1 /* 2 * Copyright 2002-2005, Instant802 Networks, Inc. 3 * Copyright 2005-2006, Devicescape Software, Inc. 4 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz> 5 * Copyright 2007-2010 Johannes Berg <johannes@sipsolutions.net> 6 * Copyright 2013-2014 Intel Mobile Communications GmbH 7 * Copyright(c) 2015 - 2017 Intel Deutschland GmbH 8 * 9 * This program is free software; you can redistribute it and/or modify 10 * it under the terms of the GNU General Public License version 2 as 11 * published by the Free Software Foundation. 12 */ 13 14 #include <linux/jiffies.h> 15 #include <linux/slab.h> 16 #include <linux/kernel.h> 17 #include <linux/skbuff.h> 18 #include <linux/netdevice.h> 19 #include <linux/etherdevice.h> 20 #include <linux/rcupdate.h> 21 #include <linux/export.h> 22 #include <linux/bitops.h> 23 #include <net/mac80211.h> 24 #include <net/ieee80211_radiotap.h> 25 #include <asm/unaligned.h> 26 27 #include "ieee80211_i.h" 28 #include "driver-ops.h" 29 #include "led.h" 30 #include "mesh.h" 31 #include "wep.h" 32 #include "wpa.h" 33 #include "tkip.h" 34 #include "wme.h" 35 #include "rate.h" 36 37 static inline void ieee80211_rx_stats(struct net_device *dev, u32 len) 38 { 39 struct pcpu_sw_netstats *tstats = this_cpu_ptr(dev->tstats); 40 41 u64_stats_update_begin(&tstats->syncp); 42 tstats->rx_packets++; 43 tstats->rx_bytes += len; 44 u64_stats_update_end(&tstats->syncp); 45 } 46 47 static u8 *ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len, 48 enum nl80211_iftype type) 49 { 50 __le16 fc = hdr->frame_control; 51 52 if (ieee80211_is_data(fc)) { 53 if (len < 24) /* drop incorrect hdr len (data) */ 54 return NULL; 55 56 if (ieee80211_has_a4(fc)) 57 return NULL; 58 if (ieee80211_has_tods(fc)) 59 return hdr->addr1; 60 if (ieee80211_has_fromds(fc)) 61 return hdr->addr2; 62 63 return hdr->addr3; 64 } 65 66 if (ieee80211_is_mgmt(fc)) { 67 if (len < 24) /* drop incorrect hdr len (mgmt) */ 68 return NULL; 69 return hdr->addr3; 70 } 71 72 if (ieee80211_is_ctl(fc)) { 73 if (ieee80211_is_pspoll(fc)) 74 return hdr->addr1; 75 76 if (ieee80211_is_back_req(fc)) { 77 switch (type) { 78 case NL80211_IFTYPE_STATION: 79 return hdr->addr2; 80 case NL80211_IFTYPE_AP: 81 case NL80211_IFTYPE_AP_VLAN: 82 return hdr->addr1; 83 default: 84 break; /* fall through to the return */ 85 } 86 } 87 } 88 89 return NULL; 90 } 91 92 /* 93 * monitor mode reception 94 * 95 * This function cleans up the SKB, i.e. it removes all the stuff 96 * only useful for monitoring. 97 */ 98 static struct sk_buff *remove_monitor_info(struct ieee80211_local *local, 99 struct sk_buff *skb, 100 unsigned int rtap_vendor_space) 101 { 102 if (ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)) { 103 if (likely(skb->len > FCS_LEN)) 104 __pskb_trim(skb, skb->len - FCS_LEN); 105 else { 106 /* driver bug */ 107 WARN_ON(1); 108 dev_kfree_skb(skb); 109 return NULL; 110 } 111 } 112 113 __pskb_pull(skb, rtap_vendor_space); 114 115 return skb; 116 } 117 118 static inline bool should_drop_frame(struct sk_buff *skb, int present_fcs_len, 119 unsigned int rtap_vendor_space) 120 { 121 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 122 struct ieee80211_hdr *hdr; 123 124 hdr = (void *)(skb->data + rtap_vendor_space); 125 126 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | 127 RX_FLAG_FAILED_PLCP_CRC | 128 RX_FLAG_ONLY_MONITOR)) 129 return true; 130 131 if (unlikely(skb->len < 16 + present_fcs_len + rtap_vendor_space)) 132 return true; 133 134 if (ieee80211_is_ctl(hdr->frame_control) && 135 !ieee80211_is_pspoll(hdr->frame_control) && 136 !ieee80211_is_back_req(hdr->frame_control)) 137 return true; 138 139 return false; 140 } 141 142 static int 143 ieee80211_rx_radiotap_hdrlen(struct ieee80211_local *local, 144 struct ieee80211_rx_status *status, 145 struct sk_buff *skb) 146 { 147 int len; 148 149 /* always present fields */ 150 len = sizeof(struct ieee80211_radiotap_header) + 8; 151 152 /* allocate extra bitmaps */ 153 if (status->chains) 154 len += 4 * hweight8(status->chains); 155 156 if (ieee80211_have_rx_timestamp(status)) { 157 len = ALIGN(len, 8); 158 len += 8; 159 } 160 if (ieee80211_hw_check(&local->hw, SIGNAL_DBM)) 161 len += 1; 162 163 /* antenna field, if we don't have per-chain info */ 164 if (!status->chains) 165 len += 1; 166 167 /* padding for RX_FLAGS if necessary */ 168 len = ALIGN(len, 2); 169 170 if (status->flag & RX_FLAG_HT) /* HT info */ 171 len += 3; 172 173 if (status->flag & RX_FLAG_AMPDU_DETAILS) { 174 len = ALIGN(len, 4); 175 len += 8; 176 } 177 178 if (status->flag & RX_FLAG_VHT) { 179 len = ALIGN(len, 2); 180 len += 12; 181 } 182 183 if (local->hw.radiotap_timestamp.units_pos >= 0) { 184 len = ALIGN(len, 8); 185 len += 12; 186 } 187 188 if (status->chains) { 189 /* antenna and antenna signal fields */ 190 len += 2 * hweight8(status->chains); 191 } 192 193 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) { 194 struct ieee80211_vendor_radiotap *rtap = (void *)skb->data; 195 196 /* vendor presence bitmap */ 197 len += 4; 198 /* alignment for fixed 6-byte vendor data header */ 199 len = ALIGN(len, 2); 200 /* vendor data header */ 201 len += 6; 202 if (WARN_ON(rtap->align == 0)) 203 rtap->align = 1; 204 len = ALIGN(len, rtap->align); 205 len += rtap->len + rtap->pad; 206 } 207 208 return len; 209 } 210 211 static void ieee80211_handle_mu_mimo_mon(struct ieee80211_sub_if_data *sdata, 212 struct sk_buff *skb, 213 int rtap_vendor_space) 214 { 215 struct { 216 struct ieee80211_hdr_3addr hdr; 217 u8 category; 218 u8 action_code; 219 } __packed action; 220 221 if (!sdata) 222 return; 223 224 BUILD_BUG_ON(sizeof(action) != IEEE80211_MIN_ACTION_SIZE + 1); 225 226 if (skb->len < rtap_vendor_space + sizeof(action) + 227 VHT_MUMIMO_GROUPS_DATA_LEN) 228 return; 229 230 if (!is_valid_ether_addr(sdata->u.mntr.mu_follow_addr)) 231 return; 232 233 skb_copy_bits(skb, rtap_vendor_space, &action, sizeof(action)); 234 235 if (!ieee80211_is_action(action.hdr.frame_control)) 236 return; 237 238 if (action.category != WLAN_CATEGORY_VHT) 239 return; 240 241 if (action.action_code != WLAN_VHT_ACTION_GROUPID_MGMT) 242 return; 243 244 if (!ether_addr_equal(action.hdr.addr1, sdata->u.mntr.mu_follow_addr)) 245 return; 246 247 skb = skb_copy(skb, GFP_ATOMIC); 248 if (!skb) 249 return; 250 251 skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME; 252 skb_queue_tail(&sdata->skb_queue, skb); 253 ieee80211_queue_work(&sdata->local->hw, &sdata->work); 254 } 255 256 /* 257 * ieee80211_add_rx_radiotap_header - add radiotap header 258 * 259 * add a radiotap header containing all the fields which the hardware provided. 260 */ 261 static void 262 ieee80211_add_rx_radiotap_header(struct ieee80211_local *local, 263 struct sk_buff *skb, 264 struct ieee80211_rate *rate, 265 int rtap_len, bool has_fcs) 266 { 267 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 268 struct ieee80211_radiotap_header *rthdr; 269 unsigned char *pos; 270 __le32 *it_present; 271 u32 it_present_val; 272 u16 rx_flags = 0; 273 u16 channel_flags = 0; 274 int mpdulen, chain; 275 unsigned long chains = status->chains; 276 struct ieee80211_vendor_radiotap rtap = {}; 277 278 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) { 279 rtap = *(struct ieee80211_vendor_radiotap *)skb->data; 280 /* rtap.len and rtap.pad are undone immediately */ 281 skb_pull(skb, sizeof(rtap) + rtap.len + rtap.pad); 282 } 283 284 mpdulen = skb->len; 285 if (!(has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS))) 286 mpdulen += FCS_LEN; 287 288 rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len); 289 memset(rthdr, 0, rtap_len - rtap.len - rtap.pad); 290 it_present = &rthdr->it_present; 291 292 /* radiotap header, set always present flags */ 293 rthdr->it_len = cpu_to_le16(rtap_len); 294 it_present_val = BIT(IEEE80211_RADIOTAP_FLAGS) | 295 BIT(IEEE80211_RADIOTAP_CHANNEL) | 296 BIT(IEEE80211_RADIOTAP_RX_FLAGS); 297 298 if (!status->chains) 299 it_present_val |= BIT(IEEE80211_RADIOTAP_ANTENNA); 300 301 for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) { 302 it_present_val |= 303 BIT(IEEE80211_RADIOTAP_EXT) | 304 BIT(IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE); 305 put_unaligned_le32(it_present_val, it_present); 306 it_present++; 307 it_present_val = BIT(IEEE80211_RADIOTAP_ANTENNA) | 308 BIT(IEEE80211_RADIOTAP_DBM_ANTSIGNAL); 309 } 310 311 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) { 312 it_present_val |= BIT(IEEE80211_RADIOTAP_VENDOR_NAMESPACE) | 313 BIT(IEEE80211_RADIOTAP_EXT); 314 put_unaligned_le32(it_present_val, it_present); 315 it_present++; 316 it_present_val = rtap.present; 317 } 318 319 put_unaligned_le32(it_present_val, it_present); 320 321 pos = (void *)(it_present + 1); 322 323 /* the order of the following fields is important */ 324 325 /* IEEE80211_RADIOTAP_TSFT */ 326 if (ieee80211_have_rx_timestamp(status)) { 327 /* padding */ 328 while ((pos - (u8 *)rthdr) & 7) 329 *pos++ = 0; 330 put_unaligned_le64( 331 ieee80211_calculate_rx_timestamp(local, status, 332 mpdulen, 0), 333 pos); 334 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT); 335 pos += 8; 336 } 337 338 /* IEEE80211_RADIOTAP_FLAGS */ 339 if (has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)) 340 *pos |= IEEE80211_RADIOTAP_F_FCS; 341 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC)) 342 *pos |= IEEE80211_RADIOTAP_F_BADFCS; 343 if (status->flag & RX_FLAG_SHORTPRE) 344 *pos |= IEEE80211_RADIOTAP_F_SHORTPRE; 345 pos++; 346 347 /* IEEE80211_RADIOTAP_RATE */ 348 if (!rate || status->flag & (RX_FLAG_HT | RX_FLAG_VHT)) { 349 /* 350 * Without rate information don't add it. If we have, 351 * MCS information is a separate field in radiotap, 352 * added below. The byte here is needed as padding 353 * for the channel though, so initialise it to 0. 354 */ 355 *pos = 0; 356 } else { 357 int shift = 0; 358 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE); 359 if (status->flag & RX_FLAG_10MHZ) 360 shift = 1; 361 else if (status->flag & RX_FLAG_5MHZ) 362 shift = 2; 363 *pos = DIV_ROUND_UP(rate->bitrate, 5 * (1 << shift)); 364 } 365 pos++; 366 367 /* IEEE80211_RADIOTAP_CHANNEL */ 368 put_unaligned_le16(status->freq, pos); 369 pos += 2; 370 if (status->flag & RX_FLAG_10MHZ) 371 channel_flags |= IEEE80211_CHAN_HALF; 372 else if (status->flag & RX_FLAG_5MHZ) 373 channel_flags |= IEEE80211_CHAN_QUARTER; 374 375 if (status->band == NL80211_BAND_5GHZ) 376 channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ; 377 else if (status->flag & (RX_FLAG_HT | RX_FLAG_VHT)) 378 channel_flags |= IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ; 379 else if (rate && rate->flags & IEEE80211_RATE_ERP_G) 380 channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ; 381 else if (rate) 382 channel_flags |= IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ; 383 else 384 channel_flags |= IEEE80211_CHAN_2GHZ; 385 put_unaligned_le16(channel_flags, pos); 386 pos += 2; 387 388 /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */ 389 if (ieee80211_hw_check(&local->hw, SIGNAL_DBM) && 390 !(status->flag & RX_FLAG_NO_SIGNAL_VAL)) { 391 *pos = status->signal; 392 rthdr->it_present |= 393 cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL); 394 pos++; 395 } 396 397 /* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */ 398 399 if (!status->chains) { 400 /* IEEE80211_RADIOTAP_ANTENNA */ 401 *pos = status->antenna; 402 pos++; 403 } 404 405 /* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */ 406 407 /* IEEE80211_RADIOTAP_RX_FLAGS */ 408 /* ensure 2 byte alignment for the 2 byte field as required */ 409 if ((pos - (u8 *)rthdr) & 1) 410 *pos++ = 0; 411 if (status->flag & RX_FLAG_FAILED_PLCP_CRC) 412 rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP; 413 put_unaligned_le16(rx_flags, pos); 414 pos += 2; 415 416 if (status->flag & RX_FLAG_HT) { 417 unsigned int stbc; 418 419 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_MCS); 420 *pos++ = local->hw.radiotap_mcs_details; 421 *pos = 0; 422 if (status->flag & RX_FLAG_SHORT_GI) 423 *pos |= IEEE80211_RADIOTAP_MCS_SGI; 424 if (status->flag & RX_FLAG_40MHZ) 425 *pos |= IEEE80211_RADIOTAP_MCS_BW_40; 426 if (status->flag & RX_FLAG_HT_GF) 427 *pos |= IEEE80211_RADIOTAP_MCS_FMT_GF; 428 if (status->flag & RX_FLAG_LDPC) 429 *pos |= IEEE80211_RADIOTAP_MCS_FEC_LDPC; 430 stbc = (status->flag & RX_FLAG_STBC_MASK) >> RX_FLAG_STBC_SHIFT; 431 *pos |= stbc << IEEE80211_RADIOTAP_MCS_STBC_SHIFT; 432 pos++; 433 *pos++ = status->rate_idx; 434 } 435 436 if (status->flag & RX_FLAG_AMPDU_DETAILS) { 437 u16 flags = 0; 438 439 /* ensure 4 byte alignment */ 440 while ((pos - (u8 *)rthdr) & 3) 441 pos++; 442 rthdr->it_present |= 443 cpu_to_le32(1 << IEEE80211_RADIOTAP_AMPDU_STATUS); 444 put_unaligned_le32(status->ampdu_reference, pos); 445 pos += 4; 446 if (status->flag & RX_FLAG_AMPDU_LAST_KNOWN) 447 flags |= IEEE80211_RADIOTAP_AMPDU_LAST_KNOWN; 448 if (status->flag & RX_FLAG_AMPDU_IS_LAST) 449 flags |= IEEE80211_RADIOTAP_AMPDU_IS_LAST; 450 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_ERROR) 451 flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_ERR; 452 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN) 453 flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_KNOWN; 454 put_unaligned_le16(flags, pos); 455 pos += 2; 456 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN) 457 *pos++ = status->ampdu_delimiter_crc; 458 else 459 *pos++ = 0; 460 *pos++ = 0; 461 } 462 463 if (status->flag & RX_FLAG_VHT) { 464 u16 known = local->hw.radiotap_vht_details; 465 466 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_VHT); 467 put_unaligned_le16(known, pos); 468 pos += 2; 469 /* flags */ 470 if (status->flag & RX_FLAG_SHORT_GI) 471 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_SGI; 472 /* in VHT, STBC is binary */ 473 if (status->flag & RX_FLAG_STBC_MASK) 474 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_STBC; 475 if (status->vht_flag & RX_VHT_FLAG_BF) 476 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_BEAMFORMED; 477 pos++; 478 /* bandwidth */ 479 if (status->vht_flag & RX_VHT_FLAG_80MHZ) 480 *pos++ = 4; 481 else if (status->vht_flag & RX_VHT_FLAG_160MHZ) 482 *pos++ = 11; 483 else if (status->flag & RX_FLAG_40MHZ) 484 *pos++ = 1; 485 else /* 20 MHz */ 486 *pos++ = 0; 487 /* MCS/NSS */ 488 *pos = (status->rate_idx << 4) | status->vht_nss; 489 pos += 4; 490 /* coding field */ 491 if (status->flag & RX_FLAG_LDPC) 492 *pos |= IEEE80211_RADIOTAP_CODING_LDPC_USER0; 493 pos++; 494 /* group ID */ 495 pos++; 496 /* partial_aid */ 497 pos += 2; 498 } 499 500 if (local->hw.radiotap_timestamp.units_pos >= 0) { 501 u16 accuracy = 0; 502 u8 flags = IEEE80211_RADIOTAP_TIMESTAMP_FLAG_32BIT; 503 504 rthdr->it_present |= 505 cpu_to_le32(1 << IEEE80211_RADIOTAP_TIMESTAMP); 506 507 /* ensure 8 byte alignment */ 508 while ((pos - (u8 *)rthdr) & 7) 509 pos++; 510 511 put_unaligned_le64(status->device_timestamp, pos); 512 pos += sizeof(u64); 513 514 if (local->hw.radiotap_timestamp.accuracy >= 0) { 515 accuracy = local->hw.radiotap_timestamp.accuracy; 516 flags |= IEEE80211_RADIOTAP_TIMESTAMP_FLAG_ACCURACY; 517 } 518 put_unaligned_le16(accuracy, pos); 519 pos += sizeof(u16); 520 521 *pos++ = local->hw.radiotap_timestamp.units_pos; 522 *pos++ = flags; 523 } 524 525 for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) { 526 *pos++ = status->chain_signal[chain]; 527 *pos++ = chain; 528 } 529 530 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) { 531 /* ensure 2 byte alignment for the vendor field as required */ 532 if ((pos - (u8 *)rthdr) & 1) 533 *pos++ = 0; 534 *pos++ = rtap.oui[0]; 535 *pos++ = rtap.oui[1]; 536 *pos++ = rtap.oui[2]; 537 *pos++ = rtap.subns; 538 put_unaligned_le16(rtap.len, pos); 539 pos += 2; 540 /* align the actual payload as requested */ 541 while ((pos - (u8 *)rthdr) & (rtap.align - 1)) 542 *pos++ = 0; 543 /* data (and possible padding) already follows */ 544 } 545 } 546 547 /* 548 * This function copies a received frame to all monitor interfaces and 549 * returns a cleaned-up SKB that no longer includes the FCS nor the 550 * radiotap header the driver might have added. 551 */ 552 static struct sk_buff * 553 ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb, 554 struct ieee80211_rate *rate) 555 { 556 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb); 557 struct ieee80211_sub_if_data *sdata; 558 int rt_hdrlen, needed_headroom; 559 struct sk_buff *skb, *skb2; 560 struct net_device *prev_dev = NULL; 561 int present_fcs_len = 0; 562 unsigned int rtap_vendor_space = 0; 563 struct ieee80211_sub_if_data *monitor_sdata = 564 rcu_dereference(local->monitor_sdata); 565 566 if (unlikely(status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA)) { 567 struct ieee80211_vendor_radiotap *rtap = (void *)origskb->data; 568 569 rtap_vendor_space = sizeof(*rtap) + rtap->len + rtap->pad; 570 } 571 572 /* 573 * First, we may need to make a copy of the skb because 574 * (1) we need to modify it for radiotap (if not present), and 575 * (2) the other RX handlers will modify the skb we got. 576 * 577 * We don't need to, of course, if we aren't going to return 578 * the SKB because it has a bad FCS/PLCP checksum. 