1 /* 2 * Copyright 2002-2005, Instant802 Networks, Inc. 3 * Copyright 2005-2006, Devicescape Software, Inc. 4 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz> 5 * Copyright 2007-2010 Johannes Berg <johannes@sipsolutions.net> 6 * 7 * This program is free software; you can redistribute it and/or modify 8 * it under the terms of the GNU General Public License version 2 as 9 * published by the Free Software Foundation. 10 */ 11 12 #include <linux/jiffies.h> 13 #include <linux/slab.h> 14 #include <linux/kernel.h> 15 #include <linux/skbuff.h> 16 #include <linux/netdevice.h> 17 #include <linux/etherdevice.h> 18 #include <linux/rcupdate.h> 19 #include <linux/export.h> 20 #include <net/mac80211.h> 21 #include <net/ieee80211_radiotap.h> 22 #include <asm/unaligned.h> 23 24 #include "ieee80211_i.h" 25 #include "driver-ops.h" 26 #include "led.h" 27 #include "mesh.h" 28 #include "wep.h" 29 #include "wpa.h" 30 #include "tkip.h" 31 #include "wme.h" 32 #include "rate.h" 33 34 /* 35 * monitor mode reception 36 * 37 * This function cleans up the SKB, i.e. it removes all the stuff 38 * only useful for monitoring. 39 */ 40 static struct sk_buff *remove_monitor_info(struct ieee80211_local *local, 41 struct sk_buff *skb) 42 { 43 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 44 45 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) { 46 if (likely(skb->len > FCS_LEN)) 47 __pskb_trim(skb, skb->len - FCS_LEN); 48 else { 49 /* driver bug */ 50 WARN_ON(1); 51 dev_kfree_skb(skb); 52 return NULL; 53 } 54 } 55 56 if (status->vendor_radiotap_len) 57 __pskb_pull(skb, status->vendor_radiotap_len); 58 59 return skb; 60 } 61 62 static inline int should_drop_frame(struct sk_buff *skb, int present_fcs_len) 63 { 64 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 65 struct ieee80211_hdr *hdr; 66 67 hdr = (void *)(skb->data + status->vendor_radiotap_len); 68 69 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | 70 RX_FLAG_FAILED_PLCP_CRC | 71 RX_FLAG_AMPDU_IS_ZEROLEN)) 72 return 1; 73 if (unlikely(skb->len < 16 + present_fcs_len + 74 status->vendor_radiotap_len)) 75 return 1; 76 if (ieee80211_is_ctl(hdr->frame_control) && 77 !ieee80211_is_pspoll(hdr->frame_control) && 78 !ieee80211_is_back_req(hdr->frame_control)) 79 return 1; 80 return 0; 81 } 82 83 static int 84 ieee80211_rx_radiotap_space(struct ieee80211_local *local, 85 struct ieee80211_rx_status *status) 86 { 87 int len; 88 89 /* always present fields */ 90 len = sizeof(struct ieee80211_radiotap_header) + 8; 91 92 /* allocate extra bitmaps */ 93 if (status->vendor_radiotap_len) 94 len += 4; 95 if (status->chains) 96 len += 4 * hweight8(status->chains); 97 98 if (ieee80211_have_rx_timestamp(status)) { 99 len = ALIGN(len, 8); 100 len += 8; 101 } 102 if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM) 103 len += 1; 104 105 /* antenna field, if we don't have per-chain info */ 106 if (!status->chains) 107 len += 1; 108 109 /* padding for RX_FLAGS if necessary */ 110 len = ALIGN(len, 2); 111 112 if (status->flag & RX_FLAG_HT) /* HT info */ 113 len += 3; 114 115 if (status->flag & RX_FLAG_AMPDU_DETAILS) { 116 len = ALIGN(len, 4); 117 len += 8; 118 } 119 120 if (status->flag & RX_FLAG_VHT) { 121 len = ALIGN(len, 2); 122 len += 12; 123 } 124 125 if (status->chains) { 126 /* antenna and antenna signal fields */ 127 len += 2 * hweight8(status->chains); 128 } 129 130 if (status->vendor_radiotap_len) { 131 if (WARN_ON_ONCE(status->vendor_radiotap_align == 0)) 132 status->vendor_radiotap_align = 1; 133 /* align standard part of vendor namespace */ 134 len = ALIGN(len, 2); 135 /* allocate standard part of vendor namespace */ 136 len += 6; 137 /* align vendor-defined part */ 138 len = ALIGN(len, status->vendor_radiotap_align); 139 /* vendor-defined part is already in skb */ 140 } 141 142 return len; 143 } 144 145 /* 146 * ieee80211_add_rx_radiotap_header - add radiotap header 147 * 148 * add a radiotap header containing all the fields which the hardware provided. 149 */ 150 static void 151 ieee80211_add_rx_radiotap_header(struct ieee80211_local *local, 152 struct sk_buff *skb, 153 struct ieee80211_rate *rate, 154 int rtap_len, bool has_fcs) 155 { 156 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 157 struct ieee80211_radiotap_header *rthdr; 158 unsigned char *pos; 159 __le32 *it_present; 160 u32 it_present_val; 161 u16 rx_flags = 0; 162 u16 channel_flags = 0; 163 int mpdulen, chain; 164 unsigned long chains = status->chains; 165 166 mpdulen = skb->len; 167 if (!(has_fcs && (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS))) 168 mpdulen += FCS_LEN; 169 170 rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len); 171 memset(rthdr, 0, rtap_len); 172 it_present = &rthdr->it_present; 173 174 /* radiotap header, set always present flags */ 175 rthdr->it_len = cpu_to_le16(rtap_len + status->vendor_radiotap_len); 176 it_present_val = BIT(IEEE80211_RADIOTAP_FLAGS) | 177 BIT(IEEE80211_RADIOTAP_CHANNEL) | 178 BIT(IEEE80211_RADIOTAP_RX_FLAGS); 179 180 if (!status->chains) 181 it_present_val |= BIT(IEEE80211_RADIOTAP_ANTENNA); 182 183 for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) { 184 it_present_val |= 185 BIT(IEEE80211_RADIOTAP_EXT) | 186 BIT(IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE); 187 put_unaligned_le32(it_present_val, it_present); 188 it_present++; 189 it_present_val = BIT(IEEE80211_RADIOTAP_ANTENNA) | 190 BIT(IEEE80211_RADIOTAP_DBM_ANTSIGNAL); 191 } 192 193 if (status->vendor_radiotap_len) { 194 it_present_val |= BIT(IEEE80211_RADIOTAP_VENDOR_NAMESPACE) | 195 BIT(IEEE80211_RADIOTAP_EXT); 196 put_unaligned_le32(it_present_val, it_present); 197 it_present++; 198 it_present_val = status->vendor_radiotap_bitmap; 199 } 200 201 put_unaligned_le32(it_present_val, it_present); 202 203 pos = (void *)(it_present + 1); 204 205 /* the order of the following fields is important */ 206 207 /* IEEE80211_RADIOTAP_TSFT */ 208 if (ieee80211_have_rx_timestamp(status)) { 209 /* padding */ 210 while ((pos - (u8 *)rthdr) & 7) 211 *pos++ = 0; 212 put_unaligned_le64( 213 ieee80211_calculate_rx_timestamp(local, status, 214 mpdulen, 0), 215 pos); 216 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT); 217 pos += 8; 218 } 219 220 /* IEEE80211_RADIOTAP_FLAGS */ 221 if (has_fcs && (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)) 222 *pos |= IEEE80211_RADIOTAP_F_FCS; 223 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC)) 224 *pos |= IEEE80211_RADIOTAP_F_BADFCS; 225 if (status->flag & RX_FLAG_SHORTPRE) 226 *pos |= IEEE80211_RADIOTAP_F_SHORTPRE; 227 pos++; 228 229 /* IEEE80211_RADIOTAP_RATE */ 230 if (!rate || status->flag & (RX_FLAG_HT | RX_FLAG_VHT)) { 231 /* 232 * Without rate information don't add it. If we have, 233 * MCS information is a separate field in radiotap, 234 * added below. The byte here is needed as padding 235 * for the channel though, so initialise it to 0. 236 */ 237 *pos = 0; 238 } else { 239 int shift = 0; 240 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE); 241 if (status->flag & RX_FLAG_10MHZ) 242 shift = 1; 243 else if (status->flag & RX_FLAG_5MHZ) 244 shift = 2; 245 *pos = DIV_ROUND_UP(rate->bitrate, 5 * (1 << shift)); 246 } 247 pos++; 248 249 /* IEEE80211_RADIOTAP_CHANNEL */ 250 put_unaligned_le16(status->freq, pos); 251 pos += 2; 252 if (status->flag & RX_FLAG_10MHZ) 253 channel_flags |= IEEE80211_CHAN_HALF; 254 else if (status->flag & RX_FLAG_5MHZ) 255 channel_flags |= IEEE80211_CHAN_QUARTER; 256 257 if (status->band == IEEE80211_BAND_5GHZ) 258 channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ; 259 else if (status->flag & (RX_FLAG_HT | RX_FLAG_VHT)) 260 channel_flags |= IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ; 261 else if (rate && rate->flags & IEEE80211_RATE_ERP_G) 262 channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ; 263 else if (rate) 264 channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ; 265 else 266 channel_flags |= IEEE80211_CHAN_2GHZ; 267 put_unaligned_le16(channel_flags, pos); 268 pos += 2; 269 270 /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */ 271 if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM && 272 !(status->flag & RX_FLAG_NO_SIGNAL_VAL)) { 273 *pos = status->signal; 274 rthdr->it_present |= 275 cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL); 276 pos++; 277 } 278 279 /* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */ 280 281 if (!status->chains) { 282 /* IEEE80211_RADIOTAP_ANTENNA */ 283 *pos = status->antenna; 284 pos++; 285 } 286 287 /* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */ 288 289 /* IEEE80211_RADIOTAP_RX_FLAGS */ 290 /* ensure 2 byte alignment for the 2 byte field as required */ 291 if ((pos - (u8 *)rthdr) & 1) 292 *pos++ = 0; 293 if (status->flag & RX_FLAG_FAILED_PLCP_CRC) 294 rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP; 295 put_unaligned_le16(rx_flags, pos); 296 pos += 2; 297 298 if (status->flag & RX_FLAG_HT) { 299 unsigned int stbc; 300 301 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_MCS); 302 *pos++ = local->hw.radiotap_mcs_details; 303 *pos = 0; 304 if (status->flag & RX_FLAG_SHORT_GI) 305 *pos |= IEEE80211_RADIOTAP_MCS_SGI; 306 if (status->flag & RX_FLAG_40MHZ) 307 *pos |= IEEE80211_RADIOTAP_MCS_BW_40; 308 if (status->flag & RX_FLAG_HT_GF) 309 *pos |= IEEE80211_RADIOTAP_MCS_FMT_GF; 310 stbc = (status->flag & RX_FLAG_STBC_MASK) >> RX_FLAG_STBC_SHIFT; 311 *pos |= stbc << IEEE80211_RADIOTAP_MCS_STBC_SHIFT; 312 pos++; 313 *pos++ = status->rate_idx; 314 } 315 316 if (status->flag & RX_FLAG_AMPDU_DETAILS) { 317 u16 flags = 0; 318 319 /* ensure 4 byte alignment */ 320 while ((pos - (u8 *)rthdr) & 3) 321 pos++; 322 rthdr->it_present |= 323 cpu_to_le32(1 << IEEE80211_RADIOTAP_AMPDU_STATUS); 324 put_unaligned_le32(status->ampdu_reference, pos); 325 pos += 4; 326 if (status->flag & RX_FLAG_AMPDU_REPORT_ZEROLEN) 327 flags |= IEEE80211_RADIOTAP_AMPDU_REPORT_ZEROLEN; 328 if (status->flag & RX_FLAG_AMPDU_IS_ZEROLEN) 329 flags |= IEEE80211_RADIOTAP_AMPDU_IS_ZEROLEN; 330 if (status->flag & RX_FLAG_AMPDU_LAST_KNOWN) 331 flags |= IEEE80211_RADIOTAP_AMPDU_LAST_KNOWN; 332 if (status->flag & RX_FLAG_AMPDU_IS_LAST) 333 flags |= IEEE80211_RADIOTAP_AMPDU_IS_LAST; 334 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_ERROR) 335 flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_ERR; 336 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN) 337 flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_KNOWN; 338 put_unaligned_le16(flags, pos); 339 pos += 2; 340 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN) 341 *pos++ = status->ampdu_delimiter_crc; 342 else 343 *pos++ = 0; 344 *pos++ = 0; 345 } 346 347 if (status->flag & RX_FLAG_VHT) { 348 u16 known = local->hw.radiotap_vht_details; 349 350 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_VHT); 351 /* known field - how to handle 80+80? */ 352 if (status->flag & RX_FLAG_80P80MHZ) 353 known &= ~IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH; 354 put_unaligned_le16(known, pos); 355 pos += 2; 356 /* flags */ 357 if (status->flag & RX_FLAG_SHORT_GI) 358 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_SGI; 359 pos++; 360 /* bandwidth */ 361 if (status->flag & RX_FLAG_80MHZ) 362 *pos++ = 4; 363 else if (status->flag & RX_FLAG_80P80MHZ) 364 *pos++ = 0; /* marked not known above */ 365 else if (status->flag & RX_FLAG_160MHZ) 366 *pos++ = 11; 367 else if (status->flag & RX_FLAG_40MHZ) 368 *pos++ = 1; 369 else /* 20 MHz */ 370 *pos++ = 0; 371 /* MCS/NSS */ 372 *pos = (status->rate_idx << 4) | status->vht_nss; 373 pos += 4; 374 /* coding field */ 375 pos++; 376 /* group ID */ 377 pos++; 378 /* partial_aid */ 379 pos += 2; 380 } 381 382 for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) { 383 *pos++ = status->chain_signal[chain]; 384 *pos++ = chain; 385 } 386 387 if (status->vendor_radiotap_len) { 388 /* ensure 2 byte alignment for the vendor field as required */ 389 if ((pos - (u8 *)rthdr) & 1) 390 *pos++ = 0; 391 *pos++ = status->vendor_radiotap_oui[0]; 392 *pos++ = status->vendor_radiotap_oui[1]; 393 *pos++ = status->vendor_radiotap_oui[2]; 394 *pos++ = status->vendor_radiotap_subns; 395 put_unaligned_le16(status->vendor_radiotap_len, pos); 396 pos += 2; 397 /* align the actual payload as requested */ 398 while ((pos - (u8 *)rthdr) & (status->vendor_radiotap_align - 1)) 399 *pos++ = 0; 400 } 401 } 402 403 /* 404 * This function copies a received frame to all monitor interfaces and 405 * returns a cleaned-up SKB that no longer includes the FCS nor the 406 * radiotap header the driver might have added. 407 */ 408 static struct sk_buff * 409 ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb, 410 struct ieee80211_rate *rate) 411 { 412 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb); 413 struct ieee80211_sub_if_data *sdata; 414 int needed_headroom; 415 struct sk_buff *skb, *skb2; 416 struct net_device *prev_dev = NULL; 417 int present_fcs_len = 0; 418 419 /* 420 * First, we may need to make a copy of the skb because 421 * (1) we need to modify it for radiotap (if not present), and 422 * (2) the other RX handlers will modify the skb we got. 423 * 424 * We don't need to, of course, if we aren't going to return 425 * the SKB because it has a bad FCS/PLCP checksum. 