1 /* 2 * Copyright 2002-2005, Instant802 Networks, Inc. 3 * Copyright 2005-2006, Devicescape Software, Inc. 4 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz> 5 * Copyright 2007-2010 Johannes Berg <johannes@sipsolutions.net> 6 * Copyright 2013-2014 Intel Mobile Communications GmbH 7 * Copyright(c) 2015 - 2017 Intel Deutschland GmbH 8 * 9 * This program is free software; you can redistribute it and/or modify 10 * it under the terms of the GNU General Public License version 2 as 11 * published by the Free Software Foundation. 12 */ 13 14 #include <linux/jiffies.h> 15 #include <linux/slab.h> 16 #include <linux/kernel.h> 17 #include <linux/skbuff.h> 18 #include <linux/netdevice.h> 19 #include <linux/etherdevice.h> 20 #include <linux/rcupdate.h> 21 #include <linux/export.h> 22 #include <linux/bitops.h> 23 #include <net/mac80211.h> 24 #include <net/ieee80211_radiotap.h> 25 #include <asm/unaligned.h> 26 27 #include "ieee80211_i.h" 28 #include "driver-ops.h" 29 #include "led.h" 30 #include "mesh.h" 31 #include "wep.h" 32 #include "wpa.h" 33 #include "tkip.h" 34 #include "wme.h" 35 #include "rate.h" 36 37 static inline void ieee80211_rx_stats(struct net_device *dev, u32 len) 38 { 39 struct pcpu_sw_netstats *tstats = this_cpu_ptr(dev->tstats); 40 41 u64_stats_update_begin(&tstats->syncp); 42 tstats->rx_packets++; 43 tstats->rx_bytes += len; 44 u64_stats_update_end(&tstats->syncp); 45 } 46 47 static u8 *ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len, 48 enum nl80211_iftype type) 49 { 50 __le16 fc = hdr->frame_control; 51 52 if (ieee80211_is_data(fc)) { 53 if (len < 24) /* drop incorrect hdr len (data) */ 54 return NULL; 55 56 if (ieee80211_has_a4(fc)) 57 return NULL; 58 if (ieee80211_has_tods(fc)) 59 return hdr->addr1; 60 if (ieee80211_has_fromds(fc)) 61 return hdr->addr2; 62 63 return hdr->addr3; 64 } 65 66 if (ieee80211_is_mgmt(fc)) { 67 if (len < 24) /* drop incorrect hdr len (mgmt) */ 68 return NULL; 69 return hdr->addr3; 70 } 71 72 if (ieee80211_is_ctl(fc)) { 73 if (ieee80211_is_pspoll(fc)) 74 return hdr->addr1; 75 76 if (ieee80211_is_back_req(fc)) { 77 switch (type) { 78 case NL80211_IFTYPE_STATION: 79 return hdr->addr2; 80 case NL80211_IFTYPE_AP: 81 case NL80211_IFTYPE_AP_VLAN: 82 return hdr->addr1; 83 default: 84 break; /* fall through to the return */ 85 } 86 } 87 } 88 89 return NULL; 90 } 91 92 /* 93 * monitor mode reception 94 * 95 * This function cleans up the SKB, i.e. it removes all the stuff 96 * only useful for monitoring. 97 */ 98 static void remove_monitor_info(struct sk_buff *skb, 99 unsigned int present_fcs_len, 100 unsigned int rtap_vendor_space) 101 { 102 if (present_fcs_len) 103 __pskb_trim(skb, skb->len - present_fcs_len); 104 __pskb_pull(skb, rtap_vendor_space); 105 } 106 107 static inline bool should_drop_frame(struct sk_buff *skb, int present_fcs_len, 108 unsigned int rtap_vendor_space) 109 { 110 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 111 struct ieee80211_hdr *hdr; 112 113 hdr = (void *)(skb->data + rtap_vendor_space); 114 115 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | 116 RX_FLAG_FAILED_PLCP_CRC | 117 RX_FLAG_ONLY_MONITOR)) 118 return true; 119 120 if (unlikely(skb->len < 16 + present_fcs_len + rtap_vendor_space)) 121 return true; 122 123 if (ieee80211_is_ctl(hdr->frame_control) && 124 !ieee80211_is_pspoll(hdr->frame_control) && 125 !ieee80211_is_back_req(hdr->frame_control)) 126 return true; 127 128 return false; 129 } 130 131 static int 132 ieee80211_rx_radiotap_hdrlen(struct ieee80211_local *local, 133 struct ieee80211_rx_status *status, 134 struct sk_buff *skb) 135 { 136 int len; 137 138 /* always present fields */ 139 len = sizeof(struct ieee80211_radiotap_header) + 8; 140 141 /* allocate extra bitmaps */ 142 if (status->chains) 143 len += 4 * hweight8(status->chains); 144 145 if (ieee80211_have_rx_timestamp(status)) { 146 len = ALIGN(len, 8); 147 len += 8; 148 } 149 if (ieee80211_hw_check(&local->hw, SIGNAL_DBM)) 150 len += 1; 151 152 /* antenna field, if we don't have per-chain info */ 153 if (!status->chains) 154 len += 1; 155 156 /* padding for RX_FLAGS if necessary */ 157 len = ALIGN(len, 2); 158 159 if (status->encoding == RX_ENC_HT) /* HT info */ 160 len += 3; 161 162 if (status->flag & RX_FLAG_AMPDU_DETAILS) { 163 len = ALIGN(len, 4); 164 len += 8; 165 } 166 167 if (status->encoding == RX_ENC_VHT) { 168 len = ALIGN(len, 2); 169 len += 12; 170 } 171 172 if (local->hw.radiotap_timestamp.units_pos >= 0) { 173 len = ALIGN(len, 8); 174 len += 12; 175 } 176 177 if (status->chains) { 178 /* antenna and antenna signal fields */ 179 len += 2 * hweight8(status->chains); 180 } 181 182 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) { 183 struct ieee80211_vendor_radiotap *rtap = (void *)skb->data; 184 185 /* vendor presence bitmap */ 186 len += 4; 187 /* alignment for fixed 6-byte vendor data header */ 188 len = ALIGN(len, 2); 189 /* vendor data header */ 190 len += 6; 191 if (WARN_ON(rtap->align == 0)) 192 rtap->align = 1; 193 len = ALIGN(len, rtap->align); 194 len += rtap->len + rtap->pad; 195 } 196 197 return len; 198 } 199 200 static void ieee80211_handle_mu_mimo_mon(struct ieee80211_sub_if_data *sdata, 201 struct sk_buff *skb, 202 int rtap_vendor_space) 203 { 204 struct { 205 struct ieee80211_hdr_3addr hdr; 206 u8 category; 207 u8 action_code; 208 } __packed action; 209 210 if (!sdata) 211 return; 212 213 BUILD_BUG_ON(sizeof(action) != IEEE80211_MIN_ACTION_SIZE + 1); 214 215 if (skb->len < rtap_vendor_space + sizeof(action) + 216 VHT_MUMIMO_GROUPS_DATA_LEN) 217 return; 218 219 if (!is_valid_ether_addr(sdata->u.mntr.mu_follow_addr)) 220 return; 221 222 skb_copy_bits(skb, rtap_vendor_space, &action, sizeof(action)); 223 224 if (!ieee80211_is_action(action.hdr.frame_control)) 225 return; 226 227 if (action.category != WLAN_CATEGORY_VHT) 228 return; 229 230 if (action.action_code != WLAN_VHT_ACTION_GROUPID_MGMT) 231 return; 232 233 if (!ether_addr_equal(action.hdr.addr1, sdata->u.mntr.mu_follow_addr)) 234 return; 235 236 skb = skb_copy(skb, GFP_ATOMIC); 237 if (!skb) 238 return; 239 240 skb_queue_tail(&sdata->skb_queue, skb); 241 ieee80211_queue_work(&sdata->local->hw, &sdata->work); 242 } 243 244 /* 245 * ieee80211_add_rx_radiotap_header - add radiotap header 246 * 247 * add a radiotap header containing all the fields which the hardware provided. 248 */ 249 static void 250 ieee80211_add_rx_radiotap_header(struct ieee80211_local *local, 251 struct sk_buff *skb, 252 struct ieee80211_rate *rate, 253 int rtap_len, bool has_fcs) 254 { 255 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 256 struct ieee80211_radiotap_header *rthdr; 257 unsigned char *pos; 258 __le32 *it_present; 259 u32 it_present_val; 260 u16 rx_flags = 0; 261 u16 channel_flags = 0; 262 int mpdulen, chain; 263 unsigned long chains = status->chains; 264 struct ieee80211_vendor_radiotap rtap = {}; 265 266 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) { 267 rtap = *(struct ieee80211_vendor_radiotap *)skb->data; 268 /* rtap.len and rtap.pad are undone immediately */ 269 skb_pull(skb, sizeof(rtap) + rtap.len + rtap.pad); 270 } 271 272 mpdulen = skb->len; 273 if (!(has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS))) 274 mpdulen += FCS_LEN; 275 276 rthdr = skb_push(skb, rtap_len); 277 memset(rthdr, 0, rtap_len - rtap.len - rtap.pad); 278 it_present = &rthdr->it_present; 279 280 /* radiotap header, set always present flags */ 281 rthdr->it_len = cpu_to_le16(rtap_len); 282 it_present_val = BIT(IEEE80211_RADIOTAP_FLAGS) | 283 BIT(IEEE80211_RADIOTAP_CHANNEL) | 284 BIT(IEEE80211_RADIOTAP_RX_FLAGS); 285 286 if (!status->chains) 287 it_present_val |= BIT(IEEE80211_RADIOTAP_ANTENNA); 288 289 for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) { 290 it_present_val |= 291 BIT(IEEE80211_RADIOTAP_EXT) | 292 BIT(IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE); 293 put_unaligned_le32(it_present_val, it_present); 294 it_present++; 295 it_present_val = BIT(IEEE80211_RADIOTAP_ANTENNA) | 296 BIT(IEEE80211_RADIOTAP_DBM_ANTSIGNAL); 297 } 298 299 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) { 300 it_present_val |= BIT(IEEE80211_RADIOTAP_VENDOR_NAMESPACE) | 301 BIT(IEEE80211_RADIOTAP_EXT); 302 put_unaligned_le32(it_present_val, it_present); 303 it_present++; 304 it_present_val = rtap.present; 305 } 306 307 put_unaligned_le32(it_present_val, it_present); 308 309 pos = (void *)(it_present + 1); 310 311 /* the order of the following fields is important */ 312 313 /* IEEE80211_RADIOTAP_TSFT */ 314 if (ieee80211_have_rx_timestamp(status)) { 315 /* padding */ 316 while ((pos - (u8 *)rthdr) & 7) 317 *pos++ = 0; 318 put_unaligned_le64( 319 ieee80211_calculate_rx_timestamp(local, status, 320 mpdulen, 0), 321 pos); 322 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT); 323 pos += 8; 324 } 325 326 /* IEEE80211_RADIOTAP_FLAGS */ 327 if (has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)) 328 *pos |= IEEE80211_RADIOTAP_F_FCS; 329 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC)) 330 *pos |= IEEE80211_RADIOTAP_F_BADFCS; 331 if (status->enc_flags & RX_ENC_FLAG_SHORTPRE) 332 *pos |= IEEE80211_RADIOTAP_F_SHORTPRE; 333 pos++; 334 335 /* IEEE80211_RADIOTAP_RATE */ 336 if (!rate || status->encoding != RX_ENC_LEGACY) { 337 /* 338 * Without rate information don't add it. If we have, 339 * MCS information is a separate field in radiotap, 340 * added below. The byte here is needed as padding 341 * for the channel though, so initialise it to 0. 342 */ 343 *pos = 0; 344 } else { 345 int shift = 0; 346 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE); 347 if (status->bw == RATE_INFO_BW_10) 348 shift = 1; 349 else if (status->bw == RATE_INFO_BW_5) 350 shift = 2; 351 *pos = DIV_ROUND_UP(rate->bitrate, 5 * (1 << shift)); 352 } 353 pos++; 354 355 /* IEEE80211_RADIOTAP_CHANNEL */ 356 put_unaligned_le16(status->freq, pos); 357 pos += 2; 358 if (status->bw == RATE_INFO_BW_10) 359 channel_flags |= IEEE80211_CHAN_HALF; 360 else if (status->bw == RATE_INFO_BW_5) 361 channel_flags |= IEEE80211_CHAN_QUARTER; 362 363 if (status->band == NL80211_BAND_5GHZ) 364 channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ; 365 else if (status->encoding != RX_ENC_LEGACY) 366 channel_flags |= IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ; 367 else if (rate && rate->flags & IEEE80211_RATE_ERP_G) 368 channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ; 369 else if (rate) 370 channel_flags |= IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ; 371 else 372 channel_flags |= IEEE80211_CHAN_2GHZ; 373 put_unaligned_le16(channel_flags, pos); 374 pos += 2; 375 376 /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */ 377 if (ieee80211_hw_check(&local->hw, SIGNAL_DBM) && 378 !(status->flag & RX_FLAG_NO_SIGNAL_VAL)) { 379 *pos = status->signal; 380 rthdr->it_present |= 381 cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL); 382 pos++; 383 } 384 385 /* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */ 386 387 if (!status->chains) { 388 /* IEEE80211_RADIOTAP_ANTENNA */ 389 *pos = status->antenna; 390 pos++; 391 } 392 393 /* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */ 394 395 /* IEEE80211_RADIOTAP_RX_FLAGS */ 396 /* ensure 2 byte alignment for the 2 byte field as required */ 397 if ((pos - (u8 *)rthdr) & 1) 398 *pos++ = 0; 399 if (status->flag & RX_FLAG_FAILED_PLCP_CRC) 400 rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP; 401 put_unaligned_le16(rx_flags, pos); 402 pos += 2; 403 404 if (status->encoding == RX_ENC_HT) { 405 unsigned int stbc; 406 407 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_MCS); 408 *pos++ = local->hw.radiotap_mcs_details; 409 *pos = 0; 410 if (status->enc_flags & RX_ENC_FLAG_SHORT_GI) 411 *pos |= IEEE80211_RADIOTAP_MCS_SGI; 412 if (status->bw == RATE_INFO_BW_40) 413 *pos |= IEEE80211_RADIOTAP_MCS_BW_40; 414 if (status->enc_flags & RX_ENC_FLAG_HT_GF) 415 *pos |= IEEE80211_RADIOTAP_MCS_FMT_GF; 416 if (status->enc_flags & RX_ENC_FLAG_LDPC) 417 *pos |= IEEE80211_RADIOTAP_MCS_FEC_LDPC; 418 stbc = (status->enc_flags & RX_ENC_FLAG_STBC_MASK) >> RX_ENC_FLAG_STBC_SHIFT; 419 *pos |= stbc << IEEE80211_RADIOTAP_MCS_STBC_SHIFT; 420 pos++; 421 *pos++ = status->rate_idx; 422 } 423 424 if (status->flag & RX_FLAG_AMPDU_DETAILS) { 425 u16 flags = 0; 426 427 /* ensure 4 byte alignment */ 428 while ((pos - (u8 *)rthdr) & 3) 429 pos++; 430 rthdr->it_present |= 431 cpu_to_le32(1 << IEEE80211_RADIOTAP_AMPDU_STATUS); 432 put_unaligned_le32(status->ampdu_reference, pos); 433 pos += 4; 434 if (status->flag & RX_FLAG_AMPDU_LAST_KNOWN) 435 flags |= IEEE80211_RADIOTAP_AMPDU_LAST_KNOWN; 436 if (status->flag & RX_FLAG_AMPDU_IS_LAST) 437 flags |= IEEE80211_RADIOTAP_AMPDU_IS_LAST; 438 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_ERROR) 439 flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_ERR; 440 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN) 441 flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_KNOWN; 442 if (status->flag & RX_FLAG_AMPDU_EOF_BIT_KNOWN) 443 flags |= IEEE80211_RADIOTAP_AMPDU_EOF_KNOWN; 444 if (status->flag & RX_FLAG_AMPDU_EOF_BIT) 445 flags |= IEEE80211_RADIOTAP_AMPDU_EOF; 446 put_unaligned_le16(flags, pos); 447 pos += 2; 448 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN) 449 *pos++ = status->ampdu_delimiter_crc; 450 else 451 *pos++ = 0; 452 *pos++ = 0; 453 } 454 455 if (status->encoding == RX_ENC_VHT) { 456 u16 known = local->hw.radiotap_vht_details; 457 458 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_VHT); 459 put_unaligned_le16(known, pos); 460 pos += 2; 461 /* flags */ 462 if (status->enc_flags & RX_ENC_FLAG_SHORT_GI) 463 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_SGI; 464 /* in VHT, STBC is binary */ 465 if (status->enc_flags & RX_ENC_FLAG_STBC_MASK) 466 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_STBC; 467 if (status->enc_flags & RX_ENC_FLAG_BF) 468 *pos |= IEEE80211_RADIOTAP_VHT_FLAG_BEAMFORMED; 469 pos++; 470 /* bandwidth */ 471 switch (status->bw) { 472 case RATE_INFO_BW_80: 473 *pos++ = 4; 474 break; 475 case RATE_INFO_BW_160: 476 *pos++ = 11; 477 break; 478 case RATE_INFO_BW_40: 479 *pos++ = 1; 480 break; 481 default: 482 *pos++ = 0; 483 } 484 /* MCS/NSS */ 485 *pos = (status->rate_idx << 4) | status->nss; 486 pos += 4; 487 /* coding field */ 488 if (status->enc_flags & RX_ENC_FLAG_LDPC) 489 *pos |= IEEE80211_RADIOTAP_CODING_LDPC_USER0; 490 pos++; 491 /* group ID */ 492 pos++; 493 /* partial_aid */ 494 pos += 2; 495 } 496 497 if (local->hw.radiotap_timestamp.units_pos >= 0) { 498 u16 accuracy = 0; 499 u8 flags = IEEE80211_RADIOTAP_TIMESTAMP_FLAG_32BIT; 500 501 rthdr->it_present |= 502 cpu_to_le32(1 << IEEE80211_RADIOTAP_TIMESTAMP); 503 504 /* ensure 8 byte alignment */ 505 while ((pos - (u8 *)rthdr) & 7) 506 pos++; 507 508 put_unaligned_le64(status->device_timestamp, pos); 509 pos += sizeof(u64); 510 511 if (local->hw.radiotap_timestamp.accuracy >= 0) { 512 accuracy = local->hw.radiotap_timestamp.accuracy; 513 flags |= IEEE80211_RADIOTAP_TIMESTAMP_FLAG_ACCURACY; 514 } 515 put_unaligned_le16(accuracy, pos); 516 pos += sizeof(u16); 517 518 *pos++ = local->hw.radiotap_timestamp.units_pos; 519 *pos++ = flags; 520 } 521 522 for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) { 523 *pos++ = status->chain_signal[chain]; 524 *pos++ = chain; 525 } 526 527 if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) { 528 /* ensure 2 byte alignment for the vendor field as required */ 529 if ((pos - (u8 *)rthdr) & 1) 530 *pos++ = 0; 531 *pos++ = rtap.oui[0]; 532 *pos++ = rtap.oui[1]; 533 *pos++ = rtap.oui[2]; 534 *pos++ = rtap.subns; 535 put_unaligned_le16(rtap.len, pos); 536 pos += 2; 537 /* align the actual payload as requested */ 538 while ((pos - (u8 *)rthdr) & (rtap.align - 1)) 539 *pos++ = 0; 540 /* data (and possible padding) already follows */ 541 } 542 } 543 544 static struct sk_buff * 545 ieee80211_make_monitor_skb(struct ieee80211_local *local, 546 struct sk_buff **origskb, 547 struct ieee80211_rate *rate, 548 int rtap_vendor_space, bool use_origskb) 549 { 550 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(*origskb); 551 int rt_hdrlen, needed_headroom; 552 struct sk_buff *skb; 553 554 /* room for the radiotap header based on driver features */ 555 rt_hdrlen = ieee80211_rx_radiotap_hdrlen(local, status, *origskb); 556 needed_headroom = rt_hdrlen - rtap_vendor_space; 557 558 if (use_origskb) { 559 /* only need to expand headroom if necessary */ 560 skb = *origskb; 561 *origskb = NULL; 562 563 /* 564 * This shouldn't trigger often because most devices have an 565 * RX header they pull before we get here, and that should 566 * be big enough for our radiotap information. We should 567 * probably export the length to drivers so that we can have 568 * them allocate enough headroom to start with. 569 */ 570 if (skb_headroom(skb) < needed_headroom && 571 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) { 572 dev_kfree_skb(skb); 573 return NULL; 574 } 575 } else { 576 /* 577 * Need to make a copy and possibly remove radiotap header 578 * and FCS from the original. 