1 /* 2 * Copyright 2002-2005, Instant802 Networks, Inc. 3 * Copyright 2005-2006, Devicescape Software, Inc. 4 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz> 5 * Copyright 2007-2010 Johannes Berg <johannes@sipsolutions.net> 6 * Copyright 2013-2014 Intel Mobile Communications GmbH 7 * Copyright(c) 2015 - 2017 Intel Deutschland GmbH 8 * Copyright (C) 2018 Intel Corporation 9 * 10 * This program is free software; you can redistribute it and/or modify 11 * it under the terms of the GNU General Public License version 2 as 12 * published by the Free Software Foundation. 13 */ 14 15 #include <linux/jiffies.h> 16 #include <linux/slab.h> 17 #include <linux/kernel.h> 18 #include <linux/skbuff.h> 19 #include <linux/netdevice.h> 20 #include <linux/etherdevice.h> 21 #include <linux/rcupdate.h> 22 #include <linux/export.h> 23 #include <linux/bitops.h> 24 #include <net/mac80211.h> 25 #include <net/ieee80211_radiotap.h> 26 #include <asm/unaligned.h> 27 28 #include "ieee80211_i.h" 29 #include "driver-ops.h" 30 #include "led.h" 31 #include "mesh.h" 32 #include "wep.h" 33 #include "wpa.h" 34 #include "tkip.h" 35 #include "wme.h" 36 #include "rate.h" 37 38 static inline void ieee80211_rx_stats(struct net_device *dev, u32 len) 39 { 40 struct pcpu_sw_netstats *tstats = this_cpu_ptr(dev->tstats); 41 42 u64_stats_update_begin(&tstats->syncp); 43 tstats->rx_packets++; 44 tstats->rx_bytes += len; 45 u64_stats_update_end(&tstats->syncp); 46 } 47 48 static u8 *ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len, 49 enum nl80211_iftype type) 50 { 51 __le16 fc = hdr->frame_control; 52 53 if (ieee80211_is_data(fc)) { 54 if (len < 24) /* drop incorrect hdr len (data) */ 55 return NULL; 56 57 if (ieee80211_has_a4(fc)) 58 return NULL; 59 if (ieee80211_has_tods(fc)) 60 return hdr->addr1; 61 if (ieee80211_has_fromds(fc)) 62 return hdr->addr2; 63 64 return hdr->addr3; 65 } 66 67 if (ieee80211_is_mgmt(fc)) { 68 if (len < 24) /* drop incorrect hdr len (mgmt) */ 69 return NULL; 70 return hdr->addr3; 71 } 72 73 if (ieee80211_is_ctl(fc)) { 74 if (ieee80211_is_pspoll(fc)) 75 return hdr->addr1; 76 77 if (ieee80211_is_back_req(fc)) { 78 switch (type) { 79 case NL80211_IFTYPE_STATION: 80 return hdr->addr2; 81 case NL80211_IFTYPE_AP: 82 case NL80211_IFTYPE_AP_VLAN: 83 return hdr->addr1; 84 default: 85 break; /* fall through to the return */ 86 } 87 } 88 } 89 90 return NULL; 91 } 92 93 /* 94 * monitor mode reception 95 * 96 * This function cleans up the SKB, i.e. it removes all the stuff 97 * only useful for monitoring. 98 */ 99 static void remove_monitor_info(struct sk_buff *skb, 100 unsigned int present_fcs_len, 101 unsigned int rtap_space) 102 { 103 if (present_fcs_len) 104 __pskb_trim(skb, skb->len - present_fcs_len); 105 __pskb_pull(skb, rtap_space); 106 } 107 108 static inline bool should_drop_frame(struct sk_buff *skb, int present_fcs_len, 109 unsigned int rtap_space) 110 { 111 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 112 struct ieee80211_hdr *hdr; 113 114 hdr = (void *)(skb->data + rtap_space); 115 116 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | 117 RX_FLAG_FAILED_PLCP_CRC | 118 RX_FLAG_ONLY_MONITOR)) 119 return true; 120 121 if (unlikely(skb->len < 16 + present_fcs_len + rtap_space)) 122 return true; 123 124 if (ieee80211_is_ctl(hdr->frame_control) && 125 !ieee80211_is_pspoll(hdr->frame_control) && 126 !ieee80211_is_back_req(hdr->frame_control)) 127 return true; 128 129 return false; 130 } 131 132 static int 133 ieee80211_rx_radiotap_hdrlen(struct ieee80211_local *local, 134 struct ieee80211_rx_status *status, 135 struct sk_buff *skb) 136 { 137 int len; 138 139 /* always present fields */ 140 len = sizeof(struct ieee80211_radiotap_header) + 8; 141 142 /* allocate extra bitmaps */ 143 if (status->chains) 144 len += 4 * hweight8(status->chains); 145 146 if (ieee80211_have_rx_timestamp(status)) { 147 len = ALIGN(len, 8); 148 len += 8; 149 } 150 if (ieee80211_hw_check(&local->hw, SIGNAL_DBM)) 151 len += 1; 152 153 /* antenna field, if we don't have per-chain info */ 154 if (!status->chains) 155 len += 1; 156 157 /* padding for RX_FLAGS if necessary */ 158 len = ALIGN(len, 2); 159 160 if (status->encoding == RX_ENC_HT) /* HT info */ 161 len += 3; 162 163 if (status->flag & RX_FLAG_AMPDU_DETAILS) { 164 len = ALIGN(len, 4); 165 len += 8; 166 } 167 168 if (status->encoding == RX_ENC_VHT) { 169 len = ALIGN(len, 2); 170 len += 12; 171 } 172 173 if (local->hw.radiotap_timestamp.units_pos >= 0) { 174 len = ALIGN(len, 8); 175 len += 12; 176 } 177 178 if (status->encoding == RX_ENC_HE && 179 status->flag & RX_FLAG_RADIOTAP_HE) { 180 len = ALIGN(len, 2); 181 len += 12; 182 BUILD_BUG_ON(sizeof(struct ieee80211_radiotap_he) != 12); 183 } 184 185 if (status->encoding == RX_ENC_HE && 186 status->flag & RX_FLAG_RADIOTAP_HE_MU) { 187 len = ALIGN(len, 2); 188 len += 12; 189 BUILD_BUG_ON(sizeof(struct ieee80211_radiotap_he_mu) != 12); 190 } 191 192 if (status->chains) { 193 /* antenna and antenna signal fields */ 194 len += 2 * hweight8(status->chains); 195 } 196 197 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) { 198 struct ieee80211_vendor_radiotap *rtap = (void *)skb->data; 199 200 /* vendor presence bitmap */ 201 len += 4; 202 /* alignment for fixed 6-byte vendor data header */ 203 len = ALIGN(len, 2); 204 /* vendor data header */ 205 len += 6; 206 if (WARN_ON(rtap->align == 0)) 207 rtap->align = 1; 208 len = ALIGN(len, rtap->align); 209 len += rtap->len + rtap->pad; 210 } 211 212 return len; 213 } 214 215 static void ieee80211_handle_mu_mimo_mon(struct ieee80211_sub_if_data *sdata, 216 struct sk_buff *skb, 217 int rtap_space) 218 { 219 struct { 220 struct ieee80211_hdr_3addr hdr; 221 u8 category; 222 u8 action_code; 223 } __packed action; 224 225 if (!sdata) 226 return; 227 228 BUILD_BUG_ON(sizeof(action) != IEEE80211_MIN_ACTION_SIZE + 1); 229 230 if (skb->len < rtap_space + sizeof(action) + 231 VHT_MUMIMO_GROUPS_DATA_LEN) 232 return; 233 234 if (!is_valid_ether_addr(sdata->u.mntr.mu_follow_addr)) 235 return; 236 237 skb_copy_bits(skb, rtap_space, &action, sizeof(action)); 238 239 if (!ieee80211_is_action(action.hdr.frame_control)) 240 return; 241 242 if (action.category != WLAN_CATEGORY_VHT) 243 return; 244 245 if (action.action_code != WLAN_VHT_ACTION_GROUPID_MGMT) 246 return; 247 248 if (!ether_addr_equal(action.hdr.addr1, sdata->u.mntr.mu_follow_addr)) 249 return; 250 251 skb = skb_copy(skb, GFP_ATOMIC); 252 if (!skb) 253 return; 254 255 skb_queue_tail(&sdata->skb_queue, skb); 256 ieee80211_queue_work(&sdata->local->hw, &sdata->work); 257 } 258 259 /* 260 * ieee80211_add_rx_radiotap_header - add radiotap header 261 * 262 * add a radiotap header containing all the fields which the hardware provided. 263 */ 264 static void 265 ieee80211_add_rx_radiotap_header(struct ieee80211_local *local, 266 struct sk_buff *skb, 267 struct ieee80211_rate *rate, 268 int rtap_len, bool has_fcs) 269 { 270 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 271 struct ieee80211_radiotap_header *rthdr; 272 unsigned char *pos; 273 __le32 *it_present; 274 u32 it_present_val; 275 u16 rx_flags = 0; 276 u16 channel_flags = 0; 277 int mpdulen, chain; 278 unsigned long chains = status->chains; 279 struct ieee80211_vendor_radiotap rtap = {}; 280 struct ieee80211_radiotap_he he = {}; 281 struct ieee80211_radiotap_he_mu he_mu = {}; 282 283 if (status->flag & RX_FLAG_RADIOTAP_HE) { 284 he = *(struct ieee80211_radiotap_he *)skb->data; 285 skb_pull(skb, sizeof(he)); 286 WARN_ON_ONCE(status->encoding != RX_ENC_HE); 287 } 288 289 if (status->flag & RX_FLAG_RADIOTAP_HE_MU) { 290 he_mu = *(struct ieee80211_radiotap_he_mu *)skb->data; 291 skb_pull(skb, sizeof(he_mu)); 292 } 293 294 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) { 295 rtap = *(struct ieee80211_vendor_radiotap *)skb->data; 296 /* rtap.len and rtap.pad are undone immediately */ 297 skb_pull(skb, sizeof(rtap) + rtap.len + rtap.pad); 298 } 299 300 mpdulen = skb->len; 301 if (!(has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS))) 302 mpdulen += FCS_LEN; 303 304 rthdr = skb_push(skb, rtap_len); 305 memset(rthdr, 0, rtap_len - rtap.len - rtap.pad); 306 it_present = &rthdr->it_present; 307 308 /* radiotap header, set always present flags */ 309 rthdr->it_len = cpu_to_le16(rtap_len); 310 it_present_val = BIT(IEEE80211_RADIOTAP_FLAGS) | 311 BIT(IEEE80211_RADIOTAP_CHANNEL) | 312 BIT(IEEE80211_RADIOTAP_RX_FLAGS); 313 314 if (!status->chains) 315 it_present_val |= BIT(IEEE80211_RADIOTAP_ANTENNA); 316 317 for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) { 318 it_present_val |= 319 BIT(IEEE80211_RADIOTAP_EXT) | 320 BIT(IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE); 321 put_unaligned_le32(it_present_val, it_present); 322 it_present++; 323 it_present_val = BIT(IEEE80211_RADIOTAP_ANTENNA) | 324 BIT(IEEE80211_RADIOTAP_DBM_ANTSIGNAL); 325 } 326 327 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) { 328 it_present_val |= BIT(IEEE80211_RADIOTAP_VENDOR_NAMESPACE) | 329 BIT(IEEE80211_RADIOTAP_EXT); 330 put_unaligned_le32(it_present_val, it_present); 331 it_present++; 332 it_present_val = rtap.present; 333 } 334 335 put_unaligned_le32(it_present_val, it_present); 336 337 pos = (void *)(it_present + 1); 338 339 /* the order of the following fields is important */ 340 341 /* IEEE80211_RADIOTAP_TSFT */ 342 if (ieee80211_have_rx_timestamp(status)) { 343 /* padding */ 344 while ((pos - (u8 *)rthdr) & 7) 345 *pos++ = 0; 346 put_unaligned_le64( 347 ieee80211_calculate_rx_timestamp(local, status, 348 mpdulen, 0), 349 pos); 350 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT); 351 pos += 8; 352 } 353 354 /* IEEE80211_RADIOTAP_FLAGS */ 355 if (has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)) 356 *pos |= IEEE80211_RADIOTAP_F_FCS; 357 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC)) 358 *pos |= IEEE80211_RADIOTAP_F_BADFCS; 359 if (status->enc_flags & RX_ENC_FLAG_SHORTPRE) 360 *pos |= IEEE80211_RADIOTAP_F_SHORTPRE; 361 pos++; 362 363 /* IEEE80211_RADIOTAP_RATE */ 364 if (!rate || status->encoding != RX_ENC_LEGACY) { 365 /* 366 * Without rate information don't add it. If we have, 367 * MCS information is a separate field in radiotap, 368 * added below. The byte here is needed as padding 369 * for the channel though, so initialise it to 0. 370 */ 371 *pos = 0; 372 } else { 373 int shift = 0; 374 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE); 375 if (status->bw == RATE_INFO_BW_10) 376 shift = 1; 377 else if (status->bw == RATE_INFO_BW_5) 378 shift = 2; 379 *pos = DIV_ROUND_UP(rate->bitrate, 5 * (1 << shift)); 380 } 381 pos++; 382 383 /* IEEE80211_RADIOTAP_CHANNEL */ 384 put_unaligned_le16(status->freq, pos); 385 pos += 2; 386 if (status->bw == RATE_INFO_BW_10) 387 channel_flags |= IEEE80211_CHAN_HALF; 388 else if (status->bw == RATE_INFO_BW_5) 389 channel_flags |= IEEE80211_CHAN_QUARTER; 390 391 if (status->band == NL80211_BAND_5GHZ) 392 channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ; 393 else if (status->encoding != RX_ENC_LEGACY) 394 channel_flags |= IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ; 395 else if (rate && rate->flags & IEEE80211_RATE_ERP_G) 396 channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ; 397 else if (rate) 398 channel_flags |= IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ; 399 else 400 channel_flags |= IEEE80211_CHAN_2GHZ; 401 put_unaligned_le16(channel_flags, pos); 402 pos += 2; 403 404 /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */ 405 if (ieee80211_hw_check(&local->hw, SIGNAL_DBM) && 406 !(status->flag & RX_FLAG_NO_SIGNAL_VAL)) { 407 *pos = status->signal; 408 rthdr->it_present |= 409 cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL); 410 pos++; 411 } 412 413 /* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */ 414 415 if (!status->chains) { 416 /* IEEE80211_RADIOTAP_ANTENNA */ 417 *pos = status->antenna; 418 pos++; 419 } 420 421 /* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */ 422 423 /* IEEE80211_RADIOTAP_RX_FLAGS */ 424 /* ensure 2 byte alignment for the 2 byte field as required */ 425 if ((pos - (u8 *)rthdr) & 1) 426 *pos++ = 0; 427 if (status->flag & RX_FLAG_FAILED_PLCP_CRC) 428 rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP; 429 put_unaligned_le16(rx_flags, pos); 430 pos += 2; 431 432 if (status->encoding == RX_ENC_HT) { 433 unsigned int stbc; 434 435 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_MCS); 436 *pos++ = local->hw.radiotap_mcs_details; 437 *pos = 0; 438 if (status->enc_flags & RX_ENC_FLAG_SHORT_GI) 439 *pos |= IEEE80211_RADIOTAP_MCS_SGI; 440 if (status->bw == RATE_INFO_BW_40) 441 *pos |= IEEE80211_RADIOTAP_MCS_BW_40; 442 if (status->enc_flags & RX_ENC_FLAG_HT_GF) 443 *pos |= IEEE80211_RADIOTAP_MCS_FMT_GF; 444 if (status->enc_flags & RX_ENC_FLAG_LDPC) 445 *pos |= IEEE80211_RADIOTAP_MCS_FEC_LDPC; 446 stbc = (status->enc_flags & RX_ENC_FLAG_STBC_MASK) >> RX_ENC_FLAG_STBC_SHIFT; 447 *pos |= stbc << IEEE80211_RADIOTAP_MCS_STBC_SHIFT; 448 pos++; 449 *pos++ = status->rate_idx; 450 } 451 452 if (status->flag & RX_FLAG_AMPDU_DETAILS) { 453 u16 flags = 0; 454 455 /* ensure 4 byte alignment */ 456 while ((pos - (u8 *)rthdr) & 3) 457 pos++; 458 rthdr->it_present |= 459 cpu_to_le32(1 << IEEE80211_RADIOTAP_AMPDU_STATUS); 460 put_unaligned_le32(status->ampdu_reference, pos); 461 pos += 4; 462 if (status->flag & RX_FLAG_AMPDU_LAST_KNOWN) 463 flags |= IEEE80211_RADIOTAP_AMPDU_LAST_KNOWN; 464 if (status->flag & RX_FLAG_AMPDU_IS_LAST) 465 flags |= IEEE80211_RADIOTAP_AMPDU_IS_LAST; 466 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_ERROR) 467 flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_ERR; 468 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN) 469 flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_KNOWN; 470 if (status->flag & RX_FLAG_AMPDU_EOF_BIT_KNOWN) 471 flags |= IEEE80211_RADIOTAP_AMPDU_EOF_KNOWN; 472 if (status->flag & RX_FLAG_AMPDU_EOF_BIT) 473 flags |= IEEE80211_RADIOTAP_AMPDU_EOF; 474 put_unaligned_le16(flags, pos); 475 pos += 2; 476 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN) 477 *pos++ = status->ampdu_delimiter_crc; 478 else 479 *pos++ = 0; 480 *pos++ = 0; 481 } 482 483 if (status->encoding == RX_ENC_VHT) { 484 u16 known = local->hw.radiotap_vht_details; 485 486 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_VHT); 487 put_unaligned_le16(known, pos); 488 pos += 2; 489 /* flags */ 490 if (status->enc_flags & RX_ENC_FLAG_SHORT_GI) 491 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_SGI; 492 /* in VHT, STBC is binary */ 493 if (status->enc_flags & RX_ENC_FLAG_STBC_MASK) 494 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_STBC; 495 if (status->enc_flags & RX_ENC_FLAG_BF) 496 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_BEAMFORMED; 497 pos++; 498 /* bandwidth */ 499 switch (status->bw) { 500 case RATE_INFO_BW_80: 501 *pos++ = 4; 502 break; 503 case RATE_INFO_BW_160: 504 *pos++ = 11; 505 break; 506 case RATE_INFO_BW_40: 507 *pos++ = 1; 508 break; 509 default: 510 *pos++ = 0; 511 } 512 /* MCS/NSS */ 513 *pos = (status->rate_idx << 4) | status->nss; 514 pos += 4; 515 /* coding field */ 516 if (status->enc_flags & RX_ENC_FLAG_LDPC) 517 *pos |= IEEE80211_RADIOTAP_CODING_LDPC_USER0; 518 pos++; 519 /* group ID */ 520 pos++; 521 /* partial_aid */ 522 pos += 2; 523 } 524 525 if (local->hw.radiotap_timestamp.units_pos >= 0) { 526 u16 accuracy = 0; 527 u8 flags = IEEE80211_RADIOTAP_TIMESTAMP_FLAG_32BIT; 528 529 rthdr->it_present |= 530 cpu_to_le32(1 << IEEE80211_RADIOTAP_TIMESTAMP); 531 532 /* ensure 8 byte alignment */ 533 while ((pos - (u8 *)rthdr) & 7) 534 pos++; 535 536 put_unaligned_le64(status->device_timestamp, pos); 537 pos += sizeof(u64); 538 539 if (local->hw.radiotap_timestamp.accuracy >= 0) { 540 accuracy = local->hw.radiotap_timestamp.accuracy; 541 flags |= IEEE80211_RADIOTAP_TIMESTAMP_FLAG_ACCURACY; 542 } 543 put_unaligned_le16(accuracy, pos); 544 pos += sizeof(u16); 545 546 *pos++ = local->hw.radiotap_timestamp.units_pos; 547 *pos++ = flags; 548 } 549 550 if (status->encoding == RX_ENC_HE && 551 status->flag & RX_FLAG_RADIOTAP_HE) { 552 #define HE_PREP(f, val) cpu_to_le16(FIELD_PREP(IEEE80211_RADIOTAP_HE_##f, val)) 553 554 if (status->enc_flags & RX_ENC_FLAG_STBC_MASK) { 555 he.data6 |= HE_PREP(DATA6_NSTS, 556 FIELD_GET(RX_ENC_FLAG_STBC_MASK, 557 status->enc_flags)); 558 he.data3 |= HE_PREP(DATA3_STBC, 1); 559 } else { 560 he.data6 |= HE_PREP(DATA6_NSTS, status->nss); 561 } 562 563 #define CHECK_GI(s) \ 564 BUILD_BUG_ON(IEEE80211_RADIOTAP_HE_DATA5_GI_##s != \ 565 (int)NL80211_RATE_INFO_HE_GI_##s) 566 567 CHECK_GI(0_8); 568 CHECK_GI(1_6); 569 CHECK_GI(3_2); 570 571 he.data3 |= HE_PREP(DATA3_DATA_MCS, status->rate_idx); 572 he.data3 |= HE_PREP(DATA3_DATA_DCM, status->he_dcm); 573 he.data3 |= HE_PREP(DATA3_CODING, 574 !!