rx.c 121.0 KB
Newer Older
1 2 3 4
/*
 * Copyright 2002-2005, Instant802 Networks, Inc.
 * Copyright 2005-2006, Devicescape Software, Inc.
 * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
5
 * Copyright 2007-2010	Johannes Berg <johannes@sipsolutions.net>
6
 * Copyright 2013-2014  Intel Mobile Communications GmbH
7
 * Copyright(c) 2015 - 2017 Intel Deutschland GmbH
8 9 10 11 12 13
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

14
#include <linux/jiffies.h>
15
#include <linux/slab.h>
16 17 18 19
#include <linux/kernel.h>
#include <linux/skbuff.h>
#include <linux/netdevice.h>
#include <linux/etherdevice.h>
20
#include <linux/rcupdate.h>
21
#include <linux/export.h>
22
#include <linux/bitops.h>
23 24
#include <net/mac80211.h>
#include <net/ieee80211_radiotap.h>
25
#include <asm/unaligned.h>
26 27

#include "ieee80211_i.h"
28
#include "driver-ops.h"
J
Johannes Berg 已提交
29
#include "led.h"
30
#include "mesh.h"
31 32 33 34
#include "wep.h"
#include "wpa.h"
#include "tkip.h"
#include "wme.h"
35
#include "rate.h"
36

37 38 39 40 41 42 43 44 45 46
static inline void ieee80211_rx_stats(struct net_device *dev, u32 len)
{
	struct pcpu_sw_netstats *tstats = this_cpu_ptr(dev->tstats);

	u64_stats_update_begin(&tstats->syncp);
	tstats->rx_packets++;
	tstats->rx_bytes += len;
	u64_stats_update_end(&tstats->syncp);
}

47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91
static u8 *ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len,
			       enum nl80211_iftype type)
{
	__le16 fc = hdr->frame_control;

	if (ieee80211_is_data(fc)) {
		if (len < 24) /* drop incorrect hdr len (data) */
			return NULL;

		if (ieee80211_has_a4(fc))
			return NULL;
		if (ieee80211_has_tods(fc))
			return hdr->addr1;
		if (ieee80211_has_fromds(fc))
			return hdr->addr2;

		return hdr->addr3;
	}

	if (ieee80211_is_mgmt(fc)) {
		if (len < 24) /* drop incorrect hdr len (mgmt) */
			return NULL;
		return hdr->addr3;
	}

	if (ieee80211_is_ctl(fc)) {
		if (ieee80211_is_pspoll(fc))
			return hdr->addr1;

		if (ieee80211_is_back_req(fc)) {
			switch (type) {
			case NL80211_IFTYPE_STATION:
				return hdr->addr2;
			case NL80211_IFTYPE_AP:
			case NL80211_IFTYPE_AP_VLAN:
				return hdr->addr1;
			default:
				break; /* fall through to the return */
			}
		}
	}

	return NULL;
}

92 93 94 95 96 97
/*
 * monitor mode reception
 *
 * This function cleans up the SKB, i.e. it removes all the stuff
 * only useful for monitoring.
 */
98 99 100
static void remove_monitor_info(struct sk_buff *skb,
				unsigned int present_fcs_len,
				unsigned int rtap_vendor_space)
101
{
102 103
	if (present_fcs_len)
		__pskb_trim(skb, skb->len - present_fcs_len);
104
	__pskb_pull(skb, rtap_vendor_space);
105 106
}

107 108
static inline bool should_drop_frame(struct sk_buff *skb, int present_fcs_len,
				     unsigned int rtap_vendor_space)
109
{
110
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
111 112 113
	struct ieee80211_hdr *hdr;

	hdr = (void *)(skb->data + rtap_vendor_space);
114

115
	if (status->flag & (RX_FLAG_FAILED_FCS_CRC |
116 117
			    RX_FLAG_FAILED_PLCP_CRC |
			    RX_FLAG_ONLY_MONITOR))
118 119
		return true;

120
	if (unlikely(skb->len < 16 + present_fcs_len + rtap_vendor_space))
121 122
		return true;

