978 3979 spin_unlock_bh(&rx->local->rx_path_lock); 3980 } 3981 3982 static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx) 3983 { 3984 struct sk_buff_head reorder_release; 3985 ieee80211_rx_result res = RX_DROP_MONITOR; 3986 3987 __skb_queue_head_init(&reorder_release); 3988 3989 #define CALL_RXH(rxh) \ 3990 do { \ 3991 res = rxh(rx); \ 3992 if (res != RX_CONTINUE) \ 3993 goto rxh_next; \ 3994 } while (0) 3995 3996 CALL_RXH(ieee80211_rx_h_check_dup); 3997 CALL_RXH(ieee80211_rx_h_check); 3998 3999 ieee80211_rx_reorder_ampdu(rx, &reorder_release); 4000 4001 ieee80211_rx_handlers(rx, &reorder_release); 4002 return; 4003 4004 rxh_next: 4005 ieee80211_rx_handlers_result(rx, res); 4006 4007 #undef CALL_RXH 4008 } 4009 4010 /* 4011 * This function makes calls into the RX path, therefore 4012 * it has to be invoked under RCU read lock. 4013 */ 4014 void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid) 4015 { 4016 struct sk_buff_head frames; 4017 struct ieee80211_rx_data rx = { 4018 .sta = sta, 4019 .sdata = sta->sdata, 4020 .local = sta->local, 4021 /* This is OK -- must be QoS data frame */ 4022 .security_idx = tid, 4023 .seqno_idx = tid, 4024 }; 4025 struct tid_ampdu_rx *tid_agg_rx; 4026 4027 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]); 4028 if (!tid_agg_rx) 4029 return; 4030 4031 __skb_queue_head_init(&frames); 4032 4033 spin_lock(&tid_agg_rx->reorder_lock); 4034 ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames); 4035 spin_unlock(&tid_agg_rx->reorder_lock); 4036 4037 if (!skb_queue_empty(&frames)) { 4038 struct ieee80211_event event = { 4039 .type = BA_FRAME_TIMEOUT, 4040 .u.ba.tid = tid, 4041 .u.ba.sta = &sta->sta, 4042 }; 4043 drv_event_callback(rx.local, rx.sdata, &event); 4044 } 4045 4046 ieee80211_rx_handlers(&rx, &frames); 4047 } 4048 4049 void ieee80211_mark_rx_ba_filtered_frames(struct ieee80211_sta *pubsta, u8 tid, 4050 u16 ssn, u64 filtered, 4051 u16 received_mpdus) 4052 { 4053 struct sta_info *sta; 4054 struct tid_ampdu_rx *tid_agg_rx; 4055 struct sk_buff_head frames; 4056 struct ieee80211_rx_data rx = { 4057 /* This is OK -- must be QoS data frame */ 4058 .security_idx = tid, 4059 .seqno_idx = tid, 4060 }; 4061 int i, diff; 4062 4063 if (WARN_ON(!pubsta || tid >= IEEE80211_NUM_TIDS)) 4064 return; 4065 4066 __skb_queue_head_init(&frames); 4067 4068 sta = container_of(pubsta, struct sta_info, sta); 4069 4070 rx.sta = sta; 4071 rx.sdata = sta->sdata; 4072 rx.local = sta->local; 4073 4074 rcu_read_lock(); 4075 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]); 4076 if (!tid_agg_rx) 4077 goto out; 4078 4079 spin_lock_bh(&tid_agg_rx->reorder_lock); 4080 4081 if (received_mpdus >= IEEE80211_SN_MODULO >> 1) { 4082 int release; 4083 4084 /* release all frames in the reorder buffer */ 4085 release = (tid_agg_rx->head_seq_num + tid_agg_rx->buf_size) % 4086 IEEE80211_SN_MODULO; 4087 ieee80211_release_reorder_frames(sta->sdata, tid_agg_rx, 4088 release, &frames); 4089 /* update ssn to match received ssn */ 4090 tid_agg_rx->head_seq_num = ssn; 4091 } else { 4092 ieee80211_release_reorder_frames(sta->sdata, tid_agg_rx, ssn, 4093 &frames); 4094 } 4095 4096 /* handle the case that received ssn is behind the mac ssn. 4097 * it can be tid_agg_rx->buf_size behind and still be valid */ 4098 diff = (tid_agg_rx->head_seq_num - ssn) & IEEE80211_SN_MASK; 4099 if (diff >= tid_agg_rx->buf_size) { 4100 tid_agg_rx->reorder_buf_filtered = 0; 4101 goto release; 4102 } 4103 filtered = filtered >> diff; 4104 ssn += diff; 4105 4106 /* update bitmap */ 4107 for (i = 0; i < tid_agg_rx->buf_size; i++) { 4108 int index = (ssn + i) % tid_agg_rx->buf_size; 4109 4110 tid_agg_rx->reorder_buf_filtered &= ~BIT_ULL(index); 4111 if (filtered & BIT_ULL(i)) 4112 tid_agg_rx->reorder_buf_filtered |= BIT_ULL(index); 4113 } 4114 4115 /* now process also frames that the filter marking released */ 4116 ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames); 4117 4118 release: 4119 spin_unlock_bh(&tid_agg_rx->reorder_lock); 