579 */ 580 581 if (ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)) 582 present_fcs_len = FCS_LEN; 583 584 /* ensure hdr->frame_control and vendor radiotap data are in skb head */ 585 if (!pskb_may_pull(origskb, 2 + rtap_vendor_space)) { 586 dev_kfree_skb(origskb); 587 return NULL; 588 } 589 590 if (!local->monitors || (status->flag & RX_FLAG_SKIP_MONITOR)) { 591 if (should_drop_frame(origskb, present_fcs_len, 592 rtap_vendor_space)) { 593 dev_kfree_skb(origskb); 594 return NULL; 595 } 596 597 return remove_monitor_info(local, origskb, rtap_vendor_space); 598 } 599 600 ieee80211_handle_mu_mimo_mon(monitor_sdata, origskb, rtap_vendor_space); 601 602 /* room for the radiotap header based on driver features */ 603 rt_hdrlen = ieee80211_rx_radiotap_hdrlen(local, status, origskb); 604 needed_headroom = rt_hdrlen - rtap_vendor_space; 605 606 if (should_drop_frame(origskb, present_fcs_len, rtap_vendor_space)) { 607 /* only need to expand headroom if necessary */ 608 skb = origskb; 609 origskb = NULL; 610 611 /* 612 * This shouldn't trigger often because most devices have an 613 * RX header they pull before we get here, and that should 614 * be big enough for our radiotap information. We should 615 * probably export the length to drivers so that we can have 616 * them allocate enough headroom to start with. 617 */ 618 if (skb_headroom(skb) < needed_headroom && 619 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) { 620 dev_kfree_skb(skb); 621 return NULL; 622 } 623 } else { 624 /* 625 * Need to make a copy and possibly remove radiotap header 626 * and FCS from the original. 627 */ 628 skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC); 629 630 origskb = remove_monitor_info(local, origskb, 631 rtap_vendor_space); 632 633 if (!skb) 634 return origskb; 635 } 636 637 /* prepend radiotap information */ 638 ieee80211_add_rx_radiotap_header(local, skb, rate, rt_hdrlen, true); 639 640 skb_reset_mac_header(skb); 641 skb->ip_summed = CHECKSUM_UNNECESSARY; 642 skb->pkt_type = PACKET_OTHERHOST; 643 skb->protocol = htons(ETH_P_802_2); 644 645 list_for_each_entry_rcu(sdata, &local->interfaces, list) { 646 if (sdata->vif.type != NL80211_IFTYPE_MONITOR) 647 continue; 648 649 if (sdata->u.mntr.flags & MONITOR_FLAG_COOK_FRAMES) 650 continue; 651 652 if (!ieee80211_sdata_running(sdata)) 653 continue; 654 655 if (prev_dev) { 656 skb2 = skb_clone(skb, GFP_ATOMIC); 657 if (skb2) { 658 skb2->dev = prev_dev; 659 netif_receive_skb(skb2); 660 } 661 } 662 663 prev_dev = sdata->dev; 664 ieee80211_rx_stats(sdata->dev, skb->len); 665 } 666 667 if (prev_dev) { 668 skb->dev = prev_dev; 669 netif_receive_skb(skb); 670 } else 671 dev_kfree_skb(skb); 672 673 return origskb; 674 } 675 676 static void ieee80211_parse_qos(struct ieee80211_rx_data *rx) 677 { 678 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 679 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 680 int tid, seqno_idx, security_idx; 681 682 /* does the frame have a qos control field? */ 683 if (ieee80211_is_data_qos(hdr->frame_control)) { 684 u8 *qc = ieee80211_get_qos_ctl(hdr); 685 /* frame has qos control */ 686 tid = *qc & IEEE80211_QOS_CTL_TID_MASK; 687 if (*qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT) 688 status->rx_flags |= IEEE80211_RX_AMSDU; 689 690 seqno_idx = tid; 691 security_idx = tid; 692 } else { 693 /* 694 * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"): 695 * 696 * Sequence numbers for management frames, QoS data 697 * frames with a broadcast/multicast address in the 698 * Address 1 field, and all non-QoS data frames sent 699 * by QoS STAs are assigned using an additional single 700 * modulo-4096 counter, [...] 701 * 702 * We also use that counter for non-QoS STAs. 703 */ 704 seqno_idx = IEEE80211_NUM_TIDS; 705 security_idx = 0; 706 if (ieee80211_is_mgmt(hdr->frame_control)) 707 security_idx = IEEE80211_NUM_TIDS; 708 tid = 0; 709 } 710 711 rx->seqno_idx = seqno_idx; 712 rx->security_idx = security_idx; 713 /* Set skb->priority to 1d tag if highest order bit of TID is not set. 714 * For now, set skb->priority to 0 for other cases. */ 715 rx->skb->priority = (tid > 7) ? 0 : tid; 716 } 717 718 /** 719 * DOC: Packet alignment 720 * 721 * Drivers always need to pass packets that are aligned to two-byte boundaries 722 * to the stack. 723 * 724 * Additionally, should, if possible, align the payload data in a way that 725 * guarantees that the contained IP header is aligned to a four-byte 726 * boundary. In the case of regular frames, this simply means aligning the 727 * payload to a four-byte boundary (because either the IP header is directly 728 * contained, or IV/RFC1042 headers that have a length divisible by four are 729 * in front of it). If the payload data is not properly aligned and the 730 * architecture doesn't support efficient unaligned operations, mac80211 731 * will align the data. 732 * 733 * With A-MSDU frames, however, the payload data address must yield two modulo 734 * four because there are 14-byte 802.3 headers within the A-MSDU frames that 735 * push the IP header further back to a multiple of four again. Thankfully, the 736 * specs were sane enough this time around to require padding each A-MSDU 737 * subframe to a length that is a multiple of four. 738 * 739 * Padding like Atheros hardware adds which is between the 802.11 header and 740 * the payload is not supported, the driver is required to move the 802.11 741 * header to be directly in front of the payload in that case. 742 */ 743 static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx) 744 { 745 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG 746 WARN_ON_ONCE((unsigned long)rx->skb->data & 1); 747 #endif 748 } 749 750 751 /* rx handlers */ 752 753 static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb) 754 { 755 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 756 757 if (is_multicast_ether_addr(hdr->addr1)) 758 return 0; 759 760 return ieee80211_is_robust_mgmt_frame(skb); 761 } 762 763 764 static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb) 765 { 766 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 767 768 if (!is_multicast_ether_addr(hdr->addr1)) 769 return 0; 770 771 return ieee80211_is_robust_mgmt_frame(skb); 772 } 773 774 775 /* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */ 776 static int ieee80211_get_mmie_keyidx(struct sk_buff *skb) 777 { 778 struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data; 779 struct ieee80211_mmie *mmie; 780 struct ieee80211_mmie_16 *mmie16; 781 782 if (skb->len < 24 + sizeof(*mmie) || !is_multicast_ether_addr(hdr->da)) 783 return -1; 784 785 if (!ieee80211_is_robust_mgmt_frame(skb)) 786 return -1; /* not a robust management frame */ 787 788 mmie = (struct ieee80211_mmie *) 789 (skb->data + skb->len - sizeof(*mmie)); 790 if (mmie->element_id == WLAN_EID_MMIE && 791 mmie->length == sizeof(*mmie) - 2) 792 return le16_to_cpu(mmie->key_id); 793 794 mmie16 = (struct ieee80211_mmie_16 *) 795 (skb->data + skb->len - sizeof(*mmie16)); 796 if (skb->len >= 24 + sizeof(*mmie16) && 797 mmie16->element_id == WLAN_EID_MMIE && 798 mmie16->length == sizeof(*mmie16) - 2) 799 return le16_to_cpu(mmie16->key_id); 800 801 return -1; 802 } 803 804 static int ieee80211_get_cs_keyid(const struct ieee80211_cipher_scheme *cs, 805 struct sk_buff *skb) 806 { 807 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; 808 __le16 fc; 809 int hdrlen; 810 u8 keyid; 811 812 fc = hdr->frame_control; 813 hdrlen = ieee80211_hdrlen(fc); 814 815 if (skb->len < hdrlen + cs->hdr_len) 816 return -EINVAL; 817 818 skb_copy_bits(skb, hdrlen + cs->key_idx_off, &keyid, 1); 819 keyid &= cs->key_idx_mask; 820 keyid >>= cs->key_idx_shift; 821 822 return keyid; 823 } 824 825 static ieee80211_rx_result ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx) 826 { 827 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 828 char *dev_addr = rx->sdata->vif.addr; 829 830 if (ieee80211_is_data(hdr->frame_control)) { 831 if (is_multicast_ether_addr(hdr->addr1)) { 832 if (ieee80211_has_tods(hdr->frame_control) || 833 !ieee80211_has_fromds(hdr->frame_control)) 834 return RX_DROP_MONITOR; 835 if (ether_addr_equal(hdr->addr3, dev_addr)) 836 return RX_DROP_MONITOR; 837 } else { 838 if (!ieee80211_has_a4(hdr->frame_control)) 839 return RX_DROP_MONITOR; 840 if (ether_addr_equal(hdr->addr4, dev_addr)) 841 return RX_DROP_MONITOR; 842 } 843 } 844 845 /* If there is not an established peer link and this is not a peer link 846 * establisment frame, beacon or probe, drop the frame. 847 */ 848 849 if (!rx->sta || sta_plink_state(rx->sta) != NL80211_PLINK_ESTAB) { 850 struct ieee80211_mgmt *mgmt; 851 852 if (!ieee80211_is_mgmt(hdr->frame_control)) 853 return RX_DROP_MONITOR; 854 855 if (ieee80211_is_action(hdr->frame_control)) { 856 u8 category; 857 858 /* make sure category field is present */ 859 if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE) 860 return RX_DROP_MONITOR; 861 862 mgmt = (struct ieee80211_mgmt *)hdr; 863 category = mgmt->u.action.category; 864 if (category != WLAN_CATEGORY_MESH_ACTION && 865 category != WLAN_CATEGORY_SELF_PROTECTED) 866 return RX_DROP_MONITOR; 867 return RX_CONTINUE; 868 } 869 870 if (ieee80211_is_probe_req(hdr->frame_control) || 871 ieee80211_is_probe_resp(hdr->frame_control) || 872 ieee80211_is_beacon(hdr->frame_control) || 873 ieee80211_is_auth(hdr->frame_control)) 874 return RX_CONTINUE; 875 876 return RX_DROP_MONITOR; 877 } 878 879 return RX_CONTINUE; 880 } 881 882 static inline bool ieee80211_rx_reorder_ready(struct tid_ampdu_rx *tid_agg_rx, 883 int index) 884 { 885 struct sk_buff_head *frames = &tid_agg_rx->reorder_buf[index]; 886 struct sk_buff *tail = skb_peek_tail(frames); 887 struct ieee80211_rx_status *status; 888 889 if (tid_agg_rx->reorder_buf_filtered & BIT_ULL(index)) 890 return true; 891 892 if (!tail) 893 return false; 894 895 status = IEEE80211_SKB_RXCB(tail); 896 if (status->flag & RX_FLAG_AMSDU_MORE) 897 return false; 898 899 return true; 900 } 901 902 static void ieee80211_release_reorder_frame(struct ieee80211_sub_if_data *sdata, 903 struct tid_ampdu_rx *tid_agg_rx, 904 int index, 905 struct sk_buff_head *frames) 906 { 907 struct sk_buff_head *skb_list = &tid_agg_rx->reorder_buf[index]; 908 struct sk_buff *skb; 909 struct ieee80211_rx_status *status; 910 911 lockdep_assert_held(&tid_agg_rx->reorder_lock); 912 913 if (skb_queue_empty(skb_list)) 914 goto no_frame; 915 916 if (!ieee80211_rx_reorder_ready(tid_agg_rx, index)) { 917 __skb_queue_purge(skb_list); 918 goto no_frame; 919 } 920 921 /* release frames from the reorder ring buffer */ 922 tid_agg_rx->stored_mpdu_num--; 923 while ((skb = __skb_dequeue(skb_list))) { 924 status = IEEE80211_SKB_RXCB(skb); 925 status->rx_flags |= IEEE80211_RX_DEFERRED_RELEASE; 926 __skb_queue_tail(frames, skb); 927 } 928 929 no_frame: 930 tid_agg_rx->reorder_buf_filtered &= ~BIT_ULL(index); 931 tid_agg_rx->head_seq_num = ieee80211_sn_inc(tid_agg_rx->head_seq_num); 932 } 933 934 static void ieee80211_release_reorder_frames(struct ieee80211_sub_if_data *sdata, 935 struct tid_ampdu_rx *tid_agg_rx, 936 u16 head_seq_num, 937 struct sk_buff_head *frames) 938 { 939 int index; 940 941 lockdep_assert_held(&tid_agg_rx->reorder_lock); 942 943 while (ieee80211_sn_less(tid_agg_rx->head_seq_num, head_seq_num)) { 944 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size; 945 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index, 946 frames); 947 } 948 } 949 950 /* 951 * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If 952 * the skb was added to the buffer longer than this time ago, the earlier 953 * frames that have not yet been received are assumed to be lost and the skb 954 * can be released for processing. This may also release other skb's from the 955 * reorder buffer if there are no additional gaps between the frames. 956 * 957 * Callers must hold tid_agg_rx->reorder_lock. 958 */ 959 #define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10) 960 961 static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata, 962 struct tid_ampdu_rx *tid_agg_rx, 963 struct sk_buff_head *frames) 964 { 965 int index, i, j; 966 967 lockdep_assert_held(&tid_agg_rx->reorder_lock); 968 969 /* release the buffer until next missing frame */ 970 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size; 971 if (!ieee80211_rx_reorder_ready(tid_agg_rx, index) && 972 tid_agg_rx->stored_mpdu_num) { 973 /* 974 * No buffers ready to be released, but check whether any 975 * frames in the reorder buffer have timed out. 976 */ 977 int skipped = 1; 978 for (j = (index + 1) % tid_agg_rx->buf_size; j != index; 979 j = (j + 1) % tid_agg_rx->buf_size) { 980 if (!ieee80211_rx_reorder_ready(tid_agg_rx, j)) { 981 skipped++; 982 continue; 983 } 984 if (skipped && 985 !time_after(jiffies, tid_agg_rx->reorder_time[j] + 986 HT_RX_REORDER_BUF_TIMEOUT)) 987 goto set_release_timer; 988 989 /* don't leave incomplete A-MSDUs around */ 990 for (i = (index + 1) % tid_agg_rx->buf_size; i != j; 991 i = (i + 1) % tid_agg_rx->buf_size) 992 __skb_queue_purge(&tid_agg_rx->reorder_buf[i]); 993 994 ht_dbg_ratelimited(sdata, 995 "release an RX reorder frame due to timeout on earlier frames\n"); 996 ieee80211_release_reorder_frame(sdata, tid_agg_rx, j, 997 frames); 998 999 /* 1000 * Increment the head seq# also for the skipped slots. 1001 */ 1002 tid_agg_rx->head_seq_num = 1003 (tid_agg_rx->head_seq_num + 1004 skipped) & IEEE80211_SN_MASK; 1005 skipped = 0; 1006 } 1007 } else while (ieee80211_rx_reorder_ready(tid_agg_rx, index)) { 1008 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index, 1009 frames); 1010 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size; 1011 } 1012 1013 if (tid_agg_rx->stored_mpdu_num) { 1014 j = index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size; 1015 1016 for (; j != (index - 1) % tid_agg_rx->buf_size; 1017 j = (j + 1) % tid_agg_rx->buf_size) { 1018 if (ieee80211_rx_reorder_ready(tid_agg_rx, j)) 1019 break; 1020 } 1021 1022 set_release_timer: 1023 1024 if (!tid_agg_rx->removed) 1025 mod_timer(&tid_agg_rx->reorder_timer, 1026 tid_agg_rx->reorder_time[j] + 1 + 1027 HT_RX_REORDER_BUF_TIMEOUT); 1028 } else { 1029 del_timer(&tid_agg_rx->reorder_timer); 1030 } 1031 } 1032 1033 /* 1034 * As this function belongs to the RX path it must be under 1035 * rcu_read_lock protection. It returns false if the frame 1036 * can be processed immediately, true if it was consumed. 1037 */ 1038 static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata, 1039 struct tid_ampdu_rx *tid_agg_rx, 1040 struct sk_buff *skb, 1041 struct sk_buff_head *frames) 1042 { 1043 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 1044 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 1045 u16 sc = le16_to_cpu(hdr->seq_ctrl); 1046 u16 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4; 1047 u16 head_seq_num, buf_size; 1048 int index; 1049 bool ret = true; 1050 1051 spin_lock(&tid_agg_rx->reorder_lock); 1052 1053 /* 1054 * Offloaded BA sessions have no known starting sequence number so pick 1055 * one from first Rxed frame for this tid after BA was started. 1056 */ 1057 if (unlikely(tid_agg_rx->auto_seq)) { 1058 tid_agg_rx->auto_seq = false; 1059 tid_agg_rx->ssn = mpdu_seq_num; 1060 tid_agg_rx->head_seq_num = mpdu_seq_num; 1061 } 1062 1063 buf_size = tid_agg_rx->buf_size; 1064 head_seq_num = tid_agg_rx->head_seq_num; 1065 1066 /* 1067 * If the current MPDU's SN is smaller than the SSN, it shouldn't 1068 * be reordered. 1069 */ 1070 if (unlikely(!tid_agg_rx->started)) { 1071 if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) { 1072 ret = false; 1073 goto out; 1074 } 1075 tid_agg_rx->started = true; 1076 } 1077 1078 /* frame with out of date sequence number */ 1079 if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) { 1080 dev_kfree_skb(skb); 1081 goto out; 1082 } 1083 1084 /* 1085 * If frame the sequence number exceeds our buffering window 1086 * size release some previous frames to make room for this one. 1087 */ 1088 if (!ieee80211_sn_less(mpdu_seq_num, head_seq_num + buf_size)) { 1089 head_seq_num = ieee80211_sn_inc( 1090 ieee80211_sn_sub(mpdu_seq_num, buf_size)); 1091 /* release stored frames up to new head to stack */ 1092 ieee80211_release_reorder_frames(sdata, tid_agg_rx, 1093 head_seq_num, frames); 1094 } 1095 1096 /* Now the new frame is always in the range of the reordering buffer */ 1097 1098 index = mpdu_seq_num % tid_agg_rx->buf_size; 1099 1100 /* check if we already stored this frame */ 1101 if (ieee80211_rx_reorder_ready(tid_agg_rx, index)) { 1102 dev_kfree_skb(skb); 1103 goto out; 1104 } 1105 1106 /* 1107 * If the current MPDU is in the right order and nothing else 1108 * is stored we can process it directly, no need to buffer it. 1109 * If it is first but there's something stored, we may be able 1110 * to release frames after this one. 1111 */ 1112 if (mpdu_seq_num == tid_agg_rx->head_seq_num && 1113 tid_agg_rx->stored_mpdu_num == 0) { 1114 if (!