H
Harvey Harrison 已提交
123 124 125
	if (ieee80211_is_ctl(hdr->frame_control) &&
	    !ieee80211_is_pspoll(hdr->frame_control) &&
	    !ieee80211_is_back_req(hdr->frame_control))
126 127 128
		return true;

	return false;
129 130
}

131
static int
132 133 134
ieee80211_rx_radiotap_hdrlen(struct ieee80211_local *local,
			     struct ieee80211_rx_status *status,
			     struct sk_buff *skb)
135 136 137 138
{
	int len;

	/* always present fields */
139
	len = sizeof(struct ieee80211_radiotap_header) + 8;
140

141 142 143
	/* allocate extra bitmaps */
	if (status->chains)
		len += 4 * hweight8(status->chains);
144 145 146

	if (ieee80211_have_rx_timestamp(status)) {
		len = ALIGN(len, 8);
147
		len += 8;
148
	}
149
	if (ieee80211_hw_check(&local->hw, SIGNAL_DBM))
150 151
		len += 1;

152 153 154 155
	/* antenna field, if we don't have per-chain info */
	if (!status->chains)
		len += 1;

156 157
	/* padding for RX_FLAGS if necessary */
	len = ALIGN(len, 2);
158

159
	if (status->encoding == RX_ENC_HT) /* HT info */
160 161
		len += 3;

162
	if (status->flag & RX_FLAG_AMPDU_DETAILS) {
163
		len = ALIGN(len, 4);
164 165 166
		len += 8;
	}

167
	if (status->encoding == RX_ENC_VHT) {
168 169 170 171
		len = ALIGN(len, 2);
		len += 12;
	}

172 173 174 175 176
	if (local->hw.radiotap_timestamp.units_pos >= 0) {
		len = ALIGN(len, 8);
		len += 12;
	}

177 178 179 180 181
	if (status->chains) {
		/* antenna and antenna signal fields */
		len += 2 * hweight8(status->chains);
	}

182 183 184 185 186 187 188 189 190 191 192 193 194 195 196
	if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
		struct ieee80211_vendor_radiotap *rtap = (void *)skb->data;

		/* vendor presence bitmap */
		len += 4;
		/* alignment for fixed 6-byte vendor data header */
		len = ALIGN(len, 2);
		/* vendor data header */
		len += 6;
		if (WARN_ON(rtap->align == 0))
			rtap->align = 1;
		len = ALIGN(len, rtap->align);
		len += rtap->len + rtap->pad;
	}

197 198 199
	return len;
}

200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243
static void ieee80211_handle_mu_mimo_mon(struct ieee80211_sub_if_data *sdata,
					 struct sk_buff *skb,
					 int rtap_vendor_space)
{
	struct {
		struct ieee80211_hdr_3addr hdr;
		u8 category;
		u8 action_code;
	} __packed action;

	if (!sdata)
		return;

	BUILD_BUG_ON(sizeof(action) != IEEE80211_MIN_ACTION_SIZE + 1);

	if (skb->len < rtap_vendor_space + sizeof(action) +
		       VHT_MUMIMO_GROUPS_DATA_LEN)
		return;

	if (!is_valid_ether_addr(sdata->u.mntr.mu_follow_addr))
		return;

	skb_copy_bits(skb, rtap_vendor_space, &action, sizeof(action));

	if (!ieee80211_is_action(action.hdr.frame_control))
		return;

	if (action.category != WLAN_CATEGORY_VHT)
		return;

	if (action.action_code != WLAN_VHT_ACTION_GROUPID_MGMT)
		return;

	if (!ether_addr_equal(action.hdr.addr1, sdata->u.mntr.mu_follow_addr))
		return;

	skb = skb_copy(skb, GFP_ATOMIC);
	if (!skb)
		return;

	skb_queue_tail(&sdata->skb_queue, skb);
	ieee80211_queue_work(&sdata->local->hw, &sdata->work);
}