579 */ 580 skb = skb_copy_expand(*origskb, needed_headroom, 0, GFP_ATOMIC); 581 582 if (!skb) 583 return NULL; 584 } 585 586 /* prepend radiotap information */ 587 ieee80211_add_rx_radiotap_header(local, skb, rate, rt_hdrlen, true); 588 589 skb_reset_mac_header(skb); 590 skb->ip_summed = CHECKSUM_UNNECESSARY; 591 skb->pkt_type = PACKET_OTHERHOST; 592 skb->protocol = htons(ETH_P_802_2); 593 594 return skb; 595 } 596 597 /* 598 * This function copies a received frame to all monitor interfaces and 599 * returns a cleaned-up SKB that no longer includes the FCS nor the 600 * radiotap header the driver might have added. 601 */ 602 static struct sk_buff * 603 ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb, 604 struct ieee80211_rate *rate) 605 { 606 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb); 607 struct ieee80211_sub_if_data *sdata; 608 struct sk_buff *monskb = NULL; 609 int present_fcs_len = 0; 610 unsigned int rtap_vendor_space = 0; 611 struct ieee80211_sub_if_data *monitor_sdata = 612 rcu_dereference(local->monitor_sdata); 613 bool only_monitor = false; 614 615 if (unlikely(status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA)) { 616 struct ieee80211_vendor_radiotap *rtap = (void *)origskb->data; 617 618 rtap_vendor_space = sizeof(*rtap) + rtap->len + rtap->pad; 619 } 620 621 /* 622 * First, we may need to make a copy of the skb because 623 * (1) we need to modify it for radiotap (if not present), and 624 * (2) the other RX handlers will modify the skb we got. 625 * 626 * We don't need to, of course, if we aren't going to return 627 * the SKB because it has a bad FCS/PLCP checksum. 628 */ 629 630 if (ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)) { 631 if (unlikely(origskb->len <= FCS_LEN)) { 632 /* driver bug */ 633 WARN_ON(1); 634 dev_kfree_skb(origskb); 635 return NULL; 636 } 637 present_fcs_len = FCS_LEN; 638 } 639 640 /* ensure hdr->frame_control and vendor radiotap data are in skb head */ 641 if (!pskb_may_pull(origskb, 2 + rtap_vendor_space)) { 642 dev_kfree_skb(origskb); 643 return NULL; 644 } 645 646 only_monitor = should_drop_frame(origskb, present_fcs_len, 647 rtap_vendor_space); 648 649 if (!local->monitors || (status->flag & RX_FLAG_SKIP_MONITOR)) { 650 if (only_monitor) { 651 dev_kfree_skb(origskb); 652 return NULL; 653 } 654 655 remove_monitor_info(origskb, present_fcs_len, 656 rtap_vendor_space); 657 return origskb; 658 } 659 660 ieee80211_handle_mu_mimo_mon(monitor_sdata, origskb, rtap_vendor_space); 661 662 list_for_each_entry_rcu(sdata, &local->mon_list, u.mntr.list) { 663 bool last_monitor = list_is_last(&sdata->u.mntr.list, 664 &local->mon_list); 665 666 if (!monskb) 667 monskb = ieee80211_make_monitor_skb(local, &origskb, 668 rate, 669 rtap_vendor_space, 670 only_monitor && 671 last_monitor); 672 673 if (monskb) { 674 struct sk_buff *skb; 675 676 if (last_monitor) { 677 skb = monskb; 678 monskb = NULL; 679 } else { 680 skb = skb_clone(monskb, GFP_ATOMIC); 681 } 682 683 if (skb) { 684 skb->dev = sdata->dev; 685 ieee80211_rx_stats(skb->dev, skb->len); 686 netif_receive_skb(skb); 687 } 688 } 689 690 if (last_monitor) 691 break; 692 } 693 694 /* this happens if last_monitor was erroneously false */ 695 dev_kfree_skb(monskb); 696 697 /* ditto */ 698 if (!origskb) 699 return NULL; 700 701 remove_monitor_info(origskb, present_fcs_len, rtap_vendor_space); 702 return origskb; 703 } 704 705 static void ieee80211_parse_qos(struct ieee80211_rx_data *rx) 706 { 707 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 708 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 709 int tid, seqno_idx, security_idx; 710 711 /* does the frame have a qos control field? */ 712 if (ieee80211_is_data_qos(hdr->frame_control)) { 713 u8 *qc = ieee80211_get_qos_ctl(hdr); 714 /* frame has qos control */ 715 tid = *qc & IEEE80211_QOS_CTL_TID_MASK; 716 if (*qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT) 717 status->rx_flags |= IEEE80211_RX_AMSDU; 718 719 seqno_idx = tid; 720 security_idx = tid; 721 } else { 722 /* 723 * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"): 724 * 725 * Sequence numbers for management frames, QoS data 726 * frames with a broadcast/multicast address in the 727 * Address 1 field, and all non-QoS data frames sent 728 * by QoS STAs are assigned using an additional single 729 * modulo-4096 counter, [...] 730 * 731 * We also use that counter for non-QoS STAs. 732 */ 733 seqno_idx = IEEE80211_NUM_TIDS; 734 security_idx = 0; 735 if (ieee80211_is_mgmt(hdr->frame_control)) 736 security_idx = IEEE80211_NUM_TIDS; 737 tid = 0; 738 } 739 740 rx->seqno_idx = seqno_idx; 741 rx->security_idx = security_idx; 742 /* Set skb->priority to 1d tag if highest order bit of TID is not set. 743 * For now, set skb->priority to 0 for other cases. */ 744 rx->skb->priority = (tid > 7) ? 0 : tid; 745 } 746 747 /** 748 * DOC: Packet alignment 749 * 750 * Drivers always need to pass packets that are aligned to two-byte boundaries 751 * to the stack. 752 * 753 * Additionally, should, if possible, align the payload data in a way that 754 * guarantees that the contained IP header is aligned to a four-byte 755 * boundary. In the case of regular frames, this simply means aligning the 756 * payload to a four-byte boundary (because either the IP header is directly 757 * contained, or IV/RFC1042 headers that have a length divisible by four are 758 * in front of it). If the payload data is not properly aligned and the 759 * architecture doesn't support efficient unaligned operations, mac80211 760 * will align the data. 761 * 762 * With A-MSDU frames, however, the payload data address must yield two modulo 763 * four because there are 14-byte 802.3 headers within the A-MSDU frames that 764 * push the IP header further back to a multiple of four again. Thankfully, the 765 * specs were sane enough this time around to require padding each A-MSDU 766 * subframe to a length that is a multiple of four. 767 * 768 * Padding like Atheros hardware adds which is between the 802.11 header and 769 * the payload is not supported, the driver is required to move the 802.11 770 * header to be directly in front of the payload in that case. 771 */ 772 static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx) 773 { 774 #ifdef CONFIG_MAC80211_VERBOSE_DEBUG 775 WARN_ON_ONCE((unsigned long)rx->skb->data & 1); 776 #endif 777 } 778 779 780 /* rx handlers */ 781 782 static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb) 783 { 784 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 785 786 if (is_multicast_ether_addr(hdr->addr1)) 787 return 0; 788 789 return ieee80211_is_robust_mgmt_frame(skb); 790 } 791 792 793 static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb) 794 { 795 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 796 797 if (!is_multicast_ether_addr(hdr->addr1)) 798 return 0; 799 800 return ieee80211_is_robust_mgmt_frame(skb); 801 } 802 803 804 /* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */ 805 static int ieee80211_get_mmie_keyidx(struct sk_buff *skb) 806 { 807 struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data; 808 struct ieee80211_mmie *mmie; 809 struct ieee80211_mmie_16 *mmie16; 810 811 if (skb->len < 24 + sizeof(*mmie) || !is_multicast_ether_addr(hdr->da)) 812 return -1; 813 814 if (!ieee80211_is_robust_mgmt_frame(skb)) 815 return -1; /* not a robust management frame */ 816 817 mmie = (struct ieee80211_mmie *) 818 (skb->data + skb->len - sizeof(*mmie)); 819 if (mmie->element_id == WLAN_EID_MMIE && 820 mmie->length == sizeof(*mmie) - 2) 821 return le16_to_cpu(mmie->key_id); 822 823 mmie16 = (struct ieee80211_mmie_16 *) 824 (skb->data + skb->len - sizeof(*mmie16)); 825 if (skb->len >= 24 + sizeof(*mmie16) && 826 mmie16->element_id == WLAN_EID_MMIE && 827 mmie16->length == sizeof(*mmie16) - 2) 828 return le16_to_cpu(mmie16->key_id); 829 830 return -1; 831 } 832 833 static int ieee80211_get_cs_keyid(const struct ieee80211_cipher_scheme *cs, 834 struct sk_buff *skb) 835 { 836 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; 837 __le16 fc; 838 int hdrlen; 839 u8 keyid; 840 841 fc = hdr->frame_control; 842 hdrlen = ieee80211_hdrlen(fc); 843 844 if (skb->len < hdrlen + cs->hdr_len) 845 return -EINVAL; 846 847 skb_copy_bits(skb, hdrlen + cs->key_idx_off, &keyid, 1); 848 keyid &= cs->key_idx_mask; 849 keyid >>= cs->key_idx_shift; 850 851 return keyid; 852 } 853 854 static ieee80211_rx_result ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx) 855 { 856 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 857 char *dev_addr = rx->sdata->vif.addr; 858 859 if (ieee80211_is_data(hdr->frame_control)) { 860 if (is_multicast_ether_addr(hdr->addr1)) { 861 if (ieee80211_has_tods(hdr->frame_control) || 862 !ieee80211_has_fromds(hdr->frame_control)) 863 return RX_DROP_MONITOR; 864 if (ether_addr_equal(hdr->addr3, dev_addr)) 865 return RX_DROP_MONITOR; 866 } else { 867 if (!ieee80211_has_a4(hdr->frame_control)) 868 return RX_DROP_MONITOR; 869 if (ether_addr_equal(hdr->addr4, dev_addr)) 870 return RX_DROP_MONITOR; 871 } 872 } 873 874 /* If there is not an established peer link and this is not a peer link 875 * establisment frame, beacon or probe, drop the frame. 876 */ 877 878 if (!rx->sta || sta_plink_state(rx->sta) != NL80211_PLINK_ESTAB) { 879 struct ieee80211_mgmt *mgmt; 880 881 if (!ieee80211_is_mgmt(hdr->frame_control)) 882 return RX_DROP_MONITOR; 883 884 if (ieee80211_is_action(hdr->frame_control)) { 885 u8 category; 886 887 /* make sure category field is present */ 888 if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE) 889 return RX_DROP_MONITOR; 890 891 mgmt = (struct ieee80211_mgmt *)hdr; 892 category = mgmt->u.action.category; 893 if (category != WLAN_CATEGORY_MESH_ACTION && 894 category != WLAN_CATEGORY_SELF_PROTECTED) 895 return RX_DROP_MONITOR; 896 return RX_CONTINUE; 897 } 898 899 if (ieee80211_is_probe_req(hdr->frame_control) || 900 ieee80211_is_probe_resp(hdr->frame_control) || 901 ieee80211_is_beacon(hdr->frame_control) || 902 ieee80211_is_auth(hdr->frame_control)) 903 return RX_CONTINUE; 904 905 return RX_DROP_MONITOR; 906 } 907 908 return RX_CONTINUE; 909 } 910 911 static inline bool ieee80211_rx_reorder_ready(struct tid_ampdu_rx *tid_agg_rx, 912 int index) 913 { 914 struct sk_buff_head *frames = &tid_agg_rx->reorder_buf[index]; 915 struct sk_buff *tail = skb_peek_tail(frames); 916 struct ieee80211_rx_status *status; 917 918 if (tid_agg_rx->reorder_buf_filtered & BIT_ULL(index)) 919 return true; 920 921 if (!tail) 922 return false; 923 924 status = IEEE80211_SKB_RXCB(tail); 925 if (status->flag & RX_FLAG_AMSDU_MORE) 926 return false; 927 928 return true; 929 } 930 931 static void ieee80211_release_reorder_frame(struct ieee80211_sub_if_data *sdata, 932 struct tid_ampdu_rx *tid_agg_rx, 933 int index, 934 struct sk_buff_head *frames) 935 { 936 struct sk_buff_head *skb_list = &tid_agg_rx->reorder_buf[index]; 937 struct sk_buff *skb; 938 struct ieee80211_rx_status *status; 939 940 lockdep_assert_held(&tid_agg_rx->reorder_lock); 941 942 if (skb_queue_empty(skb_list)) 943 goto no_frame; 944 945 if (!ieee80211_rx_reorder_ready(tid_agg_rx, index)) { 946 __skb_queue_purge(skb_list); 947 goto no_frame; 948 } 949 950 /* release frames from the reorder ring buffer */ 951 tid_agg_rx->stored_mpdu_num--; 952 while ((skb = __skb_dequeue(skb_list))) { 953 status = IEEE80211_SKB_RXCB(skb); 954 status->rx_flags |= IEEE80211_RX_DEFERRED_RELEASE; 955 __skb_queue_tail(frames, skb); 956 } 957 958 no_frame: 959 tid_agg_rx->reorder_buf_filtered &= ~BIT_ULL(index); 960 tid_agg_rx->head_seq_num = ieee80211_sn_inc(tid_agg_rx->head_seq_num); 961 } 962 963 static void ieee80211_release_reorder_frames(struct ieee80211_sub_if_data *sdata, 964 struct tid_ampdu_rx *tid_agg_rx, 965 u16 head_seq_num, 966 struct sk_buff_head *frames) 967 { 968 int index; 969 970 lockdep_assert_held(&tid_agg_rx->reorder_lock); 971 972 while (ieee80211_sn_less(tid_agg_rx->head_seq_num, head_seq_num)) { 973 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size; 974 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index, 975 frames); 976 } 977 } 978 979 /* 980 * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If 981 * the skb was added to the buffer longer than this time ago, the earlier 982 * frames that have not yet been received are assumed to be lost and the skb 983 * can be released for processing. This may also release other skb's from the 984 * reorder buffer if there are no additional gaps between the frames. 985 * 986 * Callers must hold tid_agg_rx->reorder_lock. 987 */ 988 #define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10) 989 990 static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata, 991 struct tid_ampdu_rx *tid_agg_rx, 992 struct sk_buff_head *frames) 993 { 994 int index, i, j; 995 996 lockdep_assert_held(&tid_agg_rx->reorder_lock); 997 998 /* release the buffer until next missing frame */ 999 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size; 1000 if (!ieee80211_rx_reorder_ready(tid_agg_rx, index) && 1001 tid_agg_rx->stored_mpdu_num) { 1002 /* 1003 * No buffers ready to be released, but check whether any 1004 * frames in the reorder buffer have timed out. 1005 */ 1006 int skipped = 1; 1007 for (j = (index + 1) % tid_agg_rx->buf_size; j != index; 1008 j = (j + 1) % tid_agg_rx->buf_size) { 1009 if (!ieee80211_rx_reorder_ready(tid_agg_rx, j)) { 1010 skipped++; 1011 continue; 1012 } 1013 if (skipped && 1014 !time_after(jiffies, tid_agg_rx->reorder_time[j] + 1015 HT_RX_REORDER_BUF_TIMEOUT)) 1016 goto set_release_timer; 1017 1018 /* don't leave incomplete A-MSDUs around */ 1019 for (i = (index + 1) % tid_agg_rx->buf_size; i != j; 1020 i = (i + 1) % tid_agg_rx->buf_size) 1021 __skb_queue_purge(&tid_agg_rx->reorder_buf[i]); 1022 1023 ht_dbg_ratelimited(sdata, 1024 "release an RX reorder frame due to timeout on earlier frames\n"); 1025 ieee80211_release_reorder_frame(sdata, tid_agg_rx, j, 1026 frames); 1027 1028 /* 1029 * Increment the head seq# also for the skipped slots. 1030 */ 1031 tid_agg_rx->head_seq_num = 1032 (tid_agg_rx->head_seq_num + 1033 skipped) & IEEE80211_SN_MASK; 1034 skipped = 0; 1035 } 1036 } else while (ieee80211_rx_reorder_ready(tid_agg_rx, index)) { 1037 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index, 1038 frames); 1039 index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size; 1040 } 1041 1042 if (tid_agg_rx->stored_mpdu_num) { 1043 j = index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size; 1044 1045 for (; j != (index - 1) % tid_agg_rx->buf_size; 1046 j = (j + 1) % tid_agg_rx->buf_size) { 1047 if (ieee80211_rx_reorder_ready(tid_agg_rx, j)) 1048 break; 1049 } 1050 1051 set_release_timer: 1052 1053 if (!tid_agg_rx->removed) 1054 mod_timer(&tid_agg_rx->reorder_timer, 1055 tid_agg_rx->reorder_time[j] + 1 + 1056 HT_RX_REORDER_BUF_TIMEOUT); 1057 } else { 1058 del_timer(&tid_agg_rx->reorder_timer); 1059 } 1060 } 1061 1062 /* 1063 * As this function belongs to the RX path it must be under 1064 * rcu_read_lock protection. It returns false if the frame 1065 * can be processed immediately, true if it was consumed. 1066 */ 1067 static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata, 1068 struct tid_ampdu_rx *tid_agg_rx, 1069 struct sk_buff *skb, 1070 struct sk_buff_head *frames) 1071 { 1072 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 1073 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 1074 u16 sc = le16_to_cpu(hdr->seq_ctrl); 1075 u16 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4; 1076 u16 head_seq_num, buf_size; 1077 int index; 1078 bool ret = true; 1079 1080 spin_lock(&tid_agg_rx->reorder_lock); 1081 1082 /* 1083 * Offloaded BA sessions have no known starting sequence number so pick 1084 * one from first Rxed frame for this tid after BA was started. 1085 */ 1086 if (unlikely(tid_agg_rx->auto_seq)) { 1087 tid_agg_rx->auto_seq = false; 1088 tid_agg_rx->ssn = mpdu_seq_num; 1089 tid_agg_rx->head_seq_num = mpdu_seq_num; 1090 } 1091 1092 buf_size = tid_agg_rx->buf_size; 1093 head_seq_num = tid_agg_rx->head_seq_num; 1094 1095 /* 1096 * If the current MPDU's SN is smaller than the SSN, it shouldn't 1097 * be reordered. 1098 */ 1099 if (unlikely(!tid_agg_rx->started)) { 1100 if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) { 1101 ret = false; 1102 goto out; 1103 } 1104 tid_agg_rx->started = true; 1105 } 1106 1107 /* frame with out of date sequence number */ 1108 if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) { 1109 dev_kfree_skb(skb); 1110 goto out; 1111 } 1112 1113 /* 1114 * If frame the sequence number exceeds our buffering window 1115 * size release some previous frames to make room for this one. 1116 */ 1117 if (!ieee80211_sn_less(mpdu_seq_num, head_seq_num + buf_size)) { 1118 head_seq_num = ieee80211_sn_inc( 1119 ieee80211_sn_sub(mpdu_seq_num, buf_size)); 1120 /* release stored frames up to new head to stack */ 1121 ieee80211_release_reorder_frames(sdata, tid_agg_rx, 1122 head_seq_num, frames); 1123 } 1124 1125 /* Now the new frame is always in the range of the reordering buffer */ 1126 1127 index = mpdu_seq_num % tid_agg_rx->buf_size; 1128 1129 /* check if we already stored this frame */ 1130 if (ieee80211_rx_reorder_ready(tid_agg_rx, index)) { 1131 dev_kfree_skb(skb); 1132 goto out; 1133 } 1134 1135 /* 1136 * If the current MPDU is in the right order and nothing else 1137 * is stored we can process it directly, no need to buffer it. 1138 * If it is first but there's something stored, we may be able 1139 * to release frames after this one. 1140 */ 1141 if (mpdu_seq_num == tid_agg_rx->head_seq_num && 1142 tid_agg_rx->stored_mpdu_num == 0) { 1143 if (!