rx.c 94.8 KB
Newer Older
1 2 3 4
/*
 * Copyright 2002-2005, Instant802 Networks, Inc.
 * Copyright 2005-2006, Devicescape Software, Inc.
 * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
5
 * Copyright 2007-2010	Johannes Berg <johannes@sipsolutions.net>
6 7 8 9 10 11
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

12
#include <linux/jiffies.h>
13
#include <linux/slab.h>
14 15 16 17
#include <linux/kernel.h>
#include <linux/skbuff.h>
#include <linux/netdevice.h>
#include <linux/etherdevice.h>
18
#include <linux/rcupdate.h>
19
#include <linux/export.h>
20 21
#include <net/mac80211.h>
#include <net/ieee80211_radiotap.h>
22
#include <asm/unaligned.h>
23 24

#include "ieee80211_i.h"
25
#include "driver-ops.h"
J
Johannes Berg 已提交
26
#include "led.h"
27
#include "mesh.h"
28 29 30 31
#include "wep.h"
#include "wpa.h"
#include "tkip.h"
#include "wme.h"
32
#include "rate.h"
33

34 35 36 37 38 39 40
/*
 * monitor mode reception
 *
 * This function cleans up the SKB, i.e. it removes all the stuff
 * only useful for monitoring.
 */
static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
J
Johannes Berg 已提交
41
					   struct sk_buff *skb)
42 43 44
{
	if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) {
		if (likely(skb->len > FCS_LEN))
Z
Zhu Yi 已提交
45
			__pskb_trim(skb, skb->len - FCS_LEN);
46 47 48 49
		else {
			/* driver bug */
			WARN_ON(1);
			dev_kfree_skb(skb);
50
			return NULL;
51 52 53 54 55 56
		}
	}

	return skb;
}

J
Johannes Berg 已提交
57
static inline int should_drop_frame(struct sk_buff *skb, int present_fcs_len)
58
{
59
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
60 61
	struct ieee80211_hdr *hdr;

62
	hdr = (void *)(skb->data);
63

64 65 66
	if (status->flag & (RX_FLAG_FAILED_FCS_CRC |
			    RX_FLAG_FAILED_PLCP_CRC |
			    RX_FLAG_AMPDU_IS_ZEROLEN))
67
		return 1;
68
	if (unlikely(skb->len < 16 + present_fcs_len))
69
		return 1;
H
Harvey Harrison 已提交
70 71 72
	if (ieee80211_is_ctl(hdr->frame_control) &&
	    !ieee80211_is_pspoll(hdr->frame_control) &&
	    !ieee80211_is_back_req(hdr->frame_control))
73 74 75 76
		return 1;
	return 0;
}

77
static int
78 79
ieee80211_rx_radiotap_space(struct ieee80211_local *local,
			    struct ieee80211_rx_status *status)
80 81 82 83
{
	int len;

	/* always present fields */
84
	len = sizeof(struct ieee80211_radiotap_header) + 8;
85

86 87 88
	/* allocate extra bitmaps */
	if (status->chains)
		len += 4 * hweight8(status->chains);
89 90 91

	if (ieee80211_have_rx_timestamp(status)) {
		len = ALIGN(len, 8);
92
		len += 8;
93
	}
J
Johannes Berg 已提交
94
	if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
95 96
		len += 1;

97 98 99 100
	/* antenna field, if we don't have per-chain info */
	if (!status->chains)
		len += 1;

101 102
	/* padding for RX_FLAGS if necessary */
	len = ALIGN(len, 2);
103

104 105 106
	if (status->flag & RX_FLAG_HT) /* HT info */
		len += 3;

107
	if (status->flag & RX_FLAG_AMPDU_DETAILS) {
108
		len = ALIGN(len, 4);
109 110 111
		len += 8;
	}

112 113 114 115 116
	if (status->flag & RX_FLAG_VHT) {
		len = ALIGN(len, 2);
		len += 12;
	}

117 118 119 120 121
	if (status->chains) {
		/* antenna and antenna signal fields */
		len += 2 * hweight8(status->chains);
	}

122 123 124
	return len;
}

125
/*
126 127 128 129 130 131 132 133
 * ieee80211_add_rx_radiotap_header - add radiotap header
 *
 * add a radiotap header containing all the fields which the hardware provided.
 */
static void
ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
				 struct sk_buff *skb,
				 struct ieee80211_rate *rate,
134
				 int rtap_len, bool has_fcs)
135
{
136
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
137 138
	struct ieee80211_radiotap_header *rthdr;
	unsigned char *pos;
139 140
	__le32 *it_present;
	u32 it_present_val;
141
	u16 rx_flags = 0;
142
	u16 channel_flags = 0;
143 144
	int mpdulen, chain;
	unsigned long chains = status->chains;
145 146 147 148

	mpdulen = skb->len;
	if (!(has_fcs && (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)))
		mpdulen += FCS_LEN;
149 150 151

	rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len);
	memset(rthdr, 0, rtap_len);
152
	it_present = &rthdr->it_present;
153 154

	/* radiotap header, set always present flags */
155
	rthdr->it_len = cpu_to_le16(rtap_len);
156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171
	it_present_val = BIT(IEEE80211_RADIOTAP_FLAGS) |
			 BIT(IEEE80211_RADIOTAP_CHANNEL) |
			 BIT(IEEE80211_RADIOTAP_RX_FLAGS);

	if (!status->chains)
		it_present_val |= BIT(IEEE80211_RADIOTAP_ANTENNA);

	for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
		it_present_val |=
			BIT(IEEE80211_RADIOTAP_EXT) |
			BIT(IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE);
		put_unaligned_le32(it_present_val, it_present);
		it_present++;
		it_present_val = BIT(IEEE80211_RADIOTAP_ANTENNA) |
				 BIT(IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
	}
172

173 174 175 176
	put_unaligned_le32(it_present_val, it_present);

	pos = (void *)(it_present + 1);

177 178 179
	/* the order of the following fields is important */

	/* IEEE80211_RADIOTAP_TSFT */
180
	if (ieee80211_have_rx_timestamp(status)) {
181 182 183
		/* padding */
		while ((pos - (u8 *)rthdr) & 7)
			*pos++ = 0;
184 185 186 187
		put_unaligned_le64(
			ieee80211_calculate_rx_timestamp(local, status,
							 mpdulen, 0),
			pos);
J
Johannes Berg 已提交
188
		rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
189 190 191 192
		pos += 8;
	}

	/* IEEE80211_RADIOTAP_FLAGS */
193
	if (has_fcs && (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS))
194
		*pos |= IEEE80211_RADIOTAP_F_FCS;
J
Johannes Berg 已提交
195 196
	if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
		*pos |= IEEE80211_RADIOTAP_F_BADFCS;
197 198
	if (status->flag & RX_FLAG_SHORTPRE)
		*pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
199 200 201
	pos++;

	/* IEEE80211_RADIOTAP_RATE */
202
	if (!rate || status->flag & (RX_FLAG_HT | RX_FLAG_VHT)) {
203
		/*
204
		 * Without rate information don't add it. If we have,
205
		 * MCS information is a separate field in radiotap,
206 207
		 * added below. The byte here is needed as padding
		 * for the channel though, so initialise it to 0.
208 209
		 */
		*pos = 0;
210
	} else {
211
		int shift = 0;
212
		rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
213 214 215 216 217
		if (status->flag & RX_FLAG_10MHZ)
			shift = 1;
		else if (status->flag & RX_FLAG_5MHZ)
			shift = 2;
		*pos = DIV_ROUND_UP(rate->bitrate, 5 * (1 << shift));
218
	}
219 220 221
	pos++;

	/* IEEE80211_RADIOTAP_CHANNEL */
222
	put_unaligned_le16(status->freq, pos);
223
	pos += 2;
224 225 226 227 228
	if (status->flag & RX_FLAG_10MHZ)
		channel_flags |= IEEE80211_CHAN_HALF;
	else if (status->flag & RX_FLAG_5MHZ)
		channel_flags |= IEEE80211_CHAN_QUARTER;

229
	if (status->band == IEEE80211_BAND_5GHZ)
230
		channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ;
231
	else if (status->flag & (RX_FLAG_HT | RX_FLAG_VHT))
232
		channel_flags |= IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
233
	else if (rate && rate->flags & IEEE80211_RATE_ERP_G)
234
		channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ;
235
	else if (rate)
236
		channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ;
237
	else
238 239
		channel_flags |= IEEE80211_CHAN_2GHZ;
	put_unaligned_le16(channel_flags, pos);
240 241 242
	pos += 2;

	/* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
243 244
	if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM &&
	    !(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
245 246 247 248 249 250 251 252
		*pos = status->signal;
		rthdr->it_present |=
			cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
		pos++;
	}

	/* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */

253 254 255 256 257
	if (!status->chains) {
		/* IEEE80211_RADIOTAP_ANTENNA */
		*pos = status->antenna;
		pos++;
	}
258 259 260 261 262

	/* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */

	/* IEEE80211_RADIOTAP_RX_FLAGS */
	/* ensure 2 byte alignment for the 2 byte field as required */
263
	if ((pos - (u8 *)rthdr) & 1)
264
		*pos++ = 0;
J
Johannes Berg 已提交
265
	if (status->flag & RX_FLAG_FAILED_PLCP_CRC)
266 267
		rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP;
	put_unaligned_le16(rx_flags, pos);
268
	pos += 2;
269 270

	if (status->flag & RX_FLAG_HT) {
271 272
		unsigned int stbc;

273
		rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_MCS);
274
		*pos++ = local->hw.radiotap_mcs_details;
275 276 277 278 279
		*pos = 0;
		if (status->flag & RX_FLAG_SHORT_GI)
			*pos |= IEEE80211_RADIOTAP_MCS_SGI;
		if (status->flag & RX_FLAG_40MHZ)
			*pos |= IEEE80211_RADIOTAP_MCS_BW_40;
280 281
		if (status->flag & RX_FLAG_HT_GF)
			*pos |= IEEE80211_RADIOTAP_MCS_FMT_GF;
282 283
		if (status->flag & RX_FLAG_LDPC)
			*pos |= IEEE80211_RADIOTAP_MCS_FEC_LDPC;
284 285
		stbc = (status->flag & RX_FLAG_STBC_MASK) >> RX_FLAG_STBC_SHIFT;
		*pos |= stbc << IEEE80211_RADIOTAP_MCS_STBC_SHIFT;
286 287 288
		pos++;
		*pos++ = status->rate_idx;
	}
289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319

	if (status->flag & RX_FLAG_AMPDU_DETAILS) {
		u16 flags = 0;

		/* ensure 4 byte alignment */
		while ((pos - (u8 *)rthdr) & 3)
			pos++;
		rthdr->it_present |=
			cpu_to_le32(1 << IEEE80211_RADIOTAP_AMPDU_STATUS);
		put_unaligned_le32(status->ampdu_reference, pos);
		pos += 4;
		if (status->flag & RX_FLAG_AMPDU_REPORT_ZEROLEN)
			flags |= IEEE80211_RADIOTAP_AMPDU_REPORT_ZEROLEN;
		if (status->flag & RX_FLAG_AMPDU_IS_ZEROLEN)
			flags |= IEEE80211_RADIOTAP_AMPDU_IS_ZEROLEN;
		if (status->flag & RX_FLAG_AMPDU_LAST_KNOWN)
			flags |= IEEE80211_RADIOTAP_AMPDU_LAST_KNOWN;
		if (status->flag & RX_FLAG_AMPDU_IS_LAST)
			flags |= IEEE80211_RADIOTAP_AMPDU_IS_LAST;
		if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_ERROR)
			flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_ERR;
		if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
			flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_KNOWN;
		put_unaligned_le16(flags, pos);
		pos += 2;
		if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
			*pos++ = status->ampdu_delimiter_crc;
		else
			*pos++ = 0;
		*pos++ = 0;
	}
320

321 322 323 324 325
	if (status->flag & RX_FLAG_VHT) {
		u16 known = local->hw.radiotap_vht_details;

		rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_VHT);
		/* known field - how to handle 80+80? */
326
		if (status->vht_flag & RX_VHT_FLAG_80P80MHZ)
327 328 329 330 331 332
			known &= ~IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH;
		put_unaligned_le16(known, pos);
		pos += 2;
		/* flags */
		if (status->flag & RX_FLAG_SHORT_GI)
			*pos |= IEEE80211_RADIOTAP_VHT_FLAG_SGI;
333 334 335
		/* in VHT, STBC is binary */
		if (status->flag & RX_FLAG_STBC_MASK)
			*pos |= IEEE80211_RADIOTAP_VHT_FLAG_STBC;
336 337
		pos++;
		/* bandwidth */
338
		if (status->vht_flag & RX_VHT_FLAG_80MHZ)
339
			*pos++ = 4;
340
		else if (status->vht_flag & RX_VHT_FLAG_80P80MHZ)
341
			*pos++ = 0; /* marked not known above */
342
		else if (status->vht_flag & RX_VHT_FLAG_160MHZ)
343 344 345 346 347 348 349 350 351
			*pos++ = 11;
		else if (status->flag & RX_FLAG_40MHZ)
			*pos++ = 1;
		else /* 20 MHz */
			*pos++ = 0;
		/* MCS/NSS */
		*pos = (status->rate_idx << 4) | status->vht_nss;
		pos += 4;
		/* coding field */
352 353
		if (status->flag & RX_FLAG_LDPC)
			*pos |= IEEE80211_RADIOTAP_CODING_LDPC_USER0;
354 355 356 357 358 359 360
		pos++;
		/* group ID */
		pos++;
		/* partial_aid */
		pos += 2;
	}

361 362 363 364
	for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
		*pos++ = status->chain_signal[chain];
		*pos++ = chain;
	}
365 366
}

367 368 369 370 371 372 373
/*
 * This function copies a received frame to all monitor interfaces and
 * returns a cleaned-up SKB that no longer includes the FCS nor the
 * radiotap header the driver might have added.
 */
static struct sk_buff *
ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
374
		     struct ieee80211_rate *rate)
375
{
376
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb);
377
	struct ieee80211_sub_if_data *sdata;
378
	int needed_headroom;
379 380 381 382 383 384 385 386 387 388 389 390
	struct sk_buff *skb, *skb2;
	struct net_device *prev_dev = NULL;
	int present_fcs_len = 0;

	/*
	 * First, we may need to make a copy of the skb because
	 *  (1) we need to modify it for radiotap (if not present), and
	 *  (2) the other RX handlers will modify the skb we got.
	 *
	 * We don't need to, of course, if we aren't going to return
	 * the SKB because it has a bad FCS/PLCP checksum.
	 */
J
Johannes Berg 已提交
391

392 393 394
	if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
		present_fcs_len = FCS_LEN;

395 396
	/* ensure hdr->frame_control is in skb head */
	if (!pskb_may_pull(origskb, 2)) {
Z
Zhu Yi 已提交
397 398 399 400
		dev_kfree_skb(origskb);
		return NULL;
	}

401
	if (!local->monitors) {
J
Johannes Berg 已提交
402
		if (should_drop_frame(origskb, present_fcs_len)) {
403 404 405 406
			dev_kfree_skb(origskb);
			return NULL;
		}

J
Johannes Berg 已提交
407
		return remove_monitor_info(local, origskb);
408 409
	}

410 411 412
	/* room for the radiotap header based on driver features */
	needed_headroom = ieee80211_rx_radiotap_space(local, status);

J
Johannes Berg 已提交
413
	if (should_drop_frame(origskb, present_fcs_len)) {
414 415 416 417 418 419 420 421 422 423 424 425
		/* only need to expand headroom if necessary */
		skb = origskb;
		origskb = NULL;

		/*
		 * This shouldn't trigger often because most devices have an
		 * RX header they pull before we get here, and that should
		 * be big enough for our radiotap information. We should
		 * probably export the length to drivers so that we can have
		 * them allocate enough headroom to start with.
		 */
		if (skb_headroom(skb) < needed_headroom &&
426
		    pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
427 428 429 430 431 432 433 434 435 436
			dev_kfree_skb(skb);
			return NULL;
		}
	} else {
		/*
		 * Need to make a copy and possibly remove radiotap header
		 * and FCS from the original.
		 */
		skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC);

J
Johannes Berg 已提交
437
		origskb = remove_monitor_info(local, origskb);
438 439 440 441 442

		if (!skb)
			return origskb;
	}

J
Johannes Berg 已提交
443
	/* prepend radiotap information */
444 445
	ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom,
					 true);
446

447
	skb_reset_mac_header(skb);
448 449 450 451 452
	skb->ip_summed = CHECKSUM_UNNECESSARY;
	skb->pkt_type = PACKET_OTHERHOST;
	skb->protocol = htons(ETH_P_802_2);

	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
453
		if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
454 455
			continue;

456 457 458
		if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES)
			continue;

