1 /* 2 * Copyright 2002-2005, Instant802 Networks, Inc. 3 * Copyright 2005-2006, Devicescape Software, Inc. 4 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz> 5 * Copyright 2007-2010 Johannes Berg <johannes@sipsolutions.net> 6 * Copyright 2013-2014 Intel Mobile Communications GmbH 7 * Copyright(c) 2015 - 2016 Intel Deutschland GmbH 8 * 9 * This program is free software; you can redistribute it and/or modify 10 * it under the terms of the GNU General Public License version 2 as 11 * published by the Free Software Foundation. 12 */ 13 14 #include <linux/jiffies.h> 15 #include <linux/slab.h> 16 #include <linux/kernel.h> 17 #include <linux/skbuff.h> 18 #include <linux/netdevice.h> 19 #include <linux/etherdevice.h> 20 #include <linux/rcupdate.h> 21 #include <linux/export.h> 22 #include <linux/bitops.h> 23 #include <net/mac80211.h> 24 #include <net/ieee80211_radiotap.h> 25 #include <asm/unaligned.h> 26 27 #include "ieee80211_i.h" 28 #include "driver-ops.h" 29 #include "led.h" 30 #include "mesh.h" 31 #include "wep.h" 32 #include "wpa.h" 33 #include "tkip.h" 34 #include "wme.h" 35 #include "rate.h" 36 37 static inline void ieee80211_rx_stats(struct net_device *dev, u32 len) 38 { 39 struct pcpu_sw_netstats *tstats = this_cpu_ptr(dev->tstats); 40 41 u64_stats_update_begin(&tstats->syncp); 42 tstats->rx_packets++; 43 tstats->rx_bytes += len; 44 u64_stats_update_end(&tstats->syncp); 45 } 46 47 static u8 *ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len, 48 enum nl80211_iftype type) 49 { 50 __le16 fc = hdr->frame_control; 51 52 if (ieee80211_is_data(fc)) { 53 if (len < 24) /* drop incorrect hdr len (data) */ 54 return NULL; 55 56 if (ieee80211_has_a4(fc)) 57 return NULL; 58 if (ieee80211_has_tods(fc)) 59 return hdr->addr1; 60 if (ieee80211_has_fromds(fc)) 61 return hdr->addr2; 62 63 return hdr->addr3; 64 } 65 66 if (ieee80211_is_mgmt(fc)) { 67 if (len < 24) /* drop incorrect hdr len (mgmt) */ 68 return NULL; 69 return hdr->addr3; 70 } 71 72 if (ieee80211_is_ctl(fc)) { 73 if (ieee80211_is_pspoll(fc)) 74 return hdr->addr1; 75 76 if (ieee80211_is_back_req(fc)) { 77 switch (type) { 78 case NL80211_IFTYPE_STATION: 79 return hdr->addr2; 80 case NL80211_IFTYPE_AP: 81 case NL80211_IFTYPE_AP_VLAN: 82 return hdr->addr1; 83 default: 84 break; /* fall through to the return */ 85 } 86 } 87 } 88 89 return NULL; 90 } 91 92 /* 93 * monitor mode reception 94 * 95 * This function cleans up the SKB, i.e. it removes all the stuff 96 * only useful for monitoring. 97 */ 98 static struct sk_buff *remove_monitor_info(struct ieee80211_local *local, 99 struct sk_buff *skb, 100 unsigned int rtap_vendor_space) 101 { 102 if (ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)) { 103 if (likely(skb->len > FCS_LEN)) 104 __pskb_trim(skb, skb->len - FCS_LEN); 105 else { 106 /* driver bug */ 107 WARN_ON(1); 108 dev_kfree_skb(skb); 109 return NULL; 110 } 111 } 112 113 __pskb_pull(skb, rtap_vendor_space); 114 115 return skb; 116 } 117 118 static inline bool should_drop_frame(struct sk_buff *skb, int present_fcs_len, 119 unsigned int rtap_vendor_space) 120 { 121 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 122 struct ieee80211_hdr *hdr; 123 124 hdr = (void *)(skb->data + rtap_vendor_space); 125 126 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | 127 RX_FLAG_FAILED_PLCP_CRC | 128 RX_FLAG_ONLY_MONITOR)) 129 return true; 130 131 if (unlikely(skb->len < 16 + present_fcs_len + rtap_vendor_space)) 132 return true; 133 134 if (ieee80211_is_ctl(hdr->frame_control) && 135 !ieee80211_is_pspoll(hdr->frame_control) && 136 !ieee80211_is_back_req(hdr->frame_control)) 137 return true; 138 139 return false; 140 } 141 142 static int 143 ieee80211_rx_radiotap_hdrlen(struct ieee80211_local *local, 144 struct ieee80211_rx_status *status, 145 struct sk_buff *skb) 146 { 147 int len; 148 149 /* always present fields */ 150 len = sizeof(struct ieee80211_radiotap_header) + 8; 151 152 /* allocate extra bitmaps */ 153 if (status->chains) 154 len += 4 * hweight8(status->chains); 155 156 if (ieee80211_have_rx_timestamp(status)) { 157 len = ALIGN(len, 8); 158 len += 8; 159 } 160 if (ieee80211_hw_check(&local->hw, SIGNAL_DBM)) 161 len += 1; 162 163 /* antenna field, if we don't have per-chain info */ 164 if (!status->chains) 165 len += 1; 166 167 /* padding for RX_FLAGS if necessary */ 168 len = ALIGN(len, 2); 169 170 if (status->flag & RX_FLAG_HT) /* HT info */ 171 len += 3; 172 173 if (status->flag & RX_FLAG_AMPDU_DETAILS) { 174 len = ALIGN(len, 4); 175 len += 8; 176 } 177 178 if (status->flag & RX_FLAG_VHT) { 179 len = ALIGN(len, 2); 180 len += 12; 181 } 182 183 if (status->chains) { 184 /* antenna and antenna signal fields */ 185 len += 2 * hweight8(status->chains); 186 } 187 188 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) { 189 struct ieee80211_vendor_radiotap *rtap = (void *)skb->data; 190 191 /* vendor presence bitmap */ 192 len += 4; 193 /* alignment for fixed 6-byte vendor data header */ 194 len = ALIGN(len, 2); 195 /* vendor data header */ 196 len += 6; 197 if (WARN_ON(rtap->align == 0)) 198 rtap->align = 1; 199 len = ALIGN(len, rtap->align); 200 len += rtap->len + rtap->pad; 201 } 202 203 return len; 204 } 205 206 /* 207 * ieee80211_add_rx_radiotap_header - add radiotap header 208 * 209 * add a radiotap header containing all the fields which the hardware provided. 210 */ 211 static void 212 ieee80211_add_rx_radiotap_header(struct ieee80211_local *local, 213 struct sk_buff *skb, 214 struct ieee80211_rate *rate, 215 int rtap_len, bool has_fcs) 216 { 217 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 218 struct ieee80211_radiotap_header *rthdr; 219 unsigned char *pos; 220 __le32 *it_present; 221 u32 it_present_val; 222 u16 rx_flags = 0; 223 u16 channel_flags = 0; 224 int mpdulen, chain; 225 unsigned long chains = status->chains; 226 struct ieee80211_vendor_radiotap rtap = {}; 227 228 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) { 229 rtap = *(struct ieee80211_vendor_radiotap *)skb->data; 230 /* rtap.len and rtap.pad are undone immediately */ 231 skb_pull(skb, sizeof(rtap) + rtap.len + rtap.pad); 232 } 233 234 mpdulen = skb->len; 235 if (!(has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS))) 236 mpdulen += FCS_LEN; 237 238 rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len); 239 memset(rthdr, 0, rtap_len - rtap.len - rtap.pad); 240 it_present = &rthdr->it_present; 241 242 /* radiotap header, set always present flags */ 243 rthdr->it_len = cpu_to_le16(rtap_len); 244 it_present_val = BIT(IEEE80211_RADIOTAP_FLAGS) | 245 BIT(IEEE80211_RADIOTAP_CHANNEL) | 246 BIT(IEEE80211_RADIOTAP_RX_FLAGS); 247 248 if (!status->chains) 249 it_present_val |= BIT(IEEE80211_RADIOTAP_ANTENNA); 250 251 for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) { 252 it_present_val |= 253 BIT(IEEE80211_RADIOTAP_EXT) | 254 BIT(IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE); 255 put_unaligned_le32(it_present_val, it_present); 256 it_present++; 257 it_present_val = BIT(IEEE80211_RADIOTAP_ANTENNA) | 258 BIT(IEEE80211_RADIOTAP_DBM_ANTSIGNAL); 259 } 260 261 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) { 262 it_present_val |= BIT(IEEE80211_RADIOTAP_VENDOR_NAMESPACE) | 263 BIT(IEEE80211_RADIOTAP_EXT); 264 put_unaligned_le32(it_present_val, it_present); 265 it_present++; 266 it_present_val = rtap.present; 267 } 268 269 put_unaligned_le32(it_present_val, it_present); 270 271 pos = (void *)(it_present + 1); 272 273 /* the order of the following fields is important */ 274 275 /* IEEE80211_RADIOTAP_TSFT */ 276 if (ieee80211_have_rx_timestamp(status)) { 277 /* padding */ 278 while ((pos - (u8 *)rthdr) & 7) 279 *pos++ = 0; 280 put_unaligned_le64( 281 ieee80211_calculate_rx_timestamp(local, status, 282 mpdulen, 0), 283 pos); 284 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT); 285 pos += 8; 286 } 287 288 /* IEEE80211_RADIOTAP_FLAGS */ 289 if (has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)) 290 *pos |= IEEE80211_RADIOTAP_F_FCS; 291 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC)) 292 *pos |= IEEE80211_RADIOTAP_F_BADFCS; 293 if (status->flag & RX_FLAG_SHORTPRE) 294 *pos |= IEEE80211_RADIOTAP_F_SHORTPRE; 295 pos++; 296 297 /* IEEE80211_RADIOTAP_RATE */ 298 if (!rate || status->flag & (RX_FLAG_HT | RX_FLAG_VHT)) { 299 /* 300 * Without rate information don't add it. If we have, 301 * MCS information is a separate field in radiotap, 302 * added below. The byte here is needed as padding 303 * for the channel though, so initialise it to 0. 304 */ 305 *pos = 0; 306 } else { 307 int shift = 0; 308 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE); 309 if (status->flag & RX_FLAG_10MHZ) 310 shift = 1; 311 else if (status->flag & RX_FLAG_5MHZ) 312 shift = 2; 313 *pos = DIV_ROUND_UP(rate->bitrate, 5 * (1 << shift)); 314 } 315 pos++; 316 317 /* IEEE80211_RADIOTAP_CHANNEL */ 318 put_unaligned_le16(status->freq, pos); 319 pos += 2; 320 if (status->flag & RX_FLAG_10MHZ) 321 channel_flags |= IEEE80211_CHAN_HALF; 322 else if (status->flag & RX_FLAG_5MHZ) 323 channel_flags |= IEEE80211_CHAN_QUARTER; 324 325 if (status->band == NL80211_BAND_5GHZ) 326 channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ; 327 else if (status->flag & (RX_FLAG_HT | RX_FLAG_VHT)) 328 channel_flags |= IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ; 329 else if (rate && rate->flags & IEEE80211_RATE_ERP_G) 330 channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ; 331 else if (rate) 332 channel_flags |= IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ; 333 else 334 channel_flags |= IEEE80211_CHAN_2GHZ; 335 put_unaligned_le16(channel_flags, pos); 336 pos += 2; 337 338 /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */ 339 if (ieee80211_hw_check(&local->hw, SIGNAL_DBM) && 340 !(status->flag & RX_FLAG_NO_SIGNAL_VAL)) { 341 *pos = status->signal; 342 rthdr->it_present |= 343 cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL); 344 pos++; 345 } 346 347 /* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */ 348 349 if (!status->chains) { 350 /* IEEE80211_RADIOTAP_ANTENNA */ 351 *pos = status->antenna; 352 pos++; 353 } 354 355 /* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */ 356 357 /* IEEE80211_RADIOTAP_RX_FLAGS */ 358 /* ensure 2 byte alignment for the 2 byte field as required */ 359 if ((pos - (u8 *)rthdr) & 1) 360 *pos++ = 0; 361 if (status->flag & RX_FLAG_FAILED_PLCP_CRC) 362 rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP; 363 put_unaligned_le16(rx_flags, pos); 364 pos += 2; 365 366 if (status->flag & RX_FLAG_HT) { 367 unsigned int stbc; 368 369 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_MCS); 370 *pos++ = local->hw.radiotap_mcs_details; 371 *pos = 0; 372 if (status->flag & RX_FLAG_SHORT_GI) 373 *pos |= IEEE80211_RADIOTAP_MCS_SGI; 374 if (status->flag & RX_FLAG_40MHZ) 375 *pos |= IEEE80211_RADIOTAP_MCS_BW_40; 376 if (status->flag & RX_FLAG_HT_GF) 377 *pos |= IEEE80211_RADIOTAP_MCS_FMT_GF; 378 if (status->flag & RX_FLAG_LDPC) 379 *pos |= IEEE80211_RADIOTAP_MCS_FEC_LDPC; 380 stbc = (status->flag & RX_FLAG_STBC_MASK) >> RX_FLAG_STBC_SHIFT; 381 *pos |= stbc << IEEE80211_RADIOTAP_MCS_STBC_SHIFT; 382 pos++; 383 *pos++ = status->rate_idx; 384 } 385 386 if (status->flag & RX_FLAG_AMPDU_DETAILS) { 387 u16 flags = 0; 388 389 /* ensure 4 byte alignment */ 390 while ((pos - (u8 *)rthdr) & 3) 391 pos++; 392 rthdr->it_present |= 393 cpu_to_le32(1 << IEEE80211_RADIOTAP_AMPDU_STATUS); 394 put_unaligned_le32(status->ampdu_reference, pos); 395 pos += 4; 396 if (status->flag & RX_FLAG_AMPDU_LAST_KNOWN) 397 flags |= IEEE80211_RADIOTAP_AMPDU_LAST_KNOWN; 398 if (status->flag & RX_FLAG_AMPDU_IS_LAST) 399 flags |= IEEE80211_RADIOTAP_AMPDU_IS_LAST; 400 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_ERROR) 401 flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_ERR; 402 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN) 403 flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_KNOWN; 404 put_unaligned_le16(flags, pos); 405 pos += 2; 406 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN) 407 *pos++ = status->ampdu_delimiter_crc; 408 else 409 *pos++ = 0; 410 *pos++ = 0; 411 } 412 413 if (status->flag & RX_FLAG_VHT) { 414 u16 known = local->hw.radiotap_vht_details; 415 416 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_VHT); 417 put_unaligned_le16(known, pos); 418 pos += 2; 419 /* flags */ 420 if (status->flag & RX_FLAG_SHORT_GI) 421 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_SGI; 422 /* in VHT, STBC is binary */ 423 if (status->flag & RX_FLAG_STBC_MASK) 424 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_STBC; 425 if (status->vht_flag & RX_VHT_FLAG_BF) 426 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_BEAMFORMED; 427 pos++; 428 /* bandwidth */ 429 if (status->vht_flag & RX_VHT_FLAG_80MHZ) 430 *pos++ = 4; 431 else if (status->vht_flag & RX_VHT_FLAG_160MHZ) 432 *pos++ = 11; 433 else if (status->flag & RX_FLAG_40MHZ) 434 *pos++ = 1; 435 else /* 20 MHz */ 436 *pos++ = 0; 437 /* MCS/NSS */ 438 *pos = (status->rate_idx << 4) | status->vht_nss; 439 pos += 4; 440 /* coding field */ 441 if (status->flag & RX_FLAG_LDPC) 442 *pos |= IEEE80211_RADIOTAP_CODING_LDPC_USER0; 443 pos++; 444 /* group ID */ 445 pos++; 446 /* partial_aid */ 447 pos += 2; 448 } 449 450 for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) { 451 *pos++ = status->chain_signal[chain]; 452 *pos++ = chain; 453 } 454 455 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) { 456 /* ensure 2 byte alignment for the vendor field as required */ 457 if ((pos - (u8 *)rthdr) & 1) 458 *pos++ = 0; 459 *pos++ = rtap.oui[0]; 460 *pos++ = rtap.oui[1]; 461 *pos++ = rtap.oui[2]; 462 *pos++ = rtap.subns; 463 put_unaligned_le16(rtap.len, pos); 464 pos += 2; 465 /* align the actual payload as requested */ 466 while ((pos - (u8 *)rthdr) & (rtap.align - 1)) 467 *pos++ = 0; 468 /* data (and possible padding) already follows */ 469 } 470 } 471 472 /* 473 * This function copies a received frame to all monitor interfaces and 474 * returns a cleaned-up SKB that no longer includes the FCS nor the 475 * radiotap header the driver might have added. 476 */ 477 static struct sk_buff * 478 ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb, 479 struct ieee80211_rate *rate) 480 { 481 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb); 482 struct ieee80211_sub_if_data *sdata; 483 int rt_hdrlen, needed_headroom; 484 struct sk_buff *skb, *skb2; 485 struct net_device *prev_dev = NULL; 486 int present_fcs_len = 0; 487 unsigned int rtap_vendor_space = 0; 488 489 if (unlikely(status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA)) { 490 struct ieee80211_vendor_radiotap *rtap = (void *)origskb->data; 491 492 rtap_vendor_space = sizeof(*rtap) + rtap->len + rtap->pad; 493 } 494 495 /* 496 * First, we may need to make a copy of the skb because 497 * (1) we need to modify it for radiotap (if not present), and 498 * (2) the other RX handlers will modify the skb we got. 499 * 500 * We don't need to, of course, if we aren't going to return 501 * the SKB because it has a bad FCS/PLCP checksum. 502 */ 503 504 if (ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)) 505 present_fcs_len = FCS_LEN; 506 507 /* ensure hdr->frame_control and vendor radiotap data are in skb head */ 508 if (!pskb_may_pull(origskb, 2 + rtap_vendor_space)) { 509 dev_kfree_skb(origskb); 510 return NULL; 511 } 512 513 if (!local->monitors || (status->flag & RX_FLAG_SKIP_MONITOR)) { 514 if (should_drop_frame(origskb, present_fcs_len, 515 rtap_vendor_space)) { 516 dev_kfree_skb(origskb); 517 return NULL; 518 } 519 520 return remove_monitor_info(local, origskb, rtap_vendor_space); 521 } 522 523 /* room for the radiotap header based on driver features */ 524 rt_hdrlen = ieee80211_rx_radiotap_hdrlen(local, status, origskb); 525 needed_headroom = rt_hdrlen - rtap_vendor_space; 526 527 if (should_drop_frame(origskb, present_fcs_len, rtap_vendor_space)) { 528 /* only need to expand headroom if necessary */ 529 skb = origskb; 530 origskb = NULL; 531 532 /* 533 * This shouldn't trigger often because most devices have an 534 * RX header they pull before we get here, and that should 535 * be big enough for our radiotap information. We should 536 * probably export the length to drivers so that we can have 537 * them allocate enough headroom to start with. 538 */ 539 if (skb_headroom(skb) < needed_headroom && 540 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) { 541 dev_kfree_skb(skb); 542 return NULL; 543 } 544 } else { 545 /* 546 * Need to make a copy and possibly remove radiotap header 547 * and FCS from the original. 