(status->enc_flags & RX_ENC_FLAG_LDPC)); 575 576 he.data5 |= HE_PREP(DATA5_GI, status->he_gi); 577 578 switch (status->bw) { 579 case RATE_INFO_BW_20: 580 he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC, 581 IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_20MHZ); 582 break; 583 case RATE_INFO_BW_40: 584 he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC, 585 IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_40MHZ); 586 break; 587 case RATE_INFO_BW_80: 588 he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC, 589 IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_80MHZ); 590 break; 591 case RATE_INFO_BW_160: 592 he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC, 593 IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_160MHZ); 594 break; 595 case RATE_INFO_BW_HE_RU: 596 #define CHECK_RU_ALLOC(s) \ 597 BUILD_BUG_ON(IEEE80211_RADIOTAP_HE_DATA5_DATA_BW_RU_ALLOC_##s##T != \ 598 NL80211_RATE_INFO_HE_RU_ALLOC_##s + 4) 599 600 CHECK_RU_ALLOC(26); 601 CHECK_RU_ALLOC(52); 602 CHECK_RU_ALLOC(106); 603 CHECK_RU_ALLOC(242); 604 CHECK_RU_ALLOC(484); 605 CHECK_RU_ALLOC(996); 606 CHECK_RU_ALLOC(2x996); 607 608 he.data5 |= HE_PREP(DATA5_DATA_BW_RU_ALLOC, 609 status->he_ru + 4); 610 break; 611 default: 612 WARN_ONCE(1, "Invalid SU BW %d\n", status->bw); 613 } 614 615 /* ensure 2 byte alignment */ 616 while ((pos - (u8 *)rthdr) & 1) 617 pos++; 618 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_HE); 619 memcpy(pos, &he, sizeof(he)); 620 pos += sizeof(he); 621 } 622 623 if (status->encoding == RX_ENC_HE && 624 status->flag & RX_FLAG_RADIOTAP_HE_MU) { 625 /* ensure 2 byte alignment */ 626 while ((pos - (u8 *)rthdr) & 1) 627 pos++; 628 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_HE_MU); 629 memcpy(pos, &he_mu, sizeof(he_mu)); 630 pos += sizeof(he_mu); 631 } 632 633 for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) { 634 *pos++ = status->chain_signal[chain]; 635 *pos++ = chain; 636 } 637 638 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) { 639 /* ensure 2 byte alignment for the vendor field as required */ 640 if ((pos - (u8 *)rthdr) & 1) 641 *pos++ = 0; 642 *pos++ = rtap.oui[0]; 643 *pos++ = rtap.oui[1]; 644 *pos++ = rtap.oui[2]; 645 *pos++ = rtap.subns; 646 put_unaligned_le16(rtap.len, pos); 647 pos += 2; 648 /* align the actual payload as requested */ 649 while ((pos - (u8 *)rthdr) & (rtap.align - 1)) 650 *pos++ = 0; 651 /* data (and possible padding) already follows */ 652 } 653 } 654 655 static struct sk_buff * 656 ieee80211_make_monitor_skb(struct ieee80211_local *local, 657 struct sk_buff **origskb, 658 struct ieee80211_rate *rate, 659 int rtap_space, bool use_origskb) 660 { 661 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(*origskb); 662 int rt_hdrlen, needed_headroom; 663 struct sk_buff *skb; 664 665 /* room for the radiotap header based on driver features */ 666 rt_hdrlen = ieee80211_rx_radiotap_hdrlen(local, status, *origskb); 667 needed_headroom = rt_hdrlen - rtap_space; 668 669 if (use_origskb) { 670 /* only need to expand headroom if necessary */ 671 skb = *origskb; 672 *origskb = NULL; 673 674 /* 675 * This shouldn't trigger often because most devices have an 676 * RX header they pull before we get here, and that should 677 * be big enough for our radiotap information. We should 678 * probably export the length to drivers so that we can have 679 * them allocate enough headroom to start with. 680 */ 681 if (skb_headroom(skb) < needed_headroom && 682 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) { 683 dev_kfree_skb(skb); 684 return NULL; 685 } 686 } else { 687 /* 688 * Need to make a copy and possibly remove radiotap header 689 * and FCS from the original. 690 */ 691 skb = skb_copy_expand(*origskb, needed_headroom, 0, GFP_ATOMIC); 692 693 if (!skb) 694 return NULL; 695 } 696 697 /* prepend radiotap information */ 698 ieee80211_add_rx_radiotap_header(local, skb, rate, rt_hdrlen, true); 699 700 skb_reset_mac_header(skb); 701 skb->ip_summed = CHECKSUM_UNNECESSARY; 702 skb->pkt_type = PACKET_OTHERHOST; 703 skb->protocol = htons(ETH_P_802_2); 704 705 return skb; 706 } 707 708 /* 709 * This function copies a received frame to all monitor interfaces and 710 * returns a cleaned-up SKB that no longer includes the FCS nor the 711 * radiotap header the driver might have added. 712 */ 713 static struct sk_buff * 714 ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb, 715 struct ieee80211_rate *rate) 716 { 717 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb); 718 struct ieee80211_sub_if_data *sdata; 719 struct sk_buff *monskb = NULL; 720 int present_fcs_len = 0; 721 unsigned int rtap_space = 0; 722 struct ieee80211_sub_if_data *monitor_sdata = 723 rcu_dereference(local->monitor_sdata); 724 bool only_monitor = false; 725 726 if (status->flag & RX_FLAG_RADIOTAP_HE) 727 rtap_space += sizeof(struct ieee80211_radiotap_he); 728 729 if (status->flag & RX_FLAG_RADIOTAP_HE_MU) 730 rtap_space += sizeof(struct ieee80211_radiotap_he_mu); 731 732 if (unlikely(status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA)) { 733 struct ieee80211_vendor_radiotap *rtap = (void *)origskb->data; 734 735 rtap_space += sizeof(*rtap) + rtap->len + rtap->pad; 736 } 737 738 /* 739 * First, we may need to make a copy of the skb because 740 * (1) we need to modify it for radiotap (if not present), and 741 * (2) the other RX handlers will modify the skb we got. 742 * 743 * We don't need to, of course, if we aren't going to return 744 * the SKB because it has a bad FCS/PLCP checksum. 745 */ 746 747 if (ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)) { 748 if (unlikely(origskb->len <= FCS_LEN)) { 749 /* driver bug */ 750 WARN_ON(1); 751 dev_kfree_skb(origskb); 752 return NULL; 753 } 754 present_fcs_len = FCS_LEN; 755 } 756 757 /* ensure hdr->frame_control and vendor radiotap data are in skb head */ 758 if (!pskb_may_pull(origskb, 2 + rtap_space)) { 759 dev_kfree_skb(origskb); 760 return NULL; 761 } 762 763 only_monitor = should_drop_frame(origskb, present_fcs_len, rtap_space); 764 765 if (!local->monitors || (status->flag & RX_FLAG_SKIP_MONITOR)) { 766 if (only_monitor) { 767 dev_kfree_skb(origskb); 768 return NULL; 769 } 770 771 remove_monitor_info(origskb, present_fcs_len, rtap_space); 772 return origskb; 773 } 774 775 ieee80211_handle_mu_mimo_mon(monitor_sdata, origskb, rtap_space); 776 777 list_for_each_entry_rcu(sdata, &local->mon_list, u.mntr.list) { 778 bool last_monitor = list_is_last(&sdata->u.mntr.list, 779 &local->mon_list); 780 781 if (!monskb) 782 monskb = ieee80211_make_monitor_skb(local, &origskb, 783 rate, rtap_space, 784 only_monitor && 785 last_monitor); 786 787 if (monskb) { 788 struct sk_buff *skb; 789 790 if (last_monitor) { 791 skb = monskb; 792 monskb = NULL; 793 } else { 794 skb = skb_clone(monskb, GFP_ATOMIC); 795 } 796 797 if (skb) { 798 skb->dev = sdata->dev; 799 ieee80211_rx_stats(skb->dev, skb->len); 800 netif_receive_skb(skb); 801 } 802 } 803 804 if (last_monitor) 805 break; 806 } 807 808 /* this happens if last_monitor was erroneously false */ 809 dev_kfree_skb(monskb); 810 811 /* ditto */ 812 if (!origskb) 813 return NULL; 814 815 remove_monitor_info(origskb, present_fcs_len, rtap_space); 816 return origskb; 817 } 818 819 static void ieee80211_parse_qos(struct ieee80211_rx_data *rx) 820 { 821 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 822 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 823 int tid, seqno_idx, security_idx; 824 825 /* does the frame have a qos control field? */ 826 if (ieee80211_is_data_qos(hdr->frame_control)) { 827 u8 *qc = ieee80211_get_qos_ctl(hdr); 828 /* frame has qos control */ 829 tid = *qc & IEEE80211_QOS_CTL_TID_MASK; 830 if (*qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT) 831 status->rx_flags |= IEEE80211_RX_AMSDU; 832 833 seqno_idx = tid; 834 security_idx = tid; 835 } else { 836 /* 837 * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"): 838 * 839 * Sequence numbers for management frames, QoS data 840 * frames with a broadcast/multicast address in the 841 * Address 1 field, and all non-QoS data frames sent 842 * by QoS STAs are assigned using an additional single 843 * modulo-4096 counter, [...] 844 * 845 * We also use that counter for non-QoS STAs. 846 */ 847 seqno_idx = IEEE80211_NUM_TIDS; 848 security_idx = 0; 849 if (ieee80211_is_mgmt(hdr->frame_control)) 850 security_idx = IEEE80211_NUM_TIDS; 851 tid = 0; 852 } 853 854 rx->seqno_idx = seqno_idx; 855 rx->security_idx = security_idx; 856 /* Set skb->priority to 1d tag if highest order bit of TID is not set. 857 * For now, set skb->priority to 0 for other cases. */ 858 rx->skb->priority = (tid > 7) ? 0 : tid; 859 } 860 861 /** 862 * DOC: Packet alignment 863 * 864 * Drivers always need to pass packets that are aligned to two-byte boundaries 865 * to the stack. 866 * 867 * Additionally, should, if possible, align the payload data in a way that 868 * guarantees that the contained IP header is aligned to a four-byte 869 * boundary. In the case of regular frames, this simply means aligning the 870 * payload to a four-byte boundary (because either the IP header is directly 871 * contained, or IV/RFC1042 headers that have a length divisible by four are 872 * in front of it). If the payload data is not properly aligned and the 873 * architecture doesn't support efficient unaligned operations, mac80211 874 * will align the data. 875 * 876 * With A-MSDU frames, however, the payload data address must yield two modulo 877 * four because there are 14-byte 802.3 headers within the A-MSDU frames that 878 * push the IP header further back to a multiple of four again. Thankfully, the 879 * specs were sane enough this time around to require padding each A-MSDU 880 * subframe to a length that is a multiple of four. 881 * 882 * Padding like Atheros hardware adds which is between the 802.11 header and 883 * the payload is not supported, the driver is required to move the 802.11 884 * header to be directly in front of the payload in that case. 885 */ 886 static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx) 887 { 888 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG 889 WARN_ON_ONCE((unsigned long)rx->skb->data & 1); 890 #endif 891 } 892 893 894 /* rx handlers */ 895 896 static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb) 897 { 898 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 899 900 if (is_multicast_ether_addr(hdr->addr1)) 901 return 0; 902 903 return ieee80211_is_robust_mgmt_frame(skb); 904 } 905 906 907 static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb) 908 { 909 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 910 911 if (!is_multicast_ether_addr(hdr->addr1)) 912 return 0; 913 914 return ieee80211_is_robust_mgmt_frame(skb); 915 } 916 917 918 /* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */ 919 static int ieee80211_get_mmie_keyidx(struct sk_buff *skb) 920 { 921 struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data; 922 struct ieee80211_mmie *mmie; 923 struct ieee80211_mmie_16 *mmie16; 924 925 if (skb->len < 24 + sizeof(*mmie) || !is_multicast_ether_addr(hdr->da)) 926 return -1; 927 928 if (!ieee80211_is_robust_mgmt_frame(skb)) 929 return -1; /* not a robust management frame */ 930 931 mmie = (struct ieee80211_mmie *) 932 (skb->data + skb->len - sizeof(*mmie)); 933 if (mmie->element_id == WLAN_EID_MMIE && 934 mmie->length == sizeof(*mmie) - 2) 935 return le16_to_cpu(mmie->key_id); 936 937 mmie16 = (struct ieee80211_mmie_16 *) 938 (skb->data + skb->len - sizeof(*mmie16)); 939 if (skb->len >= 24 + sizeof(*mmie16) && 940 mmie16->element_id == WLAN_EID_MMIE && 941 mmie16->length == sizeof(*mmie16) - 2) 942 return le16_to_cpu(mmie16->key_id); 943 944 return -1; 945 } 946 947 static int ieee80211_get_cs_keyid(const struct ieee80211_cipher_scheme *cs, 948 struct sk_buff *skb) 949 { 950 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; 951 __le16 fc; 952 int hdrlen; 953 u8 keyid; 954 955 fc = hdr->frame_control; 956 hdrlen = ieee80211_hdrlen(fc); 957 958 if (skb->len < hdrlen + cs->hdr_len) 959 return -EINVAL; 960 961 skb_copy_bits(skb, hdrlen + cs->key_idx_off, &keyid, 1); 962 keyid &= cs->key_idx_mask; 963 keyid >>= cs->key_idx_shift; 964 965 return keyid; 966 } 967 968 static ieee80211_rx_result ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx) 969 { 970 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 971 char *dev_addr = rx->sdata->vif.addr; 972 973 if (ieee80211_is_data(hdr->frame_control)) { 974 if (is_multicast_ether_addr(hdr->addr1)) { 975 if (ieee80211_has_tods(hdr->frame_control) || 976 !ieee80211_has_fromds(hdr->frame_control)) 977 return RX_DROP_MONITOR; 978 if (ether_addr_equal(hdr->addr3, dev_addr)) 979 return RX_DROP_MONITOR; 980 } else { 981 if (!ieee80211_has_a4(hdr->frame_control)) 982 return RX_DROP_MONITOR; 983 if (ether_addr_equal(hdr->addr4, dev_addr)) 984 return RX_DROP_MONITOR; 985 } 986 } 987 988 /* If there is not an established peer link and this is not a peer link 989 * establisment frame, beacon or probe, drop the frame. 990 */ 991 992 if (!rx->sta || sta_plink_state(rx->sta) != NL80211_PLINK_ESTAB) { 993 struct ieee80211_mgmt *mgmt; 994 995 if (!ieee80211_is_mgmt(hdr->frame_control)) 996 return RX_DROP_MONITOR; 997 998 if (ieee80211_is_action(hdr->frame_control)) { 999 u8 category; 1000 1001 /* make sure category field is present */ 1002 if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE) 1003 return RX_DROP_MONITOR; 1004 1005 mgmt = (struct ieee80211_mgmt *)hdr; 1006 category = mgmt->u.action.category; 1007 if (category != WLAN_CATEGORY_MESH_ACTION && 1008 category != WLAN_CATEGORY_SELF_PROTECTED) 1009 return RX_DROP_MONITOR; 1010 return RX_CONTINUE; 1011 } 1012 1013 if (ieee80211_is_probe_req(hdr->frame_control) || 1014 ieee80211_is_probe_resp(hdr->frame_control) || 1015 ieee80211_is_beacon(hdr->frame_control) || 1016 ieee80211_is_auth(hdr->frame_control)) 1017 return RX_CONTINUE; 1018 1019 return RX_DROP_MONITOR; 1020 } 1021 1022 return RX_CONTINUE; 1023 } 1024 1025 static inline bool ieee80211_rx_reorder_ready(struct tid_ampdu_rx *tid_agg_rx, 1026 int index) 1027 { 1028 struct sk_buff_head *frames = &tid_agg_rx->reorder_buf[index]; 1029 struct sk_buff *tail = skb_peek_tail(frames); 1030 struct ieee80211_rx_status *status; 1031 1032 if (tid_agg_rx->reorder_buf_filtered & BIT_ULL(index)) 1033 return true; 1034 1035 if (!tail) 1036 return false; 1037 1038 status = IEEE80211_SKB_RXCB(tail); 1039 if (status->flag & RX_FLAG_AMSDU_MORE) 1040 return false; 1041 1042 return true; 1043 } 1044 1045 static void ieee80211_release_reorder_frame(struct ieee80211_sub_if_data *sdata, 1046 struct tid_ampdu_rx *tid_agg_rx, 1047 int index, 1048 struct sk_buff_head *frames) 1049 { 1050 struct sk_buff_head *skb_list = &tid_agg_rx->reorder_buf[index]; 1051 struct sk_buff *skb; 1052 struct ieee80211_rx_status *status; 1053 1054 lockdep_assert_held(&tid_agg_rx->reorder_lock); 1055 1056 if (skb_queue_empty(skb_list)) 1057 goto no_frame; 1058 1059 if (!ieee80211_rx_reorder_ready(tid_agg_rx, index)) { 1060 __skb_queue_purge(skb_list); 1061 goto no_frame; 1062 } 1063 1064 /* release frames from the reorder ring buffer */ 1065 tid_agg_rx->stored_mpdu_num--; 1066 while ((skb = __skb_dequeue(skb_list))) { 1067 status = IEEE80211_SKB_RXCB(skb); 1068 status->rx_flags |= IEEE80211_RX_DEFERRED_RELEASE; 1069 __skb_queue_tail(frames, skb); 1070 } 1071 1072 no_frame: 1073 tid_agg_rx->reorder_buf_filtered &= ~BIT_ULL(index); 1074 tid_agg_rx->head_seq_num = ieee80211_sn_inc(tid_agg_rx->head_seq_num); 1075 } 1076 1077 static void ieee80211_release_reorder_frames(struct ieee80211_sub_if_data *sdata, 1078 struct tid_ampdu_rx *tid_agg_rx, 1079 u16 head_seq_num, 1080 struct sk_buff_head *frames) 1081 { 1082 int index; 1083 1084 lockdep_assert_held(&tid_agg_rx->reorder_lock); 1085 1086 while (ieee80211_sn_less(tid_agg_rx->head_seq_num, head_seq_num)) { 1087 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size; 1088 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index, 1089 frames); 1090 } 1091 } 1092 1093 /* 1094 * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If 1095 * the skb was added to the buffer longer than this time ago, the earlier 1096 * frames that have not yet been received are assumed to be lost and the skb 1097 * can be released for processing. This may also release other skb's from the 1098 * reorder buffer if there are no additional gaps between the frames. 1099 * 1100 * Callers must hold tid_agg_rx->reorder_lock. 1101 */ 1102 #define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10) 1103 1104 static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata, 1105 struct tid_ampdu_rx *tid_agg_rx, 1106 struct sk_buff_head *frames) 1107 { 1108 int index, i, j; 1109 1110 lockdep_assert_held(&tid_agg_rx->reorder_lock); 1111 1112 /* release the buffer until next missing frame */ 1113 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size; 1114 if (!ieee80211_rx_reorder_ready(tid_agg_rx, index) && 1115 tid_agg_rx->stored_mpdu_num) { 1116 /* 1117 * No buffers ready to be released, but check whether any 1118 * frames in the reorder buffer have timed out. 1119 */ 1120 int skipped = 1; 1121 for (j = (index + 1) % tid_agg_rx->buf_size; j != index; 1122 j = (j + 1) % tid_agg_rx->buf_size) { 1123 if (!ieee80211_rx_reorder_ready(tid_agg_rx, j)) { 1124 skipped++; 1125 continue; 1126 } 1127 if (skipped && 1128 !time_after(jiffies, tid_agg_rx->reorder_time[j] + 1129 HT_RX_REORDER_BUF_TIMEOUT)) 1130 goto set_release_timer; 1131 1132 /* don't leave incomplete A-MSDUs around */ 1133 for (i = (index + 1) % tid_agg_rx->buf_size; i != j; 1134 i = (i + 1) % tid_agg_rx->buf_size) 1135 __skb_queue_purge(&tid_agg_rx->reorder_buf[i]); 1136 1137 ht_dbg_ratelimited(sdata, 1138 "release an RX reorder frame due to timeout on earlier frames\n"); 1139 ieee80211_release_reorder_frame(sdata, tid_agg_rx, j, 1140 frames); 1141 1142 /* 1143 * Increment the head seq# also for the skipped slots. 1144 */ 1145 tid_agg_rx->head_seq_num = 1146 (tid_agg_rx->head_seq_num + 1147 skipped) & IEEE80211_SN_MASK; 1148 skipped = 0; 1149 } 1150 } else while (ieee80211_rx_reorder_ready(tid_agg_rx, index)) { 1151 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index, 1152 frames); 1153 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size; 1154 } 1155 1156 if (tid_agg_rx->stored_mpdu_num) { 1157 j = index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size; 1158 1159 for (; j != (index - 1) % tid_agg_rx->buf_size; 1160 j = (j + 1) % tid_agg_rx->buf_size) { 1161 if (ieee80211_rx_reorder_ready(tid_agg_rx, j)) 1162 break; 1163 } 1164 1165 set_release_timer: 1166 1167 if (!tid_agg_rx->removed) 1168 mod_timer(&tid_agg_rx->reorder_timer, 1169 tid_agg_rx->reorder_time[j] + 1 + 1170 HT_RX_REORDER_BUF_TIMEOUT); 1171 } else { 1172 del_timer(&tid_agg_rx->reorder_timer); 1173 } 1174 } 1175 1176 /* 1177 * As this function belongs to the RX path it must be under 1178 * rcu_read_lock protection. It returns false if the frame 1179 * can be processed immediately, true if it was consumed. 