426 */ 427 428 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) 429 present_fcs_len = FCS_LEN; 430 431 /* ensure hdr->frame_control and vendor radiotap data are in skb head */ 432 if (!pskb_may_pull(origskb, 2 + status->vendor_radiotap_len)) { 433 dev_kfree_skb(origskb); 434 return NULL; 435 } 436 437 if (!local->monitors) { 438 if (should_drop_frame(origskb, present_fcs_len)) { 439 dev_kfree_skb(origskb); 440 return NULL; 441 } 442 443 return remove_monitor_info(local, origskb); 444 } 445 446 /* room for the radiotap header based on driver features */ 447 needed_headroom = ieee80211_rx_radiotap_space(local, status); 448 449 if (should_drop_frame(origskb, present_fcs_len)) { 450 /* only need to expand headroom if necessary */ 451 skb = origskb; 452 origskb = NULL; 453 454 /* 455 * This shouldn't trigger often because most devices have an 456 * RX header they pull before we get here, and that should 457 * be big enough for our radiotap information. We should 458 * probably export the length to drivers so that we can have 459 * them allocate enough headroom to start with. 460 */ 461 if (skb_headroom(skb) < needed_headroom && 462 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) { 463 dev_kfree_skb(skb); 464 return NULL; 465 } 466 } else { 467 /* 468 * Need to make a copy and possibly remove radiotap header 469 * and FCS from the original. 470 */ 471 skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC); 472 473 origskb = remove_monitor_info(local, origskb); 474 475 if (!skb) 476 return origskb; 477 } 478 479 /* prepend radiotap information */ 480 ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom, 481 true); 482 483 skb_reset_mac_header(skb); 484 skb->ip_summed = CHECKSUM_UNNECESSARY; 485 skb->pkt_type = PACKET_OTHERHOST; 486 skb->protocol = htons(ETH_P_802_2); 487 488 list_for_each_entry_rcu(sdata, &local->interfaces, list) { 489 if (sdata->vif.type != NL80211_IFTYPE_MONITOR) 490 continue; 491 492 if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES) 493 continue; 494 495 if (!ieee80211_sdata_running(sdata)) 496 continue; 497 498 if (prev_dev) { 499 skb2 = skb_clone(skb, GFP_ATOMIC); 500 if (skb2) { 501 skb2->dev = prev_dev; 502 netif_receive_skb(skb2); 503 } 504 } 505 506 prev_dev = sdata->dev; 507 sdata->dev->stats.rx_packets++; 508 sdata->dev->stats.rx_bytes += skb->len; 509 } 510 511 if (prev_dev) { 512 skb->dev = prev_dev; 513 netif_receive_skb(skb); 514 } else 515 dev_kfree_skb(skb); 516 517 return origskb; 518 } 519 520 static void ieee80211_parse_qos(struct ieee80211_rx_data *rx) 521 { 522 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 523 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 524 int tid, seqno_idx, security_idx; 525 526 /* does the frame have a qos control field? */ 527 if (ieee80211_is_data_qos(hdr->frame_control)) { 528 u8 *qc = ieee80211_get_qos_ctl(hdr); 529 /* frame has qos control */ 530 tid = *qc & IEEE80211_QOS_CTL_TID_MASK; 531 if (*qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT) 532 status->rx_flags |= IEEE80211_RX_AMSDU; 533 534 seqno_idx = tid; 535 security_idx = tid; 536 } else { 537 /* 538 * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"): 539 * 540 * Sequence numbers for management frames, QoS data 541 * frames with a broadcast/multicast address in the 542 * Address 1 field, and all non-QoS data frames sent 543 * by QoS STAs are assigned using an additional single 544 * modulo-4096 counter, [...] 545 * 546 * We also use that counter for non-QoS STAs. 547 */ 548 seqno_idx = IEEE80211_NUM_TIDS; 549 security_idx = 0; 550 if (ieee80211_is_mgmt(hdr->frame_control)) 551 security_idx = IEEE80211_NUM_TIDS; 552 tid = 0; 553 } 554 555 rx->seqno_idx = seqno_idx; 556 rx->security_idx = security_idx; 557 /* Set skb->priority to 1d tag if highest order bit of TID is not set. 558 * For now, set skb->priority to 0 for other cases. */ 559 rx->skb->priority = (tid > 7) ? 0 : tid; 560 } 561 562 /** 563 * DOC: Packet alignment 564 * 565 * Drivers always need to pass packets that are aligned to two-byte boundaries 566 * to the stack. 567 * 568 * Additionally, should, if possible, align the payload data in a way that 569 * guarantees that the contained IP header is aligned to a four-byte 570 * boundary. In the case of regular frames, this simply means aligning the 571 * payload to a four-byte boundary (because either the IP header is directly 572 * contained, or IV/RFC1042 headers that have a length divisible by four are 573 * in front of it). If the payload data is not properly aligned and the 574 * architecture doesn't support efficient unaligned operations, mac80211 575 * will align the data. 576 * 577 * With A-MSDU frames, however, the payload data address must yield two modulo 578 * four because there are 14-byte 802.3 headers within the A-MSDU frames that 579 * push the IP header further back to a multiple of four again. Thankfully, the 580 * specs were sane enough this time around to require padding each A-MSDU 581 * subframe to a length that is a multiple of four. 582 * 583 * Padding like Atheros hardware adds which is between the 802.11 header and 584 * the payload is not supported, the driver is required to move the 802.11 585 * header to be directly in front of the payload in that case. 586 */ 587 static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx) 588 { 589 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG 590 WARN_ONCE((unsigned long)rx->skb->data & 1, 591 "unaligned packet at 0x%p\n", rx->skb->data); 592 #endif 593 } 594 595 596 /* rx handlers */ 597 598 static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb) 599 { 600 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 601 602 if (skb->len < 24 || is_multicast_ether_addr(hdr->addr1)) 603 return 0; 604 605 return ieee80211_is_robust_mgmt_frame(hdr); 606 } 607 608 609 static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb) 610 { 611 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 612 613 if (skb->len < 24 || !is_multicast_ether_addr(hdr->addr1)) 614 return 0; 615 616 return ieee80211_is_robust_mgmt_frame(hdr); 617 } 618 619 620 /* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */ 621 static int ieee80211_get_mmie_keyidx(struct sk_buff *skb) 622 { 623 struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data; 624 struct ieee80211_mmie *mmie; 625 626 if (skb->len < 24 + sizeof(*mmie) || !is_multicast_ether_addr(hdr->da)) 627 return -1; 628 629 if (!ieee80211_is_robust_mgmt_frame((struct ieee80211_hdr *) hdr)) 630 return -1; /* not a robust management frame */ 631 632 mmie = (struct ieee80211_mmie *) 633 (skb->data + skb->len - sizeof(*mmie)); 634 if (mmie->element_id != WLAN_EID_MMIE || 635 mmie->length != sizeof(*mmie) - 2) 636 return -1; 637 638 return le16_to_cpu(mmie->key_id); 639 } 640 641 static ieee80211_rx_result ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx) 642 { 643 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 644 char *dev_addr = rx->sdata->vif.addr; 645 646 if (ieee80211_is_data(hdr->frame_control)) { 647 if (is_multicast_ether_addr(hdr->addr1)) { 648 if (ieee80211_has_tods(hdr->frame_control) || 649 !ieee80211_has_fromds(hdr->frame_control)) 650 return RX_DROP_MONITOR; 651 if (ether_addr_equal(hdr->addr3, dev_addr)) 652 return RX_DROP_MONITOR; 653 } else { 654 if (!ieee80211_has_a4(hdr->frame_control)) 655 return RX_DROP_MONITOR; 656 if (ether_addr_equal(hdr->addr4, dev_addr)) 657 return RX_DROP_MONITOR; 658 } 659 } 660 661 /* If there is not an established peer link and this is not a peer link 662 * establisment frame, beacon or probe, drop the frame. 663 */ 664 665 if (!rx->sta || sta_plink_state(rx->sta) != NL80211_PLINK_ESTAB) { 666 struct ieee80211_mgmt *mgmt; 667 668 if (!ieee80211_is_mgmt(hdr->frame_control)) 669 return RX_DROP_MONITOR; 670 671 if (ieee80211_is_action(hdr->frame_control)) { 672 u8 category; 673 674 /* make sure category field is present */ 675 if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE) 676 return RX_DROP_MONITOR; 677 678 mgmt = (struct ieee80211_mgmt *)hdr; 679 category = mgmt->u.action.category; 680 if (category != WLAN_CATEGORY_MESH_ACTION && 681 category != WLAN_CATEGORY_SELF_PROTECTED) 682 return RX_DROP_MONITOR; 683 return RX_CONTINUE; 684 } 685 686 if (ieee80211_is_probe_req(hdr->frame_control) || 687 ieee80211_is_probe_resp(hdr->frame_control) || 688 ieee80211_is_beacon(hdr->frame_control) || 689 ieee80211_is_auth(hdr->frame_control)) 690 return RX_CONTINUE; 691 692 return RX_DROP_MONITOR; 693 } 694 695 return RX_CONTINUE; 696 } 697 698 static void ieee80211_release_reorder_frame(struct ieee80211_sub_if_data *sdata, 699 struct tid_ampdu_rx *tid_agg_rx, 700 int index, 701 struct sk_buff_head *frames) 702 { 703 struct sk_buff *skb = tid_agg_rx->reorder_buf[index]; 704 struct ieee80211_rx_status *status; 705 706 lockdep_assert_held(&tid_agg_rx->reorder_lock); 707 708 if (!skb) 709 goto no_frame; 710 711 /* release the frame from the reorder ring buffer */ 712 tid_agg_rx->stored_mpdu_num--; 713 tid_agg_rx->reorder_buf[index] = NULL; 714 status = IEEE80211_SKB_RXCB(skb); 715 status->rx_flags |= IEEE80211_RX_DEFERRED_RELEASE; 716 __skb_queue_tail(frames, skb); 717 718 no_frame: 719 tid_agg_rx->head_seq_num = ieee80211_sn_inc(tid_agg_rx->head_seq_num); 720 } 721 722 static void ieee80211_release_reorder_frames(struct ieee80211_sub_if_data *sdata, 723 struct tid_ampdu_rx *tid_agg_rx, 724 u16 head_seq_num, 725 struct sk_buff_head *frames) 726 { 727 int index; 728 729 lockdep_assert_held(&tid_agg_rx->reorder_lock); 730 731 while (ieee80211_sn_less(tid_agg_rx->head_seq_num, head_seq_num)) { 732 index = ieee80211_sn_sub(tid_agg_rx->head_seq_num, 733 tid_agg_rx->ssn) % 734 tid_agg_rx->buf_size; 735 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index, 736 frames); 737 } 738 } 739 740 /* 741 * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If 742 * the skb was added to the buffer longer than this time ago, the earlier 743 * frames that have not yet been received are assumed to be lost and the skb 744 * can be released for processing. This may also release other skb's from the 745 * reorder buffer if there are no additional gaps between the frames. 746 * 747 * Callers must hold tid_agg_rx->reorder_lock. 748 */ 749 #define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10) 750 751 static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata, 752 struct tid_ampdu_rx *tid_agg_rx, 753 struct sk_buff_head *frames) 754 { 755 int index, j; 756 757 lockdep_assert_held(&tid_agg_rx->reorder_lock); 758 759 /* release the buffer until next missing frame */ 760 index = ieee80211_sn_sub(tid_agg_rx->head_seq_num, 761 tid_agg_rx->ssn) % tid_agg_rx->buf_size; 762 if (!tid_agg_rx->reorder_buf[index] && 763 tid_agg_rx->stored_mpdu_num) { 764 /* 765 * No buffers ready to be released, but check whether any 766 * frames in the reorder buffer have timed out. 767 */ 768 int skipped = 1; 769 for (j = (index + 1) % tid_agg_rx->buf_size; j != index; 770 j = (j + 1) % tid_agg_rx->buf_size) { 771 if (!tid_agg_rx->reorder_buf[j]) { 772 skipped++; 773 continue; 774 } 775 if (skipped && 776 !time_after(jiffies, tid_agg_rx->reorder_time[j] + 777 HT_RX_REORDER_BUF_TIMEOUT)) 778 goto set_release_timer; 779 780 ht_dbg_ratelimited(sdata, 781 "release an RX reorder frame due to timeout on earlier frames\n"); 782 ieee80211_release_reorder_frame(sdata, tid_agg_rx, j, 783 frames); 784 785 /* 786 * Increment the head seq# also for the skipped slots. 787 */ 788 tid_agg_rx->head_seq_num = 789 (tid_agg_rx->head_seq_num + 790 skipped) & IEEE80211_SN_MASK; 791 skipped = 0; 792 } 793 } else while (tid_agg_rx->reorder_buf[index]) { 794 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index, 795 frames); 796 index = ieee80211_sn_sub(tid_agg_rx->head_seq_num, 797 tid_agg_rx->ssn) % 798 tid_agg_rx->buf_size; 799 } 800 801 if (tid_agg_rx->stored_mpdu_num) { 802 j = index = ieee80211_sn_sub(tid_agg_rx->head_seq_num, 803 tid_agg_rx->ssn) % 804 tid_agg_rx->buf_size; 805 806 for (; j != (index - 1) % tid_agg_rx->buf_size; 807 j = (j + 1) % tid_agg_rx->buf_size) { 808 if (tid_agg_rx->reorder_buf[j]) 809 break; 810 } 811 812 set_release_timer: 813 814 mod_timer(&tid_agg_rx->reorder_timer, 815 tid_agg_rx->reorder_time[j] + 1 + 816 HT_RX_REORDER_BUF_TIMEOUT); 817 } else { 818 del_timer(&tid_agg_rx->reorder_timer); 819 } 820 } 821 822 /* 823 * As this function belongs to the RX path it must be under 824 * rcu_read_lock protection. It returns false if the frame 825 * can be processed immediately, true if it was consumed. 