(status->flag & RX_FLAG_AMSDU_MORE)) 1115 tid_agg_rx->head_seq_num = 1116 ieee80211_sn_inc(tid_agg_rx->head_seq_num); 1117 ret = false; 1118 goto out; 1119 } 1120 1121 /* put the frame in the reordering buffer */ 1122 __skb_queue_tail(&tid_agg_rx->reorder_buf[index], skb); 1123 if (!(status->flag & RX_FLAG_AMSDU_MORE)) { 1124 tid_agg_rx->reorder_time[index] = jiffies; 1125 tid_agg_rx->stored_mpdu_num++; 1126 ieee80211_sta_reorder_release(sdata, tid_agg_rx, frames); 1127 } 1128 1129 out: 1130 spin_unlock(&tid_agg_rx->reorder_lock); 1131 return ret; 1132 } 1133 1134 /* 1135 * Reorder MPDUs from A-MPDUs, keeping them on a buffer. Returns 1136 * true if the MPDU was buffered, false if it should be processed. 1137 */ 1138 static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx, 1139 struct sk_buff_head *frames) 1140 { 1141 struct sk_buff *skb = rx->skb; 1142 struct ieee80211_local *local = rx->local; 1143 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 1144 struct sta_info *sta = rx->sta; 1145 struct tid_ampdu_rx *tid_agg_rx; 1146 u16 sc; 1147 u8 tid, ack_policy; 1148 1149 if (!ieee80211_is_data_qos(hdr->frame_control) || 1150 is_multicast_ether_addr(hdr->addr1)) 1151 goto dont_reorder; 1152 1153 /* 1154 * filter the QoS data rx stream according to 1155 * STA/TID and check if this STA/TID is on aggregation 1156 */ 1157 1158 if (!sta) 1159 goto dont_reorder; 1160 1161 ack_policy = *ieee80211_get_qos_ctl(hdr) & 1162 IEEE80211_QOS_CTL_ACK_POLICY_MASK; 1163 tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK; 1164 1165 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]); 1166 if (!tid_agg_rx) { 1167 if (ack_policy == IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK && 1168 !test_bit(tid, rx->sta->ampdu_mlme.agg_session_valid) && 1169 !test_and_set_bit(tid, rx->sta->ampdu_mlme.unexpected_agg)) 1170 ieee80211_send_delba(rx->sdata, rx->sta->sta.addr, tid, 1171 WLAN_BACK_RECIPIENT, 1172 WLAN_REASON_QSTA_REQUIRE_SETUP); 1173 goto dont_reorder; 1174 } 1175 1176 /* qos null data frames are excluded */ 1177 if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC))) 1178 goto dont_reorder; 1179 1180 /* not part of a BA session */ 1181 if (ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK && 1182 ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_NORMAL) 1183 goto dont_reorder; 1184 1185 /* new, potentially un-ordered, ampdu frame - process it */ 1186 1187 /* reset session timer */ 1188 if (tid_agg_rx->timeout) 1189 tid_agg_rx->last_rx = jiffies; 1190 1191 /* if this mpdu is fragmented - terminate rx aggregation session */ 1192 sc = le16_to_cpu(hdr->seq_ctrl); 1193 if (sc & IEEE80211_SCTL_FRAG) { 1194 skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME; 1195 skb_queue_tail(&rx->sdata->skb_queue, skb); 1196 ieee80211_queue_work(&local->hw, &rx->sdata->work); 1197 return; 1198 } 1199 1200 /* 1201 * No locking needed -- we will only ever process one 1202 * RX packet at a time, and thus own tid_agg_rx. All 1203 * other code manipulating it needs to (and does) make 1204 * sure that we cannot get to it any more before doing 1205 * anything with it. 1206 */ 1207 if (ieee80211_sta_manage_reorder_buf(rx->sdata, tid_agg_rx, skb, 1208 frames)) 1209 return; 1210 1211 dont_reorder: 1212 __skb_queue_tail(frames, skb); 1213 } 1214 1215 static ieee80211_rx_result debug_noinline 1216 ieee80211_rx_h_check_dup(struct ieee80211_rx_data *rx) 1217 { 1218 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 1219 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 1220 1221 if (status->flag & RX_FLAG_DUP_VALIDATED) 1222 return RX_CONTINUE; 1223 1224 /* 1225 * Drop duplicate 802.11 retransmissions 1226 * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery") 1227 */ 1228 1229 if (rx->skb->len < 24) 1230 return RX_CONTINUE; 1231 1232 if (ieee80211_is_ctl(hdr->frame_control) || 1233 ieee80211_is_qos_nullfunc(hdr->frame_control) || 1234 is_multicast_ether_addr(hdr->addr1)) 1235 return RX_CONTINUE; 1236 1237 if (!rx->sta) 1238 return RX_CONTINUE; 1239 1240 if (unlikely(ieee80211_has_retry(hdr->frame_control) && 1241 rx->sta->last_seq_ctrl[rx->seqno_idx] == hdr->seq_ctrl)) { 1242 I802_DEBUG_INC(rx->local->dot11FrameDuplicateCount); 1243 rx->sta->rx_stats.num_duplicates++; 1244 return RX_DROP_UNUSABLE; 1245 } else if (!(status->flag & RX_FLAG_AMSDU_MORE)) { 1246 rx->sta->last_seq_ctrl[rx->seqno_idx] = hdr->seq_ctrl; 1247 } 1248 1249 return RX_CONTINUE; 1250 } 1251 1252 static ieee80211_rx_result debug_noinline 1253 ieee80211_rx_h_check(struct ieee80211_rx_data *rx) 1254 { 1255 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 1256 1257 /* Drop disallowed frame classes based on STA auth/assoc state; 1258 * IEEE 802.11, Chap 5.5. 1259 * 1260 * mac80211 filters only based on association state, i.e. it drops 1261 * Class 3 frames from not associated stations. hostapd sends 1262 * deauth/disassoc frames when needed. In addition, hostapd is 1263 * responsible for filtering on both auth and assoc states. 1264 */ 1265 1266 if (ieee80211_vif_is_mesh(&rx->sdata->vif)) 1267 return ieee80211_rx_mesh_check(rx); 1268 1269 if (unlikely((ieee80211_is_data(hdr->frame_control) || 1270 ieee80211_is_pspoll(hdr->frame_control)) && 1271 rx->sdata->vif.type != NL80211_IFTYPE_ADHOC && 1272 rx->sdata->vif.type != NL80211_IFTYPE_WDS && 1273 rx->sdata->vif.type != NL80211_IFTYPE_OCB && 1274 (!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_ASSOC)))) { 1275 /* 1276 * accept port control frames from the AP even when it's not 1277 * yet marked ASSOC to prevent a race where we don't set the 1278 * assoc bit quickly enough before it sends the first frame 1279 */ 1280 if (rx->sta && rx->sdata->vif.type == NL80211_IFTYPE_STATION && 1281 ieee80211_is_data_present(hdr->frame_control)) { 1282 unsigned int hdrlen; 1283 __be16 ethertype; 1284 1285 hdrlen = ieee80211_hdrlen(hdr->frame_control); 1286 1287 if (rx->skb->len < hdrlen + 8) 1288 return RX_DROP_MONITOR; 1289 1290 skb_copy_bits(rx->skb, hdrlen + 6, ðertype, 2); 1291 if (ethertype == rx->sdata->control_port_protocol) 1292 return RX_CONTINUE; 1293 } 1294 1295 if (rx->sdata->vif.type == NL80211_IFTYPE_AP && 1296 cfg80211_rx_spurious_frame(rx->sdata->dev, 1297 hdr->addr2, 1298 GFP_ATOMIC)) 1299 return RX_DROP_UNUSABLE; 1300 1301 return RX_DROP_MONITOR; 1302 } 1303 1304 return RX_CONTINUE; 1305 } 1306 1307 1308 static ieee80211_rx_result debug_noinline 1309 ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx) 1310 { 1311 struct ieee80211_local *local; 1312 struct ieee80211_hdr *hdr; 1313 struct sk_buff *skb; 1314 1315 local = rx->local; 1316 skb = rx->skb; 1317 hdr = (struct ieee80211_hdr *) skb->data; 1318 1319 if (!local->pspolling) 1320 return RX_CONTINUE; 1321 1322 if (!ieee80211_has_fromds(hdr->frame_control)) 1323 /* this is not from AP */ 1324 return RX_CONTINUE; 1325 1326 if (!ieee80211_is_data(hdr->frame_control)) 1327 return RX_CONTINUE; 1328 1329 if (!ieee80211_has_moredata(hdr->frame_control)) { 1330 /* AP has no more frames buffered for us */ 1331 local->pspolling = false; 1332 return RX_CONTINUE; 1333 } 1334 1335 /* more data bit is set, let's request a new frame from the AP */ 1336 ieee80211_send_pspoll(local, rx->sdata); 1337 1338 return RX_CONTINUE; 1339 } 1340 1341 static void sta_ps_start(struct sta_info *sta) 1342 { 1343 struct ieee80211_sub_if_data *sdata = sta->sdata; 1344 struct ieee80211_local *local = sdata->local; 1345 struct ps_data *ps; 1346 int tid; 1347 1348 if (sta->sdata->vif.type == NL80211_IFTYPE_AP || 1349 sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) 1350 ps = &sdata->bss->ps; 1351 else 1352 return; 1353 1354 atomic_inc(&ps->num_sta_ps); 1355 set_sta_flag(sta, WLAN_STA_PS_STA); 1356 if (!ieee80211_hw_check(&local->hw, AP_LINK_PS)) 1357 drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta); 1358 ps_dbg(sdata, "STA %pM aid %d enters power save mode\n", 1359 sta->sta.addr, sta->sta.aid); 1360 1361 ieee80211_clear_fast_xmit(sta); 1362 1363 if (!sta->sta.txq[0]) 1364 return; 1365 1366 for (tid = 0; tid < ARRAY_SIZE(sta->sta.txq); tid++) { 1367 if (txq_has_queue(sta->sta.txq[tid])) 1368 set_bit(tid, &sta->txq_buffered_tids); 1369 else 1370 clear_bit(tid, &sta->txq_buffered_tids); 1371 } 1372 } 1373 1374 static void sta_ps_end(struct sta_info *sta) 1375 { 1376 ps_dbg(sta->sdata, "STA %pM aid %d exits power save mode\n", 1377 sta->sta.addr, sta->sta.aid); 1378 1379 if (test_sta_flag(sta, WLAN_STA_PS_DRIVER)) { 1380 /* 1381 * Clear the flag only if the other one is still set 1382 * so that the TX path won't start TX'ing new frames 1383 * directly ... In the case that the driver flag isn't 1384 * set ieee80211_sta_ps_deliver_wakeup() will clear it. 1385 */ 1386 clear_sta_flag(sta, WLAN_STA_PS_STA); 1387 ps_dbg(sta->sdata, "STA %pM aid %d driver-ps-blocked\n", 1388 sta->sta.addr, sta->sta.aid); 1389 return; 1390 } 1391 1392 set_sta_flag(sta, WLAN_STA_PS_DELIVER); 1393 clear_sta_flag(sta, WLAN_STA_PS_STA); 1394 ieee80211_sta_ps_deliver_wakeup(sta); 1395 } 1396 1397 int ieee80211_sta_ps_transition(struct ieee80211_sta *pubsta, bool start) 1398 { 1399 struct sta_info *sta = container_of(pubsta, struct sta_info, sta); 1400 bool in_ps; 1401 1402 WARN_ON(!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS)); 1403 1404 /* Don't let the same PS state be set twice */ 1405 in_ps = test_sta_flag(sta, WLAN_STA_PS_STA); 1406 if ((start && in_ps) || (!start && !in_ps)) 1407 return -EINVAL; 1408 1409 if (start) 1410 sta_ps_start(sta); 1411 else 1412 sta_ps_end(sta); 1413 1414 return 0; 1415 } 1416 EXPORT_SYMBOL(ieee80211_sta_ps_transition); 1417 1418 void ieee80211_sta_pspoll(struct ieee80211_sta *pubsta) 1419 { 1420 struct sta_info *sta = container_of(pubsta, struct sta_info, sta); 1421 1422 if (test_sta_flag(sta, WLAN_STA_SP)) 1423 return; 1424 1425 if (!test_sta_flag(sta, WLAN_STA_PS_DRIVER)) 1426 ieee80211_sta_ps_deliver_poll_response(sta); 1427 else 1428 set_sta_flag(sta, WLAN_STA_PSPOLL); 1429 } 1430 EXPORT_SYMBOL(ieee80211_sta_pspoll); 1431 1432 void ieee80211_sta_uapsd_trigger(struct ieee80211_sta *pubsta, u8 tid) 1433 { 1434 struct sta_info *sta = container_of(pubsta, struct sta_info, sta); 1435 int ac = ieee80211_ac_from_tid(tid); 1436 1437 /* 1438 * If this AC is not trigger-enabled do nothing unless the 1439 * driver is calling us after it already checked. 1440 * 1441 * NB: This could/should check a separate bitmap of trigger- 1442 * enabled queues, but for now we only implement uAPSD w/o 1443 * TSPEC changes to the ACs, so they're always the same. 1444 */ 1445 if (!(sta->sta.uapsd_queues & ieee80211_ac_to_qos_mask[ac]) && 1446 tid != IEEE80211_NUM_TIDS) 1447 return; 1448 1449 /* if we are in a service period, do nothing */ 1450 if (test_sta_flag(sta, WLAN_STA_SP)) 1451 return; 1452 1453 if (!test_sta_flag(sta, WLAN_STA_PS_DRIVER)) 1454 ieee80211_sta_ps_deliver_uapsd(sta); 1455 else 1456 set_sta_flag(sta, WLAN_STA_UAPSD); 1457 } 1458 EXPORT_SYMBOL(ieee80211_sta_uapsd_trigger); 1459 1460 static ieee80211_rx_result debug_noinline 1461 ieee80211_rx_h_uapsd_and_pspoll(struct ieee80211_rx_data *rx) 1462 { 1463 struct ieee80211_sub_if_data *sdata = rx->sdata; 1464 struct ieee80211_hdr *hdr = (void *)rx->skb->data; 1465 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 1466 1467 if (!rx->sta) 1468 return RX_CONTINUE; 1469 1470 if (sdata->vif.type != NL80211_IFTYPE_AP && 1471 sdata->vif.type != NL80211_IFTYPE_AP_VLAN) 1472 return RX_CONTINUE; 1473 1474 /* 1475 * The device handles station powersave, so don't do anything about 1476 * uAPSD and PS-Poll frames (the latter shouldn't even come up from 1477 * it to mac80211 since they're handled.) 1478 */ 1479 if (ieee80211_hw_check(&sdata->local->hw, AP_LINK_PS)) 1480 return RX_CONTINUE; 1481 1482 /* 1483 * Don't do anything if the station isn't already asleep. In 1484 * the uAPSD case, the station will probably be marked asleep, 1485 * in the PS-Poll case the station must be confused ... 1486 */ 1487 if (!test_sta_flag(rx->sta, WLAN_STA_PS_STA)) 1488 return RX_CONTINUE; 1489 1490 if (unlikely(ieee80211_is_pspoll(hdr->frame_control))) { 1491 ieee80211_sta_pspoll(&rx->sta->sta); 1492 1493 /* Free PS Poll skb here instead of returning RX_DROP that would 1494 * count as an dropped frame. */ 1495 dev_kfree_skb(rx->skb); 1496 1497 return RX_QUEUED; 1498 } else if (!ieee80211_has_morefrags(hdr->frame_control) && 1499 !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) && 1500 ieee80211_has_pm(hdr->frame_control) && 1501 (ieee80211_is_data_qos(hdr->frame_control) || 1502 ieee80211_is_qos_nullfunc(hdr->frame_control))) { 1503 u8 tid; 1504 1505 tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK; 1506 1507 ieee80211_sta_uapsd_trigger(&rx->sta->sta, tid); 1508 } 1509 1510 return RX_CONTINUE; 1511 } 1512 1513 static ieee80211_rx_result debug_noinline 1514 ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx) 1515 { 1516 struct sta_info *sta = rx->sta; 1517 struct sk_buff *skb = rx->skb; 1518 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 1519 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; 1520 int i; 1521 1522 if (!sta) 1523 return RX_CONTINUE; 1524 1525 /* 1526 * Update last_rx only for IBSS packets which are for the current 1527 * BSSID and for station already AUTHORIZED to avoid keeping the 1528 * current IBSS network alive in cases where other STAs start 1529 * using different BSSID. This will also give the station another 1530 * chance to restart the authentication/authorization in case 1531 * something went wrong the first time. 1532 */ 1533 if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) { 1534 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len, 1535 NL80211_IFTYPE_ADHOC); 1536 if (ether_addr_equal(bssid, rx->sdata->u.ibss.bssid) && 1537 test_sta_flag(sta, WLAN_STA_AUTHORIZED)) { 1538 sta->rx_stats.last_rx = jiffies; 1539 if (ieee80211_is_data(hdr->frame_control) && 1540 !is_multicast_ether_addr(hdr->addr1)) 1541 sta->rx_stats.last_rate = 1542 sta_stats_encode_rate(status); 1543 } 1544 } else if (rx->sdata->vif.type == NL80211_IFTYPE_OCB) { 1545 sta->rx_stats.last_rx = jiffies; 1546 } else if (!is_multicast_ether_addr(hdr->addr1)) { 1547 /* 1548 * Mesh beacons will update last_rx when if they are found to 1549 * match the current local configuration when processed. 1550 */ 1551 sta->rx_stats.last_rx = jiffies; 1552 if (ieee80211_is_data(hdr->frame_control)) 1553 sta->rx_stats.last_rate = sta_stats_encode_rate(status); 1554 } 1555 1556 if (rx->sdata->vif.type == NL80211_IFTYPE_STATION) 1557 ieee80211_sta_rx_notify(rx->sdata, hdr); 1558 1559 sta->rx_stats.fragments++; 1560 1561 u64_stats_update_begin(&rx->sta->rx_stats.syncp); 1562 sta->rx_stats.bytes += rx->skb->len; 1563 u64_stats_update_end(&rx->sta->rx_stats.syncp); 1564 1565 if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) { 1566 sta->rx_stats.last_signal = status->signal; 1567 ewma_signal_add(&sta->rx_stats_avg.signal, -status->signal); 1568 } 1569 1570 if (status->chains) { 1571 sta->rx_stats.chains = status->chains; 1572 for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) { 1573 int signal = status->chain_signal[i]; 1574 1575 if (!(status->chains & BIT(i))) 1576 continue; 1577 1578 sta->rx_stats.chain_signal_last[i] = signal; 1579 ewma_signal_add(&sta->rx_stats_avg.chain_signal[i], 1580 -signal); 1581 } 1582 } 1583 1584 /* 1585 * Change STA power saving mode only at the end of a frame 1586 * exchange sequence. 1587 */ 1588 if (!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS) && 1589 !ieee80211_has_morefrags(hdr->frame_control) && 1590 !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) && 1591 (rx->sdata->vif.type == NL80211_IFTYPE_AP || 1592 rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) && 1593 /* PM bit is only checked in frames where it isn't reserved, 1594 * in AP mode it's reserved in non-bufferable management frames 1595 * (cf. IEEE 802.11-2012 8.2.4.1.7 Power Management field) 1596 */ 1597 (!ieee80211_is_mgmt(hdr->frame_control) || 1598 ieee80211_is_bufferable_mmpdu(hdr->frame_control))) { 1599 if (test_sta_flag(sta, WLAN_STA_PS_STA)) { 1600 if (!ieee80211_has_pm(hdr->frame_control)) 1601 sta_ps_end(sta); 1602 } else { 1603 if (ieee80211_has_pm(hdr->frame_control)) 1604 sta_ps_start(sta); 1605 } 1606 } 1607 1608 /* mesh power save support */ 1609 if (ieee80211_vif_is_mesh(&rx->sdata->vif)) 1610 ieee80211_mps_rx_h_sta_process(sta, hdr); 1611 1612 /* 1613 * Drop (qos-)data::nullfunc frames silently, since they 1614 * are used only to control station power saving mode. 1615 */ 1616 if (ieee80211_is_nullfunc(hdr->frame_control) || 1617 ieee80211_is_qos_nullfunc(hdr->frame_control)) { 1618 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc); 1619 1620 /* 1621 * If we receive a 4-addr nullfunc frame from a STA 1622 * that was not moved to a 4-addr STA vlan yet send 1623 * the event to userspace and for older hostapd drop 1624 * the frame to the monitor interface. 