1180 */ 1181 static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata, 1182 struct tid_ampdu_rx *tid_agg_rx, 1183 struct sk_buff *skb, 1184 struct sk_buff_head *frames) 1185 { 1186 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 1187 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 1188 u16 sc = le16_to_cpu(hdr->seq_ctrl); 1189 u16 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4; 1190 u16 head_seq_num, buf_size; 1191 int index; 1192 bool ret = true; 1193 1194 spin_lock(&tid_agg_rx->reorder_lock); 1195 1196 /* 1197 * Offloaded BA sessions have no known starting sequence number so pick 1198 * one from first Rxed frame for this tid after BA was started. 1199 */ 1200 if (unlikely(tid_agg_rx->auto_seq)) { 1201 tid_agg_rx->auto_seq = false; 1202 tid_agg_rx->ssn = mpdu_seq_num; 1203 tid_agg_rx->head_seq_num = mpdu_seq_num; 1204 } 1205 1206 buf_size = tid_agg_rx->buf_size; 1207 head_seq_num = tid_agg_rx->head_seq_num; 1208 1209 /* 1210 * If the current MPDU's SN is smaller than the SSN, it shouldn't 1211 * be reordered. 1212 */ 1213 if (unlikely(!tid_agg_rx->started)) { 1214 if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) { 1215 ret = false; 1216 goto out; 1217 } 1218 tid_agg_rx->started = true; 1219 } 1220 1221 /* frame with out of date sequence number */ 1222 if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) { 1223 dev_kfree_skb(skb); 1224 goto out; 1225 } 1226 1227 /* 1228 * If frame the sequence number exceeds our buffering window 1229 * size release some previous frames to make room for this one. 1230 */ 1231 if (!ieee80211_sn_less(mpdu_seq_num, head_seq_num + buf_size)) { 1232 head_seq_num = ieee80211_sn_inc( 1233 ieee80211_sn_sub(mpdu_seq_num, buf_size)); 1234 /* release stored frames up to new head to stack */ 1235 ieee80211_release_reorder_frames(sdata, tid_agg_rx, 1236 head_seq_num, frames); 1237 } 1238 1239 /* Now the new frame is always in the range of the reordering buffer */ 1240 1241 index = mpdu_seq_num % tid_agg_rx->buf_size; 1242 1243 /* check if we already stored this frame */ 1244 if (ieee80211_rx_reorder_ready(tid_agg_rx, index)) { 1245 dev_kfree_skb(skb); 1246 goto out; 1247 } 1248 1249 /* 1250 * If the current MPDU is in the right order and nothing else 1251 * is stored we can process it directly, no need to buffer it. 1252 * If it is first but there's something stored, we may be able 1253 * to release frames after this one. 1254 */ 1255 if (mpdu_seq_num == tid_agg_rx->head_seq_num && 1256 tid_agg_rx->stored_mpdu_num == 0) { 1257 if (!(status->flag & RX_FLAG_AMSDU_MORE)) 1258 tid_agg_rx->head_seq_num = 1259 ieee80211_sn_inc(tid_agg_rx->head_seq_num); 1260 ret = false; 1261 goto out; 1262 } 1263 1264 /* put the frame in the reordering buffer */ 1265 __skb_queue_tail(&tid_agg_rx->reorder_buf[index], skb); 1266 if (!(status->flag & RX_FLAG_AMSDU_MORE)) { 1267 tid_agg_rx->reorder_time[index] = jiffies; 1268 tid_agg_rx->stored_mpdu_num++; 1269 ieee80211_sta_reorder_release(sdata, tid_agg_rx, frames); 1270 } 1271 1272 out: 1273 spin_unlock(&tid_agg_rx->reorder_lock); 1274 return ret; 1275 } 1276 1277 /* 1278 * Reorder MPDUs from A-MPDUs, keeping them on a buffer. Returns 1279 * true if the MPDU was buffered, false if it should be processed. 1280 */ 1281 static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx, 1282 struct sk_buff_head *frames) 1283 { 1284 struct sk_buff *skb = rx->skb; 1285 struct ieee80211_local *local = rx->local; 1286 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 1287 struct sta_info *sta = rx->sta; 1288 struct tid_ampdu_rx *tid_agg_rx; 1289 u16 sc; 1290 u8 tid, ack_policy; 1291 1292 if (!ieee80211_is_data_qos(hdr->frame_control) || 1293 is_multicast_ether_addr(hdr->addr1)) 1294 goto dont_reorder; 1295 1296 /* 1297 * filter the QoS data rx stream according to 1298 * STA/TID and check if this STA/TID is on aggregation 1299 */ 1300 1301 if (!sta) 1302 goto dont_reorder; 1303 1304 ack_policy = *ieee80211_get_qos_ctl(hdr) & 1305 IEEE80211_QOS_CTL_ACK_POLICY_MASK; 1306 tid = ieee80211_get_tid(hdr); 1307 1308 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]); 1309 if (!tid_agg_rx) { 1310 if (ack_policy == IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK && 1311 !test_bit(tid, rx->sta->ampdu_mlme.agg_session_valid) && 1312 !test_and_set_bit(tid, rx->sta->ampdu_mlme.unexpected_agg)) 1313 ieee80211_send_delba(rx->sdata, rx->sta->sta.addr, tid, 1314 WLAN_BACK_RECIPIENT, 1315 WLAN_REASON_QSTA_REQUIRE_SETUP); 1316 goto dont_reorder; 1317 } 1318 1319 /* qos null data frames are excluded */ 1320 if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC))) 1321 goto dont_reorder; 1322 1323 /* not part of a BA session */ 1324 if (ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK && 1325 ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_NORMAL) 1326 goto dont_reorder; 1327 1328 /* new, potentially un-ordered, ampdu frame - process it */ 1329 1330 /* reset session timer */ 1331 if (tid_agg_rx->timeout) 1332 tid_agg_rx->last_rx = jiffies; 1333 1334 /* if this mpdu is fragmented - terminate rx aggregation session */ 1335 sc = le16_to_cpu(hdr->seq_ctrl); 1336 if (sc & IEEE80211_SCTL_FRAG) { 1337 skb_queue_tail(&rx->sdata->skb_queue, skb); 1338 ieee80211_queue_work(&local->hw, &rx->sdata->work); 1339 return; 1340 } 1341 1342 /* 1343 * No locking needed -- we will only ever process one 1344 * RX packet at a time, and thus own tid_agg_rx. All 1345 * other code manipulating it needs to (and does) make 1346 * sure that we cannot get to it any more before doing 1347 * anything with it. 1348 */ 1349 if (ieee80211_sta_manage_reorder_buf(rx->sdata, tid_agg_rx, skb, 1350 frames)) 1351 return; 1352 1353 dont_reorder: 1354 __skb_queue_tail(frames, skb); 1355 } 1356 1357 static ieee80211_rx_result debug_noinline 1358 ieee80211_rx_h_check_dup(struct ieee80211_rx_data *rx) 1359 { 1360 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 1361 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 1362 1363 if (status->flag & RX_FLAG_DUP_VALIDATED) 1364 return RX_CONTINUE; 1365 1366 /* 1367 * Drop duplicate 802.11 retransmissions 1368 * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery") 1369 */ 1370 1371 if (rx->skb->len < 24) 1372 return RX_CONTINUE; 1373 1374 if (ieee80211_is_ctl(hdr->frame_control) || 1375 ieee80211_is_qos_nullfunc(hdr->frame_control) || 1376 is_multicast_ether_addr(hdr->addr1)) 1377 return RX_CONTINUE; 1378 1379 if (!rx->sta) 1380 return RX_CONTINUE; 1381 1382 if (unlikely(ieee80211_has_retry(hdr->frame_control) && 1383 rx->sta->last_seq_ctrl[rx->seqno_idx] == hdr->seq_ctrl)) { 1384 I802_DEBUG_INC(rx->local->dot11FrameDuplicateCount); 1385 rx->sta->rx_stats.num_duplicates++; 1386 return RX_DROP_UNUSABLE; 1387 } else if (!(status->flag & RX_FLAG_AMSDU_MORE)) { 1388 rx->sta->last_seq_ctrl[rx->seqno_idx] = hdr->seq_ctrl; 1389 } 1390 1391 return RX_CONTINUE; 1392 } 1393 1394 static ieee80211_rx_result debug_noinline 1395 ieee80211_rx_h_check(struct ieee80211_rx_data *rx) 1396 { 1397 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 1398 1399 /* Drop disallowed frame classes based on STA auth/assoc state; 1400 * IEEE 802.11, Chap 5.5. 1401 * 1402 * mac80211 filters only based on association state, i.e. it drops 1403 * Class 3 frames from not associated stations. hostapd sends 1404 * deauth/disassoc frames when needed. In addition, hostapd is 1405 * responsible for filtering on both auth and assoc states. 1406 */ 1407 1408 if (ieee80211_vif_is_mesh(&rx->sdata->vif)) 1409 return ieee80211_rx_mesh_check(rx); 1410 1411 if (unlikely((ieee80211_is_data(hdr->frame_control) || 1412 ieee80211_is_pspoll(hdr->frame_control)) && 1413 rx->sdata->vif.type != NL80211_IFTYPE_ADHOC && 1414 rx->sdata->vif.type != NL80211_IFTYPE_WDS && 1415 rx->sdata->vif.type != NL80211_IFTYPE_OCB && 1416 (!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_ASSOC)))) { 1417 /* 1418 * accept port control frames from the AP even when it's not 1419 * yet marked ASSOC to prevent a race where we don't set the 1420 * assoc bit quickly enough before it sends the first frame 1421 */ 1422 if (rx->sta && rx->sdata->vif.type == NL80211_IFTYPE_STATION && 1423 ieee80211_is_data_present(hdr->frame_control)) { 1424 unsigned int hdrlen; 1425 __be16 ethertype; 1426 1427 hdrlen = ieee80211_hdrlen(hdr->frame_control); 1428 1429 if (rx->skb->len < hdrlen + 8) 1430 return RX_DROP_MONITOR; 1431 1432 skb_copy_bits(rx->skb, hdrlen + 6, ðertype, 2); 1433 if (ethertype == rx->sdata->control_port_protocol) 1434 return RX_CONTINUE; 1435 } 1436 1437 if (rx->sdata->vif.type == NL80211_IFTYPE_AP && 1438 cfg80211_rx_spurious_frame(rx->sdata->dev, 1439 hdr->addr2, 1440 GFP_ATOMIC)) 1441 return RX_DROP_UNUSABLE; 1442 1443 return RX_DROP_MONITOR; 1444 } 1445 1446 return RX_CONTINUE; 1447 } 1448 1449 1450 static ieee80211_rx_result debug_noinline 1451 ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx) 1452 { 1453 struct ieee80211_local *local; 1454 struct ieee80211_hdr *hdr; 1455 struct sk_buff *skb; 1456 1457 local = rx->local; 1458 skb = rx->skb; 1459 hdr = (struct ieee80211_hdr *) skb->data; 1460 1461 if (!local->pspolling) 1462 return RX_CONTINUE; 1463 1464 if (!ieee80211_has_fromds(hdr->frame_control)) 1465 /* this is not from AP */ 1466 return RX_CONTINUE; 1467 1468 if (!ieee80211_is_data(hdr->frame_control)) 1469 return RX_CONTINUE; 1470 1471 if (!ieee80211_has_moredata(hdr->frame_control)) { 1472 /* AP has no more frames buffered for us */ 1473 local->pspolling = false; 1474 return RX_CONTINUE; 1475 } 1476 1477 /* more data bit is set, let's request a new frame from the AP */ 1478 ieee80211_send_pspoll(local, rx->sdata); 1479 1480 return RX_CONTINUE; 1481 } 1482 1483 static void sta_ps_start(struct sta_info *sta) 1484 { 1485 struct ieee80211_sub_if_data *sdata = sta->sdata; 1486 struct ieee80211_local *local = sdata->local; 1487 struct ps_data *ps; 1488 int tid; 1489 1490 if (sta->sdata->vif.type == NL80211_IFTYPE_AP || 1491 sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) 1492 ps = &sdata->bss->ps; 1493 else 1494 return; 1495 1496 atomic_inc(&ps->num_sta_ps); 1497 set_sta_flag(sta, WLAN_STA_PS_STA); 1498 if (!ieee80211_hw_check(&local->hw, AP_LINK_PS)) 1499 drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta); 1500 ps_dbg(sdata, "STA %pM aid %d enters power save mode\n", 1501 sta->sta.addr, sta->sta.aid); 1502 1503 ieee80211_clear_fast_xmit(sta); 1504 1505 if (!sta->sta.txq[0]) 1506 return; 1507 1508 for (tid = 0; tid < ARRAY_SIZE(sta->sta.txq); tid++) { 1509 if (txq_has_queue(sta->sta.txq[tid])) 1510 set_bit(tid, &sta->txq_buffered_tids); 1511 else 1512 clear_bit(tid, &sta->txq_buffered_tids); 1513 } 1514 } 1515 1516 static void sta_ps_end(struct sta_info *sta) 1517 { 1518 ps_dbg(sta->sdata, "STA %pM aid %d exits power save mode\n", 1519 sta->sta.addr, sta->sta.aid); 1520 1521 if (test_sta_flag(sta, WLAN_STA_PS_DRIVER)) { 1522 /* 1523 * Clear the flag only if the other one is still set 1524 * so that the TX path won't start TX'ing new frames 1525 * directly ... In the case that the driver flag isn't 1526 * set ieee80211_sta_ps_deliver_wakeup() will clear it. 1527 */ 1528 clear_sta_flag(sta, WLAN_STA_PS_STA); 1529 ps_dbg(sta->sdata, "STA %pM aid %d driver-ps-blocked\n", 1530 sta->sta.addr, sta->sta.aid); 1531 return; 1532 } 1533 1534 set_sta_flag(sta, WLAN_STA_PS_DELIVER); 1535 clear_sta_flag(sta, WLAN_STA_PS_STA); 1536 ieee80211_sta_ps_deliver_wakeup(sta); 1537 } 1538 1539 int ieee80211_sta_ps_transition(struct ieee80211_sta *pubsta, bool start) 1540 { 1541 struct sta_info *sta = container_of(pubsta, struct sta_info, sta); 1542 bool in_ps; 1543 1544 WARN_ON(!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS)); 1545 1546 /* Don't let the same PS state be set twice */ 1547 in_ps = test_sta_flag(sta, WLAN_STA_PS_STA); 1548 if ((start && in_ps) || (!start && !in_ps)) 1549 return -EINVAL; 1550 1551 if (start) 1552 sta_ps_start(sta); 1553 else 1554 sta_ps_end(sta); 1555 1556 return 0; 1557 } 1558 EXPORT_SYMBOL(ieee80211_sta_ps_transition); 1559 1560 void ieee80211_sta_pspoll(struct ieee80211_sta *pubsta) 1561 { 1562 struct sta_info *sta = container_of(pubsta, struct sta_info, sta); 1563 1564 if (test_sta_flag(sta, WLAN_STA_SP)) 1565 return; 1566 1567 if (!test_sta_flag(sta, WLAN_STA_PS_DRIVER)) 1568 ieee80211_sta_ps_deliver_poll_response(sta); 1569 else 1570 set_sta_flag(sta, WLAN_STA_PSPOLL); 1571 } 1572 EXPORT_SYMBOL(ieee80211_sta_pspoll); 1573 1574 void ieee80211_sta_uapsd_trigger(struct ieee80211_sta *pubsta, u8 tid) 1575 { 1576 struct sta_info *sta = container_of(pubsta, struct sta_info, sta); 1577 int ac = ieee80211_ac_from_tid(tid); 1578 1579 /* 1580 * If this AC is not trigger-enabled do nothing unless the 1581 * driver is calling us after it already checked. 1582 * 1583 * NB: This could/should check a separate bitmap of trigger- 1584 * enabled queues, but for now we only implement uAPSD w/o 1585 * TSPEC changes to the ACs, so they're always the same. 1586 */ 1587 if (!(sta->sta.uapsd_queues & ieee80211_ac_to_qos_mask[ac]) && 1588 tid != IEEE80211_NUM_TIDS) 1589 return; 1590 1591 /* if we are in a service period, do nothing */ 1592 if (test_sta_flag(sta, WLAN_STA_SP)) 1593 return; 1594 1595 if (!test_sta_flag(sta, WLAN_STA_PS_DRIVER)) 1596 ieee80211_sta_ps_deliver_uapsd(sta); 1597 else 1598 set_sta_flag(sta, WLAN_STA_UAPSD); 1599 } 1600 EXPORT_SYMBOL(ieee80211_sta_uapsd_trigger); 1601 1602 static ieee80211_rx_result debug_noinline 1603 ieee80211_rx_h_uapsd_and_pspoll(struct ieee80211_rx_data *rx) 1604 { 1605 struct ieee80211_sub_if_data *sdata = rx->sdata; 1606 struct ieee80211_hdr *hdr = (void *)rx->skb->data; 1607 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 1608 1609 if (!rx->sta) 1610 return RX_CONTINUE; 1611 1612 if (sdata->vif.type != NL80211_IFTYPE_AP && 1613 sdata->vif.type != NL80211_IFTYPE_AP_VLAN) 1614 return RX_CONTINUE; 1615 1616 /* 1617 * The device handles station powersave, so don't do anything about 1618 * uAPSD and PS-Poll frames (the latter shouldn't even come up from 1619 * it to mac80211 since they're handled.) 1620 */ 1621 if (ieee80211_hw_check(&sdata->local->hw, AP_LINK_PS)) 1622 return RX_CONTINUE; 1623 1624 /* 1625 * Don't do anything if the station isn't already asleep. In 1626 * the uAPSD case, the station will probably be marked asleep, 1627 * in the PS-Poll case the station must be confused ... 1628 */ 1629 if (!test_sta_flag(rx->sta, WLAN_STA_PS_STA)) 1630 return RX_CONTINUE; 1631 1632 if (unlikely(ieee80211_is_pspoll(hdr->frame_control))) { 1633 ieee80211_sta_pspoll(&rx->sta->sta); 1634 1635 /* Free PS Poll skb here instead of returning RX_DROP that would 1636 * count as an dropped frame. */ 1637 dev_kfree_skb(rx->skb); 1638 1639 return RX_QUEUED; 1640 } else if (!ieee80211_has_morefrags(hdr->frame_control) && 1641 !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) && 1642 ieee80211_has_pm(hdr->frame_control) && 1643 (ieee80211_is_data_qos(hdr->frame_control) || 1644 ieee80211_is_qos_nullfunc(hdr->frame_control))) { 1645 u8 tid = ieee80211_get_tid(hdr); 1646 1647 ieee80211_sta_uapsd_trigger(&rx->sta->sta, tid); 1648 } 1649 1650 return RX_CONTINUE; 1651 } 1652 1653 static ieee80211_rx_result debug_noinline 1654 ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx) 1655 { 1656 struct sta_info *sta = rx->sta; 1657 struct sk_buff *skb = rx->skb; 1658 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 1659 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; 1660 int i; 1661 1662 if (!sta) 1663 return RX_CONTINUE; 1664 1665 /* 1666 * Update last_rx only for IBSS packets which are for the current 1667 * BSSID and for station already AUTHORIZED to avoid keeping the 1668 * current IBSS network alive in cases where other STAs start 1669 * using different BSSID. This will also give the station another 1670 * chance to restart the authentication/authorization in case 1671 * something went wrong the first time. 1672 */ 1673 if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) { 1674 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len, 1675 NL80211_IFTYPE_ADHOC); 1676 if (ether_addr_equal(bssid, rx->sdata->u.ibss.bssid) && 1677 test_sta_flag(sta, WLAN_STA_AUTHORIZED)) { 1678 sta->rx_stats.last_rx = jiffies; 1679 if (ieee80211_is_data(hdr->frame_control) && 1680 !is_multicast_ether_addr(hdr->addr1)) 1681 sta->rx_stats.last_rate = 1682 sta_stats_encode_rate(status); 1683 } 1684 } else if (rx->sdata->vif.type == NL80211_IFTYPE_OCB) { 1685 sta->rx_stats.last_rx = jiffies; 1686 } else if (!is_multicast_ether_addr(hdr->addr1)) { 1687 /* 1688 * Mesh beacons will update last_rx when if they are found to 1689 * match the current local configuration when processed. 1690 */ 1691 sta->rx_stats.last_rx = jiffies; 1692 if (ieee80211_is_data(hdr->frame_control)) 1693 sta->rx_stats.last_rate = sta_stats_encode_rate(status); 1694 } 1695 1696 if (rx->sdata->vif.type == NL80211_IFTYPE_STATION) 1697 ieee80211_sta_rx_notify(rx->sdata, hdr); 1698 1699 sta->rx_stats.fragments++; 1700 1701 u64_stats_update_begin(&rx->sta->rx_stats.syncp); 1702 sta->rx_stats.bytes += rx->skb->len; 1703 u64_stats_update_end(&rx->sta->rx_stats.syncp); 1704 1705 if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) { 1706 sta->rx_stats.last_signal = status->signal; 1707 ewma_signal_add(&sta->rx_stats_avg.signal, -status->signal); 1708 } 1709 1710 if (status->chains) { 1711 sta->rx_stats.chains = status->chains; 1712 for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) { 1713 int signal = status->chain_signal[i]; 1714 1715 if (!