548 */ 549 skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC); 550 551 origskb = remove_monitor_info(local, origskb, 552 rtap_vendor_space); 553 554 if (!skb) 555 return origskb; 556 } 557 558 /* prepend radiotap information */ 559 ieee80211_add_rx_radiotap_header(local, skb, rate, rt_hdrlen, true); 560 561 skb_reset_mac_header(skb); 562 skb->ip_summed = CHECKSUM_UNNECESSARY; 563 skb->pkt_type = PACKET_OTHERHOST; 564 skb->protocol = htons(ETH_P_802_2); 565 566 list_for_each_entry_rcu(sdata, &local->interfaces, list) { 567 if (sdata->vif.type != NL80211_IFTYPE_MONITOR) 568 continue; 569 570 if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES) 571 continue; 572 573 if (!ieee80211_sdata_running(sdata)) 574 continue; 575 576 if (prev_dev) { 577 skb2 = skb_clone(skb, GFP_ATOMIC); 578 if (skb2) { 579 skb2->dev = prev_dev; 580 netif_receive_skb(skb2); 581 } 582 } 583 584 prev_dev = sdata->dev; 585 ieee80211_rx_stats(sdata->dev, skb->len); 586 } 587 588 if (prev_dev) { 589 skb->dev = prev_dev; 590 netif_receive_skb(skb); 591 } else 592 dev_kfree_skb(skb); 593 594 return origskb; 595 } 596 597 static void ieee80211_parse_qos(struct ieee80211_rx_data *rx) 598 { 599 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 600 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 601 int tid, seqno_idx, security_idx; 602 603 /* does the frame have a qos control field? */ 604 if (ieee80211_is_data_qos(hdr->frame_control)) { 605 u8 *qc = ieee80211_get_qos_ctl(hdr); 606 /* frame has qos control */ 607 tid = *qc & IEEE80211_QOS_CTL_TID_MASK; 608 if (*qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT) 609 status->rx_flags |= IEEE80211_RX_AMSDU; 610 611 seqno_idx = tid; 612 security_idx = tid; 613 } else { 614 /* 615 * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"): 616 * 617 * Sequence numbers for management frames, QoS data 618 * frames with a broadcast/multicast address in the 619 * Address 1 field, and all non-QoS data frames sent 620 * by QoS STAs are assigned using an additional single 621 * modulo-4096 counter, [...] 622 * 623 * We also use that counter for non-QoS STAs. 624 */ 625 seqno_idx = IEEE80211_NUM_TIDS; 626 security_idx = 0; 627 if (ieee80211_is_mgmt(hdr->frame_control)) 628 security_idx = IEEE80211_NUM_TIDS; 629 tid = 0; 630 } 631 632 rx->seqno_idx = seqno_idx; 633 rx->security_idx = security_idx; 634 /* Set skb->priority to 1d tag if highest order bit of TID is not set. 635 * For now, set skb->priority to 0 for other cases. */ 636 rx->skb->priority = (tid > 7) ? 0 : tid; 637 } 638 639 /** 640 * DOC: Packet alignment 641 * 642 * Drivers always need to pass packets that are aligned to two-byte boundaries 643 * to the stack. 644 * 645 * Additionally, should, if possible, align the payload data in a way that 646 * guarantees that the contained IP header is aligned to a four-byte 647 * boundary. In the case of regular frames, this simply means aligning the 648 * payload to a four-byte boundary (because either the IP header is directly 649 * contained, or IV/RFC1042 headers that have a length divisible by four are 650 * in front of it). If the payload data is not properly aligned and the 651 * architecture doesn't support efficient unaligned operations, mac80211 652 * will align the data. 653 * 654 * With A-MSDU frames, however, the payload data address must yield two modulo 655 * four because there are 14-byte 802.3 headers within the A-MSDU frames that 656 * push the IP header further back to a multiple of four again. Thankfully, the 657 * specs were sane enough this time around to require padding each A-MSDU 658 * subframe to a length that is a multiple of four. 659 * 660 * Padding like Atheros hardware adds which is between the 802.11 header and 661 * the payload is not supported, the driver is required to move the 802.11 662 * header to be directly in front of the payload in that case. 663 */ 664 static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx) 665 { 666 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG 667 WARN_ON_ONCE((unsigned long)rx->skb->data & 1); 668 #endif 669 } 670 671 672 /* rx handlers */ 673 674 static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb) 675 { 676 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 677 678 if (is_multicast_ether_addr(hdr->addr1)) 679 return 0; 680 681 return ieee80211_is_robust_mgmt_frame(skb); 682 } 683 684 685 static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb) 686 { 687 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 688 689 if (!is_multicast_ether_addr(hdr->addr1)) 690 return 0; 691 692 return ieee80211_is_robust_mgmt_frame(skb); 693 } 694 695 696 /* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */ 697 static int ieee80211_get_mmie_keyidx(struct sk_buff *skb) 698 { 699 struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data; 700 struct ieee80211_mmie *mmie; 701 struct ieee80211_mmie_16 *mmie16; 702 703 if (skb->len < 24 + sizeof(*mmie) || !is_multicast_ether_addr(hdr->da)) 704 return -1; 705 706 if (!ieee80211_is_robust_mgmt_frame(skb)) 707 return -1; /* not a robust management frame */ 708 709 mmie = (struct ieee80211_mmie *) 710 (skb->data + skb->len - sizeof(*mmie)); 711 if (mmie->element_id == WLAN_EID_MMIE && 712 mmie->length == sizeof(*mmie) - 2) 713 return le16_to_cpu(mmie->key_id); 714 715 mmie16 = (struct ieee80211_mmie_16 *) 716 (skb->data + skb->len - sizeof(*mmie16)); 717 if (skb->len >= 24 + sizeof(*mmie16) && 718 mmie16->element_id == WLAN_EID_MMIE && 719 mmie16->length == sizeof(*mmie16) - 2) 720 return le16_to_cpu(mmie16->key_id); 721 722 return -1; 723 } 724 725 static int ieee80211_get_cs_keyid(const struct ieee80211_cipher_scheme *cs, 726 struct sk_buff *skb) 727 { 728 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; 729 __le16 fc; 730 int hdrlen; 731 u8 keyid; 732 733 fc = hdr->frame_control; 734 hdrlen = ieee80211_hdrlen(fc); 735 736 if (skb->len < hdrlen + cs->hdr_len) 737 return -EINVAL; 738 739 skb_copy_bits(skb, hdrlen + cs->key_idx_off, &keyid, 1); 740 keyid &= cs->key_idx_mask; 741 keyid >>= cs->key_idx_shift; 742 743 return keyid; 744 } 745 746 static ieee80211_rx_result ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx) 747 { 748 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 749 char *dev_addr = rx->sdata->vif.addr; 750 751 if (ieee80211_is_data(hdr->frame_control)) { 752 if (is_multicast_ether_addr(hdr->addr1)) { 753 if (ieee80211_has_tods(hdr->frame_control) || 754 !ieee80211_has_fromds(hdr->frame_control)) 755 return RX_DROP_MONITOR; 756 if (ether_addr_equal(hdr->addr3, dev_addr)) 757 return RX_DROP_MONITOR; 758 } else { 759 if (!ieee80211_has_a4(hdr->frame_control)) 760 return RX_DROP_MONITOR; 761 if (ether_addr_equal(hdr->addr4, dev_addr)) 762 return RX_DROP_MONITOR; 763 } 764 } 765 766 /* If there is not an established peer link and this is not a peer link 767 * establisment frame, beacon or probe, drop the frame. 768 */ 769 770 if (!rx->sta || sta_plink_state(rx->sta) != NL80211_PLINK_ESTAB) { 771 struct ieee80211_mgmt *mgmt; 772 773 if (!ieee80211_is_mgmt(hdr->frame_control)) 774 return RX_DROP_MONITOR; 775 776 if (ieee80211_is_action(hdr->frame_control)) { 777 u8 category; 778 779 /* make sure category field is present */ 780 if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE) 781 return RX_DROP_MONITOR; 782 783 mgmt = (struct ieee80211_mgmt *)hdr; 784 category = mgmt->u.action.category; 785 if (category != WLAN_CATEGORY_MESH_ACTION && 786 category != WLAN_CATEGORY_SELF_PROTECTED) 787 return RX_DROP_MONITOR; 788 return RX_CONTINUE; 789 } 790 791 if (ieee80211_is_probe_req(hdr->frame_control) || 792 ieee80211_is_probe_resp(hdr->frame_control) || 793 ieee80211_is_beacon(hdr->frame_control) || 794 ieee80211_is_auth(hdr->frame_control)) 795 return RX_CONTINUE; 796 797 return RX_DROP_MONITOR; 798 } 799 800 return RX_CONTINUE; 801 } 802 803 static inline bool ieee80211_rx_reorder_ready(struct tid_ampdu_rx *tid_agg_rx, 804 int index) 805 { 806 struct sk_buff_head *frames = &tid_agg_rx->reorder_buf[index]; 807 struct sk_buff *tail = skb_peek_tail(frames); 808 struct ieee80211_rx_status *status; 809 810 if (tid_agg_rx->reorder_buf_filtered & BIT_ULL(index)) 811 return true; 812 813 if (!tail) 814 return false; 815 816 status = IEEE80211_SKB_RXCB(tail); 817 if (status->flag & RX_FLAG_AMSDU_MORE) 818 return false; 819 820 return true; 821 } 822 823 static void ieee80211_release_reorder_frame(struct ieee80211_sub_if_data *sdata, 824 struct tid_ampdu_rx *tid_agg_rx, 825 int index, 826 struct sk_buff_head *frames) 827 { 828 struct sk_buff_head *skb_list = &tid_agg_rx->reorder_buf[index]; 829 struct sk_buff *skb; 830 struct ieee80211_rx_status *status; 831 832 lockdep_assert_held(&tid_agg_rx->reorder_lock); 833 834 if (skb_queue_empty(skb_list)) 835 goto no_frame; 836 837 if (!ieee80211_rx_reorder_ready(tid_agg_rx, index)) { 838 __skb_queue_purge(skb_list); 839 goto no_frame; 840 } 841 842 /* release frames from the reorder ring buffer */ 843 tid_agg_rx->stored_mpdu_num--; 844 while ((skb = __skb_dequeue(skb_list))) { 845 status = IEEE80211_SKB_RXCB(skb); 846 status->rx_flags |= IEEE80211_RX_DEFERRED_RELEASE; 847 __skb_queue_tail(frames, skb); 848 } 849 850 no_frame: 851 tid_agg_rx->reorder_buf_filtered &= ~BIT_ULL(index); 852 tid_agg_rx->head_seq_num = ieee80211_sn_inc(tid_agg_rx->head_seq_num); 853 } 854 855 static void ieee80211_release_reorder_frames(struct ieee80211_sub_if_data *sdata, 856 struct tid_ampdu_rx *tid_agg_rx, 857 u16 head_seq_num, 858 struct sk_buff_head *frames) 859 { 860 int index; 861 862 lockdep_assert_held(&tid_agg_rx->reorder_lock); 863 864 while (ieee80211_sn_less(tid_agg_rx->head_seq_num, head_seq_num)) { 865 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size; 866 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index, 867 frames); 868 } 869 } 870 871 /* 872 * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If 873 * the skb was added to the buffer longer than this time ago, the earlier 874 * frames that have not yet been received are assumed to be lost and the skb 875 * can be released for processing. This may also release other skb's from the 876 * reorder buffer if there are no additional gaps between the frames. 877 * 878 * Callers must hold tid_agg_rx->reorder_lock. 879 */ 880 #define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10) 881 882 static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata, 883 struct tid_ampdu_rx *tid_agg_rx, 884 struct sk_buff_head *frames) 885 { 886 int index, i, j; 887 888 lockdep_assert_held(&tid_agg_rx->reorder_lock); 889 890 /* release the buffer until next missing frame */ 891 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size; 892 if (!ieee80211_rx_reorder_ready(tid_agg_rx, index) && 893 tid_agg_rx->stored_mpdu_num) { 894 /* 895 * No buffers ready to be released, but check whether any 896 * frames in the reorder buffer have timed out. 897 */ 898 int skipped = 1; 899 for (j = (index + 1) % tid_agg_rx->buf_size; j != index; 900 j = (j + 1) % tid_agg_rx->buf_size) { 901 if (!ieee80211_rx_reorder_ready(tid_agg_rx, j)) { 902 skipped++; 903 continue; 904 } 905 if (skipped && 906 !time_after(jiffies, tid_agg_rx->reorder_time[j] + 907 HT_RX_REORDER_BUF_TIMEOUT)) 908 goto set_release_timer; 909 910 /* don't leave incomplete A-MSDUs around */ 911 for (i = (index + 1) % tid_agg_rx->buf_size; i != j; 912 i = (i + 1) % tid_agg_rx->buf_size) 913 __skb_queue_purge(&tid_agg_rx->reorder_buf[i]); 914 915 ht_dbg_ratelimited(sdata, 916 "release an RX reorder frame due to timeout on earlier frames\n"); 917 ieee80211_release_reorder_frame(sdata, tid_agg_rx, j, 918 frames); 919 920 /* 921 * Increment the head seq# also for the skipped slots. 922 */ 923 tid_agg_rx->head_seq_num = 924 (tid_agg_rx->head_seq_num + 925 skipped) & IEEE80211_SN_MASK; 926 skipped = 0; 927 } 928 } else while (ieee80211_rx_reorder_ready(tid_agg_rx, index)) { 929 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index, 930 frames); 931 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size; 932 } 933 934 if (tid_agg_rx->stored_mpdu_num) { 935 j = index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size; 936 937 for (; j != (index - 1) % tid_agg_rx->buf_size; 938 j = (j + 1) % tid_agg_rx->buf_size) { 939 if (ieee80211_rx_reorder_ready(tid_agg_rx, j)) 940 break; 941 } 942 943 set_release_timer: 944 945 if (!tid_agg_rx->removed) 946 mod_timer(&tid_agg_rx->reorder_timer, 947 tid_agg_rx->reorder_time[j] + 1 + 948 HT_RX_REORDER_BUF_TIMEOUT); 949 } else { 950 del_timer(&tid_agg_rx->reorder_timer); 951 } 952 } 953 954 /* 955 * As this function belongs to the RX path it must be under 956 * rcu_read_lock protection. It returns false if the frame 957 * can be processed immediately, true if it was consumed. 958 */ 959 static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata, 960 struct tid_ampdu_rx *tid_agg_rx, 961 struct sk_buff *skb, 962 struct sk_buff_head *frames) 963 { 964 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 965 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 966 u16 sc = le16_to_cpu(hdr->seq_ctrl); 967 u16 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4; 968 u16 head_seq_num, buf_size; 969 int index; 970 bool ret = true; 971 972 spin_lock(&tid_agg_rx->reorder_lock); 973 974 /* 975 * Offloaded BA sessions have no known starting sequence number so pick 976 * one from first Rxed frame for this tid after BA was started. 977 */ 978 if (unlikely(tid_agg_rx->auto_seq)) { 979 tid_agg_rx->auto_seq = false; 980 tid_agg_rx->ssn = mpdu_seq_num; 981 tid_agg_rx->head_seq_num = mpdu_seq_num; 982 } 983 984 buf_size = tid_agg_rx->buf_size; 985 head_seq_num = tid_agg_rx->head_seq_num; 986 987 /* frame with out of date sequence number */ 988 if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) { 989 dev_kfree_skb(skb); 990 goto out; 991 } 992 993 /* 994 * If frame the sequence number exceeds our buffering window 995 * size release some previous frames to make room for this one. 996 */ 997 if (!ieee80211_sn_less(mpdu_seq_num, head_seq_num + buf_size)) { 998 head_seq_num = ieee80211_sn_inc( 999 ieee80211_sn_sub(mpdu_seq_num, buf_size)); 1000 /* release stored frames up to new head to stack */ 1001 ieee80211_release_reorder_frames(sdata, tid_agg_rx, 1002 head_seq_num, frames); 1003 } 1004 1005 /* Now the new frame is always in the range of the reordering buffer */ 1006 1007 index = mpdu_seq_num % tid_agg_rx->buf_size; 1008 1009 /* check if we already stored this frame */ 1010 if (ieee80211_rx_reorder_ready(tid_agg_rx, index)) { 1011 dev_kfree_skb(skb); 1012 goto out; 1013 } 1014 1015 /* 1016 * If the current MPDU is in the right order and nothing else 1017 * is stored we can process it directly, no need to buffer it. 1018 * If it is first but there's something stored, we may be able 1019 * to release frames after this one. 1020 */ 1021 if (mpdu_seq_num == tid_agg_rx->head_seq_num && 1022 tid_agg_rx->stored_mpdu_num == 0) { 1023 if (!(status->flag & RX_FLAG_AMSDU_MORE)) 1024 tid_agg_rx->head_seq_num = 1025 ieee80211_sn_inc(tid_agg_rx->head_seq_num); 1026 ret = false; 1027 goto out; 1028 } 1029 1030 /* put the frame in the reordering buffer */ 1031 __skb_queue_tail(&tid_agg_rx->reorder_buf[index], skb); 1032 if (!(status->flag & RX_FLAG_AMSDU_MORE)) { 1033 tid_agg_rx->reorder_time[index] = jiffies; 1034 tid_agg_rx->stored_mpdu_num++; 1035 ieee80211_sta_reorder_release(sdata, tid_agg_rx, frames); 1036 } 1037 1038 out: 1039 spin_unlock(&tid_agg_rx->reorder_lock); 1040 return ret; 1041 } 1042 1043 /* 1044 * Reorder MPDUs from A-MPDUs, keeping them on a buffer. Returns 1045 * true if the MPDU was buffered, false if it should be processed. 