1625 */ 1626 if (ieee80211_has_a4(hdr->frame_control) && 1627 (rx->sdata->vif.type == NL80211_IFTYPE_AP || 1628 (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN && 1629 !rx->sdata->u.vlan.sta))) { 1630 if (!test_and_set_sta_flag(sta, WLAN_STA_4ADDR_EVENT)) 1631 cfg80211_rx_unexpected_4addr_frame( 1632 rx->sdata->dev, sta->sta.addr, 1633 GFP_ATOMIC); 1634 return RX_DROP_MONITOR; 1635 } 1636 /* 1637 * Update counter and free packet here to avoid 1638 * counting this as a dropped packed. 1639 */ 1640 sta->rx_stats.packets++; 1641 dev_kfree_skb(rx->skb); 1642 return RX_QUEUED; 1643 } 1644 1645 return RX_CONTINUE; 1646 } /* ieee80211_rx_h_sta_process */ 1647 1648 static ieee80211_rx_result debug_noinline 1649 ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx) 1650 { 1651 struct sk_buff *skb = rx->skb; 1652 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 1653 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; 1654 int keyidx; 1655 int hdrlen; 1656 ieee80211_rx_result result = RX_DROP_UNUSABLE; 1657 struct ieee80211_key *sta_ptk = NULL; 1658 int mmie_keyidx = -1; 1659 __le16 fc; 1660 const struct ieee80211_cipher_scheme *cs = NULL; 1661 1662 /* 1663 * Key selection 101 1664 * 1665 * There are four types of keys: 1666 * - GTK (group keys) 1667 * - IGTK (group keys for management frames) 1668 * - PTK (pairwise keys) 1669 * - STK (station-to-station pairwise keys) 1670 * 1671 * When selecting a key, we have to distinguish between multicast 1672 * (including broadcast) and unicast frames, the latter can only 1673 * use PTKs and STKs while the former always use GTKs and IGTKs. 1674 * Unless, of course, actual WEP keys ("pre-RSNA") are used, then 1675 * unicast frames can also use key indices like GTKs. Hence, if we 1676 * don't have a PTK/STK we check the key index for a WEP key. 1677 * 1678 * Note that in a regular BSS, multicast frames are sent by the 1679 * AP only, associated stations unicast the frame to the AP first 1680 * which then multicasts it on their behalf. 1681 * 1682 * There is also a slight problem in IBSS mode: GTKs are negotiated 1683 * with each station, that is something we don't currently handle. 1684 * The spec seems to expect that one negotiates the same key with 1685 * every station but there's no such requirement; VLANs could be 1686 * possible. 1687 */ 1688 1689 /* start without a key */ 1690 rx->key = NULL; 1691 fc = hdr->frame_control; 1692 1693 if (rx->sta) { 1694 int keyid = rx->sta->ptk_idx; 1695 1696 if (ieee80211_has_protected(fc) && rx->sta->cipher_scheme) { 1697 cs = rx->sta->cipher_scheme; 1698 keyid = ieee80211_get_cs_keyid(cs, rx->skb); 1699 if (unlikely(keyid < 0)) 1700 return RX_DROP_UNUSABLE; 1701 } 1702 sta_ptk = rcu_dereference(rx->sta->ptk[keyid]); 1703 } 1704 1705 if (!ieee80211_has_protected(fc)) 1706 mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb); 1707 1708 if (!is_multicast_ether_addr(hdr->addr1) && sta_ptk) { 1709 rx->key = sta_ptk; 1710 if ((status->flag & RX_FLAG_DECRYPTED) && 1711 (status->flag & RX_FLAG_IV_STRIPPED)) 1712 return RX_CONTINUE; 1713 /* Skip decryption if the frame is not protected. */ 1714 if (!ieee80211_has_protected(fc)) 1715 return RX_CONTINUE; 1716 } else if (mmie_keyidx >= 0) { 1717 /* Broadcast/multicast robust management frame / BIP */ 1718 if ((status->flag & RX_FLAG_DECRYPTED) && 1719 (status->flag & RX_FLAG_IV_STRIPPED)) 1720 return RX_CONTINUE; 1721 1722 if (mmie_keyidx < NUM_DEFAULT_KEYS || 1723 mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS) 1724 return RX_DROP_MONITOR; /* unexpected BIP keyidx */ 1725 if (rx->sta) { 1726 if (ieee80211_is_group_privacy_action(skb) && 1727 test_sta_flag(rx->sta, WLAN_STA_MFP)) 1728 return RX_DROP_MONITOR; 1729 1730 rx->key = rcu_dereference(rx->sta->gtk[mmie_keyidx]); 1731 } 1732 if (!rx->key) 1733 rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]); 1734 } else if (!ieee80211_has_protected(fc)) { 1735 /* 1736 * The frame was not protected, so skip decryption. However, we 1737 * need to set rx->key if there is a key that could have been 1738 * used so that the frame may be dropped if encryption would 1739 * have been expected. 1740 */ 1741 struct ieee80211_key *key = NULL; 1742 struct ieee80211_sub_if_data *sdata = rx->sdata; 1743 int i; 1744 1745 if (ieee80211_is_mgmt(fc) && 1746 is_multicast_ether_addr(hdr->addr1) && 1747 (key = rcu_dereference(rx->sdata->default_mgmt_key))) 1748 rx->key = key; 1749 else { 1750 if (rx->sta) { 1751 for (i = 0; i < NUM_DEFAULT_KEYS; i++) { 1752 key = rcu_dereference(rx->sta->gtk[i]); 1753 if (key) 1754 break; 1755 } 1756 } 1757 if (!key) { 1758 for (i = 0; i < NUM_DEFAULT_KEYS; i++) { 1759 key = rcu_dereference(sdata->keys[i]); 1760 if (key) 1761 break; 1762 } 1763 } 1764 if (key) 1765 rx->key = key; 1766 } 1767 return RX_CONTINUE; 1768 } else { 1769 u8 keyid; 1770 1771 /* 1772 * The device doesn't give us the IV so we won't be 1773 * able to look up the key. That's ok though, we 1774 * don't need to decrypt the frame, we just won't 1775 * be able to keep statistics accurate. 1776 * Except for key threshold notifications, should 1777 * we somehow allow the driver to tell us which key 1778 * the hardware used if this flag is set? 1779 */ 1780 if ((status->flag & RX_FLAG_DECRYPTED) && 1781 (status->flag & RX_FLAG_IV_STRIPPED)) 1782 return RX_CONTINUE; 1783 1784 hdrlen = ieee80211_hdrlen(fc); 1785 1786 if (cs) { 1787 keyidx = ieee80211_get_cs_keyid(cs, rx->skb); 1788 1789 if (unlikely(keyidx < 0)) 1790 return RX_DROP_UNUSABLE; 1791 } else { 1792 if (rx->skb->len < 8 + hdrlen) 1793 return RX_DROP_UNUSABLE; /* TODO: count this? */ 1794 /* 1795 * no need to call ieee80211_wep_get_keyidx, 1796 * it verifies a bunch of things we've done already 1797 */ 1798 skb_copy_bits(rx->skb, hdrlen + 3, &keyid, 1); 1799 keyidx = keyid >> 6; 1800 } 1801 1802 /* check per-station GTK first, if multicast packet */ 1803 if (is_multicast_ether_addr(hdr->addr1) && rx->sta) 1804 rx->key = rcu_dereference(rx->sta->gtk[keyidx]); 1805 1806 /* if not found, try default key */ 1807 if (!rx->key) { 1808 rx->key = rcu_dereference(rx->sdata->keys[keyidx]); 1809 1810 /* 1811 * RSNA-protected unicast frames should always be 1812 * sent with pairwise or station-to-station keys, 1813 * but for WEP we allow using a key index as well. 1814 */ 1815 if (rx->key && 1816 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 && 1817 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 && 1818 !is_multicast_ether_addr(hdr->addr1)) 1819 rx->key = NULL; 1820 } 1821 } 1822 1823 if (rx->key) { 1824 if (unlikely(rx->key->flags & KEY_FLAG_TAINTED)) 1825 return RX_DROP_MONITOR; 1826 1827 /* TODO: add threshold stuff again */ 1828 } else { 1829 return RX_DROP_MONITOR; 1830 } 1831 1832 switch (rx->key->conf.cipher) { 1833 case WLAN_CIPHER_SUITE_WEP40: 1834 case WLAN_CIPHER_SUITE_WEP104: 1835 result = ieee80211_crypto_wep_decrypt(rx); 1836 break; 1837 case WLAN_CIPHER_SUITE_TKIP: 1838 result = ieee80211_crypto_tkip_decrypt(rx); 1839 break; 1840 case WLAN_CIPHER_SUITE_CCMP: 1841 result = ieee80211_crypto_ccmp_decrypt( 1842 rx, IEEE80211_CCMP_MIC_LEN); 1843 break; 1844 case WLAN_CIPHER_SUITE_CCMP_256: 1845 result = ieee80211_crypto_ccmp_decrypt( 1846 rx, IEEE80211_CCMP_256_MIC_LEN); 1847 break; 1848 case WLAN_CIPHER_SUITE_AES_CMAC: 1849 result = ieee80211_crypto_aes_cmac_decrypt(rx); 1850 break; 1851 case WLAN_CIPHER_SUITE_BIP_CMAC_256: 1852 result = ieee80211_crypto_aes_cmac_256_decrypt(rx); 1853 break; 1854 case WLAN_CIPHER_SUITE_BIP_GMAC_128: 1855 case WLAN_CIPHER_SUITE_BIP_GMAC_256: 1856 result = ieee80211_crypto_aes_gmac_decrypt(rx); 1857 break; 1858 case WLAN_CIPHER_SUITE_GCMP: 1859 case WLAN_CIPHER_SUITE_GCMP_256: 1860 result = ieee80211_crypto_gcmp_decrypt(rx); 1861 break; 1862 default: 1863 result = ieee80211_crypto_hw_decrypt(rx); 1864 } 1865 1866 /* the hdr variable is invalid after the decrypt handlers */ 1867 1868 /* either the frame has been decrypted or will be dropped */ 1869 status->flag |= RX_FLAG_DECRYPTED; 1870 1871 return result; 1872 } 1873 1874 static inline struct ieee80211_fragment_entry * 1875 ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata, 1876 unsigned int frag, unsigned int seq, int rx_queue, 1877 struct sk_buff **skb) 1878 { 1879 struct ieee80211_fragment_entry *entry; 1880 1881 entry = &sdata->fragments[sdata->fragment_next++]; 1882 if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX) 1883 sdata->fragment_next = 0; 1884 1885 if (!skb_queue_empty(&entry->skb_list)) 1886 __skb_queue_purge(&entry->skb_list); 1887 1888 __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */ 1889 *skb = NULL; 1890 entry->first_frag_time = jiffies; 1891 entry->seq = seq; 1892 entry->rx_queue = rx_queue; 1893 entry->last_frag = frag; 1894 entry->check_sequential_pn = false; 1895 entry->extra_len = 0; 1896 1897 return entry; 1898 } 1899 1900 static inline struct ieee80211_fragment_entry * 1901 ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata, 1902 unsigned int frag, unsigned int seq, 1903 int rx_queue, struct ieee80211_hdr *hdr) 1904 { 1905 struct ieee80211_fragment_entry *entry; 1906 int i, idx; 1907 1908 idx = sdata->fragment_next; 1909 for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) { 1910 struct ieee80211_hdr *f_hdr; 1911 1912 idx--; 1913 if (idx < 0) 1914 idx = IEEE80211_FRAGMENT_MAX - 1; 1915 1916 entry = &sdata->fragments[idx]; 1917 if (skb_queue_empty(&entry->skb_list) || entry->seq != seq || 1918 entry->rx_queue != rx_queue || 1919 entry->last_frag + 1 != frag) 1920 continue; 1921 1922 f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data; 1923 1924 /* 1925 * Check ftype and addresses are equal, else check next fragment 1926 */ 1927 if (((hdr->frame_control ^ f_hdr->frame_control) & 1928 cpu_to_le16(IEEE80211_FCTL_FTYPE)) || 1929 !ether_addr_equal(hdr->addr1, f_hdr->addr1) || 1930 !ether_addr_equal(hdr->addr2, f_hdr->addr2)) 1931 continue; 1932 1933 if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) { 1934 __skb_queue_purge(&entry->skb_list); 1935 continue; 1936 } 1937 return entry; 1938 } 1939 1940 return NULL; 1941 } 1942 1943 static ieee80211_rx_result debug_noinline 1944 ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx) 1945 { 1946 struct ieee80211_hdr *hdr; 1947 u16 sc; 1948 __le16 fc; 1949 unsigned int frag, seq; 1950 struct ieee80211_fragment_entry *entry; 1951 struct sk_buff *skb; 1952 1953 hdr = (struct ieee80211_hdr *)rx->skb->data; 1954 fc = hdr->frame_control; 1955 1956 if (ieee80211_is_ctl(fc)) 1957 return RX_CONTINUE; 1958 1959 sc = le16_to_cpu(hdr->seq_ctrl); 1960 frag = sc & IEEE80211_SCTL_FRAG; 1961 1962 if (is_multicast_ether_addr(hdr->addr1)) { 1963 I802_DEBUG_INC(rx->local->dot11MulticastReceivedFrameCount); 1964 goto out_no_led; 1965 } 1966 1967 if (likely(!ieee80211_has_morefrags(fc) && frag == 0)) 1968 goto out; 1969 1970 I802_DEBUG_INC(rx->local->rx_handlers_fragments); 1971 1972 if (skb_linearize(rx->skb)) 1973 return RX_DROP_UNUSABLE; 1974 1975 /* 1976 * skb_linearize() might change the skb->data and 1977 * previously cached variables (in this case, hdr) need to 1978 * be refreshed with the new data. 1979 */ 1980 hdr = (struct ieee80211_hdr *)rx->skb->data; 1981 seq = (sc & IEEE80211_SCTL_SEQ) >> 4; 1982 1983 if (frag == 0) { 1984 /* This is the first fragment of a new frame. */ 1985 entry = ieee80211_reassemble_add(rx->sdata, frag, seq, 1986 rx->seqno_idx, &(rx->skb)); 1987 if (rx->key && 1988 (rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP || 1989 rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP_256 || 1990 rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP || 1991 rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP_256) && 1992 ieee80211_has_protected(fc)) { 1993 int queue = rx->security_idx; 1994 1995 /* Store CCMP/GCMP PN so that we can verify that the 1996 * next fragment has a sequential PN value. 1997 */ 1998 entry->check_sequential_pn = true; 1999 memcpy(entry->last_pn, 2000 rx->key->u.ccmp.rx_pn[queue], 2001 IEEE80211_CCMP_PN_LEN); 2002 BUILD_BUG_ON(offsetof(struct ieee80211_key, 2003 u.ccmp.rx_pn) != 2004 offsetof(struct ieee80211_key, 2005 u.gcmp.rx_pn)); 2006 BUILD_BUG_ON(sizeof(rx->key->u.ccmp.rx_pn[queue]) != 2007 sizeof(rx->key->u.gcmp.rx_pn[queue])); 2008 BUILD_BUG_ON(IEEE80211_CCMP_PN_LEN != 2009 IEEE80211_GCMP_PN_LEN); 2010 } 2011 return RX_QUEUED; 2012 } 2013 2014 /* This is a fragment for a frame that should already be pending in 2015 * fragment cache. Add this fragment to the end of the pending entry. 2016 */ 2017 entry = ieee80211_reassemble_find(rx->sdata, frag, seq, 2018 rx->seqno_idx, hdr); 2019 if (!entry) { 2020 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag); 2021 return RX_DROP_MONITOR; 2022 } 2023 2024 /* "The receiver shall discard MSDUs and MMPDUs whose constituent 2025 * MPDU PN values are not incrementing in steps of 1." 2026 * see IEEE P802.11-REVmc/D5.0, 12.5.3.4.4, item d (for CCMP) 2027 * and IEEE P802.11-REVmc/D5.0, 12.5.5.4.4, item d (for GCMP) 2028 */ 2029 if (entry->check_sequential_pn) { 2030 int i; 2031 u8 pn[IEEE80211_CCMP_PN_LEN], *rpn; 2032 int queue; 2033 2034 if (!rx->key || 2035 (rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP && 2036 rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP_256 && 2037 rx->key->conf.cipher != WLAN_CIPHER_SUITE_GCMP && 2038 rx->key->conf.cipher != WLAN_CIPHER_SUITE_GCMP_256)) 2039 return RX_DROP_UNUSABLE; 2040 memcpy(pn, entry->last_pn, IEEE80211_CCMP_PN_LEN); 2041 for (i = IEEE80211_CCMP_PN_LEN - 1; i >= 0; i--) { 2042 pn[i]++; 2043 if (pn[i]) 2044 break; 2045 } 2046 queue = rx->security_idx; 2047 rpn = rx->key->u.ccmp.rx_pn[queue]; 2048 if (memcmp(pn, rpn, IEEE80211_CCMP_PN_LEN)) 2049 return RX_DROP_UNUSABLE; 2050 memcpy(entry->last_pn, pn, IEEE80211_CCMP_PN_LEN); 2051 } 2052 2053 skb_pull(rx->skb, ieee80211_hdrlen(fc)); 2054 __skb_queue_tail(&entry->skb_list, rx->skb); 2055 entry->last_frag = frag; 2056 entry->extra_len += rx->skb->len; 2057 if (ieee80211_has_morefrags(fc)) { 2058 rx->skb = NULL; 2059 return RX_QUEUED; 2060 } 2061 2062 rx->skb = __skb_dequeue(&entry->skb_list); 2063 if (skb_tailroom(rx->skb) < entry->extra_len) { 2064 I802_DEBUG_INC(rx->local->rx_expand_skb_head_defrag); 2065 if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len, 2066 GFP_ATOMIC))) { 2067 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag); 2068 __skb_queue_purge(&entry->skb_list); 2069 return RX_DROP_UNUSABLE; 2070 } 2071 } 2072 while ((skb = __skb_dequeue(&entry->skb_list))) { 2073 memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len); 2074 dev_kfree_skb(skb); 2075 } 2076 2077 out: 2078 ieee80211_led_rx(rx->local); 2079 out_no_led: 2080 if (rx->sta) 2081 rx->sta->rx_stats.packets++; 2082 return RX_CONTINUE; 2083 } 2084 2085 static int ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx) 2086 { 2087 if (unlikely(!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_AUTHORIZED))) 2088 return -EACCES; 2089 2090 return 0; 2091 } 2092 2093 static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc) 2094 { 2095 struct sk_buff *skb = rx->skb; 2096 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 2097 2098 /* 2099 * Pass through unencrypted frames if the hardware has 2100 * decrypted them already. 2101 */ 2102 if (status->flag & RX_FLAG_DECRYPTED) 2103 return 0; 2104 2105 /* Drop unencrypted frames if key is set. */ 2106 if (unlikely(!ieee80211_has_protected(fc) && 2107 !ieee80211_is_nullfunc(fc) && 2108 ieee80211_is_data(fc) && rx->key)) 2109 return -EACCES; 2110 2111 return 0; 2112 } 2113 2114 static int ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx) 2115 { 2116 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 2117 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 2118 __le16 fc = hdr->frame_control; 2119 2120 /* 2121 * Pass through unencrypted frames if the hardware has 2122 * decrypted them already. 