1 /* 2 * Copyright 2002-2005, Instant802 Networks, Inc. 3 * Copyright 2005-2006, Devicescape Software, Inc. 4 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz> 5 * Copyright 2007-2010 Johannes Berg <johannes@sipsolutions.net> 6 * 7 * This program is free software; you can redistribute it and/or modify 8 * it under the terms of the GNU General Public License version 2 as 9 * published by the Free Software Foundation. 10 */ 11 12 #include <linux/jiffies.h> 13 #include <linux/slab.h> 14 #include <linux/kernel.h> 15 #include <linux/skbuff.h> 16 #include <linux/netdevice.h> 17 #include <linux/etherdevice.h> 18 #include <linux/rcupdate.h> 19 #include <linux/export.h> 20 #include <net/mac80211.h> 21 #include <net/ieee80211_radiotap.h> 22 #include <asm/unaligned.h> 23 24 #include "ieee80211_i.h" 25 #include "driver-ops.h" 26 #include "led.h" 27 #include "mesh.h" 28 #include "wep.h" 29 #include "wpa.h" 30 #include "tkip.h" 31 #include "wme.h" 32 #include "rate.h" 33 34 /* 35 * monitor mode reception 36 * 37 * This function cleans up the SKB, i.e. it removes all the stuff 38 * only useful for monitoring. 39 */ 40 static struct sk_buff *remove_monitor_info(struct ieee80211_local *local, 41 struct sk_buff *skb) 42 { 43 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) { 44 if (likely(skb->len > FCS_LEN)) 45 __pskb_trim(skb, skb->len - FCS_LEN); 46 else { 47 /* driver bug */ 48 WARN_ON(1); 49 dev_kfree_skb(skb); 50 return NULL; 51 } 52 } 53 54 return skb; 55 } 56 57 static inline int should_drop_frame(struct sk_buff *skb, int present_fcs_len) 58 { 59 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 60 struct ieee80211_hdr *hdr; 61 62 hdr = (void *)(skb->data); 63 64 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | 65 RX_FLAG_FAILED_PLCP_CRC | 66 RX_FLAG_AMPDU_IS_ZEROLEN)) 67 return 1; 68 if (unlikely(skb->len < 16 + present_fcs_len)) 69 return 1; 70 if (ieee80211_is_ctl(hdr->frame_control) && 71 !ieee80211_is_pspoll(hdr->frame_control) && 72 !ieee80211_is_back_req(hdr->frame_control)) 73 return 1; 74 return 0; 75 } 76 77 static int 78 ieee80211_rx_radiotap_space(struct ieee80211_local *local, 79 struct ieee80211_rx_status *status) 80 { 81 int len; 82 83 /* always present fields */ 84 len = sizeof(struct ieee80211_radiotap_header) + 8; 85 86 /* allocate extra bitmaps */ 87 if (status->chains) 88 len += 4 * hweight8(status->chains); 89 90 if (ieee80211_have_rx_timestamp(status)) { 91 len = ALIGN(len, 8); 92 len += 8; 93 } 94 if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM) 95 len += 1; 96 97 /* antenna field, if we don't have per-chain info */ 98 if (!status->chains) 99 len += 1; 100 101 /* padding for RX_FLAGS if necessary */ 102 len = ALIGN(len, 2); 103 104 if (status->flag & RX_FLAG_HT) /* HT info */ 105 len += 3; 106 107 if (status->flag & RX_FLAG_AMPDU_DETAILS) { 108 len = ALIGN(len, 4); 109 len += 8; 110 } 111 112 if (status->flag & RX_FLAG_VHT) { 113 len = ALIGN(len, 2); 114 len += 12; 115 } 116 117 if (status->chains) { 118 /* antenna and antenna signal fields */ 119 len += 2 * hweight8(status->chains); 120 } 121 122 return len; 123 } 124 125 /* 126 * ieee80211_add_rx_radiotap_header - add radiotap header 127 * 128 * add a radiotap header containing all the fields which the hardware provided. 129 */ 130 static void 131 ieee80211_add_rx_radiotap_header(struct ieee80211_local *local, 132 struct sk_buff *skb, 133 struct ieee80211_rate *rate, 134 int rtap_len, bool has_fcs) 135 { 136 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 137 struct ieee80211_radiotap_header *rthdr; 138 unsigned char *pos; 139 __le32 *it_present; 140 u32 it_present_val; 141 u16 rx_flags = 0; 142 u16 channel_flags = 0; 143 int mpdulen, chain; 144 unsigned long chains = status->chains; 145 146 mpdulen = skb->len; 147 if (!(has_fcs && (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS))) 148 mpdulen += FCS_LEN; 149 150 rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len); 151 memset(rthdr, 0, rtap_len); 152 it_present = &rthdr->it_present; 153 154 /* radiotap header, set always present flags */ 155 rthdr->it_len = cpu_to_le16(rtap_len); 156 it_present_val = BIT(IEEE80211_RADIOTAP_FLAGS) | 157 BIT(IEEE80211_RADIOTAP_CHANNEL) | 158 BIT(IEEE80211_RADIOTAP_RX_FLAGS); 159 160 if (!status->chains) 161 it_present_val |= BIT(IEEE80211_RADIOTAP_ANTENNA); 162 163 for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) { 164 it_present_val |= 165 BIT(IEEE80211_RADIOTAP_EXT) | 166 BIT(IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE); 167 put_unaligned_le32(it_present_val, it_present); 168 it_present++; 169 it_present_val = BIT(IEEE80211_RADIOTAP_ANTENNA) | 170 BIT(IEEE80211_RADIOTAP_DBM_ANTSIGNAL); 171 } 172 173 put_unaligned_le32(it_present_val, it_present); 174 175 pos = (void *)(it_present + 1); 176 177 /* the order of the following fields is important */ 178 179 /* IEEE80211_RADIOTAP_TSFT */ 180 if (ieee80211_have_rx_timestamp(status)) { 181 /* padding */ 182 while ((pos - (u8 *)rthdr) & 7) 183 *pos++ = 0; 184 put_unaligned_le64( 185 ieee80211_calculate_rx_timestamp(local, status, 186 mpdulen, 0), 187 pos); 188 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT); 189 pos += 8; 190 } 191 192 /* IEEE80211_RADIOTAP_FLAGS */ 193 if (has_fcs && (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)) 194 *pos |= IEEE80211_RADIOTAP_F_FCS; 195 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC)) 196 *pos |= IEEE80211_RADIOTAP_F_BADFCS; 197 if (status->flag & RX_FLAG_SHORTPRE) 198 *pos |= IEEE80211_RADIOTAP_F_SHORTPRE; 199 pos++; 200 201 /* IEEE80211_RADIOTAP_RATE */ 202 if (!rate || status->flag & (RX_FLAG_HT | RX_FLAG_VHT)) { 203 /* 204 * Without rate information don't add it. If we have, 205 * MCS information is a separate field in radiotap, 206 * added below. The byte here is needed as padding 207 * for the channel though, so initialise it to 0. 208 */ 209 *pos = 0; 210 } else { 211 int shift = 0; 212 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE); 213 if (status->flag & RX_FLAG_10MHZ) 214 shift = 1; 215 else if (status->flag & RX_FLAG_5MHZ) 216 shift = 2; 217 *pos = DIV_ROUND_UP(rate->bitrate, 5 * (1 << shift)); 218 } 219 pos++; 220 221 /* IEEE80211_RADIOTAP_CHANNEL */ 222 put_unaligned_le16(status->freq, pos); 223 pos += 2; 224 if (status->flag & RX_FLAG_10MHZ) 225 channel_flags |= IEEE80211_CHAN_HALF; 226 else if (status->flag & RX_FLAG_5MHZ) 227 channel_flags |= IEEE80211_CHAN_QUARTER; 228 229 if (status->band == IEEE80211_BAND_5GHZ) 230 channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ; 231 else if (status->flag & (RX_FLAG_HT | RX_FLAG_VHT)) 232 channel_flags |= IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ; 233 else if (rate && rate->flags & IEEE80211_RATE_ERP_G) 234 channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ; 235 else if (rate) 236 channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ; 237 else 238 channel_flags |= IEEE80211_CHAN_2GHZ; 239 put_unaligned_le16(channel_flags, pos); 240 pos += 2; 241 242 /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */ 243 if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM && 244 !(status->flag & RX_FLAG_NO_SIGNAL_VAL)) { 245 *pos = status->signal; 246 rthdr->it_present |= 247 cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL); 248 pos++; 249 } 250 251 /* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */ 252 253 if (!status->chains) { 254 /* IEEE80211_RADIOTAP_ANTENNA */ 255 *pos = status->antenna; 256 pos++; 257 } 258 259 /* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */ 260 261 /* IEEE80211_RADIOTAP_RX_FLAGS */ 262 /* ensure 2 byte alignment for the 2 byte field as required */ 263 if ((pos - (u8 *)rthdr) & 1) 264 *pos++ = 0; 265 if (status->flag & RX_FLAG_FAILED_PLCP_CRC) 266 rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP; 267 put_unaligned_le16(rx_flags, pos); 268 pos += 2; 269 270 if (status->flag & RX_FLAG_HT) { 271 unsigned int stbc; 272 273 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_MCS); 274 *pos++ = local->hw.radiotap_mcs_details; 275 *pos = 0; 276 if (status->flag & RX_FLAG_SHORT_GI) 277 *pos |= IEEE80211_RADIOTAP_MCS_SGI; 278 if (status->flag & RX_FLAG_40MHZ) 279 *pos |= IEEE80211_RADIOTAP_MCS_BW_40; 280 if (status->flag & RX_FLAG_HT_GF) 281 *pos |= IEEE80211_RADIOTAP_MCS_FMT_GF; 282 if (status->flag & RX_FLAG_LDPC) 283 *pos |= IEEE80211_RADIOTAP_MCS_FEC_LDPC; 284 stbc = (status->flag & RX_FLAG_STBC_MASK) >> RX_FLAG_STBC_SHIFT; 285 *pos |= stbc << IEEE80211_RADIOTAP_MCS_STBC_SHIFT; 286 pos++; 287 *pos++ = status->rate_idx; 288 } 289 290 if (status->flag & RX_FLAG_AMPDU_DETAILS) { 291 u16 flags = 0; 292 293 /* ensure 4 byte alignment */ 294 while ((pos - (u8 *)rthdr) & 3) 295 pos++; 296 rthdr->it_present |= 297 cpu_to_le32(1 << IEEE80211_RADIOTAP_AMPDU_STATUS); 298 put_unaligned_le32(status->ampdu_reference, pos); 299 pos += 4; 300 if (status->flag & RX_FLAG_AMPDU_REPORT_ZEROLEN) 301 flags |= IEEE80211_RADIOTAP_AMPDU_REPORT_ZEROLEN; 302 if (status->flag & RX_FLAG_AMPDU_IS_ZEROLEN) 303 flags |= IEEE80211_RADIOTAP_AMPDU_IS_ZEROLEN; 304 if (status->flag & RX_FLAG_AMPDU_LAST_KNOWN) 305 flags |= IEEE80211_RADIOTAP_AMPDU_LAST_KNOWN; 306 if (status->flag & RX_FLAG_AMPDU_IS_LAST) 307 flags |= IEEE80211_RADIOTAP_AMPDU_IS_LAST; 308 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_ERROR) 309 flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_ERR; 310 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN) 311 flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_KNOWN; 312 put_unaligned_le16(flags, pos); 313 pos += 2; 314 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN) 315 *pos++ = status->ampdu_delimiter_crc; 316 else 317 *pos++ = 0; 318 *pos++ = 0; 319 } 320 321 if (status->flag & RX_FLAG_VHT) { 322 u16 known = local->hw.radiotap_vht_details; 323 324 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_VHT); 325 /* known field - how to handle 80+80? */ 326 if (status->vht_flag & RX_VHT_FLAG_80P80MHZ) 327 known &= ~IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH; 328 put_unaligned_le16(known, pos); 329 pos += 2; 330 /* flags */ 331 if (status->flag & RX_FLAG_SHORT_GI) 332 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_SGI; 333 /* in VHT, STBC is binary */ 334 if (status->flag & RX_FLAG_STBC_MASK) 335 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_STBC; 336 if (status->vht_flag & RX_VHT_FLAG_BF) 337 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_BEAMFORMED; 338 pos++; 339 /* bandwidth */ 340 if (status->vht_flag & RX_VHT_FLAG_80MHZ) 341 *pos++ = 4; 342 else if (status->vht_flag & RX_VHT_FLAG_80P80MHZ) 343 *pos++ = 0; /* marked not known above */ 344 else if (status->vht_flag & RX_VHT_FLAG_160MHZ) 345 *pos++ = 11; 346 else if (status->flag & RX_FLAG_40MHZ) 347 *pos++ = 1; 348 else /* 20 MHz */ 349 *pos++ = 0; 350 /* MCS/NSS */ 351 *pos = (status->rate_idx << 4) | status->vht_nss; 352 pos += 4; 353 /* coding field */ 354 if (status->flag & RX_FLAG_LDPC) 355 *pos |= IEEE80211_RADIOTAP_CODING_LDPC_USER0; 356 pos++; 357 /* group ID */ 358 pos++; 359 /* partial_aid */ 360 pos += 2; 361 } 362 363 for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) { 364 *pos++ = status->chain_signal[chain]; 365 *pos++ = chain; 366 } 367 } 368 369 /* 370 * This function copies a received frame to all monitor interfaces and 371 * returns a cleaned-up SKB that no longer includes the FCS nor the 372 * radiotap header the driver might have added. 373 */ 374 static struct sk_buff * 375 ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb, 376 struct ieee80211_rate *rate) 377 { 378 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb); 379 struct ieee80211_sub_if_data *sdata; 380 int needed_headroom; 381 struct sk_buff *skb, *skb2; 382 struct net_device *prev_dev = NULL; 383 int present_fcs_len = 0; 384 385 /* 386 * First, we may need to make a copy of the skb because 387 * (1) we need to modify it for radiotap (if not present), and 388 * (2) the other RX handlers will modify the skb we got. 389 * 390 * We don't need to, of course, if we aren't going to return 391 * the SKB because it has a bad FCS/PLCP checksum. 392 */ 393 394 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) 395 present_fcs_len = FCS_LEN; 396 397 /* ensure hdr->frame_control is in skb head */ 398 if (!pskb_may_pull(origskb, 2)) { 399 dev_kfree_skb(origskb); 400 return NULL; 401 } 402 403 if (!local->monitors) { 404 if (should_drop_frame(origskb, present_fcs_len)) { 405 dev_kfree_skb(origskb); 406 return NULL; 407 } 408 409 return remove_monitor_info(local, origskb); 410 } 411 412 /* room for the radiotap header based on driver features */ 413 needed_headroom = ieee80211_rx_radiotap_space(local, status); 414 415 if (should_drop_frame(origskb, present_fcs_len)) { 416 /* only need to expand headroom if necessary */ 417 skb = origskb; 418 origskb = NULL; 419 420 /* 421 * This shouldn't trigger often because most devices have an 422 * RX header they pull before we get here, and that should 423 * be big enough for our radiotap information. We should 424 * probably export the length to drivers so that we can have 425 * them allocate enough headroom to start with. 426 */ 427 if (skb_headroom(skb) < needed_headroom && 428 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) { 429 dev_kfree_skb(skb); 430 return NULL; 431 } 432 } else { 433 /* 434 * Need to make a copy and possibly remove radiotap header 435 * and FCS from the original. 