4120 4121 ieee80211_rx_handlers(&rx, &frames); 4122 4123 out: 4124 rcu_read_unlock(); 4125 } 4126 EXPORT_SYMBOL(ieee80211_mark_rx_ba_filtered_frames); 4127 4128 /* main receive path */ 4129 4130 static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx) 4131 { 4132 struct ieee80211_sub_if_data *sdata = rx->sdata; 4133 struct sk_buff *skb = rx->skb; 4134 struct ieee80211_hdr *hdr = (void *)skb->data; 4135 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 4136 u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type); 4137 bool multicast = is_multicast_ether_addr(hdr->addr1) || 4138 ieee80211_is_s1g_beacon(hdr->frame_control); 4139 4140 switch (sdata->vif.type) { 4141 case NL80211_IFTYPE_STATION: 4142 if (!bssid && !sdata->u.mgd.use_4addr) 4143 return false; 4144 if (ieee80211_is_robust_mgmt_frame(skb) && !rx->sta) 4145 return false; 4146 if (multicast) 4147 return true; 4148 return ether_addr_equal(sdata->vif.addr, hdr->addr1); 4149 case NL80211_IFTYPE_ADHOC: 4150 if (!bssid) 4151 return false; 4152 if (ether_addr_equal(sdata->vif.addr, hdr->addr2) || 4153 ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2) || 4154 !is_valid_ether_addr(hdr->addr2)) 4155 return false; 4156 if (ieee80211_is_beacon(hdr->frame_control)) 4157 return true; 4158 if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid)) 4159 return false; 4160 if (!multicast && 4161 !ether_addr_equal(sdata->vif.addr, hdr->addr1)) 4162 return false; 4163 if (!rx->sta) { 4164 int rate_idx; 4165 if (status->encoding != RX_ENC_LEGACY) 4166 rate_idx = 0; /* TODO: HT/VHT rates */ 4167 else 4168 rate_idx = status->rate_idx; 4169 ieee80211_ibss_rx_no_sta(sdata, bssid, hdr->addr2, 4170 BIT(rate_idx)); 4171 } 4172 return true; 4173 case NL80211_IFTYPE_OCB: 4174 if (!bssid) 4175 return false; 4176 if (!ieee80211_is_data_present(hdr->frame_control)) 4177 return false; 4178 if (!is_broadcast_ether_addr(bssid)) 4179 return false; 4180 if (!multicast && 4181 !ether_addr_equal(sdata->dev->dev_addr, hdr->addr1)) 4182 return false; 4183 if (!rx->sta) { 4184 int rate_idx; 4185 if (status->encoding != RX_ENC_LEGACY) 4186 rate_idx = 0; /* TODO: HT rates */ 4187 else 4188 rate_idx = status->rate_idx; 4189 ieee80211_ocb_rx_no_sta(sdata, bssid, hdr->addr2, 4190 BIT(rate_idx)); 4191 } 4192 return true; 4193 case NL80211_IFTYPE_MESH_POINT: 4194 if (ether_addr_equal(sdata->vif.addr, hdr->addr2)) 4195 return false; 4196 if (multicast) 4197 return true; 4198 return ether_addr_equal(sdata->vif.addr, hdr->addr1); 4199 case NL80211_IFTYPE_AP_VLAN: 4200 case NL80211_IFTYPE_AP: 4201 if (!bssid) 4202 return ether_addr_equal(sdata->vif.addr, hdr->addr1); 4203 4204 if (!ieee80211_bssid_match(bssid, sdata->vif.addr)) { 4205 /* 4206 * Accept public action frames even when the 4207 * BSSID doesn't match, this is used for P2P 4208 * and location updates. Note that mac80211 4209 * itself never looks at these frames. 4210 */ 4211 if (!multicast && 4212 !ether_addr_equal(sdata->vif.addr, hdr->addr1)) 4213 return false; 4214 if (ieee80211_is_public_action(hdr, skb->len)) 4215 return true; 4216 return ieee80211_is_beacon(hdr->frame_control); 4217 } 4218 4219 if (!ieee80211_has_tods(hdr->frame_control)) { 4220 /* ignore data frames to TDLS-peers */ 4221 if (ieee80211_is_data(hdr->frame_control)) 4222 return false; 4223 /* ignore action frames to TDLS-peers */ 4224 if (ieee80211_is_action(hdr->frame_control) && 4225 !is_broadcast_ether_addr(bssid) && 4226 !ether_addr_equal(bssid, hdr->addr1)) 4227 return false; 4228 } 4229 4230 /* 4231 * 802.11-2016 Table 9-26 says that for data frames, A1 must be 4232 * the BSSID - we've checked that already but may have accepted 4233 * the wildcard (ff:ff:ff:ff:ff:ff). 4234 * 4235 * It also says: 4236 * The BSSID of the Data frame is determined as follows: 4237 * a) If the STA is contained within an AP or is associated 4238 * with an AP, the BSSID is the address currently in use 4239 * by the STA contained in the AP. 4240 * 4241 * So we should not accept data frames with an address that's 4242 * multicast. 