459
		if (!ieee80211_sdata_running(sdata))
460 461
			continue;

462 463 464 465
		if (prev_dev) {
			skb2 = skb_clone(skb, GFP_ATOMIC);
			if (skb2) {
				skb2->dev = prev_dev;
466
				netif_receive_skb(skb2);
467 468 469 470 471 472 473 474 475 476
			}
		}

		prev_dev = sdata->dev;
		sdata->dev->stats.rx_packets++;
		sdata->dev->stats.rx_bytes += skb->len;
	}

	if (prev_dev) {
		skb->dev = prev_dev;
477
		netif_receive_skb(skb);
478 479 480 481 482 483
	} else
		dev_kfree_skb(skb);

	return origskb;
}

484
static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
485
{
486
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
487
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
488
	int tid, seqno_idx, security_idx;
489 490

	/* does the frame have a qos control field? */
491 492
	if (ieee80211_is_data_qos(hdr->frame_control)) {
		u8 *qc = ieee80211_get_qos_ctl(hdr);
493
		/* frame has qos control */
494
		tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
495
		if (*qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT)
496
			status->rx_flags |= IEEE80211_RX_AMSDU;
497 498 499

		seqno_idx = tid;
		security_idx = tid;
500
	} else {
501 502 503 504 505 506 507 508 509 510 511
		/*
		 * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):
		 *
		 *	Sequence numbers for management frames, QoS data
		 *	frames with a broadcast/multicast address in the
		 *	Address 1 field, and all non-QoS data frames sent
		 *	by QoS STAs are assigned using an additional single
		 *	modulo-4096 counter, [...]
		 *
		 * We also use that counter for non-QoS STAs.
		 */
512
		seqno_idx = IEEE80211_NUM_TIDS;
513 514
		security_idx = 0;
		if (ieee80211_is_mgmt(hdr->frame_control))
515
			security_idx = IEEE80211_NUM_TIDS;
516
		tid = 0;
517
	}
518

519 520
	rx->seqno_idx = seqno_idx;
	rx->security_idx = security_idx;
521 522 523
	/* Set skb->priority to 1d tag if highest order bit of TID is not set.
	 * For now, set skb->priority to 0 for other cases. */
	rx->skb->priority = (tid > 7) ? 0 : tid;
524
}
525

526 527 528 529 530 531 532 533 534 535 536
/**
 * DOC: Packet alignment
 *
 * Drivers always need to pass packets that are aligned to two-byte boundaries
 * to the stack.
 *
 * Additionally, should, if possible, align the payload data in a way that
 * guarantees that the contained IP header is aligned to a four-byte
 * boundary. In the case of regular frames, this simply means aligning the
 * payload to a four-byte boundary (because either the IP header is directly
 * contained, or IV/RFC1042 headers that have a length divisible by four are
537 538 539
 * in front of it).  If the payload data is not properly aligned and the
 * architecture doesn't support efficient unaligned operations, mac80211
 * will align the data.
540 541 542 543 544 545 546
 *
 * With A-MSDU frames, however, the payload data address must yield two modulo
 * four because there are 14-byte 802.3 headers within the A-MSDU frames that
 * push the IP header further back to a multiple of four again. Thankfully, the
 * specs were sane enough this time around to require padding each A-MSDU
 * subframe to a length that is a multiple of four.
 *
L
Lucas De Marchi 已提交
547
 * Padding like Atheros hardware adds which is between the 802.11 header and
548 549 550 551
 * the payload is not supported, the driver is required to move the 802.11
 * header to be directly in front of the payload in that case.
 */
static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
552
{
553 554 555
#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
	WARN_ONCE((unsigned long)rx->skb->data & 1,
		  "unaligned packet at 0x%p\n", rx->skb->data);
556
#endif
557 558
}

559

560 561
/* rx handlers */

562 563 564 565
static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
{
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;

566
	if (is_multicast_ether_addr(hdr->addr1))
567 568
		return 0;

569
	return ieee80211_is_robust_mgmt_frame(skb);
570 571 572 573 574 575 576
}


static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb)
{
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;

577
	if (!is_multicast_ether_addr(hdr->addr1))
578 579
		return 0;

580
	return ieee80211_is_robust_mgmt_frame(skb);
581 582 583 584 585 586 587 588 589
}


/* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */
static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
{
	struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data;
	struct ieee80211_mmie *mmie;

J
Johannes Berg 已提交
590
	if (skb->len < 24 + sizeof(*mmie) || !is_multicast_ether_addr(hdr->da))
591 592
		return -1;

593
	if (!ieee80211_is_robust_mgmt_frame(skb))
594 595 596 597 598 599 600 601 602 603 604
		return -1; /* not a robust management frame */

	mmie = (struct ieee80211_mmie *)
		(skb->data + skb->len - sizeof(*mmie));
	if (mmie->element_id != WLAN_EID_MMIE ||
	    mmie->length != sizeof(*mmie) - 2)
		return -1;

	return le16_to_cpu(mmie->key_id);
}

605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625
static int iwl80211_get_cs_keyid(const struct ieee80211_cipher_scheme *cs,
				 struct sk_buff *skb)
{
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
	__le16 fc;
	int hdrlen;
	u8 keyid;

	fc = hdr->frame_control;
	hdrlen = ieee80211_hdrlen(fc);

	if (skb->len < hdrlen + cs->hdr_len)
		return -EINVAL;

	skb_copy_bits(skb, hdrlen + cs->key_idx_off, &keyid, 1);
	keyid &= cs->key_idx_mask;
	keyid >>= cs->key_idx_shift;

	return keyid;
}

J
Johannes Berg 已提交
626
static ieee80211_rx_result ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
627
{
628
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
629
	char *dev_addr = rx->sdata->vif.addr;
630

631
	if (ieee80211_is_data(hdr->frame_control)) {
632 633
		if (is_multicast_ether_addr(hdr->addr1)) {
			if (ieee80211_has_tods(hdr->frame_control) ||
J
Johannes Berg 已提交
634
			    !ieee80211_has_fromds(hdr->frame_control))
635
				return RX_DROP_MONITOR;
636
			if (ether_addr_equal(hdr->addr3, dev_addr))
637 638 639 640
				return RX_DROP_MONITOR;
		} else {
			if (!ieee80211_has_a4(hdr->frame_control))
				return RX_DROP_MONITOR;
641
			if (ether_addr_equal(hdr->addr4, dev_addr))
642 643
				return RX_DROP_MONITOR;
		}
644 645 646 647 648 649
	}

	/* If there is not an established peer link and this is not a peer link
	 * establisment frame, beacon or probe, drop the frame.
	 */

650
	if (!rx->sta || sta_plink_state(rx->sta) != NL80211_PLINK_ESTAB) {
651
		struct ieee80211_mgmt *mgmt;
652

653
		if (!ieee80211_is_mgmt(hdr->frame_control))
654 655
			return RX_DROP_MONITOR;

656
		if (ieee80211_is_action(hdr->frame_control)) {
657
			u8 category;
658 659 660 661 662

			/* make sure category field is present */
			if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE)
				return RX_DROP_MONITOR;

663
			mgmt = (struct ieee80211_mgmt *)hdr;
664 665
			category = mgmt->u.action.category;
			if (category != WLAN_CATEGORY_MESH_ACTION &&
J
Johannes Berg 已提交
666
			    category != WLAN_CATEGORY_SELF_PROTECTED)
667 668 669 670
				return RX_DROP_MONITOR;
			return RX_CONTINUE;
		}

671 672
		if (ieee80211_is_probe_req(hdr->frame_control) ||
		    ieee80211_is_probe_resp(hdr->frame_control) ||
673 674
		    ieee80211_is_beacon(hdr->frame_control) ||
		    ieee80211_is_auth(hdr->frame_control))
675 676 677 678 679
			return RX_CONTINUE;

		return RX_DROP_MONITOR;
	}

J
Johannes Berg 已提交
680 681
	return RX_CONTINUE;
}
682

683
static void ieee80211_release_reorder_frame(struct ieee80211_sub_if_data *sdata,
684
					    struct tid_ampdu_rx *tid_agg_rx,
685 686
					    int index,
					    struct sk_buff_head *frames)
687 688
{
	struct sk_buff *skb = tid_agg_rx->reorder_buf[index];
689
	struct ieee80211_rx_status *status;
690

691 692
	lockdep_assert_held(&tid_agg_rx->reorder_lock);

693 694 695
	if (!skb)
		goto no_frame;

696
	/* release the frame from the reorder ring buffer */
697 698
	tid_agg_rx->stored_mpdu_num--;
	tid_agg_rx->reorder_buf[index] = NULL;
699 700
	status = IEEE80211_SKB_RXCB(skb);
	status->rx_flags |= IEEE80211_RX_DEFERRED_RELEASE;
701
	__skb_queue_tail(frames, skb);
702 703

no_frame:
704
	tid_agg_rx->head_seq_num = ieee80211_sn_inc(tid_agg_rx->head_seq_num);
705 706
}

707
static void ieee80211_release_reorder_frames(struct ieee80211_sub_if_data *sdata,
708
					     struct tid_ampdu_rx *tid_agg_rx,
709 710
					     u16 head_seq_num,
					     struct sk_buff_head *frames)
711 712 713
{
	int index;

714 715
	lockdep_assert_held(&tid_agg_rx->reorder_lock);

716
	while (ieee80211_sn_less(tid_agg_rx->head_seq_num, head_seq_num)) {
717
		index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
718 719
		ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
						frames);
720 721 722 723 724 725 726 727 728
	}
}

/*
 * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If
 * the skb was added to the buffer longer than this time ago, the earlier
 * frames that have not yet been received are assumed to be lost and the skb
 * can be released for processing. This may also release other skb's from the
 * reorder buffer if there are no additional gaps between the frames.
729 730
 *
 * Callers must hold tid_agg_rx->reorder_lock.
731 732 733
 */
#define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)

734
static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata,
735 736
					  struct tid_ampdu_rx *tid_agg_rx,
					  struct sk_buff_head *frames)
737
{
738
	int index, j;
739

740 741
	lockdep_assert_held(&tid_agg_rx->reorder_lock);

742
	/* release the buffer until next missing frame */
743
	index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
744
	if (!tid_agg_rx->reorder_buf[index] &&
745
	    tid_agg_rx->stored_mpdu_num) {
746 747 748 749 750 751 752 753 754 755 756
		/*
		 * No buffers ready to be released, but check whether any
		 * frames in the reorder buffer have timed out.
		 */
		int skipped = 1;
		for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
		     j = (j + 1) % tid_agg_rx->buf_size) {
			if (!tid_agg_rx->reorder_buf[j]) {
				skipped++;
				continue;
			}
757 758
			if (skipped &&
			    !time_after(jiffies, tid_agg_rx->reorder_time[j] +
759
					HT_RX_REORDER_BUF_TIMEOUT))
760
				goto set_release_timer;
761

J
Johannes Berg 已提交
762 763
			ht_dbg_ratelimited(sdata,
					   "release an RX reorder frame due to timeout on earlier frames\n");
764 765
			ieee80211_release_reorder_frame(sdata, tid_agg_rx, j,
							frames);
766 767 768 769 770

			/*
			 * Increment the head seq# also for the skipped slots.
			 */
			tid_agg_rx->head_seq_num =
771 772
				(tid_agg_rx->head_seq_num +
				 skipped) & IEEE80211_SN_MASK;
773 774 775
			skipped = 0;
		}
	} else while (tid_agg_rx->reorder_buf[index]) {
776 777
		ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
						frames);
778
		index =	tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
779
	}
780 781

	if (tid_agg_rx->stored_mpdu_num) {
782
		j = index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
783 784 785 786 787 788 789 790 791 792

		for (; j != (index - 1) % tid_agg_rx->buf_size;
		     j = (j + 1) % tid_agg_rx->buf_size) {
			if (tid_agg_rx->reorder_buf[j])
				break;
		}

 set_release_timer:

		mod_timer(&tid_agg_rx->reorder_timer,
793
			  tid_agg_rx->reorder_time[j] + 1 +
794 795 796 797
			  HT_RX_REORDER_BUF_TIMEOUT);
	} else {
		del_timer(&tid_agg_rx->reorder_timer);
	}
798 799
}

800 801 802 803 804
/*
 * As this function belongs to the RX path it must be under
 * rcu_read_lock protection. It returns false if the frame
 * can be processed immediately, true if it was consumed.
 */
805
static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata,
806
					     struct tid_ampdu_rx *tid_agg_rx,
807 808
					     struct sk_buff *skb,
					     struct sk_buff_head *frames)
809 810 811 812 813 814
{
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
	u16 sc = le16_to_cpu(hdr->seq_ctrl);
	u16 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
	u16 head_seq_num, buf_size;
	int index;
815
	bool ret = true;
816

817 818
	spin_lock(&tid_agg_rx->reorder_lock);

819 820 821 822
	buf_size = tid_agg_rx->buf_size;
	head_seq_num = tid_agg_rx->head_seq_num;

	/* frame with out of date sequence number */
823
	if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) {
824
		dev_kfree_skb(skb);
825
		goto out;
826 827 828 829 830 831
	}

	/*
	 * If frame the sequence number exceeds our buffering window
	 * size release some previous frames to make room for this one.
	 */
832 833 834
	if (!ieee80211_sn_less(mpdu_seq_num, head_seq_num + buf_size)) {
		head_seq_num = ieee80211_sn_inc(
				ieee80211_sn_sub(mpdu_seq_num, buf_size));
835
		/* release stored frames up to new head to stack */
836
		ieee80211_release_reorder_frames(sdata, tid_agg_rx,
837
						 head_seq_num, frames);
838 839 840 841
	}

	/* Now the new frame is always in the range of the reordering buffer */

842
	index = mpdu_seq_num % tid_agg_rx->buf_size;
843 844 845 846

	/* check if we already stored this frame */
	if (tid_agg_rx->reorder_buf[index]) {
		dev_kfree_skb(skb);
847
		goto out;
848 849 850 851 852
	}

	/*
	 * If the current MPDU is in the right order and nothing else
	 * is stored we can process it directly, no need to buffer it.
853 854
	 * If it is first but there's something stored, we may be able
	 * to release frames after this one.
855 856 857
	 */
	if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
	    tid_agg_rx->stored_mpdu_num == 0) {
858 859
		tid_agg_rx->head_seq_num =
			ieee80211_sn_inc(tid_agg_rx->head_seq_num);
860 861
		ret = false;
		goto out;
862 863 864 865 866 867
	}

	/* put the frame in the reordering buffer */
	tid_agg_rx->reorder_buf[index] = skb;
	tid_agg_rx->reorder_time[index] = jiffies;
	tid_agg_rx->stored_mpdu_num++;
868
	ieee80211_sta_reorder_release(sdata, tid_agg_rx, frames);
869

870 871 872
 out:
	spin_unlock(&tid_agg_rx->reorder_lock);
	return ret;
873 874 875 876 877 878
}

/*
 * Reorder MPDUs from A-MPDUs, keeping them on a buffer. Returns
 * true if the MPDU was buffered, false if it should be processed.
 */
879 880
static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx,
				       struct sk_buff_head *frames)
881
{
882 883
	struct sk_buff *skb = rx->skb;
	struct ieee80211_local *local = rx->local;
884
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
885
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
886
	struct sta_info *sta = rx->sta;
887 888
	struct tid_ampdu_rx *tid_agg_rx;
	u16 sc;
889
	u8 tid, ack_policy;
890

891 892
	if (!ieee80211_is_data_qos(hdr->frame_control) ||
	    is_multicast_ether_addr(hdr->addr1))
893
		goto dont_reorder;
894 895 896 897 898 899 900

	/*
	 * filter the QoS data rx stream according to
	 * STA/TID and check if this STA/TID is on aggregation
	 */

	if (!sta)
901
		goto dont_reorder;
902

903 904
	ack_policy = *ieee80211_get_qos_ctl(hdr) &
		     IEEE80211_QOS_CTL_ACK_POLICY_MASK;
905 906
	tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;

907 908 909
	tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
	if (!tid_agg_rx)
		goto dont_reorder;
910 911 912

	/* qos null data frames are excluded */
	if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
913
		goto dont_reorder;
914

915 916 917 918 919
	/* not part of a BA session */
	if (ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK &&
	    ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_NORMAL)
		goto dont_reorder;

920 921 922 923
	/* not actually part of this BA session */
	if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
		goto dont_reorder;

924 925 926 927
	/* new, potentially un-ordered, ampdu frame - process it */

	/* reset session timer */
	if (tid_agg_rx->timeout)
928
		tid_agg_rx->last_rx = jiffies;
929 930 931 932

	/* if this mpdu is fragmented - terminate rx aggregation session */
	sc = le16_to_cpu(hdr->seq_ctrl);
	if (sc & IEEE80211_SCTL_FRAG) {
933
		skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
934 935
		skb_queue_tail(&rx->sdata->skb_queue, skb);
		ieee80211_queue_work(&local->hw, &rx->sdata->work);
936
		return;
937 938
	}