436 */ 437 skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC); 438 439 origskb = remove_monitor_info(local, origskb); 440 441 if (!skb) 442 return origskb; 443 } 444 445 /* prepend radiotap information */ 446 ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom, 447 true); 448 449 skb_reset_mac_header(skb); 450 skb->ip_summed = CHECKSUM_UNNECESSARY; 451 skb->pkt_type = PACKET_OTHERHOST; 452 skb->protocol = htons(ETH_P_802_2); 453 454 list_for_each_entry_rcu(sdata, &local->interfaces, list) { 455 if (sdata->vif.type != NL80211_IFTYPE_MONITOR) 456 continue; 457 458 if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES) 459 continue; 460 461 if (!ieee80211_sdata_running(sdata)) 462 continue; 463 464 if (prev_dev) { 465 skb2 = skb_clone(skb, GFP_ATOMIC); 466 if (skb2) { 467 skb2->dev = prev_dev; 468 netif_receive_skb(skb2); 469 } 470 } 471 472 prev_dev = sdata->dev; 473 sdata->dev->stats.rx_packets++; 474 sdata->dev->stats.rx_bytes += skb->len; 475 } 476 477 if (prev_dev) { 478 skb->dev = prev_dev; 479 netif_receive_skb(skb); 480 } else 481 dev_kfree_skb(skb); 482 483 return origskb; 484 } 485 486 static void ieee80211_parse_qos(struct ieee80211_rx_data *rx) 487 { 488 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 489 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 490 int tid, seqno_idx, security_idx; 491 492 /* does the frame have a qos control field? */ 493 if (ieee80211_is_data_qos(hdr->frame_control)) { 494 u8 *qc = ieee80211_get_qos_ctl(hdr); 495 /* frame has qos control */ 496 tid = *qc & IEEE80211_QOS_CTL_TID_MASK; 497 if (*qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT) 498 status->rx_flags |= IEEE80211_RX_AMSDU; 499 500 seqno_idx = tid; 501 security_idx = tid; 502 } else { 503 /* 504 * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"): 505 * 506 * Sequence numbers for management frames, QoS data 507 * frames with a broadcast/multicast address in the 508 * Address 1 field, and all non-QoS data frames sent 509 * by QoS STAs are assigned using an additional single 510 * modulo-4096 counter, [...] 511 * 512 * We also use that counter for non-QoS STAs. 513 */ 514 seqno_idx = IEEE80211_NUM_TIDS; 515 security_idx = 0; 516 if (ieee80211_is_mgmt(hdr->frame_control)) 517 security_idx = IEEE80211_NUM_TIDS; 518 tid = 0; 519 } 520 521 rx->seqno_idx = seqno_idx; 522 rx->security_idx = security_idx; 523 /* Set skb->priority to 1d tag if highest order bit of TID is not set. 524 * For now, set skb->priority to 0 for other cases. */ 525 rx->skb->priority = (tid > 7) ? 0 : tid; 526 } 527 528 /** 529 * DOC: Packet alignment 530 * 531 * Drivers always need to pass packets that are aligned to two-byte boundaries 532 * to the stack. 533 * 534 * Additionally, should, if possible, align the payload data in a way that 535 * guarantees that the contained IP header is aligned to a four-byte 536 * boundary. In the case of regular frames, this simply means aligning the 537 * payload to a four-byte boundary (because either the IP header is directly 538 * contained, or IV/RFC1042 headers that have a length divisible by four are 539 * in front of it). If the payload data is not properly aligned and the 540 * architecture doesn't support efficient unaligned operations, mac80211 541 * will align the data. 542 * 543 * With A-MSDU frames, however, the payload data address must yield two modulo 544 * four because there are 14-byte 802.3 headers within the A-MSDU frames that 545 * push the IP header further back to a multiple of four again. Thankfully, the 546 * specs were sane enough this time around to require padding each A-MSDU 547 * subframe to a length that is a multiple of four. 548 * 549 * Padding like Atheros hardware adds which is between the 802.11 header and 550 * the payload is not supported, the driver is required to move the 802.11 551 * header to be directly in front of the payload in that case. 552 */ 553 static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx) 554 { 555 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG 556 WARN_ONCE((unsigned long)rx->skb->data & 1, 557 "unaligned packet at 0x%p\n", rx->skb->data); 558 #endif 559 } 560 561 562 /* rx handlers */ 563 564 static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb) 565 { 566 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 567 568 if (is_multicast_ether_addr(hdr->addr1)) 569 return 0; 570 571 return ieee80211_is_robust_mgmt_frame(skb); 572 } 573 574 575 static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb) 576 { 577 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 578 579 if (!is_multicast_ether_addr(hdr->addr1)) 580 return 0; 581 582 return ieee80211_is_robust_mgmt_frame(skb); 583 } 584 585 586 /* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */ 587 static int ieee80211_get_mmie_keyidx(struct sk_buff *skb) 588 { 589 struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data; 590 struct ieee80211_mmie *mmie; 591 592 if (skb->len < 24 + sizeof(*mmie) || !is_multicast_ether_addr(hdr->da)) 593 return -1; 594 595 if (!ieee80211_is_robust_mgmt_frame(skb)) 596 return -1; /* not a robust management frame */ 597 598 mmie = (struct ieee80211_mmie *) 599 (skb->data + skb->len - sizeof(*mmie)); 600 if (mmie->element_id != WLAN_EID_MMIE || 601 mmie->length != sizeof(*mmie) - 2) 602 return -1; 603 604 return le16_to_cpu(mmie->key_id); 605 } 606 607 static int iwl80211_get_cs_keyid(const struct ieee80211_cipher_scheme *cs, 608 struct sk_buff *skb) 609 { 610 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; 611 __le16 fc; 612 int hdrlen; 613 u8 keyid; 614 615 fc = hdr->frame_control; 616 hdrlen = ieee80211_hdrlen(fc); 617 618 if (skb->len < hdrlen + cs->hdr_len) 619 return -EINVAL; 620 621 skb_copy_bits(skb, hdrlen + cs->key_idx_off, &keyid, 1); 622 keyid &= cs->key_idx_mask; 623 keyid >>= cs->key_idx_shift; 624 625 return keyid; 626 } 627 628 static ieee80211_rx_result ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx) 629 { 630 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 631 char *dev_addr = rx->sdata->vif.addr; 632 633 if (ieee80211_is_data(hdr->frame_control)) { 634 if (is_multicast_ether_addr(hdr->addr1)) { 635 if (ieee80211_has_tods(hdr->frame_control) || 636 !ieee80211_has_fromds(hdr->frame_control)) 637 return RX_DROP_MONITOR; 638 if (ether_addr_equal(hdr->addr3, dev_addr)) 639 return RX_DROP_MONITOR; 640 } else { 641 if (!ieee80211_has_a4(hdr->frame_control)) 642 return RX_DROP_MONITOR; 643 if (ether_addr_equal(hdr->addr4, dev_addr)) 644 return RX_DROP_MONITOR; 645 } 646 } 647 648 /* If there is not an established peer link and this is not a peer link 649 * establisment frame, beacon or probe, drop the frame. 650 */ 651 652 if (!rx->sta || sta_plink_state(rx->sta) != NL80211_PLINK_ESTAB) { 653 struct ieee80211_mgmt *mgmt; 654 655 if (!ieee80211_is_mgmt(hdr->frame_control)) 656 return RX_DROP_MONITOR; 657 658 if (ieee80211_is_action(hdr->frame_control)) { 659 u8 category; 660 661 /* make sure category field is present */ 662 if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE) 663 return RX_DROP_MONITOR; 664 665 mgmt = (struct ieee80211_mgmt *)hdr; 666 category = mgmt->u.action.category; 667 if (category != WLAN_CATEGORY_MESH_ACTION && 668 category != WLAN_CATEGORY_SELF_PROTECTED) 669 return RX_DROP_MONITOR; 670 return RX_CONTINUE; 671 } 672 673 if (ieee80211_is_probe_req(hdr->frame_control) || 674 ieee80211_is_probe_resp(hdr->frame_control) || 675 ieee80211_is_beacon(hdr->frame_control) || 676 ieee80211_is_auth(hdr->frame_control)) 677 return RX_CONTINUE; 678 679 return RX_DROP_MONITOR; 680 } 681 682 return RX_CONTINUE; 683 } 684 685 static void ieee80211_release_reorder_frame(struct ieee80211_sub_if_data *sdata, 686 struct tid_ampdu_rx *tid_agg_rx, 687 int index, 688 struct sk_buff_head *frames) 689 { 690 struct sk_buff *skb = tid_agg_rx->reorder_buf[index]; 691 struct ieee80211_rx_status *status; 692 693 lockdep_assert_held(&tid_agg_rx->reorder_lock); 694 695 if (!skb) 696 goto no_frame; 697 698 /* release the frame from the reorder ring buffer */ 699 tid_agg_rx->stored_mpdu_num--; 700 tid_agg_rx->reorder_buf[index] = NULL; 701 status = IEEE80211_SKB_RXCB(skb); 702 status->rx_flags |= IEEE80211_RX_DEFERRED_RELEASE; 703 __skb_queue_tail(frames, skb); 704 705 no_frame: 706 tid_agg_rx->head_seq_num = ieee80211_sn_inc(tid_agg_rx->head_seq_num); 707 } 708 709 static void ieee80211_release_reorder_frames(struct ieee80211_sub_if_data *sdata, 710 struct tid_ampdu_rx *tid_agg_rx, 711 u16 head_seq_num, 712 struct sk_buff_head *frames) 713 { 714 int index; 715 716 lockdep_assert_held(&tid_agg_rx->reorder_lock); 717 718 while (ieee80211_sn_less(tid_agg_rx->head_seq_num, head_seq_num)) { 719 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size; 720 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index, 721 frames); 722 } 723 } 724 725 /* 726 * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If 727 * the skb was added to the buffer longer than this time ago, the earlier 728 * frames that have not yet been received are assumed to be lost and the skb 729 * can be released for processing. This may also release other skb's from the 730 * reorder buffer if there are no additional gaps between the frames. 731 * 732 * Callers must hold tid_agg_rx->reorder_lock. 733 */ 734 #define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10) 735 736 static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata, 737 struct tid_ampdu_rx *tid_agg_rx, 738 struct sk_buff_head *frames) 739 { 740 int index, j; 741 742 lockdep_assert_held(&tid_agg_rx->reorder_lock); 743 744 /* release the buffer until next missing frame */ 745 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size; 746 if (!tid_agg_rx->reorder_buf[index] && 747 tid_agg_rx->stored_mpdu_num) { 748 /* 749 * No buffers ready to be released, but check whether any 750 * frames in the reorder buffer have timed out. 751 */ 752 int skipped = 1; 753 for (j = (index + 1) % tid_agg_rx->buf_size; j != index; 754 j = (j + 1) % tid_agg_rx->buf_size) { 755 if (!tid_agg_rx->reorder_buf[j]) { 756 skipped++; 757 continue; 758 } 759 if (skipped && 760 !time_after(jiffies, tid_agg_rx->reorder_time[j] + 761 HT_RX_REORDER_BUF_TIMEOUT)) 762 goto set_release_timer; 763 764 ht_dbg_ratelimited(sdata, 765 "release an RX reorder frame due to timeout on earlier frames\n"); 766 ieee80211_release_reorder_frame(sdata, tid_agg_rx, j, 767 frames); 768 769 /* 770 * Increment the head seq# also for the skipped slots. 771 */ 772 tid_agg_rx->head_seq_num = 773 (tid_agg_rx->head_seq_num + 774 skipped) & IEEE80211_SN_MASK; 775 skipped = 0; 776 } 777 } else while (tid_agg_rx->reorder_buf[index]) { 778 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index, 779 frames); 780 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size; 781 } 782 783 if (tid_agg_rx->stored_mpdu_num) { 784 j = index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size; 785 786 for (; j != (index - 1) % tid_agg_rx->buf_size; 787 j = (j + 1) % tid_agg_rx->buf_size) { 788 if (tid_agg_rx->reorder_buf[j]) 789 break; 790 } 791 792 set_release_timer: 793 794 mod_timer(&tid_agg_rx->reorder_timer, 795 tid_agg_rx->reorder_time[j] + 1 + 796 HT_RX_REORDER_BUF_TIMEOUT); 797 } else { 798 del_timer(&tid_agg_rx->reorder_timer); 799 } 800 } 801 802 /* 803 * As this function belongs to the RX path it must be under 804 * rcu_read_lock protection. It returns false if the frame 805 * can be processed immediately, true if it was consumed. 806 */ 807 static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata, 808 struct tid_ampdu_rx *tid_agg_rx, 809 struct sk_buff *skb, 810 struct sk_buff_head *frames) 811 { 812 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 813 u16 sc = le16_to_cpu(hdr->seq_ctrl); 814 u16 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4; 815 u16 head_seq_num, buf_size; 816 int index; 817 bool ret = true; 818 819 spin_lock(&tid_agg_rx->reorder_lock); 820 821 buf_size = tid_agg_rx->buf_size; 822 head_seq_num = tid_agg_rx->head_seq_num; 823 824 /* frame with out of date sequence number */ 825 if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) { 826 dev_kfree_skb(skb); 827 goto out; 828 } 829 830 /* 831 * If frame the sequence number exceeds our buffering window 832 * size release some previous frames to make room for this one. 833 */ 834 if (!ieee80211_sn_less(mpdu_seq_num, head_seq_num + buf_size)) { 835 head_seq_num = ieee80211_sn_inc( 836 ieee80211_sn_sub(mpdu_seq_num, buf_size)); 837 /* release stored frames up to new head to stack */ 838 ieee80211_release_reorder_frames(sdata, tid_agg_rx, 839 head_seq_num, frames); 840 } 841 842 /* Now the new frame is always in the range of the reordering buffer */ 843 844 index = mpdu_seq_num % tid_agg_rx->buf_size; 845 846 /* check if we already stored this frame */ 847 if (tid_agg_rx->reorder_buf[index]) { 848 dev_kfree_skb(skb); 849 goto out; 850 } 851 852 /* 853 * If the current MPDU is in the right order and nothing else 854 * is stored we can process it directly, no need to buffer it. 855 * If it is first but there's something stored, we may be able 856 * to release frames after this one. 857 */ 858 if (mpdu_seq_num == tid_agg_rx->head_seq_num && 859 tid_agg_rx->stored_mpdu_num == 0) { 860 tid_agg_rx->head_seq_num = 861 ieee80211_sn_inc(tid_agg_rx->head_seq_num); 862 ret = false; 863 goto out; 864 } 865 866 /* put the frame in the reordering buffer */ 867 tid_agg_rx->reorder_buf[index] = skb; 868 tid_agg_rx->reorder_time[index] = jiffies; 869 tid_agg_rx->stored_mpdu_num++; 870 ieee80211_sta_reorder_release(sdata, tid_agg_rx, frames); 871 872 out: 873 spin_unlock(&tid_agg_rx->reorder_lock); 874 return ret; 875 } 876 877 /* 878 * Reorder MPDUs from A-MPDUs, keeping them on a buffer. Returns 879 * true if the MPDU was buffered, false if it should be processed. 