4243 * 4244 * Accepting it also opens a security problem because stations 4245 * could encrypt it with the GTK and inject traffic that way. 4246 */ 4247 if (ieee80211_is_data(hdr->frame_control) && multicast) 4248 return false; 4249 4250 return true; 4251 case NL80211_IFTYPE_P2P_DEVICE: 4252 return ieee80211_is_public_action(hdr, skb->len) || 4253 ieee80211_is_probe_req(hdr->frame_control) || 4254 ieee80211_is_probe_resp(hdr->frame_control) || 4255 ieee80211_is_beacon(hdr->frame_control); 4256 case NL80211_IFTYPE_NAN: 4257 /* Currently no frames on NAN interface are allowed */ 4258 return false; 4259 default: 4260 break; 4261 } 4262 4263 WARN_ON_ONCE(1); 4264 return false; 4265 } 4266 4267 void ieee80211_check_fast_rx(struct sta_info *sta) 4268 { 4269 struct ieee80211_sub_if_data *sdata = sta->sdata; 4270 struct ieee80211_local *local = sdata->local; 4271 struct ieee80211_key *key; 4272 struct ieee80211_fast_rx fastrx = { 4273 .dev = sdata->dev, 4274 .vif_type = sdata->vif.type, 4275 .control_port_protocol = sdata->control_port_protocol, 4276 }, *old, *new = NULL; 4277 bool set_offload = false; 4278 bool assign = false; 4279 bool offload; 4280 4281 /* use sparse to check that we don't return without updating */ 4282 __acquire(check_fast_rx); 4283 4284 BUILD_BUG_ON(sizeof(fastrx.rfc1042_hdr) != sizeof(rfc1042_header)); 4285 BUILD_BUG_ON(sizeof(fastrx.rfc1042_hdr) != ETH_ALEN); 4286 ether_addr_copy(fastrx.rfc1042_hdr, rfc1042_header); 4287 ether_addr_copy(fastrx.vif_addr, sdata->vif.addr); 4288 4289 fastrx.uses_rss = ieee80211_hw_check(&local->hw, USES_RSS); 4290 4291 /* fast-rx doesn't do reordering */ 4292 if (ieee80211_hw_check(&local->hw, AMPDU_AGGREGATION) && 4293 !ieee80211_hw_check(&local->hw, SUPPORTS_REORDERING_BUFFER)) 4294 goto clear; 4295 4296 switch (sdata->vif.type) { 4297 case NL80211_IFTYPE_STATION: 4298 if (sta->sta.tdls) { 4299 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr1); 4300 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr2); 4301 fastrx.expected_ds_bits = 0; 4302 } else { 4303 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr1); 4304 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr3); 4305 fastrx.expected_ds_bits = 4306 cpu_to_le16(IEEE80211_FCTL_FROMDS); 4307 } 4308 4309 if (sdata->u.mgd.use_4addr && !sta->sta.tdls) { 4310 fastrx.expected_ds_bits |= 4311 cpu_to_le16(IEEE80211_FCTL_TODS); 4312 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3); 4313 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr4); 4314 } 4315 4316 if (!sdata->u.mgd.powersave) 4317 break; 4318 4319 /* software powersave is a huge mess, avoid all of it */ 4320 if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK)) 4321 goto clear; 4322 if (ieee80211_hw_check(&local->hw, SUPPORTS_PS) && 4323 !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS)) 4324 goto clear; 4325 break; 4326 case NL80211_IFTYPE_AP_VLAN: 4327 case NL80211_IFTYPE_AP: 4328 /* parallel-rx requires this, at least with calls to 4329 * ieee80211_sta_ps_transition() 4330 */ 4331 if (!ieee80211_hw_check(&local->hw, AP_LINK_PS)) 4332 goto clear; 4333 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3); 4334 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr2); 4335 fastrx.expected_ds_bits = cpu_to_le16(IEEE80211_FCTL_TODS); 4336 4337 fastrx.internal_forward = 4338 !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) && 4339 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || 4340 !sdata->u.vlan.sta); 4341 4342 if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN && 4343 sdata->u.vlan.sta) { 4344 fastrx.expected_ds_bits |= 4345 cpu_to_le16(IEEE80211_FCTL_FROMDS); 4346 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr4); 4347 fastrx.internal_forward = 0; 4348 } 4349 4350 break; 4351 default: 4352 goto clear; 4353 } 4354 4355 if (!test_sta_flag(sta, WLAN_STA_AUTHORIZED)) 4356 goto clear; 4357 4358 rcu_read_lock(); 4359 key = rcu_dereference(sta->ptk[sta->ptk_idx]); 4360 if (!key) 4361 key = rcu_dereference(sdata->default_unicast_key); 4362 if (key) { 4363 switch (key->conf.cipher) { 4364 case WLAN_CIPHER_SUITE_TKIP: 4365 /* we don't want to deal with MMIC in fast-rx */ 4366 goto clear_rcu; 4367 case WLAN_CIPHER_SUITE_CCMP: 4368 case WLAN_CIPHER_SUITE_CCMP_256: 4369 case WLAN_CIPHER_SUITE_GCMP: 4370 case WLAN_CIPHER_SUITE_GCMP_256: 4371 break; 4372 default: 4373 /* We also don't want to deal with 4374 * WEP or cipher scheme. 