(status->flag & RX_FLAG_AMSDU_MORE)) 1144 tid_agg_rx->head_seq_num = 1145 ieee80211_sn_inc(tid_agg_rx->head_seq_num); 1146 ret = false; 1147 goto out; 1148 } 1149 1150 /* put the frame in the reordering buffer */ 1151 __skb_queue_tail(&tid_agg_rx->reorder_buf[index], skb); 1152 if (!(status->flag & RX_FLAG_AMSDU_MORE)) { 1153 tid_agg_rx->reorder_time[index] = jiffies; 1154 tid_agg_rx->stored_mpdu_num++; 1155 ieee80211_sta_reorder_release(sdata, tid_agg_rx, frames); 1156 } 1157 1158 out: 1159 spin_unlock(&tid_agg_rx->reorder_lock); 1160 return ret; 1161 } 1162 1163 /* 1164 * Reorder MPDUs from A-MPDUs, keeping them on a buffer. Returns 1165 * true if the MPDU was buffered, false if it should be processed. 1166 */ 1167 static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx, 1168 struct sk_buff_head *frames) 1169 { 1170 struct sk_buff *skb = rx->skb; 1171 struct ieee80211_local *local = rx->local; 1172 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; 1173 struct sta_info *sta = rx->sta; 1174 struct tid_ampdu_rx *tid_agg_rx; 1175 u16 sc; 1176 u8 tid, ack_policy; 1177 1178 if (!ieee80211_is_data_qos(hdr->frame_control) || 1179 is_multicast_ether_addr(hdr->addr1)) 1180 goto dont_reorder; 1181 1182 /* 1183 * filter the QoS data rx stream according to 1184 * STA/TID and check if this STA/TID is on aggregation 1185 */ 1186 1187 if (!sta) 1188 goto dont_reorder; 1189 1190 ack_policy = *ieee80211_get_qos_ctl(hdr) & 1191 IEEE80211_QOS_CTL_ACK_POLICY_MASK; 1192 tid = ieee80211_get_tid(hdr); 1193 1194 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]); 1195 if (!tid_agg_rx) { 1196 if (ack_policy == IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK && 1197 !test_bit(tid, rx->sta->ampdu_mlme.agg_session_valid) && 1198 !test_and_set_bit(tid, rx->sta->ampdu_mlme.unexpected_agg)) 1199 ieee80211_send_delba(rx->sdata, rx->sta->sta.addr, tid, 1200 WLAN_BACK_RECIPIENT, 1201 WLAN_REASON_QSTA_REQUIRE_SETUP); 1202 goto dont_reorder; 1203 } 1204 1205 /* qos null data frames are excluded */ 1206 if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC))) 1207 goto dont_reorder; 1208 1209 /* not part of a BA session */ 1210 if (ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK && 1211 ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_NORMAL) 1212 goto dont_reorder; 1213 1214 /* new, potentially un-ordered, ampdu frame - process it */ 1215 1216 /* reset session timer */ 1217 if (tid_agg_rx->timeout) 1218 tid_agg_rx->last_rx = jiffies; 1219 1220 /* if this mpdu is fragmented - terminate rx aggregation session */ 1221 sc = le16_to_cpu(hdr->seq_ctrl); 1222 if (sc & IEEE80211_SCTL_FRAG) { 1223 skb_queue_tail(&rx->sdata->skb_queue, skb); 1224 ieee80211_queue_work(&local->hw, &rx->sdata->work); 1225 return; 1226 } 1227 1228 /* 1229 * No locking needed -- we will only ever process one 1230 * RX packet at a time, and thus own tid_agg_rx. All 1231 * other code manipulating it needs to (and does) make 1232 * sure that we cannot get to it any more before doing 1233 * anything with it. 1234 */ 1235 if (ieee80211_sta_manage_reorder_buf(rx->sdata, tid_agg_rx, skb, 1236 frames)) 1237 return; 1238 1239 dont_reorder: 1240 __skb_queue_tail(frames, skb); 1241 } 1242 1243 static ieee80211_rx_result debug_noinline 1244 ieee80211_rx_h_check_dup(struct ieee80211_rx_data *rx) 1245 { 1246 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 1247 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 1248 1249 if (status->flag & RX_FLAG_DUP_VALIDATED) 1250 return RX_CONTINUE; 1251 1252 /* 1253 * Drop duplicate 802.11 retransmissions 1254 * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery") 1255 */ 1256 1257 if (rx->skb->len < 24) 1258 return RX_CONTINUE; 1259 1260 if (ieee80211_is_ctl(hdr->frame_control) || 1261 ieee80211_is_qos_nullfunc(hdr->frame_control) || 1262 is_multicast_ether_addr(hdr->addr1)) 1263 return RX_CONTINUE; 1264 1265 if (!rx->sta) 1266 return RX_CONTINUE; 1267 1268 if (unlikely(ieee80211_has_retry(hdr->frame_control) && 1269 rx->sta->last_seq_ctrl[rx->seqno_idx] == hdr->seq_ctrl)) { 1270 I802_DEBUG_INC(rx->local->dot11FrameDuplicateCount); 1271 rx->sta->rx_stats.num_duplicates++; 1272 return RX_DROP_UNUSABLE; 1273 } else if (!(status->flag & RX_FLAG_AMSDU_MORE)) { 1274 rx->sta->last_seq_ctrl[rx->seqno_idx] = hdr->seq_ctrl; 1275 } 1276 1277 return RX_CONTINUE; 1278 } 1279 1280 static ieee80211_rx_result debug_noinline 1281 ieee80211_rx_h_check(struct ieee80211_rx_data *rx) 1282 { 1283 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 1284 1285 /* Drop disallowed frame classes based on STA auth/assoc state; 1286 * IEEE 802.11, Chap 5.5. 1287 * 1288 * mac80211 filters only based on association state, i.e. it drops 1289 * Class 3 frames from not associated stations. hostapd sends 1290 * deauth/disassoc frames when needed. In addition, hostapd is 1291 * responsible for filtering on both auth and assoc states. 1292 */ 1293 1294 if (ieee80211_vif_is_mesh(&rx->sdata->vif)) 1295 return ieee80211_rx_mesh_check(rx); 1296 1297 if (unlikely((ieee80211_is_data(hdr->frame_control) || 1298 ieee80211_is_pspoll(hdr->frame_control)) && 1299 rx->sdata->vif.type != NL80211_IFTYPE_ADHOC && 1300 rx->sdata->vif.type != NL80211_IFTYPE_WDS && 1301 rx->sdata->vif.type != NL80211_IFTYPE_OCB && 1302 (!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_ASSOC)))) { 1303 /* 1304 * accept port control frames from the AP even when it's not 1305 * yet marked ASSOC to prevent a race where we don't set the 1306 * assoc bit quickly enough before it sends the first frame 1307 */ 1308 if (rx->sta && rx->sdata->vif.type == NL80211_IFTYPE_STATION && 1309 ieee80211_is_data_present(hdr->frame_control)) { 1310 unsigned int hdrlen; 1311 __be16 ethertype; 1312 1313 hdrlen = ieee80211_hdrlen(hdr->frame_control); 1314 1315 if (rx->skb->len < hdrlen + 8) 1316 return RX_DROP_MONITOR; 1317 1318 skb_copy_bits(rx->skb, hdrlen + 6, ðertype, 2); 1319 if (ethertype == rx->sdata->control_port_protocol) 1320 return RX_CONTINUE; 1321 } 1322 1323 if (rx->sdata->vif.type == NL80211_IFTYPE_AP && 1324 cfg80211_rx_spurious_frame(rx->sdata->dev, 1325 hdr->addr2, 1326 GFP_ATOMIC)) 1327 return RX_DROP_UNUSABLE; 1328 1329 return RX_DROP_MONITOR; 1330 } 1331 1332 return RX_CONTINUE; 1333 } 1334 1335 1336 static ieee80211_rx_result debug_noinline 1337 ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx) 1338 { 1339 struct ieee80211_local *local; 1340 struct ieee80211_hdr *hdr; 1341 struct sk_buff *skb; 1342 1343 local = rx->local; 1344 skb = rx->skb; 1345 hdr = (struct ieee80211_hdr *) skb->data; 1346 1347 if (!local->pspolling) 1348 return RX_CONTINUE; 1349 1350 if (!ieee80211_has_fromds(hdr->frame_control)) 1351 /* this is not from AP */ 1352 return RX_CONTINUE; 1353 1354 if (!ieee80211_is_data(hdr->frame_control)) 1355 return RX_CONTINUE; 1356 1357 if (!ieee80211_has_moredata(hdr->frame_control)) { 1358 /* AP has no more frames buffered for us */ 1359 local->pspolling = false; 1360 return RX_CONTINUE; 1361 } 1362 1363 /* more data bit is set, let's request a new frame from the AP */ 1364 ieee80211_send_pspoll(local, rx->sdata); 1365 1366 return RX_CONTINUE; 1367 } 1368 1369 static void sta_ps_start(struct sta_info *sta) 1370 { 1371 struct ieee80211_sub_if_data *sdata = sta->sdata; 1372 struct ieee80211_local *local = sdata->local; 1373 struct ps_data *ps; 1374 int tid; 1375 1376 if (sta->sdata->vif.type == NL80211_IFTYPE_AP || 1377 sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) 1378 ps = &sdata->bss->ps; 1379 else 1380 return; 1381 1382 atomic_inc(&ps->num_sta_ps); 1383 set_sta_flag(sta, WLAN_STA_PS_STA); 1384 if (!ieee80211_hw_check(&local->hw, AP_LINK_PS)) 1385 drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta); 1386 ps_dbg(sdata, "STA %pM aid %d enters power save mode\n", 1387 sta->sta.addr, sta->sta.aid); 1388 1389 ieee80211_clear_fast_xmit(sta); 1390 1391 if (!sta->sta.txq[0]) 1392 return; 1393 1394 for (tid = 0; tid < ARRAY_SIZE(sta->sta.txq); tid++) { 1395 if (txq_has_queue(sta->sta.txq[tid])) 1396 set_bit(tid, &sta->txq_buffered_tids); 1397 else 1398 clear_bit(tid, &sta->txq_buffered_tids); 1399 } 1400 } 1401 1402 static void sta_ps_end(struct sta_info *sta) 1403 { 1404 ps_dbg(sta->sdata, "STA %pM aid %d exits power save mode\n", 1405 sta->sta.addr, sta->sta.aid); 1406 1407 if (test_sta_flag(sta, WLAN_STA_PS_DRIVER)) { 1408 /* 1409 * Clear the flag only if the other one is still set 1410 * so that the TX path won't start TX'ing new frames 1411 * directly ... In the case that the driver flag isn't 1412 * set ieee80211_sta_ps_deliver_wakeup() will clear it. 1413 */ 1414 clear_sta_flag(sta, WLAN_STA_PS_STA); 1415 ps_dbg(sta->sdata, "STA %pM aid %d driver-ps-blocked\n", 1416 sta->sta.addr, sta->sta.aid); 1417 return; 1418 } 1419 1420 set_sta_flag(sta, WLAN_STA_PS_DELIVER); 1421 clear_sta_flag(sta, WLAN_STA_PS_STA); 1422 ieee80211_sta_ps_deliver_wakeup(sta); 1423 } 1424 1425 int ieee80211_sta_ps_transition(struct ieee80211_sta *pubsta, bool start) 1426 { 1427 struct sta_info *sta = container_of(pubsta, struct sta_info, sta); 1428 bool in_ps; 1429 1430 WARN_ON(!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS)); 1431 1432 /* Don't let the same PS state be set twice */ 1433 in_ps = test_sta_flag(sta, WLAN_STA_PS_STA); 1434 if ((start && in_ps) || (!start && !in_ps)) 1435 return -EINVAL; 1436 1437 if (start) 1438 sta_ps_start(sta); 1439 else 1440 sta_ps_end(sta); 1441 1442 return 0; 1443 } 1444 EXPORT_SYMBOL(ieee80211_sta_ps_transition); 1445 1446 void ieee80211_sta_pspoll(struct ieee80211_sta *pubsta) 1447 { 1448 struct sta_info *sta = container_of(pubsta, struct sta_info, sta); 1449 1450 if (test_sta_flag(sta, WLAN_STA_SP)) 1451 return; 1452 1453 if (!test_sta_flag(sta, WLAN_STA_PS_DRIVER)) 1454 ieee80211_sta_ps_deliver_poll_response(sta); 1455 else 1456 set_sta_flag(sta, WLAN_STA_PSPOLL); 1457 } 1458 EXPORT_SYMBOL(ieee80211_sta_pspoll); 1459 1460 void ieee80211_sta_uapsd_trigger(struct ieee80211_sta *pubsta, u8 tid) 1461 { 1462 struct sta_info *sta = container_of(pubsta, struct sta_info, sta); 1463 int ac = ieee80211_ac_from_tid(tid); 1464 1465 /* 1466 * If this AC is not trigger-enabled do nothing unless the 1467 * driver is calling us after it already checked. 1468 * 1469 * NB: This could/should check a separate bitmap of trigger- 1470 * enabled queues, but for now we only implement uAPSD w/o 1471 * TSPEC changes to the ACs, so they're always the same. 1472 */ 1473 if (!(sta->sta.uapsd_queues & ieee80211_ac_to_qos_mask[ac]) && 1474 tid != IEEE80211_NUM_TIDS) 1475 return; 1476 1477 /* if we are in a service period, do nothing */ 1478 if (test_sta_flag(sta, WLAN_STA_SP)) 1479 return; 1480 1481 if (!test_sta_flag(sta, WLAN_STA_PS_DRIVER)) 1482 ieee80211_sta_ps_deliver_uapsd(sta); 1483 else 1484 set_sta_flag(sta, WLAN_STA_UAPSD); 1485 } 1486 EXPORT_SYMBOL(ieee80211_sta_uapsd_trigger); 1487 1488 static ieee80211_rx_result debug_noinline 1489 ieee80211_rx_h_uapsd_and_pspoll(struct ieee80211_rx_data *rx) 1490 { 1491 struct ieee80211_sub_if_data *sdata = rx->sdata; 1492 struct ieee80211_hdr *hdr = (void *)rx->skb->data; 1493 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 1494 1495 if (!rx->sta) 1496 return RX_CONTINUE; 1497 1498 if (sdata->vif.type != NL80211_IFTYPE_AP && 1499 sdata->vif.type != NL80211_IFTYPE_AP_VLAN) 1500 return RX_CONTINUE; 1501 1502 /* 1503 * The device handles station powersave, so don't do anything about 1504 * uAPSD and PS-Poll frames (the latter shouldn't even come up from 1505 * it to mac80211 since they're handled.) 1506 */ 1507 if (ieee80211_hw_check(&sdata->local->hw, AP_LINK_PS)) 1508 return RX_CONTINUE; 1509 1510 /* 1511 * Don't do anything if the station isn't already asleep. In 1512 * the uAPSD case, the station will probably be marked asleep, 1513 * in the PS-Poll case the station must be confused ... 1514 */ 1515 if (!test_sta_flag(rx->sta, WLAN_STA_PS_STA)) 1516 return RX_CONTINUE; 1517 1518 if (unlikely(ieee80211_is_pspoll(hdr->frame_control))) { 1519 ieee80211_sta_pspoll(&rx->sta->sta); 1520 1521 /* Free PS Poll skb here instead of returning RX_DROP that would 1522 * count as an dropped frame. */ 1523 dev_kfree_skb(rx->skb); 1524 1525 return RX_QUEUED; 1526 } else if (!ieee80211_has_morefrags(hdr->frame_control) && 1527 !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) && 1528 ieee80211_has_pm(hdr->frame_control) && 1529 (ieee80211_is_data_qos(hdr->frame_control) || 1530 ieee80211_is_qos_nullfunc(hdr->frame_control))) { 1531 u8 tid = ieee80211_get_tid(hdr); 1532 1533 ieee80211_sta_uapsd_trigger(&rx->sta->sta, tid); 1534 } 1535 1536 return RX_CONTINUE; 1537 } 1538 1539 static ieee80211_rx_result debug_noinline 1540 ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx) 1541 { 1542 struct sta_info *sta = rx->sta; 1543 struct sk_buff *skb = rx->skb; 1544 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 1545 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; 1546 int i; 1547 1548 if (!sta) 1549 return RX_CONTINUE; 1550 1551 /* 1552 * Update last_rx only for IBSS packets which are for the current 1553 * BSSID and for station already AUTHORIZED to avoid keeping the 1554 * current IBSS network alive in cases where other STAs start 1555 * using different BSSID. This will also give the station another 1556 * chance to restart the authentication/authorization in case 1557 * something went wrong the first time. 1558 */ 1559 if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) { 1560 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len, 1561 NL80211_IFTYPE_ADHOC); 1562 if (ether_addr_equal(bssid, rx->sdata->u.ibss.bssid) && 1563 test_sta_flag(sta, WLAN_STA_AUTHORIZED)) { 1564 sta->rx_stats.last_rx = jiffies; 1565 if (ieee80211_is_data(hdr->frame_control) && 1566 !is_multicast_ether_addr(hdr->addr1)) 1567 sta->rx_stats.last_rate = 1568 sta_stats_encode_rate(status); 1569 } 1570 } else if (rx->sdata->vif.type == NL80211_IFTYPE_OCB) { 1571 sta->rx_stats.last_rx = jiffies; 1572 } else if (!is_multicast_ether_addr(hdr->addr1)) { 1573 /* 1574 * Mesh beacons will update last_rx when if they are found to 1575 * match the current local configuration when processed. 1576 */ 1577 sta->rx_stats.last_rx = jiffies; 1578 if (ieee80211_is_data(hdr->frame_control)) 1579 sta->rx_stats.last_rate = sta_stats_encode_rate(status); 1580 } 1581 1582 if (rx->sdata->vif.type == NL80211_IFTYPE_STATION) 1583 ieee80211_sta_rx_notify(rx->sdata, hdr); 1584 1585 sta->rx_stats.fragments++; 1586 1587 u64_stats_update_begin(&rx->sta->rx_stats.syncp); 1588 sta->rx_stats.bytes += rx->skb->len; 1589 u64_stats_update_end(&rx->sta->rx_stats.syncp); 1590 1591 if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) { 1592 sta->rx_stats.last_signal = status->signal; 1593 ewma_signal_add(&sta->rx_stats_avg.signal, -status->signal); 1594 } 1595 1596 if (status->chains) { 1597 sta->rx_stats.chains = status->chains; 1598 for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) { 1599 int signal = status->chain_signal[i]; 1600 1601 if (!(status->chains & BIT(i))) 1602 continue; 1603 1604 sta->rx_stats.chain_signal_last[i] = signal; 1605 ewma_signal_add(&sta->rx_stats_avg.chain_signal[i], 1606 -signal); 1607 } 1608 } 1609 1610 /* 1611 * Change STA power saving mode only at the end of a frame 1612 * exchange sequence, and only for a data or management 1613 * frame as specified in IEEE 802.11-2016 11.2.3.2 1614 */ 1615 if (!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS) && 1616 !ieee80211_has_morefrags(hdr->frame_control) && 1617 (ieee80211_is_mgmt(hdr->frame_control) || 1618 ieee80211_is_data(hdr->frame_control)) && 1619 !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) && 1620 (rx->sdata->vif.type == NL80211_IFTYPE_AP || 1621 rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) { 1622 if (test_sta_flag(sta, WLAN_STA_PS_STA)) { 1623 if (!ieee80211_has_pm(hdr->frame_control)) 1624 sta_ps_end(sta); 1625 } else { 1626 if (ieee80211_has_pm(hdr->frame_control)) 1627 sta_ps_start(sta); 1628 } 1629 } 1630 1631 /* mesh power save support */ 1632 if (ieee80211_vif_is_mesh(&rx->sdata->vif)) 1633 ieee80211_mps_rx_h_sta_process(sta, hdr); 1634 1635 /* 1636 * Drop (qos-)data::nullfunc frames silently, since they 1637 * are used only to control station power saving mode. 1638 */ 1639 if (ieee80211_is_nullfunc(hdr->frame_control) || 1640 ieee80211_is_qos_nullfunc(hdr->frame_control)) { 1641 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc); 1642 1643 /* 1644 * If we receive a 4-addr nullfunc frame from a STA 1645 * that was not moved to a 4-addr STA vlan yet send 1646 * the event to userspace and for older hostapd drop 1647 * the frame to the monitor interface. 1648 */ 1649 if (ieee80211_has_a4(hdr->frame_control) && 1650 (rx->sdata->vif.type == NL80211_IFTYPE_AP || 1651 (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN && 1652 !rx->sdata->u.vlan.sta))) { 1653 if (!test_and_set_sta_flag(sta, WLAN_STA_4ADDR_EVENT)) 1654 cfg80211_rx_unexpected_4addr_frame( 1655 rx->sdata->dev, sta->sta.addr, 1656 GFP_ATOMIC); 1657 return RX_DROP_MONITOR; 1658 } 1659 /* 1660 * Update counter and free packet here to avoid 1661 * counting this as a dropped packed. 