880 */ 881 static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx, 882 struct sk_buff_head *frames) 883 { 884 struct sk_buff *skb = rx->skb; 885 struct ieee80211_local *local = rx->local; 886 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 887 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 888 struct sta_info *sta = rx->sta; 889 struct tid_ampdu_rx *tid_agg_rx; 890 u16 sc; 891 u8 tid, ack_policy; 892 893 if (!ieee80211_is_data_qos(hdr->frame_control) || 894 is_multicast_ether_addr(hdr->addr1)) 895 goto dont_reorder; 896 897 /* 898 * filter the QoS data rx stream according to 899 * STA/TID and check if this STA/TID is on aggregation 900 */ 901 902 if (!sta) 903 goto dont_reorder; 904 905 ack_policy = *ieee80211_get_qos_ctl(hdr) & 906 IEEE80211_QOS_CTL_ACK_POLICY_MASK; 907 tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK; 908 909 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]); 910 if (!tid_agg_rx) 911 goto dont_reorder; 912 913 /* qos null data frames are excluded */ 914 if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC))) 915 goto dont_reorder; 916 917 /* not part of a BA session */ 918 if (ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK && 919 ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_NORMAL) 920 goto dont_reorder; 921 922 /* not actually part of this BA session */ 923 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH)) 924 goto dont_reorder; 925 926 /* new, potentially un-ordered, ampdu frame - process it */ 927 928 /* reset session timer */ 929 if (tid_agg_rx->timeout) 930 tid_agg_rx->last_rx = jiffies; 931 932 /* if this mpdu is fragmented - terminate rx aggregation session */ 933 sc = le16_to_cpu(hdr->seq_ctrl); 934 if (sc & IEEE80211_SCTL_FRAG) { 935 skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME; 936 skb_queue_tail(&rx->sdata->skb_queue, skb); 937 ieee80211_queue_work(&local->hw, &rx->sdata->work); 938 return; 939 } 940 941 /* 942 * No locking needed -- we will only ever process one 943 * RX packet at a time, and thus own tid_agg_rx. All 944 * other code manipulating it needs to (and does) make 945 * sure that we cannot get to it any more before doing 946 * anything with it. 947 */ 948 if (ieee80211_sta_manage_reorder_buf(rx->sdata, tid_agg_rx, skb, 949 frames)) 950 return; 951 952 dont_reorder: 953 __skb_queue_tail(frames, skb); 954 } 955 956 static ieee80211_rx_result debug_noinline 957 ieee80211_rx_h_check(struct ieee80211_rx_data *rx) 958 { 959 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 960 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 961 962 /* 963 * Drop duplicate 802.11 retransmissions 964 * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery") 965 */ 966 if (rx->skb->len >= 24 && rx->sta && 967 !ieee80211_is_ctl(hdr->frame_control) && 968 !ieee80211_is_qos_nullfunc(hdr->frame_control) && 969 !is_multicast_ether_addr(hdr->addr1)) { 970 if (unlikely(ieee80211_has_retry(hdr->frame_control) && 971 rx->sta->last_seq_ctrl[rx->seqno_idx] == 972 hdr->seq_ctrl)) { 973 if (status->rx_flags & IEEE80211_RX_RA_MATCH) { 974 rx->local->dot11FrameDuplicateCount++; 975 rx->sta->num_duplicates++; 976 } 977 return RX_DROP_UNUSABLE; 978 } else if (!(status->flag & RX_FLAG_AMSDU_MORE)) { 979 rx->sta->last_seq_ctrl[rx->seqno_idx] = hdr->seq_ctrl; 980 } 981 } 982 983 if (unlikely(rx->skb->len < 16)) { 984 I802_DEBUG_INC(rx->local->rx_handlers_drop_short); 985 return RX_DROP_MONITOR; 986 } 987 988 /* Drop disallowed frame classes based on STA auth/assoc state; 989 * IEEE 802.11, Chap 5.5. 990 * 991 * mac80211 filters only based on association state, i.e. it drops 992 * Class 3 frames from not associated stations. hostapd sends 993 * deauth/disassoc frames when needed. In addition, hostapd is 994 * responsible for filtering on both auth and assoc states. 995 */ 996 997 if (ieee80211_vif_is_mesh(&rx->sdata->vif)) 998 return ieee80211_rx_mesh_check(rx); 999 1000 if (unlikely((ieee80211_is_data(hdr->frame_control) || 1001 ieee80211_is_pspoll(hdr->frame_control)) && 1002 rx->sdata->vif.type != NL80211_IFTYPE_ADHOC && 1003 rx->sdata->vif.type != NL80211_IFTYPE_WDS && 1004 (!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_ASSOC)))) { 1005 /* 1006 * accept port control frames from the AP even when it's not 1007 * yet marked ASSOC to prevent a race where we don't set the 1008 * assoc bit quickly enough before it sends the first frame 1009 */ 1010 if (rx->sta && rx->sdata->vif.type == NL80211_IFTYPE_STATION && 1011 ieee80211_is_data_present(hdr->frame_control)) { 1012 unsigned int hdrlen; 1013 __be16 ethertype; 1014 1015 hdrlen = ieee80211_hdrlen(hdr->frame_control); 1016 1017 if (rx->skb->len < hdrlen + 8) 1018 return RX_DROP_MONITOR; 1019 1020 skb_copy_bits(rx->skb, hdrlen + 6, ðertype, 2); 1021 if (ethertype == rx->sdata->control_port_protocol) 1022 return RX_CONTINUE; 1023 } 1024 1025 if (rx->sdata->vif.type == NL80211_IFTYPE_AP && 1026 cfg80211_rx_spurious_frame(rx->sdata->dev, 1027 hdr->addr2, 1028 GFP_ATOMIC)) 1029 return RX_DROP_UNUSABLE; 1030 1031 return RX_DROP_MONITOR; 1032 } 1033 1034 return RX_CONTINUE; 1035 } 1036 1037 1038 static ieee80211_rx_result debug_noinline 1039 ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx) 1040 { 1041 struct ieee80211_local *local; 1042 struct ieee80211_hdr *hdr; 1043 struct sk_buff *skb; 1044 1045 local = rx->local; 1046 skb = rx->skb; 1047 hdr = (struct ieee80211_hdr *) skb->data; 1048 1049 if (!local->pspolling) 1050 return RX_CONTINUE; 1051 1052 if (!ieee80211_has_fromds(hdr->frame_control)) 1053 /* this is not from AP */ 1054 return RX_CONTINUE; 1055 1056 if (!ieee80211_is_data(hdr->frame_control)) 1057 return RX_CONTINUE; 1058 1059 if (!ieee80211_has_moredata(hdr->frame_control)) { 1060 /* AP has no more frames buffered for us */ 1061 local->pspolling = false; 1062 return RX_CONTINUE; 1063 } 1064 1065 /* more data bit is set, let's request a new frame from the AP */ 1066 ieee80211_send_pspoll(local, rx->sdata); 1067 1068 return RX_CONTINUE; 1069 } 1070 1071 static void sta_ps_start(struct sta_info *sta) 1072 { 1073 struct ieee80211_sub_if_data *sdata = sta->sdata; 1074 struct ieee80211_local *local = sdata->local; 1075 struct ps_data *ps; 1076 1077 if (sta->sdata->vif.type == NL80211_IFTYPE_AP || 1078 sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) 1079 ps = &sdata->bss->ps; 1080 else 1081 return; 1082 1083 atomic_inc(&ps->num_sta_ps); 1084 set_sta_flag(sta, WLAN_STA_PS_STA); 1085 if (!(local->hw.flags & IEEE80211_HW_AP_LINK_PS)) 1086 drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta); 1087 ps_dbg(sdata, "STA %pM aid %d enters power save mode\n", 1088 sta->sta.addr, sta->sta.aid); 1089 } 1090 1091 static void sta_ps_end(struct sta_info *sta) 1092 { 1093 ps_dbg(sta->sdata, "STA %pM aid %d exits power save mode\n", 1094 sta->sta.addr, sta->sta.aid); 1095 1096 if (test_sta_flag(sta, WLAN_STA_PS_DRIVER)) { 1097 /* 1098 * Clear the flag only if the other one is still set 1099 * so that the TX path won't start TX'ing new frames 1100 * directly ... In the case that the driver flag isn't 1101 * set ieee80211_sta_ps_deliver_wakeup() will clear it. 1102 */ 1103 clear_sta_flag(sta, WLAN_STA_PS_STA); 1104 ps_dbg(sta->sdata, "STA %pM aid %d driver-ps-blocked\n", 1105 sta->sta.addr, sta->sta.aid); 1106 return; 1107 } 1108 1109 ieee80211_sta_ps_deliver_wakeup(sta); 1110 } 1111 1112 int ieee80211_sta_ps_transition(struct ieee80211_sta *sta, bool start) 1113 { 1114 struct sta_info *sta_inf = container_of(sta, struct sta_info, sta); 1115 bool in_ps; 1116 1117 WARN_ON(!(sta_inf->local->hw.flags & IEEE80211_HW_AP_LINK_PS)); 1118 1119 /* Don't let the same PS state be set twice */ 1120 in_ps = test_sta_flag(sta_inf, WLAN_STA_PS_STA); 1121 if ((start && in_ps) || (!start && !in_ps)) 1122 return -EINVAL; 1123 1124 if (start) 1125 sta_ps_start(sta_inf); 1126 else 1127 sta_ps_end(sta_inf); 1128 1129 return 0; 1130 } 1131 EXPORT_SYMBOL(ieee80211_sta_ps_transition); 1132 1133 static ieee80211_rx_result debug_noinline 1134 ieee80211_rx_h_uapsd_and_pspoll(struct ieee80211_rx_data *rx) 1135 { 1136 struct ieee80211_sub_if_data *sdata = rx->sdata; 1137 struct ieee80211_hdr *hdr = (void *)rx->skb->data; 1138 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 1139 int tid, ac; 1140 1141 if (!rx->sta || !(status->rx_flags & IEEE80211_RX_RA_MATCH)) 1142 return RX_CONTINUE; 1143 1144 if (sdata->vif.type != NL80211_IFTYPE_AP && 1145 sdata->vif.type != NL80211_IFTYPE_AP_VLAN) 1146 return RX_CONTINUE; 1147 1148 /* 1149 * The device handles station powersave, so don't do anything about 1150 * uAPSD and PS-Poll frames (the latter shouldn't even come up from 1151 * it to mac80211 since they're handled.) 1152 */ 1153 if (sdata->local->hw.flags & IEEE80211_HW_AP_LINK_PS) 1154 return RX_CONTINUE; 1155 1156 /* 1157 * Don't do anything if the station isn't already asleep. In 1158 * the uAPSD case, the station will probably be marked asleep, 1159 * in the PS-Poll case the station must be confused ... 1160 */ 1161 if (!test_sta_flag(rx->sta, WLAN_STA_PS_STA)) 1162 return RX_CONTINUE; 1163 1164 if (unlikely(ieee80211_is_pspoll(hdr->frame_control))) { 1165 if (!test_sta_flag(rx->sta, WLAN_STA_SP)) { 1166 if (!test_sta_flag(rx->sta, WLAN_STA_PS_DRIVER)) 1167 ieee80211_sta_ps_deliver_poll_response(rx->sta); 1168 else 1169 set_sta_flag(rx->sta, WLAN_STA_PSPOLL); 1170 } 1171 1172 /* Free PS Poll skb here instead of returning RX_DROP that would 1173 * count as an dropped frame. */ 1174 dev_kfree_skb(rx->skb); 1175 1176 return RX_QUEUED; 1177 } else if (!ieee80211_has_morefrags(hdr->frame_control) && 1178 !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) && 1179 ieee80211_has_pm(hdr->frame_control) && 1180 (ieee80211_is_data_qos(hdr->frame_control) || 1181 ieee80211_is_qos_nullfunc(hdr->frame_control))) { 1182 tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK; 1183 ac = ieee802_1d_to_ac[tid & 7]; 1184 1185 /* 1186 * If this AC is not trigger-enabled do nothing. 1187 * 1188 * NB: This could/should check a separate bitmap of trigger- 1189 * enabled queues, but for now we only implement uAPSD w/o 1190 * TSPEC changes to the ACs, so they're always the same. 1191 */ 1192 if (!(rx->sta->sta.uapsd_queues & BIT(ac))) 1193 return RX_CONTINUE; 1194 1195 /* if we are in a service period, do nothing */ 1196 if (test_sta_flag(rx->sta, WLAN_STA_SP)) 1197 return RX_CONTINUE; 1198 1199 if (!test_sta_flag(rx->sta, WLAN_STA_PS_DRIVER)) 1200 ieee80211_sta_ps_deliver_uapsd(rx->sta); 1201 else 1202 set_sta_flag(rx->sta, WLAN_STA_UAPSD); 1203 } 1204 1205 return RX_CONTINUE; 1206 } 1207 1208 static ieee80211_rx_result debug_noinline 1209 ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx) 1210 { 1211 struct sta_info *sta = rx->sta; 1212 struct sk_buff *skb = rx->skb; 1213 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 1214 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; 1215 int i; 1216 1217 if (!sta) 1218 return RX_CONTINUE; 1219 1220 /* 1221 * Update last_rx only for IBSS packets which are for the current 1222 * BSSID and for station already AUTHORIZED to avoid keeping the 1223 * current IBSS network alive in cases where other STAs start 1224 * using different BSSID. This will also give the station another 1225 * chance to restart the authentication/authorization in case 1226 * something went wrong the first time. 1227 */ 1228 if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) { 1229 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len, 1230 NL80211_IFTYPE_ADHOC); 1231 if (ether_addr_equal(bssid, rx->sdata->u.ibss.bssid) && 1232 test_sta_flag(sta, WLAN_STA_AUTHORIZED)) { 1233 sta->last_rx = jiffies; 1234 if (ieee80211_is_data(hdr->frame_control)) { 1235 sta->last_rx_rate_idx = status->rate_idx; 1236 sta->last_rx_rate_flag = status->flag; 1237 sta->last_rx_rate_vht_flag = status->vht_flag; 1238 sta->last_rx_rate_vht_nss = status->vht_nss; 1239 } 1240 } 1241 } else if (!is_multicast_ether_addr(hdr->addr1)) { 1242 /* 1243 * Mesh beacons will update last_rx when if they are found to 1244 * match the current local configuration when processed. 1245 */ 1246 sta->last_rx = jiffies; 1247 if (ieee80211_is_data(hdr->frame_control)) { 1248 sta->last_rx_rate_idx = status->rate_idx; 1249 sta->last_rx_rate_flag = status->flag; 1250 sta->last_rx_rate_vht_flag = status->vht_flag; 1251 sta->last_rx_rate_vht_nss = status->vht_nss; 1252 } 1253 } 1254 1255 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH)) 1256 return RX_CONTINUE; 1257 1258 if (rx->sdata->vif.type == NL80211_IFTYPE_STATION) 1259 ieee80211_sta_rx_notify(rx->sdata, hdr); 1260 1261 sta->rx_fragments++; 1262 sta->rx_bytes += rx->skb->len; 1263 if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) { 1264 sta->last_signal = status->signal; 1265 ewma_add(&sta->avg_signal, -status->signal); 1266 } 1267 1268 if (status->chains) { 1269 sta->chains = status->chains; 1270 for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) { 1271 int signal = status->chain_signal[i]; 1272 1273 if (!