939 940 941 942 943 944 945
	/*
	 * No locking needed -- we will only ever process one
	 * RX packet at a time, and thus own tid_agg_rx. All
	 * other code manipulating it needs to (and does) make
	 * sure that we cannot get to it any more before doing
	 * anything with it.
	 */
946 947
	if (ieee80211_sta_manage_reorder_buf(rx->sdata, tid_agg_rx, skb,
					     frames))
948 949 950
		return;

 dont_reorder:
951
	__skb_queue_tail(frames, skb);
952
}
953

954
static ieee80211_rx_result debug_noinline
955
ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
956
{
957
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
958
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
959

960 961 962 963 964 965 966 967
	/*
	 * Drop duplicate 802.11 retransmissions
	 * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery")
	 */
	if (rx->skb->len >= 24 && rx->sta &&
	    !ieee80211_is_ctl(hdr->frame_control) &&
	    !ieee80211_is_qos_nullfunc(hdr->frame_control) &&
	    !is_multicast_ether_addr(hdr->addr1)) {
968
		if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
969
			     rx->sta->last_seq_ctrl[rx->seqno_idx] ==
970
			     hdr->seq_ctrl)) {
971
			if (status->rx_flags & IEEE80211_RX_RA_MATCH) {
972 973 974
				rx->local->dot11FrameDuplicateCount++;
				rx->sta->num_duplicates++;
			}
975
			return RX_DROP_UNUSABLE;
976
		} else if (!(status->flag & RX_FLAG_AMSDU_MORE)) {
977
			rx->sta->last_seq_ctrl[rx->seqno_idx] = hdr->seq_ctrl;
978
		}
979 980 981 982
	}

	if (unlikely(rx->skb->len < 16)) {
		I802_DEBUG_INC(rx->local->rx_handlers_drop_short);
J
Johannes Berg 已提交
983
		return RX_DROP_MONITOR;
984 985 986 987 988
	}

	/* Drop disallowed frame classes based on STA auth/assoc state;
	 * IEEE 802.11, Chap 5.5.
	 *
J
Johannes Berg 已提交
989 990
	 * mac80211 filters only based on association state, i.e. it drops
	 * Class 3 frames from not associated stations. hostapd sends
991 992 993
	 * deauth/disassoc frames when needed. In addition, hostapd is
	 * responsible for filtering on both auth and assoc states.
	 */
994

J
Johannes Berg 已提交
995
	if (ieee80211_vif_is_mesh(&rx->sdata->vif))
996 997
		return ieee80211_rx_mesh_check(rx);

998 999
	if (unlikely((ieee80211_is_data(hdr->frame_control) ||
		      ieee80211_is_pspoll(hdr->frame_control)) &&
1000
		     rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
B
Bill Jordan 已提交
1001
		     rx->sdata->vif.type != NL80211_IFTYPE_WDS &&
J
Johannes Berg 已提交
1002
		     (!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_ASSOC)))) {
1003 1004 1005 1006 1007 1008
		/*
		 * accept port control frames from the AP even when it's not
		 * yet marked ASSOC to prevent a race where we don't set the
		 * assoc bit quickly enough before it sends the first frame
		 */
		if (rx->sta && rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
1009
		    ieee80211_is_data_present(hdr->frame_control)) {
1010 1011 1012 1013 1014 1015 1016 1017 1018 1019
			unsigned int hdrlen;
			__be16 ethertype;

			hdrlen = ieee80211_hdrlen(hdr->frame_control);

			if (rx->skb->len < hdrlen + 8)
				return RX_DROP_MONITOR;

			skb_copy_bits(rx->skb, hdrlen + 6, &ethertype, 2);
			if (ethertype == rx->sdata->control_port_protocol)
1020 1021
				return RX_CONTINUE;
		}
1022 1023 1024 1025 1026 1027 1028

		if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
		    cfg80211_rx_spurious_frame(rx->sdata->dev,
					       hdr->addr2,
					       GFP_ATOMIC))
			return RX_DROP_UNUSABLE;

J
Johannes Berg 已提交
1029
		return RX_DROP_MONITOR;
1030
	}
1031

1032
	return RX_CONTINUE;
1033 1034 1035
}


1036 1037 1038 1039 1040 1041 1042 1043 1044 1045 1046 1047 1048 1049 1050 1051 1052 1053 1054 1055 1056 1057 1058 1059 1060 1061 1062 1063 1064 1065 1066 1067 1068
static ieee80211_rx_result debug_noinline
ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx)
{
	struct ieee80211_local *local;
	struct ieee80211_hdr *hdr;
	struct sk_buff *skb;

	local = rx->local;
	skb = rx->skb;
	hdr = (struct ieee80211_hdr *) skb->data;

	if (!local->pspolling)
		return RX_CONTINUE;

	if (!ieee80211_has_fromds(hdr->frame_control))
		/* this is not from AP */
		return RX_CONTINUE;

	if (!ieee80211_is_data(hdr->frame_control))
		return RX_CONTINUE;

	if (!ieee80211_has_moredata(hdr->frame_control)) {
		/* AP has no more frames buffered for us */
		local->pspolling = false;
		return RX_CONTINUE;
	}

	/* more data bit is set, let's request a new frame from the AP */
	ieee80211_send_pspoll(local, rx->sdata);

	return RX_CONTINUE;
}

1069
static void sta_ps_start(struct sta_info *sta)
1070
{
1071
	struct ieee80211_sub_if_data *sdata = sta->sdata;
1072
	struct ieee80211_local *local = sdata->local;
1073
	struct ps_data *ps;
1074

1075 1076 1077 1078 1079 1080 1081
	if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
	    sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
		ps = &sdata->bss->ps;
	else
		return;

	atomic_inc(&ps->num_sta_ps);
J
Johannes Berg 已提交
1082
	set_sta_flag(sta, WLAN_STA_PS_STA);
1083 1084
	if (!(local->hw.flags & IEEE80211_HW_AP_LINK_PS))
		drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta);
J
Johannes Berg 已提交
1085 1086
	ps_dbg(sdata, "STA %pM aid %d enters power save mode\n",
	       sta->sta.addr, sta->sta.aid);
1087 1088
}

1089
static void sta_ps_end(struct sta_info *sta)
1090
{
J
Johannes Berg 已提交
1091 1092
	ps_dbg(sta->sdata, "STA %pM aid %d exits power save mode\n",
	       sta->sta.addr, sta->sta.aid);
1093

J
Johannes Berg 已提交
1094
	if (test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
J
Johannes Berg 已提交
1095 1096
		ps_dbg(sta->sdata, "STA %pM aid %d driver-ps-blocked\n",
		       sta->sta.addr, sta->sta.aid);
1097 1098 1099 1100
		return;
	}

	ieee80211_sta_ps_deliver_wakeup(sta);
1101 1102
}

1103 1104 1105 1106 1107 1108 1109 1110
int ieee80211_sta_ps_transition(struct ieee80211_sta *sta, bool start)
{
	struct sta_info *sta_inf = container_of(sta, struct sta_info, sta);
	bool in_ps;

	WARN_ON(!(sta_inf->local->hw.flags & IEEE80211_HW_AP_LINK_PS));

	/* Don't let the same PS state be set twice */
J
Johannes Berg 已提交
1111
	in_ps = test_sta_flag(sta_inf, WLAN_STA_PS_STA);
1112 1113 1114 1115
	if ((start && in_ps) || (!start && !in_ps))
		return -EINVAL;

	if (start)
1116
		sta_ps_start(sta_inf);
1117
	else
1118
		sta_ps_end(sta_inf);
1119 1120 1121 1122 1123

	return 0;
}
EXPORT_SYMBOL(ieee80211_sta_ps_transition);

J
Johannes Berg 已提交
1124 1125 1126 1127 1128 1129 1130 1131 1132 1133 1134 1135 1136 1137 1138 1139 1140 1141 1142 1143 1144 1145 1146 1147 1148 1149 1150 1151
static ieee80211_rx_result debug_noinline
ieee80211_rx_h_uapsd_and_pspoll(struct ieee80211_rx_data *rx)
{
	struct ieee80211_sub_if_data *sdata = rx->sdata;
	struct ieee80211_hdr *hdr = (void *)rx->skb->data;
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
	int tid, ac;

	if (!rx->sta || !(status->rx_flags & IEEE80211_RX_RA_MATCH))
		return RX_CONTINUE;

	if (sdata->vif.type != NL80211_IFTYPE_AP &&
	    sdata->vif.type != NL80211_IFTYPE_AP_VLAN)
		return RX_CONTINUE;

	/*
	 * The device handles station powersave, so don't do anything about
	 * uAPSD and PS-Poll frames (the latter shouldn't even come up from
	 * it to mac80211 since they're handled.)
	 */
	if (sdata->local->hw.flags & IEEE80211_HW_AP_LINK_PS)
		return RX_CONTINUE;

	/*
	 * Don't do anything if the station isn't already asleep. In
	 * the uAPSD case, the station will probably be marked asleep,
	 * in the PS-Poll case the station must be confused ...
	 */
J
Johannes Berg 已提交
1152
	if (!test_sta_flag(rx->sta, WLAN_STA_PS_STA))
J
Johannes Berg 已提交
1153 1154 1155
		return RX_CONTINUE;

	if (unlikely(ieee80211_is_pspoll(hdr->frame_control))) {
J
Johannes Berg 已提交
1156 1157
		if (!test_sta_flag(rx->sta, WLAN_STA_SP)) {
			if (!test_sta_flag(rx->sta, WLAN_STA_PS_DRIVER))
1158 1159
				ieee80211_sta_ps_deliver_poll_response(rx->sta);
			else
J
Johannes Berg 已提交
1160
				set_sta_flag(rx->sta, WLAN_STA_PSPOLL);
1161
		}
J
Johannes Berg 已提交
1162 1163 1164 1165 1166 1167 1168 1169 1170 1171 1172 1173 1174 1175 1176 1177 1178 1179 1180 1181 1182 1183 1184 1185 1186

		/* Free PS Poll skb here instead of returning RX_DROP that would
		 * count as an dropped frame. */
		dev_kfree_skb(rx->skb);

		return RX_QUEUED;
	} else if (!ieee80211_has_morefrags(hdr->frame_control) &&
		   !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
		   ieee80211_has_pm(hdr->frame_control) &&
		   (ieee80211_is_data_qos(hdr->frame_control) ||
		    ieee80211_is_qos_nullfunc(hdr->frame_control))) {
		tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
		ac = ieee802_1d_to_ac[tid & 7];

		/*
		 * If this AC is not trigger-enabled do nothing.
		 *
		 * NB: This could/should check a separate bitmap of trigger-
		 * enabled queues, but for now we only implement uAPSD w/o
		 * TSPEC changes to the ACs, so they're always the same.
		 */
		if (!(rx->sta->sta.uapsd_queues & BIT(ac)))
			return RX_CONTINUE;

		/* if we are in a service period, do nothing */
J
Johannes Berg 已提交
1187
		if (test_sta_flag(rx->sta, WLAN_STA_SP))
J
Johannes Berg 已提交
1188 1189
			return RX_CONTINUE;

J
Johannes Berg 已提交
1190
		if (!test_sta_flag(rx->sta, WLAN_STA_PS_DRIVER))
J
Johannes Berg 已提交
1191 1192
			ieee80211_sta_ps_deliver_uapsd(rx->sta);
		else
J
Johannes Berg 已提交
1193
			set_sta_flag(rx->sta, WLAN_STA_UAPSD);
J
Johannes Berg 已提交
1194 1195 1196 1197 1198
	}

	return RX_CONTINUE;
}

1199
static ieee80211_rx_result debug_noinline
1200
ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
1201 1202
{
	struct sta_info *sta = rx->sta;
J
Johannes Berg 已提交
1203 1204 1205
	struct sk_buff *skb = rx->skb;
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1206
	int i;
1207 1208

	if (!sta)
1209
		return RX_CONTINUE;
1210

J
Johannes Berg 已提交
1211 1212
	/*
	 * Update last_rx only for IBSS packets which are for the current
1213 1214 1215 1216 1217
	 * BSSID and for station already AUTHORIZED to avoid keeping the
	 * current IBSS network alive in cases where other STAs start
	 * using different BSSID. This will also give the station another
	 * chance to restart the authentication/authorization in case
	 * something went wrong the first time.
J
Johannes Berg 已提交
1218
	 */
1219
	if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
1220
		u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
1221
						NL80211_IFTYPE_ADHOC);
1222 1223
		if (ether_addr_equal(bssid, rx->sdata->u.ibss.bssid) &&
		    test_sta_flag(sta, WLAN_STA_AUTHORIZED)) {
1224
			sta->last_rx = jiffies;
1225 1226 1227
			if (ieee80211_is_data(hdr->frame_control)) {
				sta->last_rx_rate_idx = status->rate_idx;
				sta->last_rx_rate_flag = status->flag;
1228
				sta->last_rx_rate_vht_flag = status->vht_flag;
1229
				sta->last_rx_rate_vht_nss = status->vht_nss;
1230 1231
			}
		}
J
Johannes Berg 已提交
1232 1233
	} else if (!is_multicast_ether_addr(hdr->addr1)) {
		/*
1234 1235
		 * Mesh beacons will update last_rx when if they are found to
		 * match the current local configuration when processed.
1236
		 */
J
Johannes Berg 已提交
1237
		sta->last_rx = jiffies;
1238 1239 1240
		if (ieee80211_is_data(hdr->frame_control)) {
			sta->last_rx_rate_idx = status->rate_idx;
			sta->last_rx_rate_flag = status->flag;
1241
			sta->last_rx_rate_vht_flag = status->vht_flag;
1242
			sta->last_rx_rate_vht_nss = status->vht_nss;
1243
		}
1244 1245
	}

1246
	if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
1247
		return RX_CONTINUE;
1248

1249 1250 1251
	if (rx->sdata->vif.type == NL80211_IFTYPE_STATION)
		ieee80211_sta_rx_notify(rx->sdata, hdr);

1252 1253
	sta->rx_fragments++;
	sta->rx_bytes += rx->skb->len;
1254 1255 1256 1257
	if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
		sta->last_signal = status->signal;
		ewma_add(&sta->avg_signal, -status->signal);
	}
1258

1259 1260 1261 1262 1263 1264 1265 1266 1267 1268 1269 1270 1271
	if (status->chains) {
		sta->chains = status->chains;
		for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {
			int signal = status->chain_signal[i];

			if (!(status->chains & BIT(i)))
				continue;

			sta->chain_signal_last[i] = signal;
			ewma_add(&sta->chain_signal_avg[i], -signal);
		}
	}

1272 1273 1274 1275
	/*
	 * Change STA power saving mode only at the end of a frame
	 * exchange sequence.
	 */
1276 1277
	if (!(sta->local->hw.flags & IEEE80211_HW_AP_LINK_PS) &&
	    !ieee80211_has_morefrags(hdr->frame_control) &&
1278
	    !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
1279
	    (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1280 1281 1282 1283 1284 1285 1286
	     rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
	    /* PM bit is only checked in frames where it isn't reserved,
	     * in AP mode it's reserved in non-bufferable management frames
	     * (cf. IEEE 802.11-2012 8.2.4.1.7 Power Management field)
	     */
	    (!ieee80211_is_mgmt(hdr->frame_control) ||
	     ieee80211_is_bufferable_mmpdu(hdr->frame_control))) {
J
Johannes Berg 已提交
1287
		if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
1288
			if (!ieee80211_has_pm(hdr->frame_control))
1289
				sta_ps_end(sta);
1290 1291
		} else {
			if (ieee80211_has_pm(hdr->frame_control))
1292
				sta_ps_start(sta);
1293
		}
1294 1295
	}

M
Marco Porsch 已提交
1296 1297 1298 1299
	/* mesh power save support */
	if (ieee80211_vif_is_mesh(&rx->sdata->vif))
		ieee80211_mps_rx_h_sta_process(sta, hdr);

1300 1301 1302 1303 1304 1305
	/*
	 * Drop (qos-)data::nullfunc frames silently, since they
	 * are used only to control station power saving mode.
	 */
	if (ieee80211_is_nullfunc(hdr->frame_control) ||
	    ieee80211_is_qos_nullfunc(hdr->frame_control)) {
1306
		I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
1307 1308 1309