1662 */ 1663 sta->rx_stats.packets++; 1664 dev_kfree_skb(rx->skb); 1665 return RX_QUEUED; 1666 } 1667 1668 return RX_CONTINUE; 1669 } /* ieee80211_rx_h_sta_process */ 1670 1671 static ieee80211_rx_result debug_noinline 1672 ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx) 1673 { 1674 struct sk_buff *skb = rx->skb; 1675 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 1676 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; 1677 int keyidx; 1678 int hdrlen; 1679 ieee80211_rx_result result = RX_DROP_UNUSABLE; 1680 struct ieee80211_key *sta_ptk = NULL; 1681 int mmie_keyidx = -1; 1682 __le16 fc; 1683 const struct ieee80211_cipher_scheme *cs = NULL; 1684 1685 /* 1686 * Key selection 101 1687 * 1688 * There are four types of keys: 1689 * - GTK (group keys) 1690 * - IGTK (group keys for management frames) 1691 * - PTK (pairwise keys) 1692 * - STK (station-to-station pairwise keys) 1693 * 1694 * When selecting a key, we have to distinguish between multicast 1695 * (including broadcast) and unicast frames, the latter can only 1696 * use PTKs and STKs while the former always use GTKs and IGTKs. 1697 * Unless, of course, actual WEP keys ("pre-RSNA") are used, then 1698 * unicast frames can also use key indices like GTKs. Hence, if we 1699 * don't have a PTK/STK we check the key index for a WEP key. 1700 * 1701 * Note that in a regular BSS, multicast frames are sent by the 1702 * AP only, associated stations unicast the frame to the AP first 1703 * which then multicasts it on their behalf. 1704 * 1705 * There is also a slight problem in IBSS mode: GTKs are negotiated 1706 * with each station, that is something we don't currently handle. 1707 * The spec seems to expect that one negotiates the same key with 1708 * every station but there's no such requirement; VLANs could be 1709 * possible. 1710 */ 1711 1712 /* start without a key */ 1713 rx->key = NULL; 1714 fc = hdr->frame_control; 1715 1716 if (rx->sta) { 1717 int keyid = rx->sta->ptk_idx; 1718 1719 if (ieee80211_has_protected(fc) && rx->sta->cipher_scheme) { 1720 cs = rx->sta->cipher_scheme; 1721 keyid = ieee80211_get_cs_keyid(cs, rx->skb); 1722 if (unlikely(keyid < 0)) 1723 return RX_DROP_UNUSABLE; 1724 } 1725 sta_ptk = rcu_dereference(rx->sta->ptk[keyid]); 1726 } 1727 1728 if (!ieee80211_has_protected(fc)) 1729 mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb); 1730 1731 if (!is_multicast_ether_addr(hdr->addr1) && sta_ptk) { 1732 rx->key = sta_ptk; 1733 if ((status->flag & RX_FLAG_DECRYPTED) && 1734 (status->flag & RX_FLAG_IV_STRIPPED)) 1735 return RX_CONTINUE; 1736 /* Skip decryption if the frame is not protected. */ 1737 if (!ieee80211_has_protected(fc)) 1738 return RX_CONTINUE; 1739 } else if (mmie_keyidx >= 0) { 1740 /* Broadcast/multicast robust management frame / BIP */ 1741 if ((status->flag & RX_FLAG_DECRYPTED) && 1742 (status->flag & RX_FLAG_IV_STRIPPED)) 1743 return RX_CONTINUE; 1744 1745 if (mmie_keyidx < NUM_DEFAULT_KEYS || 1746 mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS) 1747 return RX_DROP_MONITOR; /* unexpected BIP keyidx */ 1748 if (rx->sta) { 1749 if (ieee80211_is_group_privacy_action(skb) && 1750 test_sta_flag(rx->sta, WLAN_STA_MFP)) 1751 return RX_DROP_MONITOR; 1752 1753 rx->key = rcu_dereference(rx->sta->gtk[mmie_keyidx]); 1754 } 1755 if (!rx->key) 1756 rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]); 1757 } else if (!ieee80211_has_protected(fc)) { 1758 /* 1759 * The frame was not protected, so skip decryption. However, we 1760 * need to set rx->key if there is a key that could have been 1761 * used so that the frame may be dropped if encryption would 1762 * have been expected. 1763 */ 1764 struct ieee80211_key *key = NULL; 1765 struct ieee80211_sub_if_data *sdata = rx->sdata; 1766 int i; 1767 1768 if (ieee80211_is_mgmt(fc) && 1769 is_multicast_ether_addr(hdr->addr1) && 1770 (key = rcu_dereference(rx->sdata->default_mgmt_key))) 1771 rx->key = key; 1772 else { 1773 if (rx->sta) { 1774 for (i = 0; i < NUM_DEFAULT_KEYS; i++) { 1775 key = rcu_dereference(rx->sta->gtk[i]); 1776 if (key) 1777 break; 1778 } 1779 } 1780 if (!key) { 1781 for (i = 0; i < NUM_DEFAULT_KEYS; i++) { 1782 key = rcu_dereference(sdata->keys[i]); 1783 if (key) 1784 break; 1785 } 1786 } 1787 if (key) 1788 rx->key = key; 1789 } 1790 return RX_CONTINUE; 1791 } else { 1792 u8 keyid; 1793 1794 /* 1795 * The device doesn't give us the IV so we won't be 1796 * able to look up the key. That's ok though, we 1797 * don't need to decrypt the frame, we just won't 1798 * be able to keep statistics accurate. 1799 * Except for key threshold notifications, should 1800 * we somehow allow the driver to tell us which key 1801 * the hardware used if this flag is set? 1802 */ 1803 if ((status->flag & RX_FLAG_DECRYPTED) && 1804 (status->flag & RX_FLAG_IV_STRIPPED)) 1805 return RX_CONTINUE; 1806 1807 hdrlen = ieee80211_hdrlen(fc); 1808 1809 if (cs) { 1810 keyidx = ieee80211_get_cs_keyid(cs, rx->skb); 1811 1812 if (unlikely(keyidx < 0)) 1813 return RX_DROP_UNUSABLE; 1814 } else { 1815 if (rx->skb->len < 8 + hdrlen) 1816 return RX_DROP_UNUSABLE; /* TODO: count this? */ 1817 /* 1818 * no need to call ieee80211_wep_get_keyidx, 1819 * it verifies a bunch of things we've done already 1820 */ 1821 skb_copy_bits(rx->skb, hdrlen + 3, &keyid, 1); 1822 keyidx = keyid >> 6; 1823 } 1824 1825 /* check per-station GTK first, if multicast packet */ 1826 if (is_multicast_ether_addr(hdr->addr1) && rx->sta) 1827 rx->key = rcu_dereference(rx->sta->gtk[keyidx]); 1828 1829 /* if not found, try default key */ 1830 if (!rx->key) { 1831 rx->key = rcu_dereference(rx->sdata->keys[keyidx]); 1832 1833 /* 1834 * RSNA-protected unicast frames should always be 1835 * sent with pairwise or station-to-station keys, 1836 * but for WEP we allow using a key index as well. 1837 */ 1838 if (rx->key && 1839 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 && 1840 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 && 1841 !is_multicast_ether_addr(hdr->addr1)) 1842 rx->key = NULL; 1843 } 1844 } 1845 1846 if (rx->key) { 1847 if (unlikely(rx->key->flags & KEY_FLAG_TAINTED)) 1848 return RX_DROP_MONITOR; 1849 1850 /* TODO: add threshold stuff again */ 1851 } else { 1852 return RX_DROP_MONITOR; 1853 } 1854 1855 switch (rx->key->conf.cipher) { 1856 case WLAN_CIPHER_SUITE_WEP40: 1857 case WLAN_CIPHER_SUITE_WEP104: 1858 result = ieee80211_crypto_wep_decrypt(rx); 1859 break; 1860 case WLAN_CIPHER_SUITE_TKIP: 1861 result = ieee80211_crypto_tkip_decrypt(rx); 1862 break; 1863 case WLAN_CIPHER_SUITE_CCMP: 1864 result = ieee80211_crypto_ccmp_decrypt( 1865 rx, IEEE80211_CCMP_MIC_LEN); 1866 break; 1867 case WLAN_CIPHER_SUITE_CCMP_256: 1868 result = ieee80211_crypto_ccmp_decrypt( 1869 rx, IEEE80211_CCMP_256_MIC_LEN); 1870 break; 1871 case WLAN_CIPHER_SUITE_AES_CMAC: 1872 result = ieee80211_crypto_aes_cmac_decrypt(rx); 1873 break; 1874 case WLAN_CIPHER_SUITE_BIP_CMAC_256: 1875 result = ieee80211_crypto_aes_cmac_256_decrypt(rx); 1876 break; 1877 case WLAN_CIPHER_SUITE_BIP_GMAC_128: 1878 case WLAN_CIPHER_SUITE_BIP_GMAC_256: 1879 result = ieee80211_crypto_aes_gmac_decrypt(rx); 1880 break; 1881 case WLAN_CIPHER_SUITE_GCMP: 1882 case WLAN_CIPHER_SUITE_GCMP_256: 1883 result = ieee80211_crypto_gcmp_decrypt(rx); 1884 break; 1885 default: 1886 result = ieee80211_crypto_hw_decrypt(rx); 1887 } 1888 1889 /* the hdr variable is invalid after the decrypt handlers */ 1890 1891 /* either the frame has been decrypted or will be dropped */ 1892 status->flag |= RX_FLAG_DECRYPTED; 1893 1894 return result; 1895 } 1896 1897 static inline struct ieee80211_fragment_entry * 1898 ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata, 1899 unsigned int frag, unsigned int seq, int rx_queue, 1900 struct sk_buff **skb) 1901 { 1902 struct ieee80211_fragment_entry *entry; 1903 1904 entry = &sdata->fragments[sdata->fragment_next++]; 1905 if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX) 1906 sdata->fragment_next = 0; 1907 1908 if (!skb_queue_empty(&entry->skb_list)) 1909 __skb_queue_purge(&entry->skb_list); 1910 1911 __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */ 1912 *skb = NULL; 1913 entry->first_frag_time = jiffies; 1914 entry->seq = seq; 1915 entry->rx_queue = rx_queue; 1916 entry->last_frag = frag; 1917 entry->check_sequential_pn = false; 1918 entry->extra_len = 0; 1919 1920 return entry; 1921 } 1922 1923 static inline struct ieee80211_fragment_entry * 1924 ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata, 1925 unsigned int frag, unsigned int seq, 1926 int rx_queue, struct ieee80211_hdr *hdr) 1927 { 1928 struct ieee80211_fragment_entry *entry; 1929 int i, idx; 1930 1931 idx = sdata->fragment_next; 1932 for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) { 1933 struct ieee80211_hdr *f_hdr; 1934 1935 idx--; 1936 if (idx < 0) 1937 idx = IEEE80211_FRAGMENT_MAX - 1; 1938 1939 entry = &sdata->fragments[idx]; 1940 if (skb_queue_empty(&entry->skb_list) || entry->seq != seq || 1941 entry->rx_queue != rx_queue || 1942 entry->last_frag + 1 != frag) 1943 continue; 1944 1945 f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data; 1946 1947 /* 1948 * Check ftype and addresses are equal, else check next fragment 1949 */ 1950 if (((hdr->frame_control ^ f_hdr->frame_control) & 1951 cpu_to_le16(IEEE80211_FCTL_FTYPE)) || 1952 !ether_addr_equal(hdr->addr1, f_hdr->addr1) || 1953 !ether_addr_equal(hdr->addr2, f_hdr->addr2)) 1954 continue; 1955 1956 if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) { 1957 __skb_queue_purge(&entry->skb_list); 1958 continue; 1959 } 1960 return entry; 1961 } 1962 1963 return NULL; 1964 } 1965 1966 static ieee80211_rx_result debug_noinline 1967 ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx) 1968 { 1969 struct ieee80211_hdr *hdr; 1970 u16 sc; 1971 __le16 fc; 1972 unsigned int frag, seq; 1973 struct ieee80211_fragment_entry *entry; 1974 struct sk_buff *skb; 1975 1976 hdr = (struct ieee80211_hdr *)rx->skb->data; 1977 fc = hdr->frame_control; 1978 1979 if (ieee80211_is_ctl(fc)) 1980 return RX_CONTINUE; 1981 1982 sc = le16_to_cpu(hdr->seq_ctrl); 1983 frag = sc & IEEE80211_SCTL_FRAG; 1984 1985 if (is_multicast_ether_addr(hdr->addr1)) { 1986 I802_DEBUG_INC(rx->local->dot11MulticastReceivedFrameCount); 1987 goto out_no_led; 1988 } 1989 1990 if (likely(!ieee80211_has_morefrags(fc) && frag == 0)) 1991 goto out; 1992 1993 I802_DEBUG_INC(rx->local->rx_handlers_fragments); 1994 1995 if (skb_linearize(rx->skb)) 1996 return RX_DROP_UNUSABLE; 1997 1998 /* 1999 * skb_linearize() might change the skb->data and 2000 * previously cached variables (in this case, hdr) need to 2001 * be refreshed with the new data. 2002 */ 2003 hdr = (struct ieee80211_hdr *)rx->skb->data; 2004 seq = (sc & IEEE80211_SCTL_SEQ) >> 4; 2005 2006 if (frag == 0) { 2007 /* This is the first fragment of a new frame. */ 2008 entry = ieee80211_reassemble_add(rx->sdata, frag, seq, 2009 rx->seqno_idx, &(rx->skb)); 2010 if (rx->key && 2011 (rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP || 2012 rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP_256 || 2013 rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP || 2014 rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP_256) && 2015 ieee80211_has_protected(fc)) { 2016 int queue = rx->security_idx; 2017 2018 /* Store CCMP/GCMP PN so that we can verify that the 2019 * next fragment has a sequential PN value. 2020 */ 2021 entry->check_sequential_pn = true; 2022 memcpy(entry->last_pn, 2023 rx->key->u.ccmp.rx_pn[queue], 2024 IEEE80211_CCMP_PN_LEN); 2025 BUILD_BUG_ON(offsetof(struct ieee80211_key, 2026 u.ccmp.rx_pn) != 2027 offsetof(struct ieee80211_key, 2028 u.gcmp.rx_pn)); 2029 BUILD_BUG_ON(sizeof(rx->key->u.ccmp.rx_pn[queue]) != 2030 sizeof(rx->key->u.gcmp.rx_pn[queue])); 2031 BUILD_BUG_ON(IEEE80211_CCMP_PN_LEN != 2032 IEEE80211_GCMP_PN_LEN); 2033 } 2034 return RX_QUEUED; 2035 } 2036 2037 /* This is a fragment for a frame that should already be pending in 2038 * fragment cache. Add this fragment to the end of the pending entry. 2039 */ 2040 entry = ieee80211_reassemble_find(rx->sdata, frag, seq, 2041 rx->seqno_idx, hdr); 2042 if (!entry) { 2043 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag); 2044 return RX_DROP_MONITOR; 2045 } 2046 2047 /* "The receiver shall discard MSDUs and MMPDUs whose constituent 2048 * MPDU PN values are not incrementing in steps of 1." 2049 * see IEEE P802.11-REVmc/D5.0, 12.5.3.4.4, item d (for CCMP) 2050 * and IEEE P802.11-REVmc/D5.0, 12.5.5.4.4, item d (for GCMP) 2051 */ 2052 if (entry->check_sequential_pn) { 2053 int i; 2054 u8 pn[IEEE80211_CCMP_PN_LEN], *rpn; 2055 int queue; 2056 2057 if (!rx->key || 2058 (rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP && 2059 rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP_256 && 2060 rx->key->conf.cipher != WLAN_CIPHER_SUITE_GCMP && 2061 rx->key->conf.cipher != WLAN_CIPHER_SUITE_GCMP_256)) 2062 return RX_DROP_UNUSABLE; 2063 memcpy(pn, entry->last_pn, IEEE80211_CCMP_PN_LEN); 2064 for (i = IEEE80211_CCMP_PN_LEN - 1; i >= 0; i--) { 2065 pn[i]++; 2066 if (pn[i]) 2067 break; 2068 } 2069 queue = rx->security_idx; 2070 rpn = rx->key->u.ccmp.rx_pn[queue]; 2071 if (memcmp(pn, rpn, IEEE80211_CCMP_PN_LEN)) 2072 return RX_DROP_UNUSABLE; 2073 memcpy(entry->last_pn, pn, IEEE80211_CCMP_PN_LEN); 2074 } 2075 2076 skb_pull(rx->skb, ieee80211_hdrlen(fc)); 2077 __skb_queue_tail(&entry->skb_list, rx->skb); 2078 entry->last_frag = frag; 2079 entry->extra_len += rx->skb->len; 2080 if (ieee80211_has_morefrags(fc)) { 2081 rx->skb = NULL; 2082 return RX_QUEUED; 2083 } 2084 2085 rx->skb = __skb_dequeue(&entry->skb_list); 2086 if (skb_tailroom(rx->skb) < entry->extra_len) { 2087 I802_DEBUG_INC(rx->local->rx_expand_skb_head_defrag); 2088 if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len, 2089 GFP_ATOMIC))) { 2090 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag); 2091 __skb_queue_purge(&entry->skb_list); 2092 return RX_DROP_UNUSABLE; 2093 } 2094 } 2095 while ((skb = __skb_dequeue(&entry->skb_list))) { 2096 skb_put_data(rx->skb, skb->data, skb->len); 2097 dev_kfree_skb(skb); 2098 } 2099 2100 out: 2101 ieee80211_led_rx(rx->local); 2102 out_no_led: 2103 if (rx->sta) 2104 rx->sta->rx_stats.packets++; 2105 return RX_CONTINUE; 2106 } 2107 2108 static int ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx) 2109 { 2110 if (unlikely(!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_AUTHORIZED))) 2111 return -EACCES; 2112 2113 return 0; 2114 } 2115 2116 static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc) 2117 { 2118 struct sk_buff *skb = rx->skb; 2119 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 2120 2121 /* 2122 * Pass through unencrypted frames if the hardware has 2123 * decrypted them already. 2124 */ 2125 if (status->flag & RX_FLAG_DECRYPTED) 2126 return 0; 2127 2128 /* Drop unencrypted frames if key is set. */ 2129 if (unlikely(!ieee80211_has_protected(fc) && 2130 !ieee80211_is_nullfunc(fc) && 2131 ieee80211_is_data(fc) && rx->key)) 2132 return -EACCES; 2133 2134 return 0; 2135 } 2136 2137 static int ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx) 2138 { 2139 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 2140 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 2141 __le16 fc = hdr->frame_control; 2142 2143 /* 2144 * Pass through unencrypted frames if the hardware has 2145 * decrypted them already. 