244
/*
245 246 247 248 249 250 251 252
 * ieee80211_add_rx_radiotap_header - add radiotap header
 *
 * add a radiotap header containing all the fields which the hardware provided.
 */
static void
ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
				 struct sk_buff *skb,
				 struct ieee80211_rate *rate,
253
				 int rtap_len, bool has_fcs)
254
{
255
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
256 257
	struct ieee80211_radiotap_header *rthdr;
	unsigned char *pos;
258 259
	__le32 *it_present;
	u32 it_present_val;
260
	u16 rx_flags = 0;
261
	u16 channel_flags = 0;
262 263
	int mpdulen, chain;
	unsigned long chains = status->chains;
264 265 266 267 268 269 270
	struct ieee80211_vendor_radiotap rtap = {};

	if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
		rtap = *(struct ieee80211_vendor_radiotap *)skb->data;
		/* rtap.len and rtap.pad are undone immediately */
		skb_pull(skb, sizeof(rtap) + rtap.len + rtap.pad);
	}
271 272

	mpdulen = skb->len;
273
	if (!(has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)))
274
		mpdulen += FCS_LEN;
275

276
	rthdr = skb_push(skb, rtap_len);
277
	memset(rthdr, 0, rtap_len - rtap.len - rtap.pad);
278
	it_present = &rthdr->it_present;
279 280

	/* radiotap header, set always present flags */
281
	rthdr->it_len = cpu_to_le16(rtap_len);
282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297
	it_present_val = BIT(IEEE80211_RADIOTAP_FLAGS) |
			 BIT(IEEE80211_RADIOTAP_CHANNEL) |
			 BIT(IEEE80211_RADIOTAP_RX_FLAGS);

	if (!status->chains)
		it_present_val |= BIT(IEEE80211_RADIOTAP_ANTENNA);

	for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
		it_present_val |=
			BIT(IEEE80211_RADIOTAP_EXT) |
			BIT(IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE);
		put_unaligned_le32(it_present_val, it_present);
		it_present++;
		it_present_val = BIT(IEEE80211_RADIOTAP_ANTENNA) |
				 BIT(IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
	}
298

299 300 301 302 303 304 305 306
	if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
		it_present_val |= BIT(IEEE80211_RADIOTAP_VENDOR_NAMESPACE) |
				  BIT(IEEE80211_RADIOTAP_EXT);
		put_unaligned_le32(it_present_val, it_present);
		it_present++;
		it_present_val = rtap.present;
	}

307 308 309 310
	put_unaligned_le32(it_present_val, it_present);

	pos = (void *)(it_present + 1);

311 312 313
	/* the order of the following fields is important */

	/* IEEE80211_RADIOTAP_TSFT */
314
	if (ieee80211_have_rx_timestamp(status)) {
315 316 317
		/* padding */
		while ((pos - (u8 *)rthdr) & 7)
			*pos++ = 0;
318 319 320 321
		put_unaligned_le64(
			ieee80211_calculate_rx_timestamp(local, status,
							 mpdulen, 0),
			pos);
J
Johannes Berg 已提交
322
		rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
323 324 325 326
		pos += 8;
	}

	/* IEEE80211_RADIOTAP_FLAGS */
327
	if (has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS))
328
		*pos |= IEEE80211_RADIOTAP_F_FCS;
J
Johannes Berg 已提交
329 330
	if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
		*pos |= IEEE80211_RADIOTAP_F_BADFCS;
331
	if (status->enc_flags & RX_ENC_FLAG_SHORTPRE)
332
		*pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
333 334 335
	pos++;

	/* IEEE80211_RADIOTAP_RATE */
336
	if (!rate || status->encoding != RX_ENC_LEGACY) {
337
		/*
338
		 * Without rate information don't add it. If we have,
339
		 * MCS information is a separate field in radiotap,
340 341
		 * added below. The byte here is needed as padding
		 * for the channel though, so initialise it to 0.
342 343
		 */
		*pos = 0;
344
	} else {
345
		int shift = 0;
346
		rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
347
		if (status->bw == RATE_INFO_BW_10)
348
			shift = 1;
349
		else if (status->bw == RATE_INFO_BW_5)
350 351
			shift = 2;
		*pos = DIV_ROUND_UP(rate->bitrate, 5 * (1 << shift));
352
	}
353 354 355
	pos++;