826 */ 827 static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata, 828 struct tid_ampdu_rx *tid_agg_rx, 829 struct sk_buff *skb, 830 struct sk_buff_head *frames) 831 { 832 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 833 u16 sc = le16_to_cpu(hdr->seq_ctrl); 834 u16 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4; 835 u16 head_seq_num, buf_size; 836 int index; 837 bool ret = true; 838 839 spin_lock(&tid_agg_rx->reorder_lock); 840 841 buf_size = tid_agg_rx->buf_size; 842 head_seq_num = tid_agg_rx->head_seq_num; 843 844 /* frame with out of date sequence number */ 845 if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) { 846 dev_kfree_skb(skb); 847 goto out; 848 } 849 850 /* 851 * If frame the sequence number exceeds our buffering window 852 * size release some previous frames to make room for this one. 853 */ 854 if (!ieee80211_sn_less(mpdu_seq_num, head_seq_num + buf_size)) { 855 head_seq_num = ieee80211_sn_inc( 856 ieee80211_sn_sub(mpdu_seq_num, buf_size)); 857 /* release stored frames up to new head to stack */ 858 ieee80211_release_reorder_frames(sdata, tid_agg_rx, 859 head_seq_num, frames); 860 } 861 862 /* Now the new frame is always in the range of the reordering buffer */ 863 864 index = ieee80211_sn_sub(mpdu_seq_num, 865 tid_agg_rx->ssn) % tid_agg_rx->buf_size; 866 867 /* check if we already stored this frame */ 868 if (tid_agg_rx->reorder_buf[index]) { 869 dev_kfree_skb(skb); 870 goto out; 871 } 872 873 /* 874 * If the current MPDU is in the right order and nothing else 875 * is stored we can process it directly, no need to buffer it. 876 * If it is first but there's something stored, we may be able 877 * to release frames after this one. 878 */ 879 if (mpdu_seq_num == tid_agg_rx->head_seq_num && 880 tid_agg_rx->stored_mpdu_num == 0) { 881 tid_agg_rx->head_seq_num = 882 ieee80211_sn_inc(tid_agg_rx->head_seq_num); 883 ret = false; 884 goto out; 885 } 886 887 /* put the frame in the reordering buffer */ 888 tid_agg_rx->reorder_buf[index] = skb; 889 tid_agg_rx->reorder_time[index] = jiffies; 890 tid_agg_rx->stored_mpdu_num++; 891 ieee80211_sta_reorder_release(sdata, tid_agg_rx, frames); 892 893 out: 894 spin_unlock(&tid_agg_rx->reorder_lock); 895 return ret; 896 } 897 898 /* 899 * Reorder MPDUs from A-MPDUs, keeping them on a buffer. Returns 900 * true if the MPDU was buffered, false if it should be processed. 901 */ 902 static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx, 903 struct sk_buff_head *frames) 904 { 905 struct sk_buff *skb = rx->skb; 906 struct ieee80211_local *local = rx->local; 907 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 908 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 909 struct sta_info *sta = rx->sta; 910 struct tid_ampdu_rx *tid_agg_rx; 911 u16 sc; 912 u8 tid, ack_policy; 913 914 if (!ieee80211_is_data_qos(hdr->frame_control)) 915 goto dont_reorder; 916 917 /* 918 * filter the QoS data rx stream according to 919 * STA/TID and check if this STA/TID is on aggregation 920 */ 921 922 if (!sta) 923 goto dont_reorder; 924 925 ack_policy = *ieee80211_get_qos_ctl(hdr) & 926 IEEE80211_QOS_CTL_ACK_POLICY_MASK; 927 tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK; 928 929 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]); 930 if (!tid_agg_rx) 931 goto dont_reorder; 932 933 /* qos null data frames are excluded */ 934 if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC))) 935 goto dont_reorder; 936 937 /* not part of a BA session */ 938 if (ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK && 939 ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_NORMAL) 940 goto dont_reorder; 941 942 /* not actually part of this BA session */ 943 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH)) 944 goto dont_reorder; 945 946 /* new, potentially un-ordered, ampdu frame - process it */ 947 948 /* reset session timer */ 949 if (tid_agg_rx->timeout) 950 tid_agg_rx->last_rx = jiffies; 951 952 /* if this mpdu is fragmented - terminate rx aggregation session */ 953 sc = le16_to_cpu(hdr->seq_ctrl); 954 if (sc & IEEE80211_SCTL_FRAG) { 955 skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME; 956 skb_queue_tail(&rx->sdata->skb_queue, skb); 957 ieee80211_queue_work(&local->hw, &rx->sdata->work); 958 return; 959 } 960 961 /* 962 * No locking needed -- we will only ever process one 963 * RX packet at a time, and thus own tid_agg_rx. All 964 * other code manipulating it needs to (and does) make 965 * sure that we cannot get to it any more before doing 966 * anything with it. 967 */ 968 if (ieee80211_sta_manage_reorder_buf(rx->sdata, tid_agg_rx, skb, 969 frames)) 970 return; 971 972 dont_reorder: 973 __skb_queue_tail(frames, skb); 974 } 975 976 static ieee80211_rx_result debug_noinline 977 ieee80211_rx_h_check(struct ieee80211_rx_data *rx) 978 { 979 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 980 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 981 982 /* 983 * Drop duplicate 802.11 retransmissions 984 * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery") 985 */ 986 if (rx->skb->len >= 24 && rx->sta && 987 !ieee80211_is_ctl(hdr->frame_control) && 988 !ieee80211_is_qos_nullfunc(hdr->frame_control) && 989 !is_multicast_ether_addr(hdr->addr1)) { 990 if (unlikely(ieee80211_has_retry(hdr->frame_control) && 991 rx->sta->last_seq_ctrl[rx->seqno_idx] == 992 hdr->seq_ctrl)) { 993 if (status->rx_flags & IEEE80211_RX_RA_MATCH) { 994 rx->local->dot11FrameDuplicateCount++; 995 rx->sta->num_duplicates++; 996 } 997 return RX_DROP_UNUSABLE; 998 } else 999 rx->sta->last_seq_ctrl[rx->seqno_idx] = hdr->seq_ctrl; 1000 } 1001 1002 if (unlikely(rx->skb->len < 16)) { 1003 I802_DEBUG_INC(rx->local->rx_handlers_drop_short); 1004 return RX_DROP_MONITOR; 1005 } 1006 1007 /* Drop disallowed frame classes based on STA auth/assoc state; 1008 * IEEE 802.11, Chap 5.5. 1009 * 1010 * mac80211 filters only based on association state, i.e. it drops 1011 * Class 3 frames from not associated stations. hostapd sends 1012 * deauth/disassoc frames when needed. In addition, hostapd is 1013 * responsible for filtering on both auth and assoc states. 1014 */ 1015 1016 if (ieee80211_vif_is_mesh(&rx->sdata->vif)) 1017 return ieee80211_rx_mesh_check(rx); 1018 1019 if (unlikely((ieee80211_is_data(hdr->frame_control) || 1020 ieee80211_is_pspoll(hdr->frame_control)) && 1021 rx->sdata->vif.type != NL80211_IFTYPE_ADHOC && 1022 rx->sdata->vif.type != NL80211_IFTYPE_WDS && 1023 (!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_ASSOC)))) { 1024 /* 1025 * accept port control frames from the AP even when it's not 1026 * yet marked ASSOC to prevent a race where we don't set the 1027 * assoc bit quickly enough before it sends the first frame 1028 */ 1029 if (rx->sta && rx->sdata->vif.type == NL80211_IFTYPE_STATION && 1030 ieee80211_is_data_present(hdr->frame_control)) { 1031 unsigned int hdrlen; 1032 __be16 ethertype; 1033 1034 hdrlen = ieee80211_hdrlen(hdr->frame_control); 1035 1036 if (rx->skb->len < hdrlen + 8) 1037 return RX_DROP_MONITOR; 1038 1039 skb_copy_bits(rx->skb, hdrlen + 6, ðertype, 2); 1040 if (ethertype == rx->sdata->control_port_protocol) 1041 return RX_CONTINUE; 1042 } 1043 1044 if (rx->sdata->vif.type == NL80211_IFTYPE_AP && 1045 cfg80211_rx_spurious_frame(rx->sdata->dev, 1046 hdr->addr2, 1047 GFP_ATOMIC)) 1048 return RX_DROP_UNUSABLE; 1049 1050 return RX_DROP_MONITOR; 1051 } 1052 1053 return RX_CONTINUE; 1054 } 1055 1056 1057 static ieee80211_rx_result debug_noinline 1058 ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx) 1059 { 1060 struct ieee80211_local *local; 1061 struct ieee80211_hdr *hdr; 1062 struct sk_buff *skb; 1063 1064 local = rx->local; 1065 skb = rx->skb; 1066 hdr = (struct ieee80211_hdr *) skb->data; 1067 1068 if (!local->pspolling) 1069 return RX_CONTINUE; 1070 1071 if (!ieee80211_has_fromds(hdr->frame_control)) 1072 /* this is not from AP */ 1073 return RX_CONTINUE; 1074 1075 if (!ieee80211_is_data(hdr->frame_control)) 1076 return RX_CONTINUE; 1077 1078 if (!ieee80211_has_moredata(hdr->frame_control)) { 1079 /* AP has no more frames buffered for us */ 1080 local->pspolling = false; 1081 return RX_CONTINUE; 1082 } 1083 1084 /* more data bit is set, let's request a new frame from the AP */ 1085 ieee80211_send_pspoll(local, rx->sdata); 1086 1087 return RX_CONTINUE; 1088 } 1089 1090 static void sta_ps_start(struct sta_info *sta) 1091 { 1092 struct ieee80211_sub_if_data *sdata = sta->sdata; 1093 struct ieee80211_local *local = sdata->local; 1094 struct ps_data *ps; 1095 1096 if (sta->sdata->vif.type == NL80211_IFTYPE_AP || 1097 sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) 1098 ps = &sdata->bss->ps; 1099 else 1100 return; 1101 1102 atomic_inc(&ps->num_sta_ps); 1103 set_sta_flag(sta, WLAN_STA_PS_STA); 1104 if (!(local->hw.flags & IEEE80211_HW_AP_LINK_PS)) 1105 drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta); 1106 ps_dbg(sdata, "STA %pM aid %d enters power save mode\n", 1107 sta->sta.addr, sta->sta.aid); 1108 } 1109 1110 static void sta_ps_end(struct sta_info *sta) 1111 { 1112 ps_dbg(sta->sdata, "STA %pM aid %d exits power save mode\n", 1113 sta->sta.addr, sta->sta.aid); 1114 1115 if (test_sta_flag(sta, WLAN_STA_PS_DRIVER)) { 1116 ps_dbg(sta->sdata, "STA %pM aid %d driver-ps-blocked\n", 1117 sta->sta.addr, sta->sta.aid); 1118 return; 1119 } 1120 1121 ieee80211_sta_ps_deliver_wakeup(sta); 1122 } 1123 1124 int ieee80211_sta_ps_transition(struct ieee80211_sta *sta, bool start) 1125 { 1126 struct sta_info *sta_inf = container_of(sta, struct sta_info, sta); 1127 bool in_ps; 1128 1129 WARN_ON(!(sta_inf->local->hw.flags & IEEE80211_HW_AP_LINK_PS)); 1130 1131 /* Don't let the same PS state be set twice */ 1132 in_ps = test_sta_flag(sta_inf, WLAN_STA_PS_STA); 1133 if ((start && in_ps) || (!start && !in_ps)) 1134 return -EINVAL; 1135 1136 if (start) 1137 sta_ps_start(sta_inf); 1138 else 1139 sta_ps_end(sta_inf); 1140 1141 return 0; 1142 } 1143 EXPORT_SYMBOL(ieee80211_sta_ps_transition); 1144 1145 static ieee80211_rx_result debug_noinline 1146 ieee80211_rx_h_uapsd_and_pspoll(struct ieee80211_rx_data *rx) 1147 { 1148 struct ieee80211_sub_if_data *sdata = rx->sdata; 1149 struct ieee80211_hdr *hdr = (void *)rx->skb->data; 1150 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 1151 int tid, ac; 1152 1153 if (!rx->sta || !(status->rx_flags & IEEE80211_RX_RA_MATCH)) 1154 return RX_CONTINUE; 1155 1156 if (sdata->vif.type != NL80211_IFTYPE_AP && 1157 sdata->vif.type != NL80211_IFTYPE_AP_VLAN) 1158 return RX_CONTINUE; 1159 1160 /* 1161 * The device handles station powersave, so don't do anything about 1162 * uAPSD and PS-Poll frames (the latter shouldn't even come up from 1163 * it to mac80211 since they're handled.) 1164 */ 1165 if (sdata->local->hw.flags & IEEE80211_HW_AP_LINK_PS) 1166 return RX_CONTINUE; 1167 1168 /* 1169 * Don't do anything if the station isn't already asleep. In 1170 * the uAPSD case, the station will probably be marked asleep, 1171 * in the PS-Poll case the station must be confused ... 1172 */ 1173 if (!test_sta_flag(rx->sta, WLAN_STA_PS_STA)) 1174 return RX_CONTINUE; 1175 1176 if (unlikely(ieee80211_is_pspoll(hdr->frame_control))) { 1177 if (!test_sta_flag(rx->sta, WLAN_STA_SP)) { 1178 if (!test_sta_flag(rx->sta, WLAN_STA_PS_DRIVER)) 1179 ieee80211_sta_ps_deliver_poll_response(rx->sta); 1180 else 1181 set_sta_flag(rx->sta, WLAN_STA_PSPOLL); 1182 } 1183 1184 /* Free PS Poll skb here instead of returning RX_DROP that would 1185 * count as an dropped frame. */ 1186 dev_kfree_skb(rx->skb); 1187 1188 return RX_QUEUED; 1189 } else if (!ieee80211_has_morefrags(hdr->frame_control) && 1190 !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) && 1191 ieee80211_has_pm(hdr->frame_control) && 1192 (ieee80211_is_data_qos(hdr->frame_control) || 1193 ieee80211_is_qos_nullfunc(hdr->frame_control))) { 1194 tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK; 1195 ac = ieee802_1d_to_ac[tid & 7]; 1196 1197 /* 1198 * If this AC is not trigger-enabled do nothing. 1199 * 1200 * NB: This could/should check a separate bitmap of trigger- 1201 * enabled queues, but for now we only implement uAPSD w/o 1202 * TSPEC changes to the ACs, so they're always the same. 1203 */ 1204 if (!(rx->sta->sta.uapsd_queues & BIT(ac))) 1205 return RX_CONTINUE; 1206 1207 /* if we are in a service period, do nothing */ 1208 if (test_sta_flag(rx->sta, WLAN_STA_SP)) 1209 return RX_CONTINUE; 1210 1211 if (!test_sta_flag(rx->sta, WLAN_STA_PS_DRIVER)) 1212 ieee80211_sta_ps_deliver_uapsd(rx->sta); 1213 else 1214 set_sta_flag(rx->sta, WLAN_STA_UAPSD); 1215 } 1216 1217 return RX_CONTINUE; 1218 } 1219 1220 static ieee80211_rx_result debug_noinline 1221 ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx) 1222 { 1223 struct sta_info *sta = rx->sta; 1224 struct sk_buff *skb = rx->skb; 1225 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 1226 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; 1227 int i; 1228 1229 if (!sta) 1230 return RX_CONTINUE; 1231 1232 /* 1233 * Update last_rx only for IBSS packets which are for the current 1234 * BSSID and for station already AUTHORIZED to avoid keeping the 1235 * current IBSS network alive in cases where other STAs start 1236 * using different BSSID. This will also give the station another 1237 * chance to restart the authentication/authorization in case 1238 * something went wrong the first time. 1239 */ 1240 if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) { 1241 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len, 1242 NL80211_IFTYPE_ADHOC); 1243 if (ether_addr_equal(bssid, rx->sdata->u.ibss.bssid) && 1244 test_sta_flag(sta, WLAN_STA_AUTHORIZED)) { 1245 sta->last_rx = jiffies; 1246 if (ieee80211_is_data(hdr->frame_control)) { 1247 sta->last_rx_rate_idx = status->rate_idx; 1248 sta->last_rx_rate_flag = status->flag; 1249 sta->last_rx_rate_vht_nss = status->vht_nss; 1250 } 1251 } 1252 } else if (!is_multicast_ether_addr(hdr->addr1)) { 1253 /* 1254 * Mesh beacons will update last_rx when if they are found to 1255 * match the current local configuration when processed. 