2123 */ 2124 if (status->flag & RX_FLAG_DECRYPTED) 2125 return 0; 2126 2127 if (rx->sta && test_sta_flag(rx->sta, WLAN_STA_MFP)) { 2128 if (unlikely(!ieee80211_has_protected(fc) && 2129 ieee80211_is_unicast_robust_mgmt_frame(rx->skb) && 2130 rx->key)) { 2131 if (ieee80211_is_deauth(fc) || 2132 ieee80211_is_disassoc(fc)) 2133 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev, 2134 rx->skb->data, 2135 rx->skb->len); 2136 return -EACCES; 2137 } 2138 /* BIP does not use Protected field, so need to check MMIE */ 2139 if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) && 2140 ieee80211_get_mmie_keyidx(rx->skb) < 0)) { 2141 if (ieee80211_is_deauth(fc) || 2142 ieee80211_is_disassoc(fc)) 2143 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev, 2144 rx->skb->data, 2145 rx->skb->len); 2146 return -EACCES; 2147 } 2148 /* 2149 * When using MFP, Action frames are not allowed prior to 2150 * having configured keys. 2151 */ 2152 if (unlikely(ieee80211_is_action(fc) && !rx->key && 2153 ieee80211_is_robust_mgmt_frame(rx->skb))) 2154 return -EACCES; 2155 } 2156 2157 return 0; 2158 } 2159 2160 static int 2161 __ieee80211_data_to_8023(struct ieee80211_rx_data *rx, bool *port_control) 2162 { 2163 struct ieee80211_sub_if_data *sdata = rx->sdata; 2164 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 2165 bool check_port_control = false; 2166 struct ethhdr *ehdr; 2167 int ret; 2168 2169 *port_control = false; 2170 if (ieee80211_has_a4(hdr->frame_control) && 2171 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta) 2172 return -1; 2173 2174 if (sdata->vif.type == NL80211_IFTYPE_STATION && 2175 !!sdata->u.mgd.use_4addr != !!ieee80211_has_a4(hdr->frame_control)) { 2176 2177 if (!sdata->u.mgd.use_4addr) 2178 return -1; 2179 else 2180 check_port_control = true; 2181 } 2182 2183 if (is_multicast_ether_addr(hdr->addr1) && 2184 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta) 2185 return -1; 2186 2187 ret = ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type); 2188 if (ret < 0) 2189 return ret; 2190 2191 ehdr = (struct ethhdr *) rx->skb->data; 2192 if (ehdr->h_proto == rx->sdata->control_port_protocol) 2193 *port_control = true; 2194 else if (check_port_control) 2195 return -1; 2196 2197 return 0; 2198 } 2199 2200 /* 2201 * requires that rx->skb is a frame with ethernet header 2202 */ 2203 static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc) 2204 { 2205 static const u8 pae_group_addr[ETH_ALEN] __aligned(2) 2206 = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 }; 2207 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data; 2208 2209 /* 2210 * Allow EAPOL frames to us/the PAE group address regardless 2211 * of whether the frame was encrypted or not. 2212 */ 2213 if (ehdr->h_proto == rx->sdata->control_port_protocol && 2214 (ether_addr_equal(ehdr->h_dest, rx->sdata->vif.addr) || 2215 ether_addr_equal(ehdr->h_dest, pae_group_addr))) 2216 return true; 2217 2218 if (ieee80211_802_1x_port_control(rx) || 2219 ieee80211_drop_unencrypted(rx, fc)) 2220 return false; 2221 2222 return true; 2223 } 2224 2225 /* 2226 * requires that rx->skb is a frame with ethernet header 2227 */ 2228 static void 2229 ieee80211_deliver_skb(struct ieee80211_rx_data *rx) 2230 { 2231 struct ieee80211_sub_if_data *sdata = rx->sdata; 2232 struct net_device *dev = sdata->dev; 2233 struct sk_buff *skb, *xmit_skb; 2234 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data; 2235 struct sta_info *dsta; 2236 2237 skb = rx->skb; 2238 xmit_skb = NULL; 2239 2240 ieee80211_rx_stats(dev, skb->len); 2241 2242 if (rx->sta) { 2243 /* The seqno index has the same property as needed 2244 * for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS 2245 * for non-QoS-data frames. Here we know it's a data 2246 * frame, so count MSDUs. 2247 */ 2248 u64_stats_update_begin(&rx->sta->rx_stats.syncp); 2249 rx->sta->rx_stats.msdu[rx->seqno_idx]++; 2250 u64_stats_update_end(&rx->sta->rx_stats.syncp); 2251 } 2252 2253 if ((sdata->vif.type == NL80211_IFTYPE_AP || 2254 sdata->vif.type == NL80211_IFTYPE_AP_VLAN) && 2255 !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) && 2256 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) { 2257 if (is_multicast_ether_addr(ehdr->h_dest) && 2258 ieee80211_vif_get_num_mcast_if(sdata) != 0) { 2259 /* 2260 * send multicast frames both to higher layers in 2261 * local net stack and back to the wireless medium 2262 */ 2263 xmit_skb = skb_copy(skb, GFP_ATOMIC); 2264 if (!xmit_skb) 2265 net_info_ratelimited("%s: failed to clone multicast frame\n", 2266 dev->name); 2267 } else if (!is_multicast_ether_addr(ehdr->h_dest)) { 2268 dsta = sta_info_get(sdata, skb->data); 2269 if (dsta) { 2270 /* 2271 * The destination station is associated to 2272 * this AP (in this VLAN), so send the frame 2273 * directly to it and do not pass it to local 2274 * net stack. 2275 */ 2276 xmit_skb = skb; 2277 skb = NULL; 2278 } 2279 } 2280 } 2281 2282 #ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS 2283 if (skb) { 2284 /* 'align' will only take the values 0 or 2 here since all 2285 * frames are required to be aligned to 2-byte boundaries 2286 * when being passed to mac80211; the code here works just 2287 * as well if that isn't true, but mac80211 assumes it can 2288 * access fields as 2-byte aligned (e.g. for ether_addr_equal) 2289 */ 2290 int align; 2291 2292 align = (unsigned long)(skb->data + sizeof(struct ethhdr)) & 3; 2293 if (align) { 2294 if (WARN_ON(skb_headroom(skb) < 3)) { 2295 dev_kfree_skb(skb); 2296 skb = NULL; 2297 } else { 2298 u8 *data = skb->data; 2299 size_t len = skb_headlen(skb); 2300 skb->data -= align; 2301 memmove(skb->data, data, len); 2302 skb_set_tail_pointer(skb, len); 2303 } 2304 } 2305 } 2306 #endif 2307 2308 if (skb) { 2309 /* deliver to local stack */ 2310 skb->protocol = eth_type_trans(skb, dev); 2311 memset(skb->cb, 0, sizeof(skb->cb)); 2312 if (rx->napi) 2313 napi_gro_receive(rx->napi, skb); 2314 else 2315 netif_receive_skb(skb); 2316 } 2317 2318 if (xmit_skb) { 2319 /* 2320 * Send to wireless media and increase priority by 256 to 2321 * keep the received priority instead of reclassifying 2322 * the frame (see cfg80211_classify8021d). 2323 */ 2324 xmit_skb->priority += 256; 2325 xmit_skb->protocol = htons(ETH_P_802_3); 2326 skb_reset_network_header(xmit_skb); 2327 skb_reset_mac_header(xmit_skb); 2328 dev_queue_xmit(xmit_skb); 2329 } 2330 } 2331 2332 static ieee80211_rx_result debug_noinline 2333 ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx) 2334 { 2335 struct net_device *dev = rx->sdata->dev; 2336 struct sk_buff *skb = rx->skb; 2337 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; 2338 __le16 fc = hdr->frame_control; 2339 struct sk_buff_head frame_list; 2340 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 2341 struct ethhdr ethhdr; 2342 const u8 *check_da = ethhdr.h_dest, *check_sa = ethhdr.h_source; 2343 2344 if (unlikely(!ieee80211_is_data(fc))) 2345 return RX_CONTINUE; 2346 2347 if (unlikely(!ieee80211_is_data_present(fc))) 2348 return RX_DROP_MONITOR; 2349 2350 if (!(status->rx_flags & IEEE80211_RX_AMSDU)) 2351 return RX_CONTINUE; 2352 2353 if (unlikely(ieee80211_has_a4(hdr->frame_control))) { 2354 switch (rx->sdata->vif.type) { 2355 case NL80211_IFTYPE_AP_VLAN: 2356 if (!rx->sdata->u.vlan.sta) 2357 return RX_DROP_UNUSABLE; 2358 break; 2359 case NL80211_IFTYPE_STATION: 2360 if (!rx->sdata->u.mgd.use_4addr) 2361 return RX_DROP_UNUSABLE; 2362 break; 2363 default: 2364 return RX_DROP_UNUSABLE; 2365 } 2366 check_da = NULL; 2367 check_sa = NULL; 2368 } else switch (rx->sdata->vif.type) { 2369 case NL80211_IFTYPE_AP: 2370 case NL80211_IFTYPE_AP_VLAN: 2371 check_da = NULL; 2372 break; 2373 case NL80211_IFTYPE_STATION: 2374 if (!rx->sta || 2375 !test_sta_flag(rx->sta, WLAN_STA_TDLS_PEER)) 2376 check_sa = NULL; 2377 break; 2378 case NL80211_IFTYPE_MESH_POINT: 2379 check_sa = NULL; 2380 break; 2381 default: 2382 break; 2383 } 2384 2385 if (is_multicast_ether_addr(hdr->addr1)) 2386 return RX_DROP_UNUSABLE; 2387 2388 skb->dev = dev; 2389 __skb_queue_head_init(&frame_list); 2390 2391 if (ieee80211_data_to_8023_exthdr(skb, ðhdr, 2392 rx->sdata->vif.addr, 2393 rx->sdata->vif.type)) 2394 return RX_DROP_UNUSABLE; 2395 2396 ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr, 2397 rx->sdata->vif.type, 2398 rx->local->hw.extra_tx_headroom, 2399 check_da, check_sa); 2400 2401 while (!skb_queue_empty(&frame_list)) { 2402 rx->skb = __skb_dequeue(&frame_list); 2403 2404 if (!ieee80211_frame_allowed(rx, fc)) { 2405 dev_kfree_skb(rx->skb); 2406 continue; 2407 } 2408 2409 ieee80211_deliver_skb(rx); 2410 } 2411 2412 return RX_QUEUED; 2413 } 2414 2415 #ifdef CONFIG_MAC80211_MESH 2416 static ieee80211_rx_result 2417 ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx) 2418 { 2419 struct ieee80211_hdr *fwd_hdr, *hdr; 2420 struct ieee80211_tx_info *info; 2421 struct ieee80211s_hdr *mesh_hdr; 2422 struct sk_buff *skb = rx->skb, *fwd_skb; 2423 struct ieee80211_local *local = rx->local; 2424 struct ieee80211_sub_if_data *sdata = rx->sdata; 2425 struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh; 2426 u16 ac, q, hdrlen; 2427 2428 hdr = (struct ieee80211_hdr *) skb->data; 2429 hdrlen = ieee80211_hdrlen(hdr->frame_control); 2430 2431 /* make sure fixed part of mesh header is there, also checks skb len */ 2432 if (!pskb_may_pull(rx->skb, hdrlen + 6)) 2433 return RX_DROP_MONITOR; 2434 2435 mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen); 2436 2437 /* make sure full mesh header is there, also checks skb len */ 2438 if (!pskb_may_pull(rx->skb, 2439 hdrlen + ieee80211_get_mesh_hdrlen(mesh_hdr))) 2440 return RX_DROP_MONITOR; 2441 2442 /* reload pointers */ 2443 hdr = (struct ieee80211_hdr *) skb->data; 2444 mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen); 2445 2446 if (ieee80211_drop_unencrypted(rx, hdr->frame_control)) 2447 return RX_DROP_MONITOR; 2448 2449 /* frame is in RMC, don't forward */ 2450 if (ieee80211_is_data(hdr->frame_control) && 2451 is_multicast_ether_addr(hdr->addr1) && 2452 mesh_rmc_check(rx->sdata, hdr->addr3, mesh_hdr)) 2453 return RX_DROP_MONITOR; 2454 2455 if (!ieee80211_is_data(hdr->frame_control)) 2456 return RX_CONTINUE; 2457 2458 if (!mesh_hdr->ttl) 2459 return RX_DROP_MONITOR; 2460 2461 if (mesh_hdr->flags & MESH_FLAGS_AE) { 2462 struct mesh_path *mppath; 2463 char *proxied_addr; 2464 char *mpp_addr; 2465 2466 if (is_multicast_ether_addr(hdr->addr1)) { 2467 mpp_addr = hdr->addr3; 2468 proxied_addr = mesh_hdr->eaddr1; 2469 } else if (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6) { 2470 /* has_a4 already checked in ieee80211_rx_mesh_check */ 2471 mpp_addr = hdr->addr4; 2472 proxied_addr = mesh_hdr->eaddr2; 2473 } else { 2474 return RX_DROP_MONITOR; 2475 } 2476 2477 rcu_read_lock(); 2478 mppath = mpp_path_lookup(sdata, proxied_addr); 2479 if (!mppath) { 2480 mpp_path_add(sdata, proxied_addr, mpp_addr); 2481 } else { 2482 spin_lock_bh(&mppath->state_lock); 2483 if (!ether_addr_equal(mppath->mpp, mpp_addr)) 2484 memcpy(mppath->mpp, mpp_addr, ETH_ALEN); 2485 mppath->exp_time = jiffies; 2486 spin_unlock_bh(&mppath->state_lock); 2487 } 2488 rcu_read_unlock(); 2489 } 2490 2491 /* Frame has reached destination. Don't forward */ 2492 if (!is_multicast_ether_addr(hdr->addr1) && 2493 ether_addr_equal(sdata->vif.addr, hdr->addr3)) 2494 return RX_CONTINUE; 2495 2496 ac = ieee80211_select_queue_80211(sdata, skb, hdr); 2497 q = sdata->vif.hw_queue[ac]; 2498 if (ieee80211_queue_stopped(&local->hw, q)) { 2499 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion); 2500 return RX_DROP_MONITOR; 2501 } 2502 skb_set_queue_mapping(skb, q); 2503 2504 if (!--mesh_hdr->ttl) { 2505 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl); 2506 goto out; 2507 } 2508 2509 if (!ifmsh->mshcfg.dot11MeshForwarding) 2510 goto out; 2511 2512 fwd_skb = skb_copy_expand(skb, local->tx_headroom + 2513 sdata->encrypt_headroom, 0, GFP_ATOMIC); 2514 if (!fwd_skb) { 2515 net_info_ratelimited("%s: failed to clone mesh frame\n", 2516 sdata->name); 2517 goto out; 2518 } 2519 2520 fwd_hdr = (struct ieee80211_hdr *) fwd_skb->data; 2521 fwd_hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_RETRY); 2522 info = IEEE80211_SKB_CB(fwd_skb); 2523 memset(info, 0, sizeof(*info)); 2524 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING; 2525 info->control.vif = &rx->sdata->vif; 2526 info->control.jiffies = jiffies; 2527 if (is_multicast_ether_addr(fwd_hdr->addr1)) { 2528 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_mcast); 2529 memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN); 2530 /* update power mode indication when forwarding */ 2531 ieee80211_mps_set_frame_flags(sdata, NULL, fwd_hdr); 2532 } else if (!mesh_nexthop_lookup(sdata, fwd_skb)) { 2533 /* mesh power mode flags updated in mesh_nexthop_lookup */ 2534 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast); 2535 } else { 2536 /* unable to resolve next hop */ 2537 mesh_path_error_tx(sdata, ifmsh->mshcfg.element_ttl, 2538 fwd_hdr->addr3, 0, 2539 WLAN_REASON_MESH_PATH_NOFORWARD, 2540 fwd_hdr->addr2); 2541 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_no_route); 2542 kfree_skb(fwd_skb); 2543 return RX_DROP_MONITOR; 2544 } 2545 2546 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames); 2547 ieee80211_add_pending_skb(local, fwd_skb); 2548 out: 2549 if (is_multicast_ether_addr(hdr->addr1)) 2550 return RX_CONTINUE; 2551 return RX_DROP_MONITOR; 2552 } 2553 #endif 2554 2555 static ieee80211_rx_result debug_noinline 2556 ieee80211_rx_h_data(struct ieee80211_rx_data *rx) 2557 { 2558 struct ieee80211_sub_if_data *sdata = rx->sdata; 2559 struct ieee80211_local *local = rx->local; 2560 struct net_device *dev = sdata->dev; 2561 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 2562 __le16 fc = hdr->frame_control; 2563 bool port_control; 2564 int err; 2565 2566 if (unlikely(!ieee80211_is_data(hdr->frame_control))) 2567 return RX_CONTINUE; 2568 2569 if (unlikely(!ieee80211_is_data_present(hdr->frame_control))) 2570 return RX_DROP_MONITOR; 2571 2572 /* 2573 * Send unexpected-4addr-frame event to hostapd. For older versions, 2574 * also drop the frame to cooked monitor interfaces. 2575 */ 2576 if (ieee80211_has_a4(hdr->frame_control) && 2577 sdata->vif.type == NL80211_IFTYPE_AP) { 2578 if (rx->sta && 2579 !test_and_set_sta_flag(rx->sta, WLAN_STA_4ADDR_EVENT)) 2580 cfg80211_rx_unexpected_4addr_frame( 2581 rx->sdata->dev, rx->sta->sta.addr, GFP_ATOMIC); 2582 return RX_DROP_MONITOR; 2583 } 2584 2585 err = __ieee80211_data_to_8023(rx, &port_control); 2586 if (unlikely(err)) 2587 return RX_DROP_UNUSABLE; 2588 2589 if (!ieee80211_frame_allowed(rx, fc)) 2590 return RX_DROP_MONITOR; 2591 2592 /* directly handle TDLS channel switch requests/responses */ 2593 if (unlikely(((struct ethhdr *)rx->skb->data)->h_proto == 2594 cpu_to_be16(ETH_P_TDLS))) { 2595 struct ieee80211_tdls_data *tf = (void *)rx->skb->data; 2596 2597 if (pskb_may_pull(rx->skb, 2598 offsetof(struct ieee80211_tdls_data, u)) && 2599 tf->payload_type == WLAN_TDLS_SNAP_RFTYPE && 2600 tf->category == WLAN_CATEGORY_TDLS && 2601 (tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_REQUEST || 2602 tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_RESPONSE)) { 2603 skb_queue_tail(&local->skb_queue_tdls_chsw, rx->skb); 2604 schedule_work(&local->tdls_chsw_work); 2605 if (rx->sta) 2606 rx->sta->rx_stats.packets++; 2607 2608 return RX_QUEUED; 2609 } 2610 } 2611 2612 if (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN && 2613 unlikely(port_control) && sdata->bss) { 2614 sdata = container_of(sdata->bss, struct ieee80211_sub_if_data, 2615 u.ap); 2616 dev = sdata->dev; 2617 rx->sdata = sdata; 2618 } 2619 2620 rx->skb->dev = dev; 2621 2622 if (!ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS) && 2623 local->ps_sdata && local->hw.conf.dynamic_ps_timeout > 0 && 2624 !is_multicast_ether_addr( 2625 ((struct ethhdr *)rx->skb->data)->h_dest) && 2626 (!local->scanning && 2627 !test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))) 2628 mod_timer(&local->dynamic_ps_timer, jiffies + 2629 msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout)); 2630 2631 ieee80211_deliver_skb(rx); 2632 2633 return RX_QUEUED; 2634 } 2635 2636 static ieee80211_rx_result debug_noinline 2637 ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames) 2638 { 2639 struct sk_buff *skb = rx->skb; 2640 struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data; 2641 struct tid_ampdu_rx *tid_agg_rx; 2642 u16 start_seq_num; 2643 u16 tid; 2644 2645 if (likely(!ieee80211_is_ctl(bar->frame_control))) 2646 return RX_CONTINUE; 2647 2648 if (ieee80211_is_back_req(bar->frame_control)) { 2649 struct { 2650 __le16 control, start_seq_num; 2651 } __packed bar_data; 2652 struct ieee80211_event event = { 2653 .type = BAR_RX_EVENT, 2654 }; 2655 2656 if (!rx->sta) 2657 return RX_DROP_MONITOR; 2658 2659 if (skb_copy_bits(skb, offsetof(struct ieee80211_bar, control), 2660 &bar_data, sizeof(bar_data))) 2661 return RX_DROP_MONITOR; 2662 2663 tid = le16_to_cpu(bar_data.control) >> 12; 2664 2665 if (!test_bit(tid, rx->sta->ampdu_mlme.agg_session_valid) && 2666 !test_and_set_bit(tid, rx->sta->ampdu_mlme.unexpected_agg)) 2667 ieee80211_send_delba(rx->sdata, rx->sta->sta.addr, tid, 2668 WLAN_BACK_RECIPIENT, 2669 WLAN_REASON_QSTA_REQUIRE_SETUP); 2670 2671 tid_agg_rx = rcu_dereference(rx->sta->ampdu_mlme.tid_rx[tid]); 2672 if (!tid_agg_rx) 2673 return RX_DROP_MONITOR; 2674 2675 start_seq_num = le16_to_cpu(bar_data.start_seq_num) >> 4; 2676 event.u.ba.tid = tid; 2677 event.u.ba.ssn = start_seq_num; 2678 event.u.ba.sta = &rx->sta->sta; 2679 2680 /* reset session timer */ 2681 if (tid_agg_rx->timeout) 2682 mod_timer(&tid_agg_rx->session_timer, 2683 TU_TO_EXP_TIME(tid_agg_rx->timeout)); 2684 2685 spin_lock(&tid_agg_rx->reorder_lock); 2686 /* release stored frames up to start of BAR */ 2687 ieee80211_release_reorder_frames(rx->sdata, tid_agg_rx, 2688 start_seq_num, frames); 2689 spin_unlock(&tid_agg_rx->reorder_lock); 2690 2691 drv_event_callback(rx->local, rx->sdata, &event); 2692 2693 kfree_skb(skb); 2694 return RX_QUEUED; 2695 } 2696 2697 /* 2698 * After this point, we only want management frames, 2699 * so we can drop all remaining control frames to 2700 * cooked monitor interfaces. 