	/* IEEE80211_RADIOTAP_CHANNEL */
356
	put_unaligned_le16(status->freq, pos);
357
	pos += 2;
358
	if (status->bw == RATE_INFO_BW_10)
359
		channel_flags |= IEEE80211_CHAN_HALF;
360
	else if (status->bw == RATE_INFO_BW_5)
361 362
		channel_flags |= IEEE80211_CHAN_QUARTER;

363
	if (status->band == NL80211_BAND_5GHZ)
364
		channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ;
365
	else if (status->encoding != RX_ENC_LEGACY)
366
		channel_flags |= IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
367
	else if (rate && rate->flags & IEEE80211_RATE_ERP_G)
368
		channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ;
369
	else if (rate)
370
		channel_flags |= IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ;
371
	else
372 373
		channel_flags |= IEEE80211_CHAN_2GHZ;
	put_unaligned_le16(channel_flags, pos);
374 375 376
	pos += 2;

	/* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
377
	if (ieee80211_hw_check(&local->hw, SIGNAL_DBM) &&
378
	    !(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
379 380 381 382 383 384 385 386
		*pos = status->signal;
		rthdr->it_present |=
			cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
		pos++;
	}

	/* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */

387 388 389 390 391
	if (!status->chains) {
		/* IEEE80211_RADIOTAP_ANTENNA */
		*pos = status->antenna;
		pos++;
	}
392 393 394 395 396

	/* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */

	/* IEEE80211_RADIOTAP_RX_FLAGS */
	/* ensure 2 byte alignment for the 2 byte field as required */
397
	if ((pos - (u8 *)rthdr) & 1)
398
		*pos++ = 0;
J
Johannes Berg 已提交
399
	if (status->flag & RX_FLAG_FAILED_PLCP_CRC)
400 401
		rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP;
	put_unaligned_le16(rx_flags, pos);
402
	pos += 2;
403

404
	if (status->encoding == RX_ENC_HT) {
405 406
		unsigned int stbc;

407
		rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_MCS);
408
		*pos++ = local->hw.radiotap_mcs_details;
409
		*pos = 0;
410
		if (status->enc_flags & RX_ENC_FLAG_SHORT_GI)
411
			*pos |= IEEE80211_RADIOTAP_MCS_SGI;
412
		if (status->bw == RATE_INFO_BW_40)
413
			*pos |= IEEE80211_RADIOTAP_MCS_BW_40;
414
		if (status->enc_flags & RX_ENC_FLAG_HT_GF)
415
			*pos |= IEEE80211_RADIOTAP_MCS_FMT_GF;
416
		if (status->enc_flags & RX_ENC_FLAG_LDPC)
417
			*pos |= IEEE80211_RADIOTAP_MCS_FEC_LDPC;
418
		stbc = (status->enc_flags & RX_ENC_FLAG_STBC_MASK) >> RX_ENC_FLAG_STBC_SHIFT;
419
		*pos |= stbc << IEEE80211_RADIOTAP_MCS_STBC_SHIFT;
420 421 422
		pos++;
		*pos++ = status->rate_idx;
	}
423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449

	if (status->flag & RX_FLAG_AMPDU_DETAILS) {
		u16 flags = 0;

		/* ensure 4 byte alignment */
		while ((pos - (u8 *)rthdr) & 3)
			pos++;
		rthdr->it_present |=
			cpu_to_le32(1 << IEEE80211_RADIOTAP_AMPDU_STATUS);
		put_unaligned_le32(status->ampdu_reference, pos);
		pos += 4;
		if (status->flag & RX_FLAG_AMPDU_LAST_KNOWN)
			flags |= IEEE80211_RADIOTAP_AMPDU_LAST_KNOWN;
		if (status->flag & RX_FLAG_AMPDU_IS_LAST)
			flags |= IEEE80211_RADIOTAP_AMPDU_IS_LAST;
		if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_ERROR)
			flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_ERR;
		if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
			flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_KNOWN;
		put_unaligned_le16(flags, pos);
		pos += 2;
		if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
			*pos++ = status->ampdu_delimiter_crc;
		else
			*pos++ = 0;
		*pos++ = 0;
	}
450