		/*
		 * If we receive a 4-addr nullfunc frame from a STA
1310 1311 1312
		 * that was not moved to a 4-addr STA vlan yet send
		 * the event to userspace and for older hostapd drop
		 * the frame to the monitor interface.
1313 1314 1315 1316
		 */
		if (ieee80211_has_a4(hdr->frame_control) &&
		    (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
		     (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1317 1318 1319 1320 1321
		      !rx->sdata->u.vlan.sta))) {
			if (!test_and_set_sta_flag(sta, WLAN_STA_4ADDR_EVENT))
				cfg80211_rx_unexpected_4addr_frame(
					rx->sdata->dev, sta->sta.addr,
					GFP_ATOMIC);
1322
			return RX_DROP_MONITOR;
1323
		}
1324 1325 1326 1327
		/*
		 * Update counter and free packet here to avoid
		 * counting this as a dropped packed.
		 */
1328 1329
		sta->rx_packets++;
		dev_kfree_skb(rx->skb);
1330
		return RX_QUEUED;
1331 1332
	}

1333
	return RX_CONTINUE;
1334 1335
} /* ieee80211_rx_h_sta_process */

1336 1337 1338 1339 1340 1341 1342 1343 1344 1345 1346 1347
static ieee80211_rx_result debug_noinline
ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
{
	struct sk_buff *skb = rx->skb;
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
	int keyidx;
	int hdrlen;
	ieee80211_rx_result result = RX_DROP_UNUSABLE;
	struct ieee80211_key *sta_ptk = NULL;
	int mmie_keyidx = -1;
	__le16 fc;
1348
	const struct ieee80211_cipher_scheme *cs = NULL;
1349 1350 1351 1352 1353 1354 1355 1356 1357 1358 1359 1360 1361 1362 1363 1364 1365 1366 1367 1368 1369 1370 1371 1372 1373 1374 1375 1376 1377 1378 1379 1380 1381 1382 1383 1384 1385

	/*
	 * Key selection 101
	 *
	 * There are four types of keys:
	 *  - GTK (group keys)
	 *  - IGTK (group keys for management frames)
	 *  - PTK (pairwise keys)
	 *  - STK (station-to-station pairwise keys)
	 *
	 * When selecting a key, we have to distinguish between multicast
	 * (including broadcast) and unicast frames, the latter can only
	 * use PTKs and STKs while the former always use GTKs and IGTKs.
	 * Unless, of course, actual WEP keys ("pre-RSNA") are used, then
	 * unicast frames can also use key indices like GTKs. Hence, if we
	 * don't have a PTK/STK we check the key index for a WEP key.
	 *
	 * Note that in a regular BSS, multicast frames are sent by the
	 * AP only, associated stations unicast the frame to the AP first
	 * which then multicasts it on their behalf.
	 *
	 * There is also a slight problem in IBSS mode: GTKs are negotiated
	 * with each station, that is something we don't currently handle.
	 * The spec seems to expect that one negotiates the same key with
	 * every station but there's no such requirement; VLANs could be
	 * possible.
	 */

	/*
	 * No point in finding a key and decrypting if the frame is neither
	 * addressed to us nor a multicast frame.
	 */
	if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
		return RX_CONTINUE;

	/* start without a key */
	rx->key = NULL;
1386
	fc = hdr->frame_control;
1387

1388 1389
	if (rx->sta) {
		int keyid = rx->sta->ptk_idx;
1390

1391 1392 1393 1394 1395 1396 1397 1398
		if (ieee80211_has_protected(fc) && rx->sta->cipher_scheme) {
			cs = rx->sta->cipher_scheme;
			keyid = iwl80211_get_cs_keyid(cs, rx->skb);
			if (unlikely(keyid < 0))
				return RX_DROP_UNUSABLE;
		}
		sta_ptk = rcu_dereference(rx->sta->ptk[keyid]);
	}
1399 1400 1401 1402 1403 1404 1405 1406 1407 1408 1409 1410 1411 1412 1413 1414 1415 1416 1417 1418 1419 1420 1421 1422 1423 1424 1425 1426 1427 1428 1429 1430 1431 1432 1433 1434 1435 1436 1437 1438 1439 1440 1441 1442 1443 1444 1445 1446 1447 1448 1449 1450 1451 1452 1453 1454 1455 1456 1457 1458 1459

	if (!ieee80211_has_protected(fc))
		mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);

	if (!is_multicast_ether_addr(hdr->addr1) && sta_ptk) {
		rx->key = sta_ptk;
		if ((status->flag & RX_FLAG_DECRYPTED) &&
		    (status->flag & RX_FLAG_IV_STRIPPED))
			return RX_CONTINUE;
		/* Skip decryption if the frame is not protected. */
		if (!ieee80211_has_protected(fc))
			return RX_CONTINUE;
	} else if (mmie_keyidx >= 0) {
		/* Broadcast/multicast robust management frame / BIP */
		if ((status->flag & RX_FLAG_DECRYPTED) &&
		    (status->flag & RX_FLAG_IV_STRIPPED))
			return RX_CONTINUE;

		if (mmie_keyidx < NUM_DEFAULT_KEYS ||
		    mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
			return RX_DROP_MONITOR; /* unexpected BIP keyidx */
		if (rx->sta)
			rx->key = rcu_dereference(rx->sta->gtk[mmie_keyidx]);
		if (!rx->key)
			rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]);
	} else if (!ieee80211_has_protected(fc)) {
		/*
		 * The frame was not protected, so skip decryption. However, we
		 * need to set rx->key if there is a key that could have been
		 * used so that the frame may be dropped if encryption would
		 * have been expected.
		 */
		struct ieee80211_key *key = NULL;
		struct ieee80211_sub_if_data *sdata = rx->sdata;
		int i;

		if (ieee80211_is_mgmt(fc) &&
		    is_multicast_ether_addr(hdr->addr1) &&
		    (key = rcu_dereference(rx->sdata->default_mgmt_key)))
			rx->key = key;
		else {
			if (rx->sta) {
				for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
					key = rcu_dereference(rx->sta->gtk[i]);
					if (key)
						break;
				}
			}
			if (!key) {
				for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
					key = rcu_dereference(sdata->keys[i]);
					if (key)
						break;
				}
			}
			if (key)
				rx->key = key;
		}
		return RX_CONTINUE;
	} else {
		u8 keyid;
1460

1461 1462 1463 1464 1465 1466 1467 1468 1469 1470 1471 1472 1473 1474 1475
		/*
		 * The device doesn't give us the IV so we won't be
		 * able to look up the key. That's ok though, we
		 * don't need to decrypt the frame, we just won't
		 * be able to keep statistics accurate.
		 * Except for key threshold notifications, should
		 * we somehow allow the driver to tell us which key
		 * the hardware used if this flag is set?
		 */
		if ((status->flag & RX_FLAG_DECRYPTED) &&
		    (status->flag & RX_FLAG_IV_STRIPPED))
			return RX_CONTINUE;

		hdrlen = ieee80211_hdrlen(fc);

1476 1477
		if (cs) {
			keyidx = iwl80211_get_cs_keyid(cs, rx->skb);
1478

1479 1480 1481 1482 1483 1484 1485 1486 1487 1488 1489 1490
			if (unlikely(keyidx < 0))
				return RX_DROP_UNUSABLE;
		} else {
			if (rx->skb->len < 8 + hdrlen)
				return RX_DROP_UNUSABLE; /* TODO: count this? */
			/*
			 * no need to call ieee80211_wep_get_keyidx,
			 * it verifies a bunch of things we've done already
			 */
			skb_copy_bits(rx->skb, hdrlen + 3, &keyid, 1);
			keyidx = keyid >> 6;
		}
1491 1492 1493 1494 1495 1496 1497 1498 1499 1500 1501 1502 1503 1504 1505 1506 1507 1508 1509 1510 1511 1512 1513 1514 1515 1516 1517 1518 1519 1520 1521 1522 1523 1524 1525 1526 1527 1528 1529 1530 1531 1532 1533 1534 1535 1536 1537

		/* check per-station GTK first, if multicast packet */
		if (is_multicast_ether_addr(hdr->addr1) && rx->sta)
			rx->key = rcu_dereference(rx->sta->gtk[keyidx]);

		/* if not found, try default key */
		if (!rx->key) {
			rx->key = rcu_dereference(rx->sdata->keys[keyidx]);

			/*
			 * RSNA-protected unicast frames should always be
			 * sent with pairwise or station-to-station keys,
			 * but for WEP we allow using a key index as well.
			 */
			if (rx->key &&
			    rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 &&
			    rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 &&
			    !is_multicast_ether_addr(hdr->addr1))
				rx->key = NULL;
		}
	}

	if (rx->key) {
		if (unlikely(rx->key->flags & KEY_FLAG_TAINTED))
			return RX_DROP_MONITOR;

		rx->key->tx_rx_count++;
		/* TODO: add threshold stuff again */
	} else {
		return RX_DROP_MONITOR;
	}

	switch (rx->key->conf.cipher) {
	case WLAN_CIPHER_SUITE_WEP40:
	case WLAN_CIPHER_SUITE_WEP104:
		result = ieee80211_crypto_wep_decrypt(rx);
		break;
	case WLAN_CIPHER_SUITE_TKIP:
		result = ieee80211_crypto_tkip_decrypt(rx);
		break;
	case WLAN_CIPHER_SUITE_CCMP:
		result = ieee80211_crypto_ccmp_decrypt(rx);
		break;
	case WLAN_CIPHER_SUITE_AES_CMAC:
		result = ieee80211_crypto_aes_cmac_decrypt(rx);
		break;
	default:
1538
		result = ieee80211_crypto_hw_decrypt(rx);
1539 1540 1541 1542 1543 1544 1545 1546 1547 1548
	}

	/* the hdr variable is invalid after the decrypt handlers */

	/* either the frame has been decrypted or will be dropped */
	status->flag |= RX_FLAG_DECRYPTED;

	return result;
}

1549 1550 1551 1552 1553 1554 1555 1556 1557 1558 1559
static inline struct ieee80211_fragment_entry *
ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
			 unsigned int frag, unsigned int seq, int rx_queue,
			 struct sk_buff **skb)
{
	struct ieee80211_fragment_entry *entry;

	entry = &sdata->fragments[sdata->fragment_next++];
	if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
		sdata->fragment_next = 0;

J
Johannes Berg 已提交
1560
	if (!skb_queue_empty(&entry->skb_list))
1561 1562 1563 1564 1565 1566 1567 1568 1569 1570 1571 1572 1573 1574 1575 1576
		__skb_queue_purge(&entry->skb_list);

	__skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
	*skb = NULL;
	entry->first_frag_time = jiffies;
	entry->seq = seq;
	entry->rx_queue = rx_queue;
	entry->last_frag = frag;
	entry->ccmp = 0;
	entry->extra_len = 0;

	return entry;
}

static inline struct ieee80211_fragment_entry *
ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
1577
			  unsigned int frag, unsigned int seq,
1578 1579 1580 1581 1582 1583 1584 1585 1586 1587 1588 1589 1590 1591 1592 1593 1594 1595 1596
			  int rx_queue, struct ieee80211_hdr *hdr)
{
	struct ieee80211_fragment_entry *entry;
	int i, idx;

	idx = sdata->fragment_next;
	for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
		struct ieee80211_hdr *f_hdr;

		idx--;
		if (idx < 0)
			idx = IEEE80211_FRAGMENT_MAX - 1;

		entry = &sdata->fragments[idx];
		if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
		    entry->rx_queue != rx_queue ||
		    entry->last_frag + 1 != frag)
			continue;

1597
		f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data;
1598

1599 1600 1601 1602 1603
		/*
		 * Check ftype and addresses are equal, else check next fragment
		 */
		if (((hdr->frame_control ^ f_hdr->frame_control) &
		     cpu_to_le16(IEEE80211_FCTL_FTYPE)) ||
1604 1605
		    !ether_addr_equal(hdr->addr1, f_hdr->addr1) ||
		    !ether_addr_equal(hdr->addr2, f_hdr->addr2))
1606 1607
			continue;

1608
		if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
1609 1610 1611 1612 1613 1614 1615 1616 1617
			__skb_queue_purge(&entry->skb_list);
			continue;
		}
		return entry;
	}

	return NULL;
}

1618
static ieee80211_rx_result debug_noinline
1619
ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
1620 1621 1622
{
	struct ieee80211_hdr *hdr;
	u16 sc;
1623
	__le16 fc;
1624 1625 1626
	unsigned int frag, seq;
	struct ieee80211_fragment_entry *entry;
	struct sk_buff *skb;
1627
	struct ieee80211_rx_status *status;
1628

1629
	hdr = (struct ieee80211_hdr *)rx->skb->data;
1630
	fc = hdr->frame_control;
1631 1632 1633 1634

	if (ieee80211_is_ctl(fc))
		return RX_CONTINUE;

1635 1636 1637
	sc = le16_to_cpu(hdr->seq_ctrl);
	frag = sc & IEEE80211_SCTL_FRAG;

1638
	if (likely((!ieee80211_has_morefrags(fc) && frag == 0) ||
1639 1640 1641 1642 1643 1644
		   is_multicast_ether_addr(hdr->addr1))) {
		/* not fragmented */
		goto out;
	}
	I802_DEBUG_INC(rx->local->rx_handlers_fragments);

Z
Zhu Yi 已提交
1645 1646 1647
	if (skb_linearize(rx->skb))
		return RX_DROP_UNUSABLE;

1648 1649 1650 1651 1652 1653
	/*
	 *  skb_linearize() might change the skb->data and
	 *  previously cached variables (in this case, hdr) need to
	 *  be refreshed with the new data.
	 */
	hdr = (struct ieee80211_hdr *)rx->skb->data;
1654 1655 1656 1657 1658
	seq = (sc & IEEE80211_SCTL_SEQ) >> 4;

	if (frag == 0) {
		/* This is the first fragment of a new frame. */
		entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
1659
						 rx->seqno_idx, &(rx->skb));
1660
		if (rx->key && rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP &&
1661
		    ieee80211_has_protected(fc)) {
1662
			int queue = rx->security_idx;
1663 1664 1665 1666
			/* Store CCMP PN so that we can verify that the next
			 * fragment has a sequential PN value. */
			entry->ccmp = 1;
			memcpy(entry->last_pn,
1667
			       rx->key->u.ccmp.rx_pn[queue],
1668
			       IEEE80211_CCMP_PN_LEN);
1669
		}
1670
		return RX_QUEUED;
1671 1672 1673 1674 1675
	}

	/* This is a fragment for a frame that should already be pending in
	 * fragment cache. Add this fragment to the end of the pending entry.
	 */
1676 1677
	entry = ieee80211_reassemble_find(rx->sdata, frag, seq,
					  rx->seqno_idx, hdr);
1678 1679
	if (!entry) {
		I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
J
Johannes Berg 已提交
1680
		return RX_DROP_MONITOR;
1681 1682 1683 1684 1685 1686
	}

	/* Verify that MPDUs within one MSDU have sequential PN values.
	 * (IEEE 802.11i, 8.3.3.4.5) */
	if (entry->ccmp) {
		int i;
1687
		u8 pn[IEEE80211_CCMP_PN_LEN], *rpn;
1688
		int queue;
1689
		if (!rx->key || rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP)
J
Johannes Berg 已提交
1690
			return RX_DROP_UNUSABLE;
1691 1692
		memcpy(pn, entry->last_pn, IEEE80211_CCMP_PN_LEN);
		for (i = IEEE80211_CCMP_PN_LEN - 1; i >= 0; i--) {
1693 1694 1695 1696
			pn[i]++;
			if (pn[i])
				break;
		}
1697
		queue = rx->security_idx;
1698
		rpn = rx->key->u.ccmp.rx_pn[queue];
1699
		if (memcmp(pn, rpn, IEEE80211_CCMP_PN_LEN))
J
Johannes Berg 已提交
1700
			return RX_DROP_UNUSABLE;
1701
		memcpy(entry->last_pn, pn, IEEE80211_CCMP_PN_LEN);
1702 1703
	}

1704
	skb_pull(rx->skb, ieee80211_hdrlen(fc));
1705 1706 1707
	__skb_queue_tail(&entry->skb_list, rx->skb);
	entry->last_frag = frag;
	entry->extra_len += rx->skb->len;
1708
	if (ieee80211_has_morefrags(fc)) {
1709
		rx->skb = NULL;
1710
		return RX_QUEUED;
1711 1712 1713 1714 1715 1716 1717 1718 1719
	}

	rx->skb = __skb_dequeue(&entry->skb_list);
	if (skb_tailroom(rx->skb) < entry->extra_len) {
		I802_DEBUG_INC(rx->local->rx_expand_skb_head2);
		if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
					      GFP_ATOMIC))) {
			I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
			__skb_queue_purge(&entry->skb_list);
J
Johannes Berg 已提交
1720
			return RX_DROP_UNUSABLE;
1721 1722 1723 1724 1725 1726 1727 1728
		}
	}
	while ((skb = __skb_dequeue(&entry->skb_list))) {
		memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len);
		dev_kfree_skb(skb);
	}