(status->chains & BIT(i))) 1274 continue; 1275 1276 sta->chain_signal_last[i] = signal; 1277 ewma_add(&sta->chain_signal_avg[i], -signal); 1278 } 1279 } 1280 1281 /* 1282 * Change STA power saving mode only at the end of a frame 1283 * exchange sequence. 1284 */ 1285 if (!(sta->local->hw.flags & IEEE80211_HW_AP_LINK_PS) && 1286 !ieee80211_has_morefrags(hdr->frame_control) && 1287 !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) && 1288 (rx->sdata->vif.type == NL80211_IFTYPE_AP || 1289 rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) && 1290 /* PM bit is only checked in frames where it isn't reserved, 1291 * in AP mode it's reserved in non-bufferable management frames 1292 * (cf. IEEE 802.11-2012 8.2.4.1.7 Power Management field) 1293 */ 1294 (!ieee80211_is_mgmt(hdr->frame_control) || 1295 ieee80211_is_bufferable_mmpdu(hdr->frame_control))) { 1296 if (test_sta_flag(sta, WLAN_STA_PS_STA)) { 1297 if (!ieee80211_has_pm(hdr->frame_control)) 1298 sta_ps_end(sta); 1299 } else { 1300 if (ieee80211_has_pm(hdr->frame_control)) 1301 sta_ps_start(sta); 1302 } 1303 } 1304 1305 /* mesh power save support */ 1306 if (ieee80211_vif_is_mesh(&rx->sdata->vif)) 1307 ieee80211_mps_rx_h_sta_process(sta, hdr); 1308 1309 /* 1310 * Drop (qos-)data::nullfunc frames silently, since they 1311 * are used only to control station power saving mode. 1312 */ 1313 if (ieee80211_is_nullfunc(hdr->frame_control) || 1314 ieee80211_is_qos_nullfunc(hdr->frame_control)) { 1315 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc); 1316 1317 /* 1318 * If we receive a 4-addr nullfunc frame from a STA 1319 * that was not moved to a 4-addr STA vlan yet send 1320 * the event to userspace and for older hostapd drop 1321 * the frame to the monitor interface. 1322 */ 1323 if (ieee80211_has_a4(hdr->frame_control) && 1324 (rx->sdata->vif.type == NL80211_IFTYPE_AP || 1325 (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN && 1326 !rx->sdata->u.vlan.sta))) { 1327 if (!test_and_set_sta_flag(sta, WLAN_STA_4ADDR_EVENT)) 1328 cfg80211_rx_unexpected_4addr_frame( 1329 rx->sdata->dev, sta->sta.addr, 1330 GFP_ATOMIC); 1331 return RX_DROP_MONITOR; 1332 } 1333 /* 1334 * Update counter and free packet here to avoid 1335 * counting this as a dropped packed. 1336 */ 1337 sta->rx_packets++; 1338 dev_kfree_skb(rx->skb); 1339 return RX_QUEUED; 1340 } 1341 1342 return RX_CONTINUE; 1343 } /* ieee80211_rx_h_sta_process */ 1344 1345 static ieee80211_rx_result debug_noinline 1346 ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx) 1347 { 1348 struct sk_buff *skb = rx->skb; 1349 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 1350 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; 1351 int keyidx; 1352 int hdrlen; 1353 ieee80211_rx_result result = RX_DROP_UNUSABLE; 1354 struct ieee80211_key *sta_ptk = NULL; 1355 int mmie_keyidx = -1; 1356 __le16 fc; 1357 const struct ieee80211_cipher_scheme *cs = NULL; 1358 1359 /* 1360 * Key selection 101 1361 * 1362 * There are four types of keys: 1363 * - GTK (group keys) 1364 * - IGTK (group keys for management frames) 1365 * - PTK (pairwise keys) 1366 * - STK (station-to-station pairwise keys) 1367 * 1368 * When selecting a key, we have to distinguish between multicast 1369 * (including broadcast) and unicast frames, the latter can only 1370 * use PTKs and STKs while the former always use GTKs and IGTKs. 1371 * Unless, of course, actual WEP keys ("pre-RSNA") are used, then 1372 * unicast frames can also use key indices like GTKs. Hence, if we 1373 * don't have a PTK/STK we check the key index for a WEP key. 1374 * 1375 * Note that in a regular BSS, multicast frames are sent by the 1376 * AP only, associated stations unicast the frame to the AP first 1377 * which then multicasts it on their behalf. 1378 * 1379 * There is also a slight problem in IBSS mode: GTKs are negotiated 1380 * with each station, that is something we don't currently handle. 1381 * The spec seems to expect that one negotiates the same key with 1382 * every station but there's no such requirement; VLANs could be 1383 * possible. 1384 */ 1385 1386 /* 1387 * No point in finding a key and decrypting if the frame is neither 1388 * addressed to us nor a multicast frame. 1389 */ 1390 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH)) 1391 return RX_CONTINUE; 1392 1393 /* start without a key */ 1394 rx->key = NULL; 1395 fc = hdr->frame_control; 1396 1397 if (rx->sta) { 1398 int keyid = rx->sta->ptk_idx; 1399 1400 if (ieee80211_has_protected(fc) && rx->sta->cipher_scheme) { 1401 cs = rx->sta->cipher_scheme; 1402 keyid = iwl80211_get_cs_keyid(cs, rx->skb); 1403 if (unlikely(keyid < 0)) 1404 return RX_DROP_UNUSABLE; 1405 } 1406 sta_ptk = rcu_dereference(rx->sta->ptk[keyid]); 1407 } 1408 1409 if (!ieee80211_has_protected(fc)) 1410 mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb); 1411 1412 if (!is_multicast_ether_addr(hdr->addr1) && sta_ptk) { 1413 rx->key = sta_ptk; 1414 if ((status->flag & RX_FLAG_DECRYPTED) && 1415 (status->flag & RX_FLAG_IV_STRIPPED)) 1416 return RX_CONTINUE; 1417 /* Skip decryption if the frame is not protected. */ 1418 if (!ieee80211_has_protected(fc)) 1419 return RX_CONTINUE; 1420 } else if (mmie_keyidx >= 0) { 1421 /* Broadcast/multicast robust management frame / BIP */ 1422 if ((status->flag & RX_FLAG_DECRYPTED) && 1423 (status->flag & RX_FLAG_IV_STRIPPED)) 1424 return RX_CONTINUE; 1425 1426 if (mmie_keyidx < NUM_DEFAULT_KEYS || 1427 mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS) 1428 return RX_DROP_MONITOR; /* unexpected BIP keyidx */ 1429 if (rx->sta) 1430 rx->key = rcu_dereference(rx->sta->gtk[mmie_keyidx]); 1431 if (!rx->key) 1432 rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]); 1433 } else if (!ieee80211_has_protected(fc)) { 1434 /* 1435 * The frame was not protected, so skip decryption. However, we 1436 * need to set rx->key if there is a key that could have been 1437 * used so that the frame may be dropped if encryption would 1438 * have been expected. 1439 */ 1440 struct ieee80211_key *key = NULL; 1441 struct ieee80211_sub_if_data *sdata = rx->sdata; 1442 int i; 1443 1444 if (ieee80211_is_mgmt(fc) && 1445 is_multicast_ether_addr(hdr->addr1) && 1446 (key = rcu_dereference(rx->sdata->default_mgmt_key))) 1447 rx->key = key; 1448 else { 1449 if (rx->sta) { 1450 for (i = 0; i < NUM_DEFAULT_KEYS; i++) { 1451 key = rcu_dereference(rx->sta->gtk[i]); 1452 if (key) 1453 break; 1454 } 1455 } 1456 if (!key) { 1457 for (i = 0; i < NUM_DEFAULT_KEYS; i++) { 1458 key = rcu_dereference(sdata->keys[i]); 1459 if (key) 1460 break; 1461 } 1462 } 1463 if (key) 1464 rx->key = key; 1465 } 1466 return RX_CONTINUE; 1467 } else { 1468 u8 keyid; 1469 1470 /* 1471 * The device doesn't give us the IV so we won't be 1472 * able to look up the key. That's ok though, we 1473 * don't need to decrypt the frame, we just won't 1474 * be able to keep statistics accurate. 1475 * Except for key threshold notifications, should 1476 * we somehow allow the driver to tell us which key 1477 * the hardware used if this flag is set? 1478 */ 1479 if ((status->flag & RX_FLAG_DECRYPTED) && 1480 (status->flag & RX_FLAG_IV_STRIPPED)) 1481 return RX_CONTINUE; 1482 1483 hdrlen = ieee80211_hdrlen(fc); 1484 1485 if (cs) { 1486 keyidx = iwl80211_get_cs_keyid(cs, rx->skb); 1487 1488 if (unlikely(keyidx < 0)) 1489 return RX_DROP_UNUSABLE; 1490 } else { 1491 if (rx->skb->len < 8 + hdrlen) 1492 return RX_DROP_UNUSABLE; /* TODO: count this? */ 1493 /* 1494 * no need to call ieee80211_wep_get_keyidx, 1495 * it verifies a bunch of things we've done already 1496 */ 1497 skb_copy_bits(rx->skb, hdrlen + 3, &keyid, 1); 1498 keyidx = keyid >> 6; 1499 } 1500 1501 /* check per-station GTK first, if multicast packet */ 1502 if (is_multicast_ether_addr(hdr->addr1) && rx->sta) 1503 rx->key = rcu_dereference(rx->sta->gtk[keyidx]); 1504 1505 /* if not found, try default key */ 1506 if (!rx->key) { 1507 rx->key = rcu_dereference(rx->sdata->keys[keyidx]); 1508 1509 /* 1510 * RSNA-protected unicast frames should always be 1511 * sent with pairwise or station-to-station keys, 1512 * but for WEP we allow using a key index as well. 1513 */ 1514 if (rx->key && 1515 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 && 1516 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 && 1517 !is_multicast_ether_addr(hdr->addr1)) 1518 rx->key = NULL; 1519 } 1520 } 1521 1522 if (rx->key) { 1523 if (unlikely(rx->key->flags & KEY_FLAG_TAINTED)) 1524 return RX_DROP_MONITOR; 1525 1526 rx->key->tx_rx_count++; 1527 /* TODO: add threshold stuff again */ 1528 } else { 1529 return RX_DROP_MONITOR; 1530 } 1531 1532 switch (rx->key->conf.cipher) { 1533 case WLAN_CIPHER_SUITE_WEP40: 1534 case WLAN_CIPHER_SUITE_WEP104: 1535 result = ieee80211_crypto_wep_decrypt(rx); 1536 break; 1537 case WLAN_CIPHER_SUITE_TKIP: 1538 result = ieee80211_crypto_tkip_decrypt(rx); 1539 break; 1540 case WLAN_CIPHER_SUITE_CCMP: 1541 result = ieee80211_crypto_ccmp_decrypt(rx); 1542 break; 1543 case WLAN_CIPHER_SUITE_AES_CMAC: 1544 result = ieee80211_crypto_aes_cmac_decrypt(rx); 1545 break; 1546 default: 1547 result = ieee80211_crypto_hw_decrypt(rx); 1548 } 1549 1550 /* the hdr variable is invalid after the decrypt handlers */ 1551 1552 /* either the frame has been decrypted or will be dropped */ 1553 status->flag |= RX_FLAG_DECRYPTED; 1554 1555 return result; 1556 } 1557 1558 static inline struct ieee80211_fragment_entry * 1559 ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata, 1560 unsigned int frag, unsigned int seq, int rx_queue, 1561 struct sk_buff **skb) 1562 { 1563 struct ieee80211_fragment_entry *entry; 1564 1565 entry = &sdata->fragments[sdata->fragment_next++]; 1566 if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX) 1567 sdata->fragment_next = 0; 1568 1569 if (!skb_queue_empty(&entry->skb_list)) 1570 __skb_queue_purge(&entry->skb_list); 1571 1572 __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */ 1573 *skb = NULL; 1574 entry->first_frag_time = jiffies; 1575 entry->seq = seq; 1576 entry->rx_queue = rx_queue; 1577 entry->last_frag = frag; 1578 entry->ccmp = 0; 1579 entry->extra_len = 0; 1580 1581 return entry; 1582 } 1583 1584 static inline struct ieee80211_fragment_entry * 1585 ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata, 1586 unsigned int frag, unsigned int seq, 1587 int rx_queue, struct ieee80211_hdr *hdr) 1588 { 1589 struct ieee80211_fragment_entry *entry; 1590 int i, idx; 1591 1592 idx = sdata->fragment_next; 1593 for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) { 1594 struct ieee80211_hdr *f_hdr; 1595 1596 idx--; 1597 if (idx < 0) 1598 idx = IEEE80211_FRAGMENT_MAX - 1; 1599 1600 entry = &sdata->fragments[idx]; 1601 if (skb_queue_empty(&entry->skb_list) || entry->seq != seq || 1602 entry->rx_queue != rx_queue || 1603 entry->last_frag + 1 != frag) 1604 continue; 1605 1606 f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data; 1607 1608 /* 1609 * Check ftype and addresses are equal, else check next fragment 1610 */ 1611 if (((hdr->frame_control ^ f_hdr->frame_control) & 1612 cpu_to_le16(IEEE80211_FCTL_FTYPE)) || 1613 !ether_addr_equal(hdr->addr1, f_hdr->addr1) || 1614 !ether_addr_equal(hdr->addr2, f_hdr->addr2)) 1615 continue; 1616 1617 if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) { 1618 __skb_queue_purge(&entry->skb_list); 1619 continue; 1620 } 1621 return entry; 1622 } 1623 1624 return NULL; 1625 } 1626 1627 static ieee80211_rx_result debug_noinline 1628 ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx) 1629 { 1630 struct ieee80211_hdr *hdr; 1631 u16 sc; 1632 __le16 fc; 1633 unsigned int frag, seq; 1634 struct ieee80211_fragment_entry *entry; 1635 struct sk_buff *skb; 1636 struct ieee80211_rx_status *status; 1637 1638 hdr = (struct ieee80211_hdr *)rx->skb->data; 1639 fc = hdr->frame_control; 1640 1641 if (ieee80211_is_ctl(fc)) 1642 return RX_CONTINUE; 1643 1644 sc = le16_to_cpu(hdr->seq_ctrl); 1645 frag = sc & IEEE80211_SCTL_FRAG; 1646 1647 if (likely((!ieee80211_has_morefrags(fc) && frag == 0) || 1648 is_multicast_ether_addr(hdr->addr1))) { 1649 /* not fragmented */ 1650 goto out; 1651 } 1652 I802_DEBUG_INC(rx->local->rx_handlers_fragments); 1653 1654 if (skb_linearize(rx->skb)) 1655 return RX_DROP_UNUSABLE; 1656 1657 /* 1658 * skb_linearize() might change the skb->data and 1659 * previously cached variables (in this case, hdr) need to 1660 * be refreshed with the new data. 1661 */ 1662 hdr = (struct ieee80211_hdr *)rx->skb->data; 1663 seq = (sc & IEEE80211_SCTL_SEQ) >> 4; 1664 1665 if (frag == 0) { 1666 /* This is the first fragment of a new frame. */ 1667 entry = ieee80211_reassemble_add(rx->sdata, frag, seq, 1668 rx->seqno_idx, &(rx->skb)); 1669 if (rx->key && rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP && 1670 ieee80211_has_protected(fc)) { 1671 int queue = rx->security_idx; 1672 /* Store CCMP PN so that we can verify that the next 1673 * fragment has a sequential PN value. */ 1674 entry->ccmp = 1; 1675 memcpy(entry->last_pn, 1676 rx->key->u.ccmp.rx_pn[queue], 1677 IEEE80211_CCMP_PN_LEN); 1678 } 1679 return RX_QUEUED; 1680 } 1681 1682 /* This is a fragment for a frame that should already be pending in 1683 * fragment cache. Add this fragment to the end of the pending entry. 