4375 */ 4376 goto clear_rcu; 4377 } 4378 4379 fastrx.key = true; 4380 fastrx.icv_len = key->conf.icv_len; 4381 } 4382 4383 assign = true; 4384 clear_rcu: 4385 rcu_read_unlock(); 4386 clear: 4387 __release(check_fast_rx); 4388 4389 if (assign) 4390 new = kmemdup(&fastrx, sizeof(fastrx), GFP_KERNEL); 4391 4392 offload = assign && 4393 (sdata->vif.offload_flags & IEEE80211_OFFLOAD_DECAP_ENABLED); 4394 4395 if (offload) 4396 set_offload = !test_and_set_sta_flag(sta, WLAN_STA_DECAP_OFFLOAD); 4397 else 4398 set_offload = test_and_clear_sta_flag(sta, WLAN_STA_DECAP_OFFLOAD); 4399 4400 if (set_offload) 4401 drv_sta_set_decap_offload(local, sdata, &sta->sta, assign); 4402 4403 spin_lock_bh(&sta->lock); 4404 old = rcu_dereference_protected(sta->fast_rx, true); 4405 rcu_assign_pointer(sta->fast_rx, new); 4406 spin_unlock_bh(&sta->lock); 4407 4408 if (old) 4409 kfree_rcu(old, rcu_head); 4410 } 4411 4412 void ieee80211_clear_fast_rx(struct sta_info *sta) 4413 { 4414 struct ieee80211_fast_rx *old; 4415 4416 spin_lock_bh(&sta->lock); 4417 old = rcu_dereference_protected(sta->fast_rx, true); 4418 RCU_INIT_POINTER(sta->fast_rx, NULL); 4419 spin_unlock_bh(&sta->lock); 4420 4421 if (old) 4422 kfree_rcu(old, rcu_head); 4423 } 4424 4425 void __ieee80211_check_fast_rx_iface(struct ieee80211_sub_if_data *sdata) 4426 { 4427 struct ieee80211_local *local = sdata->local; 4428 struct sta_info *sta; 4429 4430 lockdep_assert_held(&local->sta_mtx); 4431 4432 list_for_each_entry(sta, &local->sta_list, list) { 4433 if (sdata != sta->sdata && 4434 (!sta->sdata->bss || sta->sdata->bss != sdata->bss)) 4435 continue; 4436 ieee80211_check_fast_rx(sta); 4437 } 4438 } 4439 4440 void ieee80211_check_fast_rx_iface(struct ieee80211_sub_if_data *sdata) 4441 { 4442 struct ieee80211_local *local = sdata->local; 4443 4444 mutex_lock(&local->sta_mtx); 4445 __ieee80211_check_fast_rx_iface(sdata); 4446 mutex_unlock(&local->sta_mtx); 4447 } 4448 4449 static void ieee80211_rx_8023(struct ieee80211_rx_data *rx, 4450 struct ieee80211_fast_rx *fast_rx, 4451 int orig_len) 4452 { 4453 struct ieee80211_sta_rx_stats *stats; 4454 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 4455 struct sta_info *sta = rx->sta; 4456 struct sk_buff *skb = rx->skb; 4457 void *sa = skb->data + ETH_ALEN; 4458 void *da = skb->data; 4459 4460 stats = &sta->deflink.rx_stats; 4461 if (fast_rx->uses_rss) 4462 stats = this_cpu_ptr(sta->deflink.pcpu_rx_stats); 4463 4464 /* statistics part of ieee80211_rx_h_sta_process() */ 4465 if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) { 4466 stats->last_signal = status->signal; 4467 if (!fast_rx->uses_rss) 4468 ewma_signal_add(&sta->deflink.rx_stats_avg.signal, 4469 -status->signal); 4470 } 4471 4472 if (status->chains) { 4473 int i; 4474 4475 stats->chains = status->chains; 4476 for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) { 4477 int signal = status->chain_signal[i]; 4478 4479 if (!(status->chains & BIT(i))) 4480 continue; 4481 4482 stats->chain_signal_last[i] = signal; 4483 if (!fast_rx->uses_rss) 4484 ewma_signal_add(&sta->deflink.rx_stats_avg.chain_signal[i], 4485 -signal); 4486 } 4487 } 4488 /* end of statistics */ 4489 4490 stats->last_rx = jiffies; 4491 stats->last_rate = sta_stats_encode_rate(status); 4492 4493 stats->fragments++; 4494 stats->packets++; 4495 4496 skb->dev = fast_rx->dev; 4497 4498 dev_sw_netstats_rx_add(fast_rx->dev, skb->len); 4499 4500 /* The seqno index has the same property as needed 4501 * for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS 4502 * for non-QoS-data frames. Here we know it's a data 4503 * frame, so count MSDUs. 