451
	if (status->encoding == RX_ENC_VHT) {
452 453 454 455 456 457
		u16 known = local->hw.radiotap_vht_details;

		rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_VHT);
		put_unaligned_le16(known, pos);
		pos += 2;
		/* flags */
458
		if (status->enc_flags & RX_ENC_FLAG_SHORT_GI)
459
			*pos |= IEEE80211_RADIOTAP_VHT_FLAG_SGI;
460
		/* in VHT, STBC is binary */
461
		if (status->enc_flags & RX_ENC_FLAG_STBC_MASK)
462
			*pos |= IEEE80211_RADIOTAP_VHT_FLAG_STBC;
463
		if (status->enc_flags & RX_ENC_FLAG_BF)
464
			*pos |= IEEE80211_RADIOTAP_VHT_FLAG_BEAMFORMED;
465 466
		pos++;
		/* bandwidth */
467 468
		switch (status->bw) {
		case RATE_INFO_BW_80:
469
			*pos++ = 4;
470 471
			break;
		case RATE_INFO_BW_160:
472
			*pos++ = 11;
473 474
			break;
		case RATE_INFO_BW_40:
475
			*pos++ = 1;
476 477
			break;
		default:
478
			*pos++ = 0;
479
		}
480
		/* MCS/NSS */
481
		*pos = (status->rate_idx << 4) | status->nss;
482 483
		pos += 4;
		/* coding field */
484
		if (status->enc_flags & RX_ENC_FLAG_LDPC)
485
			*pos |= IEEE80211_RADIOTAP_CODING_LDPC_USER0;
486 487 488 489 490 491 492
		pos++;
		/* group ID */
		pos++;
		/* partial_aid */
		pos += 2;
	}

493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517
	if (local->hw.radiotap_timestamp.units_pos >= 0) {
		u16 accuracy = 0;
		u8 flags = IEEE80211_RADIOTAP_TIMESTAMP_FLAG_32BIT;

		rthdr->it_present |=
			cpu_to_le32(1 << IEEE80211_RADIOTAP_TIMESTAMP);

		/* ensure 8 byte alignment */
		while ((pos - (u8 *)rthdr) & 7)
			pos++;

		put_unaligned_le64(status->device_timestamp, pos);
		pos += sizeof(u64);

		if (local->hw.radiotap_timestamp.accuracy >= 0) {
			accuracy = local->hw.radiotap_timestamp.accuracy;
			flags |= IEEE80211_RADIOTAP_TIMESTAMP_FLAG_ACCURACY;
		}
		put_unaligned_le16(accuracy, pos);
		pos += sizeof(u16);

		*pos++ = local->hw.radiotap_timestamp.units_pos;
		*pos++ = flags;
	}

518 519 520 521
	for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
		*pos++ = status->chain_signal[chain];
		*pos++ = chain;
	}
522 523 524 525 526 527 528 529 530 531 532 533 534 535 536 537

	if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
		/* ensure 2 byte alignment for the vendor field as required */
		if ((pos - (u8 *)rthdr) & 1)
			*pos++ = 0;
		*pos++ = rtap.oui[0];
		*pos++ = rtap.oui[1];
		*pos++ = rtap.oui[2];
		*pos++ = rtap.subns;
		put_unaligned_le16(rtap.len, pos);
		pos += 2;
		/* align the actual payload as requested */
		while ((pos - (u8 *)rthdr) & (rtap.align - 1))
			*pos++ = 0;
		/* data (and possible padding) already follows */
	}
538 539
}