1684 */ 1685 entry = ieee80211_reassemble_find(rx->sdata, frag, seq, 1686 rx->seqno_idx, hdr); 1687 if (!entry) { 1688 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag); 1689 return RX_DROP_MONITOR; 1690 } 1691 1692 /* Verify that MPDUs within one MSDU have sequential PN values. 1693 * (IEEE 802.11i, 8.3.3.4.5) */ 1694 if (entry->ccmp) { 1695 int i; 1696 u8 pn[IEEE80211_CCMP_PN_LEN], *rpn; 1697 int queue; 1698 if (!rx->key || rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP) 1699 return RX_DROP_UNUSABLE; 1700 memcpy(pn, entry->last_pn, IEEE80211_CCMP_PN_LEN); 1701 for (i = IEEE80211_CCMP_PN_LEN - 1; i >= 0; i--) { 1702 pn[i]++; 1703 if (pn[i]) 1704 break; 1705 } 1706 queue = rx->security_idx; 1707 rpn = rx->key->u.ccmp.rx_pn[queue]; 1708 if (memcmp(pn, rpn, IEEE80211_CCMP_PN_LEN)) 1709 return RX_DROP_UNUSABLE; 1710 memcpy(entry->last_pn, pn, IEEE80211_CCMP_PN_LEN); 1711 } 1712 1713 skb_pull(rx->skb, ieee80211_hdrlen(fc)); 1714 __skb_queue_tail(&entry->skb_list, rx->skb); 1715 entry->last_frag = frag; 1716 entry->extra_len += rx->skb->len; 1717 if (ieee80211_has_morefrags(fc)) { 1718 rx->skb = NULL; 1719 return RX_QUEUED; 1720 } 1721 1722 rx->skb = __skb_dequeue(&entry->skb_list); 1723 if (skb_tailroom(rx->skb) < entry->extra_len) { 1724 I802_DEBUG_INC(rx->local->rx_expand_skb_head2); 1725 if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len, 1726 GFP_ATOMIC))) { 1727 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag); 1728 __skb_queue_purge(&entry->skb_list); 1729 return RX_DROP_UNUSABLE; 1730 } 1731 } 1732 while ((skb = __skb_dequeue(&entry->skb_list))) { 1733 memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len); 1734 dev_kfree_skb(skb); 1735 } 1736 1737 /* Complete frame has been reassembled - process it now */ 1738 status = IEEE80211_SKB_RXCB(rx->skb); 1739 status->rx_flags |= IEEE80211_RX_FRAGMENTED; 1740 1741 out: 1742 if (rx->sta) 1743 rx->sta->rx_packets++; 1744 if (is_multicast_ether_addr(hdr->addr1)) 1745 rx->local->dot11MulticastReceivedFrameCount++; 1746 else 1747 ieee80211_led_rx(rx->local); 1748 return RX_CONTINUE; 1749 } 1750 1751 static int ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx) 1752 { 1753 if (unlikely(!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_AUTHORIZED))) 1754 return -EACCES; 1755 1756 return 0; 1757 } 1758 1759 static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc) 1760 { 1761 struct sk_buff *skb = rx->skb; 1762 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 1763 1764 /* 1765 * Pass through unencrypted frames if the hardware has 1766 * decrypted them already. 1767 */ 1768 if (status->flag & RX_FLAG_DECRYPTED) 1769 return 0; 1770 1771 /* Drop unencrypted frames if key is set. */ 1772 if (unlikely(!ieee80211_has_protected(fc) && 1773 !ieee80211_is_nullfunc(fc) && 1774 ieee80211_is_data(fc) && 1775 (rx->key || rx->sdata->drop_unencrypted))) 1776 return -EACCES; 1777 1778 return 0; 1779 } 1780 1781 static int ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx) 1782 { 1783 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 1784 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 1785 __le16 fc = hdr->frame_control; 1786 1787 /* 1788 * Pass through unencrypted frames if the hardware has 1789 * decrypted them already. 1790 */ 1791 if (status->flag & RX_FLAG_DECRYPTED) 1792 return 0; 1793 1794 if (rx->sta && test_sta_flag(rx->sta, WLAN_STA_MFP)) { 1795 if (unlikely(!ieee80211_has_protected(fc) && 1796 ieee80211_is_unicast_robust_mgmt_frame(rx->skb) && 1797 rx->key)) { 1798 if (ieee80211_is_deauth(fc) || 1799 ieee80211_is_disassoc(fc)) 1800 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev, 1801 rx->skb->data, 1802 rx->skb->len); 1803 return -EACCES; 1804 } 1805 /* BIP does not use Protected field, so need to check MMIE */ 1806 if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) && 1807 ieee80211_get_mmie_keyidx(rx->skb) < 0)) { 1808 if (ieee80211_is_deauth(fc) || 1809 ieee80211_is_disassoc(fc)) 1810 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev, 1811 rx->skb->data, 1812 rx->skb->len); 1813 return -EACCES; 1814 } 1815 /* 1816 * When using MFP, Action frames are not allowed prior to 1817 * having configured keys. 1818 */ 1819 if (unlikely(ieee80211_is_action(fc) && !rx->key && 1820 ieee80211_is_robust_mgmt_frame(rx->skb))) 1821 return -EACCES; 1822 } 1823 1824 return 0; 1825 } 1826 1827 static int 1828 __ieee80211_data_to_8023(struct ieee80211_rx_data *rx, bool *port_control) 1829 { 1830 struct ieee80211_sub_if_data *sdata = rx->sdata; 1831 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 1832 bool check_port_control = false; 1833 struct ethhdr *ehdr; 1834 int ret; 1835 1836 *port_control = false; 1837 if (ieee80211_has_a4(hdr->frame_control) && 1838 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta) 1839 return -1; 1840 1841 if (sdata->vif.type == NL80211_IFTYPE_STATION && 1842 !!sdata->u.mgd.use_4addr != !!ieee80211_has_a4(hdr->frame_control)) { 1843 1844 if (!sdata->u.mgd.use_4addr) 1845 return -1; 1846 else 1847 check_port_control = true; 1848 } 1849 1850 if (is_multicast_ether_addr(hdr->addr1) && 1851 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta) 1852 return -1; 1853 1854 ret = ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type); 1855 if (ret < 0) 1856 return ret; 1857 1858 ehdr = (struct ethhdr *) rx->skb->data; 1859 if (ehdr->h_proto == rx->sdata->control_port_protocol) 1860 *port_control = true; 1861 else if (check_port_control) 1862 return -1; 1863 1864 return 0; 1865 } 1866 1867 /* 1868 * requires that rx->skb is a frame with ethernet header 1869 */ 1870 static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc) 1871 { 1872 static const u8 pae_group_addr[ETH_ALEN] __aligned(2) 1873 = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 }; 1874 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data; 1875 1876 /* 1877 * Allow EAPOL frames to us/the PAE group address regardless 1878 * of whether the frame was encrypted or not. 1879 */ 1880 if (ehdr->h_proto == rx->sdata->control_port_protocol && 1881 (ether_addr_equal(ehdr->h_dest, rx->sdata->vif.addr) || 1882 ether_addr_equal(ehdr->h_dest, pae_group_addr))) 1883 return true; 1884 1885 if (ieee80211_802_1x_port_control(rx) || 1886 ieee80211_drop_unencrypted(rx, fc)) 1887 return false; 1888 1889 return true; 1890 } 1891 1892 /* 1893 * requires that rx->skb is a frame with ethernet header 1894 */ 1895 static void 1896 ieee80211_deliver_skb(struct ieee80211_rx_data *rx) 1897 { 1898 struct ieee80211_sub_if_data *sdata = rx->sdata; 1899 struct net_device *dev = sdata->dev; 1900 struct sk_buff *skb, *xmit_skb; 1901 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data; 1902 struct sta_info *dsta; 1903 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 1904 1905 skb = rx->skb; 1906 xmit_skb = NULL; 1907 1908 if ((sdata->vif.type == NL80211_IFTYPE_AP || 1909 sdata->vif.type == NL80211_IFTYPE_AP_VLAN) && 1910 !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) && 1911 (status->rx_flags & IEEE80211_RX_RA_MATCH) && 1912 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) { 1913 if (is_multicast_ether_addr(ehdr->h_dest)) { 1914 /* 1915 * send multicast frames both to higher layers in 1916 * local net stack and back to the wireless medium 1917 */ 1918 xmit_skb = skb_copy(skb, GFP_ATOMIC); 1919 if (!xmit_skb) 1920 net_info_ratelimited("%s: failed to clone multicast frame\n", 1921 dev->name); 1922 } else { 1923 dsta = sta_info_get(sdata, skb->data); 1924 if (dsta) { 1925 /* 1926 * The destination station is associated to 1927 * this AP (in this VLAN), so send the frame 1928 * directly to it and do not pass it to local 1929 * net stack. 1930 */ 1931 xmit_skb = skb; 1932 skb = NULL; 1933 } 1934 } 1935 } 1936 1937 #ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS 1938 if (skb) { 1939 /* 'align' will only take the values 0 or 2 here since all 1940 * frames are required to be aligned to 2-byte boundaries 1941 * when being passed to mac80211; the code here works just 1942 * as well if that isn't true, but mac80211 assumes it can 1943 * access fields as 2-byte aligned (e.g. for ether_addr_equal) 1944 */ 1945 int align; 1946 1947 align = (unsigned long)(skb->data + sizeof(struct ethhdr)) & 3; 1948 if (align) { 1949 if (WARN_ON(skb_headroom(skb) < 3)) { 1950 dev_kfree_skb(skb); 1951 skb = NULL; 1952 } else { 1953 u8 *data = skb->data; 1954 size_t len = skb_headlen(skb); 1955 skb->data -= align; 1956 memmove(skb->data, data, len); 1957 skb_set_tail_pointer(skb, len); 1958 } 1959 } 1960 } 1961 #endif 1962 1963 if (skb) { 1964 /* deliver to local stack */ 1965 skb->protocol = eth_type_trans(skb, dev); 1966 memset(skb->cb, 0, sizeof(skb->cb)); 1967 if (rx->local->napi) 1968 napi_gro_receive(rx->local->napi, skb); 1969 else 1970 netif_receive_skb(skb); 1971 } 1972 1973 if (xmit_skb) { 1974 /* 1975 * Send to wireless media and increase priority by 256 to 1976 * keep the received priority instead of reclassifying 1977 * the frame (see cfg80211_classify8021d). 1978 */ 1979 xmit_skb->priority += 256; 1980 xmit_skb->protocol = htons(ETH_P_802_3); 1981 skb_reset_network_header(xmit_skb); 1982 skb_reset_mac_header(xmit_skb); 1983 dev_queue_xmit(xmit_skb); 1984 } 1985 } 1986 1987 static ieee80211_rx_result debug_noinline 1988 ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx) 1989 { 1990 struct net_device *dev = rx->sdata->dev; 1991 struct sk_buff *skb = rx->skb; 1992 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; 1993 __le16 fc = hdr->frame_control; 1994 struct sk_buff_head frame_list; 1995 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 1996 1997 if (unlikely(!ieee80211_is_data(fc))) 1998 return RX_CONTINUE; 1999 2000 if (unlikely(!ieee80211_is_data_present(fc))) 2001 return RX_DROP_MONITOR; 2002 2003 if (!(status->rx_flags & IEEE80211_RX_AMSDU)) 2004 return RX_CONTINUE; 2005 2006 if (ieee80211_has_a4(hdr->frame_control) && 2007 rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN && 2008 !rx->sdata->u.vlan.sta) 2009 return RX_DROP_UNUSABLE; 2010 2011 if (is_multicast_ether_addr(hdr->addr1) && 2012 ((rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN && 2013 rx->sdata->u.vlan.sta) || 2014 (rx->sdata->vif.type == NL80211_IFTYPE_STATION && 2015 rx->sdata->u.mgd.use_4addr))) 2016 return RX_DROP_UNUSABLE; 2017 2018 skb->dev = dev; 2019 __skb_queue_head_init(&frame_list); 2020 2021 if (skb_linearize(skb)) 2022 return RX_DROP_UNUSABLE; 2023 2024 ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr, 2025 rx->sdata->vif.type, 2026 rx->local->hw.extra_tx_headroom, true); 2027 2028 while (!skb_queue_empty(&frame_list)) { 2029 rx->skb = __skb_dequeue(&frame_list); 2030 2031 if (!ieee80211_frame_allowed(rx, fc)) { 2032 dev_kfree_skb(rx->skb); 2033 continue; 2034 } 2035 dev->stats.rx_packets++; 2036 dev->stats.rx_bytes += rx->skb->len; 2037 2038 ieee80211_deliver_skb(rx); 2039 } 2040 2041 return RX_QUEUED; 2042 } 2043 2044 #ifdef CONFIG_MAC80211_MESH 2045 static ieee80211_rx_result 2046 ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx) 2047 { 2048 struct ieee80211_hdr *fwd_hdr, *hdr; 2049 struct ieee80211_tx_info *info; 2050 struct ieee80211s_hdr *mesh_hdr; 2051 struct sk_buff *skb = rx->skb, *fwd_skb; 2052 struct ieee80211_local *local = rx->local; 2053 struct ieee80211_sub_if_data *sdata = rx->sdata; 2054 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 2055 struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh; 2056 u16 q, hdrlen; 2057 2058 hdr = (struct ieee80211_hdr *) skb->data; 2059 hdrlen = ieee80211_hdrlen(hdr->frame_control); 2060 2061 /* make sure fixed part of mesh header is there, also checks skb len */ 2062 if (!pskb_may_pull(rx->skb, hdrlen + 6)) 2063 return RX_DROP_MONITOR; 2064 2065 mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen); 2066 2067 /* make sure full mesh header is there, also checks skb len */ 2068 if (!pskb_may_pull(rx->skb, 2069 hdrlen + ieee80211_get_mesh_hdrlen(mesh_hdr))) 2070 return RX_DROP_MONITOR; 2071 2072 /* reload pointers */ 2073 hdr = (struct ieee80211_hdr *) skb->data; 2074 mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen); 2075 2076 /* frame is in RMC, don't forward */ 2077 if (ieee80211_is_data(hdr->frame_control) && 2078 is_multicast_ether_addr(hdr->addr1) && 2079 mesh_rmc_check(rx->sdata, hdr->addr3, mesh_hdr)) 2080 return RX_DROP_MONITOR; 2081 2082 if (!ieee80211_is_data(hdr->frame_control) || 2083 !(status->rx_flags & IEEE80211_RX_RA_MATCH)) 2084 return RX_CONTINUE; 2085 2086 if (!mesh_hdr->ttl) 2087 return RX_DROP_MONITOR; 2088 2089 if (mesh_hdr->flags & MESH_FLAGS_AE) { 2090 struct mesh_path *mppath; 2091 char *proxied_addr; 2092 char *mpp_addr; 2093 2094 if (is_multicast_ether_addr(hdr->addr1)) { 2095 mpp_addr = hdr->addr3; 2096 proxied_addr = mesh_hdr->eaddr1; 2097 } else if (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6) { 2098 /* has_a4 already checked in ieee80211_rx_mesh_check */ 2099 mpp_addr = hdr->addr4; 2100 proxied_addr = mesh_hdr->eaddr2; 2101 } else { 2102 return RX_DROP_MONITOR; 2103 } 2104 2105 rcu_read_lock(); 2106 mppath = mpp_path_lookup(sdata, proxied_addr); 2107 if (!mppath) { 2108 mpp_path_add(sdata, proxied_addr, mpp_addr); 2109 } else { 2110 spin_lock_bh(&mppath->state_lock); 2111 if (!ether_addr_equal(mppath->mpp, mpp_addr)) 2112 memcpy(mppath->mpp, mpp_addr, ETH_ALEN); 2113 spin_unlock_bh(&mppath->state_lock); 2114 } 2115 rcu_read_unlock(); 2116 } 2117 2118 /* Frame has reached destination. Don't forward */ 2119 if (!is_multicast_ether_addr(hdr->addr1) && 2120 ether_addr_equal(sdata->vif.addr, hdr->addr3)) 2121 return RX_CONTINUE; 2122 2123 q = ieee80211_select_queue_80211(sdata, skb, hdr); 2124 if (ieee80211_queue_stopped(&local->hw, q)) { 2125 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion); 2126 return RX_DROP_MONITOR; 2127 } 2128 skb_set_queue_mapping(skb, q); 2129 2130 if (!