2701 */ 2702 return RX_DROP_MONITOR; 2703 } 2704 2705 static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata, 2706 struct ieee80211_mgmt *mgmt, 2707 size_t len) 2708 { 2709 struct ieee80211_local *local = sdata->local; 2710 struct sk_buff *skb; 2711 struct ieee80211_mgmt *resp; 2712 2713 if (!ether_addr_equal(mgmt->da, sdata->vif.addr)) { 2714 /* Not to own unicast address */ 2715 return; 2716 } 2717 2718 if (!ether_addr_equal(mgmt->sa, sdata->u.mgd.bssid) || 2719 !ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid)) { 2720 /* Not from the current AP or not associated yet. */ 2721 return; 2722 } 2723 2724 if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) { 2725 /* Too short SA Query request frame */ 2726 return; 2727 } 2728 2729 skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom); 2730 if (skb == NULL) 2731 return; 2732 2733 skb_reserve(skb, local->hw.extra_tx_headroom); 2734 resp = (struct ieee80211_mgmt *) skb_put(skb, 24); 2735 memset(resp, 0, 24); 2736 memcpy(resp->da, mgmt->sa, ETH_ALEN); 2737 memcpy(resp->sa, sdata->vif.addr, ETH_ALEN); 2738 memcpy(resp->bssid, sdata->u.mgd.bssid, ETH_ALEN); 2739 resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | 2740 IEEE80211_STYPE_ACTION); 2741 skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query)); 2742 resp->u.action.category = WLAN_CATEGORY_SA_QUERY; 2743 resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE; 2744 memcpy(resp->u.action.u.sa_query.trans_id, 2745 mgmt->u.action.u.sa_query.trans_id, 2746 WLAN_SA_QUERY_TR_ID_LEN); 2747 2748 ieee80211_tx_skb(sdata, skb); 2749 } 2750 2751 static ieee80211_rx_result debug_noinline 2752 ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx) 2753 { 2754 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data; 2755 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 2756 2757 /* 2758 * From here on, look only at management frames. 2759 * Data and control frames are already handled, 2760 * and unknown (reserved) frames are useless. 2761 */ 2762 if (rx->skb->len < 24) 2763 return RX_DROP_MONITOR; 2764 2765 if (!ieee80211_is_mgmt(mgmt->frame_control)) 2766 return RX_DROP_MONITOR; 2767 2768 if (rx->sdata->vif.type == NL80211_IFTYPE_AP && 2769 ieee80211_is_beacon(mgmt->frame_control) && 2770 !(rx->flags & IEEE80211_RX_BEACON_REPORTED)) { 2771 int sig = 0; 2772 2773 if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM)) 2774 sig = status->signal; 2775 2776 cfg80211_report_obss_beacon(rx->local->hw.wiphy, 2777 rx->skb->data, rx->skb->len, 2778 status->freq, sig); 2779 rx->flags |= IEEE80211_RX_BEACON_REPORTED; 2780 } 2781 2782 if (ieee80211_drop_unencrypted_mgmt(rx)) 2783 return RX_DROP_UNUSABLE; 2784 2785 return RX_CONTINUE; 2786 } 2787 2788 static ieee80211_rx_result debug_noinline 2789 ieee80211_rx_h_action(struct ieee80211_rx_data *rx) 2790 { 2791 struct ieee80211_local *local = rx->local; 2792 struct ieee80211_sub_if_data *sdata = rx->sdata; 2793 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data; 2794 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 2795 int len = rx->skb->len; 2796 2797 if (!ieee80211_is_action(mgmt->frame_control)) 2798 return RX_CONTINUE; 2799 2800 /* drop too small frames */ 2801 if (len < IEEE80211_MIN_ACTION_SIZE) 2802 return RX_DROP_UNUSABLE; 2803 2804 if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC && 2805 mgmt->u.action.category != WLAN_CATEGORY_SELF_PROTECTED && 2806 mgmt->u.action.category != WLAN_CATEGORY_SPECTRUM_MGMT) 2807 return RX_DROP_UNUSABLE; 2808 2809 switch (mgmt->u.action.category) { 2810 case WLAN_CATEGORY_HT: 2811 /* reject HT action frames from stations not supporting HT */ 2812 if (!rx->sta->sta.ht_cap.ht_supported) 2813 goto invalid; 2814 2815 if (sdata->vif.type != NL80211_IFTYPE_STATION && 2816 sdata->vif.type != NL80211_IFTYPE_MESH_POINT && 2817 sdata->vif.type != NL80211_IFTYPE_AP_VLAN && 2818 sdata->vif.type != NL80211_IFTYPE_AP && 2819 sdata->vif.type != NL80211_IFTYPE_ADHOC) 2820 break; 2821 2822 /* verify action & smps_control/chanwidth are present */ 2823 if (len < IEEE80211_MIN_ACTION_SIZE + 2) 2824 goto invalid; 2825 2826 switch (mgmt->u.action.u.ht_smps.action) { 2827 case WLAN_HT_ACTION_SMPS: { 2828 struct ieee80211_supported_band *sband; 2829 enum ieee80211_smps_mode smps_mode; 2830 2831 /* convert to HT capability */ 2832 switch (mgmt->u.action.u.ht_smps.smps_control) { 2833 case WLAN_HT_SMPS_CONTROL_DISABLED: 2834 smps_mode = IEEE80211_SMPS_OFF; 2835 break; 2836 case WLAN_HT_SMPS_CONTROL_STATIC: 2837 smps_mode = IEEE80211_SMPS_STATIC; 2838 break; 2839 case WLAN_HT_SMPS_CONTROL_DYNAMIC: 2840 smps_mode = IEEE80211_SMPS_DYNAMIC; 2841 break; 2842 default: 2843 goto invalid; 2844 } 2845 2846 /* if no change do nothing */ 2847 if (rx->sta->sta.smps_mode == smps_mode) 2848 goto handled; 2849 rx->sta->sta.smps_mode = smps_mode; 2850 2851 sband = rx->local->hw.wiphy->bands[status->band]; 2852 2853 rate_control_rate_update(local, sband, rx->sta, 2854 IEEE80211_RC_SMPS_CHANGED); 2855 goto handled; 2856 } 2857 case WLAN_HT_ACTION_NOTIFY_CHANWIDTH: { 2858 struct ieee80211_supported_band *sband; 2859 u8 chanwidth = mgmt->u.action.u.ht_notify_cw.chanwidth; 2860 enum ieee80211_sta_rx_bandwidth max_bw, new_bw; 2861 2862 /* If it doesn't support 40 MHz it can't change ... */ 2863 if (!(rx->sta->sta.ht_cap.cap & 2864 IEEE80211_HT_CAP_SUP_WIDTH_20_40)) 2865 goto handled; 2866 2867 if (chanwidth == IEEE80211_HT_CHANWIDTH_20MHZ) 2868 max_bw = IEEE80211_STA_RX_BW_20; 2869 else 2870 max_bw = ieee80211_sta_cap_rx_bw(rx->sta); 2871 2872 /* set cur_max_bandwidth and recalc sta bw */ 2873 rx->sta->cur_max_bandwidth = max_bw; 2874 new_bw = ieee80211_sta_cur_vht_bw(rx->sta); 2875 2876 if (rx->sta->sta.bandwidth == new_bw) 2877 goto handled; 2878 2879 rx->sta->sta.bandwidth = new_bw; 2880 sband = rx->local->hw.wiphy->bands[status->band]; 2881 2882 rate_control_rate_update(local, sband, rx->sta, 2883 IEEE80211_RC_BW_CHANGED); 2884 goto handled; 2885 } 2886 default: 2887 goto invalid; 2888 } 2889 2890 break; 2891 case WLAN_CATEGORY_PUBLIC: 2892 if (len < IEEE80211_MIN_ACTION_SIZE + 1) 2893 goto invalid; 2894 if (sdata->vif.type != NL80211_IFTYPE_STATION) 2895 break; 2896 if (!rx->sta) 2897 break; 2898 if (!ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid)) 2899 break; 2900 if (mgmt->u.action.u.ext_chan_switch.action_code != 2901 WLAN_PUB_ACTION_EXT_CHANSW_ANN) 2902 break; 2903 if (len < offsetof(struct ieee80211_mgmt, 2904 u.action.u.ext_chan_switch.variable)) 2905 goto invalid; 2906 goto queue; 2907 case WLAN_CATEGORY_VHT: 2908 if (sdata->vif.type != NL80211_IFTYPE_STATION && 2909 sdata->vif.type != NL80211_IFTYPE_MESH_POINT && 2910 sdata->vif.type != NL80211_IFTYPE_AP_VLAN && 2911 sdata->vif.type != NL80211_IFTYPE_AP && 2912 sdata->vif.type != NL80211_IFTYPE_ADHOC) 2913 break; 2914 2915 /* verify action code is present */ 2916 if (len < IEEE80211_MIN_ACTION_SIZE + 1) 2917 goto invalid; 2918 2919 switch (mgmt->u.action.u.vht_opmode_notif.action_code) { 2920 case WLAN_VHT_ACTION_OPMODE_NOTIF: { 2921 /* verify opmode is present */ 2922 if (len < IEEE80211_MIN_ACTION_SIZE + 2) 2923 goto invalid; 2924 goto queue; 2925 } 2926 case WLAN_VHT_ACTION_GROUPID_MGMT: { 2927 if (len < IEEE80211_MIN_ACTION_SIZE + 25) 2928 goto invalid; 2929 goto queue; 2930 } 2931 default: 2932 break; 2933 } 2934 break; 2935 case WLAN_CATEGORY_BACK: 2936 if (sdata->vif.type != NL80211_IFTYPE_STATION && 2937 sdata->vif.type != NL80211_IFTYPE_MESH_POINT && 2938 sdata->vif.type != NL80211_IFTYPE_AP_VLAN && 2939 sdata->vif.type != NL80211_IFTYPE_AP && 2940 sdata->vif.type != NL80211_IFTYPE_ADHOC) 2941 break; 2942 2943 /* verify action_code is present */ 2944 if (len < IEEE80211_MIN_ACTION_SIZE + 1) 2945 break; 2946 2947 switch (mgmt->u.action.u.addba_req.action_code) { 2948 case WLAN_ACTION_ADDBA_REQ: 2949 if (len < (IEEE80211_MIN_ACTION_SIZE + 2950 sizeof(mgmt->u.action.u.addba_req))) 2951 goto invalid; 2952 break; 2953 case WLAN_ACTION_ADDBA_RESP: 2954 if (len < (IEEE80211_MIN_ACTION_SIZE + 2955 sizeof(mgmt->u.action.u.addba_resp))) 2956 goto invalid; 2957 break; 2958 case WLAN_ACTION_DELBA: 2959 if (len < (IEEE80211_MIN_ACTION_SIZE + 2960 sizeof(mgmt->u.action.u.delba))) 2961 goto invalid; 2962 break; 2963 default: 2964 goto invalid; 2965 } 2966 2967 goto queue; 2968 case WLAN_CATEGORY_SPECTRUM_MGMT: 2969 /* verify action_code is present */ 2970 if (len < IEEE80211_MIN_ACTION_SIZE + 1) 2971 break; 2972 2973 switch (mgmt->u.action.u.measurement.action_code) { 2974 case WLAN_ACTION_SPCT_MSR_REQ: 2975 if (status->band != NL80211_BAND_5GHZ) 2976 break; 2977 2978 if (len < (IEEE80211_MIN_ACTION_SIZE + 2979 sizeof(mgmt->u.action.u.measurement))) 2980 break; 2981 2982 if (sdata->vif.type != NL80211_IFTYPE_STATION) 2983 break; 2984 2985 ieee80211_process_measurement_req(sdata, mgmt, len); 2986 goto handled; 2987 case WLAN_ACTION_SPCT_CHL_SWITCH: { 2988 u8 *bssid; 2989 if (len < (IEEE80211_MIN_ACTION_SIZE + 2990 sizeof(mgmt->u.action.u.chan_switch))) 2991 break; 2992 2993 if (sdata->vif.type != NL80211_IFTYPE_STATION && 2994 sdata->vif.type != NL80211_IFTYPE_ADHOC && 2995 sdata->vif.type != NL80211_IFTYPE_MESH_POINT) 2996 break; 2997 2998 if (sdata->vif.type == NL80211_IFTYPE_STATION) 2999 bssid = sdata->u.mgd.bssid; 3000 else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) 3001 bssid = sdata->u.ibss.bssid; 3002 else if (sdata->vif.type == NL80211_IFTYPE_MESH_POINT) 3003 bssid = mgmt->sa; 3004 else 3005 break; 3006 3007 if (!ether_addr_equal(mgmt->bssid, bssid)) 3008 break; 3009 3010 goto queue; 3011 } 3012 } 3013 break; 3014 case WLAN_CATEGORY_SA_QUERY: 3015 if (len < (IEEE80211_MIN_ACTION_SIZE + 3016 sizeof(mgmt->u.action.u.sa_query))) 3017 break; 3018 3019 switch (mgmt->u.action.u.sa_query.action) { 3020 case WLAN_ACTION_SA_QUERY_REQUEST: 3021 if (sdata->vif.type != NL80211_IFTYPE_STATION) 3022 break; 3023 ieee80211_process_sa_query_req(sdata, mgmt, len); 3024 goto handled; 3025 } 3026 break; 3027 case WLAN_CATEGORY_SELF_PROTECTED: 3028 if (len < (IEEE80211_MIN_ACTION_SIZE + 3029 sizeof(mgmt->u.action.u.self_prot.action_code))) 3030 break; 3031 3032 switch (mgmt->u.action.u.self_prot.action_code) { 3033 case WLAN_SP_MESH_PEERING_OPEN: 3034 case WLAN_SP_MESH_PEERING_CLOSE: 3035 case WLAN_SP_MESH_PEERING_CONFIRM: 3036 if (!ieee80211_vif_is_mesh(&sdata->vif)) 3037 goto invalid; 3038 if (sdata->u.mesh.user_mpm) 3039 /* userspace handles this frame */ 3040 break; 3041 goto queue; 3042 case WLAN_SP_MGK_INFORM: 3043 case WLAN_SP_MGK_ACK: 3044 if (!ieee80211_vif_is_mesh(&sdata->vif)) 3045 goto invalid; 3046 break; 3047 } 3048 break; 3049 case WLAN_CATEGORY_MESH_ACTION: 3050 if (len < (IEEE80211_MIN_ACTION_SIZE + 3051 sizeof(mgmt->u.action.u.mesh_action.action_code))) 3052 break; 3053 3054 if (!ieee80211_vif_is_mesh(&sdata->vif)) 3055 break; 3056 if (mesh_action_is_path_sel(mgmt) && 3057 !mesh_path_sel_is_hwmp(sdata)) 3058 break; 3059 goto queue; 3060 } 3061 3062 return RX_CONTINUE; 3063 3064 invalid: 3065 status->rx_flags |= IEEE80211_RX_MALFORMED_ACTION_FRM; 3066 /* will return in the next handlers */ 3067 return RX_CONTINUE; 3068 3069 handled: 3070 if (rx->sta) 3071 rx->sta->rx_stats.packets++; 3072 dev_kfree_skb(rx->skb); 3073 return RX_QUEUED; 3074 3075 queue: 3076 rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME; 3077 skb_queue_tail(&sdata->skb_queue, rx->skb); 3078 ieee80211_queue_work(&local->hw, &sdata->work); 3079 if (rx->sta) 3080 rx->sta->rx_stats.packets++; 3081 return RX_QUEUED; 3082 } 3083 3084 static ieee80211_rx_result debug_noinline 3085 ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx) 3086 { 3087 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 3088 int sig = 0; 3089 3090 /* skip known-bad action frames and return them in the next handler */ 3091 if (status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) 3092 return RX_CONTINUE; 3093 3094 /* 3095 * Getting here means the kernel doesn't know how to handle 3096 * it, but maybe userspace does ... include returned frames 3097 * so userspace can register for those to know whether ones 3098 * it transmitted were processed or returned. 3099 */ 3100 3101 if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM)) 3102 sig = status->signal; 3103 3104 if (cfg80211_rx_mgmt(&rx->sdata->wdev, status->freq, sig, 3105 rx->skb->data, rx->skb->len, 0)) { 3106 if (rx->sta) 3107 rx->sta->rx_stats.packets++; 3108 dev_kfree_skb(rx->skb); 3109 return RX_QUEUED; 3110 } 3111 3112 return RX_CONTINUE; 3113 } 3114 3115 static ieee80211_rx_result debug_noinline 3116 ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx) 3117 { 3118 struct ieee80211_local *local = rx->local; 3119 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data; 3120 struct sk_buff *nskb; 3121 struct ieee80211_sub_if_data *sdata = rx->sdata; 3122 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 3123 3124 if (!ieee80211_is_action(mgmt->frame_control)) 3125 return RX_CONTINUE; 3126 3127 /* 3128 * For AP mode, hostapd is responsible for handling any action 3129 * frames that we didn't handle, including returning unknown 3130 * ones. For all other modes we will return them to the sender, 3131 * setting the 0x80 bit in the action category, as required by 3132 * 802.11-2012 9.24.4. 3133 * Newer versions of hostapd shall also use the management frame 3134 * registration mechanisms, but older ones still use cooked 3135 * monitor interfaces so push all frames there. 3136 */ 3137 if (!(status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) && 3138 (sdata->vif.type == NL80211_IFTYPE_AP || 3139 sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) 3140 return RX_DROP_MONITOR; 3141 3142 if (is_multicast_ether_addr(mgmt->da)) 3143 return RX_DROP_MONITOR; 3144 3145 /* do not return rejected action frames */ 3146 if (mgmt->u.action.category & 0x80) 3147 return RX_DROP_UNUSABLE; 3148 3149 nskb = skb_copy_expand(rx->skb, local->hw.extra_tx_headroom, 0, 3150 GFP_ATOMIC); 3151 if (nskb) { 3152 struct ieee80211_mgmt *nmgmt = (void *)nskb->data; 3153 3154 nmgmt->u.action.category |= 0x80; 3155 memcpy(nmgmt->da, nmgmt->sa, ETH_ALEN); 3156 memcpy(nmgmt->sa, rx->sdata->vif.addr, ETH_ALEN); 3157 3158 memset(nskb->cb, 0, sizeof(nskb->cb)); 3159 3160 if (rx->sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) { 3161 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(nskb); 3162 3163 info->flags = IEEE80211_TX_CTL_TX_OFFCHAN | 3164 IEEE80211_TX_INTFL_OFFCHAN_TX_OK | 3165 IEEE80211_TX_CTL_NO_CCK_RATE; 3166 if (ieee80211_hw_check(&local->hw, QUEUE_CONTROL)) 3167 info->hw_queue = 3168 local->hw.offchannel_tx_hw_queue; 3169 } 3170 3171 __ieee80211_tx_skb_tid_band(rx->sdata, nskb, 7, 3172 status->band); 3173 } 3174 dev_kfree_skb(rx->skb); 3175 return RX_QUEUED; 3176 } 3177 3178 static ieee80211_rx_result debug_noinline 3179 ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx) 3180 { 3181 struct ieee80211_sub_if_data *sdata = rx->sdata; 3182 struct ieee80211_mgmt *mgmt = (void *)rx->skb->data; 3183 __le16 stype; 3184 3185 stype = mgmt->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE); 3186 3187 if (!ieee80211_vif_is_mesh(&sdata->vif) && 3188 sdata->vif.type != NL80211_IFTYPE_ADHOC && 3189 sdata->vif.type != NL80211_IFTYPE_OCB && 3190 sdata->vif.type != NL80211_IFTYPE_STATION) 3191 return RX_DROP_MONITOR; 3192 3193 switch (stype) { 3194 case cpu_to_le16(IEEE80211_STYPE_AUTH): 3195 case cpu_to_le16(IEEE80211_STYPE_BEACON): 3196 case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP): 3197 /* process for all: mesh, mlme, ibss */ 3198 break; 3199 case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP): 3200 case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP): 3201 case cpu_to_le16(IEEE80211_STYPE_DEAUTH): 3202 case cpu_to_le16(IEEE80211_STYPE_DISASSOC): 3203 if (is_multicast_ether_addr(mgmt->da) && 3204 !is_broadcast_ether_addr(mgmt->da)) 3205 return RX_DROP_MONITOR; 3206 3207 /* process only for station */ 3208 if (sdata->vif.type != NL80211_IFTYPE_STATION) 3209 return RX_DROP_MONITOR; 3210 break; 3211 case cpu_to_le16(IEEE80211_STYPE_PROBE_REQ): 3212 /* process only for ibss and mesh */ 3213 if (sdata->vif.type != NL80211_IFTYPE_ADHOC && 3214 sdata->vif.type != NL80211_IFTYPE_MESH_POINT) 3215 return RX_DROP_MONITOR; 3216 break; 3217 default: 3218 return RX_DROP_MONITOR; 3219 } 3220 3221 /* queue up frame and kick off work to process it */ 3222 rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME; 3223 skb_queue_tail(&sdata->skb_queue, rx->skb); 3224 ieee80211_queue_work(&rx->local->hw, &sdata->work); 3225 if (rx->sta) 3226 rx->sta->rx_stats.packets++; 3227 3228 return RX_QUEUED; 3229 } 3230 3231 static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx, 3232 struct ieee80211_rate *rate) 3233 { 3234 struct ieee80211_sub_if_data *sdata; 3235 struct ieee80211_local *local = rx->local; 3236 struct sk_buff *skb = rx->skb, *skb2; 3237 struct net_device *prev_dev = NULL; 3238 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 3239 int needed_headroom; 3240 3241 /* 3242 * If cooked monitor has been processed already, then 3243 * don't do it again. If not, set the flag. 3244 */ 3245 if (rx->flags & IEEE80211_RX_CMNTR) 3246 goto out_free_skb; 3247 rx->flags |= IEEE80211_RX_CMNTR; 3248 3249 /* If there are no cooked monitor interfaces, just free the SKB */ 3250 if (!local->cooked_mntrs) 3251 goto out_free_skb; 3252 3253 /* vendor data is long removed here */ 3254 status->flag &= ~RX_FLAG_RADIOTAP_VENDOR_DATA; 3255 /* room for the radiotap header based on driver features */ 3256 needed_headroom = ieee80211_rx_radiotap_hdrlen(local, status, skb); 3257 3258 if (skb_headroom(skb) < needed_headroom && 3259 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) 3260 goto out_free_skb; 3261 3262 /* prepend radiotap information */ 3263 ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom, 3264 false); 3265 3266 skb_reset_mac_header(skb); 3267 skb->ip_summed = CHECKSUM_UNNECESSARY; 3268 skb->pkt_type = PACKET_OTHERHOST; 3269 skb->protocol = htons(ETH_P_802_2); 3270 3271 list_for_each_entry_rcu(sdata, &local->interfaces, list) { 3272 if (!ieee80211_sdata_running(sdata)) 3273 continue; 3274 3275 if (sdata->vif.type != NL80211_IFTYPE_MONITOR || 3276 !