(status->chains & BIT(i))) 1716 continue; 1717 1718 sta->rx_stats.chain_signal_last[i] = signal; 1719 ewma_signal_add(&sta->rx_stats_avg.chain_signal[i], 1720 -signal); 1721 } 1722 } 1723 1724 /* 1725 * Change STA power saving mode only at the end of a frame 1726 * exchange sequence, and only for a data or management 1727 * frame as specified in IEEE 802.11-2016 11.2.3.2 1728 */ 1729 if (!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS) && 1730 !ieee80211_has_morefrags(hdr->frame_control) && 1731 (ieee80211_is_mgmt(hdr->frame_control) || 1732 ieee80211_is_data(hdr->frame_control)) && 1733 !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) && 1734 (rx->sdata->vif.type == NL80211_IFTYPE_AP || 1735 rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) { 1736 if (test_sta_flag(sta, WLAN_STA_PS_STA)) { 1737 if (!ieee80211_has_pm(hdr->frame_control)) 1738 sta_ps_end(sta); 1739 } else { 1740 if (ieee80211_has_pm(hdr->frame_control)) 1741 sta_ps_start(sta); 1742 } 1743 } 1744 1745 /* mesh power save support */ 1746 if (ieee80211_vif_is_mesh(&rx->sdata->vif)) 1747 ieee80211_mps_rx_h_sta_process(sta, hdr); 1748 1749 /* 1750 * Drop (qos-)data::nullfunc frames silently, since they 1751 * are used only to control station power saving mode. 1752 */ 1753 if (ieee80211_is_nullfunc(hdr->frame_control) || 1754 ieee80211_is_qos_nullfunc(hdr->frame_control)) { 1755 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc); 1756 1757 /* 1758 * If we receive a 4-addr nullfunc frame from a STA 1759 * that was not moved to a 4-addr STA vlan yet send 1760 * the event to userspace and for older hostapd drop 1761 * the frame to the monitor interface. 1762 */ 1763 if (ieee80211_has_a4(hdr->frame_control) && 1764 (rx->sdata->vif.type == NL80211_IFTYPE_AP || 1765 (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN && 1766 !rx->sdata->u.vlan.sta))) { 1767 if (!test_and_set_sta_flag(sta, WLAN_STA_4ADDR_EVENT)) 1768 cfg80211_rx_unexpected_4addr_frame( 1769 rx->sdata->dev, sta->sta.addr, 1770 GFP_ATOMIC); 1771 return RX_DROP_MONITOR; 1772 } 1773 /* 1774 * Update counter and free packet here to avoid 1775 * counting this as a dropped packed. 1776 */ 1777 sta->rx_stats.packets++; 1778 dev_kfree_skb(rx->skb); 1779 return RX_QUEUED; 1780 } 1781 1782 return RX_CONTINUE; 1783 } /* ieee80211_rx_h_sta_process */ 1784 1785 static ieee80211_rx_result debug_noinline 1786 ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx) 1787 { 1788 struct sk_buff *skb = rx->skb; 1789 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 1790 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; 1791 int keyidx; 1792 int hdrlen; 1793 ieee80211_rx_result result = RX_DROP_UNUSABLE; 1794 struct ieee80211_key *sta_ptk = NULL; 1795 int mmie_keyidx = -1; 1796 __le16 fc; 1797 const struct ieee80211_cipher_scheme *cs = NULL; 1798 1799 /* 1800 * Key selection 101 1801 * 1802 * There are four types of keys: 1803 * - GTK (group keys) 1804 * - IGTK (group keys for management frames) 1805 * - PTK (pairwise keys) 1806 * - STK (station-to-station pairwise keys) 1807 * 1808 * When selecting a key, we have to distinguish between multicast 1809 * (including broadcast) and unicast frames, the latter can only 1810 * use PTKs and STKs while the former always use GTKs and IGTKs. 1811 * Unless, of course, actual WEP keys ("pre-RSNA") are used, then 1812 * unicast frames can also use key indices like GTKs. Hence, if we 1813 * don't have a PTK/STK we check the key index for a WEP key. 1814 * 1815 * Note that in a regular BSS, multicast frames are sent by the 1816 * AP only, associated stations unicast the frame to the AP first 1817 * which then multicasts it on their behalf. 1818 * 1819 * There is also a slight problem in IBSS mode: GTKs are negotiated 1820 * with each station, that is something we don't currently handle. 1821 * The spec seems to expect that one negotiates the same key with 1822 * every station but there's no such requirement; VLANs could be 1823 * possible. 1824 */ 1825 1826 /* start without a key */ 1827 rx->key = NULL; 1828 fc = hdr->frame_control; 1829 1830 if (rx->sta) { 1831 int keyid = rx->sta->ptk_idx; 1832 1833 if (ieee80211_has_protected(fc) && rx->sta->cipher_scheme) { 1834 cs = rx->sta->cipher_scheme; 1835 keyid = ieee80211_get_cs_keyid(cs, rx->skb); 1836 if (unlikely(keyid < 0)) 1837 return RX_DROP_UNUSABLE; 1838 } 1839 sta_ptk = rcu_dereference(rx->sta->ptk[keyid]); 1840 } 1841 1842 if (!ieee80211_has_protected(fc)) 1843 mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb); 1844 1845 if (!is_multicast_ether_addr(hdr->addr1) && sta_ptk) { 1846 rx->key = sta_ptk; 1847 if ((status->flag & RX_FLAG_DECRYPTED) && 1848 (status->flag & RX_FLAG_IV_STRIPPED)) 1849 return RX_CONTINUE; 1850 /* Skip decryption if the frame is not protected. */ 1851 if (!ieee80211_has_protected(fc)) 1852 return RX_CONTINUE; 1853 } else if (mmie_keyidx >= 0) { 1854 /* Broadcast/multicast robust management frame / BIP */ 1855 if ((status->flag & RX_FLAG_DECRYPTED) && 1856 (status->flag & RX_FLAG_IV_STRIPPED)) 1857 return RX_CONTINUE; 1858 1859 if (mmie_keyidx < NUM_DEFAULT_KEYS || 1860 mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS) 1861 return RX_DROP_MONITOR; /* unexpected BIP keyidx */ 1862 if (rx->sta) { 1863 if (ieee80211_is_group_privacy_action(skb) && 1864 test_sta_flag(rx->sta, WLAN_STA_MFP)) 1865 return RX_DROP_MONITOR; 1866 1867 rx->key = rcu_dereference(rx->sta->gtk[mmie_keyidx]); 1868 } 1869 if (!rx->key) 1870 rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]); 1871 } else if (!ieee80211_has_protected(fc)) { 1872 /* 1873 * The frame was not protected, so skip decryption. However, we 1874 * need to set rx->key if there is a key that could have been 1875 * used so that the frame may be dropped if encryption would 1876 * have been expected. 1877 */ 1878 struct ieee80211_key *key = NULL; 1879 struct ieee80211_sub_if_data *sdata = rx->sdata; 1880 int i; 1881 1882 if (ieee80211_is_mgmt(fc) && 1883 is_multicast_ether_addr(hdr->addr1) && 1884 (key = rcu_dereference(rx->sdata->default_mgmt_key))) 1885 rx->key = key; 1886 else { 1887 if (rx->sta) { 1888 for (i = 0; i < NUM_DEFAULT_KEYS; i++) { 1889 key = rcu_dereference(rx->sta->gtk[i]); 1890 if (key) 1891 break; 1892 } 1893 } 1894 if (!key) { 1895 for (i = 0; i < NUM_DEFAULT_KEYS; i++) { 1896 key = rcu_dereference(sdata->keys[i]); 1897 if (key) 1898 break; 1899 } 1900 } 1901 if (key) 1902 rx->key = key; 1903 } 1904 return RX_CONTINUE; 1905 } else { 1906 u8 keyid; 1907 1908 /* 1909 * The device doesn't give us the IV so we won't be 1910 * able to look up the key. That's ok though, we 1911 * don't need to decrypt the frame, we just won't 1912 * be able to keep statistics accurate. 1913 * Except for key threshold notifications, should 1914 * we somehow allow the driver to tell us which key 1915 * the hardware used if this flag is set? 1916 */ 1917 if ((status->flag & RX_FLAG_DECRYPTED) && 1918 (status->flag & RX_FLAG_IV_STRIPPED)) 1919 return RX_CONTINUE; 1920 1921 hdrlen = ieee80211_hdrlen(fc); 1922 1923 if (cs) { 1924 keyidx = ieee80211_get_cs_keyid(cs, rx->skb); 1925 1926 if (unlikely(keyidx < 0)) 1927 return RX_DROP_UNUSABLE; 1928 } else { 1929 if (rx->skb->len < 8 + hdrlen) 1930 return RX_DROP_UNUSABLE; /* TODO: count this? */ 1931 /* 1932 * no need to call ieee80211_wep_get_keyidx, 1933 * it verifies a bunch of things we've done already 1934 */ 1935 skb_copy_bits(rx->skb, hdrlen + 3, &keyid, 1); 1936 keyidx = keyid >> 6; 1937 } 1938 1939 /* check per-station GTK first, if multicast packet */ 1940 if (is_multicast_ether_addr(hdr->addr1) && rx->sta) 1941 rx->key = rcu_dereference(rx->sta->gtk[keyidx]); 1942 1943 /* if not found, try default key */ 1944 if (!rx->key) { 1945 rx->key = rcu_dereference(rx->sdata->keys[keyidx]); 1946 1947 /* 1948 * RSNA-protected unicast frames should always be 1949 * sent with pairwise or station-to-station keys, 1950 * but for WEP we allow using a key index as well. 1951 */ 1952 if (rx->key && 1953 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 && 1954 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 && 1955 !is_multicast_ether_addr(hdr->addr1)) 1956 rx->key = NULL; 1957 } 1958 } 1959 1960 if (rx->key) { 1961 if (unlikely(rx->key->flags & KEY_FLAG_TAINTED)) 1962 return RX_DROP_MONITOR; 1963 1964 /* TODO: add threshold stuff again */ 1965 } else { 1966 return RX_DROP_MONITOR; 1967 } 1968 1969 switch (rx->key->conf.cipher) { 1970 case WLAN_CIPHER_SUITE_WEP40: 1971 case WLAN_CIPHER_SUITE_WEP104: 1972 result = ieee80211_crypto_wep_decrypt(rx); 1973 break; 1974 case WLAN_CIPHER_SUITE_TKIP: 1975 result = ieee80211_crypto_tkip_decrypt(rx); 1976 break; 1977 case WLAN_CIPHER_SUITE_CCMP: 1978 result = ieee80211_crypto_ccmp_decrypt( 1979 rx, IEEE80211_CCMP_MIC_LEN); 1980 break; 1981 case WLAN_CIPHER_SUITE_CCMP_256: 1982 result = ieee80211_crypto_ccmp_decrypt( 1983 rx, IEEE80211_CCMP_256_MIC_LEN); 1984 break; 1985 case WLAN_CIPHER_SUITE_AES_CMAC: 1986 result = ieee80211_crypto_aes_cmac_decrypt(rx); 1987 break; 1988 case WLAN_CIPHER_SUITE_BIP_CMAC_256: 1989 result = ieee80211_crypto_aes_cmac_256_decrypt(rx); 1990 break; 1991 case WLAN_CIPHER_SUITE_BIP_GMAC_128: 1992 case WLAN_CIPHER_SUITE_BIP_GMAC_256: 1993 result = ieee80211_crypto_aes_gmac_decrypt(rx); 1994 break; 1995 case WLAN_CIPHER_SUITE_GCMP: 1996 case WLAN_CIPHER_SUITE_GCMP_256: 1997 result = ieee80211_crypto_gcmp_decrypt(rx); 1998 break; 1999 default: 2000 result = ieee80211_crypto_hw_decrypt(rx); 2001 } 2002 2003 /* the hdr variable is invalid after the decrypt handlers */ 2004 2005 /* either the frame has been decrypted or will be dropped */ 2006 status->flag |= RX_FLAG_DECRYPTED; 2007 2008 return result; 2009 } 2010 2011 static inline struct ieee80211_fragment_entry * 2012 ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata, 2013 unsigned int frag, unsigned int seq, int rx_queue, 2014 struct sk_buff **skb) 2015 { 2016 struct ieee80211_fragment_entry *entry; 2017 2018 entry = &sdata->fragments[sdata->fragment_next++]; 2019 if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX) 2020 sdata->fragment_next = 0; 2021 2022 if (!skb_queue_empty(&entry->skb_list)) 2023 __skb_queue_purge(&entry->skb_list); 2024 2025 __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */ 2026 *skb = NULL; 2027 entry->first_frag_time = jiffies; 2028 entry->seq = seq; 2029 entry->rx_queue = rx_queue; 2030 entry->last_frag = frag; 2031 entry->check_sequential_pn = false; 2032 entry->extra_len = 0; 2033 2034 return entry; 2035 } 2036 2037 static inline struct ieee80211_fragment_entry * 2038 ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata, 2039 unsigned int frag, unsigned int seq, 2040 int rx_queue, struct ieee80211_hdr *hdr) 2041 { 2042 struct ieee80211_fragment_entry *entry; 2043 int i, idx; 2044 2045 idx = sdata->fragment_next; 2046 for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) { 2047 struct ieee80211_hdr *f_hdr; 2048 2049 idx--; 2050 if (idx < 0) 2051 idx = IEEE80211_FRAGMENT_MAX - 1; 2052 2053 entry = &sdata->fragments[idx]; 2054 if (skb_queue_empty(&entry->skb_list) || entry->seq != seq || 2055 entry->rx_queue != rx_queue || 2056 entry->last_frag + 1 != frag) 2057 continue; 2058 2059 f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data; 2060 2061 /* 2062 * Check ftype and addresses are equal, else check next fragment 2063 */ 2064 if (((hdr->frame_control ^ f_hdr->frame_control) & 2065 cpu_to_le16(IEEE80211_FCTL_FTYPE)) || 2066 !ether_addr_equal(hdr->addr1, f_hdr->addr1) || 2067 !ether_addr_equal(hdr->addr2, f_hdr->addr2)) 2068 continue; 2069 2070 if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) { 2071 __skb_queue_purge(&entry->skb_list); 2072 continue; 2073 } 2074 return entry; 2075 } 2076 2077 return NULL; 2078 } 2079 2080 static ieee80211_rx_result debug_noinline 2081 ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx) 2082 { 2083 struct ieee80211_hdr *hdr; 2084 u16 sc; 2085 __le16 fc; 2086 unsigned int frag, seq; 2087 struct ieee80211_fragment_entry *entry; 2088 struct sk_buff *skb; 2089 2090 hdr = (struct ieee80211_hdr *)rx->skb->data; 2091 fc = hdr->frame_control; 2092 2093 if (ieee80211_is_ctl(fc)) 2094 return RX_CONTINUE; 2095 2096 sc = le16_to_cpu(hdr->seq_ctrl); 2097 frag = sc & IEEE80211_SCTL_FRAG; 2098 2099 if (is_multicast_ether_addr(hdr->addr1)) { 2100 I802_DEBUG_INC(rx->local->dot11MulticastReceivedFrameCount); 2101 goto out_no_led; 2102 } 2103 2104 if (likely(!ieee80211_has_morefrags(fc) && frag == 0)) 2105 goto out; 2106 2107 I802_DEBUG_INC(rx->local->rx_handlers_fragments); 2108 2109 if (skb_linearize(rx->skb)) 2110 return RX_DROP_UNUSABLE; 2111 2112 /* 2113 * skb_linearize() might change the skb->data and 2114 * previously cached variables (in this case, hdr) need to 2115 * be refreshed with the new data. 2116 */ 2117 hdr = (struct ieee80211_hdr *)rx->skb->data; 2118 seq = (sc & IEEE80211_SCTL_SEQ) >> 4; 2119 2120 if (frag == 0) { 2121 /* This is the first fragment of a new frame. */ 2122 entry = ieee80211_reassemble_add(rx->sdata, frag, seq, 2123 rx->seqno_idx, &(rx->skb)); 2124 if (rx->key && 2125 (rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP || 2126 rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP_256 || 2127 rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP || 2128 rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP_256) && 2129 ieee80211_has_protected(fc)) { 2130 int queue = rx->security_idx; 2131 2132 /* Store CCMP/GCMP PN so that we can verify that the 2133 * next fragment has a sequential PN value. 2134 */ 2135 entry->check_sequential_pn = true; 2136 memcpy(entry->last_pn, 2137 rx->key->u.ccmp.rx_pn[queue], 2138 IEEE80211_CCMP_PN_LEN); 2139 BUILD_BUG_ON(offsetof(struct ieee80211_key, 2140 u.ccmp.rx_pn) != 2141 offsetof(struct ieee80211_key, 2142 u.gcmp.rx_pn)); 2143 BUILD_BUG_ON(sizeof(rx->key->u.ccmp.rx_pn[queue]) != 2144 sizeof(rx->key->u.gcmp.rx_pn[queue])); 2145 BUILD_BUG_ON(IEEE80211_CCMP_PN_LEN != 2146 IEEE80211_GCMP_PN_LEN); 2147 } 2148 return RX_QUEUED; 2149 } 2150 2151 /* This is a fragment for a frame that should already be pending in 2152 * fragment cache. Add this fragment to the end of the pending entry. 2153 */ 2154 entry = ieee80211_reassemble_find(rx->sdata, frag, seq, 2155 rx->seqno_idx, hdr); 2156 if (!entry) { 2157 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag); 2158 return RX_DROP_MONITOR; 2159 } 2160 2161 /* "The receiver shall discard MSDUs and MMPDUs whose constituent 2162 * MPDU PN values are not incrementing in steps of 1." 2163 * see IEEE P802.11-REVmc/D5.0, 12.5.3.4.4, item d (for CCMP) 2164 * and IEEE P802.11-REVmc/D5.0, 12.5.5.4.4, item d (for GCMP) 2165 */ 2166 if (entry->check_sequential_pn) { 2167 int i; 2168 u8 pn[IEEE80211_CCMP_PN_LEN], *rpn; 2169 int queue; 2170 2171 if (!rx->key || 2172 (rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP && 2173 rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP_256 && 2174 rx->key->conf.cipher != WLAN_CIPHER_SUITE_GCMP && 2175 rx->key->conf.cipher != WLAN_CIPHER_SUITE_GCMP_256)) 2176 return RX_DROP_UNUSABLE; 2177 memcpy(pn, entry->last_pn, IEEE80211_CCMP_PN_LEN); 2178 for (i = IEEE80211_CCMP_PN_LEN - 1; i >= 0; i--) { 2179 pn[i]++; 2180 if (pn[i]) 2181 break; 2182 } 2183 queue = rx->security_idx; 2184 rpn = rx->key->u.ccmp.rx_pn[queue]; 2185 if (memcmp(pn, rpn, IEEE80211_CCMP_PN_LEN)) 2186 return RX_DROP_UNUSABLE; 2187 memcpy(entry->last_pn, pn, IEEE80211_CCMP_PN_LEN); 2188 } 2189 2190 skb_pull(rx->skb, ieee80211_hdrlen(fc)); 2191 __skb_queue_tail(&entry->skb_list, rx->skb); 2192 entry->last_frag = frag; 2193 entry->extra_len += rx->skb->len; 2194 if (ieee80211_has_morefrags(fc)) { 2195 rx->skb = NULL; 2196 return RX_QUEUED; 2197 } 2198 2199 rx->skb = __skb_dequeue(&entry->skb_list); 2200 if (skb_tailroom(rx->skb) < entry->extra_len) { 2201 I802_DEBUG_INC(rx->local->rx_expand_skb_head_defrag); 2202 if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len, 2203 GFP_ATOMIC))) { 2204 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag); 2205 __skb_queue_purge(&entry->skb_list); 2206 return RX_DROP_UNUSABLE; 2207 } 2208 } 2209 while ((skb = __skb_dequeue(&entry->skb_list))) { 2210 skb_put_data(rx->skb, skb->data, skb->len); 2211 dev_kfree_skb(skb); 2212 } 2213 2214 out: 2215 ieee80211_led_rx(rx->local); 2216 out_no_led: 2217 if (rx->sta) 2218 rx->sta->rx_stats.packets++; 2219 return RX_CONTINUE; 2220 } 2221 2222 static int ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx) 2223 { 2224 if (unlikely(!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_AUTHORIZED))) 2225 return -EACCES; 2226 2227 return 0; 2228 } 2229 2230 static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc) 2231 { 2232 struct sk_buff *skb = rx->skb; 2233 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 2234 2235 /* 2236 * Pass through unencrypted frames if the hardware has 2237 * decrypted them already. 2238 */ 2239 if (status->flag & RX_FLAG_DECRYPTED) 2240 return 0; 2241 2242 /* Drop unencrypted frames if key is set. */ 2243 if (unlikely(!ieee80211_has_protected(fc) && 2244 !ieee80211_is_nullfunc(fc) && 2245 ieee80211_is_data(fc) && rx->key)) 2246 return -EACCES; 2247 2248 return 0; 2249 } 2250 2251 static int ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx) 2252 { 2253 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 2254 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 2255 __le16 fc = hdr->frame_control; 2256 2257 /* 2258 * Pass through unencrypted frames if the hardware has 2259 * decrypted them already. 