	/* Complete frame has been reassembled - process it now */
1729 1730
	status = IEEE80211_SKB_RXCB(rx->skb);
	status->rx_flags |= IEEE80211_RX_FRAGMENTED;
1731 1732 1733 1734 1735 1736 1737 1738

 out:
	if (rx->sta)
		rx->sta->rx_packets++;
	if (is_multicast_ether_addr(hdr->addr1))
		rx->local->dot11MulticastReceivedFrameCount++;
	else
		ieee80211_led_rx(rx->local);
1739
	return RX_CONTINUE;
1740 1741
}

J
Johannes Berg 已提交
1742
static int ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
1743
{
J
Johannes Berg 已提交
1744
	if (unlikely(!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_AUTHORIZED)))
1745
		return -EACCES;
1746

1747
	return 0;
1748 1749
}

J
Johannes Berg 已提交
1750
static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
1751
{
J
Johannes Berg 已提交
1752 1753 1754
	struct sk_buff *skb = rx->skb;
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);

1755
	/*
1756 1757
	 * Pass through unencrypted frames if the hardware has
	 * decrypted them already.
1758
	 */
J
Johannes Berg 已提交
1759
	if (status->flag & RX_FLAG_DECRYPTED)
1760
		return 0;
1761 1762

	/* Drop unencrypted frames if key is set. */
1763 1764
	if (unlikely(!ieee80211_has_protected(fc) &&
		     !ieee80211_is_nullfunc(fc) &&
1765
		     ieee80211_is_data(fc) &&
1766
		     (rx->key || rx->sdata->drop_unencrypted)))
1767
		return -EACCES;
1768 1769 1770 1771

	return 0;
}

J
Johannes Berg 已提交
1772
static int ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)
1773 1774
{
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1775
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1776 1777
	__le16 fc = hdr->frame_control;

1778 1779 1780 1781 1782 1783
	/*
	 * Pass through unencrypted frames if the hardware has
	 * decrypted them already.
	 */
	if (status->flag & RX_FLAG_DECRYPTED)
		return 0;
1784

J
Johannes Berg 已提交
1785
	if (rx->sta && test_sta_flag(rx->sta, WLAN_STA_MFP)) {
1786 1787
		if (unlikely(!ieee80211_has_protected(fc) &&
			     ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
1788
			     rx->key)) {
1789 1790 1791 1792 1793
			if (ieee80211_is_deauth(fc) ||
			    ieee80211_is_disassoc(fc))
				cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
							     rx->skb->data,
							     rx->skb->len);
1794
			return -EACCES;
1795
		}
1796
		/* BIP does not use Protected field, so need to check MMIE */
1797
		if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
1798
			     ieee80211_get_mmie_keyidx(rx->skb) < 0)) {
1799 1800 1801 1802 1803
			if (ieee80211_is_deauth(fc) ||
			    ieee80211_is_disassoc(fc))
				cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
							     rx->skb->data,
							     rx->skb->len);
1804
			return -EACCES;
1805
		}
1806 1807 1808 1809 1810
		/*
		 * When using MFP, Action frames are not allowed prior to
		 * having configured keys.
		 */
		if (unlikely(ieee80211_is_action(fc) && !rx->key &&
1811
			     ieee80211_is_robust_mgmt_frame(rx->skb)))
1812 1813
			return -EACCES;
	}
1814

1815
	return 0;
1816 1817
}

1818
static int
1819
__ieee80211_data_to_8023(struct ieee80211_rx_data *rx, bool *port_control)
1820
{
J
Johannes Berg 已提交
1821
	struct ieee80211_sub_if_data *sdata = rx->sdata;
1822
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1823 1824 1825
	bool check_port_control = false;
	struct ethhdr *ehdr;
	int ret;
1826

1827
	*port_control = false;
1828 1829
	if (ieee80211_has_a4(hdr->frame_control) &&
	    sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta)
1830
		return -1;
1831

1832 1833 1834 1835 1836 1837 1838 1839 1840
	if (sdata->vif.type == NL80211_IFTYPE_STATION &&
	    !!sdata->u.mgd.use_4addr != !!ieee80211_has_a4(hdr->frame_control)) {

		if (!sdata->u.mgd.use_4addr)
			return -1;
		else
			check_port_control = true;
	}

1841
	if (is_multicast_ether_addr(hdr->addr1) &&
1842
	    sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta)
1843
		return -1;
1844

1845
	ret = ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type);
1846
	if (ret < 0)
1847 1848 1849
		return ret;

	ehdr = (struct ethhdr *) rx->skb->data;
1850 1851 1852
	if (ehdr->h_proto == rx->sdata->control_port_protocol)
		*port_control = true;
	else if (check_port_control)
1853 1854 1855
		return -1;

	return 0;
1856
}
1857

1858 1859 1860
/*
 * requires that rx->skb is a frame with ethernet header
 */
1861
static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
1862
{
1863
	static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
1864 1865 1866 1867 1868 1869 1870
		= { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
	struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;

	/*
	 * Allow EAPOL frames to us/the PAE group address regardless
	 * of whether the frame was encrypted or not.
	 */
1871
	if (ehdr->h_proto == rx->sdata->control_port_protocol &&
1872 1873
	    (ether_addr_equal(ehdr->h_dest, rx->sdata->vif.addr) ||
	     ether_addr_equal(ehdr->h_dest, pae_group_addr)))
1874 1875 1876
		return true;

	if (ieee80211_802_1x_port_control(rx) ||
1877
	    ieee80211_drop_unencrypted(rx, fc))
1878 1879 1880 1881 1882 1883 1884 1885
		return false;

	return true;
}

/*
 * requires that rx->skb is a frame with ethernet header
 */
1886
static void
1887
ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
1888
{
J
Johannes Berg 已提交
1889 1890
	struct ieee80211_sub_if_data *sdata = rx->sdata;
	struct net_device *dev = sdata->dev;
1891
	struct sk_buff *skb, *xmit_skb;
1892 1893
	struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
	struct sta_info *dsta;
1894
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1895

1896 1897
	skb = rx->skb;
	xmit_skb = NULL;
1898

1899 1900
	if ((sdata->vif.type == NL80211_IFTYPE_AP ||
	     sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
1901
	    !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
1902
	    (status->rx_flags & IEEE80211_RX_RA_MATCH) &&
1903
	    (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) {
1904 1905 1906 1907 1908
		if (is_multicast_ether_addr(ehdr->h_dest)) {
			/*
			 * send multicast frames both to higher layers in
			 * local net stack and back to the wireless medium
			 */
1909
			xmit_skb = skb_copy(skb, GFP_ATOMIC);
1910
			if (!xmit_skb)
J
Johannes Berg 已提交
1911
				net_info_ratelimited("%s: failed to clone multicast frame\n",
1912
						    dev->name);
1913
		} else {
1914 1915
			dsta = sta_info_get(sdata, skb->data);
			if (dsta) {
1916 1917 1918 1919 1920
				/*
				 * The destination station is associated to
				 * this AP (in this VLAN), so send the frame
				 * directly to it and do not pass it to local
				 * net stack.
1921
				 */
1922
				xmit_skb = skb;
1923 1924 1925 1926 1927
				skb = NULL;
			}
		}
	}

1928
#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
1929 1930 1931 1932 1933 1934
	if (skb) {
		/* 'align' will only take the values 0 or 2 here since all
		 * frames are required to be aligned to 2-byte boundaries
		 * when being passed to mac80211; the code here works just
		 * as well if that isn't true, but mac80211 assumes it can
		 * access fields as 2-byte aligned (e.g. for ether_addr_equal)
1935
		 */
1936 1937 1938
		int align;

		align = (unsigned long)(skb->data + sizeof(struct ethhdr)) & 3;
1939 1940 1941 1942 1943 1944
		if (align) {
			if (WARN_ON(skb_headroom(skb) < 3)) {
				dev_kfree_skb(skb);
				skb = NULL;
			} else {
				u8 *data = skb->data;
1945 1946 1947 1948
				size_t len = skb_headlen(skb);
				skb->data -= align;
				memmove(skb->data, data, len);
				skb_set_tail_pointer(skb, len);
1949 1950
			}
		}
1951
	}
1952 1953
#endif

1954 1955 1956 1957
	if (skb) {
		/* deliver to local stack */
		skb->protocol = eth_type_trans(skb, dev);
		memset(skb->cb, 0, sizeof(skb->cb));
J
Johannes Berg 已提交
1958 1959 1960 1961
		if (rx->local->napi)
			napi_gro_receive(rx->local->napi, skb);
		else
			netif_receive_skb(skb);
1962 1963
	}

1964
	if (xmit_skb) {
1965 1966 1967 1968 1969 1970
		/*
		 * Send to wireless media and increase priority by 256 to
		 * keep the received priority instead of reclassifying
		 * the frame (see cfg80211_classify8021d).
		 */
		xmit_skb->priority += 256;
1971
		xmit_skb->protocol = htons(ETH_P_802_3);
1972 1973
		skb_reset_network_header(xmit_skb);
		skb_reset_mac_header(xmit_skb);
1974
		dev_queue_xmit(xmit_skb);
1975
	}
1976 1977
}

1978
static ieee80211_rx_result debug_noinline
1979
ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
1980
{
J
Johannes Berg 已提交
1981
	struct net_device *dev = rx->sdata->dev;
Z
Zhu Yi 已提交
1982
	struct sk_buff *skb = rx->skb;
1983 1984
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
	__le16 fc = hdr->frame_control;
Z
Zhu Yi 已提交
1985
	struct sk_buff_head frame_list;
1986
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1987

1988
	if (unlikely(!ieee80211_is_data(fc)))
1989
		return RX_CONTINUE;
1990

1991
	if (unlikely(!ieee80211_is_data_present(fc)))
J
Johannes Berg 已提交
1992
		return RX_DROP_MONITOR;
1993

1994
	if (!(status->rx_flags & IEEE80211_RX_AMSDU))
1995
		return RX_CONTINUE;
1996

Z
Zhu Yi 已提交
1997 1998 1999
	if (ieee80211_has_a4(hdr->frame_control) &&
	    rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
	    !rx->sdata->u.vlan.sta)
J
Johannes Berg 已提交
2000
		return RX_DROP_UNUSABLE;
2001

Z
Zhu Yi 已提交
2002 2003 2004 2005 2006
	if (is_multicast_ether_addr(hdr->addr1) &&
	    ((rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
	      rx->sdata->u.vlan.sta) ||
	     (rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
	      rx->sdata->u.mgd.use_4addr)))
J
Johannes Berg 已提交
2007
		return RX_DROP_UNUSABLE;
2008

Z
Zhu Yi 已提交
2009 2010
	skb->dev = dev;
	__skb_queue_head_init(&frame_list);
2011

Z
Zhu Yi 已提交
2012 2013 2014
	if (skb_linearize(skb))
		return RX_DROP_UNUSABLE;

Z
Zhu Yi 已提交
2015 2016
	ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
				 rx->sdata->vif.type,
2017
				 rx->local->hw.extra_tx_headroom, true);
2018

Z
Zhu Yi 已提交
2019 2020
	while (!skb_queue_empty(&frame_list)) {
		rx->skb = __skb_dequeue(&frame_list);
2021

2022
		if (!ieee80211_frame_allowed(rx, fc)) {
Z
Zhu Yi 已提交
2023
			dev_kfree_skb(rx->skb);
2024 2025
			continue;
		}
Z
Zhu Yi 已提交
2026 2027
		dev->stats.rx_packets++;
		dev->stats.rx_bytes += rx->skb->len;
2028 2029 2030 2031

		ieee80211_deliver_skb(rx);
	}

2032
	return RX_QUEUED;
2033 2034
}

I
Ingo Molnar 已提交
2035
#ifdef CONFIG_MAC80211_MESH
2036
static ieee80211_rx_result
2037 2038
ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
{
2039 2040
	struct ieee80211_hdr *fwd_hdr, *hdr;
	struct ieee80211_tx_info *info;
2041 2042
	struct ieee80211s_hdr *mesh_hdr;
	struct sk_buff *skb = rx->skb, *fwd_skb;
J
Johannes Berg 已提交
2043
	struct ieee80211_local *local = rx->local;
J
Johannes Berg 已提交
2044
	struct ieee80211_sub_if_data *sdata = rx->sdata;
2045
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2046 2047
	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
	u16 q, hdrlen;
2048 2049 2050

	hdr = (struct ieee80211_hdr *) skb->data;
	hdrlen = ieee80211_hdrlen(hdr->frame_control);
2051 2052 2053 2054 2055 2056 2057 2058 2059 2060 2061 2062 2063 2064

	/* make sure fixed part of mesh header is there, also checks skb len */
	if (!pskb_may_pull(rx->skb, hdrlen + 6))
		return RX_DROP_MONITOR;

	mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);

	/* make sure full mesh header is there, also checks skb len */
	if (!pskb_may_pull(rx->skb,
			   hdrlen + ieee80211_get_mesh_hdrlen(mesh_hdr)))
		return RX_DROP_MONITOR;

	/* reload pointers */
	hdr = (struct ieee80211_hdr *) skb->data;
2065 2066
	mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);

2067 2068 2069
	/* frame is in RMC, don't forward */
	if (ieee80211_is_data(hdr->frame_control) &&
	    is_multicast_ether_addr(hdr->addr1) &&
J
Johannes Berg 已提交
2070
	    mesh_rmc_check(rx->sdata, hdr->addr3, mesh_hdr))
2071 2072
		return RX_DROP_MONITOR;

2073 2074
	if (!ieee80211_is_data(hdr->frame_control) ||
	    !(status->rx_flags & IEEE80211_RX_RA_MATCH))
2075 2076 2077 2078 2079
		return RX_CONTINUE;

	if (!mesh_hdr->ttl)
		return RX_DROP_MONITOR;

2080
	if (mesh_hdr->flags & MESH_FLAGS_AE) {
2081
		struct mesh_path *mppath;
2082 2083 2084 2085 2086 2087
		char *proxied_addr;
		char *mpp_addr;

		if (is_multicast_ether_addr(hdr->addr1)) {
			mpp_addr = hdr->addr3;
			proxied_addr = mesh_hdr->eaddr1;
2088 2089
		} else if (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6) {
			/* has_a4 already checked in ieee80211_rx_mesh_check */
2090 2091
			mpp_addr = hdr->addr4;
			proxied_addr = mesh_hdr->eaddr2;
2092 2093
		} else {
			return RX_DROP_MONITOR;
2094
		}
2095 2096

		rcu_read_lock();
J
Johannes Berg 已提交
2097
		mppath = mpp_path_lookup(sdata, proxied_addr);
2098
		if (!mppath) {
J
Johannes Berg 已提交
2099
			mpp_path_add(sdata, proxied_addr, mpp_addr);
2100 2101
		} else {
			spin_lock_bh(&mppath->state_lock);
2102
			if (!ether_addr_equal(mppath->mpp, mpp_addr))
2103
				memcpy(mppath->mpp, mpp_addr, ETH_ALEN);
2104 2105 2106 2107 2108
			spin_unlock_bh(&mppath->state_lock);
		}
		rcu_read_unlock();
	}

2109 2110
	/* Frame has reached destination.  Don't forward */
	if (!is_multicast_ether_addr(hdr->addr1) &&
2111
	    ether_addr_equal(sdata->vif.addr, hdr->addr3))
2112 2113
		return RX_CONTINUE;

Y
Yoni Divinsky 已提交
2114
	q = ieee80211_select_queue_80211(sdata, skb, hdr);
2115
	if (ieee80211_queue_stopped(&local->hw, q)) {
2116
		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion);
2117 2118 2119
		return RX_DROP_MONITOR;
	}
	skb_set_queue_mapping(skb, q);
2120

2121 2122
	if (!--mesh_hdr->ttl) {
		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl);
2123
		goto out;
2124 2125
	}

2126 2127 2128
	if (!ifmsh->mshcfg.dot11MeshForwarding)
		goto out;

2129 2130
	fwd_skb = skb_copy(skb, GFP_ATOMIC);
	if (!fwd_skb) {
J
Johannes Berg 已提交
2131
		net_info_ratelimited("%s: failed to clone mesh frame\n",
2132
				    sdata->name);
2133 2134 2135 2136
		goto out;
	}

	fwd_hdr =  (struct ieee80211_hdr *) fwd_skb->data;
2137
	fwd_hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_RETRY);
2138 2139 2140 2141 2142 2143 2144 2145
	info = IEEE80211_SKB_CB(fwd_skb);
	memset(info, 0, sizeof(*info));
	info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
	info->control.vif = &rx->sdata->vif;
	info->control.jiffies = jiffies;
	if (is_multicast_ether_addr(fwd_hdr->addr1)) {
		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_mcast);
		memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
M
Marco Porsch 已提交
2146 2147
		/* update power mode indication when forwarding */
		ieee80211_mps_set_frame_flags(sdata, NULL, fwd_hdr);
J
Johannes Berg 已提交
2148
	} else if (!mesh_nexthop_lookup(sdata, fwd_skb)) {
M
Marco Porsch 已提交
2149
		/* mesh power mode flags updated in mesh_nexthop_lookup */
2150 2151 2152
		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast);
	} else {
		/* unable to resolve next hop */
J
Johannes Berg 已提交
2153
		mesh_path_error_tx(sdata, ifmsh->mshcfg.element_ttl,
2154 2155 2156
				   fwd_hdr->addr3, 0,
				   WLAN_REASON_MESH_PATH_NOFORWARD,
				   fwd_hdr->addr2);
2157
		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_no_route);
2158
		kfree_skb(fwd_skb);
2159
		return RX_DROP_MONITOR;
2160 2161
	}