(sdata->u.mntr.flags & MONITOR_FLAG_COOK_FRAMES)) 3277 continue; 3278 3279 if (prev_dev) { 3280 skb2 = skb_clone(skb, GFP_ATOMIC); 3281 if (skb2) { 3282 skb2->dev = prev_dev; 3283 netif_receive_skb(skb2); 3284 } 3285 } 3286 3287 prev_dev = sdata->dev; 3288 ieee80211_rx_stats(sdata->dev, skb->len); 3289 } 3290 3291 if (prev_dev) { 3292 skb->dev = prev_dev; 3293 netif_receive_skb(skb); 3294 return; 3295 } 3296 3297 out_free_skb: 3298 dev_kfree_skb(skb); 3299 } 3300 3301 static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx, 3302 ieee80211_rx_result res) 3303 { 3304 switch (res) { 3305 case RX_DROP_MONITOR: 3306 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop); 3307 if (rx->sta) 3308 rx->sta->rx_stats.dropped++; 3309 /* fall through */ 3310 case RX_CONTINUE: { 3311 struct ieee80211_rate *rate = NULL; 3312 struct ieee80211_supported_band *sband; 3313 struct ieee80211_rx_status *status; 3314 3315 status = IEEE80211_SKB_RXCB((rx->skb)); 3316 3317 sband = rx->local->hw.wiphy->bands[status->band]; 3318 if (!(status->flag & RX_FLAG_HT) && 3319 !(status->flag & RX_FLAG_VHT)) 3320 rate = &sband->bitrates[status->rate_idx]; 3321 3322 ieee80211_rx_cooked_monitor(rx, rate); 3323 break; 3324 } 3325 case RX_DROP_UNUSABLE: 3326 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop); 3327 if (rx->sta) 3328 rx->sta->rx_stats.dropped++; 3329 dev_kfree_skb(rx->skb); 3330 break; 3331 case RX_QUEUED: 3332 I802_DEBUG_INC(rx->sdata->local->rx_handlers_queued); 3333 break; 3334 } 3335 } 3336 3337 static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx, 3338 struct sk_buff_head *frames) 3339 { 3340 ieee80211_rx_result res = RX_DROP_MONITOR; 3341 struct sk_buff *skb; 3342 3343 #define CALL_RXH(rxh) \ 3344 do { \ 3345 res = rxh(rx); \ 3346 if (res != RX_CONTINUE) \ 3347 goto rxh_next; \ 3348 } while (0) 3349 3350 /* Lock here to avoid hitting all of the data used in the RX 3351 * path (e.g. key data, station data, ...) concurrently when 3352 * a frame is released from the reorder buffer due to timeout 3353 * from the timer, potentially concurrently with RX from the 3354 * driver. 3355 */ 3356 spin_lock_bh(&rx->local->rx_path_lock); 3357 3358 while ((skb = __skb_dequeue(frames))) { 3359 /* 3360 * all the other fields are valid across frames 3361 * that belong to an aMPDU since they are on the 3362 * same TID from the same station 3363 */ 3364 rx->skb = skb; 3365 3366 CALL_RXH(ieee80211_rx_h_check_more_data); 3367 CALL_RXH(ieee80211_rx_h_uapsd_and_pspoll); 3368 CALL_RXH(ieee80211_rx_h_sta_process); 3369 CALL_RXH(ieee80211_rx_h_decrypt); 3370 CALL_RXH(ieee80211_rx_h_defragment); 3371 CALL_RXH(ieee80211_rx_h_michael_mic_verify); 3372 /* must be after MMIC verify so header is counted in MPDU mic */ 3373 #ifdef CONFIG_MAC80211_MESH 3374 if (ieee80211_vif_is_mesh(&rx->sdata->vif)) 3375 CALL_RXH(ieee80211_rx_h_mesh_fwding); 3376 #endif 3377 CALL_RXH(ieee80211_rx_h_amsdu); 3378 CALL_RXH(ieee80211_rx_h_data); 3379 3380 /* special treatment -- needs the queue */ 3381 res = ieee80211_rx_h_ctrl(rx, frames); 3382 if (res != RX_CONTINUE) 3383 goto rxh_next; 3384 3385 CALL_RXH(ieee80211_rx_h_mgmt_check); 3386 CALL_RXH(ieee80211_rx_h_action); 3387 CALL_RXH(ieee80211_rx_h_userspace_mgmt); 3388 CALL_RXH(ieee80211_rx_h_action_return); 3389 CALL_RXH(ieee80211_rx_h_mgmt); 3390 3391 rxh_next: 3392 ieee80211_rx_handlers_result(rx, res); 3393 3394 #undef CALL_RXH 3395 } 3396 3397 spin_unlock_bh(&rx->local->rx_path_lock); 3398 } 3399 3400 static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx) 3401 { 3402 struct sk_buff_head reorder_release; 3403 ieee80211_rx_result res = RX_DROP_MONITOR; 3404 3405 __skb_queue_head_init(&reorder_release); 3406 3407 #define CALL_RXH(rxh) \ 3408 do { \ 3409 res = rxh(rx); \ 3410 if (res != RX_CONTINUE) \ 3411 goto rxh_next; \ 3412 } while (0) 3413 3414 CALL_RXH(ieee80211_rx_h_check_dup); 3415 CALL_RXH(ieee80211_rx_h_check); 3416 3417 ieee80211_rx_reorder_ampdu(rx, &reorder_release); 3418 3419 ieee80211_rx_handlers(rx, &reorder_release); 3420 return; 3421 3422 rxh_next: 3423 ieee80211_rx_handlers_result(rx, res); 3424 3425 #undef CALL_RXH 3426 } 3427 3428 /* 3429 * This function makes calls into the RX path, therefore 3430 * it has to be invoked under RCU read lock. 3431 */ 3432 void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid) 3433 { 3434 struct sk_buff_head frames; 3435 struct ieee80211_rx_data rx = { 3436 .sta = sta, 3437 .sdata = sta->sdata, 3438 .local = sta->local, 3439 /* This is OK -- must be QoS data frame */ 3440 .security_idx = tid, 3441 .seqno_idx = tid, 3442 .napi = NULL, /* must be NULL to not have races */ 3443 }; 3444 struct tid_ampdu_rx *tid_agg_rx; 3445 3446 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]); 3447 if (!tid_agg_rx) 3448 return; 3449 3450 __skb_queue_head_init(&frames); 3451 3452 spin_lock(&tid_agg_rx->reorder_lock); 3453 ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames); 3454 spin_unlock(&tid_agg_rx->reorder_lock); 3455 3456 if (!skb_queue_empty(&frames)) { 3457 struct ieee80211_event event = { 3458 .type = BA_FRAME_TIMEOUT, 3459 .u.ba.tid = tid, 3460 .u.ba.sta = &sta->sta, 3461 }; 3462 drv_event_callback(rx.local, rx.sdata, &event); 3463 } 3464 3465 ieee80211_rx_handlers(&rx, &frames); 3466 } 3467 3468 void ieee80211_mark_rx_ba_filtered_frames(struct ieee80211_sta *pubsta, u8 tid, 3469 u16 ssn, u64 filtered, 3470 u16 received_mpdus) 3471 { 3472 struct sta_info *sta; 3473 struct tid_ampdu_rx *tid_agg_rx; 3474 struct sk_buff_head frames; 3475 struct ieee80211_rx_data rx = { 3476 /* This is OK -- must be QoS data frame */ 3477 .security_idx = tid, 3478 .seqno_idx = tid, 3479 }; 3480 int i, diff; 3481 3482 if (WARN_ON(!pubsta || tid >= IEEE80211_NUM_TIDS)) 3483 return; 3484 3485 __skb_queue_head_init(&frames); 3486 3487 sta = container_of(pubsta, struct sta_info, sta); 3488 3489 rx.sta = sta; 3490 rx.sdata = sta->sdata; 3491 rx.local = sta->local; 3492 3493 rcu_read_lock(); 3494 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]); 3495 if (!tid_agg_rx) 3496 goto out; 3497 3498 spin_lock_bh(&tid_agg_rx->reorder_lock); 3499 3500 if (received_mpdus >= IEEE80211_SN_MODULO >> 1) { 3501 int release; 3502 3503 /* release all frames in the reorder buffer */ 3504 release = (tid_agg_rx->head_seq_num + tid_agg_rx->buf_size) % 3505 IEEE80211_SN_MODULO; 3506 ieee80211_release_reorder_frames(sta->sdata, tid_agg_rx, 3507 release, &frames); 3508 /* update ssn to match received ssn */ 3509 tid_agg_rx->head_seq_num = ssn; 3510 } else { 3511 ieee80211_release_reorder_frames(sta->sdata, tid_agg_rx, ssn, 3512 &frames); 3513 } 3514 3515 /* handle the case that received ssn is behind the mac ssn. 3516 * it can be tid_agg_rx->buf_size behind and still be valid */ 3517 diff = (tid_agg_rx->head_seq_num - ssn) & IEEE80211_SN_MASK; 3518 if (diff >= tid_agg_rx->buf_size) { 3519 tid_agg_rx->reorder_buf_filtered = 0; 3520 goto release; 3521 } 3522 filtered = filtered >> diff; 3523 ssn += diff; 3524 3525 /* update bitmap */ 3526 for (i = 0; i < tid_agg_rx->buf_size; i++) { 3527 int index = (ssn + i) % tid_agg_rx->buf_size; 3528 3529 tid_agg_rx->reorder_buf_filtered &= ~BIT_ULL(index); 3530 if (filtered & BIT_ULL(i)) 3531 tid_agg_rx->reorder_buf_filtered |= BIT_ULL(index); 3532 } 3533 3534 /* now process also frames that the filter marking released */ 3535 ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames); 3536 3537 release: 3538 spin_unlock_bh(&tid_agg_rx->reorder_lock); 3539 3540 ieee80211_rx_handlers(&rx, &frames); 3541 3542 out: 3543 rcu_read_unlock(); 3544 } 3545 EXPORT_SYMBOL(ieee80211_mark_rx_ba_filtered_frames); 3546 3547 /* main receive path */ 3548 3549 static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx) 3550 { 3551 struct ieee80211_sub_if_data *sdata = rx->sdata; 3552 struct sk_buff *skb = rx->skb; 3553 struct ieee80211_hdr *hdr = (void *)skb->data; 3554 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 3555 u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type); 3556 int multicast = is_multicast_ether_addr(hdr->addr1); 3557 3558 switch (sdata->vif.type) { 3559 case NL80211_IFTYPE_STATION: 3560 if (!bssid && !sdata->u.mgd.use_4addr) 3561 return false; 3562 if (multicast) 3563 return true; 3564 return ether_addr_equal(sdata->vif.addr, hdr->addr1); 3565 case NL80211_IFTYPE_ADHOC: 3566 if (!bssid) 3567 return false; 3568 if (ether_addr_equal(sdata->vif.addr, hdr->addr2) || 3569 ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2)) 3570 return false; 3571 if (ieee80211_is_beacon(hdr->frame_control)) 3572 return true; 3573 if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid)) 3574 return false; 3575 if (!multicast && 3576 !ether_addr_equal(sdata->vif.addr, hdr->addr1)) 3577 return false; 3578 if (!rx->sta) { 3579 int rate_idx; 3580 if (status->flag & (RX_FLAG_HT | RX_FLAG_VHT)) 3581 rate_idx = 0; /* TODO: HT/VHT rates */ 3582 else 3583 rate_idx = status->rate_idx; 3584 ieee80211_ibss_rx_no_sta(sdata, bssid, hdr->addr2, 3585 BIT(rate_idx)); 3586 } 3587 return true; 3588 case NL80211_IFTYPE_OCB: 3589 if (!bssid) 3590 return false; 3591 if (!ieee80211_is_data_present(hdr->frame_control)) 3592 return false; 3593 if (!is_broadcast_ether_addr(bssid)) 3594 return false; 3595 if (!multicast && 3596 !ether_addr_equal(sdata->dev->dev_addr, hdr->addr1)) 3597 return false; 3598 if (!rx->sta) { 3599 int rate_idx; 3600 if (status->flag & RX_FLAG_HT) 3601 rate_idx = 0; /* TODO: HT rates */ 3602 else 3603 rate_idx = status->rate_idx; 3604 ieee80211_ocb_rx_no_sta(sdata, bssid, hdr->addr2, 3605 BIT(rate_idx)); 3606 } 3607 return true; 3608 case NL80211_IFTYPE_MESH_POINT: 3609 if (multicast) 3610 return true; 3611 return ether_addr_equal(sdata->vif.addr, hdr->addr1); 3612 case NL80211_IFTYPE_AP_VLAN: 3613 case NL80211_IFTYPE_AP: 3614 if (!bssid) 3615 return ether_addr_equal(sdata->vif.addr, hdr->addr1); 3616 3617 if (!ieee80211_bssid_match(bssid, sdata->vif.addr)) { 3618 /* 3619 * Accept public action frames even when the 3620 * BSSID doesn't match, this is used for P2P 3621 * and location updates. Note that mac80211 3622 * itself never looks at these frames. 3623 */ 3624 if (!multicast && 3625 !ether_addr_equal(sdata->vif.addr, hdr->addr1)) 3626 return false; 3627 if (ieee80211_is_public_action(hdr, skb->len)) 3628 return true; 3629 return ieee80211_is_beacon(hdr->frame_control); 3630 } 3631 3632 if (!ieee80211_has_tods(hdr->frame_control)) { 3633 /* ignore data frames to TDLS-peers */ 3634 if (ieee80211_is_data(hdr->frame_control)) 3635 return false; 3636 /* ignore action frames to TDLS-peers */ 3637 if (ieee80211_is_action(hdr->frame_control) && 3638 !is_broadcast_ether_addr(bssid) && 3639 !ether_addr_equal(bssid, hdr->addr1)) 3640 return false; 3641 } 3642 3643 /* 3644 * 802.11-2016 Table 9-26 says that for data frames, A1 must be 3645 * the BSSID - we've checked that already but may have accepted 3646 * the wildcard (ff:ff:ff:ff:ff:ff). 3647 * 3648 * It also says: 3649 * The BSSID of the Data frame is determined as follows: 3650 * a) If the STA is contained within an AP or is associated 3651 * with an AP, the BSSID is the address currently in use 3652 * by the STA contained in the AP. 3653 * 3654 * So we should not accept data frames with an address that's 3655 * multicast. 3656 * 3657 * Accepting it also opens a security problem because stations 3658 * could encrypt it with the GTK and inject traffic that way. 3659 */ 3660 if (ieee80211_is_data(hdr->frame_control) && multicast) 3661 return false; 3662 3663 return true; 3664 case NL80211_IFTYPE_WDS: 3665 if (bssid || !ieee80211_is_data(hdr->frame_control)) 3666 return false; 3667 return ether_addr_equal(sdata->u.wds.remote_addr, hdr->addr2); 3668 case NL80211_IFTYPE_P2P_DEVICE: 3669 return ieee80211_is_public_action(hdr, skb->len) || 3670 ieee80211_is_probe_req(hdr->frame_control) || 3671 ieee80211_is_probe_resp(hdr->frame_control) || 3672 ieee80211_is_beacon(hdr->frame_control); 3673 case NL80211_IFTYPE_NAN: 3674 /* Currently no frames on NAN interface are allowed */ 3675 return false; 3676 default: 3677 break; 3678 } 3679 3680 WARN_ON_ONCE(1); 3681 return false; 3682 } 3683 3684 void ieee80211_check_fast_rx(struct sta_info *sta) 3685 { 3686 struct ieee80211_sub_if_data *sdata = sta->sdata; 3687 struct ieee80211_local *local = sdata->local; 3688 struct ieee80211_key *key; 3689 struct ieee80211_fast_rx fastrx = { 3690 .dev = sdata->dev, 3691 .vif_type = sdata->vif.type, 3692 .control_port_protocol = sdata->control_port_protocol, 3693 }, *old, *new = NULL; 3694 bool assign = false; 3695 3696 /* use sparse to check that we don't return without updating */ 3697 __acquire(check_fast_rx); 3698 3699 BUILD_BUG_ON(sizeof(fastrx.rfc1042_hdr) != sizeof(rfc1042_header)); 3700 BUILD_BUG_ON(sizeof(fastrx.rfc1042_hdr) != ETH_ALEN); 3701 ether_addr_copy(fastrx.rfc1042_hdr, rfc1042_header); 3702 ether_addr_copy(fastrx.vif_addr, sdata->vif.addr); 3703 3704 fastrx.uses_rss = ieee80211_hw_check(&local->hw, USES_RSS); 3705 3706 /* fast-rx doesn't do reordering */ 3707 if (ieee80211_hw_check(&local->hw, AMPDU_AGGREGATION) && 3708 !ieee80211_hw_check(&local->hw, SUPPORTS_REORDERING_BUFFER)) 3709 goto clear; 3710 3711 switch (sdata->vif.type) { 3712 case NL80211_IFTYPE_STATION: 3713 /* 4-addr is harder to deal with, later maybe */ 3714 if (sdata->u.mgd.use_4addr) 3715 goto clear; 3716 /* software powersave is a huge mess, avoid all of it */ 3717 if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK)) 3718 goto clear; 3719 if (ieee80211_hw_check(&local->hw, SUPPORTS_PS) && 3720 !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS)) 3721 goto clear; 3722 if (sta->sta.tdls) { 3723 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr1); 3724 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr2); 3725 fastrx.expected_ds_bits = 0; 3726 } else { 3727 fastrx.sta_notify = sdata->u.mgd.probe_send_count > 0; 3728 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr1); 3729 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr3); 3730 fastrx.expected_ds_bits = 3731 cpu_to_le16(IEEE80211_FCTL_FROMDS); 3732 } 3733 break; 3734 case NL80211_IFTYPE_AP_VLAN: 3735 case NL80211_IFTYPE_AP: 3736 /* parallel-rx requires this, at least with calls to 3737 * ieee80211_sta_ps_transition() 3738 */ 3739 if (!ieee80211_hw_check(&local->hw, AP_LINK_PS)) 3740 goto clear; 3741 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3); 3742 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr2); 3743 fastrx.expected_ds_bits = cpu_to_le16(IEEE80211_FCTL_TODS); 3744 3745 fastrx.internal_forward = 3746 !