2260 */ 2261 if (status->flag & RX_FLAG_DECRYPTED) 2262 return 0; 2263 2264 if (rx->sta && test_sta_flag(rx->sta, WLAN_STA_MFP)) { 2265 if (unlikely(!ieee80211_has_protected(fc) && 2266 ieee80211_is_unicast_robust_mgmt_frame(rx->skb) && 2267 rx->key)) { 2268 if (ieee80211_is_deauth(fc) || 2269 ieee80211_is_disassoc(fc)) 2270 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev, 2271 rx->skb->data, 2272 rx->skb->len); 2273 return -EACCES; 2274 } 2275 /* BIP does not use Protected field, so need to check MMIE */ 2276 if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) && 2277 ieee80211_get_mmie_keyidx(rx->skb) < 0)) { 2278 if (ieee80211_is_deauth(fc) || 2279 ieee80211_is_disassoc(fc)) 2280 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev, 2281 rx->skb->data, 2282 rx->skb->len); 2283 return -EACCES; 2284 } 2285 /* 2286 * When using MFP, Action frames are not allowed prior to 2287 * having configured keys. 2288 */ 2289 if (unlikely(ieee80211_is_action(fc) && !rx->key && 2290 ieee80211_is_robust_mgmt_frame(rx->skb))) 2291 return -EACCES; 2292 } 2293 2294 return 0; 2295 } 2296 2297 static int 2298 __ieee80211_data_to_8023(struct ieee80211_rx_data *rx, bool *port_control) 2299 { 2300 struct ieee80211_sub_if_data *sdata = rx->sdata; 2301 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 2302 bool check_port_control = false; 2303 struct ethhdr *ehdr; 2304 int ret; 2305 2306 *port_control = false; 2307 if (ieee80211_has_a4(hdr->frame_control) && 2308 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta) 2309 return -1; 2310 2311 if (sdata->vif.type == NL80211_IFTYPE_STATION && 2312 !!sdata->u.mgd.use_4addr != !!ieee80211_has_a4(hdr->frame_control)) { 2313 2314 if (!sdata->u.mgd.use_4addr) 2315 return -1; 2316 else 2317 check_port_control = true; 2318 } 2319 2320 if (is_multicast_ether_addr(hdr->addr1) && 2321 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta) 2322 return -1; 2323 2324 ret = ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type); 2325 if (ret < 0) 2326 return ret; 2327 2328 ehdr = (struct ethhdr *) rx->skb->data; 2329 if (ehdr->h_proto == rx->sdata->control_port_protocol) 2330 *port_control = true; 2331 else if (check_port_control) 2332 return -1; 2333 2334 return 0; 2335 } 2336 2337 /* 2338 * requires that rx->skb is a frame with ethernet header 2339 */ 2340 static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc) 2341 { 2342 static const u8 pae_group_addr[ETH_ALEN] __aligned(2) 2343 = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 }; 2344 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data; 2345 2346 /* 2347 * Allow EAPOL frames to us/the PAE group address regardless 2348 * of whether the frame was encrypted or not. 2349 */ 2350 if (ehdr->h_proto == rx->sdata->control_port_protocol && 2351 (ether_addr_equal(ehdr->h_dest, rx->sdata->vif.addr) || 2352 ether_addr_equal(ehdr->h_dest, pae_group_addr))) 2353 return true; 2354 2355 if (ieee80211_802_1x_port_control(rx) || 2356 ieee80211_drop_unencrypted(rx, fc)) 2357 return false; 2358 2359 return true; 2360 } 2361 2362 static void ieee80211_deliver_skb_to_local_stack(struct sk_buff *skb, 2363 struct ieee80211_rx_data *rx) 2364 { 2365 struct ieee80211_sub_if_data *sdata = rx->sdata; 2366 struct net_device *dev = sdata->dev; 2367 2368 if (unlikely((skb->protocol == sdata->control_port_protocol || 2369 skb->protocol == cpu_to_be16(ETH_P_PREAUTH)) && 2370 sdata->control_port_over_nl80211)) { 2371 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 2372 bool noencrypt = status->flag & RX_FLAG_DECRYPTED; 2373 struct ethhdr *ehdr = eth_hdr(skb); 2374 2375 cfg80211_rx_control_port(dev, skb->data, skb->len, 2376 ehdr->h_source, 2377 be16_to_cpu(skb->protocol), noencrypt); 2378 dev_kfree_skb(skb); 2379 } else { 2380 /* deliver to local stack */ 2381 if (rx->napi) 2382 napi_gro_receive(rx->napi, skb); 2383 else 2384 netif_receive_skb(skb); 2385 } 2386 } 2387 2388 /* 2389 * requires that rx->skb is a frame with ethernet header 2390 */ 2391 static void 2392 ieee80211_deliver_skb(struct ieee80211_rx_data *rx) 2393 { 2394 struct ieee80211_sub_if_data *sdata = rx->sdata; 2395 struct net_device *dev = sdata->dev; 2396 struct sk_buff *skb, *xmit_skb; 2397 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data; 2398 struct sta_info *dsta; 2399 2400 skb = rx->skb; 2401 xmit_skb = NULL; 2402 2403 ieee80211_rx_stats(dev, skb->len); 2404 2405 if (rx->sta) { 2406 /* The seqno index has the same property as needed 2407 * for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS 2408 * for non-QoS-data frames. Here we know it's a data 2409 * frame, so count MSDUs. 2410 */ 2411 u64_stats_update_begin(&rx->sta->rx_stats.syncp); 2412 rx->sta->rx_stats.msdu[rx->seqno_idx]++; 2413 u64_stats_update_end(&rx->sta->rx_stats.syncp); 2414 } 2415 2416 if ((sdata->vif.type == NL80211_IFTYPE_AP || 2417 sdata->vif.type == NL80211_IFTYPE_AP_VLAN) && 2418 !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) && 2419 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) { 2420 if (is_multicast_ether_addr(ehdr->h_dest) && 2421 ieee80211_vif_get_num_mcast_if(sdata) != 0) { 2422 /* 2423 * send multicast frames both to higher layers in 2424 * local net stack and back to the wireless medium 2425 */ 2426 xmit_skb = skb_copy(skb, GFP_ATOMIC); 2427 if (!xmit_skb) 2428 net_info_ratelimited("%s: failed to clone multicast frame\n", 2429 dev->name); 2430 } else if (!is_multicast_ether_addr(ehdr->h_dest)) { 2431 dsta = sta_info_get(sdata, skb->data); 2432 if (dsta) { 2433 /* 2434 * The destination station is associated to 2435 * this AP (in this VLAN), so send the frame 2436 * directly to it and do not pass it to local 2437 * net stack. 2438 */ 2439 xmit_skb = skb; 2440 skb = NULL; 2441 } 2442 } 2443 } 2444 2445 #ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS 2446 if (skb) { 2447 /* 'align' will only take the values 0 or 2 here since all 2448 * frames are required to be aligned to 2-byte boundaries 2449 * when being passed to mac80211; the code here works just 2450 * as well if that isn't true, but mac80211 assumes it can 2451 * access fields as 2-byte aligned (e.g. for ether_addr_equal) 2452 */ 2453 int align; 2454 2455 align = (unsigned long)(skb->data + sizeof(struct ethhdr)) & 3; 2456 if (align) { 2457 if (WARN_ON(skb_headroom(skb) < 3)) { 2458 dev_kfree_skb(skb); 2459 skb = NULL; 2460 } else { 2461 u8 *data = skb->data; 2462 size_t len = skb_headlen(skb); 2463 skb->data -= align; 2464 memmove(skb->data, data, len); 2465 skb_set_tail_pointer(skb, len); 2466 } 2467 } 2468 } 2469 #endif 2470 2471 if (skb) { 2472 skb->protocol = eth_type_trans(skb, dev); 2473 memset(skb->cb, 0, sizeof(skb->cb)); 2474 2475 ieee80211_deliver_skb_to_local_stack(skb, rx); 2476 } 2477 2478 if (xmit_skb) { 2479 /* 2480 * Send to wireless media and increase priority by 256 to 2481 * keep the received priority instead of reclassifying 2482 * the frame (see cfg80211_classify8021d). 2483 */ 2484 xmit_skb->priority += 256; 2485 xmit_skb->protocol = htons(ETH_P_802_3); 2486 skb_reset_network_header(xmit_skb); 2487 skb_reset_mac_header(xmit_skb); 2488 dev_queue_xmit(xmit_skb); 2489 } 2490 } 2491 2492 static ieee80211_rx_result debug_noinline 2493 __ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx, u8 data_offset) 2494 { 2495 struct net_device *dev = rx->sdata->dev; 2496 struct sk_buff *skb = rx->skb; 2497 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; 2498 __le16 fc = hdr->frame_control; 2499 struct sk_buff_head frame_list; 2500 struct ethhdr ethhdr; 2501 const u8 *check_da = ethhdr.h_dest, *check_sa = ethhdr.h_source; 2502 2503 if (unlikely(ieee80211_has_a4(hdr->frame_control))) { 2504 check_da = NULL; 2505 check_sa = NULL; 2506 } else switch (rx->sdata->vif.type) { 2507 case NL80211_IFTYPE_AP: 2508 case NL80211_IFTYPE_AP_VLAN: 2509 check_da = NULL; 2510 break; 2511 case NL80211_IFTYPE_STATION: 2512 if (!rx->sta || 2513 !test_sta_flag(rx->sta, WLAN_STA_TDLS_PEER)) 2514 check_sa = NULL; 2515 break; 2516 case NL80211_IFTYPE_MESH_POINT: 2517 check_sa = NULL; 2518 break; 2519 default: 2520 break; 2521 } 2522 2523 skb->dev = dev; 2524 __skb_queue_head_init(&frame_list); 2525 2526 if (ieee80211_data_to_8023_exthdr(skb, ðhdr, 2527 rx->sdata->vif.addr, 2528 rx->sdata->vif.type, 2529 data_offset)) 2530 return RX_DROP_UNUSABLE; 2531 2532 ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr, 2533 rx->sdata->vif.type, 2534 rx->local->hw.extra_tx_headroom, 2535 check_da, check_sa); 2536 2537 while (!skb_queue_empty(&frame_list)) { 2538 rx->skb = __skb_dequeue(&frame_list); 2539 2540 if (!ieee80211_frame_allowed(rx, fc)) { 2541 dev_kfree_skb(rx->skb); 2542 continue; 2543 } 2544 2545 ieee80211_deliver_skb(rx); 2546 } 2547 2548 return RX_QUEUED; 2549 } 2550 2551 static ieee80211_rx_result debug_noinline 2552 ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx) 2553 { 2554 struct sk_buff *skb = rx->skb; 2555 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 2556 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; 2557 __le16 fc = hdr->frame_control; 2558 2559 if (!(status->rx_flags & IEEE80211_RX_AMSDU)) 2560 return RX_CONTINUE; 2561 2562 if (unlikely(!ieee80211_is_data(fc))) 2563 return RX_CONTINUE; 2564 2565 if (unlikely(!ieee80211_is_data_present(fc))) 2566 return RX_DROP_MONITOR; 2567 2568 if (unlikely(ieee80211_has_a4(hdr->frame_control))) { 2569 switch (rx->sdata->vif.type) { 2570 case NL80211_IFTYPE_AP_VLAN: 2571 if (!rx->sdata->u.vlan.sta) 2572 return RX_DROP_UNUSABLE; 2573 break; 2574 case NL80211_IFTYPE_STATION: 2575 if (!rx->sdata->u.mgd.use_4addr) 2576 return RX_DROP_UNUSABLE; 2577 break; 2578 default: 2579 return RX_DROP_UNUSABLE; 2580 } 2581 } 2582 2583 if (is_multicast_ether_addr(hdr->addr1)) 2584 return RX_DROP_UNUSABLE; 2585 2586 return __ieee80211_rx_h_amsdu(rx, 0); 2587 } 2588 2589 #ifdef CONFIG_MAC80211_MESH 2590 static ieee80211_rx_result 2591 ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx) 2592 { 2593 struct ieee80211_hdr *fwd_hdr, *hdr; 2594 struct ieee80211_tx_info *info; 2595 struct ieee80211s_hdr *mesh_hdr; 2596 struct sk_buff *skb = rx->skb, *fwd_skb; 2597 struct ieee80211_local *local = rx->local; 2598 struct ieee80211_sub_if_data *sdata = rx->sdata; 2599 struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh; 2600 u16 ac, q, hdrlen; 2601 2602 hdr = (struct ieee80211_hdr *) skb->data; 2603 hdrlen = ieee80211_hdrlen(hdr->frame_control); 2604 2605 /* make sure fixed part of mesh header is there, also checks skb len */ 2606 if (!pskb_may_pull(rx->skb, hdrlen + 6)) 2607 return RX_DROP_MONITOR; 2608 2609 mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen); 2610 2611 /* make sure full mesh header is there, also checks skb len */ 2612 if (!pskb_may_pull(rx->skb, 2613 hdrlen + ieee80211_get_mesh_hdrlen(mesh_hdr))) 2614 return RX_DROP_MONITOR; 2615 2616 /* reload pointers */ 2617 hdr = (struct ieee80211_hdr *) skb->data; 2618 mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen); 2619 2620 if (ieee80211_drop_unencrypted(rx, hdr->frame_control)) 2621 return RX_DROP_MONITOR; 2622 2623 /* frame is in RMC, don't forward */ 2624 if (ieee80211_is_data(hdr->frame_control) && 2625 is_multicast_ether_addr(hdr->addr1) && 2626 mesh_rmc_check(rx->sdata, hdr->addr3, mesh_hdr)) 2627 return RX_DROP_MONITOR; 2628 2629 if (!ieee80211_is_data(hdr->frame_control)) 2630 return RX_CONTINUE; 2631 2632 if (!mesh_hdr->ttl) 2633 return RX_DROP_MONITOR; 2634 2635 if (mesh_hdr->flags & MESH_FLAGS_AE) { 2636 struct mesh_path *mppath; 2637 char *proxied_addr; 2638 char *mpp_addr; 2639 2640 if (is_multicast_ether_addr(hdr->addr1)) { 2641 mpp_addr = hdr->addr3; 2642 proxied_addr = mesh_hdr->eaddr1; 2643 } else if ((mesh_hdr->flags & MESH_FLAGS_AE) == 2644 MESH_FLAGS_AE_A5_A6) { 2645 /* has_a4 already checked in ieee80211_rx_mesh_check */ 2646 mpp_addr = hdr->addr4; 2647 proxied_addr = mesh_hdr->eaddr2; 2648 } else { 2649 return RX_DROP_MONITOR; 2650 } 2651 2652 rcu_read_lock(); 2653 mppath = mpp_path_lookup(sdata, proxied_addr); 2654 if (!mppath) { 2655 mpp_path_add(sdata, proxied_addr, mpp_addr); 2656 } else { 2657 spin_lock_bh(&mppath->state_lock); 2658 if (!ether_addr_equal(mppath->mpp, mpp_addr)) 2659 memcpy(mppath->mpp, mpp_addr, ETH_ALEN); 2660 mppath->exp_time = jiffies; 2661 spin_unlock_bh(&mppath->state_lock); 2662 } 2663 rcu_read_unlock(); 2664 } 2665 2666 /* Frame has reached destination. Don't forward */ 2667 if (!is_multicast_ether_addr(hdr->addr1) && 2668 ether_addr_equal(sdata->vif.addr, hdr->addr3)) 2669 return RX_CONTINUE; 2670 2671 ac = ieee80211_select_queue_80211(sdata, skb, hdr); 2672 q = sdata->vif.hw_queue[ac]; 2673 if (ieee80211_queue_stopped(&local->hw, q)) { 2674 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion); 2675 return RX_DROP_MONITOR; 2676 } 2677 skb_set_queue_mapping(skb, q); 2678 2679 if (!--mesh_hdr->ttl) { 2680 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl); 2681 goto out; 2682 } 2683 2684 if (!ifmsh->mshcfg.dot11MeshForwarding) 2685 goto out; 2686 2687 fwd_skb = skb_copy_expand(skb, local->tx_headroom + 2688 sdata->encrypt_headroom, 0, GFP_ATOMIC); 2689 if (!fwd_skb) 2690 goto out; 2691 2692 fwd_hdr = (struct ieee80211_hdr *) fwd_skb->data; 2693 fwd_hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_RETRY); 2694 info = IEEE80211_SKB_CB(fwd_skb); 2695 memset(info, 0, sizeof(*info)); 2696 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING; 2697 info->control.vif = &rx->sdata->vif; 2698 info->control.jiffies = jiffies; 2699 if (is_multicast_ether_addr(fwd_hdr->addr1)) { 2700 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_mcast); 2701 memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN); 2702 /* update power mode indication when forwarding */ 2703 ieee80211_mps_set_frame_flags(sdata, NULL, fwd_hdr); 2704 } else if (!mesh_nexthop_lookup(sdata, fwd_skb)) { 2705 /* mesh power mode flags updated in mesh_nexthop_lookup */ 2706 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast); 2707 } else { 2708 /* unable to resolve next hop */ 2709 mesh_path_error_tx(sdata, ifmsh->mshcfg.element_ttl, 2710 fwd_hdr->addr3, 0, 2711 WLAN_REASON_MESH_PATH_NOFORWARD, 2712 fwd_hdr->addr2); 2713 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_no_route); 2714 kfree_skb(fwd_skb); 2715 return RX_DROP_MONITOR; 2716 } 2717 2718 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames); 2719 ieee80211_add_pending_skb(local, fwd_skb); 2720 out: 2721 if (is_multicast_ether_addr(hdr->addr1)) 2722 return RX_CONTINUE; 2723 return RX_DROP_MONITOR; 2724 } 2725 #endif 2726 2727 static ieee80211_rx_result debug_noinline 2728 ieee80211_rx_h_data(struct ieee80211_rx_data *rx) 2729 { 2730 struct ieee80211_sub_if_data *sdata = rx->sdata; 2731 struct ieee80211_local *local = rx->local; 2732 struct net_device *dev = sdata->dev; 2733 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 2734 __le16 fc = hdr->frame_control; 2735 bool port_control; 2736 int err; 2737 2738 if (unlikely(!ieee80211_is_data(hdr->frame_control))) 2739 return RX_CONTINUE; 2740 2741 if (unlikely(!ieee80211_is_data_present(hdr->frame_control))) 2742 return RX_DROP_MONITOR; 2743 2744 /* 2745 * Send unexpected-4addr-frame event to hostapd. For older versions, 2746 * also drop the frame to cooked monitor interfaces. 2747 */ 2748 if (ieee80211_has_a4(hdr->frame_control) && 2749 sdata->vif.type == NL80211_IFTYPE_AP) { 2750 if (rx->sta && 2751 !test_and_set_sta_flag(rx->sta, WLAN_STA_4ADDR_EVENT)) 2752 cfg80211_rx_unexpected_4addr_frame( 2753 rx->sdata->dev, rx->sta->sta.addr, GFP_ATOMIC); 2754 return RX_DROP_MONITOR; 2755 } 2756 2757 err = __ieee80211_data_to_8023(rx, &port_control); 2758 if (unlikely(err)) 2759 return RX_DROP_UNUSABLE; 2760 2761 if (!ieee80211_frame_allowed(rx, fc)) 2762 return RX_DROP_MONITOR; 2763 2764 /* directly handle TDLS channel switch requests/responses */ 2765 if (unlikely(((struct ethhdr *)rx->skb->data)->h_proto == 2766 cpu_to_be16(ETH_P_TDLS))) { 2767 struct ieee80211_tdls_data *tf = (void *)rx->skb->data; 2768 2769 if (pskb_may_pull(rx->skb, 2770 offsetof(struct ieee80211_tdls_data, u)) && 2771 tf->payload_type == WLAN_TDLS_SNAP_RFTYPE && 2772 tf->category == WLAN_CATEGORY_TDLS && 2773 (tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_REQUEST || 2774 tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_RESPONSE)) { 2775 skb_queue_tail(&local->skb_queue_tdls_chsw, rx->skb); 2776 schedule_work(&local->tdls_chsw_work); 2777 if (rx->sta) 2778 rx->sta->rx_stats.packets++; 2779 2780 return RX_QUEUED; 2781 } 2782 } 2783 2784 if (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN && 2785 unlikely(port_control) && sdata->bss) { 2786 sdata = container_of(sdata->bss, struct ieee80211_sub_if_data, 2787 u.ap); 2788 dev = sdata->dev; 2789 rx->sdata = sdata; 2790 } 2791 2792 rx->skb->dev = dev; 2793 2794 if (!ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS) && 2795 local->ps_sdata && local->hw.conf.dynamic_ps_timeout > 0 && 2796 !is_multicast_ether_addr( 2797 ((struct ethhdr *)rx->skb->data)->h_dest) && 2798 (!local->scanning && 2799 !test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))) 2800 mod_timer(&local->dynamic_ps_timer, jiffies + 2801 msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout)); 2802 2803 ieee80211_deliver_skb(rx); 2804 2805 return RX_QUEUED; 2806 } 2807 2808 static ieee80211_rx_result debug_noinline 2809 ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames) 2810 { 2811 struct sk_buff *skb = rx->skb; 2812 struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data; 2813 struct tid_ampdu_rx *tid_agg_rx; 2814 u16 start_seq_num; 2815 u16 tid; 2816 2817 if (likely(!ieee80211_is_ctl(bar->frame_control))) 2818 return RX_CONTINUE; 2819 2820 if (ieee80211_is_back_req(bar->frame_control)) { 2821 struct { 2822 __le16 control, start_seq_num; 2823 } __packed bar_data; 2824 struct ieee80211_event event = { 2825 .type = BAR_RX_EVENT, 2826 }; 2827 2828 if (!rx->sta) 2829 return RX_DROP_MONITOR; 2830 2831 if (skb_copy_bits(skb, offsetof(struct ieee80211_bar, control), 2832 &bar_data, sizeof(bar_data))) 2833 return RX_DROP_MONITOR; 2834 2835 tid = le16_to_cpu(bar_data.control) >> 12; 2836 2837 if (!test_bit(tid, rx->sta->ampdu_mlme.agg_session_valid) && 2838 !test_and_set_bit(tid, rx->sta->ampdu_mlme.unexpected_agg)) 2839 ieee80211_send_delba(rx->sdata, rx->sta->sta.addr, tid, 2840 WLAN_BACK_RECIPIENT, 2841 WLAN_REASON_QSTA_REQUIRE_SETUP); 2842 2843 tid_agg_rx = rcu_dereference(rx->sta->ampdu_mlme.tid_rx[tid]); 2844 if (!tid_agg_rx) 2845 return RX_DROP_MONITOR; 2846 2847 start_seq_num = le16_to_cpu(bar_data.start_seq_num) >> 4; 2848 event.u.ba.tid = tid; 2849 event.u.ba.ssn = start_seq_num; 2850 event.u.ba.sta = &rx->sta->sta; 2851 2852 /* reset session timer */ 2853 if (tid_agg_rx->timeout) 2854 mod_timer(&tid_agg_rx->session_timer, 2855 TU_TO_EXP_TIME(tid_agg_rx->timeout)); 2856 2857 spin_lock(&tid_agg_rx->reorder_lock); 2858 /* release stored frames up to start of BAR */ 2859 ieee80211_release_reorder_frames(rx->sdata, tid_agg_rx, 2860 start_seq_num, frames); 2861 spin_unlock(&tid_agg_rx->reorder_lock); 2862 2863 drv_event_callback(rx->local, rx->sdata, &event); 2864 2865 kfree_skb(skb); 2866 return RX_QUEUED; 2867 } 2868 2869 /* 2870 * After this point, we only want management frames, 2871 * so we can drop all remaining control frames to 2872 * cooked monitor interfaces. 2873 */ 2874 return RX_DROP_MONITOR; 2875 } 2876 2877 static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata, 2878 struct ieee80211_mgmt *mgmt, 2879 size_t len) 2880 { 2881 struct ieee80211_local *local = sdata->local; 2882 struct sk_buff *skb; 2883 struct ieee80211_mgmt *resp; 2884 2885 if (!ether_addr_equal(mgmt->da, sdata->vif.addr)) { 2886 /* Not to own unicast address */ 2887 return; 2888 } 2889 2890 if (!ether_addr_equal(mgmt->sa, sdata->u.mgd.bssid) || 2891 !ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid)) { 2892 /* Not from the current AP or not associated yet. */ 2893 return; 2894 } 2895 2896 if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) { 2897 /* Too short SA Query request frame */ 2898 return; 2899 } 2900 2901 skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom); 2902 if (skb == NULL) 2903 return; 2904 2905 skb_reserve(skb, local->hw.extra_tx_headroom); 2906 resp = skb_put_zero(skb, 24); 2907 memcpy(resp->da, mgmt->sa, ETH_ALEN); 2908 memcpy(resp->sa, sdata->vif.addr, ETH_ALEN); 2909 memcpy(resp->bssid, sdata->u.mgd.bssid, ETH_ALEN); 2910 resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | 2911 IEEE80211_STYPE_ACTION); 2912 skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query)); 2913 resp->u.action.category = WLAN_CATEGORY_SA_QUERY; 2914 resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE; 2915 memcpy(resp->u.action.u.sa_query.trans_id, 2916 mgmt->u.action.u.sa_query.trans_id, 2917 WLAN_SA_QUERY_TR_ID_LEN); 2918 2919 ieee80211_tx_skb(sdata, skb); 2920 } 2921 2922 static ieee80211_rx_result debug_noinline 2923 ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx) 2924 { 2925 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data; 2926 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 2927 2928 /* 2929 * From here on, look only at management frames. 2930 * Data and control frames are already handled, 2931 * and unknown (reserved) frames are useless. 2932 */ 2933 if (rx->skb->len < 24) 2934 return RX_DROP_MONITOR; 2935 2936 if (!ieee80211_is_mgmt(mgmt->frame_control)) 2937 return RX_DROP_MONITOR; 2938 2939 if (rx->sdata->vif.type == NL80211_IFTYPE_AP && 2940 ieee80211_is_beacon(mgmt->frame_control) && 2941 !(rx->flags & IEEE80211_RX_BEACON_REPORTED)) { 2942 int sig = 0; 2943 2944 if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM) && 2945 !(status->flag & RX_FLAG_NO_SIGNAL_VAL)) 2946 sig = status->signal; 2947 2948 cfg80211_report_obss_beacon(rx->local->hw.wiphy, 2949 rx->skb->data, rx->skb->len, 2950 status->freq, sig); 2951 rx->flags |= IEEE80211_RX_BEACON_REPORTED; 2952 } 2953 2954 if (ieee80211_drop_unencrypted_mgmt(rx)) 2955 return RX_DROP_UNUSABLE; 2956 2957 return RX_CONTINUE; 2958 } 2959 2960 static ieee80211_rx_result debug_noinline 2961 ieee80211_rx_h_action(struct ieee80211_rx_data *rx) 2962 { 2963 struct ieee80211_local *local = rx->local; 2964 struct ieee80211_sub_if_data *sdata = rx->sdata; 2965 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data; 2966 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 2967 int len = rx->skb->len; 2968 2969 if (!ieee80211_is_action(mgmt->frame_control)) 2970 return RX_CONTINUE; 2971 2972 /* drop too small frames */ 2973 if (len < IEEE80211_MIN_ACTION_SIZE) 2974 return RX_DROP_UNUSABLE; 2975 2976 if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC && 2977 mgmt->u.action.category != WLAN_CATEGORY_SELF_PROTECTED && 2978 mgmt->u.action.category != WLAN_CATEGORY_SPECTRUM_MGMT) 2979 return RX_DROP_UNUSABLE; 2980 2981 switch (mgmt->u.action.category) { 2982 case WLAN_CATEGORY_HT: 2983 /* reject HT action frames from stations not supporting HT */ 2984 if (!rx->sta->sta.ht_cap.ht_supported) 2985 goto invalid; 2986 2987 if (sdata->vif.type != NL80211_IFTYPE_STATION && 2988 sdata->vif.type != NL80211_IFTYPE_MESH_POINT && 2989 sdata->vif.type != NL80211_IFTYPE_AP_VLAN && 2990 sdata->vif.type != NL80211_IFTYPE_AP && 2991 sdata->vif.type != NL80211_IFTYPE_ADHOC) 2992 break; 2993 2994 /* verify action & smps_control/chanwidth are present */ 2995 if (len < IEEE80211_MIN_ACTION_SIZE + 2) 2996 goto invalid; 2997 2998 switch (mgmt->u.action.u.ht_smps.action) { 2999 case WLAN_HT_ACTION_SMPS: { 3000 struct ieee80211_supported_band *sband; 3001 enum ieee80211_smps_mode smps_mode; 3002 struct sta_opmode_info sta_opmode = {}; 3003 3004 /* convert to HT capability */ 3005 switch (mgmt->u.action.u.ht_smps.smps_control) { 3006 case WLAN_HT_SMPS_CONTROL_DISABLED: 3007 smps_mode = IEEE80211_SMPS_OFF; 3008 break; 3009 case WLAN_HT_SMPS_CONTROL_STATIC: 3010 smps_mode = IEEE80211_SMPS_STATIC; 3011 break; 3012 case WLAN_HT_SMPS_CONTROL_DYNAMIC: 3013 smps_mode = IEEE80211_SMPS_DYNAMIC; 3014 break; 3015 default: 3016 goto invalid; 3017 } 3018 3019 /* if no change do nothing */ 3020 if (rx->sta->sta.smps_mode == smps_mode) 3021 goto handled; 3022 rx->sta->sta.smps_mode = smps_mode; 3023 sta_opmode.smps_mode = 3024 ieee80211_smps_mode_to_smps_mode(smps_mode); 3025 sta_opmode.changed = STA_OPMODE_SMPS_MODE_CHANGED; 3026 3027 sband = rx->local->hw.wiphy->bands[status->band]; 3028 3029 rate_control_rate_update(local, sband, rx->sta, 3030 IEEE80211_RC_SMPS_CHANGED); 3031 cfg80211_sta_opmode_change_notify(sdata->dev, 3032 rx->sta->addr, 3033 &sta_opmode, 3034 GFP_KERNEL); 3035 goto handled; 3036 } 3037 case WLAN_HT_ACTION_NOTIFY_CHANWIDTH: { 3038 struct ieee80211_supported_band *sband; 3039 u8 chanwidth = mgmt->u.action.u.ht_notify_cw.chanwidth; 3040 enum ieee80211_sta_rx_bandwidth max_bw, new_bw; 3041 struct sta_opmode_info sta_opmode = {}; 3042 3043 /* If it doesn't support 40 MHz it can't change ... */ 3044 if (!(rx->sta->sta.ht_cap.cap & 3045 IEEE80211_HT_CAP_SUP_WIDTH_20_40)) 3046 goto handled; 3047 3048 if (chanwidth == IEEE80211_HT_CHANWIDTH_20MHZ) 3049 max_bw = IEEE80211_STA_RX_BW_20; 3050 else 3051 max_bw = ieee80211_sta_cap_rx_bw(rx->sta); 3052 3053 /* set cur_max_bandwidth and recalc sta bw */ 3054 rx->sta->cur_max_bandwidth = max_bw; 3055 new_bw = ieee80211_sta_cur_vht_bw(rx->sta); 3056 3057 if (rx->sta->sta.bandwidth == new_bw) 3058 goto handled; 3059 3060 rx->sta->sta.bandwidth = new_bw; 3061 sband = rx->local->hw.wiphy->bands[status->band]; 3062 sta_opmode.bw = 3063 ieee80211_sta_rx_bw_to_chan_width(rx->sta); 3064 sta_opmode.changed = STA_OPMODE_MAX_BW_CHANGED; 3065 3066 rate_control_rate_update(local, sband, rx->sta, 3067 IEEE80211_RC_BW_CHANGED); 3068 cfg80211_sta_opmode_change_notify(sdata->dev, 3069 rx->sta->addr, 3070 &sta_opmode, 3071 GFP_KERNEL); 3072 goto handled; 3073 } 3074 default: 3075 goto invalid; 3076 } 3077 3078 break; 3079 case WLAN_CATEGORY_PUBLIC: 3080 if (len < IEEE80211_MIN_ACTION_SIZE + 1) 3081 goto invalid; 3082 if (sdata->vif.type != NL80211_IFTYPE_STATION) 3083 break; 3084 if (!rx->sta) 3085 break; 3086 if (!ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid)) 3087 break; 3088 if (mgmt->u.action.u.ext_chan_switch.action_code != 3089 WLAN_PUB_ACTION_EXT_CHANSW_ANN) 3090 break; 3091 if (len < offsetof(struct ieee80211_mgmt, 3092 u.action.u.ext_chan_switch.variable)) 3093 goto invalid; 3094 goto queue; 3095 case WLAN_CATEGORY_VHT: 3096 if (sdata->vif.type != NL80211_IFTYPE_STATION && 3097 sdata->vif.type != NL80211_IFTYPE_MESH_POINT && 3098 sdata->vif.type != NL80211_IFTYPE_AP_VLAN && 3099 sdata->vif.type != NL80211_IFTYPE_AP && 3100 sdata->vif.type != NL80211_IFTYPE_ADHOC) 3101 break; 3102 3103 /* verify action code is present */ 3104 if (len < IEEE80211_MIN_ACTION_SIZE + 1) 3105 goto invalid; 3106 3107 switch (mgmt->u.action.u.vht_opmode_notif.action_code) { 3108 case WLAN_VHT_ACTION_OPMODE_NOTIF: { 3109 /* verify opmode is present */ 3110 if (len < IEEE80211_MIN_ACTION_SIZE + 2) 3111 goto invalid; 3112 goto queue; 3113 } 3114 case WLAN_VHT_ACTION_GROUPID_MGMT: { 3115 if (len < IEEE80211_MIN_ACTION_SIZE + 25) 3116 goto invalid; 3117 goto queue; 3118 } 3119 default: 3120 break; 3121 } 3122 break; 3123 case WLAN_CATEGORY_BACK: 3124 if (sdata->vif.type != NL80211_IFTYPE_STATION && 3125 sdata->vif.type != NL80211_IFTYPE_MESH_POINT && 3126 sdata->vif.type != NL80211_IFTYPE_AP_VLAN && 3127 sdata->vif.type != NL80211_IFTYPE_AP && 3128 sdata->vif.type != NL80211_IFTYPE_ADHOC) 3129 break; 3130 3131 /* verify action_code is present */ 3132 if (len < IEEE80211_MIN_ACTION_SIZE + 1) 3133 break; 3134 3135 switch (mgmt->u.action.u.addba_req.action_code) { 3136 case WLAN_ACTION_ADDBA_REQ: 3137 if (len < (IEEE80211_MIN_ACTION_SIZE + 3138 sizeof(mgmt->u.action.u.addba_req))) 3139 goto invalid; 3140 break; 3141 case WLAN_ACTION_ADDBA_RESP: 3142 if (len < (IEEE80211_MIN_ACTION_SIZE + 3143 sizeof(mgmt->u.action.u.addba_resp))) 3144 goto invalid; 3145 break; 3146 case WLAN_ACTION_DELBA: 3147 if (len < (IEEE80211_MIN_ACTION_SIZE + 3148 sizeof(mgmt->u.action.u.delba))) 3149 goto invalid; 3150 break; 3151 default: 3152 goto invalid; 3153 } 3154 3155 goto queue; 3156 case WLAN_CATEGORY_SPECTRUM_MGMT: 3157 /* verify action_code is present */ 3158 if (len < IEEE80211_MIN_ACTION_SIZE + 1) 3159 break; 3160 3161 switch (mgmt->u.action.u.measurement.action_code) { 3162 case WLAN_ACTION_SPCT_MSR_REQ: 3163 if (status->band != NL80211_BAND_5GHZ) 3164 break; 3165 3166 if (len < (IEEE80211_MIN_ACTION_SIZE + 3167 sizeof(mgmt->u.action.u.measurement))) 3168 break; 3169 3170 if (sdata->vif.type != NL80211_IFTYPE_STATION) 3171 break; 3172 3173 ieee80211_process_measurement_req(sdata, mgmt, len); 3174 goto handled; 3175 case WLAN_ACTION_SPCT_CHL_SWITCH: { 3176 u8 *bssid; 3177 if (len < (IEEE80211_MIN_ACTION_SIZE + 3178 sizeof(mgmt->u.action.u.chan_switch))) 3179 break; 3180 3181 if (sdata->vif.type != NL80211_IFTYPE_STATION && 3182 sdata->vif.type != NL80211_IFTYPE_ADHOC && 3183 sdata->vif.type != NL80211_IFTYPE_MESH_POINT) 3184 break; 3185 3186 if (sdata->vif.type == NL80211_IFTYPE_STATION) 3187 bssid = sdata->u.mgd.bssid; 3188 else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) 3189 bssid = sdata->u.ibss.bssid; 3190 else if (sdata->vif.type == NL80211_IFTYPE_MESH_POINT) 3191 bssid = mgmt->sa; 3192 else 3193 break; 3194 3195 if (!ether_addr_equal(mgmt->bssid, bssid)) 3196 break; 3197 3198 goto queue; 3199 } 3200 } 3201 break; 3202 case WLAN_CATEGORY_SA_QUERY: 3203 if (len < (IEEE80211_MIN_ACTION_SIZE + 3204 sizeof(mgmt->u.action.u.sa_query))) 3205 break; 3206 3207 switch (mgmt->u.action.u.sa_query.action) { 3208 case WLAN_ACTION_SA_QUERY_REQUEST: 3209 if (sdata->vif.type != NL80211_IFTYPE_STATION) 3210 break; 3211 ieee80211_process_sa_query_req(sdata, mgmt, len); 3212 goto handled; 3213 } 3214 break; 3215 case WLAN_CATEGORY_SELF_PROTECTED: 3216 if (len < (IEEE80211_MIN_ACTION_SIZE + 3217 sizeof(mgmt->u.action.u.self_prot.action_code))) 3218 break; 3219 3220 switch (mgmt->u.action.u.self_prot.action_code) { 3221 case WLAN_SP_MESH_PEERING_OPEN: 3222 case WLAN_SP_MESH_PEERING_CLOSE: 3223 case WLAN_SP_MESH_PEERING_CONFIRM: 3224 if (!ieee80211_vif_is_mesh(&sdata->vif)) 3225 goto invalid; 3226 if (sdata->u.mesh.user_mpm) 3227 /* userspace handles this frame */ 3228 break; 3229 goto queue; 3230 case WLAN_SP_MGK_INFORM: 3231 case WLAN_SP_MGK_ACK: 3232 if (!ieee80211_vif_is_mesh(&sdata->vif)) 3233 goto invalid; 3234 break; 3235 } 3236 break; 3237 case WLAN_CATEGORY_MESH_ACTION: 3238 if (len < (IEEE80211_MIN_ACTION_SIZE + 3239 sizeof(mgmt->u.action.u.mesh_action.action_code))) 3240 break; 3241 3242 if (!ieee80211_vif_is_mesh(&sdata->vif)) 3243 break; 3244 if (mesh_action_is_path_sel(mgmt) && 3245 !mesh_path_sel_is_hwmp(sdata)) 3246 break; 3247 goto queue; 3248 } 3249 3250 return RX_CONTINUE; 3251 3252 invalid: 3253 status->rx_flags |= IEEE80211_RX_MALFORMED_ACTION_FRM; 3254 /* will return in the next handlers */ 3255 return RX_CONTINUE; 3256 3257 handled: 3258 if (rx->sta) 3259 rx->sta->rx_stats.packets++; 3260 dev_kfree_skb(rx->skb); 3261 return RX_QUEUED; 3262 3263 queue: 3264 skb_queue_tail(&sdata->skb_queue, rx->skb); 3265 ieee80211_queue_work(&local->hw, &sdata->work); 3266 if (rx->sta) 3267 rx->sta->rx_stats.packets++; 3268 return RX_QUEUED; 3269 } 3270 3271 static ieee80211_rx_result debug_noinline 3272 ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx) 3273 { 3274 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 3275 int sig = 0; 3276 3277 /* skip known-bad action frames and return them in the next handler */ 3278 if (status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) 3279 return RX_CONTINUE; 3280 3281 /* 3282 * Getting here means the kernel doesn't know how to handle 3283 * it, but maybe userspace does ... include returned frames 3284 * so userspace can register for those to know whether ones 3285 * it transmitted were processed or returned. 3286 */ 3287 3288 if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM) && 3289 !(status->flag & RX_FLAG_NO_SIGNAL_VAL)) 3290 sig = status->signal; 3291 3292 if (cfg80211_rx_mgmt(&rx->sdata->wdev, status->freq, sig, 3293 rx->skb->data, rx->skb->len, 0)) { 3294 if (rx->sta) 3295 rx->sta->rx_stats.packets++; 3296 dev_kfree_skb(rx->skb); 3297 return RX_QUEUED; 3298 } 3299 3300 return RX_CONTINUE; 3301 } 3302 3303 static ieee80211_rx_result debug_noinline 3304 ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx) 3305 { 3306 struct ieee80211_local *local = rx->local; 3307 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data; 3308 struct sk_buff *nskb; 3309 struct ieee80211_sub_if_data *sdata = rx->sdata; 3310 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 3311 3312 if (!ieee80211_is_action(mgmt->frame_control)) 3313 return RX_CONTINUE; 3314 3315 /* 3316 * For AP mode, hostapd is responsible for handling any action 3317 * frames that we didn't handle, including returning unknown 3318 * ones. For all other modes we will return them to the sender, 3319 * setting the 0x80 bit in the action category, as required by 3320 * 802.11-2012 9.24.4. 3321 * Newer versions of hostapd shall also use the management frame 3322 * registration mechanisms, but older ones still use cooked 3323 * monitor interfaces so push all frames there. 3324 */ 3325 if (!