4504 */ 4505 u64_stats_update_begin(&stats->syncp); 4506 stats->msdu[rx->seqno_idx]++; 4507 stats->bytes += orig_len; 4508 u64_stats_update_end(&stats->syncp); 4509 4510 if (fast_rx->internal_forward) { 4511 struct sk_buff *xmit_skb = NULL; 4512 if (is_multicast_ether_addr(da)) { 4513 xmit_skb = skb_copy(skb, GFP_ATOMIC); 4514 } else if (!ether_addr_equal(da, sa) && 4515 sta_info_get(rx->sdata, da)) { 4516 xmit_skb = skb; 4517 skb = NULL; 4518 } 4519 4520 if (xmit_skb) { 4521 /* 4522 * Send to wireless media and increase priority by 256 4523 * to keep the received priority instead of 4524 * reclassifying the frame (see cfg80211_classify8021d). 4525 */ 4526 xmit_skb->priority += 256; 4527 xmit_skb->protocol = htons(ETH_P_802_3); 4528 skb_reset_network_header(xmit_skb); 4529 skb_reset_mac_header(xmit_skb); 4530 dev_queue_xmit(xmit_skb); 4531 } 4532 4533 if (!skb) 4534 return; 4535 } 4536 4537 /* deliver to local stack */ 4538 skb->protocol = eth_type_trans(skb, fast_rx->dev); 4539 ieee80211_deliver_skb_to_local_stack(skb, rx); 4540 } 4541 4542 static bool ieee80211_invoke_fast_rx(struct ieee80211_rx_data *rx, 4543 struct ieee80211_fast_rx *fast_rx) 4544 { 4545 struct sk_buff *skb = rx->skb; 4546 struct ieee80211_hdr *hdr = (void *)skb->data; 4547 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 4548 struct sta_info *sta = rx->sta; 4549 int orig_len = skb->len; 4550 int hdrlen = ieee80211_hdrlen(hdr->frame_control); 4551 int snap_offs = hdrlen; 4552 struct { 4553 u8 snap[sizeof(rfc1042_header)]; 4554 __be16 proto; 4555 } *payload __aligned(2); 4556 struct { 4557 u8 da[ETH_ALEN]; 4558 u8 sa[ETH_ALEN]; 4559 } addrs __aligned(2); 4560 struct ieee80211_sta_rx_stats *stats = &sta->deflink.rx_stats; 4561 4562 /* for parallel-rx, we need to have DUP_VALIDATED, otherwise we write 4563 * to a common data structure; drivers can implement that per queue 4564 * but we don't have that information in mac80211 4565 */ 4566 if (!(status->flag & RX_FLAG_DUP_VALIDATED)) 4567 return false; 4568 4569 #define FAST_RX_CRYPT_FLAGS (RX_FLAG_PN_VALIDATED | RX_FLAG_DECRYPTED) 4570 4571 /* If using encryption, we also need to have: 4572 * - PN_VALIDATED: similar, but the implementation is tricky 4573 * - DECRYPTED: necessary for PN_VALIDATED 4574 */ 4575 if (fast_rx->key && 4576 (status->flag & FAST_RX_CRYPT_FLAGS) != FAST_RX_CRYPT_FLAGS) 4577 return false; 4578 4579 if (unlikely(!ieee80211_is_data_present(hdr->frame_control))) 4580 return false; 4581 4582 if (unlikely(ieee80211_is_frag(hdr))) 4583 return false; 4584 4585 /* Since our interface address cannot be multicast, this 4586 * implicitly also rejects multicast frames without the 4587 * explicit check. 4588 * 4589 * We shouldn't get any *data* frames not addressed to us 4590 * (AP mode will accept multicast *management* frames), but 4591 * punting here will make it go through the full checks in 4592 * ieee80211_accept_frame(). 4593 */ 4594 if (!ether_addr_equal(fast_rx->vif_addr, hdr->addr1)) 4595 return false; 4596 4597 if ((hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_FROMDS | 4598 IEEE80211_FCTL_TODS)) != 4599 fast_rx->expected_ds_bits) 4600 return false; 4601 4602 /* assign the key to drop unencrypted frames (later) 4603 * and strip the IV/MIC if necessary 4604 */ 4605 if (fast_rx->key && !(status->flag & RX_FLAG_IV_STRIPPED)) { 4606 /* GCMP header length is the same */ 4607 snap_offs += IEEE80211_CCMP_HDR_LEN; 4608 } 4609 4610 if (!(status->rx_flags & IEEE80211_RX_AMSDU)) { 4611 if (!pskb_may_pull(skb, snap_offs + sizeof(*payload))) 4612 goto drop; 4613 4614 payload = (void *)(skb->data + snap_offs); 4615 4616 if (!ether_addr_equal(payload->snap, fast_rx->rfc1042_hdr)) 4617 return false; 4618 4619 /* Don't handle these here since they require special code. 4620 * Accept AARP and IPX even though they should come with a 4621 * bridge-tunnel header - but if we get them this way then 4622 * there's little point in discarding them. 4623 */ 4624 if (unlikely(payload->proto == cpu_to_be16(ETH_P_TDLS) || 4625 payload->proto == fast_rx->control_port_protocol)) 4626 return false; 4627 } 4628 4629 /* after this point, don't punt to the slowpath! */ 4630 4631 if (rx->key && !