2162 2163
	IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
	ieee80211_add_pending_skb(local, fwd_skb);
J
Johannes Berg 已提交
2164
 out:
2165
	if (is_multicast_ether_addr(hdr->addr1) ||
J
Johannes Berg 已提交
2166
	    sdata->dev->flags & IFF_PROMISC)
2167 2168 2169 2170
		return RX_CONTINUE;
	else
		return RX_DROP_MONITOR;
}
I
Ingo Molnar 已提交
2171
#endif
2172

2173
static ieee80211_rx_result debug_noinline
2174
ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
2175
{
J
Johannes Berg 已提交
2176
	struct ieee80211_sub_if_data *sdata = rx->sdata;
2177
	struct ieee80211_local *local = rx->local;
J
Johannes Berg 已提交
2178
	struct net_device *dev = sdata->dev;
2179 2180
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
	__le16 fc = hdr->frame_control;
2181
	bool port_control;
2182
	int err;
2183

2184
	if (unlikely(!ieee80211_is_data(hdr->frame_control)))
2185
		return RX_CONTINUE;
2186

2187
	if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
J
Johannes Berg 已提交
2188
		return RX_DROP_MONITOR;
2189

2190
	/*
2191 2192
	 * Send unexpected-4addr-frame event to hostapd. For older versions,
	 * also drop the frame to cooked monitor interfaces.
2193 2194
	 */
	if (ieee80211_has_a4(hdr->frame_control) &&
2195 2196 2197 2198 2199
	    sdata->vif.type == NL80211_IFTYPE_AP) {
		if (rx->sta &&
		    !test_and_set_sta_flag(rx->sta, WLAN_STA_4ADDR_EVENT))
			cfg80211_rx_unexpected_4addr_frame(
				rx->sdata->dev, rx->sta->sta.addr, GFP_ATOMIC);
2200
		return RX_DROP_MONITOR;
2201
	}
2202

2203
	err = __ieee80211_data_to_8023(rx, &port_control);
2204
	if (unlikely(err))
J
Johannes Berg 已提交
2205
		return RX_DROP_UNUSABLE;
2206

2207
	if (!ieee80211_frame_allowed(rx, fc))
J
Johannes Berg 已提交
2208
		return RX_DROP_MONITOR;
2209

2210 2211 2212 2213 2214 2215 2216 2217
	if (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
	    unlikely(port_control) && sdata->bss) {
		sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
				     u.ap);
		dev = sdata->dev;
		rx->sdata = sdata;
	}

2218 2219 2220 2221 2222
	rx->skb->dev = dev;

	dev->stats.rx_packets++;
	dev->stats.rx_bytes += rx->skb->len;

2223
	if (local->ps_sdata && local->hw.conf.dynamic_ps_timeout > 0 &&
2224 2225 2226 2227
	    !is_multicast_ether_addr(
		    ((struct ethhdr *)rx->skb->data)->h_dest) &&
	    (!local->scanning &&
	     !test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))) {
2228 2229 2230 2231
			mod_timer(&local->dynamic_ps_timer, jiffies +
			 msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
	}

2232
	ieee80211_deliver_skb(rx);
2233

2234
	return RX_QUEUED;
2235 2236
}

2237
static ieee80211_rx_result debug_noinline
2238
ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames)
2239 2240
{
	struct sk_buff *skb = rx->skb;
2241
	struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
2242 2243 2244 2245
	struct tid_ampdu_rx *tid_agg_rx;
	u16 start_seq_num;
	u16 tid;

2246
	if (likely(!ieee80211_is_ctl(bar->frame_control)))
2247
		return RX_CONTINUE;
2248

2249
	if (ieee80211_is_back_req(bar->frame_control)) {
2250 2251 2252 2253
		struct {
			__le16 control, start_seq_num;
		} __packed bar_data;

2254
		if (!rx->sta)
2255
			return RX_DROP_MONITOR;
2256 2257 2258 2259 2260 2261

		if (skb_copy_bits(skb, offsetof(struct ieee80211_bar, control),
				  &bar_data, sizeof(bar_data)))
			return RX_DROP_MONITOR;

		tid = le16_to_cpu(bar_data.control) >> 12;
2262 2263 2264

		tid_agg_rx = rcu_dereference(rx->sta->ampdu_mlme.tid_rx[tid]);
		if (!tid_agg_rx)
2265
			return RX_DROP_MONITOR;
2266

2267
		start_seq_num = le16_to_cpu(bar_data.start_seq_num) >> 4;
2268 2269

		/* reset session timer */
2270 2271 2272
		if (tid_agg_rx->timeout)
			mod_timer(&tid_agg_rx->session_timer,
				  TU_TO_EXP_TIME(tid_agg_rx->timeout));
2273

2274
		spin_lock(&tid_agg_rx->reorder_lock);
2275
		/* release stored frames up to start of BAR */
2276
		ieee80211_release_reorder_frames(rx->sdata, tid_agg_rx,
2277
						 start_seq_num, frames);
2278 2279
		spin_unlock(&tid_agg_rx->reorder_lock);

2280 2281
		kfree_skb(skb);
		return RX_QUEUED;
2282 2283
	}

2284 2285 2286 2287 2288 2289
	/*
	 * After this point, we only want management frames,
	 * so we can drop all remaining control frames to
	 * cooked monitor interfaces.
	 */
	return RX_DROP_MONITOR;
2290 2291
}

2292 2293 2294
static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
					   struct ieee80211_mgmt *mgmt,
					   size_t len)
2295 2296 2297 2298 2299
{
	struct ieee80211_local *local = sdata->local;
	struct sk_buff *skb;
	struct ieee80211_mgmt *resp;

2300
	if (!ether_addr_equal(mgmt->da, sdata->vif.addr)) {
2301 2302 2303 2304
		/* Not to own unicast address */
		return;
	}

2305 2306
	if (!ether_addr_equal(mgmt->sa, sdata->u.mgd.bssid) ||
	    !ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid)) {
2307
		/* Not from the current AP or not associated yet. */
2308 2309 2310 2311 2312 2313 2314 2315 2316 2317 2318 2319 2320 2321 2322 2323
		return;
	}

	if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) {
		/* Too short SA Query request frame */
		return;
	}

	skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom);
	if (skb == NULL)
		return;

	skb_reserve(skb, local->hw.extra_tx_headroom);
	resp = (struct ieee80211_mgmt *) skb_put(skb, 24);
	memset(resp, 0, 24);
	memcpy(resp->da, mgmt->sa, ETH_ALEN);
2324
	memcpy(resp->sa, sdata->vif.addr, ETH_ALEN);
2325
	memcpy(resp->bssid, sdata->u.mgd.bssid, ETH_ALEN);
2326 2327 2328 2329 2330 2331 2332 2333 2334
	resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
					  IEEE80211_STYPE_ACTION);
	skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query));
	resp->u.action.category = WLAN_CATEGORY_SA_QUERY;
	resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE;
	memcpy(resp->u.action.u.sa_query.trans_id,
	       mgmt->u.action.u.sa_query.trans_id,
	       WLAN_SA_QUERY_TR_ID_LEN);

2335
	ieee80211_tx_skb(sdata, skb);
2336 2337
}

2338 2339 2340 2341
static ieee80211_rx_result debug_noinline
ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx)
{
	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
2342
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2343 2344 2345 2346 2347 2348 2349 2350 2351 2352 2353 2354

	/*
	 * From here on, look only at management frames.
	 * Data and control frames are already handled,
	 * and unknown (reserved) frames are useless.
	 */
	if (rx->skb->len < 24)
		return RX_DROP_MONITOR;

	if (!ieee80211_is_mgmt(mgmt->frame_control))
		return RX_DROP_MONITOR;

J
Johannes Berg 已提交
2355 2356 2357
	if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
	    ieee80211_is_beacon(mgmt->frame_control) &&
	    !(rx->flags & IEEE80211_RX_BEACON_REPORTED)) {
2358 2359 2360 2361 2362
		int sig = 0;

		if (rx->local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
			sig = status->signal;

J
Johannes Berg 已提交
2363 2364
		cfg80211_report_obss_beacon(rx->local->hw.wiphy,
					    rx->skb->data, rx->skb->len,
2365
					    status->freq, sig);
J
Johannes Berg 已提交
2366 2367 2368
		rx->flags |= IEEE80211_RX_BEACON_REPORTED;
	}

2369
	if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
2370 2371 2372 2373 2374 2375 2376 2377
		return RX_DROP_MONITOR;

	if (ieee80211_drop_unencrypted_mgmt(rx))
		return RX_DROP_UNUSABLE;

	return RX_CONTINUE;
}

2378 2379 2380 2381
static ieee80211_rx_result debug_noinline
ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
{
	struct ieee80211_local *local = rx->local;
J
Johannes Berg 已提交
2382
	struct ieee80211_sub_if_data *sdata = rx->sdata;
2383
	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
2384
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2385 2386 2387 2388 2389
	int len = rx->skb->len;

	if (!ieee80211_is_action(mgmt->frame_control))
		return RX_CONTINUE;

2390 2391
	/* drop too small frames */
	if (len < IEEE80211_MIN_ACTION_SIZE)
2392
		return RX_DROP_UNUSABLE;
2393

2394
	if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC &&
2395 2396
	    mgmt->u.action.category != WLAN_CATEGORY_SELF_PROTECTED &&
	    mgmt->u.action.category != WLAN_CATEGORY_SPECTRUM_MGMT)
2397
		return RX_DROP_UNUSABLE;
2398

2399
	if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
2400
		return RX_DROP_UNUSABLE;
2401

2402
	switch (mgmt->u.action.category) {
2403 2404 2405 2406 2407 2408 2409 2410 2411 2412 2413 2414
	case WLAN_CATEGORY_HT:
		/* reject HT action frames from stations not supporting HT */
		if (!rx->sta->sta.ht_cap.ht_supported)
			goto invalid;

		if (sdata->vif.type != NL80211_IFTYPE_STATION &&
		    sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
		    sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
		    sdata->vif.type != NL80211_IFTYPE_AP &&
		    sdata->vif.type != NL80211_IFTYPE_ADHOC)
			break;

2415
		/* verify action & smps_control/chanwidth are present */
2416 2417 2418 2419 2420 2421
		if (len < IEEE80211_MIN_ACTION_SIZE + 2)
			goto invalid;

		switch (mgmt->u.action.u.ht_smps.action) {
		case WLAN_HT_ACTION_SMPS: {
			struct ieee80211_supported_band *sband;
2422
			enum ieee80211_smps_mode smps_mode;
2423 2424 2425 2426

			/* convert to HT capability */
			switch (mgmt->u.action.u.ht_smps.smps_control) {
			case WLAN_HT_SMPS_CONTROL_DISABLED:
2427
				smps_mode = IEEE80211_SMPS_OFF;
2428 2429
				break;
			case WLAN_HT_SMPS_CONTROL_STATIC:
2430
				smps_mode = IEEE80211_SMPS_STATIC;
2431 2432
				break;
			case WLAN_HT_SMPS_CONTROL_DYNAMIC:
2433
				smps_mode = IEEE80211_SMPS_DYNAMIC;
2434 2435 2436 2437 2438 2439
				break;
			default:
				goto invalid;
			}

			/* if no change do nothing */
2440
			if (rx->sta->sta.smps_mode == smps_mode)
2441
				goto handled;
2442
			rx->sta->sta.smps_mode = smps_mode;
2443 2444 2445

			sband = rx->local->hw.wiphy->bands[status->band];

2446 2447
			rate_control_rate_update(local, sband, rx->sta,
						 IEEE80211_RC_SMPS_CHANGED);
2448 2449
			goto handled;
		}
2450 2451 2452
		case WLAN_HT_ACTION_NOTIFY_CHANWIDTH: {
			struct ieee80211_supported_band *sband;
			u8 chanwidth = mgmt->u.action.u.ht_notify_cw.chanwidth;
2453
			enum ieee80211_sta_rx_bandwidth new_bw;
2454 2455

			/* If it doesn't support 40 MHz it can't change ... */
2456 2457
			if (!(rx->sta->sta.ht_cap.cap &
					IEEE80211_HT_CAP_SUP_WIDTH_20_40))
2458 2459
				goto handled;

2460 2461 2462 2463
			if (chanwidth == IEEE80211_HT_CHANWIDTH_20MHZ)
				new_bw = IEEE80211_STA_RX_BW_20;
			else
				new_bw = ieee80211_sta_cur_vht_bw(rx->sta);
2464

2465
			if (rx->sta->sta.bandwidth == new_bw)
2466 2467 2468 2469 2470 2471 2472 2473
				goto handled;

			sband = rx->local->hw.wiphy->bands[status->band];

			rate_control_rate_update(local, sband, rx->sta,
						 IEEE80211_RC_BW_CHANGED);
			goto handled;
		}
2474 2475 2476 2477
		default:
			goto invalid;
		}

2478
		break;
2479 2480 2481 2482 2483 2484 2485 2486 2487 2488 2489 2490 2491 2492 2493 2494
	case WLAN_CATEGORY_PUBLIC:
		if (len < IEEE80211_MIN_ACTION_SIZE + 1)
			goto invalid;
		if (sdata->vif.type != NL80211_IFTYPE_STATION)
			break;
		if (!rx->sta)
			break;
		if (!ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid))
			break;
		if (mgmt->u.action.u.ext_chan_switch.action_code !=
				WLAN_PUB_ACTION_EXT_CHANSW_ANN)
			break;
		if (len < offsetof(struct ieee80211_mgmt,
				   u.action.u.ext_chan_switch.variable))
			goto invalid;
		goto queue;
2495 2496 2497 2498 2499 2500 2501 2502 2503 2504 2505 2506 2507 2508 2509 2510 2511 2512 2513 2514 2515 2516 2517
	case WLAN_CATEGORY_VHT:
		if (sdata->vif.type != NL80211_IFTYPE_STATION &&
		    sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
		    sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
		    sdata->vif.type != NL80211_IFTYPE_AP &&
		    sdata->vif.type != NL80211_IFTYPE_ADHOC)
			break;

		/* verify action code is present */
		if (len < IEEE80211_MIN_ACTION_SIZE + 1)
			goto invalid;

		switch (mgmt->u.action.u.vht_opmode_notif.action_code) {
		case WLAN_VHT_ACTION_OPMODE_NOTIF: {
			u8 opmode;

			/* verify opmode is present */
			if (len < IEEE80211_MIN_ACTION_SIZE + 2)
				goto invalid;

			opmode = mgmt->u.action.u.vht_opmode_notif.operating_mode;

			ieee80211_vht_handle_opmode(rx->sdata, rx->sta,
2518 2519
						    opmode, status->band,
						    false);
2520 2521 2522 2523 2524
			goto handled;
		}
		default:
			break;
		}
2525
		break;
2526
	case WLAN_CATEGORY_BACK:
2527
		if (sdata->vif.type != NL80211_IFTYPE_STATION &&
2528
		    sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
2529
		    sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
2530 2531
		    sdata->vif.type != NL80211_IFTYPE_AP &&
		    sdata->vif.type != NL80211_IFTYPE_ADHOC)
2532
			break;
2533

2534 2535 2536 2537
		/* verify action_code is present */
		if (len < IEEE80211_MIN_ACTION_SIZE + 1)
			break;

2538 2539 2540 2541
		switch (mgmt->u.action.u.addba_req.action_code) {
		case WLAN_ACTION_ADDBA_REQ:
			if (len < (IEEE80211_MIN_ACTION_SIZE +
				   sizeof(mgmt->u.action.u.addba_req)))
2542 2543
				goto invalid;
			break;
2544 2545 2546
		case WLAN_ACTION_ADDBA_RESP:
			if (len < (IEEE80211_MIN_ACTION_SIZE +
				   sizeof(mgmt->u.action.u.addba_resp)))
2547 2548
				goto invalid;
			break;
2549 2550 2551
		case WLAN_ACTION_DELBA:
			if (len < (IEEE80211_MIN_ACTION_SIZE +
				   sizeof(mgmt->u.action.u.delba)))
2552 2553 2554 2555
				goto invalid;
			break;
		default:
			goto invalid;
2556
		}
2557