1256 */ 1257 sta->last_rx = jiffies; 1258 if (ieee80211_is_data(hdr->frame_control)) { 1259 sta->last_rx_rate_idx = status->rate_idx; 1260 sta->last_rx_rate_flag = status->flag; 1261 sta->last_rx_rate_vht_nss = status->vht_nss; 1262 } 1263 } 1264 1265 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH)) 1266 return RX_CONTINUE; 1267 1268 if (rx->sdata->vif.type == NL80211_IFTYPE_STATION) 1269 ieee80211_sta_rx_notify(rx->sdata, hdr); 1270 1271 sta->rx_fragments++; 1272 sta->rx_bytes += rx->skb->len; 1273 if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) { 1274 sta->last_signal = status->signal; 1275 ewma_add(&sta->avg_signal, -status->signal); 1276 } 1277 1278 if (status->chains) { 1279 sta->chains = status->chains; 1280 for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) { 1281 int signal = status->chain_signal[i]; 1282 1283 if (!(status->chains & BIT(i))) 1284 continue; 1285 1286 sta->chain_signal_last[i] = signal; 1287 ewma_add(&sta->chain_signal_avg[i], -signal); 1288 } 1289 } 1290 1291 /* 1292 * Change STA power saving mode only at the end of a frame 1293 * exchange sequence. 1294 */ 1295 if (!(sta->local->hw.flags & IEEE80211_HW_AP_LINK_PS) && 1296 !ieee80211_has_morefrags(hdr->frame_control) && 1297 !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) && 1298 (rx->sdata->vif.type == NL80211_IFTYPE_AP || 1299 rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) { 1300 if (test_sta_flag(sta, WLAN_STA_PS_STA)) { 1301 /* 1302 * Ignore doze->wake transitions that are 1303 * indicated by non-data frames, the standard 1304 * is unclear here, but for example going to 1305 * PS mode and then scanning would cause a 1306 * doze->wake transition for the probe request, 1307 * and that is clearly undesirable. 1308 */ 1309 if (ieee80211_is_data(hdr->frame_control) && 1310 !ieee80211_has_pm(hdr->frame_control)) 1311 sta_ps_end(sta); 1312 } else { 1313 if (ieee80211_has_pm(hdr->frame_control)) 1314 sta_ps_start(sta); 1315 } 1316 } 1317 1318 /* mesh power save support */ 1319 if (ieee80211_vif_is_mesh(&rx->sdata->vif)) 1320 ieee80211_mps_rx_h_sta_process(sta, hdr); 1321 1322 /* 1323 * Drop (qos-)data::nullfunc frames silently, since they 1324 * are used only to control station power saving mode. 1325 */ 1326 if (ieee80211_is_nullfunc(hdr->frame_control) || 1327 ieee80211_is_qos_nullfunc(hdr->frame_control)) { 1328 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc); 1329 1330 /* 1331 * If we receive a 4-addr nullfunc frame from a STA 1332 * that was not moved to a 4-addr STA vlan yet send 1333 * the event to userspace and for older hostapd drop 1334 * the frame to the monitor interface. 1335 */ 1336 if (ieee80211_has_a4(hdr->frame_control) && 1337 (rx->sdata->vif.type == NL80211_IFTYPE_AP || 1338 (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN && 1339 !rx->sdata->u.vlan.sta))) { 1340 if (!test_and_set_sta_flag(sta, WLAN_STA_4ADDR_EVENT)) 1341 cfg80211_rx_unexpected_4addr_frame( 1342 rx->sdata->dev, sta->sta.addr, 1343 GFP_ATOMIC); 1344 return RX_DROP_MONITOR; 1345 } 1346 /* 1347 * Update counter and free packet here to avoid 1348 * counting this as a dropped packed. 1349 */ 1350 sta->rx_packets++; 1351 dev_kfree_skb(rx->skb); 1352 return RX_QUEUED; 1353 } 1354 1355 return RX_CONTINUE; 1356 } /* ieee80211_rx_h_sta_process */ 1357 1358 static ieee80211_rx_result debug_noinline 1359 ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx) 1360 { 1361 struct sk_buff *skb = rx->skb; 1362 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 1363 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; 1364 int keyidx; 1365 int hdrlen; 1366 ieee80211_rx_result result = RX_DROP_UNUSABLE; 1367 struct ieee80211_key *sta_ptk = NULL; 1368 int mmie_keyidx = -1; 1369 __le16 fc; 1370 1371 /* 1372 * Key selection 101 1373 * 1374 * There are four types of keys: 1375 * - GTK (group keys) 1376 * - IGTK (group keys for management frames) 1377 * - PTK (pairwise keys) 1378 * - STK (station-to-station pairwise keys) 1379 * 1380 * When selecting a key, we have to distinguish between multicast 1381 * (including broadcast) and unicast frames, the latter can only 1382 * use PTKs and STKs while the former always use GTKs and IGTKs. 1383 * Unless, of course, actual WEP keys ("pre-RSNA") are used, then 1384 * unicast frames can also use key indices like GTKs. Hence, if we 1385 * don't have a PTK/STK we check the key index for a WEP key. 1386 * 1387 * Note that in a regular BSS, multicast frames are sent by the 1388 * AP only, associated stations unicast the frame to the AP first 1389 * which then multicasts it on their behalf. 1390 * 1391 * There is also a slight problem in IBSS mode: GTKs are negotiated 1392 * with each station, that is something we don't currently handle. 1393 * The spec seems to expect that one negotiates the same key with 1394 * every station but there's no such requirement; VLANs could be 1395 * possible. 1396 */ 1397 1398 /* 1399 * No point in finding a key and decrypting if the frame is neither 1400 * addressed to us nor a multicast frame. 1401 */ 1402 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH)) 1403 return RX_CONTINUE; 1404 1405 /* start without a key */ 1406 rx->key = NULL; 1407 1408 if (rx->sta) 1409 sta_ptk = rcu_dereference(rx->sta->ptk); 1410 1411 fc = hdr->frame_control; 1412 1413 if (!ieee80211_has_protected(fc)) 1414 mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb); 1415 1416 if (!is_multicast_ether_addr(hdr->addr1) && sta_ptk) { 1417 rx->key = sta_ptk; 1418 if ((status->flag & RX_FLAG_DECRYPTED) && 1419 (status->flag & RX_FLAG_IV_STRIPPED)) 1420 return RX_CONTINUE; 1421 /* Skip decryption if the frame is not protected. */ 1422 if (!ieee80211_has_protected(fc)) 1423 return RX_CONTINUE; 1424 } else if (mmie_keyidx >= 0) { 1425 /* Broadcast/multicast robust management frame / BIP */ 1426 if ((status->flag & RX_FLAG_DECRYPTED) && 1427 (status->flag & RX_FLAG_IV_STRIPPED)) 1428 return RX_CONTINUE; 1429 1430 if (mmie_keyidx < NUM_DEFAULT_KEYS || 1431 mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS) 1432 return RX_DROP_MONITOR; /* unexpected BIP keyidx */ 1433 if (rx->sta) 1434 rx->key = rcu_dereference(rx->sta->gtk[mmie_keyidx]); 1435 if (!rx->key) 1436 rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]); 1437 } else if (!ieee80211_has_protected(fc)) { 1438 /* 1439 * The frame was not protected, so skip decryption. However, we 1440 * need to set rx->key if there is a key that could have been 1441 * used so that the frame may be dropped if encryption would 1442 * have been expected. 1443 */ 1444 struct ieee80211_key *key = NULL; 1445 struct ieee80211_sub_if_data *sdata = rx->sdata; 1446 int i; 1447 1448 if (ieee80211_is_mgmt(fc) && 1449 is_multicast_ether_addr(hdr->addr1) && 1450 (key = rcu_dereference(rx->sdata->default_mgmt_key))) 1451 rx->key = key; 1452 else { 1453 if (rx->sta) { 1454 for (i = 0; i < NUM_DEFAULT_KEYS; i++) { 1455 key = rcu_dereference(rx->sta->gtk[i]); 1456 if (key) 1457 break; 1458 } 1459 } 1460 if (!key) { 1461 for (i = 0; i < NUM_DEFAULT_KEYS; i++) { 1462 key = rcu_dereference(sdata->keys[i]); 1463 if (key) 1464 break; 1465 } 1466 } 1467 if (key) 1468 rx->key = key; 1469 } 1470 return RX_CONTINUE; 1471 } else { 1472 u8 keyid; 1473 /* 1474 * The device doesn't give us the IV so we won't be 1475 * able to look up the key. That's ok though, we 1476 * don't need to decrypt the frame, we just won't 1477 * be able to keep statistics accurate. 1478 * Except for key threshold notifications, should 1479 * we somehow allow the driver to tell us which key 1480 * the hardware used if this flag is set? 1481 */ 1482 if ((status->flag & RX_FLAG_DECRYPTED) && 1483 (status->flag & RX_FLAG_IV_STRIPPED)) 1484 return RX_CONTINUE; 1485 1486 hdrlen = ieee80211_hdrlen(fc); 1487 1488 if (rx->skb->len < 8 + hdrlen) 1489 return RX_DROP_UNUSABLE; /* TODO: count this? */ 1490 1491 /* 1492 * no need to call ieee80211_wep_get_keyidx, 1493 * it verifies a bunch of things we've done already 1494 */ 1495 skb_copy_bits(rx->skb, hdrlen + 3, &keyid, 1); 1496 keyidx = keyid >> 6; 1497 1498 /* check per-station GTK first, if multicast packet */ 1499 if (is_multicast_ether_addr(hdr->addr1) && rx->sta) 1500 rx->key = rcu_dereference(rx->sta->gtk[keyidx]); 1501 1502 /* if not found, try default key */ 1503 if (!rx->key) { 1504 rx->key = rcu_dereference(rx->sdata->keys[keyidx]); 1505 1506 /* 1507 * RSNA-protected unicast frames should always be 1508 * sent with pairwise or station-to-station keys, 1509 * but for WEP we allow using a key index as well. 1510 */ 1511 if (rx->key && 1512 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 && 1513 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 && 1514 !is_multicast_ether_addr(hdr->addr1)) 1515 rx->key = NULL; 1516 } 1517 } 1518 1519 if (rx->key) { 1520 if (unlikely(rx->key->flags & KEY_FLAG_TAINTED)) 1521 return RX_DROP_MONITOR; 1522 1523 rx->key->tx_rx_count++; 1524 /* TODO: add threshold stuff again */ 1525 } else { 1526 return RX_DROP_MONITOR; 1527 } 1528 1529 switch (rx->key->conf.cipher) { 1530 case WLAN_CIPHER_SUITE_WEP40: 1531 case WLAN_CIPHER_SUITE_WEP104: 1532 result = ieee80211_crypto_wep_decrypt(rx); 1533 break; 1534 case WLAN_CIPHER_SUITE_TKIP: 1535 result = ieee80211_crypto_tkip_decrypt(rx); 1536 break; 1537 case WLAN_CIPHER_SUITE_CCMP: 1538 result = ieee80211_crypto_ccmp_decrypt(rx); 1539 break; 1540 case WLAN_CIPHER_SUITE_AES_CMAC: 1541 result = ieee80211_crypto_aes_cmac_decrypt(rx); 1542 break; 1543 default: 1544 /* 1545 * We can reach here only with HW-only algorithms 1546 * but why didn't it decrypt the frame?! 1547 */ 1548 return RX_DROP_UNUSABLE; 1549 } 1550 1551 /* the hdr variable is invalid after the decrypt handlers */ 1552 1553 /* either the frame has been decrypted or will be dropped */ 1554 status->flag |= RX_FLAG_DECRYPTED; 1555 1556 return result; 1557 } 1558 1559 static inline struct ieee80211_fragment_entry * 1560 ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata, 1561 unsigned int frag, unsigned int seq, int rx_queue, 1562 struct sk_buff **skb) 1563 { 1564 struct ieee80211_fragment_entry *entry; 1565 1566 entry = &sdata->fragments[sdata->fragment_next++]; 1567 if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX) 1568 sdata->fragment_next = 0; 1569 1570 if (!skb_queue_empty(&entry->skb_list)) 1571 __skb_queue_purge(&entry->skb_list); 1572 1573 __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */ 1574 *skb = NULL; 1575 entry->first_frag_time = jiffies; 1576 entry->seq = seq; 1577 entry->rx_queue = rx_queue; 1578 entry->last_frag = frag; 1579 entry->ccmp = 0; 1580 entry->extra_len = 0; 1581 1582 return entry; 1583 } 1584 1585 static inline struct ieee80211_fragment_entry * 1586 ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata, 1587 unsigned int frag, unsigned int seq, 1588 int rx_queue, struct ieee80211_hdr *hdr) 1589 { 1590 struct ieee80211_fragment_entry *entry; 1591 int i, idx; 1592 1593 idx = sdata->fragment_next; 1594 for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) { 1595 struct ieee80211_hdr *f_hdr; 1596 1597 idx--; 1598 if (idx < 0) 1599 idx = IEEE80211_FRAGMENT_MAX - 1; 1600 1601 entry = &sdata->fragments[idx]; 1602 if (skb_queue_empty(&entry->skb_list) || entry->seq != seq || 1603 entry->rx_queue != rx_queue || 1604 entry->last_frag + 1 != frag) 1605 continue; 1606 1607 f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data; 1608 1609 /* 1610 * Check ftype and addresses are equal, else check next fragment 1611 */ 1612 if (((hdr->frame_control ^ f_hdr->frame_control) & 1613 cpu_to_le16(IEEE80211_FCTL_FTYPE)) || 1614 !ether_addr_equal(hdr->addr1, f_hdr->addr1) || 1615 !ether_addr_equal(hdr->addr2, f_hdr->addr2)) 1616 continue; 1617 1618 if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) { 1619 __skb_queue_purge(&entry->skb_list); 1620 continue; 1621 } 1622 return entry; 1623 } 1624 1625 return NULL; 1626 } 1627 1628 static ieee80211_rx_result debug_noinline 1629 ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx) 1630 { 1631 struct ieee80211_hdr *hdr; 1632 u16 sc; 1633 __le16 fc; 1634 unsigned int frag, seq; 1635 struct ieee80211_fragment_entry *entry; 1636 struct sk_buff *skb; 1637 struct ieee80211_rx_status *status; 1638 1639 hdr = (struct ieee80211_hdr *)rx->skb->data; 1640 fc = hdr->frame_control; 1641 1642 if (ieee80211_is_ctl(fc)) 1643 return RX_CONTINUE; 1644 1645 sc = le16_to_cpu(hdr->seq_ctrl); 1646 frag = sc & IEEE80211_SCTL_FRAG; 1647 1648 if (likely((!ieee80211_has_morefrags(fc) && frag == 0) || 1649 is_multicast_ether_addr(hdr->addr1))) { 1650 /* not fragmented */ 1651 goto out; 1652 } 1653 I802_DEBUG_INC(rx->local->rx_handlers_fragments); 1654 1655 if (skb_linearize(rx->skb)) 1656 return RX_DROP_UNUSABLE; 1657 1658 /* 1659 * skb_linearize() might change the skb->data and 1660 * previously cached variables (in this case, hdr) need to 1661 * be refreshed with the new data. 1662 */ 1663 hdr = (struct ieee80211_hdr *)rx->skb->data; 1664 seq = (sc & IEEE80211_SCTL_SEQ) >> 4; 1665 1666 if (frag == 0) { 1667 /* This is the first fragment of a new frame. */ 1668 entry = ieee80211_reassemble_add(rx->sdata, frag, seq, 1669 rx->seqno_idx, &(rx->skb)); 1670 if (rx->key && rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP && 1671 ieee80211_has_protected(fc)) { 1672 int queue = rx->security_idx; 1673 /* Store CCMP PN so that we can verify that the next 1674 * fragment has a sequential PN value. */ 1675 entry->ccmp = 1; 1676 memcpy(entry->last_pn, 1677 rx->key->u.ccmp.rx_pn[queue], 1678 IEEE80211_CCMP_PN_LEN); 1679 } 1680 return RX_QUEUED; 1681 } 1682 1683 /* This is a fragment for a frame that should already be pending in 1684 * fragment cache. Add this fragment to the end of the pending entry. 