(status->flag & RX_FLAG_MIC_STRIPPED) && 4632 pskb_trim(skb, skb->len - fast_rx->icv_len)) 4633 goto drop; 4634 4635 if (rx->key && !ieee80211_has_protected(hdr->frame_control)) 4636 goto drop; 4637 4638 if (status->rx_flags & IEEE80211_RX_AMSDU) { 4639 if (__ieee80211_rx_h_amsdu(rx, snap_offs - hdrlen) != 4640 RX_QUEUED) 4641 goto drop; 4642 4643 return true; 4644 } 4645 4646 /* do the header conversion - first grab the addresses */ 4647 ether_addr_copy(addrs.da, skb->data + fast_rx->da_offs); 4648 ether_addr_copy(addrs.sa, skb->data + fast_rx->sa_offs); 4649 skb_postpull_rcsum(skb, skb->data + snap_offs, 4650 sizeof(rfc1042_header) + 2); 4651 /* remove the SNAP but leave the ethertype */ 4652 skb_pull(skb, snap_offs + sizeof(rfc1042_header)); 4653 /* push the addresses in front */ 4654 memcpy(skb_push(skb, sizeof(addrs)), &addrs, sizeof(addrs)); 4655 4656 ieee80211_rx_8023(rx, fast_rx, orig_len); 4657 4658 return true; 4659 drop: 4660 dev_kfree_skb(skb); 4661 if (fast_rx->uses_rss) 4662 stats = this_cpu_ptr(sta->deflink.pcpu_rx_stats); 4663 4664 stats->dropped++; 4665 return true; 4666 } 4667 4668 /* 4669 * This function returns whether or not the SKB 4670 * was destined for RX processing or not, which, 4671 * if consume is true, is equivalent to whether 4672 * or not the skb was consumed. 4673 */ 4674 static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx, 4675 struct sk_buff *skb, bool consume) 4676 { 4677 struct ieee80211_local *local = rx->local; 4678 struct ieee80211_sub_if_data *sdata = rx->sdata; 4679 4680 rx->skb = skb; 4681 4682 /* See if we can do fast-rx; if we have to copy we already lost, 4683 * so punt in that case. We should never have to deliver a data 4684 * frame to multiple interfaces anyway. 4685 * 4686 * We skip the ieee80211_accept_frame() call and do the necessary 4687 * checking inside ieee80211_invoke_fast_rx(). 4688 */ 4689 if (consume && rx->sta) { 4690 struct ieee80211_fast_rx *fast_rx; 4691 4692 fast_rx = rcu_dereference(rx->sta->fast_rx); 4693 if (fast_rx && ieee80211_invoke_fast_rx(rx, fast_rx)) 4694 return true; 4695 } 4696 4697 if (!ieee80211_accept_frame(rx)) 4698 return false; 4699 4700 if (!consume) { 4701 skb = skb_copy(skb, GFP_ATOMIC); 4702 if (!skb) { 4703 if (net_ratelimit()) 4704 wiphy_debug(local->hw.wiphy, 4705 "failed to copy skb for %s\n", 4706 sdata->name); 4707 return true; 4708 } 4709 4710 rx->skb = skb; 4711 } 4712 4713 ieee80211_invoke_rx_handlers(rx); 4714 return true; 4715 } 4716 4717 static void __ieee80211_rx_handle_8023(struct ieee80211_hw *hw, 4718 struct ieee80211_sta *pubsta, 4719 struct sk_buff *skb, 4720 struct list_head *list) 4721 { 4722 struct ieee80211_local *local = hw_to_local(hw); 4723 struct ieee80211_fast_rx *fast_rx; 4724 struct ieee80211_rx_data rx; 4725 4726 memset(&rx, 0, sizeof(rx)); 4727 rx.skb = skb; 4728 rx.local = local; 4729 rx.list = list; 4730 4731 I802_DEBUG_INC(local->dot11ReceivedFragmentCount); 4732 4733 /* drop frame if too short for header */ 4734 if (skb->len < sizeof(struct ethhdr)) 4735 goto drop; 4736 4737 if (!pubsta) 4738 goto drop; 4739 4740 rx.sta = container_of(pubsta, struct sta_info, sta); 4741 rx.sdata = rx.sta->sdata; 4742 4743 fast_rx = rcu_dereference(rx.sta->fast_rx); 4744 if (!fast_rx) 4745 goto drop; 4746 4747 ieee80211_rx_8023(&rx, fast_rx, skb->len); 4748 return; 4749 4750 drop: 4751 dev_kfree_skb(skb); 4752 } 4753 4754 /* 4755 * This is the actual Rx frames handler. as it belongs to Rx path it must 4756 * be called with rcu_read_lock protection. 