2146 */ 2147 if (status->flag & RX_FLAG_DECRYPTED) 2148 return 0; 2149 2150 if (rx->sta && test_sta_flag(rx->sta, WLAN_STA_MFP)) { 2151 if (unlikely(!ieee80211_has_protected(fc) && 2152 ieee80211_is_unicast_robust_mgmt_frame(rx->skb) && 2153 rx->key)) { 2154 if (ieee80211_is_deauth(fc) || 2155 ieee80211_is_disassoc(fc)) 2156 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev, 2157 rx->skb->data, 2158 rx->skb->len); 2159 return -EACCES; 2160 } 2161 /* BIP does not use Protected field, so need to check MMIE */ 2162 if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) && 2163 ieee80211_get_mmie_keyidx(rx->skb) < 0)) { 2164 if (ieee80211_is_deauth(fc) || 2165 ieee80211_is_disassoc(fc)) 2166 cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev, 2167 rx->skb->data, 2168 rx->skb->len); 2169 return -EACCES; 2170 } 2171 /* 2172 * When using MFP, Action frames are not allowed prior to 2173 * having configured keys. 2174 */ 2175 if (unlikely(ieee80211_is_action(fc) && !rx->key && 2176 ieee80211_is_robust_mgmt_frame(rx->skb))) 2177 return -EACCES; 2178 } 2179 2180 return 0; 2181 } 2182 2183 static int 2184 __ieee80211_data_to_8023(struct ieee80211_rx_data *rx, bool *port_control) 2185 { 2186 struct ieee80211_sub_if_data *sdata = rx->sdata; 2187 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 2188 bool check_port_control = false; 2189 struct ethhdr *ehdr; 2190 int ret; 2191 2192 *port_control = false; 2193 if (ieee80211_has_a4(hdr->frame_control) && 2194 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta) 2195 return -1; 2196 2197 if (sdata->vif.type == NL80211_IFTYPE_STATION && 2198 !!sdata->u.mgd.use_4addr != !!ieee80211_has_a4(hdr->frame_control)) { 2199 2200 if (!sdata->u.mgd.use_4addr) 2201 return -1; 2202 else 2203 check_port_control = true; 2204 } 2205 2206 if (is_multicast_ether_addr(hdr->addr1) && 2207 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta) 2208 return -1; 2209 2210 ret = ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type); 2211 if (ret < 0) 2212 return ret; 2213 2214 ehdr = (struct ethhdr *) rx->skb->data; 2215 if (ehdr->h_proto == rx->sdata->control_port_protocol) 2216 *port_control = true; 2217 else if (check_port_control) 2218 return -1; 2219 2220 return 0; 2221 } 2222 2223 /* 2224 * requires that rx->skb is a frame with ethernet header 2225 */ 2226 static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc) 2227 { 2228 static const u8 pae_group_addr[ETH_ALEN] __aligned(2) 2229 = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 }; 2230 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data; 2231 2232 /* 2233 * Allow EAPOL frames to us/the PAE group address regardless 2234 * of whether the frame was encrypted or not. 2235 */ 2236 if (ehdr->h_proto == rx->sdata->control_port_protocol && 2237 (ether_addr_equal(ehdr->h_dest, rx->sdata->vif.addr) || 2238 ether_addr_equal(ehdr->h_dest, pae_group_addr))) 2239 return true; 2240 2241 if (ieee80211_802_1x_port_control(rx) || 2242 ieee80211_drop_unencrypted(rx, fc)) 2243 return false; 2244 2245 return true; 2246 } 2247 2248 static void ieee80211_deliver_skb_to_local_stack(struct sk_buff *skb, 2249 struct ieee80211_rx_data *rx) 2250 { 2251 struct ieee80211_sub_if_data *sdata = rx->sdata; 2252 struct net_device *dev = sdata->dev; 2253 2254 if (unlikely((skb->protocol == sdata->control_port_protocol || 2255 skb->protocol == cpu_to_be16(ETH_P_PREAUTH)) && 2256 sdata->control_port_over_nl80211)) { 2257 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 2258 bool noencrypt = status->flag & RX_FLAG_DECRYPTED; 2259 struct ethhdr *ehdr = eth_hdr(skb); 2260 2261 cfg80211_rx_control_port(dev, skb->data, skb->len, 2262 ehdr->h_source, 2263 be16_to_cpu(skb->protocol), noencrypt); 2264 dev_kfree_skb(skb); 2265 } else { 2266 /* deliver to local stack */ 2267 if (rx->napi) 2268 napi_gro_receive(rx->napi, skb); 2269 else 2270 netif_receive_skb(skb); 2271 } 2272 } 2273 2274 /* 2275 * requires that rx->skb is a frame with ethernet header 2276 */ 2277 static void 2278 ieee80211_deliver_skb(struct ieee80211_rx_data *rx) 2279 { 2280 struct ieee80211_sub_if_data *sdata = rx->sdata; 2281 struct net_device *dev = sdata->dev; 2282 struct sk_buff *skb, *xmit_skb; 2283 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data; 2284 struct sta_info *dsta; 2285 2286 skb = rx->skb; 2287 xmit_skb = NULL; 2288 2289 ieee80211_rx_stats(dev, skb->len); 2290 2291 if (rx->sta) { 2292 /* The seqno index has the same property as needed 2293 * for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS 2294 * for non-QoS-data frames. Here we know it's a data 2295 * frame, so count MSDUs. 2296 */ 2297 u64_stats_update_begin(&rx->sta->rx_stats.syncp); 2298 rx->sta->rx_stats.msdu[rx->seqno_idx]++; 2299 u64_stats_update_end(&rx->sta->rx_stats.syncp); 2300 } 2301 2302 if ((sdata->vif.type == NL80211_IFTYPE_AP || 2303 sdata->vif.type == NL80211_IFTYPE_AP_VLAN) && 2304 !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) && 2305 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) { 2306 if (is_multicast_ether_addr(ehdr->h_dest) && 2307 ieee80211_vif_get_num_mcast_if(sdata) != 0) { 2308 /* 2309 * send multicast frames both to higher layers in 2310 * local net stack and back to the wireless medium 2311 */ 2312 xmit_skb = skb_copy(skb, GFP_ATOMIC); 2313 if (!xmit_skb) 2314 net_info_ratelimited("%s: failed to clone multicast frame\n", 2315 dev->name); 2316 } else if (!is_multicast_ether_addr(ehdr->h_dest)) { 2317 dsta = sta_info_get(sdata, skb->data); 2318 if (dsta) { 2319 /* 2320 * The destination station is associated to 2321 * this AP (in this VLAN), so send the frame 2322 * directly to it and do not pass it to local 2323 * net stack. 2324 */ 2325 xmit_skb = skb; 2326 skb = NULL; 2327 } 2328 } 2329 } 2330 2331 #ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS 2332 if (skb) { 2333 /* 'align' will only take the values 0 or 2 here since all 2334 * frames are required to be aligned to 2-byte boundaries 2335 * when being passed to mac80211; the code here works just 2336 * as well if that isn't true, but mac80211 assumes it can 2337 * access fields as 2-byte aligned (e.g. for ether_addr_equal) 2338 */ 2339 int align; 2340 2341 align = (unsigned long)(skb->data + sizeof(struct ethhdr)) & 3; 2342 if (align) { 2343 if (WARN_ON(skb_headroom(skb) < 3)) { 2344 dev_kfree_skb(skb); 2345 skb = NULL; 2346 } else { 2347 u8 *data = skb->data; 2348 size_t len = skb_headlen(skb); 2349 skb->data -= align; 2350 memmove(skb->data, data, len); 2351 skb_set_tail_pointer(skb, len); 2352 } 2353 } 2354 } 2355 #endif 2356 2357 if (skb) { 2358 skb->protocol = eth_type_trans(skb, dev); 2359 memset(skb->cb, 0, sizeof(skb->cb)); 2360 2361 ieee80211_deliver_skb_to_local_stack(skb, rx); 2362 } 2363 2364 if (xmit_skb) { 2365 /* 2366 * Send to wireless media and increase priority by 256 to 2367 * keep the received priority instead of reclassifying 2368 * the frame (see cfg80211_classify8021d). 2369 */ 2370 xmit_skb->priority += 256; 2371 xmit_skb->protocol = htons(ETH_P_802_3); 2372 skb_reset_network_header(xmit_skb); 2373 skb_reset_mac_header(xmit_skb); 2374 dev_queue_xmit(xmit_skb); 2375 } 2376 } 2377 2378 static ieee80211_rx_result debug_noinline 2379 __ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx, u8 data_offset) 2380 { 2381 struct net_device *dev = rx->sdata->dev; 2382 struct sk_buff *skb = rx->skb; 2383 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; 2384 __le16 fc = hdr->frame_control; 2385 struct sk_buff_head frame_list; 2386 struct ethhdr ethhdr; 2387 const u8 *check_da = ethhdr.h_dest, *check_sa = ethhdr.h_source; 2388 2389 if (unlikely(ieee80211_has_a4(hdr->frame_control))) { 2390 check_da = NULL; 2391 check_sa = NULL; 2392 } else switch (rx->sdata->vif.type) { 2393 case NL80211_IFTYPE_AP: 2394 case NL80211_IFTYPE_AP_VLAN: 2395 check_da = NULL; 2396 break; 2397 case NL80211_IFTYPE_STATION: 2398 if (!rx->sta || 2399 !test_sta_flag(rx->sta, WLAN_STA_TDLS_PEER)) 2400 check_sa = NULL; 2401 break; 2402 case NL80211_IFTYPE_MESH_POINT: 2403 check_sa = NULL; 2404 break; 2405 default: 2406 break; 2407 } 2408 2409 skb->dev = dev; 2410 __skb_queue_head_init(&frame_list); 2411 2412 if (ieee80211_data_to_8023_exthdr(skb, ðhdr, 2413 rx->sdata->vif.addr, 2414 rx->sdata->vif.type, 2415 data_offset)) 2416 return RX_DROP_UNUSABLE; 2417 2418 ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr, 2419 rx->sdata->vif.type, 2420 rx->local->hw.extra_tx_headroom, 2421 check_da, check_sa); 2422 2423 while (!skb_queue_empty(&frame_list)) { 2424 rx->skb = __skb_dequeue(&frame_list); 2425 2426 if (!ieee80211_frame_allowed(rx, fc)) { 2427 dev_kfree_skb(rx->skb); 2428 continue; 2429 } 2430 2431 ieee80211_deliver_skb(rx); 2432 } 2433 2434 return RX_QUEUED; 2435 } 2436 2437 static ieee80211_rx_result debug_noinline 2438 ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx) 2439 { 2440 struct sk_buff *skb = rx->skb; 2441 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 2442 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; 2443 __le16 fc = hdr->frame_control; 2444 2445 if (!(status->rx_flags & IEEE80211_RX_AMSDU)) 2446 return RX_CONTINUE; 2447 2448 if (unlikely(!ieee80211_is_data(fc))) 2449 return RX_CONTINUE; 2450 2451 if (unlikely(!ieee80211_is_data_present(fc))) 2452 return RX_DROP_MONITOR; 2453 2454 if (unlikely(ieee80211_has_a4(hdr->frame_control))) { 2455 switch (rx->sdata->vif.type) { 2456 case NL80211_IFTYPE_AP_VLAN: 2457 if (!rx->sdata->u.vlan.sta) 2458 return RX_DROP_UNUSABLE; 2459 break; 2460 case NL80211_IFTYPE_STATION: 2461 if (!rx->sdata->u.mgd.use_4addr) 2462 return RX_DROP_UNUSABLE; 2463 break; 2464 default: 2465 return RX_DROP_UNUSABLE; 2466 } 2467 } 2468 2469 if (is_multicast_ether_addr(hdr->addr1)) 2470 return RX_DROP_UNUSABLE; 2471 2472 return __ieee80211_rx_h_amsdu(rx, 0); 2473 } 2474 2475 #ifdef CONFIG_MAC80211_MESH 2476 static ieee80211_rx_result 2477 ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx) 2478 { 2479 struct ieee80211_hdr *fwd_hdr, *hdr; 2480 struct ieee80211_tx_info *info; 2481 struct ieee80211s_hdr *mesh_hdr; 2482 struct sk_buff *skb = rx->skb, *fwd_skb; 2483 struct ieee80211_local *local = rx->local; 2484 struct ieee80211_sub_if_data *sdata = rx->sdata; 2485 struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh; 2486 u16 ac, q, hdrlen; 2487 2488 hdr = (struct ieee80211_hdr *) skb->data; 2489 hdrlen = ieee80211_hdrlen(hdr->frame_control); 2490 2491 /* make sure fixed part of mesh header is there, also checks skb len */ 2492 if (!pskb_may_pull(rx->skb, hdrlen + 6)) 2493 return RX_DROP_MONITOR; 2494 2495 mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen); 2496 2497 /* make sure full mesh header is there, also checks skb len */ 2498 if (!pskb_may_pull(rx->skb, 2499 hdrlen + ieee80211_get_mesh_hdrlen(mesh_hdr))) 2500 return RX_DROP_MONITOR; 2501 2502 /* reload pointers */ 2503 hdr = (struct ieee80211_hdr *) skb->data; 2504 mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen); 2505 2506 if (ieee80211_drop_unencrypted(rx, hdr->frame_control)) 2507 return RX_DROP_MONITOR; 2508 2509 /* frame is in RMC, don't forward */ 2510 if (ieee80211_is_data(hdr->frame_control) && 2511 is_multicast_ether_addr(hdr->addr1) && 2512 mesh_rmc_check(rx->sdata, hdr->addr3, mesh_hdr)) 2513 return RX_DROP_MONITOR; 2514 2515 if (!ieee80211_is_data(hdr->frame_control)) 2516 return RX_CONTINUE; 2517 2518 if (!mesh_hdr->ttl) 2519 return RX_DROP_MONITOR; 2520 2521 if (mesh_hdr->flags & MESH_FLAGS_AE) { 2522 struct mesh_path *mppath; 2523 char *proxied_addr; 2524 char *mpp_addr; 2525 2526 if (is_multicast_ether_addr(hdr->addr1)) { 2527 mpp_addr = hdr->addr3; 2528 proxied_addr = mesh_hdr->eaddr1; 2529 } else if ((mesh_hdr->flags & MESH_FLAGS_AE) == 2530 MESH_FLAGS_AE_A5_A6) { 2531 /* has_a4 already checked in ieee80211_rx_mesh_check */ 2532 mpp_addr = hdr->addr4; 2533 proxied_addr = mesh_hdr->eaddr2; 2534 } else { 2535 return RX_DROP_MONITOR; 2536 } 2537 2538 rcu_read_lock(); 2539 mppath = mpp_path_lookup(sdata, proxied_addr); 2540 if (!mppath) { 2541 mpp_path_add(sdata, proxied_addr, mpp_addr); 2542 } else { 2543 spin_lock_bh(&mppath->state_lock); 2544 if (!ether_addr_equal(mppath->mpp, mpp_addr)) 2545 memcpy(mppath->mpp, mpp_addr, ETH_ALEN); 2546 mppath->exp_time = jiffies; 2547 spin_unlock_bh(&mppath->state_lock); 2548 } 2549 rcu_read_unlock(); 2550 } 2551 2552 /* Frame has reached destination. Don't forward */ 2553 if (!is_multicast_ether_addr(hdr->addr1) && 2554 ether_addr_equal(sdata->vif.addr, hdr->addr3)) 2555 return RX_CONTINUE; 2556 2557 ac = ieee80211_select_queue_80211(sdata, skb, hdr); 2558 q = sdata->vif.hw_queue[ac]; 2559 if (ieee80211_queue_stopped(&local->hw, q)) { 2560 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion); 2561 return RX_DROP_MONITOR; 2562 } 2563 skb_set_queue_mapping(skb, q); 2564 2565 if (!--mesh_hdr->ttl) { 2566 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl); 2567 goto out; 2568 } 2569 2570 if (!ifmsh->mshcfg.dot11MeshForwarding) 2571 goto out; 2572 2573 fwd_skb = skb_copy_expand(skb, local->tx_headroom + 2574 sdata->encrypt_headroom, 0, GFP_ATOMIC); 2575 if (!fwd_skb) 2576 goto out; 2577 2578 fwd_hdr = (struct ieee80211_hdr *) fwd_skb->data; 2579 fwd_hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_RETRY); 2580 info = IEEE80211_SKB_CB(fwd_skb); 2581 memset(info, 0, sizeof(*info)); 2582 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING; 2583 info->control.vif = &rx->sdata->vif; 2584 info->control.jiffies = jiffies; 2585 if (is_multicast_ether_addr(fwd_hdr->addr1)) { 2586 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_mcast); 2587 memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN); 2588 /* update power mode indication when forwarding */ 2589 ieee80211_mps_set_frame_flags(sdata, NULL, fwd_hdr); 2590 } else if (!mesh_nexthop_lookup(sdata, fwd_skb)) { 2591 /* mesh power mode flags updated in mesh_nexthop_lookup */ 2592 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast); 2593 } else { 2594 /* unable to resolve next hop */ 2595 mesh_path_error_tx(sdata, ifmsh->mshcfg.element_ttl, 2596 fwd_hdr->addr3, 0, 2597 WLAN_REASON_MESH_PATH_NOFORWARD, 2598 fwd_hdr->addr2); 2599 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_no_route); 2600 kfree_skb(fwd_skb); 2601 return RX_DROP_MONITOR; 2602 } 2603 2604 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames); 2605 ieee80211_add_pending_skb(local, fwd_skb); 2606 out: 2607 if (is_multicast_ether_addr(hdr->addr1)) 2608 return RX_CONTINUE; 2609 return RX_DROP_MONITOR; 2610 } 2611 #endif 2612 2613 static ieee80211_rx_result debug_noinline 2614 ieee80211_rx_h_data(struct ieee80211_rx_data *rx) 2615 { 2616 struct ieee80211_sub_if_data *sdata = rx->sdata; 2617 struct ieee80211_local *local = rx->local; 2618 struct net_device *dev = sdata->dev; 2619 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data; 2620 __le16 fc = hdr->frame_control; 2621 bool port_control; 2622 int err; 2623 2624 if (unlikely(!ieee80211_is_data(hdr->frame_control))) 2625 return RX_CONTINUE; 2626 2627 if (unlikely(!ieee80211_is_data_present(hdr->frame_control))) 2628 return RX_DROP_MONITOR; 2629 2630 /* 2631 * Send unexpected-4addr-frame event to hostapd. For older versions, 2632 * also drop the frame to cooked monitor interfaces. 2633 */ 2634 if (ieee80211_has_a4(hdr->frame_control) && 2635 sdata->vif.type == NL80211_IFTYPE_AP) { 2636 if (rx->sta && 2637 !test_and_set_sta_flag(rx->sta, WLAN_STA_4ADDR_EVENT)) 2638 cfg80211_rx_unexpected_4addr_frame( 2639 rx->sdata->dev, rx->sta->sta.addr, GFP_ATOMIC); 2640 return RX_DROP_MONITOR; 2641 } 2642 2643 err = __ieee80211_data_to_8023(rx, &port_control); 2644 if (unlikely(err)) 2645 return RX_DROP_UNUSABLE; 2646 2647 if (!ieee80211_frame_allowed(rx, fc)) 2648 return RX_DROP_MONITOR; 2649 2650 /* directly handle TDLS channel switch requests/responses */ 2651 if (unlikely(((struct ethhdr *)rx->skb->data)->h_proto == 2652 cpu_to_be16(ETH_P_TDLS))) { 2653 struct ieee80211_tdls_data *tf = (void *)rx->skb->data; 2654 2655 if (pskb_may_pull(rx->skb, 2656 offsetof(struct ieee80211_tdls_data, u)) && 2657 tf->payload_type == WLAN_TDLS_SNAP_RFTYPE && 2658 tf->category == WLAN_CATEGORY_TDLS && 2659 (tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_REQUEST || 2660 tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_RESPONSE)) { 2661 skb_queue_tail(&local->skb_queue_tdls_chsw, rx->skb); 2662 schedule_work(&local->tdls_chsw_work); 2663 if (rx->sta) 2664 rx->sta->rx_stats.packets++; 2665 2666 return RX_QUEUED; 2667 } 2668 } 2669 2670 if (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN && 2671 unlikely(port_control) && sdata->bss) { 2672 sdata = container_of(sdata->bss, struct ieee80211_sub_if_data, 2673 u.ap); 2674 dev = sdata->dev; 2675 rx->sdata = sdata; 2676 } 2677 2678 rx->skb->dev = dev; 2679 2680 if (!ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS) && 2681 local->ps_sdata && local->hw.conf.dynamic_ps_timeout > 0 && 2682 !is_multicast_ether_addr( 2683 ((struct ethhdr *)rx->skb->data)->h_dest) && 2684 (!local->scanning && 2685 !test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))) 2686 mod_timer(&local->dynamic_ps_timer, jiffies + 2687 msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout)); 2688 2689 ieee80211_deliver_skb(rx); 2690 2691 return RX_QUEUED; 2692 } 2693 2694 static ieee80211_rx_result debug_noinline 2695 ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames) 2696 { 2697 struct sk_buff *skb = rx->skb; 2698 struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data; 2699 struct tid_ampdu_rx *tid_agg_rx; 2700 u16 start_seq_num; 2701 u16 tid; 2702 2703 if (likely(!ieee80211_is_ctl(bar->frame_control))) 2704 return RX_CONTINUE; 2705 2706 if (ieee80211_is_back_req(bar->frame_control)) { 2707 struct { 2708 __le16 control, start_seq_num; 2709 } __packed bar_data; 2710 struct ieee80211_event event = { 2711 .type = BAR_RX_EVENT, 2712 }; 2713 2714 if (!rx->sta) 2715 return RX_DROP_MONITOR; 2716 2717 if (skb_copy_bits(skb, offsetof(struct ieee80211_bar, control), 2718 &bar_data, sizeof(bar_data))) 2719 return RX_DROP_MONITOR; 2720 2721 tid = le16_to_cpu(bar_data.control) >> 12; 2722 2723 if (!test_bit(tid, rx->sta->ampdu_mlme.agg_session_valid) && 2724 !test_and_set_bit(tid, rx->sta->ampdu_mlme.unexpected_agg)) 2725 ieee80211_send_delba(rx->sdata, rx->sta->sta.addr, tid, 2726 WLAN_BACK_RECIPIENT, 2727 WLAN_REASON_QSTA_REQUIRE_SETUP); 2728 2729 tid_agg_rx = rcu_dereference(rx->sta->ampdu_mlme.tid_rx[tid]); 2730 if (!tid_agg_rx) 2731 return RX_DROP_MONITOR; 2732 2733 start_seq_num = le16_to_cpu(bar_data.start_seq_num) >> 4; 2734 event.u.ba.tid = tid; 2735 event.u.ba.ssn = start_seq_num; 2736 event.u.ba.sta = &rx->sta->sta; 2737 2738 /* reset session timer */ 2739 if (tid_agg_rx->timeout) 2740 mod_timer(&tid_agg_rx->session_timer, 2741 TU_TO_EXP_TIME(tid_agg_rx->timeout)); 2742 2743 spin_lock(&tid_agg_rx->reorder_lock); 2744 /* release stored frames up to start of BAR */ 2745 ieee80211_release_reorder_frames(rx->sdata, tid_agg_rx, 2746 start_seq_num, frames); 2747 spin_unlock(&tid_agg_rx->reorder_lock); 2748 2749 drv_event_callback(rx->local, rx->sdata, &event); 2750 2751 kfree_skb(skb); 2752 return RX_QUEUED; 2753 } 2754 2755 /* 2756 * After this point, we only want management frames, 2757 * so we can drop all remaining control frames to 2758 * cooked monitor interfaces. 