1046 */ 1047 static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx, 1048 struct sk_buff_head *frames) 1049 { 1050 struct sk_buff *skb = rx->skb; 1051 struct ieee80211_local *local = rx->local; 1052 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 1053 struct sta_info *sta = rx->sta; 1054 struct tid_ampdu_rx *tid_agg_rx; 1055 u16 sc; 1056 u8 tid, ack_policy; 1057 1058 if (!ieee80211_is_data_qos(hdr->frame_control) || 1059 is_multicast_ether_addr(hdr->addr1)) 1060 goto dont_reorder; 1061 1062 /* 1063 * filter the QoS data rx stream according to 1064 * STA/TID and check if this STA/TID is on aggregation 1065 */ 1066 1067 if (!sta) 1068 goto dont_reorder; 1069 1070 ack_policy = *ieee80211_get_qos_ctl(hdr) & 1071 IEEE80211_QOS_CTL_ACK_POLICY_MASK; 1072 tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK; 1073 1074 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]); 1075 if (!tid_agg_rx) 1076 goto dont_reorder; 1077 1078 /* qos null data frames are excluded */ 1079 if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC))) 1080 goto dont_reorder; 1081 1082 /* not part of a BA session */ 1083 if (ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK && 1084 ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_NORMAL) 1085 goto dont_reorder; 1086 1087 /* new, potentially un-ordered, ampdu frame - process it */ 1088 1089 /* reset session timer */ 1090 if (tid_agg_rx->timeout) 1091 tid_agg_rx->last_rx = jiffies; 1092 1093 /* if this mpdu is fragmented - terminate rx aggregation session */ 1094 sc = le16_to_cpu(hdr->seq_ctrl); 1095 if (sc & IEEE80211_SCTL_FRAG) { 1096 skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME; 1097 skb_queue_tail(&rx->sdata->skb_queue, skb); 1098 ieee80211_queue_work(&local->hw, &rx->sdata->work); 1099 return; 1100 } 1101 1102 /* 1103 * No locking needed -- we will only ever process one 1104 * RX packet at a time, and thus own tid_agg_rx. All 1105 * other code manipulating it needs to (and does) make 1106 * sure that we cannot get to it any more before doing 1107 * anything with it. 1108 */ 1109 if (ieee80211_sta_manage_reorder_buf(rx->sdata, tid_agg_rx, skb, 1110 frames)) 1111 return; 1112 1113 dont_reorder: 1114 __skb_queue_tail(frames, skb); 1115 } 1116 1117 static ieee80211_rx_result debug_noinline 1118 ieee80211_rx_h_check_dup(struct ieee80211_rx_data *rx) 1119 { 1120 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 1121 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 1122 1123 if (status->flag & RX_FLAG_DUP_VALIDATED) 1124 return RX_CONTINUE; 1125 1126 /* 1127 * Drop duplicate 802.11 retransmissions 1128 * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery") 1129 */ 1130 1131 if (rx->skb->len < 24) 1132 return RX_CONTINUE; 1133 1134 if (ieee80211_is_ctl(hdr->frame_control) || 1135 ieee80211_is_qos_nullfunc(hdr->frame_control) || 1136 is_multicast_ether_addr(hdr->addr1)) 1137 return RX_CONTINUE; 1138 1139 if (!rx->sta) 1140 return RX_CONTINUE; 1141 1142 if (unlikely(ieee80211_has_retry(hdr->frame_control) && 1143 rx->sta->last_seq_ctrl[rx->seqno_idx] == hdr->seq_ctrl)) { 1144 I802_DEBUG_INC(rx->local->dot11FrameDuplicateCount); 1145 rx->sta->rx_stats.num_duplicates++; 1146 return RX_DROP_UNUSABLE; 1147 } else if (!(status->flag & RX_FLAG_AMSDU_MORE)) { 1148 rx->sta->last_seq_ctrl[rx->seqno_idx] = hdr->seq_ctrl; 1149 } 1150 1151 return RX_CONTINUE; 1152 } 1153 1154 static ieee80211_rx_result debug_noinline 1155 ieee80211_rx_h_check(struct ieee80211_rx_data *rx) 1156 { 1157 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 1158 1159 /* Drop disallowed frame classes based on STA auth/assoc state; 1160 * IEEE 802.11, Chap 5.5. 1161 * 1162 * mac80211 filters only based on association state, i.e. it drops 1163 * Class 3 frames from not associated stations. hostapd sends 1164 * deauth/disassoc frames when needed. In addition, hostapd is 1165 * responsible for filtering on both auth and assoc states. 1166 */ 1167 1168 if (ieee80211_vif_is_mesh(&rx->sdata->vif)) 1169 return ieee80211_rx_mesh_check(rx); 1170 1171 if (unlikely((ieee80211_is_data(hdr->frame_control) || 1172 ieee80211_is_pspoll(hdr->frame_control)) && 1173 rx->sdata->vif.type != NL80211_IFTYPE_ADHOC && 1174 rx->sdata->vif.type != NL80211_IFTYPE_WDS && 1175 rx->sdata->vif.type != NL80211_IFTYPE_OCB && 1176 (!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_ASSOC)))) { 1177 /* 1178 * accept port control frames from the AP even when it's not 1179 * yet marked ASSOC to prevent a race where we don't set the 1180 * assoc bit quickly enough before it sends the first frame 1181 */ 1182 if (rx->sta && rx->sdata->vif.type == NL80211_IFTYPE_STATION && 1183 ieee80211_is_data_present(hdr->frame_control)) { 1184 unsigned int hdrlen; 1185 __be16 ethertype; 1186 1187 hdrlen = ieee80211_hdrlen(hdr->frame_control); 1188 1189 if (rx->skb->len < hdrlen + 8) 1190 return RX_DROP_MONITOR; 1191 1192 skb_copy_bits(rx->skb, hdrlen + 6, ðertype, 2); 1193 if (ethertype == rx->sdata->control_port_protocol) 1194 return RX_CONTINUE; 1195 } 1196 1197 if (rx->sdata->vif.type == NL80211_IFTYPE_AP && 1198 cfg80211_rx_spurious_frame(rx->sdata->dev, 1199 hdr->addr2, 1200 GFP_ATOMIC)) 1201 return RX_DROP_UNUSABLE; 1202 1203 return RX_DROP_MONITOR; 1204 } 1205 1206 return RX_CONTINUE; 1207 } 1208 1209 1210 static ieee80211_rx_result debug_noinline 1211 ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx) 1212 { 1213 struct ieee80211_local *local; 1214 struct ieee80211_hdr *hdr; 1215 struct sk_buff *skb; 1216 1217 local = rx->local; 1218 skb = rx->skb; 1219 hdr = (struct ieee80211_hdr *) skb->data; 1220 1221 if (!local->pspolling) 1222 return RX_CONTINUE; 1223 1224 if (!ieee80211_has_fromds(hdr->frame_control)) 1225 /* this is not from AP */ 1226 return RX_CONTINUE; 1227 1228 if (!ieee80211_is_data(hdr->frame_control)) 1229 return RX_CONTINUE; 1230 1231 if (!ieee80211_has_moredata(hdr->frame_control)) { 1232 /* AP has no more frames buffered for us */ 1233 local->pspolling = false; 1234 return RX_CONTINUE; 1235 } 1236 1237 /* more data bit is set, let's request a new frame from the AP */ 1238 ieee80211_send_pspoll(local, rx->sdata); 1239 1240 return RX_CONTINUE; 1241 } 1242 1243 static void sta_ps_start(struct sta_info *sta) 1244 { 1245 struct ieee80211_sub_if_data *sdata = sta->sdata; 1246 struct ieee80211_local *local = sdata->local; 1247 struct ps_data *ps; 1248 int tid; 1249 1250 if (sta->sdata->vif.type == NL80211_IFTYPE_AP || 1251 sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) 1252 ps = &sdata->bss->ps; 1253 else 1254 return; 1255 1256 atomic_inc(&ps->num_sta_ps); 1257 set_sta_flag(sta, WLAN_STA_PS_STA); 1258 if (!ieee80211_hw_check(&local->hw, AP_LINK_PS)) 1259 drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta); 1260 ps_dbg(sdata, "STA %pM aid %d enters power save mode\n", 1261 sta->sta.addr, sta->sta.aid); 1262 1263 ieee80211_clear_fast_xmit(sta); 1264 1265 if (!sta->sta.txq[0]) 1266 return; 1267 1268 for (tid = 0; tid < ARRAY_SIZE(sta->sta.txq); tid++) { 1269 struct txq_info *txqi = to_txq_info(sta->sta.txq[tid]); 1270 1271 if (!skb_queue_len(&txqi->queue)) 1272 set_bit(tid, &sta->txq_buffered_tids); 1273 else 1274 clear_bit(tid, &sta->txq_buffered_tids); 1275 } 1276 } 1277 1278 static void sta_ps_end(struct sta_info *sta) 1279 { 1280 ps_dbg(sta->sdata, "STA %pM aid %d exits power save mode\n", 1281 sta->sta.addr, sta->sta.aid); 1282 1283 if (test_sta_flag(sta, WLAN_STA_PS_DRIVER)) { 1284 /* 1285 * Clear the flag only if the other one is still set 1286 * so that the TX path won't start TX'ing new frames 1287 * directly ... In the case that the driver flag isn't 1288 * set ieee80211_sta_ps_deliver_wakeup() will clear it. 1289 */ 1290 clear_sta_flag(sta, WLAN_STA_PS_STA); 1291 ps_dbg(sta->sdata, "STA %pM aid %d driver-ps-blocked\n", 1292 sta->sta.addr, sta->sta.aid); 1293 return; 1294 } 1295 1296 set_sta_flag(sta, WLAN_STA_PS_DELIVER); 1297 clear_sta_flag(sta, WLAN_STA_PS_STA); 1298 ieee80211_sta_ps_deliver_wakeup(sta); 1299 } 1300 1301 int ieee80211_sta_ps_transition(struct ieee80211_sta *pubsta, bool start) 1302 { 1303 struct sta_info *sta = container_of(pubsta, struct sta_info, sta); 1304 bool in_ps; 1305 1306 WARN_ON(!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS)); 1307 1308 /* Don't let the same PS state be set twice */ 1309 in_ps = test_sta_flag(sta, WLAN_STA_PS_STA); 1310 if ((start && in_ps) || (!start && !in_ps)) 1311 return -EINVAL; 1312 1313 if (start) 1314 sta_ps_start(sta); 1315 else 1316 sta_ps_end(sta); 1317 1318 return 0; 1319 } 1320 EXPORT_SYMBOL(ieee80211_sta_ps_transition); 1321 1322 static ieee80211_rx_result debug_noinline 1323 ieee80211_rx_h_uapsd_and_pspoll(struct ieee80211_rx_data *rx) 1324 { 1325 struct ieee80211_sub_if_data *sdata = rx->sdata; 1326 struct ieee80211_hdr *hdr = (void *)rx->skb->data; 1327 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 1328 int tid, ac; 1329 1330 if (!rx->sta) 1331 return RX_CONTINUE; 1332 1333 if (sdata->vif.type != NL80211_IFTYPE_AP && 1334 sdata->vif.type != NL80211_IFTYPE_AP_VLAN) 1335 return RX_CONTINUE; 1336 1337 /* 1338 * The device handles station powersave, so don't do anything about 1339 * uAPSD and PS-Poll frames (the latter shouldn't even come up from 1340 * it to mac80211 since they're handled.) 1341 */ 1342 if (ieee80211_hw_check(&sdata->local->hw, AP_LINK_PS)) 1343 return RX_CONTINUE; 1344 1345 /* 1346 * Don't do anything if the station isn't already asleep. In 1347 * the uAPSD case, the station will probably be marked asleep, 1348 * in the PS-Poll case the station must be confused ... 1349 */ 1350 if (!test_sta_flag(rx->sta, WLAN_STA_PS_STA)) 1351 return RX_CONTINUE; 1352 1353 if (unlikely(ieee80211_is_pspoll(hdr->frame_control))) { 1354 if (!test_sta_flag(rx->sta, WLAN_STA_SP)) { 1355 if (!test_sta_flag(rx->sta, WLAN_STA_PS_DRIVER)) 1356 ieee80211_sta_ps_deliver_poll_response(rx->sta); 1357 else 1358 set_sta_flag(rx->sta, WLAN_STA_PSPOLL); 1359 } 1360 1361 /* Free PS Poll skb here instead of returning RX_DROP that would 1362 * count as an dropped frame. */ 1363 dev_kfree_skb(rx->skb); 1364 1365 return RX_QUEUED; 1366 } else if (!ieee80211_has_morefrags(hdr->frame_control) && 1367 !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) && 1368 ieee80211_has_pm(hdr->frame_control) && 1369 (ieee80211_is_data_qos(hdr->frame_control) || 1370 ieee80211_is_qos_nullfunc(hdr->frame_control))) { 1371 tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK; 1372 ac = ieee802_1d_to_ac[tid & 7]; 1373 1374 /* 1375 * If this AC is not trigger-enabled do nothing. 1376 * 1377 * NB: This could/should check a separate bitmap of trigger- 1378 * enabled queues, but for now we only implement uAPSD w/o 1379 * TSPEC changes to the ACs, so they're always the same. 1380 */ 1381 if (!(rx->sta->sta.uapsd_queues & BIT(ac))) 1382 return RX_CONTINUE; 1383 1384 /* if we are in a service period, do nothing */ 1385 if (test_sta_flag(rx->sta, WLAN_STA_SP)) 1386 return RX_CONTINUE; 1387 1388 if (!test_sta_flag(rx->sta, WLAN_STA_PS_DRIVER)) 1389 ieee80211_sta_ps_deliver_uapsd(rx->sta); 1390 else 1391 set_sta_flag(rx->sta, WLAN_STA_UAPSD); 1392 } 1393 1394 return RX_CONTINUE; 1395 } 1396 1397 static ieee80211_rx_result debug_noinline 1398 ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx) 1399 { 1400 struct sta_info *sta = rx->sta; 1401 struct sk_buff *skb = rx->skb; 1402 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 1403 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; 1404 int i; 1405 1406 if (!sta) 1407 return RX_CONTINUE; 1408 1409 /* 1410 * Update last_rx only for IBSS packets which are for the current 1411 * BSSID and for station already AUTHORIZED to avoid keeping the 1412 * current IBSS network alive in cases where other STAs start 1413 * using different BSSID. This will also give the station another 1414 * chance to restart the authentication/authorization in case 1415 * something went wrong the first time. 1416 */ 1417 if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) { 1418 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len, 1419 NL80211_IFTYPE_ADHOC); 1420 if (ether_addr_equal(bssid, rx->sdata->u.ibss.bssid) && 1421 test_sta_flag(sta, WLAN_STA_AUTHORIZED)) { 1422 sta->rx_stats.last_rx = jiffies; 1423 if (ieee80211_is_data(hdr->frame_control) && 1424 !is_multicast_ether_addr(hdr->addr1)) 1425 sta->rx_stats.last_rate = 1426 sta_stats_encode_rate(status); 1427 } 1428 } else if (rx->sdata->vif.type == NL80211_IFTYPE_OCB) { 1429 sta->rx_stats.last_rx = jiffies; 1430 } else if (!is_multicast_ether_addr(hdr->addr1)) { 1431 /* 1432 * Mesh beacons will update last_rx when if they are found to 1433 * match the current local configuration when processed. 1434 */ 1435 sta->rx_stats.last_rx = jiffies; 1436 if (ieee80211_is_data(hdr->frame_control)) 1437 sta->rx_stats.last_rate = sta_stats_encode_rate(status); 1438 } 1439 1440 if (rx->sdata->vif.type == NL80211_IFTYPE_STATION) 1441 ieee80211_sta_rx_notify(rx->sdata, hdr); 1442 1443 sta->rx_stats.fragments++; 1444 1445 u64_stats_update_begin(&rx->sta->rx_stats.syncp); 1446 sta->rx_stats.bytes += rx->skb->len; 1447 u64_stats_update_end(&rx->sta->rx_stats.syncp); 1448 1449 if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) { 1450 sta->rx_stats.last_signal = status->signal; 1451 ewma_signal_add(&sta->rx_stats_avg.signal, -status->signal); 1452 } 1453 1454 if (status->chains) { 1455 sta->rx_stats.chains = status->chains; 1456 for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) { 1457 int signal = status->chain_signal[i]; 1458 1459 if (!(status->chains & BIT(i))) 1460 continue; 1461 1462 sta->rx_stats.chain_signal_last[i] = signal; 1463 ewma_signal_add(&sta->rx_stats_avg.chain_signal[i], 1464 -signal); 1465 } 1466 } 1467 1468 /* 1469 * Change STA power saving mode only at the end of a frame 1470 * exchange sequence. 1471 */ 1472 if (!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS) && 1473 !ieee80211_has_morefrags(hdr->frame_control) && 1474 !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) && 1475 (rx->sdata->vif.type == NL80211_IFTYPE_AP || 1476 rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) && 1477 /* PM bit is only checked in frames where it isn't reserved, 1478 * in AP mode it's reserved in non-bufferable management frames 1479 * (cf. IEEE 802.11-2012 8.2.4.1.7 Power Management field) 1480 */ 1481 (!ieee80211_is_mgmt(hdr->frame_control) || 1482 ieee80211_is_bufferable_mmpdu(hdr->frame_control))) { 1483 if (test_sta_flag(sta, WLAN_STA_PS_STA)) { 1484 if (!ieee80211_has_pm(hdr->frame_control)) 1485 sta_ps_end(sta); 1486 } else { 1487 if (ieee80211_has_pm(hdr->frame_control)) 1488 sta_ps_start(sta); 1489 } 1490 } 1491 1492 /* mesh power save support */ 1493 if (ieee80211_vif_is_mesh(&rx->sdata->vif)) 1494 ieee80211_mps_rx_h_sta_process(sta, hdr); 1495 1496 /* 1497 * Drop (qos-)data::nullfunc frames silently, since they 1498 * are used only to control station power saving mode. 1499 */ 1500 if (ieee80211_is_nullfunc(hdr->frame_control) || 1501 ieee80211_is_qos_nullfunc(hdr->frame_control)) { 1502 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc); 1503 1504 /* 1505 * If we receive a 4-addr nullfunc frame from a STA 1506 * that was not moved to a 4-addr STA vlan yet send 1507 * the event to userspace and for older hostapd drop 1508 * the frame to the monitor interface. 1509 */ 1510 if (ieee80211_has_a4(hdr->frame_control) && 1511 (rx->sdata->vif.type == NL80211_IFTYPE_AP || 1512 (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN && 1513 !rx->sdata->u.vlan.sta))) { 1514 if (!test_and_set_sta_flag(sta, WLAN_STA_4ADDR_EVENT)) 1515 cfg80211_rx_unexpected_4addr_frame( 1516 rx->sdata->dev, sta->sta.addr, 1517 GFP_ATOMIC); 1518 return RX_DROP_MONITOR; 1519 } 1520 /* 1521 * Update counter and free packet here to avoid 1522 * counting this as a dropped packed. 1523 */ 1524 sta->rx_stats.packets++; 1525 dev_kfree_skb(rx->skb); 1526 return RX_QUEUED; 1527 } 1528 1529 return RX_CONTINUE; 1530 } /* ieee80211_rx_h_sta_process */ 1531 1532 static ieee80211_rx_result debug_noinline 1533 ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx) 1534 { 1535 struct sk_buff *skb = rx->skb; 1536 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 1537 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; 1538 int keyidx; 1539 int hdrlen; 1540 ieee80211_rx_result result = RX_DROP_UNUSABLE; 1541 struct ieee80211_key *sta_ptk = NULL; 1542 int mmie_keyidx = -1; 1543 __le16 fc; 1544 const struct ieee80211_cipher_scheme *cs = NULL; 1545 1546 /* 1547 * Key selection 101 1548 * 1549 * There are four types of keys: 1550 * - GTK (group keys) 1551 * - IGTK (group keys for management frames) 1552 * - PTK (pairwise keys) 1553 * - STK (station-to-station pairwise keys) 1554 * 1555 * When selecting a key, we have to distinguish between multicast 1556 * (including broadcast) and unicast frames, the latter can only 1557 * use PTKs and STKs while the former always use GTKs and IGTKs. 