1685 */ 1686 entry = ieee80211_reassemble_find(rx->sdata, frag, seq, 1687 rx->seqno_idx, hdr); 1688 if (!entry) { 1689 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag); 1690 return RX_DROP_MONITOR; 1691 } 1692 1693 /* Verify that MPDUs within one MSDU have sequential PN values. 1694 * (IEEE 802.11i, 8.3.3.4.5) */ 1695 if (entry->ccmp) { 1696 int i; 1697 u8 pn[IEEE80211_CCMP_PN_LEN], *rpn; 1698 int queue; 1699 if (!rx->key || rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP) 1700 return RX_DROP_UNUSABLE; 1701 memcpy(pn, entry->last_pn, IEEE80211_CCMP_PN_LEN); 1702 for (i = IEEE80211_CCMP_PN_LEN - 1; i >= 0; i--) { 1703 pn[i]++; 1704 if (pn[i]) 1705 break; 1706 } 1707 queue = rx->security_idx; 1708 rpn = rx->key->u.ccmp.rx_pn[queue]; 1709 if (memcmp(pn, rpn, IEEE80211_CCMP_PN_LEN)) 1710 return RX_DROP_UNUSABLE; 1711 memcpy(entry->last_pn, pn, IEEE80211_CCMP_PN_LEN); 1712 } 1713 1714 skb_pull(rx->skb, ieee80211_hdrlen(fc)); 1715 __skb_queue_tail(&entry->skb_list, rx->skb); 1716 entry->last_frag = frag; 1717 entry->extra_len += rx->skb->len; 1718 if (ieee80211_has_morefrags(fc)) { 1719 rx->skb = NULL; 1720 return RX_QUEUED; 1721 } 1722 1723 rx->skb = __skb_dequeue(&entry->skb_list); 1724 if (skb_tailroom(rx->skb) < entry->extra_len) { 1725 I802_DEBUG_INC(rx->local->rx_expand_skb_head2); 1726 if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len, 1727 GFP_ATOMIC))) { 1728 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag); 1729 __skb_queue_purge(&entry->skb_list); 1730 return RX_DROP_UNUSABLE; 1731 } 1732 } 1733 while ((skb = __skb_dequeue(&entry->skb_list))) { 1734 memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len); 1735 dev_kfree_skb(skb); 1736 } 1737 1738 /* Complete frame has been reassembled - process it now */ 1739 status = IEEE80211_SKB_RXCB(rx->skb); 1740 status->rx_flags |= IEEE80211_RX_FRAGMENTED; 1741 1742 out: 1743 if (rx->sta) 1744 rx->sta->rx_packets++; 1745 if (is_multicast_ether_addr(hdr->addr1)) 1746 rx->local->dot11MulticastReceivedFrameCount++; 1747 else 1748 ieee80211_led_rx(rx->local); 1749 return RX_CONTINUE; 1750 } 1751 1752 static int ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx) 1753 { 1754 if (unlikely(!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_AUTHORIZED))) 1755 return -EACCES; 1756 1757 return 0; 1758 } 1759 1760 static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc) 1761 { 1762 struct sk_buff *skb = rx->skb; 1763 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 1764 1765 /* 1766 * Pass through unencrypted frames if the hardware has 1767 * decrypted them already. 1768 */ 1769 if (status->flag & RX_FLAG_DECRYPTED) 1770 return 0; 1771 1772 /* Drop unencrypted frames if key is set. */ 1773 if (unlikely(!ieee80211_has_protected(fc) && 1774 !ieee80211_is_nullfunc(fc) && 1775 ieee80211_is_data(fc) && 1776 (rx->key || rx->sdata->drop_unencrypted))) 1777 return -EACCES; 1778 1779 return 0; 1780 } 1781 1782 static int ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx) 1783 { 1784 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 1785 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 1786 __le16 fc = hdr->frame_control; 1787 1788 /* 1789 * Pass through unencrypted frames if the hardware has 1790 * decrypted them already. 1791 */ 1792 if (status->flag & RX_FLAG_DECRYPTED) 1793 return 0; 1794 1795 if (rx->sta && test_sta_flag(rx->sta, WLAN_STA_MFP)) { 1796 if (unlikely(!ieee80211_has_protected(fc) && 1797 ieee80211_is_unicast_robust_mgmt_frame(rx->skb) && 1798 rx->key)) { 1799 if (ieee80211_is_deauth(fc) || 1800 ieee80211_is_disassoc(fc)) 1801 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev, 1802 rx->skb->data, 1803 rx->skb->len); 1804 return -EACCES; 1805 } 1806 /* BIP does not use Protected field, so need to check MMIE */ 1807 if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) && 1808 ieee80211_get_mmie_keyidx(rx->skb) < 0)) { 1809 if (ieee80211_is_deauth(fc) || 1810 ieee80211_is_disassoc(fc)) 1811 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev, 1812 rx->skb->data, 1813 rx->skb->len); 1814 return -EACCES; 1815 } 1816 /* 1817 * When using MFP, Action frames are not allowed prior to 1818 * having configured keys. 1819 */ 1820 if (unlikely(ieee80211_is_action(fc) && !rx->key && 1821 ieee80211_is_robust_mgmt_frame( 1822 (struct ieee80211_hdr *) rx->skb->data))) 1823 return -EACCES; 1824 } 1825 1826 return 0; 1827 } 1828 1829 static int 1830 __ieee80211_data_to_8023(struct ieee80211_rx_data *rx, bool *port_control) 1831 { 1832 struct ieee80211_sub_if_data *sdata = rx->sdata; 1833 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 1834 bool check_port_control = false; 1835 struct ethhdr *ehdr; 1836 int ret; 1837 1838 *port_control = false; 1839 if (ieee80211_has_a4(hdr->frame_control) && 1840 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta) 1841 return -1; 1842 1843 if (sdata->vif.type == NL80211_IFTYPE_STATION && 1844 !!sdata->u.mgd.use_4addr != !!ieee80211_has_a4(hdr->frame_control)) { 1845 1846 if (!sdata->u.mgd.use_4addr) 1847 return -1; 1848 else 1849 check_port_control = true; 1850 } 1851 1852 if (is_multicast_ether_addr(hdr->addr1) && 1853 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta) 1854 return -1; 1855 1856 ret = ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type); 1857 if (ret < 0) 1858 return ret; 1859 1860 ehdr = (struct ethhdr *) rx->skb->data; 1861 if (ehdr->h_proto == rx->sdata->control_port_protocol) 1862 *port_control = true; 1863 else if (check_port_control) 1864 return -1; 1865 1866 return 0; 1867 } 1868 1869 /* 1870 * requires that rx->skb is a frame with ethernet header 1871 */ 1872 static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc) 1873 { 1874 static const u8 pae_group_addr[ETH_ALEN] __aligned(2) 1875 = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 }; 1876 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data; 1877 1878 /* 1879 * Allow EAPOL frames to us/the PAE group address regardless 1880 * of whether the frame was encrypted or not. 1881 */ 1882 if (ehdr->h_proto == rx->sdata->control_port_protocol && 1883 (ether_addr_equal(ehdr->h_dest, rx->sdata->vif.addr) || 1884 ether_addr_equal(ehdr->h_dest, pae_group_addr))) 1885 return true; 1886 1887 if (ieee80211_802_1x_port_control(rx) || 1888 ieee80211_drop_unencrypted(rx, fc)) 1889 return false; 1890 1891 return true; 1892 } 1893 1894 /* 1895 * requires that rx->skb is a frame with ethernet header 1896 */ 1897 static void 1898 ieee80211_deliver_skb(struct ieee80211_rx_data *rx) 1899 { 1900 struct ieee80211_sub_if_data *sdata = rx->sdata; 1901 struct net_device *dev = sdata->dev; 1902 struct sk_buff *skb, *xmit_skb; 1903 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data; 1904 struct sta_info *dsta; 1905 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 1906 1907 skb = rx->skb; 1908 xmit_skb = NULL; 1909 1910 if ((sdata->vif.type == NL80211_IFTYPE_AP || 1911 sdata->vif.type == NL80211_IFTYPE_AP_VLAN) && 1912 !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) && 1913 (status->rx_flags & IEEE80211_RX_RA_MATCH) && 1914 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) { 1915 if (is_multicast_ether_addr(ehdr->h_dest)) { 1916 /* 1917 * send multicast frames both to higher layers in 1918 * local net stack and back to the wireless medium 1919 */ 1920 xmit_skb = skb_copy(skb, GFP_ATOMIC); 1921 if (!xmit_skb) 1922 net_info_ratelimited("%s: failed to clone multicast frame\n", 1923 dev->name); 1924 } else { 1925 dsta = sta_info_get(sdata, skb->data); 1926 if (dsta) { 1927 /* 1928 * The destination station is associated to 1929 * this AP (in this VLAN), so send the frame 1930 * directly to it and do not pass it to local 1931 * net stack. 1932 */ 1933 xmit_skb = skb; 1934 skb = NULL; 1935 } 1936 } 1937 } 1938 1939 if (skb) { 1940 int align __maybe_unused; 1941 1942 #ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS 1943 /* 1944 * 'align' will only take the values 0 or 2 here 1945 * since all frames are required to be aligned 1946 * to 2-byte boundaries when being passed to 1947 * mac80211; the code here works just as well if 1948 * that isn't true, but mac80211 assumes it can 1949 * access fields as 2-byte aligned (e.g. for 1950 * compare_ether_addr) 1951 */ 1952 align = ((unsigned long)(skb->data + sizeof(struct ethhdr))) & 3; 1953 if (align) { 1954 if (WARN_ON(skb_headroom(skb) < 3)) { 1955 dev_kfree_skb(skb); 1956 skb = NULL; 1957 } else { 1958 u8 *data = skb->data; 1959 size_t len = skb_headlen(skb); 1960 skb->data -= align; 1961 memmove(skb->data, data, len); 1962 skb_set_tail_pointer(skb, len); 1963 } 1964 } 1965 #endif 1966 1967 if (skb) { 1968 /* deliver to local stack */ 1969 skb->protocol = eth_type_trans(skb, dev); 1970 memset(skb->cb, 0, sizeof(skb->cb)); 1971 netif_receive_skb(skb); 1972 } 1973 } 1974 1975 if (xmit_skb) { 1976 /* 1977 * Send to wireless media and increase priority by 256 to 1978 * keep the received priority instead of reclassifying 1979 * the frame (see cfg80211_classify8021d). 1980 */ 1981 xmit_skb->priority += 256; 1982 xmit_skb->protocol = htons(ETH_P_802_3); 1983 skb_reset_network_header(xmit_skb); 1984 skb_reset_mac_header(xmit_skb); 1985 dev_queue_xmit(xmit_skb); 1986 } 1987 } 1988 1989 static ieee80211_rx_result debug_noinline 1990 ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx) 1991 { 1992 struct net_device *dev = rx->sdata->dev; 1993 struct sk_buff *skb = rx->skb; 1994 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; 1995 __le16 fc = hdr->frame_control; 1996 struct sk_buff_head frame_list; 1997 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 1998 1999 if (unlikely(!ieee80211_is_data(fc))) 2000 return RX_CONTINUE; 2001 2002 if (unlikely(!ieee80211_is_data_present(fc))) 2003 return RX_DROP_MONITOR; 2004 2005 if (!(status->rx_flags & IEEE80211_RX_AMSDU)) 2006 return RX_CONTINUE; 2007 2008 if (ieee80211_has_a4(hdr->frame_control) && 2009 rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN && 2010 !rx->sdata->u.vlan.sta) 2011 return RX_DROP_UNUSABLE; 2012 2013 if (is_multicast_ether_addr(hdr->addr1) && 2014 ((rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN && 2015 rx->sdata->u.vlan.sta) || 2016 (rx->sdata->vif.type == NL80211_IFTYPE_STATION && 2017 rx->sdata->u.mgd.use_4addr))) 2018 return RX_DROP_UNUSABLE; 2019 2020 skb->dev = dev; 2021 __skb_queue_head_init(&frame_list); 2022 2023 if (skb_linearize(skb)) 2024 return RX_DROP_UNUSABLE; 2025 2026 ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr, 2027 rx->sdata->vif.type, 2028 rx->local->hw.extra_tx_headroom, true); 2029 2030 while (!skb_queue_empty(&frame_list)) { 2031 rx->skb = __skb_dequeue(&frame_list); 2032 2033 if (!ieee80211_frame_allowed(rx, fc)) { 2034 dev_kfree_skb(rx->skb); 2035 continue; 2036 } 2037 dev->stats.rx_packets++; 2038 dev->stats.rx_bytes += rx->skb->len; 2039 2040 ieee80211_deliver_skb(rx); 2041 } 2042 2043 return RX_QUEUED; 2044 } 2045 2046 #ifdef CONFIG_MAC80211_MESH 2047 static ieee80211_rx_result 2048 ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx) 2049 { 2050 struct ieee80211_hdr *fwd_hdr, *hdr; 2051 struct ieee80211_tx_info *info; 2052 struct ieee80211s_hdr *mesh_hdr; 2053 struct sk_buff *skb = rx->skb, *fwd_skb; 2054 struct ieee80211_local *local = rx->local; 2055 struct ieee80211_sub_if_data *sdata = rx->sdata; 2056 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 2057 struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh; 2058 __le16 reason = cpu_to_le16(WLAN_REASON_MESH_PATH_NOFORWARD); 2059 u16 q, hdrlen; 2060 2061 hdr = (struct ieee80211_hdr *) skb->data; 2062 hdrlen = ieee80211_hdrlen(hdr->frame_control); 2063 2064 /* make sure fixed part of mesh header is there, also checks skb len */ 2065 if (!pskb_may_pull(rx->skb, hdrlen + 6)) 2066 return RX_DROP_MONITOR; 2067 2068 mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen); 2069 2070 /* make sure full mesh header is there, also checks skb len */ 2071 if (!pskb_may_pull(rx->skb, 2072 hdrlen + ieee80211_get_mesh_hdrlen(mesh_hdr))) 2073 return RX_DROP_MONITOR; 2074 2075 /* reload pointers */ 2076 hdr = (struct ieee80211_hdr *) skb->data; 2077 mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen); 2078 2079 /* frame is in RMC, don't forward */ 2080 if (ieee80211_is_data(hdr->frame_control) && 2081 is_multicast_ether_addr(hdr->addr1) && 2082 mesh_rmc_check(rx->sdata, hdr->addr3, mesh_hdr)) 2083 return RX_DROP_MONITOR; 2084 2085 if (!ieee80211_is_data(hdr->frame_control) || 2086 !