2759 */ 2760 return RX_DROP_MONITOR; 2761 } 2762 2763 static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata, 2764 struct ieee80211_mgmt *mgmt, 2765 size_t len) 2766 { 2767 struct ieee80211_local *local = sdata->local; 2768 struct sk_buff *skb; 2769 struct ieee80211_mgmt *resp; 2770 2771 if (!ether_addr_equal(mgmt->da, sdata->vif.addr)) { 2772 /* Not to own unicast address */ 2773 return; 2774 } 2775 2776 if (!ether_addr_equal(mgmt->sa, sdata->u.mgd.bssid) || 2777 !ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid)) { 2778 /* Not from the current AP or not associated yet. */ 2779 return; 2780 } 2781 2782 if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) { 2783 /* Too short SA Query request frame */ 2784 return; 2785 } 2786 2787 skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom); 2788 if (skb == NULL) 2789 return; 2790 2791 skb_reserve(skb, local->hw.extra_tx_headroom); 2792 resp = skb_put_zero(skb, 24); 2793 memcpy(resp->da, mgmt->sa, ETH_ALEN); 2794 memcpy(resp->sa, sdata->vif.addr, ETH_ALEN); 2795 memcpy(resp->bssid, sdata->u.mgd.bssid, ETH_ALEN); 2796 resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | 2797 IEEE80211_STYPE_ACTION); 2798 skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query)); 2799 resp->u.action.category = WLAN_CATEGORY_SA_QUERY; 2800 resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE; 2801 memcpy(resp->u.action.u.sa_query.trans_id, 2802 mgmt->u.action.u.sa_query.trans_id, 2803 WLAN_SA_QUERY_TR_ID_LEN); 2804 2805 ieee80211_tx_skb(sdata, skb); 2806 } 2807 2808 static ieee80211_rx_result debug_noinline 2809 ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx) 2810 { 2811 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data; 2812 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 2813 2814 /* 2815 * From here on, look only at management frames. 2816 * Data and control frames are already handled, 2817 * and unknown (reserved) frames are useless. 2818 */ 2819 if (rx->skb->len < 24) 2820 return RX_DROP_MONITOR; 2821 2822 if (!ieee80211_is_mgmt(mgmt->frame_control)) 2823 return RX_DROP_MONITOR; 2824 2825 if (rx->sdata->vif.type == NL80211_IFTYPE_AP && 2826 ieee80211_is_beacon(mgmt->frame_control) && 2827 !(rx->flags & IEEE80211_RX_BEACON_REPORTED)) { 2828 int sig = 0; 2829 2830 if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM) && 2831 !(status->flag & RX_FLAG_NO_SIGNAL_VAL)) 2832 sig = status->signal; 2833 2834 cfg80211_report_obss_beacon(rx->local->hw.wiphy, 2835 rx->skb->data, rx->skb->len, 2836 status->freq, sig); 2837 rx->flags |= IEEE80211_RX_BEACON_REPORTED; 2838 } 2839 2840 if (ieee80211_drop_unencrypted_mgmt(rx)) 2841 return RX_DROP_UNUSABLE; 2842 2843 return RX_CONTINUE; 2844 } 2845 2846 static ieee80211_rx_result debug_noinline 2847 ieee80211_rx_h_action(struct ieee80211_rx_data *rx) 2848 { 2849 struct ieee80211_local *local = rx->local; 2850 struct ieee80211_sub_if_data *sdata = rx->sdata; 2851 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data; 2852 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 2853 int len = rx->skb->len; 2854 2855 if (!ieee80211_is_action(mgmt->frame_control)) 2856 return RX_CONTINUE; 2857 2858 /* drop too small frames */ 2859 if (len < IEEE80211_MIN_ACTION_SIZE) 2860 return RX_DROP_UNUSABLE; 2861 2862 if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC && 2863 mgmt->u.action.category != WLAN_CATEGORY_SELF_PROTECTED && 2864 mgmt->u.action.category != WLAN_CATEGORY_SPECTRUM_MGMT) 2865 return RX_DROP_UNUSABLE; 2866 2867 switch (mgmt->u.action.category) { 2868 case WLAN_CATEGORY_HT: 2869 /* reject HT action frames from stations not supporting HT */ 2870 if (!rx->sta->sta.ht_cap.ht_supported) 2871 goto invalid; 2872 2873 if (sdata->vif.type != NL80211_IFTYPE_STATION && 2874 sdata->vif.type != NL80211_IFTYPE_MESH_POINT && 2875 sdata->vif.type != NL80211_IFTYPE_AP_VLAN && 2876 sdata->vif.type != NL80211_IFTYPE_AP && 2877 sdata->vif.type != NL80211_IFTYPE_ADHOC) 2878 break; 2879 2880 /* verify action & smps_control/chanwidth are present */ 2881 if (len < IEEE80211_MIN_ACTION_SIZE + 2) 2882 goto invalid; 2883 2884 switch (mgmt->u.action.u.ht_smps.action) { 2885 case WLAN_HT_ACTION_SMPS: { 2886 struct ieee80211_supported_band *sband; 2887 enum ieee80211_smps_mode smps_mode; 2888 struct sta_opmode_info sta_opmode = {}; 2889 2890 /* convert to HT capability */ 2891 switch (mgmt->u.action.u.ht_smps.smps_control) { 2892 case WLAN_HT_SMPS_CONTROL_DISABLED: 2893 smps_mode = IEEE80211_SMPS_OFF; 2894 break; 2895 case WLAN_HT_SMPS_CONTROL_STATIC: 2896 smps_mode = IEEE80211_SMPS_STATIC; 2897 break; 2898 case WLAN_HT_SMPS_CONTROL_DYNAMIC: 2899 smps_mode = IEEE80211_SMPS_DYNAMIC; 2900 break; 2901 default: 2902 goto invalid; 2903 } 2904 2905 /* if no change do nothing */ 2906 if (rx->sta->sta.smps_mode == smps_mode) 2907 goto handled; 2908 rx->sta->sta.smps_mode = smps_mode; 2909 sta_opmode.smps_mode = 2910 ieee80211_smps_mode_to_smps_mode(smps_mode); 2911 sta_opmode.changed = STA_OPMODE_SMPS_MODE_CHANGED; 2912 2913 sband = rx->local->hw.wiphy->bands[status->band]; 2914 2915 rate_control_rate_update(local, sband, rx->sta, 2916 IEEE80211_RC_SMPS_CHANGED); 2917 cfg80211_sta_opmode_change_notify(sdata->dev, 2918 rx->sta->addr, 2919 &sta_opmode, 2920 GFP_KERNEL); 2921 goto handled; 2922 } 2923 case WLAN_HT_ACTION_NOTIFY_CHANWIDTH: { 2924 struct ieee80211_supported_band *sband; 2925 u8 chanwidth = mgmt->u.action.u.ht_notify_cw.chanwidth; 2926 enum ieee80211_sta_rx_bandwidth max_bw, new_bw; 2927 struct sta_opmode_info sta_opmode = {}; 2928 2929 /* If it doesn't support 40 MHz it can't change ... */ 2930 if (!(rx->sta->sta.ht_cap.cap & 2931 IEEE80211_HT_CAP_SUP_WIDTH_20_40)) 2932 goto handled; 2933 2934 if (chanwidth == IEEE80211_HT_CHANWIDTH_20MHZ) 2935 max_bw = IEEE80211_STA_RX_BW_20; 2936 else 2937 max_bw = ieee80211_sta_cap_rx_bw(rx->sta); 2938 2939 /* set cur_max_bandwidth and recalc sta bw */ 2940 rx->sta->cur_max_bandwidth = max_bw; 2941 new_bw = ieee80211_sta_cur_vht_bw(rx->sta); 2942 2943 if (rx->sta->sta.bandwidth == new_bw) 2944 goto handled; 2945 2946 rx->sta->sta.bandwidth = new_bw; 2947 sband = rx->local->hw.wiphy->bands[status->band]; 2948 sta_opmode.bw = 2949 ieee80211_sta_rx_bw_to_chan_width(rx->sta); 2950 sta_opmode.changed = STA_OPMODE_MAX_BW_CHANGED; 2951 2952 rate_control_rate_update(local, sband, rx->sta, 2953 IEEE80211_RC_BW_CHANGED); 2954 cfg80211_sta_opmode_change_notify(sdata->dev, 2955 rx->sta->addr, 2956 &sta_opmode, 2957 GFP_KERNEL); 2958 goto handled; 2959 } 2960 default: 2961 goto invalid; 2962 } 2963 2964 break; 2965 case WLAN_CATEGORY_PUBLIC: 2966 if (len < IEEE80211_MIN_ACTION_SIZE + 1) 2967 goto invalid; 2968 if (sdata->vif.type != NL80211_IFTYPE_STATION) 2969 break; 2970 if (!rx->sta) 2971 break; 2972 if (!ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid)) 2973 break; 2974 if (mgmt->u.action.u.ext_chan_switch.action_code != 2975 WLAN_PUB_ACTION_EXT_CHANSW_ANN) 2976 break; 2977 if (len < offsetof(struct ieee80211_mgmt, 2978 u.action.u.ext_chan_switch.variable)) 2979 goto invalid; 2980 goto queue; 2981 case WLAN_CATEGORY_VHT: 2982 if (sdata->vif.type != NL80211_IFTYPE_STATION && 2983 sdata->vif.type != NL80211_IFTYPE_MESH_POINT && 2984 sdata->vif.type != NL80211_IFTYPE_AP_VLAN && 2985 sdata->vif.type != NL80211_IFTYPE_AP && 2986 sdata->vif.type != NL80211_IFTYPE_ADHOC) 2987 break; 2988 2989 /* verify action code is present */ 2990 if (len < IEEE80211_MIN_ACTION_SIZE + 1) 2991 goto invalid; 2992 2993 switch (mgmt->u.action.u.vht_opmode_notif.action_code) { 2994 case WLAN_VHT_ACTION_OPMODE_NOTIF: { 2995 /* verify opmode is present */ 2996 if (len < IEEE80211_MIN_ACTION_SIZE + 2) 2997 goto invalid; 2998 goto queue; 2999 } 3000 case WLAN_VHT_ACTION_GROUPID_MGMT: { 3001 if (len < IEEE80211_MIN_ACTION_SIZE + 25) 3002 goto invalid; 3003 goto queue; 3004 } 3005 default: 3006 break; 3007 } 3008 break; 3009 case WLAN_CATEGORY_BACK: 3010 if (sdata->vif.type != NL80211_IFTYPE_STATION && 3011 sdata->vif.type != NL80211_IFTYPE_MESH_POINT && 3012 sdata->vif.type != NL80211_IFTYPE_AP_VLAN && 3013 sdata->vif.type != NL80211_IFTYPE_AP && 3014 sdata->vif.type != NL80211_IFTYPE_ADHOC) 3015 break; 3016 3017 /* verify action_code is present */ 3018 if (len < IEEE80211_MIN_ACTION_SIZE + 1) 3019 break; 3020 3021 switch (mgmt->u.action.u.addba_req.action_code) { 3022 case WLAN_ACTION_ADDBA_REQ: 3023 if (len < (IEEE80211_MIN_ACTION_SIZE + 3024 sizeof(mgmt->u.action.u.addba_req))) 3025 goto invalid; 3026 break; 3027 case WLAN_ACTION_ADDBA_RESP: 3028 if (len < (IEEE80211_MIN_ACTION_SIZE + 3029 sizeof(mgmt->u.action.u.addba_resp))) 3030 goto invalid; 3031 break; 3032 case WLAN_ACTION_DELBA: 3033 if (len < (IEEE80211_MIN_ACTION_SIZE + 3034 sizeof(mgmt->u.action.u.delba))) 3035 goto invalid; 3036 break; 3037 default: 3038 goto invalid; 3039 } 3040 3041 goto queue; 3042 case WLAN_CATEGORY_SPECTRUM_MGMT: 3043 /* verify action_code is present */ 3044 if (len < IEEE80211_MIN_ACTION_SIZE + 1) 3045 break; 3046 3047 switch (mgmt->u.action.u.measurement.action_code) { 3048 case WLAN_ACTION_SPCT_MSR_REQ: 3049 if (status->band != NL80211_BAND_5GHZ) 3050 break; 3051 3052 if (len < (IEEE80211_MIN_ACTION_SIZE + 3053 sizeof(mgmt->u.action.u.measurement))) 3054 break; 3055 3056 if (sdata->vif.type != NL80211_IFTYPE_STATION) 3057 break; 3058 3059 ieee80211_process_measurement_req(sdata, mgmt, len); 3060 goto handled; 3061 case WLAN_ACTION_SPCT_CHL_SWITCH: { 3062 u8 *bssid; 3063 if (len < (IEEE80211_MIN_ACTION_SIZE + 3064 sizeof(mgmt->u.action.u.chan_switch))) 3065 break; 3066 3067 if (sdata->vif.type != NL80211_IFTYPE_STATION && 3068 sdata->vif.type != NL80211_IFTYPE_ADHOC && 3069 sdata->vif.type != NL80211_IFTYPE_MESH_POINT) 3070 break; 3071 3072 if (sdata->vif.type == NL80211_IFTYPE_STATION) 3073 bssid = sdata->u.mgd.bssid; 3074 else if (sdata->vif.type == NL80211_IFTYPE_ADHOC) 3075 bssid = sdata->u.ibss.bssid; 3076 else if (sdata->vif.type == NL80211_IFTYPE_MESH_POINT) 3077 bssid = mgmt->sa; 3078 else 3079 break; 3080 3081 if (!ether_addr_equal(mgmt->bssid, bssid)) 3082 break; 3083 3084 goto queue; 3085 } 3086 } 3087 break; 3088 case WLAN_CATEGORY_SA_QUERY: 3089 if (len < (IEEE80211_MIN_ACTION_SIZE + 3090 sizeof(mgmt->u.action.u.sa_query))) 3091 break; 3092 3093 switch (mgmt->u.action.u.sa_query.action) { 3094 case WLAN_ACTION_SA_QUERY_REQUEST: 3095 if (sdata->vif.type != NL80211_IFTYPE_STATION) 3096 break; 3097 ieee80211_process_sa_query_req(sdata, mgmt, len); 3098 goto handled; 3099 } 3100 break; 3101 case WLAN_CATEGORY_SELF_PROTECTED: 3102 if (len < (IEEE80211_MIN_ACTION_SIZE + 3103 sizeof(mgmt->u.action.u.self_prot.action_code))) 3104 break; 3105 3106 switch (mgmt->u.action.u.self_prot.action_code) { 3107 case WLAN_SP_MESH_PEERING_OPEN: 3108 case WLAN_SP_MESH_PEERING_CLOSE: 3109 case WLAN_SP_MESH_PEERING_CONFIRM: 3110 if (!ieee80211_vif_is_mesh(&sdata->vif)) 3111 goto invalid; 3112 if (sdata->u.mesh.user_mpm) 3113 /* userspace handles this frame */ 3114 break; 3115 goto queue; 3116 case WLAN_SP_MGK_INFORM: 3117 case WLAN_SP_MGK_ACK: 3118 if (!ieee80211_vif_is_mesh(&sdata->vif)) 3119 goto invalid; 3120 break; 3121 } 3122 break; 3123 case WLAN_CATEGORY_MESH_ACTION: 3124 if (len < (IEEE80211_MIN_ACTION_SIZE + 3125 sizeof(mgmt->u.action.u.mesh_action.action_code))) 3126 break; 3127 3128 if (!ieee80211_vif_is_mesh(&sdata->vif)) 3129 break; 3130 if (mesh_action_is_path_sel(mgmt) && 3131 !mesh_path_sel_is_hwmp(sdata)) 3132 break; 3133 goto queue; 3134 } 3135 3136 return RX_CONTINUE; 3137 3138 invalid: 3139 status->rx_flags |= IEEE80211_RX_MALFORMED_ACTION_FRM; 3140 /* will return in the next handlers */ 3141 return RX_CONTINUE; 3142 3143 handled: 3144 if (rx->sta) 3145 rx->sta->rx_stats.packets++; 3146 dev_kfree_skb(rx->skb); 3147 return RX_QUEUED; 3148 3149 queue: 3150 skb_queue_tail(&sdata->skb_queue, rx->skb); 3151 ieee80211_queue_work(&local->hw, &sdata->work); 3152 if (rx->sta) 3153 rx->sta->rx_stats.packets++; 3154 return RX_QUEUED; 3155 } 3156 3157 static ieee80211_rx_result debug_noinline 3158 ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx) 3159 { 3160 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 3161 int sig = 0; 3162 3163 /* skip known-bad action frames and return them in the next handler */ 3164 if (status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) 3165 return RX_CONTINUE; 3166 3167 /* 3168 * Getting here means the kernel doesn't know how to handle 3169 * it, but maybe userspace does ... include returned frames 3170 * so userspace can register for those to know whether ones 3171 * it transmitted were processed or returned. 3172 */ 3173 3174 if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM) && 3175 !(status->flag & RX_FLAG_NO_SIGNAL_VAL)) 3176 sig = status->signal; 3177 3178 if (cfg80211_rx_mgmt(&rx->sdata->wdev, status->freq, sig, 3179 rx->skb->data, rx->skb->len, 0)) { 3180 if (rx->sta) 3181 rx->sta->rx_stats.packets++; 3182 dev_kfree_skb(rx->skb); 3183 return RX_QUEUED; 3184 } 3185 3186 return RX_CONTINUE; 3187 } 3188 3189 static ieee80211_rx_result debug_noinline 3190 ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx) 3191 { 3192 struct ieee80211_local *local = rx->local; 3193 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data; 3194 struct sk_buff *nskb; 3195 struct ieee80211_sub_if_data *sdata = rx->sdata; 3196 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb); 3197 3198 if (!ieee80211_is_action(mgmt->frame_control)) 3199 return RX_CONTINUE; 3200 3201 /* 3202 * For AP mode, hostapd is responsible for handling any action 3203 * frames that we didn't handle, including returning unknown 3204 * ones. For all other modes we will return them to the sender, 3205 * setting the 0x80 bit in the action category, as required by 3206 * 802.11-2012 9.24.4. 3207 * Newer versions of hostapd shall also use the management frame 3208 * registration mechanisms, but older ones still use cooked 3209 * monitor interfaces so push all frames there. 3210 */ 3211 if (!(status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) && 3212 (sdata->vif.type == NL80211_IFTYPE_AP || 3213 sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) 3214 return RX_DROP_MONITOR; 3215 3216 if (is_multicast_ether_addr(mgmt->da)) 3217 return RX_DROP_MONITOR; 3218 3219 /* do not return rejected action frames */ 3220 if (mgmt->u.action.category & 0x80) 3221 return RX_DROP_UNUSABLE; 3222 3223 nskb = skb_copy_expand(rx->skb, local->hw.extra_tx_headroom, 0, 3224 GFP_ATOMIC); 3225 if (nskb) { 3226 struct ieee80211_mgmt *nmgmt = (void *)nskb->data; 3227 3228 nmgmt->u.action.category |= 0x80; 3229 memcpy(nmgmt->da, nmgmt->sa, ETH_ALEN); 3230 memcpy(nmgmt->sa, rx->sdata->vif.addr, ETH_ALEN); 3231 3232 memset(nskb->cb, 0, sizeof(nskb->cb)); 3233 3234 if (rx->sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) { 3235 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(nskb); 3236 3237 info->flags = IEEE80211_TX_CTL_TX_OFFCHAN | 3238 IEEE80211_TX_INTFL_OFFCHAN_TX_OK | 3239 IEEE80211_TX_CTL_NO_CCK_RATE; 3240 if (ieee80211_hw_check(&local->hw, QUEUE_CONTROL)) 3241 info->hw_queue = 3242 local->hw.offchannel_tx_hw_queue; 3243 } 3244 3245 __ieee80211_tx_skb_tid_band(rx->sdata, nskb, 7, 3246 status->band); 3247 } 3248 dev_kfree_skb(rx->skb); 3249 return RX_QUEUED; 3250 } 3251 3252 static ieee80211_rx_result debug_noinline 3253 ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx) 3254 { 3255 struct ieee80211_sub_if_data *sdata = rx->sdata; 3256 struct ieee80211_mgmt *mgmt = (void *)rx->skb->data; 3257 __le16 stype; 3258 3259 stype = mgmt->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE); 3260 3261 if (!ieee80211_vif_is_mesh(&sdata->vif) && 3262 sdata->vif.type != NL80211_IFTYPE_ADHOC && 3263 sdata->vif.type != NL80211_IFTYPE_OCB && 3264 sdata->vif.type != NL80211_IFTYPE_STATION) 3265 return RX_DROP_MONITOR; 3266 3267 switch (stype) { 3268 case cpu_to_le16(IEEE80211_STYPE_AUTH): 3269 case cpu_to_le16(IEEE80211_STYPE_BEACON): 3270 case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP): 3271 /* process for all: mesh, mlme, ibss */ 3272 break; 3273 case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP): 3274 case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP): 3275 case cpu_to_le16(IEEE80211_STYPE_DEAUTH): 3276 case cpu_to_le16(IEEE80211_STYPE_DISASSOC): 3277 if (is_multicast_ether_addr(mgmt->da) && 3278 !is_broadcast_ether_addr(mgmt->da)) 3279 return RX_DROP_MONITOR; 3280 3281 /* process only for station */ 3282 if (sdata->vif.type != NL80211_IFTYPE_STATION) 3283 return RX_DROP_MONITOR; 3284 break; 3285 case cpu_to_le16(IEEE80211_STYPE_PROBE_REQ): 3286 /* process only for ibss and mesh */ 3287 if (sdata->vif.type != NL80211_IFTYPE_ADHOC && 3288 sdata->vif.type != NL80211_IFTYPE_MESH_POINT) 3289 return RX_DROP_MONITOR; 3290 break; 3291 default: 3292 return RX_DROP_MONITOR; 3293 } 3294 3295 /* queue up frame and kick off work to process it */ 3296 skb_queue_tail(&sdata->skb_queue, rx->skb); 3297 ieee80211_queue_work(&rx->local->hw, &sdata->work); 3298 if (rx->sta) 3299 rx->sta->rx_stats.packets++; 3300 3301 return RX_QUEUED; 3302 } 3303 3304 static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx, 3305 struct ieee80211_rate *rate) 3306 { 3307 struct ieee80211_sub_if_data *sdata; 3308 struct ieee80211_local *local = rx->local; 3309 struct sk_buff *skb = rx->skb, *skb2; 3310 struct net_device *prev_dev = NULL; 3311 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 3312 int needed_headroom; 3313 3314 /* 3315 * If cooked monitor has been processed already, then 3316 * don't do it again. If not, set the flag. 3317 */ 3318 if (rx->flags & IEEE80211_RX_CMNTR) 3319 goto out_free_skb; 3320 rx->flags |= IEEE80211_RX_CMNTR; 3321 3322 /* If there are no cooked monitor interfaces, just free the SKB */ 3323 if (!local->cooked_mntrs) 3324 goto out_free_skb; 3325 3326 /* vendor data is long removed here */ 3327 status->flag &= ~RX_FLAG_RADIOTAP_VENDOR_DATA; 3328 /* room for the radiotap header based on driver features */ 3329 needed_headroom = ieee80211_rx_radiotap_hdrlen(local, status, skb); 3330 3331 if (skb_headroom(skb) < needed_headroom && 3332 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) 3333 goto out_free_skb; 3334 3335 /* prepend radiotap information */ 3336 ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom, 3337 false); 3338 3339 skb_reset_mac_header(skb); 3340 skb->ip_summed = CHECKSUM_UNNECESSARY; 3341 skb->pkt_type = PACKET_OTHERHOST; 3342 skb->protocol = htons(ETH_P_802_2); 3343 3344 list_for_each_entry_rcu(sdata, &local->interfaces, list) { 3345 if (!ieee80211_sdata_running(sdata)) 3346 continue; 3347 3348 if (sdata->vif.type != NL80211_IFTYPE_MONITOR || 3349 !