1558 * Unless, of course, actual WEP keys ("pre-RSNA") are used, then 1559 * unicast frames can also use key indices like GTKs. Hence, if we 1560 * don't have a PTK/STK we check the key index for a WEP key. 1561 * 1562 * Note that in a regular BSS, multicast frames are sent by the 1563 * AP only, associated stations unicast the frame to the AP first 1564 * which then multicasts it on their behalf. 1565 * 1566 * There is also a slight problem in IBSS mode: GTKs are negotiated 1567 * with each station, that is something we don't currently handle. 1568 * The spec seems to expect that one negotiates the same key with 1569 * every station but there's no such requirement; VLANs could be 1570 * possible. 1571 */ 1572 1573 /* start without a key */ 1574 rx->key = NULL; 1575 fc = hdr->frame_control; 1576 1577 if (rx->sta) { 1578 int keyid = rx->sta->ptk_idx; 1579 1580 if (ieee80211_has_protected(fc) && rx->sta->cipher_scheme) { 1581 cs = rx->sta->cipher_scheme; 1582 keyid = ieee80211_get_cs_keyid(cs, rx->skb); 1583 if (unlikely(keyid < 0)) 1584 return RX_DROP_UNUSABLE; 1585 } 1586 sta_ptk = rcu_dereference(rx->sta->ptk[keyid]); 1587 } 1588 1589 if (!ieee80211_has_protected(fc)) 1590 mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb); 1591 1592 if (!is_multicast_ether_addr(hdr->addr1) && sta_ptk) { 1593 rx->key = sta_ptk; 1594 if ((status->flag & RX_FLAG_DECRYPTED) && 1595 (status->flag & RX_FLAG_IV_STRIPPED)) 1596 return RX_CONTINUE; 1597 /* Skip decryption if the frame is not protected. */ 1598 if (!ieee80211_has_protected(fc)) 1599 return RX_CONTINUE; 1600 } else if (mmie_keyidx >= 0) { 1601 /* Broadcast/multicast robust management frame / BIP */ 1602 if ((status->flag & RX_FLAG_DECRYPTED) && 1603 (status->flag & RX_FLAG_IV_STRIPPED)) 1604 return RX_CONTINUE; 1605 1606 if (mmie_keyidx < NUM_DEFAULT_KEYS || 1607 mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS) 1608 return RX_DROP_MONITOR; /* unexpected BIP keyidx */ 1609 if (rx->sta) 1610 rx->key = rcu_dereference(rx->sta->gtk[mmie_keyidx]); 1611 if (!rx->key) 1612 rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]); 1613 } else if (!ieee80211_has_protected(fc)) { 1614 /* 1615 * The frame was not protected, so skip decryption. However, we 1616 * need to set rx->key if there is a key that could have been 1617 * used so that the frame may be dropped if encryption would 1618 * have been expected. 1619 */ 1620 struct ieee80211_key *key = NULL; 1621 struct ieee80211_sub_if_data *sdata = rx->sdata; 1622 int i; 1623 1624 if (ieee80211_is_mgmt(fc) && 1625 is_multicast_ether_addr(hdr->addr1) && 1626 (key = rcu_dereference(rx->sdata->default_mgmt_key))) 1627 rx->key = key; 1628 else { 1629 if (rx->sta) { 1630 for (i = 0; i < NUM_DEFAULT_KEYS; i++) { 1631 key = rcu_dereference(rx->sta->gtk[i]); 1632 if (key) 1633 break; 1634 } 1635 } 1636 if (!key) { 1637 for (i = 0; i < NUM_DEFAULT_KEYS; i++) { 1638 key = rcu_dereference(sdata->keys[i]); 1639 if (key) 1640 break; 1641 } 1642 } 1643 if (key) 1644 rx->key = key; 1645 } 1646 return RX_CONTINUE; 1647 } else { 1648 u8 keyid; 1649 1650 /* 1651 * The device doesn't give us the IV so we won't be 1652 * able to look up the key. That's ok though, we 1653 * don't need to decrypt the frame, we just won't 1654 * be able to keep statistics accurate. 1655 * Except for key threshold notifications, should 1656 * we somehow allow the driver to tell us which key 1657 * the hardware used if this flag is set? 1658 */ 1659 if ((status->flag & RX_FLAG_DECRYPTED) && 1660 (status->flag & RX_FLAG_IV_STRIPPED)) 1661 return RX_CONTINUE; 1662 1663 hdrlen = ieee80211_hdrlen(fc); 1664 1665 if (cs) { 1666 keyidx = ieee80211_get_cs_keyid(cs, rx->skb); 1667 1668 if (unlikely(keyidx < 0)) 1669 return RX_DROP_UNUSABLE; 1670 } else { 1671 if (rx->skb->len < 8 + hdrlen) 1672 return RX_DROP_UNUSABLE; /* TODO: count this? */ 1673 /* 1674 * no need to call ieee80211_wep_get_keyidx, 1675 * it verifies a bunch of things we've done already 1676 */ 1677 skb_copy_bits(rx->skb, hdrlen + 3, &keyid, 1); 1678 keyidx = keyid >> 6; 1679 } 1680 1681 /* check per-station GTK first, if multicast packet */ 1682 if (is_multicast_ether_addr(hdr->addr1) && rx->sta) 1683 rx->key = rcu_dereference(rx->sta->gtk[keyidx]); 1684 1685 /* if not found, try default key */ 1686 if (!rx->key) { 1687 rx->key = rcu_dereference(rx->sdata->keys[keyidx]); 1688 1689 /* 1690 * RSNA-protected unicast frames should always be 1691 * sent with pairwise or station-to-station keys, 1692 * but for WEP we allow using a key index as well. 1693 */ 1694 if (rx->key && 1695 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 && 1696 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 && 1697 !is_multicast_ether_addr(hdr->addr1)) 1698 rx->key = NULL; 1699 } 1700 } 1701 1702 if (rx->key) { 1703 if (unlikely(rx->key->flags & KEY_FLAG_TAINTED)) 1704 return RX_DROP_MONITOR; 1705 1706 /* TODO: add threshold stuff again */ 1707 } else { 1708 return RX_DROP_MONITOR; 1709 } 1710 1711 switch (rx->key->conf.cipher) { 1712 case WLAN_CIPHER_SUITE_WEP40: 1713 case WLAN_CIPHER_SUITE_WEP104: 1714 result = ieee80211_crypto_wep_decrypt(rx); 1715 break; 1716 case WLAN_CIPHER_SUITE_TKIP: 1717 result = ieee80211_crypto_tkip_decrypt(rx); 1718 break; 1719 case WLAN_CIPHER_SUITE_CCMP: 1720 result = ieee80211_crypto_ccmp_decrypt( 1721 rx, IEEE80211_CCMP_MIC_LEN); 1722 break; 1723 case WLAN_CIPHER_SUITE_CCMP_256: 1724 result = ieee80211_crypto_ccmp_decrypt( 1725 rx, IEEE80211_CCMP_256_MIC_LEN); 1726 break; 1727 case WLAN_CIPHER_SUITE_AES_CMAC: 1728 result = ieee80211_crypto_aes_cmac_decrypt(rx); 1729 break; 1730 case WLAN_CIPHER_SUITE_BIP_CMAC_256: 1731 result = ieee80211_crypto_aes_cmac_256_decrypt(rx); 1732 break; 1733 case WLAN_CIPHER_SUITE_BIP_GMAC_128: 1734 case WLAN_CIPHER_SUITE_BIP_GMAC_256: 1735 result = ieee80211_crypto_aes_gmac_decrypt(rx); 1736 break; 1737 case WLAN_CIPHER_SUITE_GCMP: 1738 case WLAN_CIPHER_SUITE_GCMP_256: 1739 result = ieee80211_crypto_gcmp_decrypt(rx); 1740 break; 1741 default: 1742 result = ieee80211_crypto_hw_decrypt(rx); 1743 } 1744 1745 /* the hdr variable is invalid after the decrypt handlers */ 1746 1747 /* either the frame has been decrypted or will be dropped */ 1748 status->flag |= RX_FLAG_DECRYPTED; 1749 1750 return result; 1751 } 1752 1753 static inline struct ieee80211_fragment_entry * 1754 ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata, 1755 unsigned int frag, unsigned int seq, int rx_queue, 1756 struct sk_buff **skb) 1757 { 1758 struct ieee80211_fragment_entry *entry; 1759 1760 entry = &sdata->fragments[sdata->fragment_next++]; 1761 if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX) 1762 sdata->fragment_next = 0; 1763 1764 if (!skb_queue_empty(&entry->skb_list)) 1765 __skb_queue_purge(&entry->skb_list); 1766 1767 __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */ 1768 *skb = NULL; 1769 entry->first_frag_time = jiffies; 1770 entry->seq = seq; 1771 entry->rx_queue = rx_queue; 1772 entry->last_frag = frag; 1773 entry->check_sequential_pn = false; 1774 entry->extra_len = 0; 1775 1776 return entry; 1777 } 1778 1779 static inline struct ieee80211_fragment_entry * 1780 ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata, 1781 unsigned int frag, unsigned int seq, 1782 int rx_queue, struct ieee80211_hdr *hdr) 1783 { 1784 struct ieee80211_fragment_entry *entry; 1785 int i, idx; 1786 1787 idx = sdata->fragment_next; 1788 for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) { 1789 struct ieee80211_hdr *f_hdr; 1790 1791 idx--; 1792 if (idx < 0) 1793 idx = IEEE80211_FRAGMENT_MAX - 1; 1794 1795 entry = &sdata->fragments[idx]; 1796 if (skb_queue_empty(&entry->skb_list) || entry->seq != seq || 1797 entry->rx_queue != rx_queue || 1798 entry->last_frag + 1 != frag) 1799 continue; 1800 1801 f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data; 1802 1803 /* 1804 * Check ftype and addresses are equal, else check next fragment 1805 */ 1806 if (((hdr->frame_control ^ f_hdr->frame_control) & 1807 cpu_to_le16(IEEE80211_FCTL_FTYPE)) || 1808 !ether_addr_equal(hdr->addr1, f_hdr->addr1) || 1809 !ether_addr_equal(hdr->addr2, f_hdr->addr2)) 1810 continue; 1811 1812 if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) { 1813 __skb_queue_purge(&entry->skb_list); 1814 continue; 1815 } 1816 return entry; 1817 } 1818 1819 return NULL; 1820 } 1821 1822 static ieee80211_rx_result debug_noinline 1823 ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx) 1824 { 1825 struct ieee80211_hdr *hdr; 1826 u16 sc; 1827 __le16 fc; 1828 unsigned int frag, seq; 1829 struct ieee80211_fragment_entry *entry; 1830 struct sk_buff *skb; 1831 struct ieee80211_rx_status *status; 1832 1833 hdr = (struct ieee80211_hdr *)rx->skb->data; 1834 fc = hdr->frame_control; 1835 1836 if (ieee80211_is_ctl(fc)) 1837 return RX_CONTINUE; 1838 1839 sc = le16_to_cpu(hdr->seq_ctrl); 1840 frag = sc & IEEE80211_SCTL_FRAG; 1841 1842 if (is_multicast_ether_addr(hdr->addr1)) { 1843 I802_DEBUG_INC(rx->local->dot11MulticastReceivedFrameCount); 1844 goto out_no_led; 1845 } 1846 1847 if (likely(!ieee80211_has_morefrags(fc) && frag == 0)) 1848 goto out; 1849 1850 I802_DEBUG_INC(rx->local->rx_handlers_fragments); 1851 1852 if (skb_linearize(rx->skb)) 1853 return RX_DROP_UNUSABLE; 1854 1855 /* 1856 * skb_linearize() might change the skb->data and 1857 * previously cached variables (in this case, hdr) need to 1858 * be refreshed with the new data. 1859 */ 1860 hdr = (struct ieee80211_hdr *)rx->skb->data; 1861 seq = (sc & IEEE80211_SCTL_SEQ) >> 4; 1862 1863 if (frag == 0) { 1864 /* This is the first fragment of a new frame. */ 1865 entry = ieee80211_reassemble_add(rx->sdata, frag, seq, 1866 rx->seqno_idx, &(rx->skb)); 1867 if (rx->key && 1868 (rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP || 1869 rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP_256 || 1870 rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP || 1871 rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP_256) && 1872 ieee80211_has_protected(fc)) { 1873 int queue = rx->security_idx; 1874 1875 /* Store CCMP/GCMP PN so that we can verify that the 1876 * next fragment has a sequential PN value. 1877 */ 1878 entry->check_sequential_pn = true; 1879 memcpy(entry->last_pn, 1880 rx->key->u.ccmp.rx_pn[queue], 1881 IEEE80211_CCMP_PN_LEN); 1882 BUILD_BUG_ON(offsetof(struct ieee80211_key, 1883 u.ccmp.rx_pn) != 1884 offsetof(struct ieee80211_key, 1885 u.gcmp.rx_pn)); 1886 BUILD_BUG_ON(sizeof(rx->key->u.ccmp.rx_pn[queue]) != 1887 sizeof(rx->key->u.gcmp.rx_pn[queue])); 1888 BUILD_BUG_ON(IEEE80211_CCMP_PN_LEN != 1889 IEEE80211_GCMP_PN_LEN); 1890 } 1891 return RX_QUEUED; 1892 } 1893 1894 /* This is a fragment for a frame that should already be pending in 1895 * fragment cache. Add this fragment to the end of the pending entry. 1896 */ 1897 entry = ieee80211_reassemble_find(rx->sdata, frag, seq, 1898 rx->seqno_idx, hdr); 1899 if (!entry) { 1900 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag); 1901 return RX_DROP_MONITOR; 1902 } 1903 1904 /* "The receiver shall discard MSDUs and MMPDUs whose constituent 1905 * MPDU PN values are not incrementing in steps of 1." 1906 * see IEEE P802.11-REVmc/D5.0, 12.5.3.4.4, item d (for CCMP) 1907 * and IEEE P802.11-REVmc/D5.0, 12.5.5.4.4, item d (for GCMP) 1908 */ 1909 if (entry->check_sequential_pn) { 1910 int i; 1911 u8 pn[IEEE80211_CCMP_PN_LEN], *rpn; 1912 int queue; 1913 1914 if (!rx->key || 1915 (rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP && 1916 rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP_256 && 1917 rx->key->conf.cipher != WLAN_CIPHER_SUITE_GCMP && 1918 rx->key->conf.cipher != WLAN_CIPHER_SUITE_GCMP_256)) 1919 return RX_DROP_UNUSABLE; 1920 memcpy(pn, entry->last_pn, IEEE80211_CCMP_PN_LEN); 1921 for (i = IEEE80211_CCMP_PN_LEN - 1; i >= 0; i--) { 1922 pn[i]++; 1923 if (pn[i]) 1924 break; 1925 } 1926 queue = rx->security_idx; 1927 rpn = rx->key->u.ccmp.rx_pn[queue]; 1928 if (memcmp(pn, rpn, IEEE80211_CCMP_PN_LEN)) 1929 return RX_DROP_UNUSABLE; 1930 memcpy(entry->last_pn, pn, IEEE80211_CCMP_PN_LEN); 1931 } 1932 1933 skb_pull(rx->skb, ieee80211_hdrlen(fc)); 1934 __skb_queue_tail(&entry->skb_list, rx->skb); 1935 entry->last_frag = frag; 1936 entry->extra_len += rx->skb->len; 1937 if (ieee80211_has_morefrags(fc)) { 1938 rx->skb = NULL; 1939 return RX_QUEUED; 1940 } 1941 1942 rx->skb = __skb_dequeue(&entry->skb_list); 1943 if (skb_tailroom(rx->skb) < entry->extra_len) { 1944 I802_DEBUG_INC(rx->local->rx_expand_skb_head_defrag); 1945 if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len, 1946 GFP_ATOMIC))) { 1947 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag); 1948 __skb_queue_purge(&entry->skb_list); 1949 return RX_DROP_UNUSABLE; 1950 } 1951 } 1952 while ((skb = __skb_dequeue(&entry->skb_list))) { 1953 memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len); 1954 dev_kfree_skb(skb); 1955 } 1956 1957 /* Complete frame has been reassembled - process it now */ 1958 status = IEEE80211_SKB_RXCB(rx->skb); 1959 1960 out: 1961 ieee80211_led_rx(rx->local); 1962 out_no_led: 1963 if (rx->sta) 1964 rx->sta->rx_stats.packets++; 1965 return RX_CONTINUE; 1966 } 1967 1968 static int ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx) 1969 { 1970 if (unlikely(!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_AUTHORIZED))) 1971 return -EACCES; 1972 1973 return 0; 1974 } 1975 1976 static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc) 1977 { 1978 struct sk_buff *skb = rx->skb; 1979 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 1980 1981 /* 1982 * Pass through unencrypted frames if the hardware has 1983 * decrypted them already. 1984 */ 1985 if (status->flag & RX_FLAG_DECRYPTED) 1986 return 0; 1987 1988 /* Drop unencrypted frames if key is set. */ 1989 if (unlikely(!ieee80211_has_protected(fc) && 1990 !ieee80211_is_nullfunc(fc) && 1991 ieee80211_is_data(fc) && rx->key)) 1992 return -EACCES; 1993 1994 return 0; 1995 } 1996 1997 static int ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx) 1998 { 1999 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 2000 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 2001 __le16 fc = hdr->frame_control; 2002 2003 /* 2004 * Pass through unencrypted frames if the hardware has 2005 * decrypted them already. 