2558
		goto queue;
2559
	case WLAN_CATEGORY_SPECTRUM_MGMT:
2560 2561 2562 2563
		/* verify action_code is present */
		if (len < IEEE80211_MIN_ACTION_SIZE + 1)
			break;

2564 2565
		switch (mgmt->u.action.u.measurement.action_code) {
		case WLAN_ACTION_SPCT_MSR_REQ:
2566 2567 2568
			if (status->band != IEEE80211_BAND_5GHZ)
				break;

2569 2570
			if (len < (IEEE80211_MIN_ACTION_SIZE +
				   sizeof(mgmt->u.action.u.measurement)))
2571
				break;
2572 2573 2574 2575

			if (sdata->vif.type != NL80211_IFTYPE_STATION)
				break;

2576
			ieee80211_process_measurement_req(sdata, mgmt, len);
2577
			goto handled;
2578 2579 2580 2581
		case WLAN_ACTION_SPCT_CHL_SWITCH: {
			u8 *bssid;
			if (len < (IEEE80211_MIN_ACTION_SIZE +
				   sizeof(mgmt->u.action.u.chan_switch)))
2582
				break;
2583

2584
			if (sdata->vif.type != NL80211_IFTYPE_STATION &&
2585 2586
			    sdata->vif.type != NL80211_IFTYPE_ADHOC &&
			    sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
2587 2588 2589 2590 2591 2592
				break;

			if (sdata->vif.type == NL80211_IFTYPE_STATION)
				bssid = sdata->u.mgd.bssid;
			else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
				bssid = sdata->u.ibss.bssid;
2593 2594
			else if (sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
				bssid = mgmt->sa;
2595 2596 2597 2598
			else
				break;

			if (!ether_addr_equal(mgmt->bssid, bssid))
2599
				break;
S
Sujith 已提交
2600

2601
			goto queue;
2602
			}
2603 2604
		}
		break;
2605 2606 2607
	case WLAN_CATEGORY_SA_QUERY:
		if (len < (IEEE80211_MIN_ACTION_SIZE +
			   sizeof(mgmt->u.action.u.sa_query)))
2608 2609
			break;

2610 2611 2612
		switch (mgmt->u.action.u.sa_query.action) {
		case WLAN_ACTION_SA_QUERY_REQUEST:
			if (sdata->vif.type != NL80211_IFTYPE_STATION)
2613
				break;
2614
			ieee80211_process_sa_query_req(sdata, mgmt, len);
2615
			goto handled;
2616 2617
		}
		break;
2618
	case WLAN_CATEGORY_SELF_PROTECTED:
2619 2620 2621 2622
		if (len < (IEEE80211_MIN_ACTION_SIZE +
			   sizeof(mgmt->u.action.u.self_prot.action_code)))
			break;

2623 2624 2625 2626 2627 2628
		switch (mgmt->u.action.u.self_prot.action_code) {
		case WLAN_SP_MESH_PEERING_OPEN:
		case WLAN_SP_MESH_PEERING_CLOSE:
		case WLAN_SP_MESH_PEERING_CONFIRM:
			if (!ieee80211_vif_is_mesh(&sdata->vif))
				goto invalid;
2629
			if (sdata->u.mesh.user_mpm)
2630 2631 2632 2633 2634 2635 2636 2637 2638 2639
				/* userspace handles this frame */
				break;
			goto queue;
		case WLAN_SP_MGK_INFORM:
		case WLAN_SP_MGK_ACK:
			if (!ieee80211_vif_is_mesh(&sdata->vif))
				goto invalid;
			break;
		}
		break;
2640
	case WLAN_CATEGORY_MESH_ACTION:
2641 2642 2643 2644
		if (len < (IEEE80211_MIN_ACTION_SIZE +
			   sizeof(mgmt->u.action.u.mesh_action.action_code)))
			break;

2645 2646
		if (!ieee80211_vif_is_mesh(&sdata->vif))
			break;
2647
		if (mesh_action_is_path_sel(mgmt) &&
J
Johannes Berg 已提交
2648
		    !mesh_path_sel_is_hwmp(sdata))
2649 2650
			break;
		goto queue;
2651
	}
2652

2653 2654
	return RX_CONTINUE;

2655
 invalid:
2656
	status->rx_flags |= IEEE80211_RX_MALFORMED_ACTION_FRM;
2657 2658 2659 2660 2661 2662 2663 2664 2665 2666 2667 2668 2669 2670 2671 2672 2673 2674 2675 2676 2677
	/* will return in the next handlers */
	return RX_CONTINUE;

 handled:
	if (rx->sta)
		rx->sta->rx_packets++;
	dev_kfree_skb(rx->skb);
	return RX_QUEUED;

 queue:
	rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
	skb_queue_tail(&sdata->skb_queue, rx->skb);
	ieee80211_queue_work(&local->hw, &sdata->work);
	if (rx->sta)
		rx->sta->rx_packets++;
	return RX_QUEUED;
}

static ieee80211_rx_result debug_noinline
ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx)
{
2678
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2679
	int sig = 0;
2680 2681

	/* skip known-bad action frames and return them in the next handler */
2682
	if (status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM)
2683
		return RX_CONTINUE;
2684

2685 2686 2687 2688 2689 2690 2691
	/*
	 * Getting here means the kernel doesn't know how to handle
	 * it, but maybe userspace does ... include returned frames
	 * so userspace can register for those to know whether ones
	 * it transmitted were processed or returned.
	 */

2692 2693 2694
	if (rx->local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
		sig = status->signal;

2695
	if (cfg80211_rx_mgmt(&rx->sdata->wdev, status->freq, sig,
2696
			     rx->skb->data, rx->skb->len, 0, GFP_ATOMIC)) {
2697 2698 2699 2700 2701 2702 2703 2704 2705 2706 2707 2708 2709 2710 2711 2712
		if (rx->sta)
			rx->sta->rx_packets++;
		dev_kfree_skb(rx->skb);
		return RX_QUEUED;
	}

	return RX_CONTINUE;
}

static ieee80211_rx_result debug_noinline
ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
{
	struct ieee80211_local *local = rx->local;
	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
	struct sk_buff *nskb;
	struct ieee80211_sub_if_data *sdata = rx->sdata;
2713
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2714 2715 2716 2717 2718 2719 2720 2721 2722

	if (!ieee80211_is_action(mgmt->frame_control))
		return RX_CONTINUE;

	/*
	 * For AP mode, hostapd is responsible for handling any action
	 * frames that we didn't handle, including returning unknown
	 * ones. For all other modes we will return them to the sender,
	 * setting the 0x80 bit in the action category, as required by
2723
	 * 802.11-2012 9.24.4.
2724 2725 2726 2727
	 * Newer versions of hostapd shall also use the management frame
	 * registration mechanisms, but older ones still use cooked
	 * monitor interfaces so push all frames there.
	 */
2728
	if (!(status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) &&
2729 2730 2731
	    (sdata->vif.type == NL80211_IFTYPE_AP ||
	     sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
		return RX_DROP_MONITOR;
2732

2733 2734 2735
	if (is_multicast_ether_addr(mgmt->da))
		return RX_DROP_MONITOR;

2736 2737 2738 2739 2740 2741 2742
	/* do not return rejected action frames */
	if (mgmt->u.action.category & 0x80)
		return RX_DROP_UNUSABLE;

	nskb = skb_copy_expand(rx->skb, local->hw.extra_tx_headroom, 0,
			       GFP_ATOMIC);
	if (nskb) {
2743
		struct ieee80211_mgmt *nmgmt = (void *)nskb->data;
2744

2745 2746 2747
		nmgmt->u.action.category |= 0x80;
		memcpy(nmgmt->da, nmgmt->sa, ETH_ALEN);
		memcpy(nmgmt->sa, rx->sdata->vif.addr, ETH_ALEN);
2748 2749 2750

		memset(nskb->cb, 0, sizeof(nskb->cb));

2751 2752 2753 2754 2755 2756 2757 2758 2759 2760 2761 2762 2763
		if (rx->sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) {
			struct ieee80211_tx_info *info = IEEE80211_SKB_CB(nskb);

			info->flags = IEEE80211_TX_CTL_TX_OFFCHAN |
				      IEEE80211_TX_INTFL_OFFCHAN_TX_OK |
				      IEEE80211_TX_CTL_NO_CCK_RATE;
			if (local->hw.flags & IEEE80211_HW_QUEUE_CONTROL)
				info->hw_queue =
					local->hw.offchannel_tx_hw_queue;
		}

		__ieee80211_tx_skb_tid_band(rx->sdata, nskb, 7,
					    status->band);
2764
	}
2765 2766
	dev_kfree_skb(rx->skb);
	return RX_QUEUED;
2767 2768
}

2769
static ieee80211_rx_result debug_noinline
2770
ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
2771
{
J
Johannes Berg 已提交
2772
	struct ieee80211_sub_if_data *sdata = rx->sdata;
2773 2774
	struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
	__le16 stype;
2775

2776
	stype = mgmt->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE);
2777

2778 2779 2780 2781
	if (!ieee80211_vif_is_mesh(&sdata->vif) &&
	    sdata->vif.type != NL80211_IFTYPE_ADHOC &&
	    sdata->vif.type != NL80211_IFTYPE_STATION)
		return RX_DROP_MONITOR;
2782

2783
	switch (stype) {
J
Johannes Berg 已提交
2784
	case cpu_to_le16(IEEE80211_STYPE_AUTH):
2785 2786 2787 2788
	case cpu_to_le16(IEEE80211_STYPE_BEACON):
	case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
		/* process for all: mesh, mlme, ibss */
		break;
J
Johannes Berg 已提交
2789 2790
	case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
	case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
2791 2792
	case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
	case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
2793 2794 2795 2796
		if (is_multicast_ether_addr(mgmt->da) &&
		    !is_broadcast_ether_addr(mgmt->da))
			return RX_DROP_MONITOR;

2797 2798 2799 2800 2801
		/* process only for station */
		if (sdata->vif.type != NL80211_IFTYPE_STATION)
			return RX_DROP_MONITOR;
		break;
	case cpu_to_le16(IEEE80211_STYPE_PROBE_REQ):
2802 2803 2804
		/* process only for ibss and mesh */
		if (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
		    sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
2805 2806 2807 2808 2809
			return RX_DROP_MONITOR;
		break;
	default:
		return RX_DROP_MONITOR;
	}
2810

2811
	/* queue up frame and kick off work to process it */
2812
	rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
2813 2814
	skb_queue_tail(&sdata->skb_queue, rx->skb);
	ieee80211_queue_work(&rx->local->hw, &sdata->work);
2815 2816
	if (rx->sta)
		rx->sta->rx_packets++;
2817

2818
	return RX_QUEUED;
2819 2820
}

2821
/* TODO: use IEEE80211_RX_FRAGMENTED */
J
Johannes Berg 已提交
2822 2823
static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
					struct ieee80211_rate *rate)
2824 2825 2826 2827 2828
{
	struct ieee80211_sub_if_data *sdata;
	struct ieee80211_local *local = rx->local;
	struct sk_buff *skb = rx->skb, *skb2;
	struct net_device *prev_dev = NULL;
J
Johannes Berg 已提交
2829
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2830
	int needed_headroom;
2831

2832 2833 2834 2835 2836
	/*
	 * If cooked monitor has been processed already, then
	 * don't do it again. If not, set the flag.
	 */
	if (rx->flags & IEEE80211_RX_CMNTR)
2837
		goto out_free_skb;
2838
	rx->flags |= IEEE80211_RX_CMNTR;
2839

2840 2841 2842 2843
	/* If there are no cooked monitor interfaces, just free the SKB */
	if (!local->cooked_mntrs)
		goto out_free_skb;

2844
	/* room for the radiotap header based on driver features */
2845
	needed_headroom = ieee80211_rx_radiotap_space(local, status);
2846

2847 2848 2849
	if (skb_headroom(skb) < needed_headroom &&
	    pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC))
		goto out_free_skb;
2850

2851
	/* prepend radiotap information */
2852 2853
	ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom,
					 false);
2854 2855 2856 2857 2858 2859 2860

	skb_set_mac_header(skb, 0);
	skb->ip_summed = CHECKSUM_UNNECESSARY;
	skb->pkt_type = PACKET_OTHERHOST;
	skb->protocol = htons(ETH_P_802_2);

	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
2861
		if (!ieee80211_sdata_running(sdata))
2862 2863
			continue;

2864
		if (sdata->vif.type != NL80211_IFTYPE_MONITOR ||
2865 2866 2867 2868 2869 2870 2871
		    !(sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES))
			continue;

		if (prev_dev) {
			skb2 = skb_clone(skb, GFP_ATOMIC);
			if (skb2) {
				skb2->dev = prev_dev;
2872
				netif_receive_skb(skb2);
2873 2874 2875 2876 2877 2878 2879 2880 2881 2882
			}
		}

		prev_dev = sdata->dev;
		sdata->dev->stats.rx_packets++;
		sdata->dev->stats.rx_bytes += skb->len;
	}

	if (prev_dev) {
		skb->dev = prev_dev;
2883
		netif_receive_skb(skb);
2884 2885
		return;
	}
2886 2887 2888 2889 2890

 out_free_skb:
	dev_kfree_skb(skb);
}

2891 2892 2893 2894 2895 2896 2897 2898 2899 2900 2901 2902 2903 2904 2905 2906 2907
static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx,
					 ieee80211_rx_result res)
{
	switch (res) {
	case RX_DROP_MONITOR:
		I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
		if (rx->sta)
			rx->sta->rx_dropped++;
		/* fall through */
	case RX_CONTINUE: {
		struct ieee80211_rate *rate = NULL;
		struct ieee80211_supported_band *sband;
		struct ieee80211_rx_status *status;

		status = IEEE80211_SKB_RXCB((rx->skb));

		sband = rx->local->hw.wiphy->bands[status->band];
2908 2909
		if (!(status->flag & RX_FLAG_HT) &&
		    !(status->flag & RX_FLAG_VHT))
2910 2911 2912 2913 2914 2915 2916 2917 2918 2919 2920 2921 2922 2923 2924 2925
			rate = &sband->bitrates[status->rate_idx];

		ieee80211_rx_cooked_monitor(rx, rate);
		break;
		}
	case RX_DROP_UNUSABLE:
		I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
		if (rx->sta)
			rx->sta->rx_dropped++;
		dev_kfree_skb(rx->skb);
		break;
	case RX_QUEUED:
		I802_DEBUG_INC(rx->sdata->local->rx_handlers_queued);
		break;
	}
}
2926

2927 2928
static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx,
				  struct sk_buff_head *frames)
2929 2930
{
	ieee80211_rx_result res = RX_DROP_MONITOR;
2931
	struct sk_buff *skb;
2932

2933 2934 2935 2936
#define CALL_RXH(rxh)			\
	do {				\
		res = rxh(rx);		\
		if (res != RX_CONTINUE)	\
2937
			goto rxh_next;  \
2938
	} while (0);
2939

2940
	spin_lock_bh(&rx->local->rx_path_lock);
2941

2942
	while ((skb = __skb_dequeue(frames))) {
2943 2944 2945 2946 2947 2948 2949 2950
		/*
		 * all the other fields are valid across frames
		 * that belong to an aMPDU since they are on the
		 * same TID from the same station
		 */
		rx->skb = skb;

		CALL_RXH(ieee80211_rx_h_check_more_data)
J
Johannes Berg 已提交
2951
		CALL_RXH(ieee80211_rx_h_uapsd_and_pspoll)
2952
		CALL_RXH(ieee80211_rx_h_sta_process)
2953
		CALL_RXH(ieee80211_rx_h_decrypt)
2954 2955 2956
		CALL_RXH(ieee80211_rx_h_defragment)
		CALL_RXH(ieee80211_rx_h_michael_mic_verify)
		/* must be after MMIC verify so header is counted in MPDU mic */
I
Ingo Molnar 已提交
2957
#ifdef CONFIG_MAC80211_MESH
2958
		if (ieee80211_vif_is_mesh(&rx->sdata->vif))
2959
			CALL_RXH(ieee80211_rx_h_mesh_fwding);
I
Ingo Molnar 已提交
2960
#endif
2961
		CALL_RXH(ieee80211_rx_h_amsdu)
2962
		CALL_RXH(ieee80211_rx_h_data)
2963 2964 2965 2966 2967 2968

		/* special treatment -- needs the queue */
		res = ieee80211_rx_h_ctrl(rx, frames);
		if (res != RX_CONTINUE)
			goto rxh_next;

2969
		CALL_RXH(ieee80211_rx_h_mgmt_check)
2970
		CALL_RXH(ieee80211_rx_h_action)
2971 2972
		CALL_RXH(ieee80211_rx_h_userspace_mgmt)
		CALL_RXH(ieee80211_rx_h_action_return)
2973
		CALL_RXH(ieee80211_rx_h_mgmt)
2974