(sdata->u.mntr.flags & MONITOR_FLAG_COOK_FRAMES)) 3350 continue; 3351 3352 if (prev_dev) { 3353 skb2 = skb_clone(skb, GFP_ATOMIC); 3354 if (skb2) { 3355 skb2->dev = prev_dev; 3356 netif_receive_skb(skb2); 3357 } 3358 } 3359 3360 prev_dev = sdata->dev; 3361 ieee80211_rx_stats(sdata->dev, skb->len); 3362 } 3363 3364 if (prev_dev) { 3365 skb->dev = prev_dev; 3366 netif_receive_skb(skb); 3367 return; 3368 } 3369 3370 out_free_skb: 3371 dev_kfree_skb(skb); 3372 } 3373 3374 static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx, 3375 ieee80211_rx_result res) 3376 { 3377 switch (res) { 3378 case RX_DROP_MONITOR: 3379 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop); 3380 if (rx->sta) 3381 rx->sta->rx_stats.dropped++; 3382 /* fall through */ 3383 case RX_CONTINUE: { 3384 struct ieee80211_rate *rate = NULL; 3385 struct ieee80211_supported_band *sband; 3386 struct ieee80211_rx_status *status; 3387 3388 status = IEEE80211_SKB_RXCB((rx->skb)); 3389 3390 sband = rx->local->hw.wiphy->bands[status->band]; 3391 if (!(status->encoding == RX_ENC_HT) && 3392 !(status->encoding == RX_ENC_VHT)) 3393 rate = &sband->bitrates[status->rate_idx]; 3394 3395 ieee80211_rx_cooked_monitor(rx, rate); 3396 break; 3397 } 3398 case RX_DROP_UNUSABLE: 3399 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop); 3400 if (rx->sta) 3401 rx->sta->rx_stats.dropped++; 3402 dev_kfree_skb(rx->skb); 3403 break; 3404 case RX_QUEUED: 3405 I802_DEBUG_INC(rx->sdata->local->rx_handlers_queued); 3406 break; 3407 } 3408 } 3409 3410 static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx, 3411 struct sk_buff_head *frames) 3412 { 3413 ieee80211_rx_result res = RX_DROP_MONITOR; 3414 struct sk_buff *skb; 3415 3416 #define CALL_RXH(rxh) \ 3417 do { \ 3418 res = rxh(rx); \ 3419 if (res != RX_CONTINUE) \ 3420 goto rxh_next; \ 3421 } while (0) 3422 3423 /* Lock here to avoid hitting all of the data used in the RX 3424 * path (e.g. key data, station data, ...) concurrently when 3425 * a frame is released from the reorder buffer due to timeout 3426 * from the timer, potentially concurrently with RX from the 3427 * driver. 3428 */ 3429 spin_lock_bh(&rx->local->rx_path_lock); 3430 3431 while ((skb = __skb_dequeue(frames))) { 3432 /* 3433 * all the other fields are valid across frames 3434 * that belong to an aMPDU since they are on the 3435 * same TID from the same station 3436 */ 3437 rx->skb = skb; 3438 3439 CALL_RXH(ieee80211_rx_h_check_more_data); 3440 CALL_RXH(ieee80211_rx_h_uapsd_and_pspoll); 3441 CALL_RXH(ieee80211_rx_h_sta_process); 3442 CALL_RXH(ieee80211_rx_h_decrypt); 3443 CALL_RXH(ieee80211_rx_h_defragment); 3444 CALL_RXH(ieee80211_rx_h_michael_mic_verify); 3445 /* must be after MMIC verify so header is counted in MPDU mic */ 3446 #ifdef CONFIG_MAC80211_MESH 3447 if (ieee80211_vif_is_mesh(&rx->sdata->vif)) 3448 CALL_RXH(ieee80211_rx_h_mesh_fwding); 3449 #endif 3450 CALL_RXH(ieee80211_rx_h_amsdu); 3451 CALL_RXH(ieee80211_rx_h_data); 3452 3453 /* special treatment -- needs the queue */ 3454 res = ieee80211_rx_h_ctrl(rx, frames); 3455 if (res != RX_CONTINUE) 3456 goto rxh_next; 3457 3458 CALL_RXH(ieee80211_rx_h_mgmt_check); 3459 CALL_RXH(ieee80211_rx_h_action); 3460 CALL_RXH(ieee80211_rx_h_userspace_mgmt); 3461 CALL_RXH(ieee80211_rx_h_action_return); 3462 CALL_RXH(ieee80211_rx_h_mgmt); 3463 3464 rxh_next: 3465 ieee80211_rx_handlers_result(rx, res); 3466 3467 #undef CALL_RXH 3468 } 3469 3470 spin_unlock_bh(&rx->local->rx_path_lock); 3471 } 3472 3473 static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx) 3474 { 3475 struct sk_buff_head reorder_release; 3476 ieee80211_rx_result res = RX_DROP_MONITOR; 3477 3478 __skb_queue_head_init(&reorder_release); 3479 3480 #define CALL_RXH(rxh) \ 3481 do { \ 3482 res = rxh(rx); \ 3483 if (res != RX_CONTINUE) \ 3484 goto rxh_next; \ 3485 } while (0) 3486 3487 CALL_RXH(ieee80211_rx_h_check_dup); 3488 CALL_RXH(ieee80211_rx_h_check); 3489 3490 ieee80211_rx_reorder_ampdu(rx, &reorder_release); 3491 3492 ieee80211_rx_handlers(rx, &reorder_release); 3493 return; 3494 3495 rxh_next: 3496 ieee80211_rx_handlers_result(rx, res); 3497 3498 #undef CALL_RXH 3499 } 3500 3501 /* 3502 * This function makes calls into the RX path, therefore 3503 * it has to be invoked under RCU read lock. 3504 */ 3505 void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid) 3506 { 3507 struct sk_buff_head frames; 3508 struct ieee80211_rx_data rx = { 3509 .sta = sta, 3510 .sdata = sta->sdata, 3511 .local = sta->local, 3512 /* This is OK -- must be QoS data frame */ 3513 .security_idx = tid, 3514 .seqno_idx = tid, 3515 .napi = NULL, /* must be NULL to not have races */ 3516 }; 3517 struct tid_ampdu_rx *tid_agg_rx; 3518 3519 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]); 3520 if (!tid_agg_rx) 3521 return; 3522 3523 __skb_queue_head_init(&frames); 3524 3525 spin_lock(&tid_agg_rx->reorder_lock); 3526 ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames); 3527 spin_unlock(&tid_agg_rx->reorder_lock); 3528 3529 if (!skb_queue_empty(&frames)) { 3530 struct ieee80211_event event = { 3531 .type = BA_FRAME_TIMEOUT, 3532 .u.ba.tid = tid, 3533 .u.ba.sta = &sta->sta, 3534 }; 3535 drv_event_callback(rx.local, rx.sdata, &event); 3536 } 3537 3538 ieee80211_rx_handlers(&rx, &frames); 3539 } 3540 3541 void ieee80211_mark_rx_ba_filtered_frames(struct ieee80211_sta *pubsta, u8 tid, 3542 u16 ssn, u64 filtered, 3543 u16 received_mpdus) 3544 { 3545 struct sta_info *sta; 3546 struct tid_ampdu_rx *tid_agg_rx; 3547 struct sk_buff_head frames; 3548 struct ieee80211_rx_data rx = { 3549 /* This is OK -- must be QoS data frame */ 3550 .security_idx = tid, 3551 .seqno_idx = tid, 3552 }; 3553 int i, diff; 3554 3555 if (WARN_ON(!pubsta || tid >= IEEE80211_NUM_TIDS)) 3556 return; 3557 3558 __skb_queue_head_init(&frames); 3559 3560 sta = container_of(pubsta, struct sta_info, sta); 3561 3562 rx.sta = sta; 3563 rx.sdata = sta->sdata; 3564 rx.local = sta->local; 3565 3566 rcu_read_lock(); 3567 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]); 3568 if (!tid_agg_rx) 3569 goto out; 3570 3571 spin_lock_bh(&tid_agg_rx->reorder_lock); 3572 3573 if (received_mpdus >= IEEE80211_SN_MODULO >> 1) { 3574 int release; 3575 3576 /* release all frames in the reorder buffer */ 3577 release = (tid_agg_rx->head_seq_num + tid_agg_rx->buf_size) % 3578 IEEE80211_SN_MODULO; 3579 ieee80211_release_reorder_frames(sta->sdata, tid_agg_rx, 3580 release, &frames); 3581 /* update ssn to match received ssn */ 3582 tid_agg_rx->head_seq_num = ssn; 3583 } else { 3584 ieee80211_release_reorder_frames(sta->sdata, tid_agg_rx, ssn, 3585 &frames); 3586 } 3587 3588 /* handle the case that received ssn is behind the mac ssn. 3589 * it can be tid_agg_rx->buf_size behind and still be valid */ 3590 diff = (tid_agg_rx->head_seq_num - ssn) & IEEE80211_SN_MASK; 3591 if (diff >= tid_agg_rx->buf_size) { 3592 tid_agg_rx->reorder_buf_filtered = 0; 3593 goto release; 3594 } 3595 filtered = filtered >> diff; 3596 ssn += diff; 3597 3598 /* update bitmap */ 3599 for (i = 0; i < tid_agg_rx->buf_size; i++) { 3600 int index = (ssn + i) % tid_agg_rx->buf_size; 3601 3602 tid_agg_rx->reorder_buf_filtered &= ~BIT_ULL(index); 3603 if (filtered & BIT_ULL(i)) 3604 tid_agg_rx->reorder_buf_filtered |= BIT_ULL(index); 3605 } 3606 3607 /* now process also frames that the filter marking released */ 3608 ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames); 3609 3610 release: 3611 spin_unlock_bh(&tid_agg_rx->reorder_lock); 3612 3613 ieee80211_rx_handlers(&rx, &frames); 3614 3615 out: 3616 rcu_read_unlock(); 3617 } 3618 EXPORT_SYMBOL(ieee80211_mark_rx_ba_filtered_frames); 3619 3620 /* main receive path */ 3621 3622 static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx) 3623 { 3624 struct ieee80211_sub_if_data *sdata = rx->sdata; 3625 struct sk_buff *skb = rx->skb; 3626 struct ieee80211_hdr *hdr = (void *)skb->data; 3627 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 3628 u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type); 3629 bool multicast = is_multicast_ether_addr(hdr->addr1); 3630 3631 switch (sdata->vif.type) { 3632 case NL80211_IFTYPE_STATION: 3633 if (!bssid && !sdata->u.mgd.use_4addr) 3634 return false; 3635 if (multicast) 3636 return true; 3637 return ether_addr_equal(sdata->vif.addr, hdr->addr1); 3638 case NL80211_IFTYPE_ADHOC: 3639 if (!bssid) 3640 return false; 3641 if (ether_addr_equal(sdata->vif.addr, hdr->addr2) || 3642 ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2)) 3643 return false; 3644 if (ieee80211_is_beacon(hdr->frame_control)) 3645 return true; 3646 if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid)) 3647 return false; 3648 if (!multicast && 3649 !ether_addr_equal(sdata->vif.addr, hdr->addr1)) 3650 return false; 3651 if (!rx->sta) { 3652 int rate_idx; 3653 if (status->encoding != RX_ENC_LEGACY) 3654 rate_idx = 0; /* TODO: HT/VHT rates */ 3655 else 3656 rate_idx = status->rate_idx; 3657 ieee80211_ibss_rx_no_sta(sdata, bssid, hdr->addr2, 3658 BIT(rate_idx)); 3659 } 3660 return true; 3661 case NL80211_IFTYPE_OCB: 3662 if (!bssid) 3663 return false; 3664 if (!ieee80211_is_data_present(hdr->frame_control)) 3665 return false; 3666 if (!is_broadcast_ether_addr(bssid)) 3667 return false; 3668 if (!multicast && 3669 !ether_addr_equal(sdata->dev->dev_addr, hdr->addr1)) 3670 return false; 3671 if (!rx->sta) { 3672 int rate_idx; 3673 if (status->encoding != RX_ENC_LEGACY) 3674 rate_idx = 0; /* TODO: HT rates */ 3675 else 3676 rate_idx = status->rate_idx; 3677 ieee80211_ocb_rx_no_sta(sdata, bssid, hdr->addr2, 3678 BIT(rate_idx)); 3679 } 3680 return true; 3681 case NL80211_IFTYPE_MESH_POINT: 3682 if (ether_addr_equal(sdata->vif.addr, hdr->addr2)) 3683 return false; 3684 if (multicast) 3685 return true; 3686 return ether_addr_equal(sdata->vif.addr, hdr->addr1); 3687 case NL80211_IFTYPE_AP_VLAN: 3688 case NL80211_IFTYPE_AP: 3689 if (!bssid) 3690 return ether_addr_equal(sdata->vif.addr, hdr->addr1); 3691 3692 if (!ieee80211_bssid_match(bssid, sdata->vif.addr)) { 3693 /* 3694 * Accept public action frames even when the 3695 * BSSID doesn't match, this is used for P2P 3696 * and location updates. Note that mac80211 3697 * itself never looks at these frames. 3698 */ 3699 if (!multicast && 3700 !ether_addr_equal(sdata->vif.addr, hdr->addr1)) 3701 return false; 3702 if (ieee80211_is_public_action(hdr, skb->len)) 3703 return true; 3704 return ieee80211_is_beacon(hdr->frame_control); 3705 } 3706 3707 if (!ieee80211_has_tods(hdr->frame_control)) { 3708 /* ignore data frames to TDLS-peers */ 3709 if (ieee80211_is_data(hdr->frame_control)) 3710 return false; 3711 /* ignore action frames to TDLS-peers */ 3712 if (ieee80211_is_action(hdr->frame_control) && 3713 !is_broadcast_ether_addr(bssid) && 3714 !ether_addr_equal(bssid, hdr->addr1)) 3715 return false; 3716 } 3717 3718 /* 3719 * 802.11-2016 Table 9-26 says that for data frames, A1 must be 3720 * the BSSID - we've checked that already but may have accepted 3721 * the wildcard (ff:ff:ff:ff:ff:ff). 3722 * 3723 * It also says: 3724 * The BSSID of the Data frame is determined as follows: 3725 * a) If the STA is contained within an AP or is associated 3726 * with an AP, the BSSID is the address currently in use 3727 * by the STA contained in the AP. 3728 * 3729 * So we should not accept data frames with an address that's 3730 * multicast. 3731 * 3732 * Accepting it also opens a security problem because stations 3733 * could encrypt it with the GTK and inject traffic that way. 3734 */ 3735 if (ieee80211_is_data(hdr->frame_control) && multicast) 3736 return false; 3737 3738 return true; 3739 case NL80211_IFTYPE_WDS: 3740 if (bssid || !ieee80211_is_data(hdr->frame_control)) 3741 return false; 3742 return ether_addr_equal(sdata->u.wds.remote_addr, hdr->addr2); 3743 case NL80211_IFTYPE_P2P_DEVICE: 3744 return ieee80211_is_public_action(hdr, skb->len) || 3745 ieee80211_is_probe_req(hdr->frame_control) || 3746 ieee80211_is_probe_resp(hdr->frame_control) || 3747 ieee80211_is_beacon(hdr->frame_control); 3748 case NL80211_IFTYPE_NAN: 3749 /* Currently no frames on NAN interface are allowed */ 3750 return false; 3751 default: 3752 break; 3753 } 3754 3755 WARN_ON_ONCE(1); 3756 return false; 3757 } 3758 3759 void ieee80211_check_fast_rx(struct sta_info *sta) 3760 { 3761 struct ieee80211_sub_if_data *sdata = sta->sdata; 3762 struct ieee80211_local *local = sdata->local; 3763 struct ieee80211_key *key; 3764 struct ieee80211_fast_rx fastrx = { 3765 .dev = sdata->dev, 3766 .vif_type = sdata->vif.type, 3767 .control_port_protocol = sdata->control_port_protocol, 3768 }, *old, *new = NULL; 3769 bool assign = false; 3770 3771 /* use sparse to check that we don't return without updating */ 3772 __acquire(check_fast_rx); 3773 3774 BUILD_BUG_ON(sizeof(fastrx.rfc1042_hdr) != sizeof(rfc1042_header)); 3775 BUILD_BUG_ON(sizeof(fastrx.rfc1042_hdr) != ETH_ALEN); 3776 ether_addr_copy(fastrx.rfc1042_hdr, rfc1042_header); 3777 ether_addr_copy(fastrx.vif_addr, sdata->vif.addr); 3778 3779 fastrx.uses_rss = ieee80211_hw_check(&local->hw, USES_RSS); 3780 3781 /* fast-rx doesn't do reordering */ 3782 if (ieee80211_hw_check(&local->hw, AMPDU_AGGREGATION) && 3783 !ieee80211_hw_check(&local->hw, SUPPORTS_REORDERING_BUFFER)) 3784 goto clear; 3785 3786 switch (sdata->vif.type) { 3787 case NL80211_IFTYPE_STATION: 3788 if (sta->sta.tdls) { 3789 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr1); 3790 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr2); 3791 fastrx.expected_ds_bits = 0; 3792 } else { 3793 fastrx.sta_notify = sdata->u.mgd.probe_send_count > 0; 3794 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr1); 3795 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr3); 3796 fastrx.expected_ds_bits = 3797 cpu_to_le16(IEEE80211_FCTL_FROMDS); 3798 } 3799 3800 if (sdata->u.mgd.use_4addr && !sta->sta.tdls) { 3801 fastrx.expected_ds_bits |= 3802 cpu_to_le16(IEEE80211_FCTL_TODS); 3803 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3); 3804 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr4); 3805 } 3806 3807 if (!sdata->u.mgd.powersave) 3808 break; 3809 3810 /* software powersave is a huge mess, avoid all of it */ 3811 if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK)) 3812 goto clear; 3813 if (ieee80211_hw_check(&local->hw, SUPPORTS_PS) && 3814 !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS)) 3815 goto clear; 3816 break; 3817 case NL80211_IFTYPE_AP_VLAN: 3818 case NL80211_IFTYPE_AP: 3819 /* parallel-rx requires this, at least with calls to 3820 * ieee80211_sta_ps_transition() 3821 */ 3822 if (!ieee80211_hw_check(&local->hw, AP_LINK_PS)) 3823 goto clear; 3824 fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3); 3825 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr2); 3826 fastrx.expected_ds_bits = cpu_to_le16(IEEE80211_FCTL_TODS); 3827 3828 fastrx.internal_forward = 3829 !