4757 */ 4758 static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, 4759 struct ieee80211_sta *pubsta, 4760 struct sk_buff *skb, 4761 struct list_head *list) 4762 { 4763 struct ieee80211_local *local = hw_to_local(hw); 4764 struct ieee80211_sub_if_data *sdata; 4765 struct ieee80211_hdr *hdr; 4766 __le16 fc; 4767 struct ieee80211_rx_data rx; 4768 struct ieee80211_sub_if_data *prev; 4769 struct rhlist_head *tmp; 4770 int err = 0; 4771 4772 fc = ((struct ieee80211_hdr *)skb->data)->frame_control; 4773 memset(&rx, 0, sizeof(rx)); 4774 rx.skb = skb; 4775 rx.local = local; 4776 rx.list = list; 4777 4778 if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc)) 4779 I802_DEBUG_INC(local->dot11ReceivedFragmentCount); 4780 4781 if (ieee80211_is_mgmt(fc)) { 4782 /* drop frame if too short for header */ 4783 if (skb->len < ieee80211_hdrlen(fc)) 4784 err = -ENOBUFS; 4785 else 4786 err = skb_linearize(skb); 4787 } else { 4788 err = !pskb_may_pull(skb, ieee80211_hdrlen(fc)); 4789 } 4790 4791 if (err) { 4792 dev_kfree_skb(skb); 4793 return; 4794 } 4795 4796 hdr = (struct ieee80211_hdr *)skb->data; 4797 ieee80211_parse_qos(&rx); 4798 ieee80211_verify_alignment(&rx); 4799 4800 if (unlikely(ieee80211_is_probe_resp(hdr->frame_control) || 4801 ieee80211_is_beacon(hdr->frame_control) || 4802 ieee80211_is_s1g_beacon(hdr->frame_control))) 4803 ieee80211_scan_rx(local, skb); 4804 4805 if (ieee80211_is_data(fc)) { 4806 struct sta_info *sta, *prev_sta; 4807 4808 if (pubsta) { 4809 rx.sta = container_of(pubsta, struct sta_info, sta); 4810 rx.sdata = rx.sta->sdata; 4811 if (ieee80211_prepare_and_rx_handle(&rx, skb, true)) 4812 return; 4813 goto out; 4814 } 4815 4816 prev_sta = NULL; 4817 4818 for_each_sta_info(local, hdr->addr2, sta, tmp) { 4819 if (!prev_sta) { 4820 prev_sta = sta; 4821 continue; 4822 } 4823 4824 rx.sta = prev_sta; 4825 rx.sdata = prev_sta->sdata; 4826 ieee80211_prepare_and_rx_handle(&rx, skb, false); 4827 4828 prev_sta = sta; 4829 } 4830 4831 if (prev_sta) { 4832 rx.sta = prev_sta; 4833 rx.sdata = prev_sta->sdata; 4834 4835 if (ieee80211_prepare_and_rx_handle(&rx, skb, true)) 4836 return; 4837 goto out; 4838 } 4839 } 4840 4841 prev = NULL; 4842 4843 list_for_each_entry_rcu(sdata, &local->interfaces, list) { 4844 if (!ieee80211_sdata_running(sdata)) 4845 continue; 4846 4847 if (sdata->vif.type == NL80211_IFTYPE_MONITOR || 4848 sdata->vif.type == NL80211_IFTYPE_AP_VLAN) 4849 continue; 4850 4851 /* 4852 * frame is destined for this interface, but if it's 4853 * not also for the previous one we handle that after 4854 * the loop to avoid copying the SKB once too much 4855 */ 4856 4857 if (!prev) { 4858 prev = sdata; 4859 continue; 4860 } 4861 4862 rx.sta = sta_info_get_bss(prev, hdr->addr2); 4863 rx.sdata = prev; 4864 ieee80211_prepare_and_rx_handle(&rx, skb, false); 4865 4866 prev = sdata; 4867 } 4868 4869 if (prev) { 4870 rx.sta = sta_info_get_bss(prev, hdr->addr2); 4871 rx.sdata = prev; 4872 4873 if (ieee80211_prepare_and_rx_handle(&rx, skb, true)) 4874 return; 4875 } 4876 4877 out: 4878 dev_kfree_skb(skb); 4879 } 4880 4881 /* 4882 * This is the receive path handler. It is called by a low level driver when an 4883 * 802.11 MPDU is received from the hardware. 4884 */ 4885 void ieee80211_rx_list(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta, 4886 struct sk_buff *skb, struct list_head *list) 4887 { 4888 struct ieee80211_local *local = hw_to_local(hw); 4889 struct ieee80211_rate *rate = NULL; 4890 struct ieee80211_supported_band *sband; 4891 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 4892 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; 4893 4894 WARN_ON_ONCE(softirq_count() == 0); 4895 4896 if (WARN_ON(status->band >= NUM_NL80211_BANDS)) 4897 goto drop; 4898 4899 sband = local->hw.wiphy->bands[status->band]; 4900 if (WARN_ON(!sband)) 4901 goto drop; 4902 4903 /* 4904 * If we're suspending, it is possible although not too likely 4905 * that we'd be receiving frames after having already partially 4906 * quiesced the stack. We can't process such frames then since 4907 * that might, for example, cause stations to be added or other 4908 * driver callbacks be invoked. 