(status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) && 3326 (sdata->vif.type == NL80211_IFTYPE_AP || 3327 sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) 3328 return RX_DROP_MONITOR; 3329 3330 if (is_multicast_ether_addr(mgmt->da)) 3331 return RX_DROP_MONITOR; 3332 3333 /* do not return rejected action frames */ 3334 if (mgmt->u.action.category & 0x80) 3335 return RX_DROP_UNUSABLE; 3336 3337 nskb = skb_copy_expand(rx->skb, local->hw.extra_tx_headroom, 0, 3338 GFP_ATOMIC); 3339 if (nskb) { 3340 struct ieee80211_mgmt *nmgmt = (void *)nskb->data; 3341 3342 nmgmt->u.action.category |= 0x80; 3343 memcpy(nmgmt->da, nmgmt->sa, ETH_ALEN); 3344 memcpy(nmgmt->sa, rx->sdata->vif.addr, ETH_ALEN); 3345 3346 memset(nskb->cb, 0, sizeof(nskb->cb)); 3347 3348 if (rx->sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) { 3349 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(nskb); 3350 3351 info->flags = IEEE80211_TX_CTL_TX_OFFCHAN | 3352 IEEE80211_TX_INTFL_OFFCHAN_TX_OK | 3353 IEEE80211_TX_CTL_NO_CCK_RATE; 3354 if (ieee80211_hw_check(&local->hw, QUEUE_CONTROL)) 3355 info->hw_queue = 3356 local->hw.offchannel_tx_hw_queue; 3357 } 3358 3359 __ieee80211_tx_skb_tid_band(rx->sdata, nskb, 7, 3360 status->band, 0); 3361 } 3362 dev_kfree_skb(rx->skb); 3363 return RX_QUEUED; 3364 } 3365 3366 static ieee80211_rx_result debug_noinline 3367 ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx) 3368 { 3369 struct ieee80211_sub_if_data *sdata = rx->sdata; 3370 struct ieee80211_mgmt *mgmt = (void *)rx->skb->data; 3371 __le16 stype; 3372 3373 stype = mgmt->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE); 3374 3375 if (!ieee80211_vif_is_mesh(&sdata->vif) && 3376 sdata->vif.type != NL80211_IFTYPE_ADHOC && 3377 sdata->vif.type != NL80211_IFTYPE_OCB && 3378 sdata->vif.type != NL80211_IFTYPE_STATION) 3379 return RX_DROP_MONITOR; 3380 3381 switch (stype) { 3382 case cpu_to_le16(IEEE80211_STYPE_AUTH): 3383 case cpu_to_le16(IEEE80211_STYPE_BEACON): 3384 case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP): 3385 /* process for all: mesh, mlme, ibss */ 3386 break; 3387 case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP): 3388 case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP): 3389 case cpu_to_le16(IEEE80211_STYPE_DEAUTH): 3390 case cpu_to_le16(IEEE80211_STYPE_DISASSOC): 3391 if (is_multicast_ether_addr(mgmt->da) && 3392 !is_broadcast_ether_addr(mgmt->da)) 3393 return RX_DROP_MONITOR; 3394 3395 /* process only for station */ 3396 if (sdata->vif.type != NL80211_IFTYPE_STATION) 3397 return RX_DROP_MONITOR; 3398 break; 3399 case cpu_to_le16(IEEE80211_STYPE_PROBE_REQ): 3400 /* process only for ibss and mesh */ 3401 if (sdata->vif.type != NL80211_IFTYPE_ADHOC && 3402 sdata->vif.type != NL80211_IFTYPE_MESH_POINT) 3403 return RX_DROP_MONITOR; 3404 break; 3405 default: 3406 return RX_DROP_MONITOR; 3407 } 3408 3409 /* queue up frame and kick off work to process it */ 3410 skb_queue_tail(&sdata->skb_queue, rx->skb); 3411 ieee80211_queue_work(&rx->local->hw, &sdata->work); 3412 if (rx->sta) 3413 rx->sta->rx_stats.packets++; 3414 3415 return RX_QUEUED; 3416 } 3417 3418 static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx, 3419 struct ieee80211_rate *rate) 3420 { 3421 struct ieee80211_sub_if_data *sdata; 3422 struct ieee80211_local *local = rx->local; 3423 struct sk_buff *skb = rx->skb, *skb2; 3424 struct net_device *prev_dev = NULL; 3425 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 3426 int needed_headroom; 3427 3428 /* 3429 * If cooked monitor has been processed already, then 3430 * don't do it again. If not, set the flag. 3431 */ 3432 if (rx->flags & IEEE80211_RX_CMNTR) 3433 goto out_free_skb; 3434 rx->flags |= IEEE80211_RX_CMNTR; 3435 3436 /* If there are no cooked monitor interfaces, just free the SKB */ 3437 if (!local->cooked_mntrs) 3438 goto out_free_skb; 3439 3440 /* vendor data is long removed here */ 3441 status->flag &= ~RX_FLAG_RADIOTAP_VENDOR_DATA; 3442 /* room for the radiotap header based on driver features */ 3443 needed_headroom = ieee80211_rx_radiotap_hdrlen(local, status, skb); 3444 3445 if (skb_headroom(skb) < needed_headroom && 3446 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) 3447 goto out_free_skb; 3448 3449 /* prepend radiotap information */ 3450 ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom, 3451 false); 3452 3453 skb_reset_mac_header(skb); 3454 skb->ip_summed = CHECKSUM_UNNECESSARY; 3455 skb->pkt_type = PACKET_OTHERHOST; 3456 skb->protocol = htons(ETH_P_802_2); 3457 3458 list_for_each_entry_rcu(sdata, &local->interfaces, list) { 3459 if (!ieee80211_sdata_running(sdata)) 3460 continue; 3461 3462 if (sdata->vif.type != NL80211_IFTYPE_MONITOR || 3463 !(sdata->u.mntr.flags & MONITOR_FLAG_COOK_FRAMES)) 3464 continue; 3465 3466 if (prev_dev) { 3467 skb2 = skb_clone(skb, GFP_ATOMIC); 3468 if (skb2) { 3469 skb2->dev = prev_dev; 3470 netif_receive_skb(skb2); 3471 } 3472 } 3473 3474 prev_dev = sdata->dev; 3475 ieee80211_rx_stats(sdata->dev, skb->len); 3476 } 3477 3478 if (prev_dev) { 3479 skb->dev = prev_dev; 3480 netif_receive_skb(skb); 3481 return; 3482 } 3483 3484 out_free_skb: 3485 dev_kfree_skb(skb); 3486 } 3487 3488 static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx, 3489 ieee80211_rx_result res) 3490 { 3491 switch (res) { 3492 case RX_DROP_MONITOR: 3493 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop); 3494 if (rx->sta) 3495 rx->sta->rx_stats.dropped++; 3496 /* fall through */ 3497 case RX_CONTINUE: { 3498 struct ieee80211_rate *rate = NULL; 3499 struct ieee80211_supported_band *sband; 3500 struct ieee80211_rx_status *status; 3501 3502 status = IEEE80211_SKB_RXCB((rx->skb)); 3503 3504 sband = rx->local->hw.wiphy->bands[status->band]; 3505 if (status->encoding == RX_ENC_LEGACY) 3506 rate = &sband->bitrates[status->rate_idx]; 3507 3508 ieee80211_rx_cooked_monitor(rx, rate); 3509 break; 3510 } 3511 case RX_DROP_UNUSABLE: 3512 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop); 3513 if (rx->sta) 3514 rx->sta->rx_stats.dropped++; 3515 dev_kfree_skb(rx->skb); 3516 break; 3517 case RX_QUEUED: 3518 I802_DEBUG_INC(rx->sdata->local->rx_handlers_queued); 3519 break; 3520 } 3521 } 3522 3523 static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx, 3524 struct sk_buff_head *frames) 3525 { 3526 ieee80211_rx_result res = RX_DROP_MONITOR; 3527 struct sk_buff *skb; 3528 3529 #define CALL_RXH(rxh) \ 3530 do { \ 3531 res = rxh(rx); \ 3532 if (res != RX_CONTINUE) \ 3533 goto rxh_next; \ 3534 } while (0) 3535 3536 /* Lock here to avoid hitting all of the data used in the RX 3537 * path (e.g. key data, station data, ...) concurrently when 3538 * a frame is released from the reorder buffer due to timeout 3539 * from the timer, potentially concurrently with RX from the 3540 * driver. 3541 */ 3542 spin_lock_bh(&rx->local->rx_path_lock); 3543 3544 while ((skb = __skb_dequeue(frames))) { 3545 /* 3546 * all the other fields are valid across frames 3547 * that belong to an aMPDU since they are on the 3548 * same TID from the same station 3549 */ 3550 rx->skb = skb; 3551 3552 CALL_RXH(ieee80211_rx_h_check_more_data); 3553 CALL_RXH(ieee80211_rx_h_uapsd_and_pspoll); 3554 CALL_RXH(ieee80211_rx_h_sta_process); 3555 CALL_RXH(ieee80211_rx_h_decrypt); 3556 CALL_RXH(ieee80211_rx_h_defragment); 3557 CALL_RXH(ieee80211_rx_h_michael_mic_verify); 3558 /* must be after MMIC verify so header is counted in MPDU mic */ 3559 #ifdef CONFIG_MAC80211_MESH 3560 if (ieee80211_vif_is_mesh(&rx->sdata->vif)) 3561 CALL_RXH(ieee80211_rx_h_mesh_fwding); 3562 #endif 3563 CALL_RXH(ieee80211_rx_h_amsdu); 3564 CALL_RXH(ieee80211_rx_h_data); 3565 3566 /* special treatment -- needs the queue */ 3567 res = ieee80211_rx_h_ctrl(rx, frames); 3568 if (res != RX_CONTINUE) 3569 goto rxh_next; 3570 3571 CALL_RXH(ieee80211_rx_h_mgmt_check); 3572 CALL_RXH(ieee80211_rx_h_action); 3573 CALL_RXH(ieee80211_rx_h_userspace_mgmt); 3574 CALL_RXH(ieee80211_rx_h_action_return); 3575 CALL_RXH(ieee80211_rx_h_mgmt); 3576 3577 rxh_next: 3578 ieee80211_rx_handlers_result(rx, res); 3579 3580 #undef CALL_RXH 3581 } 3582 3583 spin_unlock_bh(&rx->local->rx_path_lock); 3584 } 3585 3586 static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx) 3587 { 3588 struct sk_buff_head reorder_release; 3589 ieee80211_rx_result res = RX_DROP_MONITOR; 3590 3591 __skb_queue_head_init(&reorder_release); 3592 3593 #define CALL_RXH(rxh) \ 3594 do { \ 3595 res = rxh(rx); \ 3596 if (res != RX_CONTINUE) \ 3597 goto rxh_next; \ 3598 } while (0) 3599 3600 CALL_RXH(ieee80211_rx_h_check_dup); 3601 CALL_RXH(ieee80211_rx_h_check); 3602 3603 ieee80211_rx_reorder_ampdu(rx, &reorder_release); 3604 3605 ieee80211_rx_handlers(rx, &reorder_release); 3606 return; 3607 3608 rxh_next: 3609 ieee80211_rx_handlers_result(rx, res); 3610 3611 #undef CALL_RXH 3612 } 3613 3614 /* 3615 * This function makes calls into the RX path, therefore 3616 * it has to be invoked under RCU read lock. 3617 */ 3618 void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid) 3619 { 3620 struct sk_buff_head frames; 3621 struct ieee80211_rx_data rx = { 3622 .sta = sta, 3623 .sdata = sta->sdata, 3624 .local = sta->local, 3625 /* This is OK -- must be QoS data frame */ 3626 .security_idx = tid, 3627 .seqno_idx = tid, 3628 .napi = NULL, /* must be NULL to not have races */ 3629 }; 3630 struct tid_ampdu_rx *tid_agg_rx; 3631 3632 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]); 3633 if (!tid_agg_rx) 3634 return; 3635 3636 __skb_queue_head_init(&frames); 3637 3638 spin_lock(&tid_agg_rx->reorder_lock); 3639 ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames); 3640 spin_unlock(&tid_agg_rx->reorder_lock); 3641 3642 if (!skb_queue_empty(&frames)) { 3643 struct ieee80211_event event = { 3644 .type = BA_FRAME_TIMEOUT, 3645 .u.ba.tid = tid, 3646 .u.ba.sta = &sta->sta, 3647 }; 3648 drv_event_callback(rx.local, rx.sdata, &event); 3649 } 3650 3651 ieee80211_rx_handlers(&rx, &frames); 3652 } 3653 3654 void ieee80211_mark_rx_ba_filtered_frames(struct ieee80211_sta *pubsta, u8 tid, 3655 u16 ssn, u64 filtered, 3656 u16 received_mpdus) 3657 { 3658 struct sta_info *sta; 3659 struct tid_ampdu_rx *tid_agg_rx; 3660 struct sk_buff_head frames; 3661 struct ieee80211_rx_data rx = { 3662 /* This is OK -- must be QoS data frame */ 3663 .security_idx = tid, 3664 .seqno_idx = tid, 3665 }; 3666 int i, diff; 3667 3668 if (WARN_ON(!pubsta || tid >= IEEE80211_NUM_TIDS)) 3669 return; 3670 3671 __skb_queue_head_init(&frames); 3672 3673 sta = container_of(pubsta, struct sta_info, sta); 3674 3675 rx.sta = sta; 3676 rx.sdata = sta->sdata; 3677 rx.local = sta->local; 3678 3679 rcu_read_lock(); 3680 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]); 3681 if (!tid_agg_rx) 3682 goto out; 3683 3684 spin_lock_bh(&tid_agg_rx->reorder_lock); 3685 3686 if (received_mpdus >= IEEE80211_SN_MODULO >> 1) { 3687 int release; 3688 3689 /* release all frames in the reorder buffer */ 3690 release = (tid_agg_rx->head_seq_num + tid_agg_rx->buf_size) % 3691 IEEE80211_SN_MODULO; 3692 ieee80211_release_reorder_frames(sta->sdata, tid_agg_rx, 3693 release, &frames); 3694 /* update ssn to match received ssn */ 3695 tid_agg_rx->head_seq_num = ssn; 3696 } else { 3697 ieee80211_release_reorder_frames(sta->sdata, tid_agg_rx, ssn, 3698 &frames); 3699 } 3700 3701 /* handle the case that received ssn is behind the mac ssn. 3702 * it can be tid_agg_rx->buf_size behind and still be valid */ 3703 diff = (tid_agg_rx->head_seq_num - ssn) & IEEE80211_SN_MASK; 3704 if (diff >= tid_agg_rx->buf_size) { 3705 tid_agg_rx->reorder_buf_filtered = 0; 3706 goto release; 3707 } 3708 filtered = filtered >> diff; 3709 ssn += diff; 3710 3711 /* update bitmap */ 3712 for (i = 0; i < tid_agg_rx->buf_size; i++) { 3713 int index = (ssn + i) % tid_agg_rx->buf_size; 3714 3715 tid_agg_rx->reorder_buf_filtered &= ~BIT_ULL(index); 3716 if (filtered & BIT_ULL(i)) 3717 tid_agg_rx->reorder_buf_filtered |= BIT_ULL(index); 3718 } 3719 3720 /* now process also frames that the filter marking released */ 3721 ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames); 3722 3723 release: 3724 spin_unlock_bh(&tid_agg_rx->reorder_lock); 3725 3726 ieee80211_rx_handlers(&rx, &frames); 3727 3728 out: 3729 rcu_read_unlock(); 3730 } 3731 EXPORT_SYMBOL(ieee80211_mark_rx_ba_filtered_frames); 3732 3733 /* main receive path */ 3734 3735 static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx) 3736 { 3737 struct ieee80211_sub_if_data *sdata = rx->sdata; 3738 struct sk_buff *skb = rx->skb; 3739 struct ieee80211_hdr *hdr = (void *)skb->data; 3740 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 3741 u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type); 3742 bool multicast = is_multicast_ether_addr(hdr->addr1); 3743 3744 switch (sdata->vif.type) { 3745 case NL80211_IFTYPE_STATION: 3746 if (!bssid && !sdata->u.mgd.use_4addr) 3747 return false; 3748 if (multicast) 3749 return true; 3750 return ether_addr_equal(sdata->vif.addr, hdr->addr1); 3751 case NL80211_IFTYPE_ADHOC: 3752 if (!bssid) 3753 return false; 3754 if (ether_addr_equal(sdata->vif.addr, hdr->addr2) || 3755 ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2)) 3756 return false; 3757 if (ieee80211_is_beacon(hdr->frame_control)) 3758 return true; 3759 if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid)) 3760 return false; 3761 if (!multicast && 3762 !ether_addr_equal(sdata->vif.addr, hdr->addr1)) 3763 return false; 3764 if (!rx->sta) { 3765 int rate_idx; 3766 if (status->encoding != RX_ENC_LEGACY) 3767 rate_idx = 0; /* TODO: HT/VHT rates */ 3768 else 3769 rate_idx = status->rate_idx; 3770 ieee80211_ibss_rx_no_sta(sdata, bssid, hdr->addr2, 3771 BIT(rate_idx)); 3772 } 3773 return true; 3774 case NL80211_IFTYPE_OCB: 3775 if (!bssid) 3776 return false; 3777 if (!ieee80211_is_data_present(hdr->frame_control)) 3778 return false; 3779 if (!is_broadcast_ether_addr(bssid)) 3780 return false; 3781 if (!multicast && 3782 !ether_addr_equal(sdata->dev->dev_addr, hdr->addr1)) 3783 return false; 3784 if (!rx->sta) { 3785 int rate_idx; 3786 if (status->encoding != RX_ENC_LEGACY) 3787 rate_idx = 0; /* TODO: HT rates */ 3788 else 3789 rate_idx = status->rate_idx; 3790 ieee80211_ocb_rx_no_sta(sdata, bssid, hdr->addr2, 3791 BIT(rate_idx)); 3792 } 3793 return true; 3794 case NL80211_IFTYPE_MESH_POINT: 3795 if (ether_addr_equal(sdata->vif.addr, hdr->addr2)) 3796 return false; 3797 if (multicast) 3798 return true; 3799 return ether_addr_equal(sdata->vif.addr, hdr->addr1); 3800 case NL80211_IFTYPE_AP_VLAN: 3801 case NL80211_IFTYPE_AP: 3802 if (!bssid) 3803 return ether_addr_equal(sdata->vif.addr, hdr->addr1); 3804 3805 if (!ieee80211_bssid_match(bssid, sdata->vif.addr)) { 3806 /* 3807 * Accept public action frames even when the 3808 * BSSID doesn't match, this is used for P2P 3809 * and location updates. Note that mac80211 3810 * itself never looks at these frames. 3811 */ 3812 if (!multicast && 3813 !ether_addr_equal(sdata->vif.addr, hdr->addr1)) 3814 return false; 3815 if (ieee80211_is_public_action(hdr, skb->len)) 3816 return true; 3817 return ieee80211_is_beacon(hdr->frame_control); 3818 } 3819 3820 if (!ieee80211_has_tods(hdr->frame_control)) { 3821 /* ignore data frames to TDLS-peers */ 3822 if (ieee80211_is_data(hdr->frame_control)) 3823 return false; 3824 /* ignore action frames to TDLS-peers */ 3825 if (ieee80211_is_action(hdr->frame_control) && 3826 !is_broadcast_ether_addr(bssid) && 3827 !ether_addr_equal(bssid, hdr->addr1)) 3828 return false; 3829 } 3830 3831 /* 3832 * 802.11-2016 Table 9-26 says that for data frames, A1 must be 3833 * the BSSID - we've checked that already but may have accepted 3834 * the wildcard (ff:ff:ff:ff:ff:ff). 3835 * 3836 * It also says: 3837 * The BSSID of the Data frame is determined as follows: 3838 * a) If the STA is contained within an AP or is associated 3839 * with an AP, the BSSID is the address currently in use 3840 * by the STA contained in the AP. 3841 * 3842 * So we should not accept data frames with an address that's 3843 * multicast. 3844 * 3845 * Accepting it also opens a security problem because stations 3846 * could encrypt it with the GTK and inject traffic that way. 3847 */ 3848 if (ieee80211_is_data(hdr->frame_control) && multicast) 3849 return false; 3850 3851 return true; 3852 case NL80211_IFTYPE_WDS: 3853 if (bssid || !ieee80211_is_data(hdr->frame_control)) 3854 return false; 3855 return ether_addr_equal(sdata->u.wds.remote_addr, hdr->addr2); 3856 case NL80211_IFTYPE_P2P_DEVICE: 3857 return ieee80211_is_public_action(hdr, skb->len) || 3858 ieee80211_is_probe_req(hdr->frame_control) || 3859 ieee80211_is_probe_resp(hdr->frame_control) || 3860 ieee80211_is_beacon(hdr->frame_control); 3861 case NL80211_IFTYPE_NAN: 3862 /* Currently no frames on NAN interface are allowed */ 3863 return false; 3864 default: 3865 break; 3866 } 3867 3868 WARN_ON_ONCE(1); 3869 return false; 3870 } 3871 3872 void ieee80211_check_fast_rx(struct sta_info *sta) 3873 { 3874 struct ieee80211_sub_if_data *sdata = sta->sdata; 3875 struct ieee80211_local *local = sdata->local; 3876 struct ieee80211_key *key; 3877 struct ieee80211_fast_rx fastrx = { 3878 .dev = sdata->dev, 3879 .vif_type = sdata->vif.type, 3880 .control_port_protocol = sdata->control_port_protocol, 3881 }, *old, *new = NULL; 3882 bool assign = false; 3883 3884 /* use sparse to check that we don't return without updating */ 3885 __acquire(check_fast_rx); 3886 3887 BUILD_BUG_ON(sizeof(fastrx.rfc1042_hdr) != sizeof(rfc1042_header)); 3888 BUILD_BUG_ON(sizeof(fastrx.rfc1042_hdr) != ETH_ALEN); 3889 ether_addr_copy(fastrx.rfc1042_hdr, rfc1042_header); 3890 ether_addr_copy(fastrx.vif_addr, sdata->vif.addr); 3891 3892 fastrx.uses_rss = ieee80211_hw_check(&local->hw, USES_RSS); 3893 3894 /* fast-rx doesn't do reordering */ 3895 if (ieee80211_hw_check(&local->hw, AMPDU_AGGREGATION) && 3896 !ieee80211_hw_check(&local->hw, SUPPORTS_REORDERING_BUFFER)) 3897 goto clear; 3898 3899 switch (sdata->vif.type) { 3900 case NL80211_IFTYPE_STATION: 3901 if (sta->sta.tdls) { 3902 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr1); 3903 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr2); 3904 fastrx.expected_ds_bits = 0; 3905 } else { 3906 fastrx.sta_notify = sdata->u.mgd.probe_send_count > 0; 3907 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr1); 3908 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr3); 3909 fastrx.expected_ds_bits = 3910 cpu_to_le16(IEEE80211_FCTL_FROMDS); 3911 } 3912 3913 if (sdata->u.mgd.use_4addr && !sta->sta.tdls) { 3914 fastrx.expected_ds_bits |= 3915 cpu_to_le16(IEEE80211_FCTL_TODS); 3916 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3); 3917 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr4); 3918 } 3919 3920 if (!sdata->u.mgd.powersave) 3921 break; 3922 3923 /* software powersave is a huge mess, avoid all of it */ 3924 if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK)) 3925 goto clear; 3926 if (ieee80211_hw_check(&local->hw, SUPPORTS_PS) && 3927 !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS)) 3928 goto clear; 3929 break; 3930 case NL80211_IFTYPE_AP_VLAN: 3931 case NL80211_IFTYPE_AP: 3932 /* parallel-rx requires this, at least with calls to 3933 * ieee80211_sta_ps_transition() 3934 */ 3935 if (!ieee80211_hw_check(&local->hw, AP_LINK_PS)) 3936 goto clear; 3937 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3); 3938 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr2); 3939 fastrx.expected_ds_bits = cpu_to_le16(IEEE80211_FCTL_TODS); 3940 3941 fastrx.internal_forward = 3942 !