--mesh_hdr->ttl) { 2131 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl); 2132 goto out; 2133 } 2134 2135 if (!ifmsh->mshcfg.dot11MeshForwarding) 2136 goto out; 2137 2138 fwd_skb = skb_copy(skb, GFP_ATOMIC); 2139 if (!fwd_skb) { 2140 net_info_ratelimited("%s: failed to clone mesh frame\n", 2141 sdata->name); 2142 goto out; 2143 } 2144 2145 fwd_hdr = (struct ieee80211_hdr *) fwd_skb->data; 2146 fwd_hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_RETRY); 2147 info = IEEE80211_SKB_CB(fwd_skb); 2148 memset(info, 0, sizeof(*info)); 2149 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING; 2150 info->control.vif = &rx->sdata->vif; 2151 info->control.jiffies = jiffies; 2152 if (is_multicast_ether_addr(fwd_hdr->addr1)) { 2153 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_mcast); 2154 memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN); 2155 /* update power mode indication when forwarding */ 2156 ieee80211_mps_set_frame_flags(sdata, NULL, fwd_hdr); 2157 } else if (!mesh_nexthop_lookup(sdata, fwd_skb)) { 2158 /* mesh power mode flags updated in mesh_nexthop_lookup */ 2159 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast); 2160 } else { 2161 /* unable to resolve next hop */ 2162 mesh_path_error_tx(sdata, ifmsh->mshcfg.element_ttl, 2163 fwd_hdr->addr3, 0, 2164 WLAN_REASON_MESH_PATH_NOFORWARD, 2165 fwd_hdr->addr2); 2166 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_no_route); 2167 kfree_skb(fwd_skb); 2168 return RX_DROP_MONITOR; 2169 } 2170 2171 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames); 2172 ieee80211_add_pending_skb(local, fwd_skb); 2173 out: 2174 if (is_multicast_ether_addr(hdr->addr1) || 2175 sdata->dev->flags & IFF_PROMISC) 2176 return RX_CONTINUE; 2177 else 2178 return RX_DROP_MONITOR; 2179 } 2180 #endif 2181 2182 static ieee80211_rx_result debug_noinline 2183 ieee80211_rx_h_data(struct ieee80211_rx_data *rx) 2184 { 2185 struct ieee80211_sub_if_data *sdata = rx->sdata; 2186 struct ieee80211_local *local = rx->local; 2187 struct net_device *dev = sdata->dev; 2188 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 2189 __le16 fc = hdr->frame_control; 2190 bool port_control; 2191 int err; 2192 2193 if (unlikely(!ieee80211_is_data(hdr->frame_control))) 2194 return RX_CONTINUE; 2195 2196 if (unlikely(!ieee80211_is_data_present(hdr->frame_control))) 2197 return RX_DROP_MONITOR; 2198 2199 /* 2200 * Send unexpected-4addr-frame event to hostapd. For older versions, 2201 * also drop the frame to cooked monitor interfaces. 2202 */ 2203 if (ieee80211_has_a4(hdr->frame_control) && 2204 sdata->vif.type == NL80211_IFTYPE_AP) { 2205 if (rx->sta && 2206 !test_and_set_sta_flag(rx->sta, WLAN_STA_4ADDR_EVENT)) 2207 cfg80211_rx_unexpected_4addr_frame( 2208 rx->sdata->dev, rx->sta->sta.addr, GFP_ATOMIC); 2209 return RX_DROP_MONITOR; 2210 } 2211 2212 err = __ieee80211_data_to_8023(rx, &port_control); 2213 if (unlikely(err)) 2214 return RX_DROP_UNUSABLE; 2215 2216 if (!ieee80211_frame_allowed(rx, fc)) 2217 return RX_DROP_MONITOR; 2218 2219 if (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN && 2220 unlikely(port_control) && sdata->bss) { 2221 sdata = container_of(sdata->bss, struct ieee80211_sub_if_data, 2222 u.ap); 2223 dev = sdata->dev; 2224 rx->sdata = sdata; 2225 } 2226 2227 rx->skb->dev = dev; 2228 2229 dev->stats.rx_packets++; 2230 dev->stats.rx_bytes += rx->skb->len; 2231 2232 if (local->ps_sdata && local->hw.conf.dynamic_ps_timeout > 0 && 2233 !is_multicast_ether_addr( 2234 ((struct ethhdr *)rx->skb->data)->h_dest) && 2235 (!local->scanning && 2236 !test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))) { 2237 mod_timer(&local->dynamic_ps_timer, jiffies + 2238 msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout)); 2239 } 2240 2241 ieee80211_deliver_skb(rx); 2242 2243 return RX_QUEUED; 2244 } 2245 2246 static ieee80211_rx_result debug_noinline 2247 ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames) 2248 { 2249 struct sk_buff *skb = rx->skb; 2250 struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data; 2251 struct tid_ampdu_rx *tid_agg_rx; 2252 u16 start_seq_num; 2253 u16 tid; 2254 2255 if (likely(!ieee80211_is_ctl(bar->frame_control))) 2256 return RX_CONTINUE; 2257 2258 if (ieee80211_is_back_req(bar->frame_control)) { 2259 struct { 2260 __le16 control, start_seq_num; 2261 } __packed bar_data; 2262 2263 if (!rx->sta) 2264 return RX_DROP_MONITOR; 2265 2266 if (skb_copy_bits(skb, offsetof(struct ieee80211_bar, control), 2267 &bar_data, sizeof(bar_data))) 2268 return RX_DROP_MONITOR; 2269 2270 tid = le16_to_cpu(bar_data.control) >> 12; 2271 2272 tid_agg_rx = rcu_dereference(rx->sta->ampdu_mlme.tid_rx[tid]); 2273 if (!tid_agg_rx) 2274 return RX_DROP_MONITOR; 2275 2276 start_seq_num = le16_to_cpu(bar_data.start_seq_num) >> 4; 2277 2278 /* reset session timer */ 2279 if (tid_agg_rx->timeout) 2280 mod_timer(&tid_agg_rx->session_timer, 2281 TU_TO_EXP_TIME(tid_agg_rx->timeout)); 2282 2283 spin_lock(&tid_agg_rx->reorder_lock); 2284 /* release stored frames up to start of BAR */ 2285 ieee80211_release_reorder_frames(rx->sdata, tid_agg_rx, 2286 start_seq_num, frames); 2287 spin_unlock(&tid_agg_rx->reorder_lock); 2288 2289 kfree_skb(skb); 2290 return RX_QUEUED; 2291 } 2292 2293 /* 2294 * After this point, we only want management frames, 2295 * so we can drop all remaining control frames to 2296 * cooked monitor interfaces. 2297 */ 2298 return RX_DROP_MONITOR; 2299 } 2300 2301 static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata, 2302 struct ieee80211_mgmt *mgmt, 2303 size_t len) 2304 { 2305 struct ieee80211_local *local = sdata->local; 2306 struct sk_buff *skb; 2307 struct ieee80211_mgmt *resp; 2308 2309 if (!ether_addr_equal(mgmt->da, sdata->vif.addr)) { 2310 /* Not to own unicast address */ 2311 return; 2312 } 2313 2314 if (!ether_addr_equal(mgmt->sa, sdata->u.mgd.bssid) || 2315 !ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid)) { 2316 /* Not from the current AP or not associated yet. */ 2317 return; 2318 } 2319 2320 if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) { 2321 /* Too short SA Query request frame */ 2322 return; 2323 } 2324 2325 skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom); 2326 if (skb == NULL) 2327 return; 2328 2329 skb_reserve(skb, local->hw.extra_tx_headroom); 2330 resp = (struct ieee80211_mgmt *) skb_put(skb, 24); 2331 memset(resp, 0, 24); 2332 memcpy(resp->da, mgmt->sa, ETH_ALEN); 2333 memcpy(resp->sa, sdata->vif.addr, ETH_ALEN); 2334 memcpy(resp->bssid, sdata->u.mgd.bssid, ETH_ALEN); 2335 resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | 2336 IEEE80211_STYPE_ACTION); 2337 skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query)); 2338 resp->u.action.category = WLAN_CATEGORY_SA_QUERY; 2339 resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE; 2340 memcpy(resp->u.action.u.sa_query.trans_id, 2341 mgmt->u.action.u.sa_query.trans_id, 2342 WLAN_SA_QUERY_TR_ID_LEN); 2343 2344 ieee80211_tx_skb(sdata, skb); 2345 } 2346 2347 static ieee80211_rx_result debug_noinline 2348 ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx) 2349 { 2350 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data; 2351 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 2352 2353 /* 2354 * From here on, look only at management frames. 2355 * Data and control frames are already handled, 2356 * and unknown (reserved) frames are useless. 2357 */ 2358 if (rx->skb->len < 24) 2359 return RX_DROP_MONITOR; 2360 2361 if (!ieee80211_is_mgmt(mgmt->frame_control)) 2362 return RX_DROP_MONITOR; 2363 2364 if (rx->sdata->vif.type == NL80211_IFTYPE_AP && 2365 ieee80211_is_beacon(mgmt->frame_control) && 2366 !(rx->flags & IEEE80211_RX_BEACON_REPORTED)) { 2367 int sig = 0; 2368 2369 if (rx->local->hw.flags & IEEE80211_HW_SIGNAL_DBM) 2370 sig = status->signal; 2371 2372 cfg80211_report_obss_beacon(rx->local->hw.wiphy, 2373 rx->skb->data, rx->skb->len, 2374 status->freq, sig); 2375 rx->flags |= IEEE80211_RX_BEACON_REPORTED; 2376 } 2377 2378 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH)) 2379 return RX_DROP_MONITOR; 2380 2381 if (ieee80211_drop_unencrypted_mgmt(rx)) 2382 return RX_DROP_UNUSABLE; 2383 2384 return RX_CONTINUE; 2385 } 2386 2387 static ieee80211_rx_result debug_noinline 2388 ieee80211_rx_h_action(struct ieee80211_rx_data *rx) 2389 { 2390 struct ieee80211_local *local = rx->local; 2391 struct ieee80211_sub_if_data *sdata = rx->sdata; 2392 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data; 2393 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 2394 int len = rx->skb->len; 2395 2396 if (!ieee80211_is_action(mgmt->frame_control)) 2397 return RX_CONTINUE; 2398 2399 /* drop too small frames */ 2400 if (len < IEEE80211_MIN_ACTION_SIZE) 2401 return RX_DROP_UNUSABLE; 2402 2403 if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC && 2404 mgmt->u.action.category != WLAN_CATEGORY_SELF_PROTECTED && 2405 mgmt->u.action.category != WLAN_CATEGORY_SPECTRUM_MGMT) 2406 return RX_DROP_UNUSABLE; 2407 2408 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH)) 2409 return RX_DROP_UNUSABLE; 2410 2411 switch (mgmt->u.action.category) { 2412 case WLAN_CATEGORY_HT: 2413 /* reject HT action frames from stations not supporting HT */ 2414 if (!rx->sta->sta.ht_cap.ht_supported) 2415 goto invalid; 2416 2417 if (sdata->vif.type != NL80211_IFTYPE_STATION && 2418 sdata->vif.type != NL80211_IFTYPE_MESH_POINT && 2419 sdata->vif.type != NL80211_IFTYPE_AP_VLAN && 2420 sdata->vif.type != NL80211_IFTYPE_AP && 2421 sdata->vif.type != NL80211_IFTYPE_ADHOC) 2422 break; 2423 2424 /* verify action & smps_control/chanwidth are present */ 2425 if (len < IEEE80211_MIN_ACTION_SIZE + 2) 2426 goto invalid; 2427 2428 switch (mgmt->u.action.u.ht_smps.action) { 2429 case WLAN_HT_ACTION_SMPS: { 2430 struct ieee80211_supported_band *sband; 2431 enum ieee80211_smps_mode smps_mode; 2432 2433 /* convert to HT capability */ 2434 switch (mgmt->u.action.u.ht_smps.smps_control) { 2435 case WLAN_HT_SMPS_CONTROL_DISABLED: 2436 smps_mode = IEEE80211_SMPS_OFF; 2437 break; 2438 case WLAN_HT_SMPS_CONTROL_STATIC: 2439 smps_mode = IEEE80211_SMPS_STATIC; 2440 break; 2441 case WLAN_HT_SMPS_CONTROL_DYNAMIC: 2442 smps_mode = IEEE80211_SMPS_DYNAMIC; 2443 break; 2444 default: 2445 goto invalid; 2446 } 2447 2448 /* if no change do nothing */ 2449 if (rx->sta->sta.smps_mode == smps_mode) 2450 goto handled; 2451 rx->sta->sta.smps_mode = smps_mode; 2452 2453 sband = rx->local->hw.wiphy->bands[status->band]; 2454 2455 rate_control_rate_update(local, sband, rx->sta, 2456 IEEE80211_RC_SMPS_CHANGED); 2457 goto handled; 2458 } 2459 case WLAN_HT_ACTION_NOTIFY_CHANWIDTH: { 2460 struct ieee80211_supported_band *sband; 2461 u8 chanwidth = mgmt->u.action.u.ht_notify_cw.chanwidth; 2462 enum ieee80211_sta_rx_bandwidth new_bw; 2463 2464 /* If it doesn't support 40 MHz it can't change ... */ 2465 if (!(rx->sta->sta.ht_cap.cap & 2466 IEEE80211_HT_CAP_SUP_WIDTH_20_40)) 2467 goto handled; 2468 2469 if (chanwidth == IEEE80211_HT_CHANWIDTH_20MHZ) 2470 new_bw = IEEE80211_STA_RX_BW_20; 2471 else 2472 new_bw = ieee80211_sta_cur_vht_bw(rx->sta); 2473 2474 if (rx->sta->sta.bandwidth == new_bw) 2475 goto handled; 2476 2477 sband = rx->local->hw.wiphy->bands[status->band]; 2478 2479 rate_control_rate_update(local, sband, rx->sta, 2480 IEEE80211_RC_BW_CHANGED); 2481 goto handled; 2482 } 2483 default: 2484 goto invalid; 2485 } 2486 2487 break; 2488 case WLAN_CATEGORY_PUBLIC: 2489 if (len < IEEE80211_MIN_ACTION_SIZE + 1) 2490 goto invalid; 2491 if (sdata->vif.type != NL80211_IFTYPE_STATION) 2492 break; 2493 if (!rx->sta) 2494 break; 2495 if (!ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid)) 2496 break; 2497 if (mgmt->u.action.u.ext_chan_switch.action_code != 2498 WLAN_PUB_ACTION_EXT_CHANSW_ANN) 2499 break; 2500 if (len < offsetof(struct ieee80211_mgmt, 2501 u.action.u.ext_chan_switch.variable)) 2502 goto invalid; 2503 goto queue; 2504 case WLAN_CATEGORY_VHT: 2505 if (sdata->vif.type != NL80211_IFTYPE_STATION && 2506 sdata->vif.type != NL80211_IFTYPE_MESH_POINT && 2507 sdata->vif.type != NL80211_IFTYPE_AP_VLAN && 2508 sdata->vif.type != NL80211_IFTYPE_AP && 2509 sdata->vif.type != NL80211_IFTYPE_ADHOC) 2510 break; 2511 2512 /* verify action code is present */ 2513 if (len < IEEE80211_MIN_ACTION_SIZE + 1) 2514 goto invalid; 2515 2516 switch (mgmt->u.action.u.vht_opmode_notif.action_code) { 2517 case WLAN_VHT_ACTION_OPMODE_NOTIF: { 2518 u8 opmode; 2519 2520 /* verify opmode is present */ 2521 if (len < IEEE80211_MIN_ACTION_SIZE + 2) 2522 goto invalid; 2523 2524 opmode = mgmt->u.action.u.vht_opmode_notif.operating_mode; 2525 2526 ieee80211_vht_handle_opmode(rx->sdata, rx->sta, 2527 opmode, status->band, 2528 false); 2529 goto handled; 2530 } 2531 default: 2532 break; 2533 } 2534 break; 2535 case WLAN_CATEGORY_BACK: 2536 if (sdata->vif.type != NL80211_IFTYPE_STATION && 2537 sdata->vif.type != NL80211_IFTYPE_MESH_POINT && 2538 sdata->vif.type != NL80211_IFTYPE_AP_VLAN && 2539 sdata->vif.type != NL80211_IFTYPE_AP && 2540 sdata->vif.type != NL80211_IFTYPE_ADHOC) 2541 break; 2542 2543 /* verify action_code is present */ 2544 if (len < IEEE80211_MIN_ACTION_SIZE + 1) 2545 break; 2546 2547 switch (mgmt->u.action.u.addba_req.action_code) { 2548 case WLAN_ACTION_ADDBA_REQ: 2549 if (len < (IEEE80211_MIN_ACTION_SIZE + 2550 sizeof(mgmt->u.action.u.addba_req))) 2551 goto invalid; 2552 break; 2553 case WLAN_ACTION_ADDBA_RESP: 2554 if (len < (IEEE80211_MIN_ACTION_SIZE + 2555 sizeof(mgmt->u.action.u.addba_resp))) 2556 goto invalid; 2557 break; 2558 case WLAN_ACTION_DELBA: 2559 if (len < (IEEE80211_MIN_ACTION_SIZE + 2560 sizeof(mgmt->u.action.u.delba))) 2561 goto invalid; 2562 break; 2563 default: 2564 goto invalid; 2565 } 2566 2567 goto queue; 2568 case WLAN_CATEGORY_SPECTRUM_MGMT: 2569 /* verify action_code is present */ 2570 if (len < IEEE80211_MIN_ACTION_SIZE + 1) 2571 break; 2572 2573 switch (mgmt->u.action.u.measurement.action_code) { 2574 case WLAN_ACTION_SPCT_MSR_REQ: 2575 if (status->band != IEEE80211_BAND_5GHZ) 2576 break; 2577 2578 if (len < (IEEE80211_MIN_ACTION_SIZE + 2579 sizeof(mgmt->u.action.u.measurement))) 2580 break; 2581 2582 if (sdata->vif.type != NL80211_IFTYPE_STATION) 2583 break; 2584 2585 ieee80211_process_measurement_req(sdata, mgmt, len); 2586 goto handled; 2587 case WLAN_ACTION_SPCT_CHL_SWITCH: { 2588 u8 *bssid; 2589 if (len < (IEEE80211_MIN_ACTION_SIZE + 2590 sizeof(mgmt->u.action.u.chan_switch))) 2591 break; 2592 2593 if (sdata->vif.type != NL80211_IFTYPE_STATION && 2594 sdata->vif.type != NL80211_IFTYPE_ADHOC && 2595 sdata->vif.type != NL80211_IFTYPE_MESH_POINT) 2596 break; 2597 2598 if (sdata->vif.type == NL80211_IFTYPE_STATION) 2599 bssid = sdata->u.mgd.bssid; 2600 else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) 2601 bssid = sdata->u.ibss.bssid; 2602 else if (sdata->vif.type == NL80211_IFTYPE_MESH_POINT) 2603 bssid = mgmt->sa; 2604 else 2605 break; 2606 2607 if (!ether_addr_equal(mgmt->bssid, bssid)) 2608 break; 2609 2610 goto queue; 2611 } 2612 } 2613 break; 2614 case WLAN_CATEGORY_SA_QUERY: 2615 if (len < (IEEE80211_MIN_ACTION_SIZE + 2616 sizeof(mgmt->u.action.u.sa_query))) 2617 break; 2618 2619 switch (mgmt->u.action.u.sa_query.action) { 2620 case WLAN_ACTION_SA_QUERY_REQUEST: 2621 if (sdata->vif.type != NL80211_IFTYPE_STATION) 2622 break; 2623 ieee80211_process_sa_query_req(sdata, mgmt, len); 2624 goto handled; 2625 } 2626 break; 2627 case WLAN_CATEGORY_SELF_PROTECTED: 2628 if (len < (IEEE80211_MIN_ACTION_SIZE + 2629 sizeof(mgmt->u.action.u.self_prot.action_code))) 2630 break; 2631 2632 switch (mgmt->u.action.u.self_prot.action_code) { 2633 case WLAN_SP_MESH_PEERING_OPEN: 2634 case WLAN_SP_MESH_PEERING_CLOSE: 2635 case WLAN_SP_MESH_PEERING_CONFIRM: 2636 if (!ieee80211_vif_is_mesh(&sdata->vif)) 2637 goto invalid; 2638 if (sdata->u.mesh.user_mpm) 2639 /* userspace handles this frame */ 2640 break; 2641 goto queue; 2642 case WLAN_SP_MGK_INFORM: 2643 case WLAN_SP_MGK_ACK: 2644 if (!ieee80211_vif_is_mesh(&sdata->vif)) 2645 goto invalid; 2646 break; 2647 } 2648 break; 2649 case WLAN_CATEGORY_MESH_ACTION: 2650 if (len < (IEEE80211_MIN_ACTION_SIZE + 2651 sizeof(mgmt->u.action.u.mesh_action.action_code))) 2652 break; 2653 2654 if (!ieee80211_vif_is_mesh(&sdata->vif)) 2655 break; 2656 if (mesh_action_is_path_sel(mgmt) && 2657 !mesh_path_sel_is_hwmp(sdata)) 2658 break; 2659 goto queue; 2660 } 2661 2662 return RX_CONTINUE; 2663 2664 invalid: 2665 status->rx_flags |= IEEE80211_RX_MALFORMED_ACTION_FRM; 2666 /* will return in the next handlers */ 2667 return RX_CONTINUE; 2668 2669 handled: 2670 if (rx->sta) 2671 rx->sta->rx_packets++; 2672 dev_kfree_skb(rx->skb); 2673 return RX_QUEUED; 2674 2675 queue: 2676 rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME; 2677 skb_queue_tail(&sdata->skb_queue, rx->skb); 2678 ieee80211_queue_work(&local->hw, &sdata->work); 2679 if (rx->sta) 2680 rx->sta->rx_packets++; 2681 return RX_QUEUED; 2682 } 2683 2684 static ieee80211_rx_result debug_noinline 2685 ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx) 2686 { 2687 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 2688 int sig = 0; 2689 2690 /* skip known-bad action frames and return them in the next handler */ 2691 if (status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) 2692 return RX_CONTINUE; 2693 2694 /* 2695 * Getting here means the kernel doesn't know how to handle 2696 * it, but maybe userspace does ... include returned frames 2697 * so userspace can register for those to know whether ones 2698 * it transmitted were processed or returned. 2699 */ 2700 2701 if (rx->local->hw.flags & IEEE80211_HW_SIGNAL_DBM) 2702 sig = status->signal; 2703 2704 if (cfg80211_rx_mgmt(&rx->sdata->wdev, status->freq, sig, 2705 rx->skb->data, rx->skb->len, 0, GFP_ATOMIC)) { 2706 if (rx->sta) 2707 rx->sta->rx_packets++; 2708 dev_kfree_skb(rx->skb); 2709 return RX_QUEUED; 2710 } 2711 2712 return RX_CONTINUE; 2713 } 2714 2715 static ieee80211_rx_result debug_noinline 2716 ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx) 2717 { 2718 struct ieee80211_local *local = rx->local; 2719 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data; 2720 struct sk_buff *nskb; 2721 struct ieee80211_sub_if_data *sdata = rx->sdata; 2722 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 2723 2724 if (!ieee80211_is_action(mgmt->frame_control)) 2725 return RX_CONTINUE; 2726 2727 /* 2728 * For AP mode, hostapd is responsible for handling any action 2729 * frames that we didn't handle, including returning unknown 2730 * ones. For all other modes we will return them to the sender, 2731 * setting the 0x80 bit in the action category, as required by 2732 * 802.11-2012 9.24.4. 2733 * Newer versions of hostapd shall also use the management frame 2734 * registration mechanisms, but older ones still use cooked 2735 * monitor interfaces so push all frames there. 2736 */ 2737 if (!(status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) && 2738 (sdata->vif.type == NL80211_IFTYPE_AP || 2739 sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) 2740 return RX_DROP_MONITOR; 2741 2742 if (is_multicast_ether_addr(mgmt->da)) 2743 return RX_DROP_MONITOR; 2744 2745 /* do not return rejected action frames */ 2746 if (mgmt->u.action.category & 0x80) 2747 return RX_DROP_UNUSABLE; 2748 2749 nskb = skb_copy_expand(rx->skb, local->hw.extra_tx_headroom, 0, 2750 GFP_ATOMIC); 2751 if (nskb) { 2752 struct ieee80211_mgmt *nmgmt = (void *)nskb->data; 2753 2754 nmgmt->u.action.category |= 0x80; 2755 memcpy(nmgmt->da, nmgmt->sa, ETH_ALEN); 2756 memcpy(nmgmt->sa, rx->sdata->vif.addr, ETH_ALEN); 2757 2758 memset(nskb->cb, 0, sizeof(nskb->cb)); 2759 2760 if (rx->sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) { 2761 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(nskb); 2762 2763 info->flags = IEEE80211_TX_CTL_TX_OFFCHAN | 2764 IEEE80211_TX_INTFL_OFFCHAN_TX_OK | 2765 IEEE80211_TX_CTL_NO_CCK_RATE; 2766 if (local->hw.flags & IEEE80211_HW_QUEUE_CONTROL) 2767 info->hw_queue = 2768 local->hw.offchannel_tx_hw_queue; 2769 } 2770 2771 __ieee80211_tx_skb_tid_band(rx->sdata, nskb, 7, 2772 status->band); 2773 } 2774 dev_kfree_skb(rx->skb); 2775 return RX_QUEUED; 2776 } 2777 2778 static ieee80211_rx_result debug_noinline 2779 ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx) 2780 { 2781 struct ieee80211_sub_if_data *sdata = rx->sdata; 2782 struct ieee80211_mgmt *mgmt = (void *)rx->skb->data; 2783 __le16 stype; 2784 2785 stype = mgmt->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE); 2786 2787 if (!ieee80211_vif_is_mesh(&sdata->vif) && 2788 sdata->vif.type != NL80211_IFTYPE_ADHOC && 2789 sdata->vif.type != NL80211_IFTYPE_STATION) 2790 return RX_DROP_MONITOR; 2791 2792 switch (stype) { 2793 case cpu_to_le16(IEEE80211_STYPE_AUTH): 2794 case cpu_to_le16(IEEE80211_STYPE_BEACON): 2795 case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP): 2796 /* process for all: mesh, mlme, ibss */ 2797 break; 2798 case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP): 2799 case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP): 2800 case cpu_to_le16(IEEE80211_STYPE_DEAUTH): 2801 case cpu_to_le16(IEEE80211_STYPE_DISASSOC): 2802 if (is_multicast_ether_addr(mgmt->da) && 2803 !is_broadcast_ether_addr(mgmt->da)) 2804 return RX_DROP_MONITOR; 2805 2806 /* process only for station */ 2807 if (sdata->vif.type != NL80211_IFTYPE_STATION) 2808 return RX_DROP_MONITOR; 2809 break; 2810 case cpu_to_le16(IEEE80211_STYPE_PROBE_REQ): 2811 /* process only for ibss and mesh */ 2812 if (sdata->vif.type != NL80211_IFTYPE_ADHOC && 2813 sdata->vif.type != NL80211_IFTYPE_MESH_POINT) 2814 return RX_DROP_MONITOR; 2815 break; 2816 default: 2817 return RX_DROP_MONITOR; 2818 } 2819 2820 /* queue up frame and kick off work to process it */ 2821 rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME; 2822 skb_queue_tail(&sdata->skb_queue, rx->skb); 2823 ieee80211_queue_work(&rx->local->hw, &sdata->work); 2824 if (rx->sta) 2825 rx->sta->rx_packets++; 2826 2827 return RX_QUEUED; 2828 } 2829 2830 /* TODO: use IEEE80211_RX_FRAGMENTED */ 2831 static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx, 2832 struct ieee80211_rate *rate) 2833 { 2834 struct ieee80211_sub_if_data *sdata; 2835 struct ieee80211_local *local = rx->local; 2836 struct sk_buff *skb = rx->skb, *skb2; 2837 struct net_device *prev_dev = NULL; 2838 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 2839 int needed_headroom; 2840 2841 /* 2842 * If cooked monitor has been processed already, then 2843 * don't do it again. If not, set the flag. 2844 */ 2845 if (rx->flags & IEEE80211_RX_CMNTR) 2846 goto out_free_skb; 2847 rx->flags |= IEEE80211_RX_CMNTR; 2848 2849 /* If there are no cooked monitor interfaces, just free the SKB */ 2850 if (!local->cooked_mntrs) 2851 goto out_free_skb; 2852 2853 /* room for the radiotap header based on driver features */ 2854 needed_headroom = ieee80211_rx_radiotap_space(local, status); 2855 2856 if (skb_headroom(skb) < needed_headroom && 2857 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) 2858 goto out_free_skb; 2859 2860 /* prepend radiotap information */ 2861 ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom, 2862 false); 2863 2864 skb_set_mac_header(skb, 0); 2865 skb->ip_summed = CHECKSUM_UNNECESSARY; 2866 skb->pkt_type = PACKET_OTHERHOST; 2867 skb->protocol = htons(ETH_P_802_2); 2868 2869 list_for_each_entry_rcu(sdata, &local->interfaces, list) { 2870 if (!ieee80211_sdata_running(sdata)) 2871 continue; 2872 2873 if (sdata->vif.type != NL80211_IFTYPE_MONITOR || 2874 !(sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES)) 2875 continue; 2876 2877 if (prev_dev) { 2878 skb2 = skb_clone(skb, GFP_ATOMIC); 2879 if (skb2) { 2880 skb2->dev = prev_dev; 2881 netif_receive_skb(skb2); 2882 } 2883 } 2884 2885 prev_dev = sdata->dev; 2886 sdata->dev->stats.rx_packets++; 2887 sdata->dev->stats.rx_bytes += skb->len; 2888 } 2889 2890 if (prev_dev) { 2891 skb->dev = prev_dev; 2892 netif_receive_skb(skb); 2893 return; 2894 } 2895 2896 out_free_skb: 2897 dev_kfree_skb(skb); 2898 } 2899 2900 static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx, 2901 ieee80211_rx_result res) 2902 { 2903 switch (res) { 2904 case RX_DROP_MONITOR: 2905 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop); 2906 if (rx->sta) 2907 rx->sta->rx_dropped++; 2908 /* fall through */ 2909 case RX_CONTINUE: { 2910 struct ieee80211_rate *rate = NULL; 2911 struct ieee80211_supported_band *sband; 2912 struct ieee80211_rx_status *status; 2913 2914 status = IEEE80211_SKB_RXCB((rx->skb)); 2915 2916 sband = rx->local->hw.wiphy->bands[status->band]; 2917 if (!(status->flag & RX_FLAG_HT) && 2918 !