(status->rx_flags & IEEE80211_RX_RA_MATCH)) 2087 return RX_CONTINUE; 2088 2089 if (!mesh_hdr->ttl) 2090 return RX_DROP_MONITOR; 2091 2092 if (mesh_hdr->flags & MESH_FLAGS_AE) { 2093 struct mesh_path *mppath; 2094 char *proxied_addr; 2095 char *mpp_addr; 2096 2097 if (is_multicast_ether_addr(hdr->addr1)) { 2098 mpp_addr = hdr->addr3; 2099 proxied_addr = mesh_hdr->eaddr1; 2100 } else if (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6) { 2101 /* has_a4 already checked in ieee80211_rx_mesh_check */ 2102 mpp_addr = hdr->addr4; 2103 proxied_addr = mesh_hdr->eaddr2; 2104 } else { 2105 return RX_DROP_MONITOR; 2106 } 2107 2108 rcu_read_lock(); 2109 mppath = mpp_path_lookup(sdata, proxied_addr); 2110 if (!mppath) { 2111 mpp_path_add(sdata, proxied_addr, mpp_addr); 2112 } else { 2113 spin_lock_bh(&mppath->state_lock); 2114 if (!ether_addr_equal(mppath->mpp, mpp_addr)) 2115 memcpy(mppath->mpp, mpp_addr, ETH_ALEN); 2116 spin_unlock_bh(&mppath->state_lock); 2117 } 2118 rcu_read_unlock(); 2119 } 2120 2121 /* Frame has reached destination. Don't forward */ 2122 if (!is_multicast_ether_addr(hdr->addr1) && 2123 ether_addr_equal(sdata->vif.addr, hdr->addr3)) 2124 return RX_CONTINUE; 2125 2126 q = ieee80211_select_queue_80211(sdata, skb, hdr); 2127 if (ieee80211_queue_stopped(&local->hw, q)) { 2128 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion); 2129 return RX_DROP_MONITOR; 2130 } 2131 skb_set_queue_mapping(skb, q); 2132 2133 if (!--mesh_hdr->ttl) { 2134 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl); 2135 goto out; 2136 } 2137 2138 if (!ifmsh->mshcfg.dot11MeshForwarding) 2139 goto out; 2140 2141 fwd_skb = skb_copy(skb, GFP_ATOMIC); 2142 if (!fwd_skb) { 2143 net_info_ratelimited("%s: failed to clone mesh frame\n", 2144 sdata->name); 2145 goto out; 2146 } 2147 2148 fwd_hdr = (struct ieee80211_hdr *) fwd_skb->data; 2149 fwd_hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_RETRY); 2150 info = IEEE80211_SKB_CB(fwd_skb); 2151 memset(info, 0, sizeof(*info)); 2152 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING; 2153 info->control.vif = &rx->sdata->vif; 2154 info->control.jiffies = jiffies; 2155 if (is_multicast_ether_addr(fwd_hdr->addr1)) { 2156 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_mcast); 2157 memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN); 2158 /* update power mode indication when forwarding */ 2159 ieee80211_mps_set_frame_flags(sdata, NULL, fwd_hdr); 2160 } else if (!mesh_nexthop_lookup(sdata, fwd_skb)) { 2161 /* mesh power mode flags updated in mesh_nexthop_lookup */ 2162 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast); 2163 } else { 2164 /* unable to resolve next hop */ 2165 mesh_path_error_tx(sdata, ifmsh->mshcfg.element_ttl, 2166 fwd_hdr->addr3, 0, reason, fwd_hdr->addr2); 2167 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_no_route); 2168 kfree_skb(fwd_skb); 2169 return RX_DROP_MONITOR; 2170 } 2171 2172 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames); 2173 ieee80211_add_pending_skb(local, fwd_skb); 2174 out: 2175 if (is_multicast_ether_addr(hdr->addr1) || 2176 sdata->dev->flags & IFF_PROMISC) 2177 return RX_CONTINUE; 2178 else 2179 return RX_DROP_MONITOR; 2180 } 2181 #endif 2182 2183 static ieee80211_rx_result debug_noinline 2184 ieee80211_rx_h_data(struct ieee80211_rx_data *rx) 2185 { 2186 struct ieee80211_sub_if_data *sdata = rx->sdata; 2187 struct ieee80211_local *local = rx->local; 2188 struct net_device *dev = sdata->dev; 2189 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 2190 __le16 fc = hdr->frame_control; 2191 bool port_control; 2192 int err; 2193 2194 if (unlikely(!ieee80211_is_data(hdr->frame_control))) 2195 return RX_CONTINUE; 2196 2197 if (unlikely(!ieee80211_is_data_present(hdr->frame_control))) 2198 return RX_DROP_MONITOR; 2199 2200 /* 2201 * Send unexpected-4addr-frame event to hostapd. For older versions, 2202 * also drop the frame to cooked monitor interfaces. 2203 */ 2204 if (ieee80211_has_a4(hdr->frame_control) && 2205 sdata->vif.type == NL80211_IFTYPE_AP) { 2206 if (rx->sta && 2207 !test_and_set_sta_flag(rx->sta, WLAN_STA_4ADDR_EVENT)) 2208 cfg80211_rx_unexpected_4addr_frame( 2209 rx->sdata->dev, rx->sta->sta.addr, GFP_ATOMIC); 2210 return RX_DROP_MONITOR; 2211 } 2212 2213 err = __ieee80211_data_to_8023(rx, &port_control); 2214 if (unlikely(err)) 2215 return RX_DROP_UNUSABLE; 2216 2217 if (!ieee80211_frame_allowed(rx, fc)) 2218 return RX_DROP_MONITOR; 2219 2220 if (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN && 2221 unlikely(port_control) && sdata->bss) { 2222 sdata = container_of(sdata->bss, struct ieee80211_sub_if_data, 2223 u.ap); 2224 dev = sdata->dev; 2225 rx->sdata = sdata; 2226 } 2227 2228 rx->skb->dev = dev; 2229 2230 dev->stats.rx_packets++; 2231 dev->stats.rx_bytes += rx->skb->len; 2232 2233 if (local->ps_sdata && local->hw.conf.dynamic_ps_timeout > 0 && 2234 !is_multicast_ether_addr( 2235 ((struct ethhdr *)rx->skb->data)->h_dest) && 2236 (!local->scanning && 2237 !test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))) { 2238 mod_timer(&local->dynamic_ps_timer, jiffies + 2239 msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout)); 2240 } 2241 2242 ieee80211_deliver_skb(rx); 2243 2244 return RX_QUEUED; 2245 } 2246 2247 static ieee80211_rx_result debug_noinline 2248 ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames) 2249 { 2250 struct sk_buff *skb = rx->skb; 2251 struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data; 2252 struct tid_ampdu_rx *tid_agg_rx; 2253 u16 start_seq_num; 2254 u16 tid; 2255 2256 if (likely(!ieee80211_is_ctl(bar->frame_control))) 2257 return RX_CONTINUE; 2258 2259 if (ieee80211_is_back_req(bar->frame_control)) { 2260 struct { 2261 __le16 control, start_seq_num; 2262 } __packed bar_data; 2263 2264 if (!rx->sta) 2265 return RX_DROP_MONITOR; 2266 2267 if (skb_copy_bits(skb, offsetof(struct ieee80211_bar, control), 2268 &bar_data, sizeof(bar_data))) 2269 return RX_DROP_MONITOR; 2270 2271 tid = le16_to_cpu(bar_data.control) >> 12; 2272 2273 tid_agg_rx = rcu_dereference(rx->sta->ampdu_mlme.tid_rx[tid]); 2274 if (!tid_agg_rx) 2275 return RX_DROP_MONITOR; 2276 2277 start_seq_num = le16_to_cpu(bar_data.start_seq_num) >> 4; 2278 2279 /* reset session timer */ 2280 if (tid_agg_rx->timeout) 2281 mod_timer(&tid_agg_rx->session_timer, 2282 TU_TO_EXP_TIME(tid_agg_rx->timeout)); 2283 2284 spin_lock(&tid_agg_rx->reorder_lock); 2285 /* release stored frames up to start of BAR */ 2286 ieee80211_release_reorder_frames(rx->sdata, tid_agg_rx, 2287 start_seq_num, frames); 2288 spin_unlock(&tid_agg_rx->reorder_lock); 2289 2290 kfree_skb(skb); 2291 return RX_QUEUED; 2292 } 2293 2294 /* 2295 * After this point, we only want management frames, 2296 * so we can drop all remaining control frames to 2297 * cooked monitor interfaces. 2298 */ 2299 return RX_DROP_MONITOR; 2300 } 2301 2302 static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata, 2303 struct ieee80211_mgmt *mgmt, 2304 size_t len) 2305 { 2306 struct ieee80211_local *local = sdata->local; 2307 struct sk_buff *skb; 2308 struct ieee80211_mgmt *resp; 2309 2310 if (!ether_addr_equal(mgmt->da, sdata->vif.addr)) { 2311 /* Not to own unicast address */ 2312 return; 2313 } 2314 2315 if (!ether_addr_equal(mgmt->sa, sdata->u.mgd.bssid) || 2316 !ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid)) { 2317 /* Not from the current AP or not associated yet. */ 2318 return; 2319 } 2320 2321 if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) { 2322 /* Too short SA Query request frame */ 2323 return; 2324 } 2325 2326 skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom); 2327 if (skb == NULL) 2328 return; 2329 2330 skb_reserve(skb, local->hw.extra_tx_headroom); 2331 resp = (struct ieee80211_mgmt *) skb_put(skb, 24); 2332 memset(resp, 0, 24); 2333 memcpy(resp->da, mgmt->sa, ETH_ALEN); 2334 memcpy(resp->sa, sdata->vif.addr, ETH_ALEN); 2335 memcpy(resp->bssid, sdata->u.mgd.bssid, ETH_ALEN); 2336 resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | 2337 IEEE80211_STYPE_ACTION); 2338 skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query)); 2339 resp->u.action.category = WLAN_CATEGORY_SA_QUERY; 2340 resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE; 2341 memcpy(resp->u.action.u.sa_query.trans_id, 2342 mgmt->u.action.u.sa_query.trans_id, 2343 WLAN_SA_QUERY_TR_ID_LEN); 2344 2345 ieee80211_tx_skb(sdata, skb); 2346 } 2347 2348 static ieee80211_rx_result debug_noinline 2349 ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx) 2350 { 2351 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data; 2352 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 2353 2354 /* 2355 * From here on, look only at management frames. 2356 * Data and control frames are already handled, 2357 * and unknown (reserved) frames are useless. 2358 */ 2359 if (rx->skb->len < 24) 2360 return RX_DROP_MONITOR; 2361 2362 if (!ieee80211_is_mgmt(mgmt->frame_control)) 2363 return RX_DROP_MONITOR; 2364 2365 if (rx->sdata->vif.type == NL80211_IFTYPE_AP && 2366 ieee80211_is_beacon(mgmt->frame_control) && 2367 !(rx->flags & IEEE80211_RX_BEACON_REPORTED)) { 2368 int sig = 0; 2369 2370 if (rx->local->hw.flags & IEEE80211_HW_SIGNAL_DBM) 2371 sig = status->signal; 2372 2373 cfg80211_report_obss_beacon(rx->local->hw.wiphy, 2374 rx->skb->data, rx->skb->len, 2375 status->freq, sig); 2376 rx->flags |= IEEE80211_RX_BEACON_REPORTED; 2377 } 2378 2379 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH)) 2380 return RX_DROP_MONITOR; 2381 2382 if (ieee80211_drop_unencrypted_mgmt(rx)) 2383 return RX_DROP_UNUSABLE; 2384 2385 return RX_CONTINUE; 2386 } 2387 2388 static ieee80211_rx_result debug_noinline 2389 ieee80211_rx_h_action(struct ieee80211_rx_data *rx) 2390 { 2391 struct ieee80211_local *local = rx->local; 2392 struct ieee80211_sub_if_data *sdata = rx->sdata; 2393 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data; 2394 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 2395 int len = rx->skb->len; 2396 2397 if (!ieee80211_is_action(mgmt->frame_control)) 2398 return RX_CONTINUE; 2399 2400 /* drop too small frames */ 2401 if (len < IEEE80211_MIN_ACTION_SIZE) 2402 return RX_DROP_UNUSABLE; 2403 2404 if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC && 2405 mgmt->u.action.category != WLAN_CATEGORY_SELF_PROTECTED) 2406 return RX_DROP_UNUSABLE; 2407 2408 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH)) 2409 return RX_DROP_UNUSABLE; 2410 2411 switch (mgmt->u.action.category) { 2412 case WLAN_CATEGORY_HT: 2413 /* reject HT action frames from stations not supporting HT */ 2414 if (!rx->sta->sta.ht_cap.ht_supported) 2415 goto invalid; 2416 2417 if (sdata->vif.type != NL80211_IFTYPE_STATION && 2418 sdata->vif.type != NL80211_IFTYPE_MESH_POINT && 2419 sdata->vif.type != NL80211_IFTYPE_AP_VLAN && 2420 sdata->vif.type != NL80211_IFTYPE_AP && 2421 sdata->vif.type != NL80211_IFTYPE_ADHOC) 2422 break; 2423 2424 /* verify action & smps_control/chanwidth are present */ 2425 if (len < IEEE80211_MIN_ACTION_SIZE + 2) 2426 goto invalid; 2427 2428 switch (mgmt->u.action.u.ht_smps.action) { 2429 case WLAN_HT_ACTION_SMPS: { 2430 struct ieee80211_supported_band *sband; 2431 enum ieee80211_smps_mode smps_mode; 2432 2433 /* convert to HT capability */ 2434 switch (mgmt->u.action.u.ht_smps.smps_control) { 2435 case WLAN_HT_SMPS_CONTROL_DISABLED: 2436 smps_mode = IEEE80211_SMPS_OFF; 2437 break; 2438 case WLAN_HT_SMPS_CONTROL_STATIC: 2439 smps_mode = IEEE80211_SMPS_STATIC; 2440 break; 2441 case WLAN_HT_SMPS_CONTROL_DYNAMIC: 2442 smps_mode = IEEE80211_SMPS_DYNAMIC; 2443 break; 2444 default: 2445 goto invalid; 2446 } 2447 2448 /* if no change do nothing */ 2449 if (rx->sta->sta.smps_mode == smps_mode) 2450 goto handled; 2451 rx->sta->sta.smps_mode = smps_mode; 2452 2453 sband = rx->local->hw.wiphy->bands[status->band]; 2454 2455 rate_control_rate_update(local, sband, rx->sta, 2456 IEEE80211_RC_SMPS_CHANGED); 2457 goto handled; 2458 } 2459 case WLAN_HT_ACTION_NOTIFY_CHANWIDTH: { 2460 struct ieee80211_supported_band *sband; 2461 u8 chanwidth = mgmt->u.action.u.ht_notify_cw.chanwidth; 2462 enum ieee80211_sta_rx_bandwidth new_bw; 2463 2464 /* If it doesn't support 40 MHz it can't change ... */ 2465 if (!(rx->sta->sta.ht_cap.cap & 2466 IEEE80211_HT_CAP_SUP_WIDTH_20_40)) 2467 goto handled; 2468 2469 if (chanwidth == IEEE80211_HT_CHANWIDTH_20MHZ) 2470 new_bw = IEEE80211_STA_RX_BW_20; 2471 else 2472 new_bw = ieee80211_sta_cur_vht_bw(rx->sta); 2473 2474 if (rx->sta->sta.bandwidth == new_bw) 2475 goto handled; 2476 2477 sband = rx->local->hw.wiphy->bands[status->band]; 2478 2479 rate_control_rate_update(local, sband, rx->sta, 2480 IEEE80211_RC_BW_CHANGED); 2481 goto handled; 2482 } 2483 default: 2484 goto invalid; 2485 } 2486 2487 break; 2488 case WLAN_CATEGORY_PUBLIC: 2489 if (len < IEEE80211_MIN_ACTION_SIZE + 1) 2490 goto invalid; 2491 if (sdata->vif.type != NL80211_IFTYPE_STATION) 2492 break; 2493 if (!rx->sta) 2494 break; 2495 if (!ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid)) 2496 break; 2497 if (mgmt->u.action.u.ext_chan_switch.action_code != 2498 WLAN_PUB_ACTION_EXT_CHANSW_ANN) 2499 break; 2500 if (len < offsetof(struct ieee80211_mgmt, 2501 u.action.u.ext_chan_switch.variable)) 2502 goto invalid; 2503 goto queue; 2504 case WLAN_CATEGORY_VHT: 2505 if (sdata->vif.type != NL80211_IFTYPE_STATION && 2506 sdata->vif.type != NL80211_IFTYPE_MESH_POINT && 2507 sdata->vif.type != NL80211_IFTYPE_AP_VLAN && 2508 sdata->vif.type != NL80211_IFTYPE_AP && 2509 sdata->vif.type != NL80211_IFTYPE_ADHOC) 2510 break; 2511 2512 /* verify action code is present */ 2513 if (len < IEEE80211_MIN_ACTION_SIZE + 1) 2514 goto invalid; 2515 2516 switch (mgmt->u.action.u.vht_opmode_notif.action_code) { 2517 case WLAN_VHT_ACTION_OPMODE_NOTIF: { 2518 u8 opmode; 2519 2520 /* verify opmode is present */ 2521 if (len < IEEE80211_MIN_ACTION_SIZE + 2) 2522 goto invalid; 2523 2524 opmode = mgmt->u.action.u.vht_opmode_notif.operating_mode; 2525 2526 ieee80211_vht_handle_opmode(rx->sdata, rx->sta, 2527 opmode, status->band, 2528 false); 2529 goto handled; 2530 } 2531 default: 2532 break; 2533 } 2534 break; 2535 case WLAN_CATEGORY_BACK: 2536 if (sdata->vif.type != NL80211_IFTYPE_STATION && 2537 sdata->vif.type != NL80211_IFTYPE_MESH_POINT && 2538 sdata->vif.type != NL80211_IFTYPE_AP_VLAN && 2539 sdata->vif.type != NL80211_IFTYPE_AP && 2540 sdata->vif.type != NL80211_IFTYPE_ADHOC) 2541 break; 2542 2543 /* verify action_code is present */ 2544 if (len < IEEE80211_MIN_ACTION_SIZE + 1) 2545 break; 2546 2547 switch (mgmt->u.action.u.addba_req.action_code) { 2548 case WLAN_ACTION_ADDBA_REQ: 2549 if (len < (IEEE80211_MIN_ACTION_SIZE + 2550 sizeof(mgmt->u.action.u.addba_req))) 2551 goto invalid; 2552 break; 2553 case WLAN_ACTION_ADDBA_RESP: 2554 if (len < (IEEE80211_MIN_ACTION_SIZE + 2555 sizeof(mgmt->u.action.u.addba_resp))) 2556 goto invalid; 2557 break; 2558 case WLAN_ACTION_DELBA: 2559 if (len < (IEEE80211_MIN_ACTION_SIZE + 2560 sizeof(mgmt->u.action.u.delba))) 2561 goto invalid; 2562 break; 2563 default: 2564 goto invalid; 2565 } 2566 2567 goto queue; 2568 case WLAN_CATEGORY_SPECTRUM_MGMT: 2569 if (status->band != IEEE80211_BAND_5GHZ) 2570 break; 2571 2572 if (sdata->vif.type != NL80211_IFTYPE_STATION) 2573 break; 2574 2575 /* verify action_code is present */ 2576 if (len < IEEE80211_MIN_ACTION_SIZE + 1) 2577 break; 2578 2579 switch (mgmt->u.action.u.measurement.action_code) { 2580 case WLAN_ACTION_SPCT_MSR_REQ: 2581 if (len < (IEEE80211_MIN_ACTION_SIZE + 2582 sizeof(mgmt->u.action.u.measurement))) 2583 break; 2584 ieee80211_process_measurement_req(sdata, mgmt, len); 2585 goto handled; 2586 case WLAN_ACTION_SPCT_CHL_SWITCH: 2587 if (sdata->vif.type != NL80211_IFTYPE_STATION) 2588 break; 2589 2590 if (!ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid)) 2591 break; 2592 2593 goto queue; 2594 } 2595 break; 2596 case WLAN_CATEGORY_SA_QUERY: 2597 if (len < (IEEE80211_MIN_ACTION_SIZE + 2598 sizeof(mgmt->u.action.u.sa_query))) 2599 break; 2600 2601 switch (mgmt->u.action.u.sa_query.action) { 2602 case WLAN_ACTION_SA_QUERY_REQUEST: 2603 if (sdata->vif.type != NL80211_IFTYPE_STATION) 2604 break; 2605 ieee80211_process_sa_query_req(sdata, mgmt, len); 2606 goto handled; 2607 } 2608 break; 2609 case WLAN_CATEGORY_SELF_PROTECTED: 2610 if (len < (IEEE80211_MIN_ACTION_SIZE + 2611 sizeof(mgmt->u.action.u.self_prot.action_code))) 2612 break; 2613 2614 switch (mgmt->u.action.u.self_prot.action_code) { 2615 case WLAN_SP_MESH_PEERING_OPEN: 2616 case WLAN_SP_MESH_PEERING_CLOSE: 2617 case WLAN_SP_MESH_PEERING_CONFIRM: 2618 if (!ieee80211_vif_is_mesh(&sdata->vif)) 2619 goto invalid; 2620 if (sdata->u.mesh.user_mpm) 2621 /* userspace handles this frame */ 2622 break; 2623 goto queue; 2624 case WLAN_SP_MGK_INFORM: 2625 case WLAN_SP_MGK_ACK: 2626 if (!ieee80211_vif_is_mesh(&sdata->vif)) 2627 goto invalid; 2628 break; 2629 } 2630 break; 2631 case WLAN_CATEGORY_MESH_ACTION: 2632 if (len < (IEEE80211_MIN_ACTION_SIZE + 2633 sizeof(mgmt->u.action.u.mesh_action.action_code))) 2634 break; 2635 2636 if (!ieee80211_vif_is_mesh(&sdata->vif)) 2637 break; 2638 if (mesh_action_is_path_sel(mgmt) && 2639 !mesh_path_sel_is_hwmp(sdata)) 2640 break; 2641 goto queue; 2642 } 2643 2644 return RX_CONTINUE; 2645 2646 invalid: 2647 status->rx_flags |= IEEE80211_RX_MALFORMED_ACTION_FRM; 2648 /* will return in the next handlers */ 2649 return RX_CONTINUE; 2650 2651 handled: 2652 if (rx->sta) 2653 rx->sta->rx_packets++; 2654 dev_kfree_skb(rx->skb); 2655 return RX_QUEUED; 2656 2657 queue: 2658 rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME; 2659 skb_queue_tail(&sdata->skb_queue, rx->skb); 2660 ieee80211_queue_work(&local->hw, &sdata->work); 2661 if (rx->sta) 2662 rx->sta->rx_packets++; 2663 return RX_QUEUED; 2664 } 2665 2666 static ieee80211_rx_result debug_noinline 2667 ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx) 2668 { 2669 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 2670 int sig = 0; 2671 2672 /* skip known-bad action frames and return them in the next handler */ 2673 if (status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) 2674 return RX_CONTINUE; 2675 2676 /* 2677 * Getting here means the kernel doesn't know how to handle 2678 * it, but maybe userspace does ... include returned frames 2679 * so userspace can register for those to know whether ones 2680 * it transmitted were processed or returned. 2681 */ 2682 2683 if (rx->local->hw.flags & IEEE80211_HW_SIGNAL_DBM) 2684 sig = status->signal; 2685 2686 if (cfg80211_rx_mgmt(&rx->sdata->wdev, status->freq, sig, 2687 rx->skb->data, rx->skb->len, 0, GFP_ATOMIC)) { 2688 if (rx->sta) 2689 rx->sta->rx_packets++; 2690 dev_kfree_skb(rx->skb); 2691 return RX_QUEUED; 2692 } 2693 2694 return RX_CONTINUE; 2695 } 2696 2697 static ieee80211_rx_result debug_noinline 2698 ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx) 2699 { 2700 struct ieee80211_local *local = rx->local; 2701 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data; 2702 struct sk_buff *nskb; 2703 struct ieee80211_sub_if_data *sdata = rx->sdata; 2704 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 2705 2706 if (!ieee80211_is_action(mgmt->frame_control)) 2707 return RX_CONTINUE; 2708 2709 /* 2710 * For AP mode, hostapd is responsible for handling any action 2711 * frames that we didn't handle, including returning unknown 2712 * ones. For all other modes we will return them to the sender, 2713 * setting the 0x80 bit in the action category, as required by 2714 * 802.11-2012 9.24.4. 2715 * Newer versions of hostapd shall also use the management frame 2716 * registration mechanisms, but older ones still use cooked 2717 * monitor interfaces so push all frames there. 2718 */ 2719 if (!(status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) && 2720 (sdata->vif.type == NL80211_IFTYPE_AP || 2721 sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) 2722 return RX_DROP_MONITOR; 2723 2724 if (is_multicast_ether_addr(mgmt->da)) 2725 return RX_DROP_MONITOR; 2726 2727 /* do not return rejected action frames */ 2728 if (mgmt->u.action.category & 0x80) 2729 return RX_DROP_UNUSABLE; 2730 2731 nskb = skb_copy_expand(rx->skb, local->hw.extra_tx_headroom, 0, 2732 GFP_ATOMIC); 2733 if (nskb) { 2734 struct ieee80211_mgmt *nmgmt = (void *)nskb->data; 2735 2736 nmgmt->u.action.category |= 0x80; 2737 memcpy(nmgmt->da, nmgmt->sa, ETH_ALEN); 2738 memcpy(nmgmt->sa, rx->sdata->vif.addr, ETH_ALEN); 2739 2740 memset(nskb->cb, 0, sizeof(nskb->cb)); 2741 2742 if (rx->sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) { 2743 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(nskb); 2744 2745 info->flags = IEEE80211_TX_CTL_TX_OFFCHAN | 2746 IEEE80211_TX_INTFL_OFFCHAN_TX_OK | 2747 IEEE80211_TX_CTL_NO_CCK_RATE; 2748 if (local->hw.flags & IEEE80211_HW_QUEUE_CONTROL) 2749 info->hw_queue = 2750 local->hw.offchannel_tx_hw_queue; 2751 } 2752 2753 __ieee80211_tx_skb_tid_band(rx->sdata, nskb, 7, 2754 status->band); 2755 } 2756 dev_kfree_skb(rx->skb); 2757 return RX_QUEUED; 2758 } 2759 2760 static ieee80211_rx_result debug_noinline 2761 ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx) 2762 { 2763 struct ieee80211_sub_if_data *sdata = rx->sdata; 2764 struct ieee80211_mgmt *mgmt = (void *)rx->skb->data; 2765 __le16 stype; 2766 2767 stype = mgmt->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE); 2768 2769 if (!ieee80211_vif_is_mesh(&sdata->vif) && 2770 sdata->vif.type != NL80211_IFTYPE_ADHOC && 2771 sdata->vif.type != NL80211_IFTYPE_STATION) 2772 return RX_DROP_MONITOR; 2773 2774 switch (stype) { 2775 case cpu_to_le16(IEEE80211_STYPE_AUTH): 2776 case cpu_to_le16(IEEE80211_STYPE_BEACON): 2777 case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP): 2778 /* process for all: mesh, mlme, ibss */ 2779 break; 2780 case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP): 2781 case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP): 2782 case cpu_to_le16(IEEE80211_STYPE_DEAUTH): 2783 case cpu_to_le16(IEEE80211_STYPE_DISASSOC): 2784 if (is_multicast_ether_addr(mgmt->da) && 2785 !is_broadcast_ether_addr(mgmt->da)) 2786 return RX_DROP_MONITOR; 2787 2788 /* process only for station */ 2789 if (sdata->vif.type != NL80211_IFTYPE_STATION) 2790 return RX_DROP_MONITOR; 2791 break; 2792 case cpu_to_le16(IEEE80211_STYPE_PROBE_REQ): 2793 /* process only for ibss and mesh */ 2794 if (sdata->vif.type != NL80211_IFTYPE_ADHOC && 2795 sdata->vif.type != NL80211_IFTYPE_MESH_POINT) 2796 return RX_DROP_MONITOR; 2797 break; 2798 default: 2799 return RX_DROP_MONITOR; 2800 } 2801 2802 /* queue up frame and kick off work to process it */ 2803 rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME; 2804 skb_queue_tail(&sdata->skb_queue, rx->skb); 2805 ieee80211_queue_work(&rx->local->hw, &sdata->work); 2806 if (rx->sta) 2807 rx->sta->rx_packets++; 2808 2809 return RX_QUEUED; 2810 } 2811 2812 /* TODO: use IEEE80211_RX_FRAGMENTED */ 2813 static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx, 2814 struct ieee80211_rate *rate) 2815 { 2816 struct ieee80211_sub_if_data *sdata; 2817 struct ieee80211_local *local = rx->local; 2818 struct sk_buff *skb = rx->skb, *skb2; 2819 struct net_device *prev_dev = NULL; 2820 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 2821 int needed_headroom; 2822 2823 /* 2824 * If cooked monitor has been processed already, then 2825 * don't do it again. If not, set the flag. 2826 */ 2827 if (rx->flags & IEEE80211_RX_CMNTR) 2828 goto out_free_skb; 2829 rx->flags |= IEEE80211_RX_CMNTR; 2830 2831 /* If there are no cooked monitor interfaces, just free the SKB */ 2832 if (!local->cooked_mntrs) 2833 goto out_free_skb; 2834 2835 /* room for the radiotap header based on driver features */ 2836 needed_headroom = ieee80211_rx_radiotap_space(local, status); 2837 2838 if (skb_headroom(skb) < needed_headroom && 2839 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) 2840 goto out_free_skb; 2841 2842 /* prepend radiotap information */ 2843 ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom, 2844 false); 2845 2846 skb_set_mac_header(skb, 0); 2847 skb->ip_summed = CHECKSUM_UNNECESSARY; 2848 skb->pkt_type = PACKET_OTHERHOST; 2849 skb->protocol = htons(ETH_P_802_2); 2850 2851 list_for_each_entry_rcu(sdata, &local->interfaces, list) { 2852 if (!ieee80211_sdata_running(sdata)) 2853 continue; 2854 2855 if (sdata->vif.type != NL80211_IFTYPE_MONITOR || 2856 !(sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES)) 2857 continue; 2858 2859 if (prev_dev) { 2860 skb2 = skb_clone(skb, GFP_ATOMIC); 2861 if (skb2) { 2862 skb2->dev = prev_dev; 2863 netif_receive_skb(skb2); 2864 } 2865 } 2866 2867 prev_dev = sdata->dev; 2868 sdata->dev->stats.rx_packets++; 2869 sdata->dev->stats.rx_bytes += skb->len; 2870 } 2871 2872 if (prev_dev) { 2873 skb->dev = prev_dev; 2874 netif_receive_skb(skb); 2875 return; 2876 } 2877 2878 out_free_skb: 2879 dev_kfree_skb(skb); 2880 } 2881 2882 static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx, 2883 ieee80211_rx_result res) 2884 { 2885 switch (res) { 2886 case RX_DROP_MONITOR: 2887 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop); 2888 if (rx->sta) 2889 rx->sta->rx_dropped++; 2890 /* fall through */ 2891 case RX_CONTINUE: { 2892 struct ieee80211_rate *rate = NULL; 2893 struct ieee80211_supported_band *sband; 2894 struct ieee80211_rx_status *status; 2895 2896 status = IEEE80211_SKB_RXCB((rx->skb)); 2897 2898 sband = rx->local->hw.wiphy->bands[status->band]; 2899 if (!(status->flag & RX_FLAG_HT) && 2900 !