2006 */ 2007 if (status->flag & RX_FLAG_DECRYPTED) 2008 return 0; 2009 2010 if (rx->sta && test_sta_flag(rx->sta, WLAN_STA_MFP)) { 2011 if (unlikely(!ieee80211_has_protected(fc) && 2012 ieee80211_is_unicast_robust_mgmt_frame(rx->skb) && 2013 rx->key)) { 2014 if (ieee80211_is_deauth(fc) || 2015 ieee80211_is_disassoc(fc)) 2016 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev, 2017 rx->skb->data, 2018 rx->skb->len); 2019 return -EACCES; 2020 } 2021 /* BIP does not use Protected field, so need to check MMIE */ 2022 if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) && 2023 ieee80211_get_mmie_keyidx(rx->skb) < 0)) { 2024 if (ieee80211_is_deauth(fc) || 2025 ieee80211_is_disassoc(fc)) 2026 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev, 2027 rx->skb->data, 2028 rx->skb->len); 2029 return -EACCES; 2030 } 2031 /* 2032 * When using MFP, Action frames are not allowed prior to 2033 * having configured keys. 2034 */ 2035 if (unlikely(ieee80211_is_action(fc) && !rx->key && 2036 ieee80211_is_robust_mgmt_frame(rx->skb))) 2037 return -EACCES; 2038 } 2039 2040 return 0; 2041 } 2042 2043 static int 2044 __ieee80211_data_to_8023(struct ieee80211_rx_data *rx, bool *port_control) 2045 { 2046 struct ieee80211_sub_if_data *sdata = rx->sdata; 2047 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 2048 bool check_port_control = false; 2049 struct ethhdr *ehdr; 2050 int ret; 2051 2052 *port_control = false; 2053 if (ieee80211_has_a4(hdr->frame_control) && 2054 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta) 2055 return -1; 2056 2057 if (sdata->vif.type == NL80211_IFTYPE_STATION && 2058 !!sdata->u.mgd.use_4addr != !!ieee80211_has_a4(hdr->frame_control)) { 2059 2060 if (!sdata->u.mgd.use_4addr) 2061 return -1; 2062 else 2063 check_port_control = true; 2064 } 2065 2066 if (is_multicast_ether_addr(hdr->addr1) && 2067 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta) 2068 return -1; 2069 2070 ret = ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type); 2071 if (ret < 0) 2072 return ret; 2073 2074 ehdr = (struct ethhdr *) rx->skb->data; 2075 if (ehdr->h_proto == rx->sdata->control_port_protocol) 2076 *port_control = true; 2077 else if (check_port_control) 2078 return -1; 2079 2080 return 0; 2081 } 2082 2083 /* 2084 * requires that rx->skb is a frame with ethernet header 2085 */ 2086 static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc) 2087 { 2088 static const u8 pae_group_addr[ETH_ALEN] __aligned(2) 2089 = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 }; 2090 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data; 2091 2092 /* 2093 * Allow EAPOL frames to us/the PAE group address regardless 2094 * of whether the frame was encrypted or not. 2095 */ 2096 if (ehdr->h_proto == rx->sdata->control_port_protocol && 2097 (ether_addr_equal(ehdr->h_dest, rx->sdata->vif.addr) || 2098 ether_addr_equal(ehdr->h_dest, pae_group_addr))) 2099 return true; 2100 2101 if (ieee80211_802_1x_port_control(rx) || 2102 ieee80211_drop_unencrypted(rx, fc)) 2103 return false; 2104 2105 return true; 2106 } 2107 2108 /* 2109 * requires that rx->skb is a frame with ethernet header 2110 */ 2111 static void 2112 ieee80211_deliver_skb(struct ieee80211_rx_data *rx) 2113 { 2114 struct ieee80211_sub_if_data *sdata = rx->sdata; 2115 struct net_device *dev = sdata->dev; 2116 struct sk_buff *skb, *xmit_skb; 2117 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data; 2118 struct sta_info *dsta; 2119 2120 skb = rx->skb; 2121 xmit_skb = NULL; 2122 2123 ieee80211_rx_stats(dev, skb->len); 2124 2125 if (rx->sta) { 2126 /* The seqno index has the same property as needed 2127 * for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS 2128 * for non-QoS-data frames. Here we know it's a data 2129 * frame, so count MSDUs. 2130 */ 2131 u64_stats_update_begin(&rx->sta->rx_stats.syncp); 2132 rx->sta->rx_stats.msdu[rx->seqno_idx]++; 2133 u64_stats_update_end(&rx->sta->rx_stats.syncp); 2134 } 2135 2136 if ((sdata->vif.type == NL80211_IFTYPE_AP || 2137 sdata->vif.type == NL80211_IFTYPE_AP_VLAN) && 2138 !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) && 2139 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) { 2140 if (is_multicast_ether_addr(ehdr->h_dest)) { 2141 /* 2142 * send multicast frames both to higher layers in 2143 * local net stack and back to the wireless medium 2144 */ 2145 xmit_skb = skb_copy(skb, GFP_ATOMIC); 2146 if (!xmit_skb) 2147 net_info_ratelimited("%s: failed to clone multicast frame\n", 2148 dev->name); 2149 } else { 2150 dsta = sta_info_get(sdata, skb->data); 2151 if (dsta) { 2152 /* 2153 * The destination station is associated to 2154 * this AP (in this VLAN), so send the frame 2155 * directly to it and do not pass it to local 2156 * net stack. 2157 */ 2158 xmit_skb = skb; 2159 skb = NULL; 2160 } 2161 } 2162 } 2163 2164 #ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS 2165 if (skb) { 2166 /* 'align' will only take the values 0 or 2 here since all 2167 * frames are required to be aligned to 2-byte boundaries 2168 * when being passed to mac80211; the code here works just 2169 * as well if that isn't true, but mac80211 assumes it can 2170 * access fields as 2-byte aligned (e.g. for ether_addr_equal) 2171 */ 2172 int align; 2173 2174 align = (unsigned long)(skb->data + sizeof(struct ethhdr)) & 3; 2175 if (align) { 2176 if (WARN_ON(skb_headroom(skb) < 3)) { 2177 dev_kfree_skb(skb); 2178 skb = NULL; 2179 } else { 2180 u8 *data = skb->data; 2181 size_t len = skb_headlen(skb); 2182 skb->data -= align; 2183 memmove(skb->data, data, len); 2184 skb_set_tail_pointer(skb, len); 2185 } 2186 } 2187 } 2188 #endif 2189 2190 if (skb) { 2191 /* deliver to local stack */ 2192 skb->protocol = eth_type_trans(skb, dev); 2193 memset(skb->cb, 0, sizeof(skb->cb)); 2194 if (rx->napi) 2195 napi_gro_receive(rx->napi, skb); 2196 else 2197 netif_receive_skb(skb); 2198 } 2199 2200 if (xmit_skb) { 2201 /* 2202 * Send to wireless media and increase priority by 256 to 2203 * keep the received priority instead of reclassifying 2204 * the frame (see cfg80211_classify8021d). 2205 */ 2206 xmit_skb->priority += 256; 2207 xmit_skb->protocol = htons(ETH_P_802_3); 2208 skb_reset_network_header(xmit_skb); 2209 skb_reset_mac_header(xmit_skb); 2210 dev_queue_xmit(xmit_skb); 2211 } 2212 } 2213 2214 static ieee80211_rx_result debug_noinline 2215 ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx) 2216 { 2217 struct net_device *dev = rx->sdata->dev; 2218 struct sk_buff *skb = rx->skb; 2219 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; 2220 __le16 fc = hdr->frame_control; 2221 struct sk_buff_head frame_list; 2222 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 2223 2224 if (unlikely(!ieee80211_is_data(fc))) 2225 return RX_CONTINUE; 2226 2227 if (unlikely(!ieee80211_is_data_present(fc))) 2228 return RX_DROP_MONITOR; 2229 2230 if (!(status->rx_flags & IEEE80211_RX_AMSDU)) 2231 return RX_CONTINUE; 2232 2233 if (ieee80211_has_a4(hdr->frame_control) && 2234 rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN && 2235 !rx->sdata->u.vlan.sta) 2236 return RX_DROP_UNUSABLE; 2237 2238 if (is_multicast_ether_addr(hdr->addr1) && 2239 ((rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN && 2240 rx->sdata->u.vlan.sta) || 2241 (rx->sdata->vif.type == NL80211_IFTYPE_STATION && 2242 rx->sdata->u.mgd.use_4addr))) 2243 return RX_DROP_UNUSABLE; 2244 2245 skb->dev = dev; 2246 __skb_queue_head_init(&frame_list); 2247 2248 ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr, 2249 rx->sdata->vif.type, 2250 rx->local->hw.extra_tx_headroom, true); 2251 2252 while (!skb_queue_empty(&frame_list)) { 2253 rx->skb = __skb_dequeue(&frame_list); 2254 2255 if (!ieee80211_frame_allowed(rx, fc)) { 2256 dev_kfree_skb(rx->skb); 2257 continue; 2258 } 2259 2260 ieee80211_deliver_skb(rx); 2261 } 2262 2263 return RX_QUEUED; 2264 } 2265 2266 #ifdef CONFIG_MAC80211_MESH 2267 static ieee80211_rx_result 2268 ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx) 2269 { 2270 struct ieee80211_hdr *fwd_hdr, *hdr; 2271 struct ieee80211_tx_info *info; 2272 struct ieee80211s_hdr *mesh_hdr; 2273 struct sk_buff *skb = rx->skb, *fwd_skb; 2274 struct ieee80211_local *local = rx->local; 2275 struct ieee80211_sub_if_data *sdata = rx->sdata; 2276 struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh; 2277 u16 ac, q, hdrlen; 2278 2279 hdr = (struct ieee80211_hdr *) skb->data; 2280 hdrlen = ieee80211_hdrlen(hdr->frame_control); 2281 2282 /* make sure fixed part of mesh header is there, also checks skb len */ 2283 if (!pskb_may_pull(rx->skb, hdrlen + 6)) 2284 return RX_DROP_MONITOR; 2285 2286 mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen); 2287 2288 /* make sure full mesh header is there, also checks skb len */ 2289 if (!pskb_may_pull(rx->skb, 2290 hdrlen + ieee80211_get_mesh_hdrlen(mesh_hdr))) 2291 return RX_DROP_MONITOR; 2292 2293 /* reload pointers */ 2294 hdr = (struct ieee80211_hdr *) skb->data; 2295 mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen); 2296 2297 if (ieee80211_drop_unencrypted(rx, hdr->frame_control)) 2298 return RX_DROP_MONITOR; 2299 2300 /* frame is in RMC, don't forward */ 2301 if (ieee80211_is_data(hdr->frame_control) && 2302 is_multicast_ether_addr(hdr->addr1) && 2303 mesh_rmc_check(rx->sdata, hdr->addr3, mesh_hdr)) 2304 return RX_DROP_MONITOR; 2305 2306 if (!ieee80211_is_data(hdr->frame_control)) 2307 return RX_CONTINUE; 2308 2309 if (!mesh_hdr->ttl) 2310 return RX_DROP_MONITOR; 2311 2312 if (mesh_hdr->flags & MESH_FLAGS_AE) { 2313 struct mesh_path *mppath; 2314 char *proxied_addr; 2315 char *mpp_addr; 2316 2317 if (is_multicast_ether_addr(hdr->addr1)) { 2318 mpp_addr = hdr->addr3; 2319 proxied_addr = mesh_hdr->eaddr1; 2320 } else if (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6) { 2321 /* has_a4 already checked in ieee80211_rx_mesh_check */ 2322 mpp_addr = hdr->addr4; 2323 proxied_addr = mesh_hdr->eaddr2; 2324 } else { 2325 return RX_DROP_MONITOR; 2326 } 2327 2328 rcu_read_lock(); 2329 mppath = mpp_path_lookup(sdata, proxied_addr); 2330 if (!mppath) { 2331 mpp_path_add(sdata, proxied_addr, mpp_addr); 2332 } else { 2333 spin_lock_bh(&mppath->state_lock); 2334 if (!ether_addr_equal(mppath->mpp, mpp_addr)) 2335 memcpy(mppath->mpp, mpp_addr, ETH_ALEN); 2336 mppath->exp_time = jiffies; 2337 spin_unlock_bh(&mppath->state_lock); 2338 } 2339 rcu_read_unlock(); 2340 } 2341 2342 /* Frame has reached destination. Don't forward */ 2343 if (!is_multicast_ether_addr(hdr->addr1) && 2344 ether_addr_equal(sdata->vif.addr, hdr->addr3)) 2345 return RX_CONTINUE; 2346 2347 ac = ieee80211_select_queue_80211(sdata, skb, hdr); 2348 q = sdata->vif.hw_queue[ac]; 2349 if (ieee80211_queue_stopped(&local->hw, q)) { 2350 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion); 2351 return RX_DROP_MONITOR; 2352 } 2353 skb_set_queue_mapping(skb, q); 2354 2355 if (!--mesh_hdr->ttl) { 2356 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl); 2357 goto out; 2358 } 2359 2360 if (!ifmsh->mshcfg.dot11MeshForwarding) 2361 goto out; 2362 2363 fwd_skb = skb_copy(skb, GFP_ATOMIC); 2364 if (!fwd_skb) { 2365 net_info_ratelimited("%s: failed to clone mesh frame\n", 2366 sdata->name); 2367 goto out; 2368 } 2369 2370 fwd_hdr = (struct ieee80211_hdr *) fwd_skb->data; 2371 fwd_hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_RETRY); 2372 info = IEEE80211_SKB_CB(fwd_skb); 2373 memset(info, 0, sizeof(*info)); 2374 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING; 2375 info->control.vif = &rx->sdata->vif; 2376 info->control.jiffies = jiffies; 2377 if (is_multicast_ether_addr(fwd_hdr->addr1)) { 2378 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_mcast); 2379 memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN); 2380 /* update power mode indication when forwarding */ 2381 ieee80211_mps_set_frame_flags(sdata, NULL, fwd_hdr); 2382 } else if (!mesh_nexthop_lookup(sdata, fwd_skb)) { 2383 /* mesh power mode flags updated in mesh_nexthop_lookup */ 2384 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast); 2385 } else { 2386 /* unable to resolve next hop */ 2387 mesh_path_error_tx(sdata, ifmsh->mshcfg.element_ttl, 2388 fwd_hdr->addr3, 0, 2389 WLAN_REASON_MESH_PATH_NOFORWARD, 2390 fwd_hdr->addr2); 2391 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_no_route); 2392 kfree_skb(fwd_skb); 2393 return RX_DROP_MONITOR; 2394 } 2395 2396 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames); 2397 ieee80211_add_pending_skb(local, fwd_skb); 2398 out: 2399 if (is_multicast_ether_addr(hdr->addr1)) 2400 return RX_CONTINUE; 2401 return RX_DROP_MONITOR; 2402 } 2403 #endif 2404 2405 static ieee80211_rx_result debug_noinline 2406 ieee80211_rx_h_data(struct ieee80211_rx_data *rx) 2407 { 2408 struct ieee80211_sub_if_data *sdata = rx->sdata; 2409 struct ieee80211_local *local = rx->local; 2410 struct net_device *dev = sdata->dev; 2411 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 2412 __le16 fc = hdr->frame_control; 2413 bool port_control; 2414 int err; 2415 2416 if (unlikely(!ieee80211_is_data(hdr->frame_control))) 2417 return RX_CONTINUE; 2418 2419 if (unlikely(!ieee80211_is_data_present(hdr->frame_control))) 2420 return RX_DROP_MONITOR; 2421 2422 /* 2423 * Send unexpected-4addr-frame event to hostapd. For older versions, 2424 * also drop the frame to cooked monitor interfaces. 2425 */ 2426 if (ieee80211_has_a4(hdr->frame_control) && 2427 sdata->vif.type == NL80211_IFTYPE_AP) { 2428 if (rx->sta && 2429 !test_and_set_sta_flag(rx->sta, WLAN_STA_4ADDR_EVENT)) 2430 cfg80211_rx_unexpected_4addr_frame( 2431 rx->sdata->dev, rx->sta->sta.addr, GFP_ATOMIC); 2432 return RX_DROP_MONITOR; 2433 } 2434 2435 err = __ieee80211_data_to_8023(rx, &port_control); 2436 if (unlikely(err)) 2437 return RX_DROP_UNUSABLE; 2438 2439 if (!ieee80211_frame_allowed(rx, fc)) 2440 return RX_DROP_MONITOR; 2441 2442 /* directly handle TDLS channel switch requests/responses */ 2443 if (unlikely(((struct ethhdr *)rx->skb->data)->h_proto == 2444 cpu_to_be16(ETH_P_TDLS))) { 2445 struct ieee80211_tdls_data *tf = (void *)rx->skb->data; 2446 2447 if (pskb_may_pull(rx->skb, 2448 offsetof(struct ieee80211_tdls_data, u)) && 2449 tf->payload_type == WLAN_TDLS_SNAP_RFTYPE && 2450 tf->category == WLAN_CATEGORY_TDLS && 2451 (tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_REQUEST || 2452 tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_RESPONSE)) { 2453 skb_queue_tail(&local->skb_queue_tdls_chsw, rx->skb); 2454 schedule_work(&local->tdls_chsw_work); 2455 if (rx->sta) 2456 rx->sta->rx_stats.packets++; 2457 2458 return RX_QUEUED; 2459 } 2460 } 2461 2462 if (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN && 2463 unlikely(port_control) && sdata->bss) { 2464 sdata = container_of(sdata->bss, struct ieee80211_sub_if_data, 2465 u.ap); 2466 dev = sdata->dev; 2467 rx->sdata = sdata; 2468 } 2469 2470 rx->skb->dev = dev; 2471 2472 if (!ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS) && 2473 local->ps_sdata && local->hw.conf.dynamic_ps_timeout > 0 && 2474 !is_multicast_ether_addr( 2475 ((struct ethhdr *)rx->skb->data)->h_dest) && 2476 (!local->scanning && 2477 !test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))) 2478 mod_timer(&local->dynamic_ps_timer, jiffies + 2479 msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout)); 2480 2481 ieee80211_deliver_skb(rx); 2482 2483 return RX_QUEUED; 2484 } 2485 2486 static ieee80211_rx_result debug_noinline 2487 ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames) 2488 { 2489 struct sk_buff *skb = rx->skb; 2490 struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data; 2491 struct tid_ampdu_rx *tid_agg_rx; 2492 u16 start_seq_num; 2493 u16 tid; 2494 2495 if (likely(!ieee80211_is_ctl(bar->frame_control))) 2496 return RX_CONTINUE; 2497 2498 if (ieee80211_is_back_req(bar->frame_control)) { 2499 struct { 2500 __le16 control, start_seq_num; 2501 } __packed bar_data; 2502 struct ieee80211_event event = { 2503 .type = BAR_RX_EVENT, 2504 }; 2505 2506 if (!rx->sta) 2507 return RX_DROP_MONITOR; 2508 2509 if (skb_copy_bits(skb, offsetof(struct ieee80211_bar, control), 2510 &bar_data, sizeof(bar_data))) 2511 return RX_DROP_MONITOR; 2512 2513 tid = le16_to_cpu(bar_data.control) >> 12; 2514 2515 tid_agg_rx = rcu_dereference(rx->sta->ampdu_mlme.tid_rx[tid]); 2516 if (!tid_agg_rx) 2517 return RX_DROP_MONITOR; 2518 2519 start_seq_num = le16_to_cpu(bar_data.start_seq_num) >> 4; 2520 event.u.ba.tid = tid; 2521 event.u.ba.ssn = start_seq_num; 2522 event.u.ba.sta = &rx->sta->sta; 2523 2524 /* reset session timer */ 2525 if (tid_agg_rx->timeout) 2526 mod_timer(&tid_agg_rx->session_timer, 2527 TU_TO_EXP_TIME(tid_agg_rx->timeout)); 2528 2529 spin_lock(&tid_agg_rx->reorder_lock); 2530 /* release stored frames up to start of BAR */ 2531 ieee80211_release_reorder_frames(rx->sdata, tid_agg_rx, 2532 start_seq_num, frames); 2533 spin_unlock(&tid_agg_rx->reorder_lock); 2534 2535 drv_event_callback(rx->local, rx->sdata, &event); 2536 2537 kfree_skb(skb); 2538 return RX_QUEUED; 2539 } 2540 2541 /* 2542 * After this point, we only want management frames, 2543 * so we can drop all remaining control frames to 2544 * cooked monitor interfaces. 2545 */ 2546 return RX_DROP_MONITOR; 2547 } 2548 2549 static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata, 2550 struct ieee80211_mgmt *mgmt, 2551 size_t len) 2552 { 2553 struct ieee80211_local *local = sdata->local; 2554 struct sk_buff *skb; 2555 struct ieee80211_mgmt *resp; 2556 2557 if (!ether_addr_equal(mgmt->da, sdata->vif.addr)) { 2558 /* Not to own unicast address */ 2559 return; 2560 } 2561 2562 if (!ether_addr_equal(mgmt->sa, sdata->u.mgd.bssid) || 2563 !ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid)) { 2564 /* Not from the current AP or not associated yet. */ 2565 return; 2566 } 2567 2568 if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) { 2569 /* Too short SA Query request frame */ 2570 return; 2571 } 2572 2573 skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom); 2574 if (skb == NULL) 2575 return; 2576 2577 skb_reserve(skb, local->hw.extra_tx_headroom); 2578 resp = (struct ieee80211_mgmt *) skb_put(skb, 24); 2579 memset(resp, 0, 24); 2580 memcpy(resp->da, mgmt->sa, ETH_ALEN); 2581 memcpy(resp->sa, sdata->vif.addr, ETH_ALEN); 2582 memcpy(resp->bssid, sdata->u.mgd.bssid, ETH_ALEN); 2583 resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | 2584 IEEE80211_STYPE_ACTION); 2585 skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query)); 2586 resp->u.action.category = WLAN_CATEGORY_SA_QUERY; 2587 resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE; 2588 memcpy(resp->u.action.u.sa_query.trans_id, 2589 mgmt->u.action.u.sa_query.trans_id, 2590 WLAN_SA_QUERY_TR_ID_LEN); 2591 2592 ieee80211_tx_skb(sdata, skb); 2593 } 2594 2595 static ieee80211_rx_result debug_noinline 2596 ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx) 2597 { 2598 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data; 2599 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 2600 2601 /* 2602 * From here on, look only at management frames. 2603 * Data and control frames are already handled, 2604 * and unknown (reserved) frames are useless. 2605 */ 2606 if (rx->skb->len < 24) 2607 return RX_DROP_MONITOR; 2608 2609 if (!ieee80211_is_mgmt(mgmt->frame_control)) 2610 return RX_DROP_MONITOR; 2611 2612 if (rx->sdata->vif.type == NL80211_IFTYPE_AP && 2613 ieee80211_is_beacon(mgmt->frame_control) && 2614 !(rx->flags & IEEE80211_RX_BEACON_REPORTED)) { 2615 int sig = 0; 2616 2617 if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM)) 2618 sig = status->signal; 2619 2620 cfg80211_report_obss_beacon(rx->local->hw.wiphy, 2621 rx->skb->data, rx->skb->len, 2622 status->freq, sig); 2623 rx->flags |= IEEE80211_RX_BEACON_REPORTED; 2624 } 2625 2626 if (ieee80211_drop_unencrypted_mgmt(rx)) 2627 return RX_DROP_UNUSABLE; 2628 2629 return RX_CONTINUE; 2630 } 2631 2632 static ieee80211_rx_result debug_noinline 2633 ieee80211_rx_h_action(struct ieee80211_rx_data *rx) 2634 { 2635 struct ieee80211_local *local = rx->local; 2636 struct ieee80211_sub_if_data *sdata = rx->sdata; 2637 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data; 2638 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 2639 int len = rx->skb->len; 2640 2641 if (!ieee80211_is_action(mgmt->frame_control)) 2642 return RX_CONTINUE; 2643 2644 /* drop too small frames */ 2645 if (len < IEEE80211_MIN_ACTION_SIZE) 2646 return RX_DROP_UNUSABLE; 2647 2648 if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC && 2649 mgmt->u.action.category != WLAN_CATEGORY_SELF_PROTECTED && 2650 mgmt->u.action.category != WLAN_CATEGORY_SPECTRUM_MGMT) 2651 return RX_DROP_UNUSABLE; 2652 2653 switch (mgmt->u.action.category) { 2654 case WLAN_CATEGORY_HT: 2655 /* reject HT action frames from stations not supporting HT */ 2656 if (!rx->sta->sta.ht_cap.ht_supported) 2657 goto invalid; 2658 2659 if (sdata->vif.type != NL80211_IFTYPE_STATION && 2660 sdata->vif.type != NL80211_IFTYPE_MESH_POINT && 2661 sdata->vif.type != NL80211_IFTYPE_AP_VLAN && 2662 sdata->vif.type != NL80211_IFTYPE_AP && 2663 sdata->vif.type != NL80211_IFTYPE_ADHOC) 2664 break; 2665 2666 /* verify action & smps_control/chanwidth are present */ 2667 if (len < IEEE80211_MIN_ACTION_SIZE + 2) 2668 goto invalid; 2669 2670 switch (mgmt->u.action.u.ht_smps.action) { 2671 case WLAN_HT_ACTION_SMPS: { 2672 struct ieee80211_supported_band *sband; 2673 enum ieee80211_smps_mode smps_mode; 2674 2675 /* convert to HT capability */ 2676 switch (mgmt->u.action.u.ht_smps.smps_control) { 2677 case WLAN_HT_SMPS_CONTROL_DISABLED: 2678 smps_mode = IEEE80211_SMPS_OFF; 2679 break; 2680 case WLAN_HT_SMPS_CONTROL_STATIC: 2681 smps_mode = IEEE80211_SMPS_STATIC; 2682 break; 2683 case WLAN_HT_SMPS_CONTROL_DYNAMIC: 2684 smps_mode = IEEE80211_SMPS_DYNAMIC; 2685 break; 2686 default: 2687 goto invalid; 2688 } 2689 2690 /* if no change do nothing */ 2691 if (rx->sta->sta.smps_mode == smps_mode) 2692 goto handled; 2693 rx->sta->sta.smps_mode = smps_mode; 2694 2695 sband = rx->local->hw.wiphy->bands[status->band]; 2696 2697 rate_control_rate_update(local, sband, rx->sta, 2698 IEEE80211_RC_SMPS_CHANGED); 2699 goto handled; 2700 } 2701 case WLAN_HT_ACTION_NOTIFY_CHANWIDTH: { 2702 struct ieee80211_supported_band *sband; 2703 u8 chanwidth = mgmt->u.action.u.ht_notify_cw.chanwidth; 2704 enum ieee80211_sta_rx_bandwidth max_bw, new_bw; 2705 2706 /* If it doesn't support 40 MHz it can't change ... */ 2707 if (!(rx->sta->sta.ht_cap.cap & 2708 IEEE80211_HT_CAP_SUP_WIDTH_20_40)) 2709 goto handled; 2710 2711 if (chanwidth == IEEE80211_HT_CHANWIDTH_20MHZ) 2712 max_bw = IEEE80211_STA_RX_BW_20; 2713 else 2714 max_bw = ieee80211_sta_cap_rx_bw(rx->sta); 2715 2716 /* set cur_max_bandwidth and recalc sta bw */ 2717 rx->sta->cur_max_bandwidth = max_bw; 2718 new_bw = ieee80211_sta_cur_vht_bw(rx->sta); 2719 2720 if (rx->sta->sta.bandwidth == new_bw) 2721 goto handled; 2722 2723 rx->sta->sta.bandwidth = new_bw; 2724 sband = rx->local->hw.wiphy->bands[status->band]; 2725 2726 rate_control_rate_update(local, sband, rx->sta, 2727 IEEE80211_RC_BW_CHANGED); 2728 goto handled; 2729 } 2730 default: 2731 goto invalid; 2732 } 2733 2734 break; 2735 case WLAN_CATEGORY_PUBLIC: 2736 if (len < IEEE80211_MIN_ACTION_SIZE + 1) 2737 goto invalid; 2738 if (sdata->vif.type != NL80211_IFTYPE_STATION) 2739 break; 2740 if (!rx->sta) 2741 break; 2742 if (!ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid)) 2743 break; 2744 if (mgmt->u.action.u.ext_chan_switch.action_code != 2745 WLAN_PUB_ACTION_EXT_CHANSW_ANN) 2746 break; 2747 if (len < offsetof(struct ieee80211_mgmt, 2748 u.action.u.ext_chan_switch.variable)) 2749 goto invalid; 2750 goto queue; 2751 case WLAN_CATEGORY_VHT: 2752 if (sdata->vif.type != NL80211_IFTYPE_STATION && 2753 sdata->vif.type != NL80211_IFTYPE_MESH_POINT && 2754 sdata->vif.type != NL80211_IFTYPE_AP_VLAN && 2755 sdata->vif.type != NL80211_IFTYPE_AP && 2756 sdata->vif.type != NL80211_IFTYPE_ADHOC) 2757 break; 2758 2759 /* verify action code is present */ 2760 if (len < IEEE80211_MIN_ACTION_SIZE + 1) 2761 goto invalid; 2762 2763 switch (mgmt->u.action.u.vht_opmode_notif.action_code) { 2764 case WLAN_VHT_ACTION_OPMODE_NOTIF: { 2765 u8 opmode; 2766 2767 /* verify opmode is present */ 2768 if (len < IEEE80211_MIN_ACTION_SIZE + 2) 2769 goto invalid; 2770 2771 opmode = mgmt->u.action.u.vht_opmode_notif.operating_mode; 2772 2773 ieee80211_vht_handle_opmode(rx->sdata, rx->sta, 2774 opmode, status->band); 2775 goto handled; 2776 } 2777 case WLAN_VHT_ACTION_GROUPID_MGMT: { 2778 if (len < IEEE80211_MIN_ACTION_SIZE + 25) 2779 goto invalid; 2780 goto queue; 2781 } 2782 default: 2783 break; 2784 } 2785 break; 2786 case WLAN_CATEGORY_BACK: 2787 if (sdata->vif.type != NL80211_IFTYPE_STATION && 2788 sdata->vif.type != NL80211_IFTYPE_MESH_POINT && 2789 sdata->vif.type != NL80211_IFTYPE_AP_VLAN && 2790 sdata->vif.type != NL80211_IFTYPE_AP && 2791 sdata->vif.type != NL80211_IFTYPE_ADHOC) 2792 break; 2793 2794 /* verify action_code is present */ 2795 if (len < IEEE80211_MIN_ACTION_SIZE + 1) 2796 break; 2797 2798 switch (mgmt->u.action.u.addba_req.action_code) { 2799 case WLAN_ACTION_ADDBA_REQ: 2800 if (len < (IEEE80211_MIN_ACTION_SIZE + 2801 sizeof(mgmt->u.action.u.addba_req))) 2802 goto invalid; 2803 break; 2804 case WLAN_ACTION_ADDBA_RESP: 2805 if (len < (IEEE80211_MIN_ACTION_SIZE + 2806 sizeof(mgmt->u.action.u.addba_resp))) 2807 goto invalid; 2808 break; 2809 case WLAN_ACTION_DELBA: 2810 if (len < (IEEE80211_MIN_ACTION_SIZE + 2811 sizeof(mgmt->u.action.u.delba))) 2812 goto invalid; 2813 break; 2814 default: 2815 goto invalid; 2816 } 2817 2818 goto queue; 2819 case WLAN_CATEGORY_SPECTRUM_MGMT: 2820 /* verify action_code is present */ 2821 if (len < IEEE80211_MIN_ACTION_SIZE + 1) 2822 break; 2823 2824 switch (mgmt->u.action.u.measurement.action_code) { 2825 case WLAN_ACTION_SPCT_MSR_REQ: 2826 if (status->band != NL80211_BAND_5GHZ) 2827 break; 2828 2829 if (len < (IEEE80211_MIN_ACTION_SIZE + 2830 sizeof(mgmt->u.action.u.measurement))) 2831 break; 2832 2833 if (sdata->vif.type != NL80211_IFTYPE_STATION) 2834 break; 2835 2836 ieee80211_process_measurement_req(sdata, mgmt, len); 2837 goto handled; 2838 case WLAN_ACTION_SPCT_CHL_SWITCH: { 2839 u8 *bssid; 2840 if (len < (IEEE80211_MIN_ACTION_SIZE + 2841 sizeof(mgmt->u.action.u.chan_switch))) 2842 break; 2843 2844 if (sdata->vif.type != NL80211_IFTYPE_STATION && 2845 sdata->vif.type != NL80211_IFTYPE_ADHOC && 2846 sdata->vif.type != NL80211_IFTYPE_MESH_POINT) 2847 break; 2848 2849 if (sdata->vif.type == NL80211_IFTYPE_STATION) 2850 bssid = sdata->u.mgd.bssid; 2851 else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) 2852 bssid = sdata->u.ibss.bssid; 2853 else if (sdata->vif.type == NL80211_IFTYPE_MESH_POINT) 2854 bssid = mgmt->sa; 2855 else 2856 break; 2857 2858 if (!ether_addr_equal(mgmt->bssid, bssid)) 2859 break; 2860 2861 goto queue; 2862 } 2863 } 2864 break; 2865 case WLAN_CATEGORY_SA_QUERY: 2866 if (len < (IEEE80211_MIN_ACTION_SIZE + 2867 sizeof(mgmt->u.action.u.sa_query))) 2868 break; 2869 2870 switch (mgmt->u.action.u.sa_query.action) { 2871 case WLAN_ACTION_SA_QUERY_REQUEST: 2872 if (sdata->vif.type != NL80211_IFTYPE_STATION) 2873 break; 2874 ieee80211_process_sa_query_req(sdata, mgmt, len); 2875 goto handled; 2876 } 2877 break; 2878 case WLAN_CATEGORY_SELF_PROTECTED: 2879 if (len < (IEEE80211_MIN_ACTION_SIZE + 2880 sizeof(mgmt->u.action.u.self_prot.action_code))) 2881 break; 2882 2883 switch (mgmt->u.action.u.self_prot.action_code) { 2884 case WLAN_SP_MESH_PEERING_OPEN: 2885 case WLAN_SP_MESH_PEERING_CLOSE: 2886 case WLAN_SP_MESH_PEERING_CONFIRM: 2887 if (!ieee80211_vif_is_mesh(&sdata->vif)) 2888 goto invalid; 2889 if (sdata->u.mesh.user_mpm) 2890 /* userspace handles this frame */ 2891 break; 2892 goto queue; 2893 case WLAN_SP_MGK_INFORM: 2894 case WLAN_SP_MGK_ACK: 2895 if (!ieee80211_vif_is_mesh(&sdata->vif)) 2896 goto invalid; 2897 break; 2898 } 2899 break; 2900 case WLAN_CATEGORY_MESH_ACTION: 2901 if (len < (IEEE80211_MIN_ACTION_SIZE + 2902 sizeof(mgmt->u.action.u.mesh_action.action_code))) 2903 break; 2904 2905 if (!ieee80211_vif_is_mesh(&sdata->vif)) 2906 break; 2907 if (mesh_action_is_path_sel(mgmt) && 2908 !mesh_path_sel_is_hwmp(sdata)) 2909 break; 2910 goto queue; 2911 } 2912 2913 return RX_CONTINUE; 2914 2915 invalid: 2916 status->rx_flags |= IEEE80211_RX_MALFORMED_ACTION_FRM; 2917 /* will return in the next handlers */ 2918 return RX_CONTINUE; 2919 2920 handled: 2921 if (rx->sta) 2922 rx->sta->rx_stats.packets++; 2923 dev_kfree_skb(rx->skb); 2924 return RX_QUEUED; 2925 2926 queue: 2927 rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME; 2928 skb_queue_tail(&sdata->skb_queue, rx->skb); 2929 ieee80211_queue_work(&local->hw, &sdata->work); 2930 if (rx->sta) 2931 rx->sta->rx_stats.packets++; 2932 return RX_QUEUED; 2933 } 2934 2935 static ieee80211_rx_result debug_noinline 2936 ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx) 2937 { 2938 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 2939 int sig = 0; 2940 2941 /* skip known-bad action frames and return them in the next handler */ 2942 if (status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) 2943 return RX_CONTINUE; 2944 2945 /* 2946 * Getting here means the kernel doesn't know how to handle 2947 * it, but maybe userspace does ... include returned frames 2948 * so userspace can register for those to know whether ones 2949 * it transmitted were processed or returned. 2950 */ 2951 2952 if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM)) 2953 sig = status->signal; 2954 2955 if (cfg80211_rx_mgmt(&rx->sdata->wdev, status->freq, sig, 2956 rx->skb->data, rx->skb->len, 0)) { 2957 if (rx->sta) 2958 rx->sta->rx_stats.packets++; 2959 dev_kfree_skb(rx->skb); 2960 return RX_QUEUED; 2961 } 2962 2963 return RX_CONTINUE; 2964 } 2965 2966 static ieee80211_rx_result debug_noinline 2967 ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx) 2968 { 2969 struct ieee80211_local *local = rx->local; 2970 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data; 2971 struct sk_buff *nskb; 2972 struct ieee80211_sub_if_data *sdata = rx->sdata; 2973 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 2974 2975 if (!ieee80211_is_action(mgmt->frame_control)) 2976 return RX_CONTINUE; 2977 2978 /* 2979 * For AP mode, hostapd is responsible for handling any action 2980 * frames that we didn't handle, including returning unknown 2981 * ones. For all other modes we will return them to the sender, 2982 * setting the 0x80 bit in the action category, as required by 2983 * 802.11-2012 9.24.4. 2984 * Newer versions of hostapd shall also use the management frame 2985 * registration mechanisms, but older ones still use cooked 2986 * monitor interfaces so push all frames there. 2987 */ 2988 if (!(status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) && 2989 (sdata->vif.type == NL80211_IFTYPE_AP || 2990 sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) 2991 return RX_DROP_MONITOR; 2992 2993 if (is_multicast_ether_addr(mgmt->da)) 2994 return RX_DROP_MONITOR; 2995 2996 /* do not return rejected action frames */ 2997 if (mgmt->u.action.category & 0x80) 2998 return RX_DROP_UNUSABLE; 2999 3000 nskb = skb_copy_expand(rx->skb, local->hw.extra_tx_headroom, 0, 3001 GFP_ATOMIC); 3002 if (nskb) { 3003 struct ieee80211_mgmt *nmgmt = (void *)nskb->data; 3004 3005 nmgmt->u.action.category |= 0x80; 3006 memcpy(nmgmt->da, nmgmt->sa, ETH_ALEN); 3007 memcpy(nmgmt->sa, rx->sdata->vif.addr, ETH_ALEN); 3008 3009 memset(nskb->cb, 0, sizeof(nskb->cb)); 3010 3011 if (rx->sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) { 3012 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(nskb); 3013 3014 info->flags = IEEE80211_TX_CTL_TX_OFFCHAN | 3015 IEEE80211_TX_INTFL_OFFCHAN_TX_OK | 3016 IEEE80211_TX_CTL_NO_CCK_RATE; 3017 if (ieee80211_hw_check(&local->hw, QUEUE_CONTROL)) 3018 info->hw_queue = 3019 local->hw.offchannel_tx_hw_queue; 3020 } 3021 3022 __ieee80211_tx_skb_tid_band(rx->sdata, nskb, 7, 3023 status->band); 3024 } 3025 dev_kfree_skb(rx->skb); 3026 return RX_QUEUED; 3027 } 3028 3029 static ieee80211_rx_result debug_noinline 3030 ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx) 3031 { 3032 struct ieee80211_sub_if_data *sdata = rx->sdata; 3033 struct ieee80211_mgmt *mgmt = (void *)rx->skb->data; 3034 __le16 stype; 3035 3036 stype = mgmt->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE); 3037 3038 if (!ieee80211_vif_is_mesh(&sdata->vif) && 3039 sdata->vif.type != NL80211_IFTYPE_ADHOC && 3040 sdata->vif.type != NL80211_IFTYPE_OCB && 3041 sdata->vif.type != NL80211_IFTYPE_STATION) 3042 return RX_DROP_MONITOR; 3043 3044 switch (stype) { 3045 case cpu_to_le16(IEEE80211_STYPE_AUTH): 3046 case cpu_to_le16(IEEE80211_STYPE_BEACON): 3047 case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP): 3048 /* process for all: mesh, mlme, ibss */ 3049 break; 3050 case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP): 3051 case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP): 3052 case cpu_to_le16(IEEE80211_STYPE_DEAUTH): 3053 case cpu_to_le16(IEEE80211_STYPE_DISASSOC): 3054 if (is_multicast_ether_addr(mgmt->da) && 3055 !is_broadcast_ether_addr(mgmt->da)) 3056 return RX_DROP_MONITOR; 3057 3058 /* process only for station */ 3059 if (sdata->vif.type != NL80211_IFTYPE_STATION) 3060 return RX_DROP_MONITOR; 3061 break; 3062 case cpu_to_le16(IEEE80211_STYPE_PROBE_REQ): 3063 /* process only for ibss and mesh */ 3064 if (sdata->vif.type != NL80211_IFTYPE_ADHOC && 3065 sdata->vif.type != NL80211_IFTYPE_MESH_POINT) 3066 return RX_DROP_MONITOR; 3067 break; 3068 default: 3069 return RX_DROP_MONITOR; 3070 } 3071 3072 /* queue up frame and kick off work to process it */ 3073 rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME; 3074 skb_queue_tail(&sdata->skb_queue, rx->skb); 3075 ieee80211_queue_work(&rx->local->hw, &sdata->work); 3076 if (rx->sta) 3077 rx->sta->rx_stats.packets++; 3078 3079 return RX_QUEUED; 3080 } 3081 3082 static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx, 3083 struct ieee80211_rate *rate) 3084 { 3085 struct ieee80211_sub_if_data *sdata; 3086 struct ieee80211_local *local = rx->local; 3087 struct sk_buff *skb = rx->skb, *skb2; 3088 struct net_device *prev_dev = NULL; 3089 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 3090 int needed_headroom; 3091 3092 /* 3093 * If cooked monitor has been processed already, then 3094 * don't do it again. If not, set the flag. 3095 */ 3096 if (rx->flags & IEEE80211_RX_CMNTR) 3097 goto out_free_skb; 3098 rx->flags |= IEEE80211_RX_CMNTR; 3099 3100 /* If there are no cooked monitor interfaces, just free the SKB */ 3101 if (!local->cooked_mntrs) 3102 goto out_free_skb; 3103 3104 /* vendor data is long removed here */ 3105 status->flag &= ~RX_FLAG_RADIOTAP_VENDOR_DATA; 3106 /* room for the radiotap header based on driver features */ 3107 needed_headroom = ieee80211_rx_radiotap_hdrlen(local, status, skb); 3108 3109 if (skb_headroom(skb) < needed_headroom && 3110 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) 3111 goto out_free_skb; 3112 3113 /* prepend radiotap information */ 3114 ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom, 3115 false); 3116 3117 skb_reset_mac_header(skb); 3118 skb->ip_summed = CHECKSUM_UNNECESSARY; 3119 skb->pkt_type = PACKET_OTHERHOST; 3120 skb->protocol = htons(ETH_P_802_2); 3121 3122 list_for_each_entry_rcu(sdata, &local->interfaces, list) { 3123 if (!ieee80211_sdata_running(sdata)) 3124 continue; 3125 3126 if (sdata->vif.type != NL80211_IFTYPE_MONITOR || 3127 !(sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES)) 3128 continue; 3129 3130 if (prev_dev) { 3131 skb2 = skb_clone(skb, GFP_ATOMIC); 3132 if (skb2) { 3133 skb2->dev = prev_dev; 3134 netif_receive_skb(skb2); 3135 } 3136 } 3137 3138 prev_dev = sdata->dev; 3139 ieee80211_rx_stats(sdata->dev, skb->len); 3140 } 3141 3142 if (prev_dev) { 3143 skb->dev = prev_dev; 3144 netif_receive_skb(skb); 3145 return; 3146 } 3147 3148 out_free_skb: 3149 dev_kfree_skb(skb); 3150 } 3151 3152 static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx, 3153 ieee80211_rx_result res) 3154 { 3155 switch (res) { 3156 case RX_DROP_MONITOR: 3157 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop); 3158 if (rx->sta) 3159 rx->sta->rx_stats.dropped++; 3160 /* fall through */ 3161 case RX_CONTINUE: { 3162 struct ieee80211_rate *rate = NULL; 3163 struct ieee80211_supported_band *sband; 3164 struct ieee80211_rx_status *status; 3165 3166 status = IEEE80211_SKB_RXCB((rx->skb)); 3167 3168 sband = rx->local->hw.wiphy->bands[status->band]; 3169 if (!(status->flag & RX_FLAG_HT) && 3170 !(status->flag & RX_FLAG_VHT)) 3171 rate = &sband->bitrates[status->rate_idx]; 3172 3173 ieee80211_rx_cooked_monitor(rx, rate); 3174 break; 3175 } 3176 case RX_DROP_UNUSABLE: 3177 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop); 3178 if (rx->sta) 3179 rx->sta->rx_stats.dropped++; 3180 dev_kfree_skb(rx->skb); 3181 break; 3182 case RX_QUEUED: 3183 I802_DEBUG_INC(rx->sdata->local->rx_handlers_queued); 3184 break; 3185 } 3186 } 3187 3188 static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx, 3189 struct sk_buff_head *frames) 3190 { 3191 ieee80211_rx_result res = RX_DROP_MONITOR; 3192 struct sk_buff *skb; 3193 3194 #define CALL_RXH(rxh) \ 3195 do { \ 3196 res = rxh(rx); \ 3197 if (res != RX_CONTINUE) \ 3198 goto rxh_next; \ 3199 } while (0) 3200 3201 /* Lock here to avoid hitting all of the data used in the RX 3202 * path (e.g. key data, station data, ...) concurrently when 3203 * a frame is released from the reorder buffer due to timeout 3204 * from the timer, potentially concurrently with RX from the 3205 * driver. 3206 */ 3207 spin_lock_bh(&rx->local->rx_path_lock); 3208 3209 while ((skb = __skb_dequeue(frames))) { 3210 /* 3211 * all the other fields are valid across frames 3212 * that belong to an aMPDU since they are on the 3213 * same TID from the same station 3214 */ 3215 rx->skb = skb; 3216 3217 CALL_RXH(ieee80211_rx_h_check_more_data); 3218 CALL_RXH(ieee80211_rx_h_uapsd_and_pspoll); 3219 CALL_RXH(ieee80211_rx_h_sta_process); 3220 CALL_RXH(ieee80211_rx_h_decrypt); 3221 CALL_RXH(ieee80211_rx_h_defragment); 3222 CALL_RXH(ieee80211_rx_h_michael_mic_verify); 3223 /* must be after MMIC verify so header is counted in MPDU mic */ 3224 #ifdef CONFIG_MAC80211_MESH 3225 if (ieee80211_vif_is_mesh(&rx->sdata->vif)) 3226 CALL_RXH(ieee80211_rx_h_mesh_fwding); 3227 #endif 3228 CALL_RXH(ieee80211_rx_h_amsdu); 3229 CALL_RXH(ieee80211_rx_h_data); 3230 3231 /* special treatment -- needs the queue */ 3232 res = ieee80211_rx_h_ctrl(rx, frames); 3233 if (res != RX_CONTINUE) 3234 goto rxh_next; 3235 3236 CALL_RXH(ieee80211_rx_h_mgmt_check); 3237 CALL_RXH(ieee80211_rx_h_action); 3238 CALL_RXH(ieee80211_rx_h_userspace_mgmt); 3239 CALL_RXH(ieee80211_rx_h_action_return); 3240 CALL_RXH(ieee80211_rx_h_mgmt); 3241 3242 rxh_next: 3243 ieee80211_rx_handlers_result(rx, res); 3244 3245 #undef CALL_RXH 3246 } 3247 3248 spin_unlock_bh(&rx->local->rx_path_lock); 3249 } 3250 3251 static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx) 3252 { 3253 struct sk_buff_head reorder_release; 3254 ieee80211_rx_result res = RX_DROP_MONITOR; 3255 3256 __skb_queue_head_init(&reorder_release); 3257 3258 #define CALL_RXH(rxh) \ 3259 do { \ 3260 res = rxh(rx); \ 3261 if (res != RX_CONTINUE) \ 3262 goto rxh_next; \ 3263 } while (0) 3264 3265 CALL_RXH(ieee80211_rx_h_check_dup); 3266 CALL_RXH(ieee80211_rx_h_check); 3267 3268 ieee80211_rx_reorder_ampdu(rx, &reorder_release); 3269 3270 ieee80211_rx_handlers(rx, &reorder_release); 3271 return; 3272 3273 rxh_next: 3274 ieee80211_rx_handlers_result(rx, res); 3275 3276 #undef CALL_RXH 3277 } 3278 3279 /* 3280 * This function makes calls into the RX path, therefore 3281 * it has to be invoked under RCU read lock. 3282 */ 3283 void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid) 3284 { 3285 struct sk_buff_head frames; 3286 struct ieee80211_rx_data rx = { 3287 .sta = sta, 3288 .sdata = sta->sdata, 3289 .local = sta->local, 3290 /* This is OK -- must be QoS data frame */ 3291 .security_idx = tid, 3292 .seqno_idx = tid, 3293 .napi = NULL, /* must be NULL to not have races */ 3294 }; 3295 struct tid_ampdu_rx *tid_agg_rx; 3296 3297 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]); 3298 if (!tid_agg_rx) 3299 return; 3300 3301 __skb_queue_head_init(&frames); 3302 3303 spin_lock(&tid_agg_rx->reorder_lock); 3304 ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames); 3305 spin_unlock(&tid_agg_rx->reorder_lock); 3306 3307 if (!skb_queue_empty(&frames)) { 3308 struct ieee80211_event event = { 3309 .type = BA_FRAME_TIMEOUT, 3310 .u.ba.tid = tid, 3311 .u.ba.sta = &sta->sta, 3312 }; 3313 drv_event_callback(rx.local, rx.sdata, &event); 3314 } 3315 3316 ieee80211_rx_handlers(&rx, &frames); 3317 } 3318 3319 void ieee80211_mark_rx_ba_filtered_frames(struct ieee80211_sta *pubsta, u8 tid, 3320 u16 ssn, u64 filtered, 3321 u16 received_mpdus) 3322 { 3323 struct sta_info *sta; 3324 struct tid_ampdu_rx *tid_agg_rx; 3325 struct sk_buff_head frames; 3326 struct ieee80211_rx_data rx = { 3327 /* This is OK -- must be QoS data frame */ 3328 .security_idx = tid, 3329 .seqno_idx = tid, 3330 }; 3331 int i, diff; 3332 3333 if (WARN_ON(!pubsta || tid >= IEEE80211_NUM_TIDS)) 3334 return; 3335 3336 __skb_queue_head_init(&frames); 3337 3338 sta = container_of(pubsta, struct sta_info, sta); 3339 3340 rx.sta = sta; 3341 rx.sdata = sta->sdata; 3342 rx.local = sta->local; 3343 3344 rcu_read_lock(); 3345 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]); 3346 if (!tid_agg_rx) 3347 goto out; 3348 3349 spin_lock_bh(&tid_agg_rx->reorder_lock); 3350 3351 if (received_mpdus >= IEEE80211_SN_MODULO >> 1) { 3352 int release; 3353 3354 /* release all frames in the reorder buffer */ 3355 release = (tid_agg_rx->head_seq_num + tid_agg_rx->buf_size) % 3356 IEEE80211_SN_MODULO; 3357 ieee80211_release_reorder_frames(sta->sdata, tid_agg_rx, 3358 release, &frames); 3359 /* update ssn to match received ssn */ 3360 tid_agg_rx->head_seq_num = ssn; 3361 } else { 3362 ieee80211_release_reorder_frames(sta->sdata, tid_agg_rx, ssn, 3363 &frames); 3364 } 3365 3366 /* handle the case that received ssn is behind the mac ssn. 3367 * it can be tid_agg_rx->buf_size behind and still be valid */ 3368 diff = (tid_agg_rx->head_seq_num - ssn) & IEEE80211_SN_MASK; 3369 if (diff >= tid_agg_rx->buf_size) { 3370 tid_agg_rx->reorder_buf_filtered = 0; 3371 goto release; 3372 } 3373 filtered = filtered >> diff; 3374 ssn += diff; 3375 3376 /* update bitmap */ 3377 for (i = 0; i < tid_agg_rx->buf_size; i++) { 3378 int index = (ssn + i) % tid_agg_rx->buf_size; 3379 3380 tid_agg_rx->reorder_buf_filtered &= ~BIT_ULL(index); 3381 if (filtered & BIT_ULL(i)) 3382 tid_agg_rx->reorder_buf_filtered |= BIT_ULL(index); 3383 } 3384 3385 /* now process also frames that the filter marking released */ 3386 ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames); 3387 3388 release: 3389 spin_unlock_bh(&tid_agg_rx->reorder_lock); 3390 3391 ieee80211_rx_handlers(&rx, &frames); 3392 3393 out: 3394 rcu_read_unlock(); 3395 } 3396 EXPORT_SYMBOL(ieee80211_mark_rx_ba_filtered_frames); 3397 3398 /* main receive path */ 3399 3400 static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx) 3401 { 3402 struct ieee80211_sub_if_data *sdata = rx->sdata; 3403 struct sk_buff *skb = rx->skb; 3404 struct ieee80211_hdr *hdr = (void *)skb->data; 3405 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 3406 u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type); 3407 int multicast = is_multicast_ether_addr(hdr->addr1); 3408 3409 switch (sdata->vif.type) { 3410 case NL80211_IFTYPE_STATION: 3411 if (!bssid && !sdata->u.mgd.use_4addr) 3412 return false; 3413 if (multicast) 3414 return true; 3415 return ether_addr_equal(sdata->vif.addr, hdr->addr1); 3416 case NL80211_IFTYPE_ADHOC: 3417 if (!bssid) 3418 return false; 3419 if (ether_addr_equal(sdata->vif.addr, hdr->addr2) || 3420 ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2)) 3421 return false; 3422 if (ieee80211_is_beacon(hdr->frame_control)) 3423 return true; 3424 if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid)) 3425 return false; 3426 if (!multicast && 3427 !ether_addr_equal(sdata->vif.addr, hdr->addr1)) 3428 return false; 3429 if (!rx->sta) { 3430 int rate_idx; 3431 if (status->flag & (RX_FLAG_HT | RX_FLAG_VHT)) 3432 rate_idx = 0; /* TODO: HT/VHT rates */ 3433 else 3434 rate_idx = status->rate_idx; 3435 ieee80211_ibss_rx_no_sta(sdata, bssid, hdr->addr2, 3436 BIT(rate_idx)); 3437 } 3438 return true; 3439 case NL80211_IFTYPE_OCB: 3440 if (!bssid) 3441 return false; 3442 if (!ieee80211_is_data_present(hdr->frame_control)) 3443 return false; 3444 if (!is_broadcast_ether_addr(bssid)) 3445 return false; 3446 if (!multicast && 3447 !ether_addr_equal(sdata->dev->dev_addr, hdr->addr1)) 3448 return false; 3449 if (!rx->sta) { 3450 int rate_idx; 3451 if (status->flag & RX_FLAG_HT) 3452 rate_idx = 0; /* TODO: HT rates */ 3453 else 3454 rate_idx = status->rate_idx; 3455 ieee80211_ocb_rx_no_sta(sdata, bssid, hdr->addr2, 3456 BIT(rate_idx)); 3457 } 3458 return true; 3459 case NL80211_IFTYPE_MESH_POINT: 3460 if (multicast) 3461 return true; 3462 return ether_addr_equal(sdata->vif.addr, hdr->addr1); 3463 case NL80211_IFTYPE_AP_VLAN: 3464 case NL80211_IFTYPE_AP: 3465 if (!bssid) 3466 return ether_addr_equal(sdata->vif.addr, hdr->addr1); 3467 3468 if (!ieee80211_bssid_match(bssid, sdata->vif.addr)) { 3469 /* 3470 * Accept public action frames even when the 3471 * BSSID doesn't match, this is used for P2P 3472 * and location updates. Note that mac80211 3473 * itself never looks at these frames. 3474 */ 3475 if (!multicast && 3476 !ether_addr_equal(sdata->vif.addr, hdr->addr1)) 3477 return false; 3478 if (ieee80211_is_public_action(hdr, skb->len)) 3479 return true; 3480 return ieee80211_is_beacon(hdr->frame_control); 3481 } 3482 3483 if (!ieee80211_has_tods(hdr->frame_control)) { 3484 /* ignore data frames to TDLS-peers */ 3485 if (ieee80211_is_data(hdr->frame_control)) 3486 return false; 3487 /* ignore action frames to TDLS-peers */ 3488 if (ieee80211_is_action(hdr->frame_control) && 3489 !is_broadcast_ether_addr(bssid) && 3490 !ether_addr_equal(bssid, hdr->addr1)) 3491 return false; 3492 } 3493 return true; 3494 case NL80211_IFTYPE_WDS: 3495 if (bssid || !ieee80211_is_data(hdr->frame_control)) 3496 return false; 3497 return ether_addr_equal(sdata->u.wds.remote_addr, hdr->addr2); 3498 case NL80211_IFTYPE_P2P_DEVICE: 3499 return ieee80211_is_public_action(hdr, skb->len) || 3500 ieee80211_is_probe_req(hdr->frame_control) || 3501 ieee80211_is_probe_resp(hdr->frame_control) || 3502 ieee80211_is_beacon(hdr->frame_control); 3503 default: 3504 break; 3505 } 3506 3507 WARN_ON_ONCE(1); 3508 return false; 3509 } 3510 3511 void ieee80211_check_fast_rx(struct sta_info *sta) 3512 { 3513 struct ieee80211_sub_if_data *sdata = sta->sdata; 3514 struct ieee80211_local *local = sdata->local; 3515 struct ieee80211_key *key; 3516 struct ieee80211_fast_rx fastrx = { 3517 .dev = sdata->dev, 3518 .vif_type = sdata->vif.type, 3519 .control_port_protocol = sdata->control_port_protocol, 3520 }, *old, *new = NULL; 3521 bool assign = false; 3522 3523 /* use sparse to check that we don't return without updating */ 3524 __acquire(check_fast_rx); 3525 3526 BUILD_BUG_ON(sizeof(fastrx.rfc1042_hdr) != sizeof(rfc1042_header)); 3527 BUILD_BUG_ON(sizeof(fastrx.rfc1042_hdr) != ETH_ALEN); 3528 ether_addr_copy(fastrx.rfc1042_hdr, rfc1042_header); 3529 ether_addr_copy(fastrx.vif_addr, sdata->vif.addr); 3530 3531 fastrx.uses_rss = ieee80211_hw_check(&local->hw, USES_RSS); 3532 3533 /* fast-rx doesn't do reordering */ 3534 if (ieee80211_hw_check(&local->hw, AMPDU_AGGREGATION) && 3535 !ieee80211_hw_check(&local->hw, SUPPORTS_REORDERING_BUFFER)) 3536 goto clear; 3537 3538 switch (sdata->vif.type) { 3539 case NL80211_IFTYPE_STATION: 3540 /* 4-addr is harder to deal with, later maybe */ 3541 if (sdata->u.mgd.use_4addr) 3542 goto clear; 3543 /* software powersave is a huge mess, avoid all of it */ 3544 if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK)) 3545 goto clear; 3546 if (ieee80211_hw_check(&local->hw, SUPPORTS_PS) && 3547 !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS)) 3548 goto clear; 3549 if (sta->sta.tdls) { 3550 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr1); 3551 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr2); 3552 fastrx.expected_ds_bits = 0; 3553 } else { 3554 fastrx.sta_notify = sdata->u.mgd.probe_send_count > 0; 3555 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr1); 3556 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr3); 3557 fastrx.expected_ds_bits = 3558 cpu_to_le16(IEEE80211_FCTL_FROMDS); 3559 } 3560 break; 3561 case NL80211_IFTYPE_AP_VLAN: 3562 case NL80211_IFTYPE_AP: 3563 /* parallel-rx requires this, at least with calls to 3564 * ieee80211_sta_ps_transition() 3565 */ 3566 if (!ieee80211_hw_check(&local->hw, AP_LINK_PS)) 3567 goto clear; 3568 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3); 3569 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr2); 3570 fastrx.expected_ds_bits = cpu_to_le16(IEEE80211_FCTL_TODS); 3571 3572 fastrx.internal_forward = 3573 !