2975 2976
 rxh_next:
		ieee80211_rx_handlers_result(rx, res);
2977

2978
#undef CALL_RXH
2979
	}
2980

2981
	spin_unlock_bh(&rx->local->rx_path_lock);
2982 2983
}

2984
static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
2985
{
2986
	struct sk_buff_head reorder_release;
2987 2988
	ieee80211_rx_result res = RX_DROP_MONITOR;

2989 2990
	__skb_queue_head_init(&reorder_release);

2991 2992 2993 2994 2995 2996 2997 2998 2999
#define CALL_RXH(rxh)			\
	do {				\
		res = rxh(rx);		\
		if (res != RX_CONTINUE)	\
			goto rxh_next;  \
	} while (0);

	CALL_RXH(ieee80211_rx_h_check)

3000
	ieee80211_rx_reorder_ampdu(rx, &reorder_release);
3001

3002
	ieee80211_rx_handlers(rx, &reorder_release);
3003
	return;
3004

3005
 rxh_next:
3006 3007 3008
	ieee80211_rx_handlers_result(rx, res);

#undef CALL_RXH
3009 3010
}

3011
/*
3012 3013
 * This function makes calls into the RX path, therefore
 * it has to be invoked under RCU read lock.
3014 3015 3016
 */
void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
{
3017
	struct sk_buff_head frames;
3018 3019 3020 3021
	struct ieee80211_rx_data rx = {
		.sta = sta,
		.sdata = sta->sdata,
		.local = sta->local,
3022 3023 3024
		/* This is OK -- must be QoS data frame */
		.security_idx = tid,
		.seqno_idx = tid,
3025
		.flags = 0,
3026
	};
3027 3028 3029 3030 3031
	struct tid_ampdu_rx *tid_agg_rx;

	tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
	if (!tid_agg_rx)
		return;
3032

3033 3034
	__skb_queue_head_init(&frames);

3035
	spin_lock(&tid_agg_rx->reorder_lock);
3036
	ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames);
3037
	spin_unlock(&tid_agg_rx->reorder_lock);
3038

3039
	ieee80211_rx_handlers(&rx, &frames);
3040 3041
}

3042 3043
/* main receive path */

3044 3045
static bool prepare_for_handlers(struct ieee80211_rx_data *rx,
				 struct ieee80211_hdr *hdr)
3046
{
3047
	struct ieee80211_sub_if_data *sdata = rx->sdata;
J
Johannes Berg 已提交
3048 3049 3050
	struct sk_buff *skb = rx->skb;
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
	u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
3051 3052
	int multicast = is_multicast_ether_addr(hdr->addr1);

3053
	switch (sdata->vif.type) {
3054
	case NL80211_IFTYPE_STATION:
3055
		if (!bssid && !sdata->u.mgd.use_4addr)
3056
			return false;
3057
		if (!multicast &&
3058
		    !ether_addr_equal(sdata->vif.addr, hdr->addr1)) {
3059 3060
			if (!(sdata->dev->flags & IFF_PROMISC) ||
			    sdata->u.mgd.use_4addr)
3061
				return false;
3062
			status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
3063 3064
		}
		break;
3065
	case NL80211_IFTYPE_ADHOC:
3066
		if (!bssid)
3067
			return false;
3068 3069
		if (ether_addr_equal(sdata->vif.addr, hdr->addr2) ||
		    ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2))
3070
			return false;
3071
		if (ieee80211_is_beacon(hdr->frame_control)) {
3072
			return true;
J
Johannes Berg 已提交
3073
		} else if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid)) {
3074
			return false;
3075
		} else if (!multicast &&
3076
			   !ether_addr_equal(sdata->vif.addr, hdr->addr1)) {
3077
			if (!(sdata->dev->flags & IFF_PROMISC))
3078
				return false;
3079
			status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
3080 3081
		} else if (!rx->sta) {
			int rate_idx;
3082 3083
			if (status->flag & (RX_FLAG_HT | RX_FLAG_VHT))
				rate_idx = 0; /* TODO: HT/VHT rates */
3084
			else
J
Johannes Berg 已提交
3085
				rate_idx = status->rate_idx;
3086 3087
			ieee80211_ibss_rx_no_sta(sdata, bssid, hdr->addr2,
						 BIT(rate_idx));
3088
		}
3089
		break;
3090
	case NL80211_IFTYPE_MESH_POINT:
3091
		if (!multicast &&
3092
		    !ether_addr_equal(sdata->vif.addr, hdr->addr1)) {
3093
			if (!(sdata->dev->flags & IFF_PROMISC))
3094
				return false;
3095

3096
			status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
3097 3098
		}
		break;
3099 3100
	case NL80211_IFTYPE_AP_VLAN:
	case NL80211_IFTYPE_AP:
3101
		if (!bssid) {
3102
			if (!ether_addr_equal(sdata->vif.addr, hdr->addr1))
3103
				return false;
3104
		} else if (!ieee80211_bssid_match(bssid, sdata->vif.addr)) {
3105 3106 3107 3108 3109 3110
			/*
			 * Accept public action frames even when the
			 * BSSID doesn't match, this is used for P2P
			 * and location updates. Note that mac80211
			 * itself never looks at these frames.
			 */
3111 3112
			if (!multicast &&
			    !ether_addr_equal(sdata->vif.addr, hdr->addr1))
3113
				return false;
J
Johannes Berg 已提交
3114
			if (ieee80211_is_public_action(hdr, skb->len))
3115
				return true;
J
Johannes Berg 已提交
3116
			if (!ieee80211_is_beacon(hdr->frame_control))
3117
				return false;
3118
			status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
3119 3120
		}
		break;
3121
	case NL80211_IFTYPE_WDS:
3122
		if (bssid || !ieee80211_is_data(hdr->frame_control))
3123
			return false;
3124
		if (!ether_addr_equal(sdata->u.wds.remote_addr, hdr->addr2))
3125
			return false;
3126
		break;
3127 3128 3129 3130 3131
	case NL80211_IFTYPE_P2P_DEVICE:
		if (!ieee80211_is_public_action(hdr, skb->len) &&
		    !ieee80211_is_probe_req(hdr->frame_control) &&
		    !ieee80211_is_probe_resp(hdr->frame_control) &&
		    !ieee80211_is_beacon(hdr->frame_control))
3132
			return false;
3133 3134
		if (!ether_addr_equal(sdata->vif.addr, hdr->addr1) &&
		    !multicast)
3135 3136
			status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
		break;
3137
	default:
J
Johannes Berg 已提交
3138
		/* should never get here */
3139
		WARN_ON_ONCE(1);
J
Johannes Berg 已提交
3140
		break;
3141 3142
	}

3143
	return true;
3144 3145
}

3146 3147 3148 3149 3150 3151 3152 3153 3154 3155 3156 3157 3158 3159 3160
/*
 * This function returns whether or not the SKB
 * was destined for RX processing or not, which,
 * if consume is true, is equivalent to whether
 * or not the skb was consumed.
 */
static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,
					    struct sk_buff *skb, bool consume)
{
	struct ieee80211_local *local = rx->local;
	struct ieee80211_sub_if_data *sdata = rx->sdata;
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
	struct ieee80211_hdr *hdr = (void *)skb->data;

	rx->skb = skb;
3161
	status->rx_flags |= IEEE80211_RX_RA_MATCH;
3162

3163
	if (!prepare_for_handlers(rx, hdr))
3164 3165 3166 3167 3168 3169 3170
		return false;

	if (!consume) {
		skb = skb_copy(skb, GFP_ATOMIC);
		if (!skb) {
			if (net_ratelimit())
				wiphy_debug(local->hw.wiphy,
3171
					"failed to copy skb for %s\n",
3172 3173 3174 3175 3176 3177 3178 3179 3180 3181 3182
					sdata->name);
			return true;
		}

		rx->skb = skb;
	}

	ieee80211_invoke_rx_handlers(rx);
	return true;
}

3183
/*
3184 3185
 * This is the actual Rx frames handler. as it blongs to Rx path it must
 * be called with rcu_read_lock protection.
3186
 */
3187
static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
3188
					 struct sk_buff *skb)
3189 3190 3191 3192
{
	struct ieee80211_local *local = hw_to_local(hw);
	struct ieee80211_sub_if_data *sdata;
	struct ieee80211_hdr *hdr;
Z
Zhu Yi 已提交
3193
	__le16 fc;
3194
	struct ieee80211_rx_data rx;
3195
	struct ieee80211_sub_if_data *prev;
3196
	struct sta_info *sta, *tmp, *prev_sta;
Z
Zhu Yi 已提交
3197
	int err = 0;
3198

Z
Zhu Yi 已提交
3199
	fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
3200 3201 3202
	memset(&rx, 0, sizeof(rx));
	rx.skb = skb;
	rx.local = local;
3203

Z
Zhu Yi 已提交
3204
	if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc))
3205 3206
		local->dot11ReceivedFragmentCount++;

3207 3208 3209 3210 3211 3212 3213
	if (ieee80211_is_mgmt(fc)) {
		/* drop frame if too short for header */
		if (skb->len < ieee80211_hdrlen(fc))
			err = -ENOBUFS;
		else
			err = skb_linearize(skb);
	} else {
Z
Zhu Yi 已提交
3214
		err = !pskb_may_pull(skb, ieee80211_hdrlen(fc));
3215
	}
Z
Zhu Yi 已提交
3216 3217 3218 3219 3220 3221 3222

	if (err) {
		dev_kfree_skb(skb);
		return;
	}

	hdr = (struct ieee80211_hdr *)skb->data;
3223
	ieee80211_parse_qos(&rx);
3224
	ieee80211_verify_alignment(&rx);
3225

J
Johannes Berg 已提交
3226 3227 3228 3229
	if (unlikely(ieee80211_is_probe_resp(hdr->frame_control) ||
		     ieee80211_is_beacon(hdr->frame_control)))
		ieee80211_scan_rx(local, skb);

Z
Zhu Yi 已提交
3230
	if (ieee80211_is_data(fc)) {
3231
		prev_sta = NULL;
3232

3233
		for_each_sta_info(local, hdr->addr2, sta, tmp) {
3234 3235 3236 3237 3238 3239 3240
			if (!prev_sta) {
				prev_sta = sta;
				continue;
			}

			rx.sta = prev_sta;
			rx.sdata = prev_sta->sdata;
3241
			ieee80211_prepare_and_rx_handle(&rx, skb, false);
3242

3243
			prev_sta = sta;
3244
		}
3245 3246 3247 3248 3249

		if (prev_sta) {
			rx.sta = prev_sta;
			rx.sdata = prev_sta->sdata;

3250
			if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
3251
				return;
3252
			goto out;
3253
		}
3254 3255
	}

3256
	prev = NULL;
3257

3258 3259 3260
	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
		if (!ieee80211_sdata_running(sdata))
			continue;
J
Johannes Berg 已提交
3261

3262 3263 3264
		if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
		    sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
			continue;
J
Johannes Berg 已提交
3265

3266 3267 3268 3269 3270
		/*
		 * frame is destined for this interface, but if it's
		 * not also for the previous one we handle that after
		 * the loop to avoid copying the SKB once too much
		 */
3271

3272
		if (!prev) {
3273
			prev = sdata;
3274
			continue;
J
Johannes Berg 已提交
3275
		}
3276

3277
		rx.sta = sta_info_get_bss(prev, hdr->addr2);
3278 3279
		rx.sdata = prev;
		ieee80211_prepare_and_rx_handle(&rx, skb, false);
3280

3281 3282 3283 3284
		prev = sdata;
	}

	if (prev) {
3285
		rx.sta = sta_info_get_bss(prev, hdr->addr2);
3286
		rx.sdata = prev;
3287

3288 3289
		if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
			return;
3290
	}
3291

3292
 out:
3293
	dev_kfree_skb(skb);
3294
}
3295 3296 3297 3298 3299

/*
 * This is the receive path handler. It is called by a low level driver when an
 * 802.11 MPDU is received from the hardware.
 */
3300
void ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb)
3301 3302
{
	struct ieee80211_local *local = hw_to_local(hw);
3303 3304
	struct ieee80211_rate *rate = NULL;
	struct ieee80211_supported_band *sband;
3305
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
3306

3307 3308
	WARN_ON_ONCE(softirq_count() == 0);

J
Johannes Berg 已提交
3309
	if (WARN_ON(status->band >= IEEE80211_NUM_BANDS))
J
Johannes Berg 已提交
3310
		goto drop;
3311 3312

	sband = local->hw.wiphy->bands[status->band];
J
Johannes Berg 已提交
3313 3314
	if (WARN_ON(!sband))
		goto drop;
3315

J
Johannes Berg 已提交
3316 3317 3318 3319 3320 3321 3322
	/*
	 * If we're suspending, it is possible although not too likely
	 * that we'd be receiving frames after having already partially
	 * quiesced the stack. We can't process such frames then since
	 * that might, for example, cause stations to be added or other
	 * driver callbacks be invoked.
	 */
J
Johannes Berg 已提交
3323 3324
	if (unlikely(local->quiescing || local->suspended))
		goto drop;
J
Johannes Berg 已提交
3325

3326 3327 3328 3329
	/* We might be during a HW reconfig, prevent Rx for the same reason */
	if (unlikely(local->in_reconfig))
		goto drop;

3330 3331 3332 3333
	/*
	 * The same happens when we're not even started,
	 * but that's worth a warning.
	 */
J
Johannes Berg 已提交
3334 3335
	if (WARN_ON(!local->started))
		goto drop;
3336

3337
	if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC))) {
3338
		/*
3339 3340
		 * Validate the rate, unless a PLCP error means that
		 * we probably can't have a valid rate here anyway.
3341
		 */
3342 3343 3344 3345 3346 3347 3348 3349 3350 3351 3352 3353

		if (status->flag & RX_FLAG_HT) {
			/*
			 * rate_idx is MCS index, which can be [0-76]
			 * as documented on:
			 *
			 * http://wireless.kernel.org/en/developers/Documentation/ieee80211/802.11n
			 *
			 * Anything else would be some sort of driver or
			 * hardware error. The driver should catch hardware
			 * errors.
			 */
J
Johannes Berg 已提交
3354
			if (WARN(status->rate_idx > 76,
3355 3356 3357 3358 3359 3360
				 "Rate marked as an HT rate but passed "
				 "status->rate_idx is not "
				 "an MCS index [0-76]: %d (0x%02x)\n",
				 status->rate_idx,
				 status->rate_idx))
				goto drop;
3361 3362 3363 3364 3365 3366 3367
		} else if (status->flag & RX_FLAG_VHT) {
			if (WARN_ONCE(status->rate_idx > 9 ||
				      !status->vht_nss ||
				      status->vht_nss > 8,
				      "Rate marked as a VHT rate but data is invalid: MCS: %d, NSS: %d\n",
				      status->rate_idx, status->vht_nss))
				goto drop;
3368
		} else {
J
Johannes Berg 已提交
3369
			if (WARN_ON(status->rate_idx >= sband->n_bitrates))
3370 3371 3372
				goto drop;
			rate = &sband->bitrates[status->rate_idx];
		}
3373
	}
3374

3375 3376
	status->rx_flags = 0;

3377 3378 3379 3380 3381 3382 3383 3384 3385 3386 3387 3388 3389
	/*
	 * key references and virtual interfaces are protected using RCU
	 * and this requires that we are in a read-side RCU section during
	 * receive processing
	 */
	rcu_read_lock();

	/*
	 * Frames with failed FCS/PLCP checksum are not returned,
	 * all other frames are returned without radiotap header
	 * if it was previously present.
	 * Also, frames with less than 16 bytes are dropped.
	 */
3390
	skb = ieee80211_rx_monitor(local, skb, rate);
3391 3392 3393 3394 3395
	if (!skb) {
		rcu_read_unlock();
		return;
	}

3396 3397 3398
	ieee80211_tpt_led_trig_rx(local,
			((struct ieee80211_hdr *)skb->data)->frame_control,
			skb->len);
3399
	__ieee80211_rx_handle_packet(hw, skb);
3400 3401

	rcu_read_unlock();
J
Johannes Berg 已提交
3402 3403 3404 3405

	return;
 drop:
	kfree_skb(skb);
3406
}
3407
EXPORT_SYMBOL(ieee80211_rx);
3408 3409 3410

/* This is a version of the rx handler that can be called from hard irq
 * context. Post the skb on the queue and schedule the tasklet */
3411
void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb)
3412 3413 3414 3415 3416 3417 3418 3419 3420 3421
{
	struct ieee80211_local *local = hw_to_local(hw);

	BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));

	skb->pkt_type = IEEE80211_RX_MSG;
	skb_queue_tail(&local->skb_queue, skb);
	tasklet_schedule(&local->tasklet);
}
EXPORT_SYMBOL(ieee80211_rx_irqsafe);