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) && 3943 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || 3944 !sdata->u.vlan.sta); 3945 3946 if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN && 3947 sdata->u.vlan.sta) { 3948 fastrx.expected_ds_bits |= 3949 cpu_to_le16(IEEE80211_FCTL_FROMDS); 3950 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr4); 3951 fastrx.internal_forward = 0; 3952 } 3953 3954 break; 3955 default: 3956 goto clear; 3957 } 3958 3959 if (!test_sta_flag(sta, WLAN_STA_AUTHORIZED)) 3960 goto clear; 3961 3962 rcu_read_lock(); 3963 key = rcu_dereference(sta->ptk[sta->ptk_idx]); 3964 if (key) { 3965 switch (key->conf.cipher) { 3966 case WLAN_CIPHER_SUITE_TKIP: 3967 /* we don't want to deal with MMIC in fast-rx */ 3968 goto clear_rcu; 3969 case WLAN_CIPHER_SUITE_CCMP: 3970 case WLAN_CIPHER_SUITE_CCMP_256: 3971 case WLAN_CIPHER_SUITE_GCMP: 3972 case WLAN_CIPHER_SUITE_GCMP_256: 3973 break; 3974 default: 3975 /* we also don't want to deal with WEP or cipher scheme 3976 * since those require looking up the key idx in the 3977 * frame, rather than assuming the PTK is used 3978 * (we need to revisit this once we implement the real 3979 * PTK index, which is now valid in the spec, but we 3980 * haven't implemented that part yet) 3981 */ 3982 goto clear_rcu; 3983 } 3984 3985 fastrx.key = true; 3986 fastrx.icv_len = key->conf.icv_len; 3987 } 3988 3989 assign = true; 3990 clear_rcu: 3991 rcu_read_unlock(); 3992 clear: 3993 __release(check_fast_rx); 3994 3995 if (assign) 3996 new = kmemdup(&fastrx, sizeof(fastrx), GFP_KERNEL); 3997 3998 spin_lock_bh(&sta->lock); 3999 old = rcu_dereference_protected(sta->fast_rx, true); 4000 rcu_assign_pointer(sta->fast_rx, new); 4001 spin_unlock_bh(&sta->lock); 4002 4003 if (old) 4004 kfree_rcu(old, rcu_head); 4005 } 4006 4007 void ieee80211_clear_fast_rx(struct sta_info *sta) 4008 { 4009 struct ieee80211_fast_rx *old; 4010 4011 spin_lock_bh(&sta->lock); 4012 old = rcu_dereference_protected(sta->fast_rx, true); 4013 RCU_INIT_POINTER(sta->fast_rx, NULL); 4014 spin_unlock_bh(&sta->lock); 4015 4016 if (old) 4017 kfree_rcu(old, rcu_head); 4018 } 4019 4020 void __ieee80211_check_fast_rx_iface(struct ieee80211_sub_if_data *sdata) 4021 { 4022 struct ieee80211_local *local = sdata->local; 4023 struct sta_info *sta; 4024 4025 lockdep_assert_held(&local->sta_mtx); 4026 4027 list_for_each_entry_rcu(sta, &local->sta_list, list) { 4028 if (sdata != sta->sdata && 4029 (!sta->sdata->bss || sta->sdata->bss != sdata->bss)) 4030 continue; 4031 ieee80211_check_fast_rx(sta); 4032 } 4033 } 4034 4035 void ieee80211_check_fast_rx_iface(struct ieee80211_sub_if_data *sdata) 4036 { 4037 struct ieee80211_local *local = sdata->local; 4038 4039 mutex_lock(&local->sta_mtx); 4040 __ieee80211_check_fast_rx_iface(sdata); 4041 mutex_unlock(&local->sta_mtx); 4042 } 4043 4044 static bool ieee80211_invoke_fast_rx(struct ieee80211_rx_data *rx, 4045 struct ieee80211_fast_rx *fast_rx) 4046 { 4047 struct sk_buff *skb = rx->skb; 4048 struct ieee80211_hdr *hdr = (void *)skb->data; 4049 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 4050 struct sta_info *sta = rx->sta; 4051 int orig_len = skb->len; 4052 int hdrlen = ieee80211_hdrlen(hdr->frame_control); 4053 int snap_offs = hdrlen; 4054 struct { 4055 u8 snap[sizeof(rfc1042_header)]; 4056 __be16 proto; 4057 } *payload __aligned(2); 4058 struct { 4059 u8 da[ETH_ALEN]; 4060 u8 sa[ETH_ALEN]; 4061 } addrs __aligned(2); 4062 struct ieee80211_sta_rx_stats *stats = &sta->rx_stats; 4063 4064 if (fast_rx->uses_rss) 4065 stats = this_cpu_ptr(sta->pcpu_rx_stats); 4066 4067 /* for parallel-rx, we need to have DUP_VALIDATED, otherwise we write 4068 * to a common data structure; drivers can implement that per queue 4069 * but we don't have that information in mac80211 4070 */ 4071 if (!(status->flag & RX_FLAG_DUP_VALIDATED)) 4072 return false; 4073 4074 #define FAST_RX_CRYPT_FLAGS (RX_FLAG_PN_VALIDATED | RX_FLAG_DECRYPTED) 4075 4076 /* If using encryption, we also need to have: 4077 * - PN_VALIDATED: similar, but the implementation is tricky 4078 * - DECRYPTED: necessary for PN_VALIDATED 4079 */ 4080 if (fast_rx->key && 4081 (status->flag & FAST_RX_CRYPT_FLAGS) != FAST_RX_CRYPT_FLAGS) 4082 return false; 4083 4084 if (unlikely(!ieee80211_is_data_present(hdr->frame_control))) 4085 return false; 4086 4087 if (unlikely(ieee80211_is_frag(hdr))) 4088 return false; 4089 4090 /* Since our interface address cannot be multicast, this 4091 * implicitly also rejects multicast frames without the 4092 * explicit check. 4093 * 4094 * We shouldn't get any *data* frames not addressed to us 4095 * (AP mode will accept multicast *management* frames), but 4096 * punting here will make it go through the full checks in 4097 * ieee80211_accept_frame(). 4098 */ 4099 if (!ether_addr_equal(fast_rx->vif_addr, hdr->addr1)) 4100 return false; 4101 4102 if ((hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_FROMDS | 4103 IEEE80211_FCTL_TODS)) != 4104 fast_rx->expected_ds_bits) 4105 return false; 4106 4107 /* assign the key to drop unencrypted frames (later) 4108 * and strip the IV/MIC if necessary 4109 */ 4110 if (fast_rx->key && !(status->flag & RX_FLAG_IV_STRIPPED)) { 4111 /* GCMP header length is the same */ 4112 snap_offs += IEEE80211_CCMP_HDR_LEN; 4113 } 4114 4115 if (!(status->rx_flags & IEEE80211_RX_AMSDU)) { 4116 if (!pskb_may_pull(skb, snap_offs + sizeof(*payload))) 4117 goto drop; 4118 4119 payload = (void *)(skb->data + snap_offs); 4120 4121 if (!ether_addr_equal(payload->snap, fast_rx->rfc1042_hdr)) 4122 return false; 4123 4124 /* Don't handle these here since they require special code. 4125 * Accept AARP and IPX even though they should come with a 4126 * bridge-tunnel header - but if we get them this way then 4127 * there's little point in discarding them. 4128 */ 4129 if (unlikely(payload->proto == cpu_to_be16(ETH_P_TDLS) || 4130 payload->proto == fast_rx->control_port_protocol)) 4131 return false; 4132 } 4133 4134 /* after this point, don't punt to the slowpath! */ 4135 4136 if (rx->key && !(status->flag & RX_FLAG_MIC_STRIPPED) && 4137 pskb_trim(skb, skb->len - fast_rx->icv_len)) 4138 goto drop; 4139 4140 if (unlikely(fast_rx->sta_notify)) { 4141 ieee80211_sta_rx_notify(rx->sdata, hdr); 4142 fast_rx->sta_notify = false; 4143 } 4144 4145 /* statistics part of ieee80211_rx_h_sta_process() */ 4146 if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) { 4147 stats->last_signal = status->signal; 4148 if (!fast_rx->uses_rss) 4149 ewma_signal_add(&sta->rx_stats_avg.signal, 4150 -status->signal); 4151 } 4152 4153 if (status->chains) { 4154 int i; 4155 4156 stats->chains = status->chains; 4157 for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) { 4158 int signal = status->chain_signal[i]; 4159 4160 if (!(status->chains & BIT(i))) 4161 continue; 4162 4163 stats->chain_signal_last[i] = signal; 4164 if (!fast_rx->uses_rss) 4165 ewma_signal_add(&sta->rx_stats_avg.chain_signal[i], 4166 -signal); 4167 } 4168 } 4169 /* end of statistics */ 4170 4171 if (rx->key && !ieee80211_has_protected(hdr->frame_control)) 4172 goto drop; 4173 4174 if (status->rx_flags & IEEE80211_RX_AMSDU) { 4175 if (__ieee80211_rx_h_amsdu(rx, snap_offs - hdrlen) != 4176 RX_QUEUED) 4177 goto drop; 4178 4179 return true; 4180 } 4181 4182 stats->last_rx = jiffies; 4183 stats->last_rate = sta_stats_encode_rate(status); 4184 4185 stats->fragments++; 4186 stats->packets++; 4187 4188 /* do the header conversion - first grab the addresses */ 4189 ether_addr_copy(addrs.da, skb->data + fast_rx->da_offs); 4190 ether_addr_copy(addrs.sa, skb->data + fast_rx->sa_offs); 4191 /* remove the SNAP but leave the ethertype */ 4192 skb_pull(skb, snap_offs + sizeof(rfc1042_header)); 4193 /* push the addresses in front */ 4194 memcpy(skb_push(skb, sizeof(addrs)), &addrs, sizeof(addrs)); 4195 4196 skb->dev = fast_rx->dev; 4197 4198 ieee80211_rx_stats(fast_rx->dev, skb->len); 4199 4200 /* The seqno index has the same property as needed 4201 * for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS 4202 * for non-QoS-data frames. Here we know it's a data 4203 * frame, so count MSDUs. 4204 */ 4205 u64_stats_update_begin(&stats->syncp); 4206 stats->msdu[rx->seqno_idx]++; 4207 stats->bytes += orig_len; 4208 u64_stats_update_end(&stats->syncp); 4209 4210 if (fast_rx->internal_forward) { 4211 struct sk_buff *xmit_skb = NULL; 4212 bool multicast = is_multicast_ether_addr(skb->data); 4213 4214 if (multicast) { 4215 xmit_skb = skb_copy(skb, GFP_ATOMIC); 4216 } else if (sta_info_get(rx->sdata, skb->data)) { 4217 xmit_skb = skb; 4218 skb = NULL; 4219 } 4220 4221 if (xmit_skb) { 4222 /* 4223 * Send to wireless media and increase priority by 256 4224 * to keep the received priority instead of 4225 * reclassifying the frame (see cfg80211_classify8021d). 4226 */ 4227 xmit_skb->priority += 256; 4228 xmit_skb->protocol = htons(ETH_P_802_3); 4229 skb_reset_network_header(xmit_skb); 4230 skb_reset_mac_header(xmit_skb); 4231 dev_queue_xmit(xmit_skb); 4232 } 4233 4234 if (!skb) 4235 return true; 4236 } 4237 4238 /* deliver to local stack */ 4239 skb->protocol = eth_type_trans(skb, fast_rx->dev); 4240 memset(skb->cb, 0, sizeof(skb->cb)); 4241 if (rx->napi) 4242 napi_gro_receive(rx->napi, skb); 4243 else 4244 netif_receive_skb(skb); 4245 4246 return true; 4247 drop: 4248 dev_kfree_skb(skb); 4249 stats->dropped++; 4250 return true; 4251 } 4252 4253 /* 4254 * This function returns whether or not the SKB 4255 * was destined for RX processing or not, which, 4256 * if consume is true, is equivalent to whether 4257 * or not the skb was consumed. 4258 */ 4259 static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx, 4260 struct sk_buff *skb, bool consume) 4261 { 4262 struct ieee80211_local *local = rx->local; 4263 struct ieee80211_sub_if_data *sdata = rx->sdata; 4264 4265 rx->skb = skb; 4266 4267 /* See if we can do fast-rx; if we have to copy we already lost, 4268 * so punt in that case. We should never have to deliver a data 4269 * frame to multiple interfaces anyway. 4270 * 4271 * We skip the ieee80211_accept_frame() call and do the necessary 4272 * checking inside ieee80211_invoke_fast_rx(). 4273 */ 4274 if (consume && rx->sta) { 4275 struct ieee80211_fast_rx *fast_rx; 4276 4277 fast_rx = rcu_dereference(rx->sta->fast_rx); 4278 if (fast_rx && ieee80211_invoke_fast_rx(rx, fast_rx)) 4279 return true; 4280 } 4281 4282 if (!ieee80211_accept_frame(rx)) 4283 return false; 4284 4285 if (!consume) { 4286 skb = skb_copy(skb, GFP_ATOMIC); 4287 if (!skb) { 4288 if (net_ratelimit()) 4289 wiphy_debug(local->hw.wiphy, 4290 "failed to copy skb for %s\n", 4291 sdata->name); 4292 return true; 4293 } 4294 4295 rx->skb = skb; 4296 } 4297 4298 ieee80211_invoke_rx_handlers(rx); 4299 return true; 4300 } 4301 4302 /* 4303 * This is the actual Rx frames handler. as it belongs to Rx path it must 4304 * be called with rcu_read_lock protection. 4305 */ 4306 static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, 4307 struct ieee80211_sta *pubsta, 4308 struct sk_buff *skb, 4309 struct napi_struct *napi) 4310 { 4311 struct ieee80211_local *local = hw_to_local(hw); 4312 struct ieee80211_sub_if_data *sdata; 4313 struct ieee80211_hdr *hdr; 4314 __le16 fc; 4315 struct ieee80211_rx_data rx; 4316 struct ieee80211_sub_if_data *prev; 4317 struct rhlist_head *tmp; 4318 int err = 0; 4319 4320 fc = ((struct ieee80211_hdr *)skb->data)->frame_control; 4321 memset(&rx, 0, sizeof(rx)); 4322 rx.skb = skb; 4323 rx.local = local; 4324 rx.napi = napi; 4325 4326 if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc)) 4327 I802_DEBUG_INC(local->dot11ReceivedFragmentCount); 4328 4329 if (ieee80211_is_mgmt(fc)) { 4330 /* drop frame if too short for header */ 4331 if (skb->len < ieee80211_hdrlen(fc)) 4332 err = -ENOBUFS; 4333 else 4334 err = skb_linearize(skb); 4335 } else { 4336 err = !pskb_may_pull(skb, ieee80211_hdrlen(fc)); 4337 } 4338 4339 if (err) { 4340 dev_kfree_skb(skb); 4341 return; 4342 } 4343 4344 hdr = (struct ieee80211_hdr *)skb->data; 4345 ieee80211_parse_qos(&rx); 4346 ieee80211_verify_alignment(&rx); 4347 4348 if (unlikely(ieee80211_is_probe_resp(hdr->frame_control) || 4349 ieee80211_is_beacon(hdr->frame_control))) 4350 ieee80211_scan_rx(local, skb); 4351 4352 if (ieee80211_is_data(fc)) { 4353 struct sta_info *sta, *prev_sta; 4354 4355 if (pubsta) { 4356 rx.sta = container_of(pubsta, struct sta_info, sta); 4357 rx.sdata = rx.sta->sdata; 4358 if (ieee80211_prepare_and_rx_handle(&rx, skb, true)) 4359 return; 4360 goto out; 4361 } 4362 4363 prev_sta = NULL; 4364 4365 for_each_sta_info(local, hdr->addr2, sta, tmp) { 4366 if (!prev_sta) { 4367 prev_sta = sta; 4368 continue; 4369 } 4370 4371 rx.sta = prev_sta; 4372 rx.sdata = prev_sta->sdata; 4373 ieee80211_prepare_and_rx_handle(&rx, skb, false); 4374 4375 prev_sta = sta; 4376 } 4377 4378 if (prev_sta) { 4379 rx.sta = prev_sta; 4380 rx.sdata = prev_sta->sdata; 4381 4382 if (ieee80211_prepare_and_rx_handle(&rx, skb, true)) 4383 return; 4384 goto out; 4385 } 4386 } 4387 4388 prev = NULL; 4389 4390 list_for_each_entry_rcu(sdata, &local->interfaces, list) { 4391 if (!ieee80211_sdata_running(sdata)) 4392 continue; 4393 4394 if (sdata->vif.type == NL80211_IFTYPE_MONITOR || 4395 sdata->vif.type == NL80211_IFTYPE_AP_VLAN) 4396 continue; 4397 4398 /* 4399 * frame is destined for this interface, but if it's 4400 * not also for the previous one we handle that after 4401 * the loop to avoid copying the SKB once too much 4402 */ 4403 4404 if (!prev) { 4405 prev = sdata; 4406 continue; 4407 } 4408 4409 rx.sta = sta_info_get_bss(prev, hdr->addr2); 4410 rx.sdata = prev; 4411 ieee80211_prepare_and_rx_handle(&rx, skb, false); 4412 4413 prev = sdata; 4414 } 4415 4416 if (prev) { 4417 rx.sta = sta_info_get_bss(prev, hdr->addr2); 4418 rx.sdata = prev; 4419 4420 if (ieee80211_prepare_and_rx_handle(&rx, skb, true)) 4421 return; 4422 } 4423 4424 out: 4425 dev_kfree_skb(skb); 4426 } 4427 4428 /* 4429 * This is the receive path handler. It is called by a low level driver when an 4430 * 802.11 MPDU is received from the hardware. 4431 */ 4432 void ieee80211_rx_napi(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta, 4433 struct sk_buff *skb, struct napi_struct *napi) 4434 { 4435 struct ieee80211_local *local = hw_to_local(hw); 4436 struct ieee80211_rate *rate = NULL; 4437 struct ieee80211_supported_band *sband; 4438 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 4439 4440 WARN_ON_ONCE(softirq_count() == 0); 4441 4442 if (WARN_ON(status->band >= NUM_NL80211_BANDS)) 4443 goto drop; 4444 4445 sband = local->hw.wiphy->bands[status->band]; 4446 if (WARN_ON(!sband)) 4447 goto drop; 4448 4449 /* 4450 * If we're suspending, it is possible although not too likely 4451 * that we'd be receiving frames after having already partially 4452 * quiesced the stack. We can't process such frames then since 4453 * that might, for example, cause stations to be added or other 4454 * driver callbacks be invoked. 4455 */ 4456 if (unlikely(local->quiescing || local->suspended)) 4457 goto drop; 4458 4459 /* We might be during a HW reconfig, prevent Rx for the same reason */ 4460 if (unlikely(local->in_reconfig)) 4461 goto drop; 4462 4463 /* 4464 * The same happens when we're not even started, 4465 * but that's worth a warning. 4466 */ 4467 if (WARN_ON(!local->started)) 4468 goto drop; 4469 4470 if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC))) { 4471 /* 4472 * Validate the rate, unless a PLCP error means that 4473 * we probably can't have a valid rate here anyway. 4474 */ 4475 4476 switch (status->encoding) { 4477 case RX_ENC_HT: 4478 /* 4479 * rate_idx is MCS index, which can be [0-76] 4480 * as documented on: 4481 * 4482 * http://wireless.kernel.org/en/developers/Documentation/ieee80211/802.11n 4483 * 4484 * Anything else would be some sort of driver or 4485 * hardware error. The driver should catch hardware 4486 * errors. 4487 */ 4488 if (WARN(status->rate_idx > 76, 4489 "Rate marked as an HT rate but passed " 4490 "status->rate_idx is not " 4491 "an MCS index [0-76]: %d (0x%02x)\n", 4492 status->rate_idx, 4493 status->rate_idx)) 4494 goto drop; 4495 break; 4496 case RX_ENC_VHT: 4497 if (WARN_ONCE(status->rate_idx > 9 || 4498 !status->nss || 4499 status->nss > 8, 4500 "Rate marked as a VHT rate but data is invalid: MCS: %d, NSS: %d\n", 4501 status->rate_idx, status->nss)) 4502 goto drop; 4503 break; 4504 case RX_ENC_HE: 4505 if (WARN_ONCE(status->rate_idx > 11 || 4506 !status->nss || 4507 status->nss > 8, 4508 "Rate marked as an HE rate but data is invalid: MCS: %d, NSS: %d\n", 4509 status->rate_idx, status->nss)) 4510 goto drop; 4511 break; 4512 default: 4513 WARN_ON_ONCE(1); 4514 /* fall through */ 4515 case RX_ENC_LEGACY: 4516 if (WARN_ON(status->rate_idx >= sband->n_bitrates)) 4517 goto drop; 4518 rate = &sband->bitrates[status->rate_idx]; 4519 } 4520 } 4521 4522 status->rx_flags = 0; 4523 4524 /* 4525 * key references and virtual interfaces are protected using RCU 4526 * and this requires that we are in a read-side RCU section during 4527 * receive processing 4528 */ 4529 rcu_read_lock(); 4530 4531 /* 4532 * Frames with failed FCS/PLCP checksum are not returned, 4533 * all other frames are returned without radiotap header 4534 * if it was previously present. 4535 * Also, frames with less than 16 bytes are dropped. 4536 */ 4537 skb = ieee80211_rx_monitor(local, skb, rate); 4538 if (!skb) { 4539 rcu_read_unlock(); 4540 return; 4541 } 4542 4543 ieee80211_tpt_led_trig_rx(local, 4544 ((struct ieee80211_hdr *)skb->data)->frame_control, 4545 skb->len); 4546 4547 __ieee80211_rx_handle_packet(hw, pubsta, skb, napi); 4548 4549 rcu_read_unlock(); 4550 4551 return; 4552 drop: 4553 kfree_skb(skb); 4554 } 4555 EXPORT_SYMBOL(ieee80211_rx_napi); 4556 4557 /* This is a version of the rx handler that can be called from hard irq 4558 * context. Post the skb on the queue and schedule the tasklet */ 4559 void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb) 4560 { 4561 struct ieee80211_local *local = hw_to_local(hw); 4562 4563 BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb)); 4564 4565 skb->pkt_type = IEEE80211_RX_MSG; 4566 skb_queue_tail(&local->skb_queue, skb); 4567 tasklet_schedule(&local->tasklet); 4568 } 4569 EXPORT_SYMBOL(ieee80211_rx_irqsafe); 4570