(status->flag & RX_FLAG_VHT)) 2919 rate = &sband->bitrates[status->rate_idx]; 2920 2921 ieee80211_rx_cooked_monitor(rx, rate); 2922 break; 2923 } 2924 case RX_DROP_UNUSABLE: 2925 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop); 2926 if (rx->sta) 2927 rx->sta->rx_dropped++; 2928 dev_kfree_skb(rx->skb); 2929 break; 2930 case RX_QUEUED: 2931 I802_DEBUG_INC(rx->sdata->local->rx_handlers_queued); 2932 break; 2933 } 2934 } 2935 2936 static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx, 2937 struct sk_buff_head *frames) 2938 { 2939 ieee80211_rx_result res = RX_DROP_MONITOR; 2940 struct sk_buff *skb; 2941 2942 #define CALL_RXH(rxh) \ 2943 do { \ 2944 res = rxh(rx); \ 2945 if (res != RX_CONTINUE) \ 2946 goto rxh_next; \ 2947 } while (0); 2948 2949 spin_lock_bh(&rx->local->rx_path_lock); 2950 2951 while ((skb = __skb_dequeue(frames))) { 2952 /* 2953 * all the other fields are valid across frames 2954 * that belong to an aMPDU since they are on the 2955 * same TID from the same station 2956 */ 2957 rx->skb = skb; 2958 2959 CALL_RXH(ieee80211_rx_h_check_more_data) 2960 CALL_RXH(ieee80211_rx_h_uapsd_and_pspoll) 2961 CALL_RXH(ieee80211_rx_h_sta_process) 2962 CALL_RXH(ieee80211_rx_h_decrypt) 2963 CALL_RXH(ieee80211_rx_h_defragment) 2964 CALL_RXH(ieee80211_rx_h_michael_mic_verify) 2965 /* must be after MMIC verify so header is counted in MPDU mic */ 2966 #ifdef CONFIG_MAC80211_MESH 2967 if (ieee80211_vif_is_mesh(&rx->sdata->vif)) 2968 CALL_RXH(ieee80211_rx_h_mesh_fwding); 2969 #endif 2970 CALL_RXH(ieee80211_rx_h_amsdu) 2971 CALL_RXH(ieee80211_rx_h_data) 2972 2973 /* special treatment -- needs the queue */ 2974 res = ieee80211_rx_h_ctrl(rx, frames); 2975 if (res != RX_CONTINUE) 2976 goto rxh_next; 2977 2978 CALL_RXH(ieee80211_rx_h_mgmt_check) 2979 CALL_RXH(ieee80211_rx_h_action) 2980 CALL_RXH(ieee80211_rx_h_userspace_mgmt) 2981 CALL_RXH(ieee80211_rx_h_action_return) 2982 CALL_RXH(ieee80211_rx_h_mgmt) 2983 2984 rxh_next: 2985 ieee80211_rx_handlers_result(rx, res); 2986 2987 #undef CALL_RXH 2988 } 2989 2990 spin_unlock_bh(&rx->local->rx_path_lock); 2991 } 2992 2993 static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx) 2994 { 2995 struct sk_buff_head reorder_release; 2996 ieee80211_rx_result res = RX_DROP_MONITOR; 2997 2998 __skb_queue_head_init(&reorder_release); 2999 3000 #define CALL_RXH(rxh) \ 3001 do { \ 3002 res = rxh(rx); \ 3003 if (res != RX_CONTINUE) \ 3004 goto rxh_next; \ 3005 } while (0); 3006 3007 CALL_RXH(ieee80211_rx_h_check) 3008 3009 ieee80211_rx_reorder_ampdu(rx, &reorder_release); 3010 3011 ieee80211_rx_handlers(rx, &reorder_release); 3012 return; 3013 3014 rxh_next: 3015 ieee80211_rx_handlers_result(rx, res); 3016 3017 #undef CALL_RXH 3018 } 3019 3020 /* 3021 * This function makes calls into the RX path, therefore 3022 * it has to be invoked under RCU read lock. 3023 */ 3024 void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid) 3025 { 3026 struct sk_buff_head frames; 3027 struct ieee80211_rx_data rx = { 3028 .sta = sta, 3029 .sdata = sta->sdata, 3030 .local = sta->local, 3031 /* This is OK -- must be QoS data frame */ 3032 .security_idx = tid, 3033 .seqno_idx = tid, 3034 .flags = 0, 3035 }; 3036 struct tid_ampdu_rx *tid_agg_rx; 3037 3038 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]); 3039 if (!tid_agg_rx) 3040 return; 3041 3042 __skb_queue_head_init(&frames); 3043 3044 spin_lock(&tid_agg_rx->reorder_lock); 3045 ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames); 3046 spin_unlock(&tid_agg_rx->reorder_lock); 3047 3048 ieee80211_rx_handlers(&rx, &frames); 3049 } 3050 3051 /* main receive path */ 3052 3053 static bool prepare_for_handlers(struct ieee80211_rx_data *rx, 3054 struct ieee80211_hdr *hdr) 3055 { 3056 struct ieee80211_sub_if_data *sdata = rx->sdata; 3057 struct sk_buff *skb = rx->skb; 3058 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 3059 u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type); 3060 int multicast = is_multicast_ether_addr(hdr->addr1); 3061 3062 switch (sdata->vif.type) { 3063 case NL80211_IFTYPE_STATION: 3064 if (!bssid && !sdata->u.mgd.use_4addr) 3065 return false; 3066 if (!multicast && 3067 !ether_addr_equal(sdata->vif.addr, hdr->addr1)) { 3068 if (!(sdata->dev->flags & IFF_PROMISC) || 3069 sdata->u.mgd.use_4addr) 3070 return false; 3071 status->rx_flags &= ~IEEE80211_RX_RA_MATCH; 3072 } 3073 break; 3074 case NL80211_IFTYPE_ADHOC: 3075 if (!bssid) 3076 return false; 3077 if (ether_addr_equal(sdata->vif.addr, hdr->addr2) || 3078 ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2)) 3079 return false; 3080 if (ieee80211_is_beacon(hdr->frame_control)) { 3081 return true; 3082 } else if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid)) { 3083 return false; 3084 } else if (!multicast && 3085 !ether_addr_equal(sdata->vif.addr, hdr->addr1)) { 3086 if (!(sdata->dev->flags & IFF_PROMISC)) 3087 return false; 3088 status->rx_flags &= ~IEEE80211_RX_RA_MATCH; 3089 } else if (!rx->sta) { 3090 int rate_idx; 3091 if (status->flag & (RX_FLAG_HT | RX_FLAG_VHT)) 3092 rate_idx = 0; /* TODO: HT/VHT rates */ 3093 else 3094 rate_idx = status->rate_idx; 3095 ieee80211_ibss_rx_no_sta(sdata, bssid, hdr->addr2, 3096 BIT(rate_idx)); 3097 } 3098 break; 3099 case NL80211_IFTYPE_MESH_POINT: 3100 if (!multicast && 3101 !ether_addr_equal(sdata->vif.addr, hdr->addr1)) { 3102 if (!(sdata->dev->flags & IFF_PROMISC)) 3103 return false; 3104 3105 status->rx_flags &= ~IEEE80211_RX_RA_MATCH; 3106 } 3107 break; 3108 case NL80211_IFTYPE_AP_VLAN: 3109 case NL80211_IFTYPE_AP: 3110 if (!bssid) { 3111 if (!ether_addr_equal(sdata->vif.addr, hdr->addr1)) 3112 return false; 3113 } else if (!ieee80211_bssid_match(bssid, sdata->vif.addr)) { 3114 /* 3115 * Accept public action frames even when the 3116 * BSSID doesn't match, this is used for P2P 3117 * and location updates. Note that mac80211 3118 * itself never looks at these frames. 3119 */ 3120 if (!multicast && 3121 !ether_addr_equal(sdata->vif.addr, hdr->addr1)) 3122 return false; 3123 if (ieee80211_is_public_action(hdr, skb->len)) 3124 return true; 3125 if (!ieee80211_is_beacon(hdr->frame_control)) 3126 return false; 3127 status->rx_flags &= ~IEEE80211_RX_RA_MATCH; 3128 } 3129 break; 3130 case NL80211_IFTYPE_WDS: 3131 if (bssid || !ieee80211_is_data(hdr->frame_control)) 3132 return false; 3133 if (!ether_addr_equal(sdata->u.wds.remote_addr, hdr->addr2)) 3134 return false; 3135 break; 3136 case NL80211_IFTYPE_P2P_DEVICE: 3137 if (!ieee80211_is_public_action(hdr, skb->len) && 3138 !ieee80211_is_probe_req(hdr->frame_control) && 3139 !ieee80211_is_probe_resp(hdr->frame_control) && 3140 !ieee80211_is_beacon(hdr->frame_control)) 3141 return false; 3142 if (!ether_addr_equal(sdata->vif.addr, hdr->addr1) && 3143 !multicast) 3144 status->rx_flags &= ~IEEE80211_RX_RA_MATCH; 3145 break; 3146 default: 3147 /* should never get here */ 3148 WARN_ON_ONCE(1); 3149 break; 3150 } 3151 3152 return true; 3153 } 3154 3155 /* 3156 * This function returns whether or not the SKB 3157 * was destined for RX processing or not, which, 3158 * if consume is true, is equivalent to whether 3159 * or not the skb was consumed. 3160 */ 3161 static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx, 3162 struct sk_buff *skb, bool consume) 3163 { 3164 struct ieee80211_local *local = rx->local; 3165 struct ieee80211_sub_if_data *sdata = rx->sdata; 3166 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 3167 struct ieee80211_hdr *hdr = (void *)skb->data; 3168 3169 rx->skb = skb; 3170 status->rx_flags |= IEEE80211_RX_RA_MATCH; 3171 3172 if (!prepare_for_handlers(rx, hdr)) 3173 return false; 3174 3175 if (!consume) { 3176 skb = skb_copy(skb, GFP_ATOMIC); 3177 if (!skb) { 3178 if (net_ratelimit()) 3179 wiphy_debug(local->hw.wiphy, 3180 "failed to copy skb for %s\n", 3181 sdata->name); 3182 return true; 3183 } 3184 3185 rx->skb = skb; 3186 } 3187 3188 ieee80211_invoke_rx_handlers(rx); 3189 return true; 3190 } 3191 3192 /* 3193 * This is the actual Rx frames handler. as it blongs to Rx path it must 3194 * be called with rcu_read_lock protection. 3195 */ 3196 static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, 3197 struct sk_buff *skb) 3198 { 3199 struct ieee80211_local *local = hw_to_local(hw); 3200 struct ieee80211_sub_if_data *sdata; 3201 struct ieee80211_hdr *hdr; 3202 __le16 fc; 3203 struct ieee80211_rx_data rx; 3204 struct ieee80211_sub_if_data *prev; 3205 struct sta_info *sta, *tmp, *prev_sta; 3206 int err = 0; 3207 3208 fc = ((struct ieee80211_hdr *)skb->data)->frame_control; 3209 memset(&rx, 0, sizeof(rx)); 3210 rx.skb = skb; 3211 rx.local = local; 3212 3213 if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc)) 3214 local->dot11ReceivedFragmentCount++; 3215 3216 if (ieee80211_is_mgmt(fc)) { 3217 /* drop frame if too short for header */ 3218 if (skb->len < ieee80211_hdrlen(fc)) 3219 err = -ENOBUFS; 3220 else 3221 err = skb_linearize(skb); 3222 } else { 3223 err = !pskb_may_pull(skb, ieee80211_hdrlen(fc)); 3224 } 3225 3226 if (err) { 3227 dev_kfree_skb(skb); 3228 return; 3229 } 3230 3231 hdr = (struct ieee80211_hdr *)skb->data; 3232 ieee80211_parse_qos(&rx); 3233 ieee80211_verify_alignment(&rx); 3234 3235 if (unlikely(ieee80211_is_probe_resp(hdr->frame_control) || 3236 ieee80211_is_beacon(hdr->frame_control))) 3237 ieee80211_scan_rx(local, skb); 3238 3239 if (ieee80211_is_data(fc)) { 3240 prev_sta = NULL; 3241 3242 for_each_sta_info(local, hdr->addr2, sta, tmp) { 3243 if (!prev_sta) { 3244 prev_sta = sta; 3245 continue; 3246 } 3247 3248 rx.sta = prev_sta; 3249 rx.sdata = prev_sta->sdata; 3250 ieee80211_prepare_and_rx_handle(&rx, skb, false); 3251 3252 prev_sta = sta; 3253 } 3254 3255 if (prev_sta) { 3256 rx.sta = prev_sta; 3257 rx.sdata = prev_sta->sdata; 3258 3259 if (ieee80211_prepare_and_rx_handle(&rx, skb, true)) 3260 return; 3261 goto out; 3262 } 3263 } 3264 3265 prev = NULL; 3266 3267 list_for_each_entry_rcu(sdata, &local->interfaces, list) { 3268 if (!ieee80211_sdata_running(sdata)) 3269 continue; 3270 3271 if (sdata->vif.type == NL80211_IFTYPE_MONITOR || 3272 sdata->vif.type == NL80211_IFTYPE_AP_VLAN) 3273 continue; 3274 3275 /* 3276 * frame is destined for this interface, but if it's 3277 * not also for the previous one we handle that after 3278 * the loop to avoid copying the SKB once too much 3279 */ 3280 3281 if (!prev) { 3282 prev = sdata; 3283 continue; 3284 } 3285 3286 rx.sta = sta_info_get_bss(prev, hdr->addr2); 3287 rx.sdata = prev; 3288 ieee80211_prepare_and_rx_handle(&rx, skb, false); 3289 3290 prev = sdata; 3291 } 3292 3293 if (prev) { 3294 rx.sta = sta_info_get_bss(prev, hdr->addr2); 3295 rx.sdata = prev; 3296 3297 if (ieee80211_prepare_and_rx_handle(&rx, skb, true)) 3298 return; 3299 } 3300 3301 out: 3302 dev_kfree_skb(skb); 3303 } 3304 3305 /* 3306 * This is the receive path handler. It is called by a low level driver when an 3307 * 802.11 MPDU is received from the hardware. 3308 */ 3309 void ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb) 3310 { 3311 struct ieee80211_local *local = hw_to_local(hw); 3312 struct ieee80211_rate *rate = NULL; 3313 struct ieee80211_supported_band *sband; 3314 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 3315 3316 WARN_ON_ONCE(softirq_count() == 0); 3317 3318 if (WARN_ON(status->band >= IEEE80211_NUM_BANDS)) 3319 goto drop; 3320 3321 sband = local->hw.wiphy->bands[status->band]; 3322 if (WARN_ON(!sband)) 3323 goto drop; 3324 3325 /* 3326 * If we're suspending, it is possible although not too likely 3327 * that we'd be receiving frames after having already partially 3328 * quiesced the stack. We can't process such frames then since 3329 * that might, for example, cause stations to be added or other 3330 * driver callbacks be invoked. 3331 */ 3332 if (unlikely(local->quiescing || local->suspended)) 3333 goto drop; 3334 3335 /* We might be during a HW reconfig, prevent Rx for the same reason */ 3336 if (unlikely(local->in_reconfig)) 3337 goto drop; 3338 3339 /* 3340 * The same happens when we're not even started, 3341 * but that's worth a warning. 3342 */ 3343 if (WARN_ON(!local->started)) 3344 goto drop; 3345 3346 if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC))) { 3347 /* 3348 * Validate the rate, unless a PLCP error means that 3349 * we probably can't have a valid rate here anyway. 3350 */ 3351 3352 if (status->flag & RX_FLAG_HT) { 3353 /* 3354 * rate_idx is MCS index, which can be [0-76] 3355 * as documented on: 3356 * 3357 * http://wireless.kernel.org/en/developers/Documentation/ieee80211/802.11n 3358 * 3359 * Anything else would be some sort of driver or 3360 * hardware error. The driver should catch hardware 3361 * errors. 3362 */ 3363 if (WARN(status->rate_idx > 76, 3364 "Rate marked as an HT rate but passed " 3365 "status->rate_idx is not " 3366 "an MCS index [0-76]: %d (0x%02x)\n", 3367 status->rate_idx, 3368 status->rate_idx)) 3369 goto drop; 3370 } else if (status->flag & RX_FLAG_VHT) { 3371 if (WARN_ONCE(status->rate_idx > 9 || 3372 !status->vht_nss || 3373 status->vht_nss > 8, 3374 "Rate marked as a VHT rate but data is invalid: MCS: %d, NSS: %d\n", 3375 status->rate_idx, status->vht_nss)) 3376 goto drop; 3377 } else { 3378 if (WARN_ON(status->rate_idx >= sband->n_bitrates)) 3379 goto drop; 3380 rate = &sband->bitrates[status->rate_idx]; 3381 } 3382 } 3383 3384 status->rx_flags = 0; 3385 3386 /* 3387 * key references and virtual interfaces are protected using RCU 3388 * and this requires that we are in a read-side RCU section during 3389 * receive processing 3390 */ 3391 rcu_read_lock(); 3392 3393 /* 3394 * Frames with failed FCS/PLCP checksum are not returned, 3395 * all other frames are returned without radiotap header 3396 * if it was previously present. 3397 * Also, frames with less than 16 bytes are dropped. 3398 */ 3399 skb = ieee80211_rx_monitor(local, skb, rate); 3400 if (!skb) { 3401 rcu_read_unlock(); 3402 return; 3403 } 3404 3405 ieee80211_tpt_led_trig_rx(local, 3406 ((struct ieee80211_hdr *)skb->data)->frame_control, 3407 skb->len); 3408 __ieee80211_rx_handle_packet(hw, skb); 3409 3410 rcu_read_unlock(); 3411 3412 return; 3413 drop: 3414 kfree_skb(skb); 3415 } 3416 EXPORT_SYMBOL(ieee80211_rx); 3417 3418 /* This is a version of the rx handler that can be called from hard irq 3419 * context. Post the skb on the queue and schedule the tasklet */ 3420 void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb) 3421 { 3422 struct ieee80211_local *local = hw_to_local(hw); 3423 3424 BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb)); 3425 3426 skb->pkt_type = IEEE80211_RX_MSG; 3427 skb_queue_tail(&local->skb_queue, skb); 3428 tasklet_schedule(&local->tasklet); 3429 } 3430 EXPORT_SYMBOL(ieee80211_rx_irqsafe); 3431