(status->flag & RX_FLAG_VHT)) 2901 rate = &sband->bitrates[status->rate_idx]; 2902 2903 ieee80211_rx_cooked_monitor(rx, rate); 2904 break; 2905 } 2906 case RX_DROP_UNUSABLE: 2907 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop); 2908 if (rx->sta) 2909 rx->sta->rx_dropped++; 2910 dev_kfree_skb(rx->skb); 2911 break; 2912 case RX_QUEUED: 2913 I802_DEBUG_INC(rx->sdata->local->rx_handlers_queued); 2914 break; 2915 } 2916 } 2917 2918 static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx, 2919 struct sk_buff_head *frames) 2920 { 2921 ieee80211_rx_result res = RX_DROP_MONITOR; 2922 struct sk_buff *skb; 2923 2924 #define CALL_RXH(rxh) \ 2925 do { \ 2926 res = rxh(rx); \ 2927 if (res != RX_CONTINUE) \ 2928 goto rxh_next; \ 2929 } while (0); 2930 2931 spin_lock_bh(&rx->local->rx_path_lock); 2932 2933 while ((skb = __skb_dequeue(frames))) { 2934 /* 2935 * all the other fields are valid across frames 2936 * that belong to an aMPDU since they are on the 2937 * same TID from the same station 2938 */ 2939 rx->skb = skb; 2940 2941 CALL_RXH(ieee80211_rx_h_check_more_data) 2942 CALL_RXH(ieee80211_rx_h_uapsd_and_pspoll) 2943 CALL_RXH(ieee80211_rx_h_sta_process) 2944 CALL_RXH(ieee80211_rx_h_decrypt) 2945 CALL_RXH(ieee80211_rx_h_defragment) 2946 CALL_RXH(ieee80211_rx_h_michael_mic_verify) 2947 /* must be after MMIC verify so header is counted in MPDU mic */ 2948 #ifdef CONFIG_MAC80211_MESH 2949 if (ieee80211_vif_is_mesh(&rx->sdata->vif)) 2950 CALL_RXH(ieee80211_rx_h_mesh_fwding); 2951 #endif 2952 CALL_RXH(ieee80211_rx_h_amsdu) 2953 CALL_RXH(ieee80211_rx_h_data) 2954 2955 /* special treatment -- needs the queue */ 2956 res = ieee80211_rx_h_ctrl(rx, frames); 2957 if (res != RX_CONTINUE) 2958 goto rxh_next; 2959 2960 CALL_RXH(ieee80211_rx_h_mgmt_check) 2961 CALL_RXH(ieee80211_rx_h_action) 2962 CALL_RXH(ieee80211_rx_h_userspace_mgmt) 2963 CALL_RXH(ieee80211_rx_h_action_return) 2964 CALL_RXH(ieee80211_rx_h_mgmt) 2965 2966 rxh_next: 2967 ieee80211_rx_handlers_result(rx, res); 2968 2969 #undef CALL_RXH 2970 } 2971 2972 spin_unlock_bh(&rx->local->rx_path_lock); 2973 } 2974 2975 static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx) 2976 { 2977 struct sk_buff_head reorder_release; 2978 ieee80211_rx_result res = RX_DROP_MONITOR; 2979 2980 __skb_queue_head_init(&reorder_release); 2981 2982 #define CALL_RXH(rxh) \ 2983 do { \ 2984 res = rxh(rx); \ 2985 if (res != RX_CONTINUE) \ 2986 goto rxh_next; \ 2987 } while (0); 2988 2989 CALL_RXH(ieee80211_rx_h_check) 2990 2991 ieee80211_rx_reorder_ampdu(rx, &reorder_release); 2992 2993 ieee80211_rx_handlers(rx, &reorder_release); 2994 return; 2995 2996 rxh_next: 2997 ieee80211_rx_handlers_result(rx, res); 2998 2999 #undef CALL_RXH 3000 } 3001 3002 /* 3003 * This function makes calls into the RX path, therefore 3004 * it has to be invoked under RCU read lock. 3005 */ 3006 void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid) 3007 { 3008 struct sk_buff_head frames; 3009 struct ieee80211_rx_data rx = { 3010 .sta = sta, 3011 .sdata = sta->sdata, 3012 .local = sta->local, 3013 /* This is OK -- must be QoS data frame */ 3014 .security_idx = tid, 3015 .seqno_idx = tid, 3016 .flags = 0, 3017 }; 3018 struct tid_ampdu_rx *tid_agg_rx; 3019 3020 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]); 3021 if (!tid_agg_rx) 3022 return; 3023 3024 __skb_queue_head_init(&frames); 3025 3026 spin_lock(&tid_agg_rx->reorder_lock); 3027 ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames); 3028 spin_unlock(&tid_agg_rx->reorder_lock); 3029 3030 ieee80211_rx_handlers(&rx, &frames); 3031 } 3032 3033 /* main receive path */ 3034 3035 static int prepare_for_handlers(struct ieee80211_rx_data *rx, 3036 struct ieee80211_hdr *hdr) 3037 { 3038 struct ieee80211_sub_if_data *sdata = rx->sdata; 3039 struct sk_buff *skb = rx->skb; 3040 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 3041 u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type); 3042 int multicast = is_multicast_ether_addr(hdr->addr1); 3043 3044 switch (sdata->vif.type) { 3045 case NL80211_IFTYPE_STATION: 3046 if (!bssid && !sdata->u.mgd.use_4addr) 3047 return 0; 3048 if (!multicast && 3049 !ether_addr_equal(sdata->vif.addr, hdr->addr1)) { 3050 if (!(sdata->dev->flags & IFF_PROMISC) || 3051 sdata->u.mgd.use_4addr) 3052 return 0; 3053 status->rx_flags &= ~IEEE80211_RX_RA_MATCH; 3054 } 3055 break; 3056 case NL80211_IFTYPE_ADHOC: 3057 if (!bssid) 3058 return 0; 3059 if (ether_addr_equal(sdata->vif.addr, hdr->addr2) || 3060 ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2)) 3061 return 0; 3062 if (ieee80211_is_beacon(hdr->frame_control)) { 3063 return 1; 3064 } else if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid)) { 3065 return 0; 3066 } else if (!multicast && 3067 !ether_addr_equal(sdata->vif.addr, hdr->addr1)) { 3068 if (!(sdata->dev->flags & IFF_PROMISC)) 3069 return 0; 3070 status->rx_flags &= ~IEEE80211_RX_RA_MATCH; 3071 } else if (!rx->sta) { 3072 int rate_idx; 3073 if (status->flag & (RX_FLAG_HT | RX_FLAG_VHT)) 3074 rate_idx = 0; /* TODO: HT/VHT rates */ 3075 else 3076 rate_idx = status->rate_idx; 3077 ieee80211_ibss_rx_no_sta(sdata, bssid, hdr->addr2, 3078 BIT(rate_idx)); 3079 } 3080 break; 3081 case NL80211_IFTYPE_MESH_POINT: 3082 if (!multicast && 3083 !ether_addr_equal(sdata->vif.addr, hdr->addr1)) { 3084 if (!(sdata->dev->flags & IFF_PROMISC)) 3085 return 0; 3086 3087 status->rx_flags &= ~IEEE80211_RX_RA_MATCH; 3088 } 3089 break; 3090 case NL80211_IFTYPE_AP_VLAN: 3091 case NL80211_IFTYPE_AP: 3092 if (!bssid) { 3093 if (!ether_addr_equal(sdata->vif.addr, hdr->addr1)) 3094 return 0; 3095 } else if (!ieee80211_bssid_match(bssid, sdata->vif.addr)) { 3096 /* 3097 * Accept public action frames even when the 3098 * BSSID doesn't match, this is used for P2P 3099 * and location updates. Note that mac80211 3100 * itself never looks at these frames. 3101 */ 3102 if (!multicast && 3103 !ether_addr_equal(sdata->vif.addr, hdr->addr1)) 3104 return 0; 3105 if (ieee80211_is_public_action(hdr, skb->len)) 3106 return 1; 3107 if (!ieee80211_is_beacon(hdr->frame_control)) 3108 return 0; 3109 status->rx_flags &= ~IEEE80211_RX_RA_MATCH; 3110 } 3111 break; 3112 case NL80211_IFTYPE_WDS: 3113 if (bssid || !ieee80211_is_data(hdr->frame_control)) 3114 return 0; 3115 if (!ether_addr_equal(sdata->u.wds.remote_addr, hdr->addr2)) 3116 return 0; 3117 break; 3118 case NL80211_IFTYPE_P2P_DEVICE: 3119 if (!ieee80211_is_public_action(hdr, skb->len) && 3120 !ieee80211_is_probe_req(hdr->frame_control) && 3121 !ieee80211_is_probe_resp(hdr->frame_control) && 3122 !ieee80211_is_beacon(hdr->frame_control)) 3123 return 0; 3124 if (!ether_addr_equal(sdata->vif.addr, hdr->addr1) && 3125 !multicast) 3126 status->rx_flags &= ~IEEE80211_RX_RA_MATCH; 3127 break; 3128 default: 3129 /* should never get here */ 3130 WARN_ON_ONCE(1); 3131 break; 3132 } 3133 3134 return 1; 3135 } 3136 3137 /* 3138 * This function returns whether or not the SKB 3139 * was destined for RX processing or not, which, 3140 * if consume is true, is equivalent to whether 3141 * or not the skb was consumed. 3142 */ 3143 static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx, 3144 struct sk_buff *skb, bool consume) 3145 { 3146 struct ieee80211_local *local = rx->local; 3147 struct ieee80211_sub_if_data *sdata = rx->sdata; 3148 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 3149 struct ieee80211_hdr *hdr = (void *)skb->data; 3150 int prepares; 3151 3152 rx->skb = skb; 3153 status->rx_flags |= IEEE80211_RX_RA_MATCH; 3154 prepares = prepare_for_handlers(rx, hdr); 3155 3156 if (!prepares) 3157 return false; 3158 3159 if (!consume) { 3160 skb = skb_copy(skb, GFP_ATOMIC); 3161 if (!skb) { 3162 if (net_ratelimit()) 3163 wiphy_debug(local->hw.wiphy, 3164 "failed to copy skb for %s\n", 3165 sdata->name); 3166 return true; 3167 } 3168 3169 rx->skb = skb; 3170 } 3171 3172 ieee80211_invoke_rx_handlers(rx); 3173 return true; 3174 } 3175 3176 /* 3177 * This is the actual Rx frames handler. as it blongs to Rx path it must 3178 * be called with rcu_read_lock protection. 3179 */ 3180 static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, 3181 struct sk_buff *skb) 3182 { 3183 struct ieee80211_local *local = hw_to_local(hw); 3184 struct ieee80211_sub_if_data *sdata; 3185 struct ieee80211_hdr *hdr; 3186 __le16 fc; 3187 struct ieee80211_rx_data rx; 3188 struct ieee80211_sub_if_data *prev; 3189 struct sta_info *sta, *tmp, *prev_sta; 3190 int err = 0; 3191 3192 fc = ((struct ieee80211_hdr *)skb->data)->frame_control; 3193 memset(&rx, 0, sizeof(rx)); 3194 rx.skb = skb; 3195 rx.local = local; 3196 3197 if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc)) 3198 local->dot11ReceivedFragmentCount++; 3199 3200 if (ieee80211_is_mgmt(fc)) { 3201 /* drop frame if too short for header */ 3202 if (skb->len < ieee80211_hdrlen(fc)) 3203 err = -ENOBUFS; 3204 else 3205 err = skb_linearize(skb); 3206 } else { 3207 err = !pskb_may_pull(skb, ieee80211_hdrlen(fc)); 3208 } 3209 3210 if (err) { 3211 dev_kfree_skb(skb); 3212 return; 3213 } 3214 3215 hdr = (struct ieee80211_hdr *)skb->data; 3216 ieee80211_parse_qos(&rx); 3217 ieee80211_verify_alignment(&rx); 3218 3219 if (unlikely(ieee80211_is_probe_resp(hdr->frame_control) || 3220 ieee80211_is_beacon(hdr->frame_control))) 3221 ieee80211_scan_rx(local, skb); 3222 3223 if (ieee80211_is_data(fc)) { 3224 prev_sta = NULL; 3225 3226 for_each_sta_info(local, hdr->addr2, sta, tmp) { 3227 if (!prev_sta) { 3228 prev_sta = sta; 3229 continue; 3230 } 3231 3232 rx.sta = prev_sta; 3233 rx.sdata = prev_sta->sdata; 3234 ieee80211_prepare_and_rx_handle(&rx, skb, false); 3235 3236 prev_sta = sta; 3237 } 3238 3239 if (prev_sta) { 3240 rx.sta = prev_sta; 3241 rx.sdata = prev_sta->sdata; 3242 3243 if (ieee80211_prepare_and_rx_handle(&rx, skb, true)) 3244 return; 3245 goto out; 3246 } 3247 } 3248 3249 prev = NULL; 3250 3251 list_for_each_entry_rcu(sdata, &local->interfaces, list) { 3252 if (!ieee80211_sdata_running(sdata)) 3253 continue; 3254 3255 if (sdata->vif.type == NL80211_IFTYPE_MONITOR || 3256 sdata->vif.type == NL80211_IFTYPE_AP_VLAN) 3257 continue; 3258 3259 /* 3260 * frame is destined for this interface, but if it's 3261 * not also for the previous one we handle that after 3262 * the loop to avoid copying the SKB once too much 3263 */ 3264 3265 if (!prev) { 3266 prev = sdata; 3267 continue; 3268 } 3269 3270 rx.sta = sta_info_get_bss(prev, hdr->addr2); 3271 rx.sdata = prev; 3272 ieee80211_prepare_and_rx_handle(&rx, skb, false); 3273 3274 prev = sdata; 3275 } 3276 3277 if (prev) { 3278 rx.sta = sta_info_get_bss(prev, hdr->addr2); 3279 rx.sdata = prev; 3280 3281 if (ieee80211_prepare_and_rx_handle(&rx, skb, true)) 3282 return; 3283 } 3284 3285 out: 3286 dev_kfree_skb(skb); 3287 } 3288 3289 /* 3290 * This is the receive path handler. It is called by a low level driver when an 3291 * 802.11 MPDU is received from the hardware. 3292 */ 3293 void ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb) 3294 { 3295 struct ieee80211_local *local = hw_to_local(hw); 3296 struct ieee80211_rate *rate = NULL; 3297 struct ieee80211_supported_band *sband; 3298 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 3299 3300 WARN_ON_ONCE(softirq_count() == 0); 3301 3302 if (WARN_ON(status->band >= IEEE80211_NUM_BANDS)) 3303 goto drop; 3304 3305 sband = local->hw.wiphy->bands[status->band]; 3306 if (WARN_ON(!sband)) 3307 goto drop; 3308 3309 /* 3310 * If we're suspending, it is possible although not too likely 3311 * that we'd be receiving frames after having already partially 3312 * quiesced the stack. We can't process such frames then since 3313 * that might, for example, cause stations to be added or other 3314 * driver callbacks be invoked. 3315 */ 3316 if (unlikely(local->quiescing || local->suspended)) 3317 goto drop; 3318 3319 /* We might be during a HW reconfig, prevent Rx for the same reason */ 3320 if (unlikely(local->in_reconfig)) 3321 goto drop; 3322 3323 /* 3324 * The same happens when we're not even started, 3325 * but that's worth a warning. 3326 */ 3327 if (WARN_ON(!local->started)) 3328 goto drop; 3329 3330 if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC))) { 3331 /* 3332 * Validate the rate, unless a PLCP error means that 3333 * we probably can't have a valid rate here anyway. 3334 */ 3335 3336 if (status->flag & RX_FLAG_HT) { 3337 /* 3338 * rate_idx is MCS index, which can be [0-76] 3339 * as documented on: 3340 * 3341 * http://wireless.kernel.org/en/developers/Documentation/ieee80211/802.11n 3342 * 3343 * Anything else would be some sort of driver or 3344 * hardware error. The driver should catch hardware 3345 * errors. 3346 */ 3347 if (WARN(status->rate_idx > 76, 3348 "Rate marked as an HT rate but passed " 3349 "status->rate_idx is not " 3350 "an MCS index [0-76]: %d (0x%02x)\n", 3351 status->rate_idx, 3352 status->rate_idx)) 3353 goto drop; 3354 } else if (status->flag & RX_FLAG_VHT) { 3355 if (WARN_ONCE(status->rate_idx > 9 || 3356 !status->vht_nss || 3357 status->vht_nss > 8, 3358 "Rate marked as a VHT rate but data is invalid: MCS: %d, NSS: %d\n", 3359 status->rate_idx, status->vht_nss)) 3360 goto drop; 3361 } else { 3362 if (WARN_ON(status->rate_idx >= sband->n_bitrates)) 3363 goto drop; 3364 rate = &sband->bitrates[status->rate_idx]; 3365 } 3366 } 3367 3368 status->rx_flags = 0; 3369 3370 /* 3371 * key references and virtual interfaces are protected using RCU 3372 * and this requires that we are in a read-side RCU section during 3373 * receive processing 3374 */ 3375 rcu_read_lock(); 3376 3377 /* 3378 * Frames with failed FCS/PLCP checksum are not returned, 3379 * all other frames are returned without radiotap header 3380 * if it was previously present. 3381 * Also, frames with less than 16 bytes are dropped. 3382 */ 3383 skb = ieee80211_rx_monitor(local, skb, rate); 3384 if (!skb) { 3385 rcu_read_unlock(); 3386 return; 3387 } 3388 3389 ieee80211_tpt_led_trig_rx(local, 3390 ((struct ieee80211_hdr *)skb->data)->frame_control, 3391 skb->len); 3392 __ieee80211_rx_handle_packet(hw, skb); 3393 3394 rcu_read_unlock(); 3395 3396 return; 3397 drop: 3398 kfree_skb(skb); 3399 } 3400 EXPORT_SYMBOL(ieee80211_rx); 3401 3402 /* This is a version of the rx handler that can be called from hard irq 3403 * context. Post the skb on the queue and schedule the tasklet */ 3404 void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb) 3405 { 3406 struct ieee80211_local *local = hw_to_local(hw); 3407 3408 BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb)); 3409 3410 skb->pkt_type = IEEE80211_RX_MSG; 3411 skb_queue_tail(&local->skb_queue, skb); 3412 tasklet_schedule(&local->tasklet); 3413 } 3414 EXPORT_SYMBOL(ieee80211_rx_irqsafe); 3415