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) && 3747 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || 3748 !sdata->u.vlan.sta); 3749 break; 3750 default: 3751 goto clear; 3752 } 3753 3754 if (!test_sta_flag(sta, WLAN_STA_AUTHORIZED)) 3755 goto clear; 3756 3757 rcu_read_lock(); 3758 key = rcu_dereference(sta->ptk[sta->ptk_idx]); 3759 if (key) { 3760 switch (key->conf.cipher) { 3761 case WLAN_CIPHER_SUITE_TKIP: 3762 /* we don't want to deal with MMIC in fast-rx */ 3763 goto clear_rcu; 3764 case WLAN_CIPHER_SUITE_CCMP: 3765 case WLAN_CIPHER_SUITE_CCMP_256: 3766 case WLAN_CIPHER_SUITE_GCMP: 3767 case WLAN_CIPHER_SUITE_GCMP_256: 3768 break; 3769 default: 3770 /* we also don't want to deal with WEP or cipher scheme 3771 * since those require looking up the key idx in the 3772 * frame, rather than assuming the PTK is used 3773 * (we need to revisit this once we implement the real 3774 * PTK index, which is now valid in the spec, but we 3775 * haven't implemented that part yet) 3776 */ 3777 goto clear_rcu; 3778 } 3779 3780 fastrx.key = true; 3781 fastrx.icv_len = key->conf.icv_len; 3782 } 3783 3784 assign = true; 3785 clear_rcu: 3786 rcu_read_unlock(); 3787 clear: 3788 __release(check_fast_rx); 3789 3790 if (assign) 3791 new = kmemdup(&fastrx, sizeof(fastrx), GFP_KERNEL); 3792 3793 spin_lock_bh(&sta->lock); 3794 old = rcu_dereference_protected(sta->fast_rx, true); 3795 rcu_assign_pointer(sta->fast_rx, new); 3796 spin_unlock_bh(&sta->lock); 3797 3798 if (old) 3799 kfree_rcu(old, rcu_head); 3800 } 3801 3802 void ieee80211_clear_fast_rx(struct sta_info *sta) 3803 { 3804 struct ieee80211_fast_rx *old; 3805 3806 spin_lock_bh(&sta->lock); 3807 old = rcu_dereference_protected(sta->fast_rx, true); 3808 RCU_INIT_POINTER(sta->fast_rx, NULL); 3809 spin_unlock_bh(&sta->lock); 3810 3811 if (old) 3812 kfree_rcu(old, rcu_head); 3813 } 3814 3815 void __ieee80211_check_fast_rx_iface(struct ieee80211_sub_if_data *sdata) 3816 { 3817 struct ieee80211_local *local = sdata->local; 3818 struct sta_info *sta; 3819 3820 lockdep_assert_held(&local->sta_mtx); 3821 3822 list_for_each_entry_rcu(sta, &local->sta_list, list) { 3823 if (sdata != sta->sdata && 3824 (!sta->sdata->bss || sta->sdata->bss != sdata->bss)) 3825 continue; 3826 ieee80211_check_fast_rx(sta); 3827 } 3828 } 3829 3830 void ieee80211_check_fast_rx_iface(struct ieee80211_sub_if_data *sdata) 3831 { 3832 struct ieee80211_local *local = sdata->local; 3833 3834 mutex_lock(&local->sta_mtx); 3835 __ieee80211_check_fast_rx_iface(sdata); 3836 mutex_unlock(&local->sta_mtx); 3837 } 3838 3839 static bool ieee80211_invoke_fast_rx(struct ieee80211_rx_data *rx, 3840 struct ieee80211_fast_rx *fast_rx) 3841 { 3842 struct sk_buff *skb = rx->skb; 3843 struct ieee80211_hdr *hdr = (void *)skb->data; 3844 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 3845 struct sta_info *sta = rx->sta; 3846 int orig_len = skb->len; 3847 int snap_offs = ieee80211_hdrlen(hdr->frame_control); 3848 struct { 3849 u8 snap[sizeof(rfc1042_header)]; 3850 __be16 proto; 3851 } *payload __aligned(2); 3852 struct { 3853 u8 da[ETH_ALEN]; 3854 u8 sa[ETH_ALEN]; 3855 } addrs __aligned(2); 3856 struct ieee80211_sta_rx_stats *stats = &sta->rx_stats; 3857 3858 if (fast_rx->uses_rss) 3859 stats = this_cpu_ptr(sta->pcpu_rx_stats); 3860 3861 /* for parallel-rx, we need to have DUP_VALIDATED, otherwise we write 3862 * to a common data structure; drivers can implement that per queue 3863 * but we don't have that information in mac80211 3864 */ 3865 if (!(status->flag & RX_FLAG_DUP_VALIDATED)) 3866 return false; 3867 3868 #define FAST_RX_CRYPT_FLAGS (RX_FLAG_PN_VALIDATED | RX_FLAG_DECRYPTED) 3869 3870 /* If using encryption, we also need to have: 3871 * - PN_VALIDATED: similar, but the implementation is tricky 3872 * - DECRYPTED: necessary for PN_VALIDATED 3873 */ 3874 if (fast_rx->key && 3875 (status->flag & FAST_RX_CRYPT_FLAGS) != FAST_RX_CRYPT_FLAGS) 3876 return false; 3877 3878 /* we don't deal with A-MSDU deaggregation here */ 3879 if (status->rx_flags & IEEE80211_RX_AMSDU) 3880 return false; 3881 3882 if (unlikely(!ieee80211_is_data_present(hdr->frame_control))) 3883 return false; 3884 3885 if (unlikely(ieee80211_is_frag(hdr))) 3886 return false; 3887 3888 /* Since our interface address cannot be multicast, this 3889 * implicitly also rejects multicast frames without the 3890 * explicit check. 3891 * 3892 * We shouldn't get any *data* frames not addressed to us 3893 * (AP mode will accept multicast *management* frames), but 3894 * punting here will make it go through the full checks in 3895 * ieee80211_accept_frame(). 3896 */ 3897 if (!ether_addr_equal(fast_rx->vif_addr, hdr->addr1)) 3898 return false; 3899 3900 if ((hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_FROMDS | 3901 IEEE80211_FCTL_TODS)) != 3902 fast_rx->expected_ds_bits) 3903 goto drop; 3904 3905 /* assign the key to drop unencrypted frames (later) 3906 * and strip the IV/MIC if necessary 3907 */ 3908 if (fast_rx->key && !(status->flag & RX_FLAG_IV_STRIPPED)) { 3909 /* GCMP header length is the same */ 3910 snap_offs += IEEE80211_CCMP_HDR_LEN; 3911 } 3912 3913 if (!pskb_may_pull(skb, snap_offs + sizeof(*payload))) 3914 goto drop; 3915 payload = (void *)(skb->data + snap_offs); 3916 3917 if (!ether_addr_equal(payload->snap, fast_rx->rfc1042_hdr)) 3918 return false; 3919 3920 /* Don't handle these here since they require special code. 3921 * Accept AARP and IPX even though they should come with a 3922 * bridge-tunnel header - but if we get them this way then 3923 * there's little point in discarding them. 3924 */ 3925 if (unlikely(payload->proto == cpu_to_be16(ETH_P_TDLS) || 3926 payload->proto == fast_rx->control_port_protocol)) 3927 return false; 3928 3929 /* after this point, don't punt to the slowpath! */ 3930 3931 if (rx->key && !(status->flag & RX_FLAG_MIC_STRIPPED) && 3932 pskb_trim(skb, skb->len - fast_rx->icv_len)) 3933 goto drop; 3934 3935 if (unlikely(fast_rx->sta_notify)) { 3936 ieee80211_sta_rx_notify(rx->sdata, hdr); 3937 fast_rx->sta_notify = false; 3938 } 3939 3940 /* statistics part of ieee80211_rx_h_sta_process() */ 3941 stats->last_rx = jiffies; 3942 stats->last_rate = sta_stats_encode_rate(status); 3943 3944 stats->fragments++; 3945 stats->packets++; 3946 3947 if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) { 3948 stats->last_signal = status->signal; 3949 if (!fast_rx->uses_rss) 3950 ewma_signal_add(&sta->rx_stats_avg.signal, 3951 -status->signal); 3952 } 3953 3954 if (status->chains) { 3955 int i; 3956 3957 stats->chains = status->chains; 3958 for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) { 3959 int signal = status->chain_signal[i]; 3960 3961 if (!(status->chains & BIT(i))) 3962 continue; 3963 3964 stats->chain_signal_last[i] = signal; 3965 if (!fast_rx->uses_rss) 3966 ewma_signal_add(&sta->rx_stats_avg.chain_signal[i], 3967 -signal); 3968 } 3969 } 3970 /* end of statistics */ 3971 3972 if (rx->key && !ieee80211_has_protected(hdr->frame_control)) 3973 goto drop; 3974 3975 /* do the header conversion - first grab the addresses */ 3976 ether_addr_copy(addrs.da, skb->data + fast_rx->da_offs); 3977 ether_addr_copy(addrs.sa, skb->data + fast_rx->sa_offs); 3978 /* remove the SNAP but leave the ethertype */ 3979 skb_pull(skb, snap_offs + sizeof(rfc1042_header)); 3980 /* push the addresses in front */ 3981 memcpy(skb_push(skb, sizeof(addrs)), &addrs, sizeof(addrs)); 3982 3983 skb->dev = fast_rx->dev; 3984 3985 ieee80211_rx_stats(fast_rx->dev, skb->len); 3986 3987 /* The seqno index has the same property as needed 3988 * for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS 3989 * for non-QoS-data frames. Here we know it's a data 3990 * frame, so count MSDUs. 3991 */ 3992 u64_stats_update_begin(&stats->syncp); 3993 stats->msdu[rx->seqno_idx]++; 3994 stats->bytes += orig_len; 3995 u64_stats_update_end(&stats->syncp); 3996 3997 if (fast_rx->internal_forward) { 3998 struct sk_buff *xmit_skb = NULL; 3999 bool multicast = is_multicast_ether_addr(skb->data); 4000 4001 if (multicast) { 4002 xmit_skb = skb_copy(skb, GFP_ATOMIC); 4003 } else if (sta_info_get(rx->sdata, skb->data)) { 4004 xmit_skb = skb; 4005 skb = NULL; 4006 } 4007 4008 if (xmit_skb) { 4009 /* 4010 * Send to wireless media and increase priority by 256 4011 * to keep the received priority instead of 4012 * reclassifying the frame (see cfg80211_classify8021d). 4013 */ 4014 xmit_skb->priority += 256; 4015 xmit_skb->protocol = htons(ETH_P_802_3); 4016 skb_reset_network_header(xmit_skb); 4017 skb_reset_mac_header(xmit_skb); 4018 dev_queue_xmit(xmit_skb); 4019 } 4020 4021 if (!skb) 4022 return true; 4023 } 4024 4025 /* deliver to local stack */ 4026 skb->protocol = eth_type_trans(skb, fast_rx->dev); 4027 memset(skb->cb, 0, sizeof(skb->cb)); 4028 if (rx->napi) 4029 napi_gro_receive(rx->napi, skb); 4030 else 4031 netif_receive_skb(skb); 4032 4033 return true; 4034 drop: 4035 dev_kfree_skb(skb); 4036 stats->dropped++; 4037 return true; 4038 } 4039 4040 /* 4041 * This function returns whether or not the SKB 4042 * was destined for RX processing or not, which, 4043 * if consume is true, is equivalent to whether 4044 * or not the skb was consumed. 4045 */ 4046 static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx, 4047 struct sk_buff *skb, bool consume) 4048 { 4049 struct ieee80211_local *local = rx->local; 4050 struct ieee80211_sub_if_data *sdata = rx->sdata; 4051 4052 rx->skb = skb; 4053 4054 /* See if we can do fast-rx; if we have to copy we already lost, 4055 * so punt in that case. We should never have to deliver a data 4056 * frame to multiple interfaces anyway. 4057 * 4058 * We skip the ieee80211_accept_frame() call and do the necessary 4059 * checking inside ieee80211_invoke_fast_rx(). 4060 */ 4061 if (consume && rx->sta) { 4062 struct ieee80211_fast_rx *fast_rx; 4063 4064 fast_rx = rcu_dereference(rx->sta->fast_rx); 4065 if (fast_rx && ieee80211_invoke_fast_rx(rx, fast_rx)) 4066 return true; 4067 } 4068 4069 if (!ieee80211_accept_frame(rx)) 4070 return false; 4071 4072 if (!consume) { 4073 skb = skb_copy(skb, GFP_ATOMIC); 4074 if (!skb) { 4075 if (net_ratelimit()) 4076 wiphy_debug(local->hw.wiphy, 4077 "failed to copy skb for %s\n", 4078 sdata->name); 4079 return true; 4080 } 4081 4082 rx->skb = skb; 4083 } 4084 4085 ieee80211_invoke_rx_handlers(rx); 4086 return true; 4087 } 4088 4089 /* 4090 * This is the actual Rx frames handler. as it belongs to Rx path it must 4091 * be called with rcu_read_lock protection. 4092 */ 4093 static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, 4094 struct ieee80211_sta *pubsta, 4095 struct sk_buff *skb, 4096 struct napi_struct *napi) 4097 { 4098 struct ieee80211_local *local = hw_to_local(hw); 4099 struct ieee80211_sub_if_data *sdata; 4100 struct ieee80211_hdr *hdr; 4101 __le16 fc; 4102 struct ieee80211_rx_data rx; 4103 struct ieee80211_sub_if_data *prev; 4104 struct rhlist_head *tmp; 4105 int err = 0; 4106 4107 fc = ((struct ieee80211_hdr *)skb->data)->frame_control; 4108 memset(&rx, 0, sizeof(rx)); 4109 rx.skb = skb; 4110 rx.local = local; 4111 rx.napi = napi; 4112 4113 if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc)) 4114 I802_DEBUG_INC(local->dot11ReceivedFragmentCount); 4115 4116 if (ieee80211_is_mgmt(fc)) { 4117 /* drop frame if too short for header */ 4118 if (skb->len < ieee80211_hdrlen(fc)) 4119 err = -ENOBUFS; 4120 else 4121 err = skb_linearize(skb); 4122 } else { 4123 err = !pskb_may_pull(skb, ieee80211_hdrlen(fc)); 4124 } 4125 4126 if (err) { 4127 dev_kfree_skb(skb); 4128 return; 4129 } 4130 4131 hdr = (struct ieee80211_hdr *)skb->data; 4132 ieee80211_parse_qos(&rx); 4133 ieee80211_verify_alignment(&rx); 4134 4135 if (unlikely(ieee80211_is_probe_resp(hdr->frame_control) || 4136 ieee80211_is_beacon(hdr->frame_control))) 4137 ieee80211_scan_rx(local, skb); 4138 4139 if (ieee80211_is_data(fc)) { 4140 struct sta_info *sta, *prev_sta; 4141 4142 if (pubsta) { 4143 rx.sta = container_of(pubsta, struct sta_info, sta); 4144 rx.sdata = rx.sta->sdata; 4145 if (ieee80211_prepare_and_rx_handle(&rx, skb, true)) 4146 return; 4147 goto out; 4148 } 4149 4150 prev_sta = NULL; 4151 4152 for_each_sta_info(local, hdr->addr2, sta, tmp) { 4153 if (!prev_sta) { 4154 prev_sta = sta; 4155 continue; 4156 } 4157 4158 rx.sta = prev_sta; 4159 rx.sdata = prev_sta->sdata; 4160 ieee80211_prepare_and_rx_handle(&rx, skb, false); 4161 4162 prev_sta = sta; 4163 } 4164 4165 if (prev_sta) { 4166 rx.sta = prev_sta; 4167 rx.sdata = prev_sta->sdata; 4168 4169 if (ieee80211_prepare_and_rx_handle(&rx, skb, true)) 4170 return; 4171 goto out; 4172 } 4173 } 4174 4175 prev = NULL; 4176 4177 list_for_each_entry_rcu(sdata, &local->interfaces, list) { 4178 if (!ieee80211_sdata_running(sdata)) 4179 continue; 4180 4181 if (sdata->vif.type == NL80211_IFTYPE_MONITOR || 4182 sdata->vif.type == NL80211_IFTYPE_AP_VLAN) 4183 continue; 4184 4185 /* 4186 * frame is destined for this interface, but if it's 4187 * not also for the previous one we handle that after 4188 * the loop to avoid copying the SKB once too much 4189 */ 4190 4191 if (!prev) { 4192 prev = sdata; 4193 continue; 4194 } 4195 4196 rx.sta = sta_info_get_bss(prev, hdr->addr2); 4197 rx.sdata = prev; 4198 ieee80211_prepare_and_rx_handle(&rx, skb, false); 4199 4200 prev = sdata; 4201 } 4202 4203 if (prev) { 4204 rx.sta = sta_info_get_bss(prev, hdr->addr2); 4205 rx.sdata = prev; 4206 4207 if (ieee80211_prepare_and_rx_handle(&rx, skb, true)) 4208 return; 4209 } 4210 4211 out: 4212 dev_kfree_skb(skb); 4213 } 4214 4215 /* 4216 * This is the receive path handler. It is called by a low level driver when an 4217 * 802.11 MPDU is received from the hardware. 4218 */ 4219 void ieee80211_rx_napi(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta, 4220 struct sk_buff *skb, struct napi_struct *napi) 4221 { 4222 struct ieee80211_local *local = hw_to_local(hw); 4223 struct ieee80211_rate *rate = NULL; 4224 struct ieee80211_supported_band *sband; 4225 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 4226 4227 WARN_ON_ONCE(softirq_count() == 0); 4228 4229 if (WARN_ON(status->band >= NUM_NL80211_BANDS)) 4230 goto drop; 4231 4232 sband = local->hw.wiphy->bands[status->band]; 4233 if (WARN_ON(!sband)) 4234 goto drop; 4235 4236 /* 4237 * If we're suspending, it is possible although not too likely 4238 * that we'd be receiving frames after having already partially 4239 * quiesced the stack. We can't process such frames then since 4240 * that might, for example, cause stations to be added or other 4241 * driver callbacks be invoked. 4242 */ 4243 if (unlikely(local->quiescing || local->suspended)) 4244 goto drop; 4245 4246 /* We might be during a HW reconfig, prevent Rx for the same reason */ 4247 if (unlikely(local->in_reconfig)) 4248 goto drop; 4249 4250 /* 4251 * The same happens when we're not even started, 4252 * but that's worth a warning. 4253 */ 4254 if (WARN_ON(!local->started)) 4255 goto drop; 4256 4257 if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC))) { 4258 /* 4259 * Validate the rate, unless a PLCP error means that 4260 * we probably can't have a valid rate here anyway. 4261 */ 4262 4263 if (status->flag & RX_FLAG_HT) { 4264 /* 4265 * rate_idx is MCS index, which can be [0-76] 4266 * as documented on: 4267 * 4268 * http://wireless.kernel.org/en/developers/Documentation/ieee80211/802.11n 4269 * 4270 * Anything else would be some sort of driver or 4271 * hardware error. The driver should catch hardware 4272 * errors. 4273 */ 4274 if (WARN(status->rate_idx > 76, 4275 "Rate marked as an HT rate but passed " 4276 "status->rate_idx is not " 4277 "an MCS index [0-76]: %d (0x%02x)\n", 4278 status->rate_idx, 4279 status->rate_idx)) 4280 goto drop; 4281 } else if (status->flag & RX_FLAG_VHT) { 4282 if (WARN_ONCE(status->rate_idx > 9 || 4283 !status->vht_nss || 4284 status->vht_nss > 8, 4285 "Rate marked as a VHT rate but data is invalid: MCS: %d, NSS: %d\n", 4286 status->rate_idx, status->vht_nss)) 4287 goto drop; 4288 } else { 4289 if (WARN_ON(status->rate_idx >= sband->n_bitrates)) 4290 goto drop; 4291 rate = &sband->bitrates[status->rate_idx]; 4292 } 4293 } 4294 4295 status->rx_flags = 0; 4296 4297 /* 4298 * key references and virtual interfaces are protected using RCU 4299 * and this requires that we are in a read-side RCU section during 4300 * receive processing 4301 */ 4302 rcu_read_lock(); 4303 4304 /* 4305 * Frames with failed FCS/PLCP checksum are not returned, 4306 * all other frames are returned without radiotap header 4307 * if it was previously present. 4308 * Also, frames with less than 16 bytes are dropped. 4309 */ 4310 skb = ieee80211_rx_monitor(local, skb, rate); 4311 if (!skb) { 4312 rcu_read_unlock(); 4313 return; 4314 } 4315 4316 ieee80211_tpt_led_trig_rx(local, 4317 ((struct ieee80211_hdr *)skb->data)->frame_control, 4318 skb->len); 4319 4320 __ieee80211_rx_handle_packet(hw, pubsta, skb, napi); 4321 4322 rcu_read_unlock(); 4323 4324 return; 4325 drop: 4326 kfree_skb(skb); 4327 } 4328 EXPORT_SYMBOL(ieee80211_rx_napi); 4329 4330 /* This is a version of the rx handler that can be called from hard irq 4331 * context. Post the skb on the queue and schedule the tasklet */ 4332 void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb) 4333 { 4334 struct ieee80211_local *local = hw_to_local(hw); 4335 4336 BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb)); 4337 4338 skb->pkt_type = IEEE80211_RX_MSG; 4339 skb_queue_tail(&local->skb_queue, skb); 4340 tasklet_schedule(&local->tasklet); 4341 } 4342 EXPORT_SYMBOL(ieee80211_rx_irqsafe); 4343