4909 */ 4910 if (unlikely(local->quiescing || local->suspended)) 4911 goto drop; 4912 4913 /* We might be during a HW reconfig, prevent Rx for the same reason */ 4914 if (unlikely(local->in_reconfig)) 4915 goto drop; 4916 4917 /* 4918 * The same happens when we're not even started, 4919 * but that's worth a warning. 4920 */ 4921 if (WARN_ON(!local->started)) 4922 goto drop; 4923 4924 if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC))) { 4925 /* 4926 * Validate the rate, unless a PLCP error means that 4927 * we probably can't have a valid rate here anyway. 4928 */ 4929 4930 switch (status->encoding) { 4931 case RX_ENC_HT: 4932 /* 4933 * rate_idx is MCS index, which can be [0-76] 4934 * as documented on: 4935 * 4936 * https://wireless.wiki.kernel.org/en/developers/Documentation/ieee80211/802.11n 4937 * 4938 * Anything else would be some sort of driver or 4939 * hardware error. The driver should catch hardware 4940 * errors. 4941 */ 4942 if (WARN(status->rate_idx > 76, 4943 "Rate marked as an HT rate but passed " 4944 "status->rate_idx is not " 4945 "an MCS index [0-76]: %d (0x%02x)\n", 4946 status->rate_idx, 4947 status->rate_idx)) 4948 goto drop; 4949 break; 4950 case RX_ENC_VHT: 4951 if (WARN_ONCE(status->rate_idx > 11 || 4952 !status->nss || 4953 status->nss > 8, 4954 "Rate marked as a VHT rate but data is invalid: MCS: %d, NSS: %d\n", 4955 status->rate_idx, status->nss)) 4956 goto drop; 4957 break; 4958 case RX_ENC_HE: 4959 if (WARN_ONCE(status->rate_idx > 11 || 4960 !status->nss || 4961 status->nss > 8, 4962 "Rate marked as an HE rate but data is invalid: MCS: %d, NSS: %d\n", 4963 status->rate_idx, status->nss)) 4964 goto drop; 4965 break; 4966 default: 4967 WARN_ON_ONCE(1); 4968 fallthrough; 4969 case RX_ENC_LEGACY: 4970 if (WARN_ON(status->rate_idx >= sband->n_bitrates)) 4971 goto drop; 4972 rate = &sband->bitrates[status->rate_idx]; 4973 } 4974 } 4975 4976 status->rx_flags = 0; 4977 4978 kcov_remote_start_common(skb_get_kcov_handle(skb)); 4979 4980 /* 4981 * Frames with failed FCS/PLCP checksum are not returned, 4982 * all other frames are returned without radiotap header 4983 * if it was previously present. 4984 * Also, frames with less than 16 bytes are dropped. 4985 */ 4986 if (!(status->flag & RX_FLAG_8023)) 4987 skb = ieee80211_rx_monitor(local, skb, rate); 4988 if (skb) { 4989 if ((status->flag & RX_FLAG_8023) || 4990 ieee80211_is_data_present(hdr->frame_control)) 4991 ieee80211_tpt_led_trig_rx(local, skb->len); 4992 4993 if (status->flag & RX_FLAG_8023) 4994 __ieee80211_rx_handle_8023(hw, pubsta, skb, list); 4995 else 4996 __ieee80211_rx_handle_packet(hw, pubsta, skb, list); 4997 } 4998 4999 kcov_remote_stop(); 5000 return; 5001 drop: 5002 kfree_skb(skb); 5003 } 5004 EXPORT_SYMBOL(ieee80211_rx_list); 5005 5006 void ieee80211_rx_napi(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta, 5007 struct sk_buff *skb, struct napi_struct *napi) 5008 { 5009 struct sk_buff *tmp; 5010 LIST_HEAD(list); 5011 5012 5013 /* 5014 * key references and virtual interfaces are protected using RCU 5015 * and this requires that we are in a read-side RCU section during 5016 * receive processing 5017 */ 5018 rcu_read_lock(); 5019 ieee80211_rx_list(hw, pubsta, skb, &list); 5020 rcu_read_unlock(); 5021 5022 if (!napi) { 5023 netif_receive_skb_list(&list); 5024 return; 5025 } 5026 5027 list_for_each_entry_safe(skb, tmp, &list, list) { 5028 skb_list_del_init(skb); 5029 napi_gro_receive(napi, skb); 5030 } 5031 } 5032 EXPORT_SYMBOL(ieee80211_rx_napi); 5033 5034 /* This is a version of the rx handler that can be called from hard irq 5035 * context. Post the skb on the queue and schedule the tasklet */ 5036 void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb) 5037 { 5038 struct ieee80211_local *local = hw_to_local(hw); 5039 5040 BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb)); 5041 5042 skb->pkt_type = IEEE80211_RX_MSG; 5043 skb_queue_tail(&local->skb_queue, skb); 5044 tasklet_schedule(&local->tasklet); 5045 } 5046 EXPORT_SYMBOL(ieee80211_rx_irqsafe); 5047