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) && 3574 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || 3575 !sdata->u.vlan.sta); 3576 break; 3577 default: 3578 goto clear; 3579 } 3580 3581 if (!test_sta_flag(sta, WLAN_STA_AUTHORIZED)) 3582 goto clear; 3583 3584 rcu_read_lock(); 3585 key = rcu_dereference(sta->ptk[sta->ptk_idx]); 3586 if (key) { 3587 switch (key->conf.cipher) { 3588 case WLAN_CIPHER_SUITE_TKIP: 3589 /* we don't want to deal with MMIC in fast-rx */ 3590 goto clear_rcu; 3591 case WLAN_CIPHER_SUITE_CCMP: 3592 case WLAN_CIPHER_SUITE_CCMP_256: 3593 case WLAN_CIPHER_SUITE_GCMP: 3594 case WLAN_CIPHER_SUITE_GCMP_256: 3595 break; 3596 default: 3597 /* we also don't want to deal with WEP or cipher scheme 3598 * since those require looking up the key idx in the 3599 * frame, rather than assuming the PTK is used 3600 * (we need to revisit this once we implement the real 3601 * PTK index, which is now valid in the spec, but we 3602 * haven't implemented that part yet) 3603 */ 3604 goto clear_rcu; 3605 } 3606 3607 fastrx.key = true; 3608 fastrx.icv_len = key->conf.icv_len; 3609 } 3610 3611 assign = true; 3612 clear_rcu: 3613 rcu_read_unlock(); 3614 clear: 3615 __release(check_fast_rx); 3616 3617 if (assign) 3618 new = kmemdup(&fastrx, sizeof(fastrx), GFP_KERNEL); 3619 3620 spin_lock_bh(&sta->lock); 3621 old = rcu_dereference_protected(sta->fast_rx, true); 3622 rcu_assign_pointer(sta->fast_rx, new); 3623 spin_unlock_bh(&sta->lock); 3624 3625 if (old) 3626 kfree_rcu(old, rcu_head); 3627 } 3628 3629 void ieee80211_clear_fast_rx(struct sta_info *sta) 3630 { 3631 struct ieee80211_fast_rx *old; 3632 3633 spin_lock_bh(&sta->lock); 3634 old = rcu_dereference_protected(sta->fast_rx, true); 3635 RCU_INIT_POINTER(sta->fast_rx, NULL); 3636 spin_unlock_bh(&sta->lock); 3637 3638 if (old) 3639 kfree_rcu(old, rcu_head); 3640 } 3641 3642 void __ieee80211_check_fast_rx_iface(struct ieee80211_sub_if_data *sdata) 3643 { 3644 struct ieee80211_local *local = sdata->local; 3645 struct sta_info *sta; 3646 3647 lockdep_assert_held(&local->sta_mtx); 3648 3649 list_for_each_entry_rcu(sta, &local->sta_list, list) { 3650 if (sdata != sta->sdata && 3651 (!sta->sdata->bss || sta->sdata->bss != sdata->bss)) 3652 continue; 3653 ieee80211_check_fast_rx(sta); 3654 } 3655 } 3656 3657 void ieee80211_check_fast_rx_iface(struct ieee80211_sub_if_data *sdata) 3658 { 3659 struct ieee80211_local *local = sdata->local; 3660 3661 mutex_lock(&local->sta_mtx); 3662 __ieee80211_check_fast_rx_iface(sdata); 3663 mutex_unlock(&local->sta_mtx); 3664 } 3665 3666 static bool ieee80211_invoke_fast_rx(struct ieee80211_rx_data *rx, 3667 struct ieee80211_fast_rx *fast_rx) 3668 { 3669 struct sk_buff *skb = rx->skb; 3670 struct ieee80211_hdr *hdr = (void *)skb->data; 3671 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 3672 struct sta_info *sta = rx->sta; 3673 int orig_len = skb->len; 3674 int snap_offs = ieee80211_hdrlen(hdr->frame_control); 3675 struct { 3676 u8 snap[sizeof(rfc1042_header)]; 3677 __be16 proto; 3678 } *payload __aligned(2); 3679 struct { 3680 u8 da[ETH_ALEN]; 3681 u8 sa[ETH_ALEN]; 3682 } addrs __aligned(2); 3683 struct ieee80211_sta_rx_stats *stats = &sta->rx_stats; 3684 3685 if (fast_rx->uses_rss) 3686 stats = this_cpu_ptr(sta->pcpu_rx_stats); 3687 3688 /* for parallel-rx, we need to have DUP_VALIDATED, otherwise we write 3689 * to a common data structure; drivers can implement that per queue 3690 * but we don't have that information in mac80211 3691 */ 3692 if (!(status->flag & RX_FLAG_DUP_VALIDATED)) 3693 return false; 3694 3695 #define FAST_RX_CRYPT_FLAGS (RX_FLAG_PN_VALIDATED | RX_FLAG_DECRYPTED) 3696 3697 /* If using encryption, we also need to have: 3698 * - PN_VALIDATED: similar, but the implementation is tricky 3699 * - DECRYPTED: necessary for PN_VALIDATED 3700 */ 3701 if (fast_rx->key && 3702 (status->flag & FAST_RX_CRYPT_FLAGS) != FAST_RX_CRYPT_FLAGS) 3703 return false; 3704 3705 /* we don't deal with A-MSDU deaggregation here */ 3706 if (status->rx_flags & IEEE80211_RX_AMSDU) 3707 return false; 3708 3709 if (unlikely(!ieee80211_is_data_present(hdr->frame_control))) 3710 return false; 3711 3712 if (unlikely(ieee80211_is_frag(hdr))) 3713 return false; 3714 3715 /* Since our interface address cannot be multicast, this 3716 * implicitly also rejects multicast frames without the 3717 * explicit check. 3718 * 3719 * We shouldn't get any *data* frames not addressed to us 3720 * (AP mode will accept multicast *management* frames), but 3721 * punting here will make it go through the full checks in 3722 * ieee80211_accept_frame(). 3723 */ 3724 if (!ether_addr_equal(fast_rx->vif_addr, hdr->addr1)) 3725 return false; 3726 3727 if ((hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_FROMDS | 3728 IEEE80211_FCTL_TODS)) != 3729 fast_rx->expected_ds_bits) 3730 goto drop; 3731 3732 /* assign the key to drop unencrypted frames (later) 3733 * and strip the IV/MIC if necessary 3734 */ 3735 if (fast_rx->key && !(status->flag & RX_FLAG_IV_STRIPPED)) { 3736 /* GCMP header length is the same */ 3737 snap_offs += IEEE80211_CCMP_HDR_LEN; 3738 } 3739 3740 if (!pskb_may_pull(skb, snap_offs + sizeof(*payload))) 3741 goto drop; 3742 payload = (void *)(skb->data + snap_offs); 3743 3744 if (!ether_addr_equal(payload->snap, fast_rx->rfc1042_hdr)) 3745 return false; 3746 3747 /* Don't handle these here since they require special code. 3748 * Accept AARP and IPX even though they should come with a 3749 * bridge-tunnel header - but if we get them this way then 3750 * there's little point in discarding them. 3751 */ 3752 if (unlikely(payload->proto == cpu_to_be16(ETH_P_TDLS) || 3753 payload->proto == fast_rx->control_port_protocol)) 3754 return false; 3755 3756 /* after this point, don't punt to the slowpath! */ 3757 3758 if (rx->key && !(status->flag & RX_FLAG_MIC_STRIPPED) && 3759 pskb_trim(skb, skb->len - fast_rx->icv_len)) 3760 goto drop; 3761 3762 if (unlikely(fast_rx->sta_notify)) { 3763 ieee80211_sta_rx_notify(rx->sdata, hdr); 3764 fast_rx->sta_notify = false; 3765 } 3766 3767 /* statistics part of ieee80211_rx_h_sta_process() */ 3768 stats->last_rx = jiffies; 3769 stats->last_rate = sta_stats_encode_rate(status); 3770 3771 stats->fragments++; 3772 3773 if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) { 3774 stats->last_signal = status->signal; 3775 if (!fast_rx->uses_rss) 3776 ewma_signal_add(&sta->rx_stats_avg.signal, 3777 -status->signal); 3778 } 3779 3780 if (status->chains) { 3781 int i; 3782 3783 stats->chains = status->chains; 3784 for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) { 3785 int signal = status->chain_signal[i]; 3786 3787 if (!(status->chains & BIT(i))) 3788 continue; 3789 3790 stats->chain_signal_last[i] = signal; 3791 if (!fast_rx->uses_rss) 3792 ewma_signal_add(&sta->rx_stats_avg.chain_signal[i], 3793 -signal); 3794 } 3795 } 3796 /* end of statistics */ 3797 3798 if (rx->key && !ieee80211_has_protected(hdr->frame_control)) 3799 goto drop; 3800 3801 /* do the header conversion - first grab the addresses */ 3802 ether_addr_copy(addrs.da, skb->data + fast_rx->da_offs); 3803 ether_addr_copy(addrs.sa, skb->data + fast_rx->sa_offs); 3804 /* remove the SNAP but leave the ethertype */ 3805 skb_pull(skb, snap_offs + sizeof(rfc1042_header)); 3806 /* push the addresses in front */ 3807 memcpy(skb_push(skb, sizeof(addrs)), &addrs, sizeof(addrs)); 3808 3809 skb->dev = fast_rx->dev; 3810 3811 ieee80211_rx_stats(fast_rx->dev, skb->len); 3812 3813 /* The seqno index has the same property as needed 3814 * for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS 3815 * for non-QoS-data frames. Here we know it's a data 3816 * frame, so count MSDUs. 3817 */ 3818 u64_stats_update_begin(&stats->syncp); 3819 stats->msdu[rx->seqno_idx]++; 3820 stats->bytes += orig_len; 3821 u64_stats_update_end(&stats->syncp); 3822 3823 if (fast_rx->internal_forward) { 3824 struct sta_info *dsta = sta_info_get(rx->sdata, skb->data); 3825 3826 if (dsta) { 3827 /* 3828 * Send to wireless media and increase priority by 256 3829 * to keep the received priority instead of 3830 * reclassifying the frame (see cfg80211_classify8021d). 3831 */ 3832 skb->priority += 256; 3833 skb->protocol = htons(ETH_P_802_3); 3834 skb_reset_network_header(skb); 3835 skb_reset_mac_header(skb); 3836 dev_queue_xmit(skb); 3837 return true; 3838 } 3839 } 3840 3841 /* deliver to local stack */ 3842 skb->protocol = eth_type_trans(skb, fast_rx->dev); 3843 memset(skb->cb, 0, sizeof(skb->cb)); 3844 if (rx->napi) 3845 napi_gro_receive(rx->napi, skb); 3846 else 3847 netif_receive_skb(skb); 3848 3849 return true; 3850 drop: 3851 dev_kfree_skb(skb); 3852 stats->dropped++; 3853 return true; 3854 } 3855 3856 /* 3857 * This function returns whether or not the SKB 3858 * was destined for RX processing or not, which, 3859 * if consume is true, is equivalent to whether 3860 * or not the skb was consumed. 3861 */ 3862 static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx, 3863 struct sk_buff *skb, bool consume) 3864 { 3865 struct ieee80211_local *local = rx->local; 3866 struct ieee80211_sub_if_data *sdata = rx->sdata; 3867 3868 rx->skb = skb; 3869 3870 /* See if we can do fast-rx; if we have to copy we already lost, 3871 * so punt in that case. We should never have to deliver a data 3872 * frame to multiple interfaces anyway. 3873 * 3874 * We skip the ieee80211_accept_frame() call and do the necessary 3875 * checking inside ieee80211_invoke_fast_rx(). 3876 */ 3877 if (consume && rx->sta) { 3878 struct ieee80211_fast_rx *fast_rx; 3879 3880 fast_rx = rcu_dereference(rx->sta->fast_rx); 3881 if (fast_rx && ieee80211_invoke_fast_rx(rx, fast_rx)) 3882 return true; 3883 } 3884 3885 if (!ieee80211_accept_frame(rx)) 3886 return false; 3887 3888 if (!consume) { 3889 skb = skb_copy(skb, GFP_ATOMIC); 3890 if (!skb) { 3891 if (net_ratelimit()) 3892 wiphy_debug(local->hw.wiphy, 3893 "failed to copy skb for %s\n", 3894 sdata->name); 3895 return true; 3896 } 3897 3898 rx->skb = skb; 3899 } 3900 3901 ieee80211_invoke_rx_handlers(rx); 3902 return true; 3903 } 3904 3905 /* 3906 * This is the actual Rx frames handler. as it belongs to Rx path it must 3907 * be called with rcu_read_lock protection. 3908 */ 3909 static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, 3910 struct ieee80211_sta *pubsta, 3911 struct sk_buff *skb, 3912 struct napi_struct *napi) 3913 { 3914 struct ieee80211_local *local = hw_to_local(hw); 3915 struct ieee80211_sub_if_data *sdata; 3916 struct ieee80211_hdr *hdr; 3917 __le16 fc; 3918 struct ieee80211_rx_data rx; 3919 struct ieee80211_sub_if_data *prev; 3920 struct rhash_head *tmp; 3921 int err = 0; 3922 3923 fc = ((struct ieee80211_hdr *)skb->data)->frame_control; 3924 memset(&rx, 0, sizeof(rx)); 3925 rx.skb = skb; 3926 rx.local = local; 3927 rx.napi = napi; 3928 3929 if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc)) 3930 I802_DEBUG_INC(local->dot11ReceivedFragmentCount); 3931 3932 if (ieee80211_is_mgmt(fc)) { 3933 /* drop frame if too short for header */ 3934 if (skb->len < ieee80211_hdrlen(fc)) 3935 err = -ENOBUFS; 3936 else 3937 err = skb_linearize(skb); 3938 } else { 3939 err = !pskb_may_pull(skb, ieee80211_hdrlen(fc)); 3940 } 3941 3942 if (err) { 3943 dev_kfree_skb(skb); 3944 return; 3945 } 3946 3947 hdr = (struct ieee80211_hdr *)skb->data; 3948 ieee80211_parse_qos(&rx); 3949 ieee80211_verify_alignment(&rx); 3950 3951 if (unlikely(ieee80211_is_probe_resp(hdr->frame_control) || 3952 ieee80211_is_beacon(hdr->frame_control))) 3953 ieee80211_scan_rx(local, skb); 3954 3955 if (pubsta) { 3956 rx.sta = container_of(pubsta, struct sta_info, sta); 3957 rx.sdata = rx.sta->sdata; 3958 if (ieee80211_prepare_and_rx_handle(&rx, skb, true)) 3959 return; 3960 goto out; 3961 } else if (ieee80211_is_data(fc)) { 3962 struct sta_info *sta, *prev_sta; 3963 const struct bucket_table *tbl; 3964 3965 prev_sta = NULL; 3966 3967 tbl = rht_dereference_rcu(local->sta_hash.tbl, &local->sta_hash); 3968 3969 for_each_sta_info(local, tbl, hdr->addr2, sta, tmp) { 3970 if (!prev_sta) { 3971 prev_sta = sta; 3972 continue; 3973 } 3974 3975 rx.sta = prev_sta; 3976 rx.sdata = prev_sta->sdata; 3977 ieee80211_prepare_and_rx_handle(&rx, skb, false); 3978 3979 prev_sta = sta; 3980 } 3981 3982 if (prev_sta) { 3983 rx.sta = prev_sta; 3984 rx.sdata = prev_sta->sdata; 3985 3986 if (ieee80211_prepare_and_rx_handle(&rx, skb, true)) 3987 return; 3988 goto out; 3989 } 3990 } 3991 3992 prev = NULL; 3993 3994 list_for_each_entry_rcu(sdata, &local->interfaces, list) { 3995 if (!ieee80211_sdata_running(sdata)) 3996 continue; 3997 3998 if (sdata->vif.type == NL80211_IFTYPE_MONITOR || 3999 sdata->vif.type == NL80211_IFTYPE_AP_VLAN) 4000 continue; 4001 4002 /* 4003 * frame is destined for this interface, but if it's 4004 * not also for the previous one we handle that after 4005 * the loop to avoid copying the SKB once too much 4006 */ 4007 4008 if (!prev) { 4009 prev = sdata; 4010 continue; 4011 } 4012 4013 rx.sta = sta_info_get_bss(prev, hdr->addr2); 4014 rx.sdata = prev; 4015 ieee80211_prepare_and_rx_handle(&rx, skb, false); 4016 4017 prev = sdata; 4018 } 4019 4020 if (prev) { 4021 rx.sta = sta_info_get_bss(prev, hdr->addr2); 4022 rx.sdata = prev; 4023 4024 if (ieee80211_prepare_and_rx_handle(&rx, skb, true)) 4025 return; 4026 } 4027 4028 out: 4029 dev_kfree_skb(skb); 4030 } 4031 4032 /* 4033 * This is the receive path handler. It is called by a low level driver when an 4034 * 802.11 MPDU is received from the hardware. 4035 */ 4036 void ieee80211_rx_napi(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta, 4037 struct sk_buff *skb, struct napi_struct *napi) 4038 { 4039 struct ieee80211_local *local = hw_to_local(hw); 4040 struct ieee80211_rate *rate = NULL; 4041 struct ieee80211_supported_band *sband; 4042 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 4043 4044 WARN_ON_ONCE(softirq_count() == 0); 4045 4046 if (WARN_ON(status->band >= NUM_NL80211_BANDS)) 4047 goto drop; 4048 4049 sband = local->hw.wiphy->bands[status->band]; 4050 if (WARN_ON(!sband)) 4051 goto drop; 4052 4053 /* 4054 * If we're suspending, it is possible although not too likely 4055 * that we'd be receiving frames after having already partially 4056 * quiesced the stack. We can't process such frames then since 4057 * that might, for example, cause stations to be added or other 4058 * driver callbacks be invoked. 4059 */ 4060 if (unlikely(local->quiescing || local->suspended)) 4061 goto drop; 4062 4063 /* We might be during a HW reconfig, prevent Rx for the same reason */ 4064 if (unlikely(local->in_reconfig)) 4065 goto drop; 4066 4067 /* 4068 * The same happens when we're not even started, 4069 * but that's worth a warning. 4070 */ 4071 if (WARN_ON(!local->started)) 4072 goto drop; 4073 4074 if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC))) { 4075 /* 4076 * Validate the rate, unless a PLCP error means that 4077 * we probably can't have a valid rate here anyway. 4078 */ 4079 4080 if (status->flag & RX_FLAG_HT) { 4081 /* 4082 * rate_idx is MCS index, which can be [0-76] 4083 * as documented on: 4084 * 4085 * http://wireless.kernel.org/en/developers/Documentation/ieee80211/802.11n 4086 * 4087 * Anything else would be some sort of driver or 4088 * hardware error. The driver should catch hardware 4089 * errors. 4090 */ 4091 if (WARN(status->rate_idx > 76, 4092 "Rate marked as an HT rate but passed " 4093 "status->rate_idx is not " 4094 "an MCS index [0-76]: %d (0x%02x)\n", 4095 status->rate_idx, 4096 status->rate_idx)) 4097 goto drop; 4098 } else if (status->flag & RX_FLAG_VHT) { 4099 if (WARN_ONCE(status->rate_idx > 9 || 4100 !status->vht_nss || 4101 status->vht_nss > 8, 4102 "Rate marked as a VHT rate but data is invalid: MCS: %d, NSS: %d\n", 4103 status->rate_idx, status->vht_nss)) 4104 goto drop; 4105 } else { 4106 if (WARN_ON(status->rate_idx >= sband->n_bitrates)) 4107 goto drop; 4108 rate = &sband->bitrates[status->rate_idx]; 4109 } 4110 } 4111 4112 status->rx_flags = 0; 4113 4114 /* 4115 * key references and virtual interfaces are protected using RCU 4116 * and this requires that we are in a read-side RCU section during 4117 * receive processing 4118 */ 4119 rcu_read_lock(); 4120 4121 /* 4122 * Frames with failed FCS/PLCP checksum are not returned, 4123 * all other frames are returned without radiotap header 4124 * if it was previously present. 4125 * Also, frames with less than 16 bytes are dropped. 4126 */ 4127 skb = ieee80211_rx_monitor(local, skb, rate); 4128 if (!skb) { 4129 rcu_read_unlock(); 4130 return; 4131 } 4132 4133 ieee80211_tpt_led_trig_rx(local, 4134 ((struct ieee80211_hdr *)skb->data)->frame_control, 4135 skb->len); 4136 4137 __ieee80211_rx_handle_packet(hw, pubsta, skb, napi); 4138 4139 rcu_read_unlock(); 4140 4141 return; 4142 drop: 4143 kfree_skb(skb); 4144 } 4145 EXPORT_SYMBOL(ieee80211_rx_napi); 4146 4147 /* This is a version of the rx handler that can be called from hard irq 4148 * context. Post the skb on the queue and schedule the tasklet */ 4149 void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb) 4150 { 4151 struct ieee80211_local *local = hw_to_local(hw); 4152 4153 BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb)); 4154 4155 skb->pkt_type = IEEE80211_RX_MSG; 4156 skb_queue_tail(&local->skb_queue, skb); 4157 tasklet_schedule(&local->tasklet); 4158 } 4159 EXPORT_SYMBOL(ieee80211_rx_irqsafe); 4160