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) && 3830 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || 3831 !sdata->u.vlan.sta); 3832 3833 if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN && 3834 sdata->u.vlan.sta) { 3835 fastrx.expected_ds_bits |= 3836 cpu_to_le16(IEEE80211_FCTL_FROMDS); 3837 fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr4); 3838 fastrx.internal_forward = 0; 3839 } 3840 3841 break; 3842 default: 3843 goto clear; 3844 } 3845 3846 if (!test_sta_flag(sta, WLAN_STA_AUTHORIZED)) 3847 goto clear; 3848 3849 rcu_read_lock(); 3850 key = rcu_dereference(sta->ptk[sta->ptk_idx]); 3851 if (key) { 3852 switch (key->conf.cipher) { 3853 case WLAN_CIPHER_SUITE_TKIP: 3854 /* we don't want to deal with MMIC in fast-rx */ 3855 goto clear_rcu; 3856 case WLAN_CIPHER_SUITE_CCMP: 3857 case WLAN_CIPHER_SUITE_CCMP_256: 3858 case WLAN_CIPHER_SUITE_GCMP: 3859 case WLAN_CIPHER_SUITE_GCMP_256: 3860 break; 3861 default: 3862 /* we also don't want to deal with WEP or cipher scheme 3863 * since those require looking up the key idx in the 3864 * frame, rather than assuming the PTK is used 3865 * (we need to revisit this once we implement the real 3866 * PTK index, which is now valid in the spec, but we 3867 * haven't implemented that part yet) 3868 */ 3869 goto clear_rcu; 3870 } 3871 3872 fastrx.key = true; 3873 fastrx.icv_len = key->conf.icv_len; 3874 } 3875 3876 assign = true; 3877 clear_rcu: 3878 rcu_read_unlock(); 3879 clear: 3880 __release(check_fast_rx); 3881 3882 if (assign) 3883 new = kmemdup(&fastrx, sizeof(fastrx), GFP_KERNEL); 3884 3885 spin_lock_bh(&sta->lock); 3886 old = rcu_dereference_protected(sta->fast_rx, true); 3887 rcu_assign_pointer(sta->fast_rx, new); 3888 spin_unlock_bh(&sta->lock); 3889 3890 if (old) 3891 kfree_rcu(old, rcu_head); 3892 } 3893 3894 void ieee80211_clear_fast_rx(struct sta_info *sta) 3895 { 3896 struct ieee80211_fast_rx *old; 3897 3898 spin_lock_bh(&sta->lock); 3899 old = rcu_dereference_protected(sta->fast_rx, true); 3900 RCU_INIT_POINTER(sta->fast_rx, NULL); 3901 spin_unlock_bh(&sta->lock); 3902 3903 if (old) 3904 kfree_rcu(old, rcu_head); 3905 } 3906 3907 void __ieee80211_check_fast_rx_iface(struct ieee80211_sub_if_data *sdata) 3908 { 3909 struct ieee80211_local *local = sdata->local; 3910 struct sta_info *sta; 3911 3912 lockdep_assert_held(&local->sta_mtx); 3913 3914 list_for_each_entry_rcu(sta, &local->sta_list, list) { 3915 if (sdata != sta->sdata && 3916 (!sta->sdata->bss || sta->sdata->bss != sdata->bss)) 3917 continue; 3918 ieee80211_check_fast_rx(sta); 3919 } 3920 } 3921 3922 void ieee80211_check_fast_rx_iface(struct ieee80211_sub_if_data *sdata) 3923 { 3924 struct ieee80211_local *local = sdata->local; 3925 3926 mutex_lock(&local->sta_mtx); 3927 __ieee80211_check_fast_rx_iface(sdata); 3928 mutex_unlock(&local->sta_mtx); 3929 } 3930 3931 static bool ieee80211_invoke_fast_rx(struct ieee80211_rx_data *rx, 3932 struct ieee80211_fast_rx *fast_rx) 3933 { 3934 struct sk_buff *skb = rx->skb; 3935 struct ieee80211_hdr *hdr = (void *)skb->data; 3936 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 3937 struct sta_info *sta = rx->sta; 3938 int orig_len = skb->len; 3939 int hdrlen = ieee80211_hdrlen(hdr->frame_control); 3940 int snap_offs = hdrlen; 3941 struct { 3942 u8 snap[sizeof(rfc1042_header)]; 3943 __be16 proto; 3944 } *payload __aligned(2); 3945 struct { 3946 u8 da[ETH_ALEN]; 3947 u8 sa[ETH_ALEN]; 3948 } addrs __aligned(2); 3949 struct ieee80211_sta_rx_stats *stats = &sta->rx_stats; 3950 3951 if (fast_rx->uses_rss) 3952 stats = this_cpu_ptr(sta->pcpu_rx_stats); 3953 3954 /* for parallel-rx, we need to have DUP_VALIDATED, otherwise we write 3955 * to a common data structure; drivers can implement that per queue 3956 * but we don't have that information in mac80211 3957 */ 3958 if (!(status->flag & RX_FLAG_DUP_VALIDATED)) 3959 return false; 3960 3961 #define FAST_RX_CRYPT_FLAGS (RX_FLAG_PN_VALIDATED | RX_FLAG_DECRYPTED) 3962 3963 /* If using encryption, we also need to have: 3964 * - PN_VALIDATED: similar, but the implementation is tricky 3965 * - DECRYPTED: necessary for PN_VALIDATED 3966 */ 3967 if (fast_rx->key && 3968 (status->flag & FAST_RX_CRYPT_FLAGS) != FAST_RX_CRYPT_FLAGS) 3969 return false; 3970 3971 if (unlikely(!ieee80211_is_data_present(hdr->frame_control))) 3972 return false; 3973 3974 if (unlikely(ieee80211_is_frag(hdr))) 3975 return false; 3976 3977 /* Since our interface address cannot be multicast, this 3978 * implicitly also rejects multicast frames without the 3979 * explicit check. 3980 * 3981 * We shouldn't get any *data* frames not addressed to us 3982 * (AP mode will accept multicast *management* frames), but 3983 * punting here will make it go through the full checks in 3984 * ieee80211_accept_frame(). 3985 */ 3986 if (!ether_addr_equal(fast_rx->vif_addr, hdr->addr1)) 3987 return false; 3988 3989 if ((hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_FROMDS | 3990 IEEE80211_FCTL_TODS)) != 3991 fast_rx->expected_ds_bits) 3992 return false; 3993 3994 /* assign the key to drop unencrypted frames (later) 3995 * and strip the IV/MIC if necessary 3996 */ 3997 if (fast_rx->key && !(status->flag & RX_FLAG_IV_STRIPPED)) { 3998 /* GCMP header length is the same */ 3999 snap_offs += IEEE80211_CCMP_HDR_LEN; 4000 } 4001 4002 if (!(status->rx_flags & IEEE80211_RX_AMSDU)) { 4003 if (!pskb_may_pull(skb, snap_offs + sizeof(*payload))) 4004 goto drop; 4005 4006 payload = (void *)(skb->data + snap_offs); 4007 4008 if (!ether_addr_equal(payload->snap, fast_rx->rfc1042_hdr)) 4009 return false; 4010 4011 /* Don't handle these here since they require special code. 4012 * Accept AARP and IPX even though they should come with a 4013 * bridge-tunnel header - but if we get them this way then 4014 * there's little point in discarding them. 4015 */ 4016 if (unlikely(payload->proto == cpu_to_be16(ETH_P_TDLS) || 4017 payload->proto == fast_rx->control_port_protocol)) 4018 return false; 4019 } 4020 4021 /* after this point, don't punt to the slowpath! */ 4022 4023 if (rx->key && !(status->flag & RX_FLAG_MIC_STRIPPED) && 4024 pskb_trim(skb, skb->len - fast_rx->icv_len)) 4025 goto drop; 4026 4027 if (unlikely(fast_rx->sta_notify)) { 4028 ieee80211_sta_rx_notify(rx->sdata, hdr); 4029 fast_rx->sta_notify = false; 4030 } 4031 4032 /* statistics part of ieee80211_rx_h_sta_process() */ 4033 if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) { 4034 stats->last_signal = status->signal; 4035 if (!fast_rx->uses_rss) 4036 ewma_signal_add(&sta->rx_stats_avg.signal, 4037 -status->signal); 4038 } 4039 4040 if (status->chains) { 4041 int i; 4042 4043 stats->chains = status->chains; 4044 for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) { 4045 int signal = status->chain_signal[i]; 4046 4047 if (!(status->chains & BIT(i))) 4048 continue; 4049 4050 stats->chain_signal_last[i] = signal; 4051 if (!fast_rx->uses_rss) 4052 ewma_signal_add(&sta->rx_stats_avg.chain_signal[i], 4053 -signal); 4054 } 4055 } 4056 /* end of statistics */ 4057 4058 if (rx->key && !ieee80211_has_protected(hdr->frame_control)) 4059 goto drop; 4060 4061 if (status->rx_flags & IEEE80211_RX_AMSDU) { 4062 if (__ieee80211_rx_h_amsdu(rx, snap_offs - hdrlen) != 4063 RX_QUEUED) 4064 goto drop; 4065 4066 return true; 4067 } 4068 4069 stats->last_rx = jiffies; 4070 stats->last_rate = sta_stats_encode_rate(status); 4071 4072 stats->fragments++; 4073 stats->packets++; 4074 4075 /* do the header conversion - first grab the addresses */ 4076 ether_addr_copy(addrs.da, skb->data + fast_rx->da_offs); 4077 ether_addr_copy(addrs.sa, skb->data + fast_rx->sa_offs); 4078 /* remove the SNAP but leave the ethertype */ 4079 skb_pull(skb, snap_offs + sizeof(rfc1042_header)); 4080 /* push the addresses in front */ 4081 memcpy(skb_push(skb, sizeof(addrs)), &addrs, sizeof(addrs)); 4082 4083 skb->dev = fast_rx->dev; 4084 4085 ieee80211_rx_stats(fast_rx->dev, skb->len); 4086 4087 /* The seqno index has the same property as needed 4088 * for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS 4089 * for non-QoS-data frames. Here we know it's a data 4090 * frame, so count MSDUs. 4091 */ 4092 u64_stats_update_begin(&stats->syncp); 4093 stats->msdu[rx->seqno_idx]++; 4094 stats->bytes += orig_len; 4095 u64_stats_update_end(&stats->syncp); 4096 4097 if (fast_rx->internal_forward) { 4098 struct sk_buff *xmit_skb = NULL; 4099 bool multicast = is_multicast_ether_addr(skb->data); 4100 4101 if (multicast) { 4102 xmit_skb = skb_copy(skb, GFP_ATOMIC); 4103 } else if (sta_info_get(rx->sdata, skb->data)) { 4104 xmit_skb = skb; 4105 skb = NULL; 4106 } 4107 4108 if (xmit_skb) { 4109 /* 4110 * Send to wireless media and increase priority by 256 4111 * to keep the received priority instead of 4112 * reclassifying the frame (see cfg80211_classify8021d). 4113 */ 4114 xmit_skb->priority += 256; 4115 xmit_skb->protocol = htons(ETH_P_802_3); 4116 skb_reset_network_header(xmit_skb); 4117 skb_reset_mac_header(xmit_skb); 4118 dev_queue_xmit(xmit_skb); 4119 } 4120 4121 if (!skb) 4122 return true; 4123 } 4124 4125 /* deliver to local stack */ 4126 skb->protocol = eth_type_trans(skb, fast_rx->dev); 4127 memset(skb->cb, 0, sizeof(skb->cb)); 4128 if (rx->napi) 4129 napi_gro_receive(rx->napi, skb); 4130 else 4131 netif_receive_skb(skb); 4132 4133 return true; 4134 drop: 4135 dev_kfree_skb(skb); 4136 stats->dropped++; 4137 return true; 4138 } 4139 4140 /* 4141 * This function returns whether or not the SKB 4142 * was destined for RX processing or not, which, 4143 * if consume is true, is equivalent to whether 4144 * or not the skb was consumed. 4145 */ 4146 static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx, 4147 struct sk_buff *skb, bool consume) 4148 { 4149 struct ieee80211_local *local = rx->local; 4150 struct ieee80211_sub_if_data *sdata = rx->sdata; 4151 4152 rx->skb = skb; 4153 4154 /* See if we can do fast-rx; if we have to copy we already lost, 4155 * so punt in that case. We should never have to deliver a data 4156 * frame to multiple interfaces anyway. 4157 * 4158 * We skip the ieee80211_accept_frame() call and do the necessary 4159 * checking inside ieee80211_invoke_fast_rx(). 4160 */ 4161 if (consume && rx->sta) { 4162 struct ieee80211_fast_rx *fast_rx; 4163 4164 fast_rx = rcu_dereference(rx->sta->fast_rx); 4165 if (fast_rx && ieee80211_invoke_fast_rx(rx, fast_rx)) 4166 return true; 4167 } 4168 4169 if (!ieee80211_accept_frame(rx)) 4170 return false; 4171 4172 if (!consume) { 4173 skb = skb_copy(skb, GFP_ATOMIC); 4174 if (!skb) { 4175 if (net_ratelimit()) 4176 wiphy_debug(local->hw.wiphy, 4177 "failed to copy skb for %s\n", 4178 sdata->name); 4179 return true; 4180 } 4181 4182 rx->skb = skb; 4183 } 4184 4185 ieee80211_invoke_rx_handlers(rx); 4186 return true; 4187 } 4188 4189 /* 4190 * This is the actual Rx frames handler. as it belongs to Rx path it must 4191 * be called with rcu_read_lock protection. 4192 */ 4193 static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, 4194 struct ieee80211_sta *pubsta, 4195 struct sk_buff *skb, 4196 struct napi_struct *napi) 4197 { 4198 struct ieee80211_local *local = hw_to_local(hw); 4199 struct ieee80211_sub_if_data *sdata; 4200 struct ieee80211_hdr *hdr; 4201 __le16 fc; 4202 struct ieee80211_rx_data rx; 4203 struct ieee80211_sub_if_data *prev; 4204 struct rhlist_head *tmp; 4205 int err = 0; 4206 4207 fc = ((struct ieee80211_hdr *)skb->data)->frame_control; 4208 memset(&rx, 0, sizeof(rx)); 4209 rx.skb = skb; 4210 rx.local = local; 4211 rx.napi = napi; 4212 4213 if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc)) 4214 I802_DEBUG_INC(local->dot11ReceivedFragmentCount); 4215 4216 if (ieee80211_is_mgmt(fc)) { 4217 /* drop frame if too short for header */ 4218 if (skb->len < ieee80211_hdrlen(fc)) 4219 err = -ENOBUFS; 4220 else 4221 err = skb_linearize(skb); 4222 } else { 4223 err = !pskb_may_pull(skb, ieee80211_hdrlen(fc)); 4224 } 4225 4226 if (err) { 4227 dev_kfree_skb(skb); 4228 return; 4229 } 4230 4231 hdr = (struct ieee80211_hdr *)skb->data; 4232 ieee80211_parse_qos(&rx); 4233 ieee80211_verify_alignment(&rx); 4234 4235 if (unlikely(ieee80211_is_probe_resp(hdr->frame_control) || 4236 ieee80211_is_beacon(hdr->frame_control))) 4237 ieee80211_scan_rx(local, skb); 4238 4239 if (ieee80211_is_data(fc)) { 4240 struct sta_info *sta, *prev_sta; 4241 4242 if (pubsta) { 4243 rx.sta = container_of(pubsta, struct sta_info, sta); 4244 rx.sdata = rx.sta->sdata; 4245 if (ieee80211_prepare_and_rx_handle(&rx, skb, true)) 4246 return; 4247 goto out; 4248 } 4249 4250 prev_sta = NULL; 4251 4252 for_each_sta_info(local, hdr->addr2, sta, tmp) { 4253 if (!prev_sta) { 4254 prev_sta = sta; 4255 continue; 4256 } 4257 4258 rx.sta = prev_sta; 4259 rx.sdata = prev_sta->sdata; 4260 ieee80211_prepare_and_rx_handle(&rx, skb, false); 4261 4262 prev_sta = sta; 4263 } 4264 4265 if (prev_sta) { 4266 rx.sta = prev_sta; 4267 rx.sdata = prev_sta->sdata; 4268 4269 if (ieee80211_prepare_and_rx_handle(&rx, skb, true)) 4270 return; 4271 goto out; 4272 } 4273 } 4274 4275 prev = NULL; 4276 4277 list_for_each_entry_rcu(sdata, &local->interfaces, list) { 4278 if (!ieee80211_sdata_running(sdata)) 4279 continue; 4280 4281 if (sdata->vif.type == NL80211_IFTYPE_MONITOR || 4282 sdata->vif.type == NL80211_IFTYPE_AP_VLAN) 4283 continue; 4284 4285 /* 4286 * frame is destined for this interface, but if it's 4287 * not also for the previous one we handle that after 4288 * the loop to avoid copying the SKB once too much 4289 */ 4290 4291 if (!prev) { 4292 prev = sdata; 4293 continue; 4294 } 4295 4296 rx.sta = sta_info_get_bss(prev, hdr->addr2); 4297 rx.sdata = prev; 4298 ieee80211_prepare_and_rx_handle(&rx, skb, false); 4299 4300 prev = sdata; 4301 } 4302 4303 if (prev) { 4304 rx.sta = sta_info_get_bss(prev, hdr->addr2); 4305 rx.sdata = prev; 4306 4307 if (ieee80211_prepare_and_rx_handle(&rx, skb, true)) 4308 return; 4309 } 4310 4311 out: 4312 dev_kfree_skb(skb); 4313 } 4314 4315 /* 4316 * This is the receive path handler. It is called by a low level driver when an 4317 * 802.11 MPDU is received from the hardware. 4318 */ 4319 void ieee80211_rx_napi(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta, 4320 struct sk_buff *skb, struct napi_struct *napi) 4321 { 4322 struct ieee80211_local *local = hw_to_local(hw); 4323 struct ieee80211_rate *rate = NULL; 4324 struct ieee80211_supported_band *sband; 4325 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); 4326 4327 WARN_ON_ONCE(softirq_count() == 0); 4328 4329 if (WARN_ON(status->band >= NUM_NL80211_BANDS)) 4330 goto drop; 4331 4332 sband = local->hw.wiphy->bands[status->band]; 4333 if (WARN_ON(!sband)) 4334 goto drop; 4335 4336 /* 4337 * If we're suspending, it is possible although not too likely 4338 * that we'd be receiving frames after having already partially 4339 * quiesced the stack. We can't process such frames then since 4340 * that might, for example, cause stations to be added or other 4341 * driver callbacks be invoked. 4342 */ 4343 if (unlikely(local->quiescing || local->suspended)) 4344 goto drop; 4345 4346 /* We might be during a HW reconfig, prevent Rx for the same reason */ 4347 if (unlikely(local->in_reconfig)) 4348 goto drop; 4349 4350 /* 4351 * The same happens when we're not even started, 4352 * but that's worth a warning. 4353 */ 4354 if (WARN_ON(!local->started)) 4355 goto drop; 4356 4357 if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC))) { 4358 /* 4359 * Validate the rate, unless a PLCP error means that 4360 * we probably can't have a valid rate here anyway. 4361 */ 4362 4363 switch (status->encoding) { 4364 case RX_ENC_HT: 4365 /* 4366 * rate_idx is MCS index, which can be [0-76] 4367 * as documented on: 4368 * 4369 * http://wireless.kernel.org/en/developers/Documentation/ieee80211/802.11n 4370 * 4371 * Anything else would be some sort of driver or 4372 * hardware error. The driver should catch hardware 4373 * errors. 4374 */ 4375 if (WARN(status->rate_idx > 76, 4376 "Rate marked as an HT rate but passed " 4377 "status->rate_idx is not " 4378 "an MCS index [0-76]: %d (0x%02x)\n", 4379 status->rate_idx, 4380 status->rate_idx)) 4381 goto drop; 4382 break; 4383 case RX_ENC_VHT: 4384 if (WARN_ONCE(status->rate_idx > 9 || 4385 !status->nss || 4386 status->nss > 8, 4387 "Rate marked as a VHT rate but data is invalid: MCS: %d, NSS: %d\n", 4388 status->rate_idx, status->nss)) 4389 goto drop; 4390 break; 4391 default: 4392 WARN_ON_ONCE(1); 4393 /* fall through */ 4394 case RX_ENC_LEGACY: 4395 if (WARN_ON(status->rate_idx >= sband->n_bitrates)) 4396 goto drop; 4397 rate = &sband->bitrates[status->rate_idx]; 4398 } 4399 } 4400 4401 status->rx_flags = 0; 4402 4403 /* 4404 * key references and virtual interfaces are protected using RCU 4405 * and this requires that we are in a read-side RCU section during 4406 * receive processing 4407 */ 4408 rcu_read_lock(); 4409 4410 /* 4411 * Frames with failed FCS/PLCP checksum are not returned, 4412 * all other frames are returned without radiotap header 4413 * if it was previously present. 4414 * Also, frames with less than 16 bytes are dropped. 4415 */ 4416 skb = ieee80211_rx_monitor(local, skb, rate); 4417 if (!skb) { 4418 rcu_read_unlock(); 4419 return; 4420 } 4421 4422 ieee80211_tpt_led_trig_rx(local, 4423 ((struct ieee80211_hdr *)skb->data)->frame_control, 4424 skb->len); 4425 4426 __ieee80211_rx_handle_packet(hw, pubsta, skb, napi); 4427 4428 rcu_read_unlock(); 4429 4430 return; 4431 drop: 4432 kfree_skb(skb); 4433 } 4434 EXPORT_SYMBOL(ieee80211_rx_napi); 4435 4436 /* This is a version of the rx handler that can be called from hard irq 4437 * context. Post the skb on the queue and schedule the tasklet */ 4438 void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb) 4439 { 4440 struct ieee80211_local *local = hw_to_local(hw); 4441 4442 BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb)); 4443 4444 skb->pkt_type = IEEE80211_RX_MSG; 4445 skb_queue_tail(&local->skb_queue, skb); 4446 tasklet_schedule(&local->tasklet); 4447 } 4448 EXPORT_SYMBOL(ieee80211_rx_irqsafe); 4449