540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 570 571 572 573 574 575 576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592
static struct sk_buff *
ieee80211_make_monitor_skb(struct ieee80211_local *local,
			   struct sk_buff **origskb,
			   struct ieee80211_rate *rate,
			   int rtap_vendor_space, bool use_origskb)
{
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(*origskb);
	int rt_hdrlen, needed_headroom;
	struct sk_buff *skb;

	/* room for the radiotap header based on driver features */
	rt_hdrlen = ieee80211_rx_radiotap_hdrlen(local, status, *origskb);
	needed_headroom = rt_hdrlen - rtap_vendor_space;

	if (use_origskb) {
		/* only need to expand headroom if necessary */
		skb = *origskb;
		*origskb = NULL;

		/*
		 * This shouldn't trigger often because most devices have an
		 * RX header they pull before we get here, and that should
		 * be big enough for our radiotap information. We should
		 * probably export the length to drivers so that we can have
		 * them allocate enough headroom to start with.
		 */
		if (skb_headroom(skb) < needed_headroom &&
		    pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
			dev_kfree_skb(skb);
			return NULL;
		}
	} else {
		/*
		 * Need to make a copy and possibly remove radiotap header
		 * and FCS from the original.
		 */
		skb = skb_copy_expand(*origskb, needed_headroom, 0, GFP_ATOMIC);

		if (!skb)
			return NULL;
	}

	/* prepend radiotap information */
	ieee80211_add_rx_radiotap_header(local, skb, rate, rt_hdrlen, true);

	skb_reset_mac_header(skb);
	skb->ip_summed = CHECKSUM_UNNECESSARY;
	skb->pkt_type = PACKET_OTHERHOST;
	skb->protocol = htons(ETH_P_802_2);

	return skb;
}

593 594 595 596 597 598 599
/*
 * This function copies a received frame to all monitor interfaces and
 * returns a cleaned-up SKB that no longer includes the FCS nor the
 * radiotap header the driver might have added.
 */
static struct sk_buff *
ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
600
		     struct ieee80211_rate *rate)
601
{
602
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb);
603
	struct ieee80211_sub_if_data *sdata;
604
	struct sk_buff *monskb = NULL;
605
	int present_fcs_len = 0;
606
	unsigned int rtap_vendor_space = 0;
607 608
	struct ieee80211_sub_if_data *monitor_sdata =
		rcu_dereference(local->monitor_sdata);
609
	bool only_monitor = false;
610 611 612 613 614 615

	if (unlikely(status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA)) {
		struct ieee80211_vendor_radiotap *rtap = (void *)origskb->data;

		rtap_vendor_space = sizeof(*rtap) + rtap->len + rtap->pad;
	}
616 617 618 619 620 621 622 623 624

	/*
	 * First, we may need to make a copy of the skb because
	 *  (1) we need to modify it for radiotap (if not present), and
	 *  (2) the other RX handlers will modify the skb we got.
	 *
	 * We don't need to, of course, if we aren't going to return
	 * the SKB because it has a bad FCS/PLCP checksum.
	 */
J
Johannes Berg 已提交
625

626 627 628 629 630 631 632
	if (ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)) {
		if (unlikely(origskb->len <= FCS_LEN)) {
			/* driver bug */
			WARN_ON(1);
			dev_kfree_skb(origskb);
			return NULL;
		}
633
		present_fcs_len = FCS_LEN;
634
	}
635

636 637
	/* ensure hdr->frame_control and vendor radiotap data are in skb head */
	if (!pskb_may_pull(origskb, 2 + rtap_vendor_space)) {
Z
Zhu Yi 已提交
638 639 640 641
		dev_kfree_skb(origskb);
		return NULL;
	}

642 643 644
	only_monitor = should_drop_frame(origskb, present_fcs_len,
					 rtap_vendor_space);

645
	if (!local->monitors || (status->flag & RX_FLAG_SKIP_MONITOR)) {
646
		if (only_monitor) {
647 648 649 650
			dev_kfree_skb(origskb);
			return NULL;
		}

651 652 653
		remove_monitor_info(origskb, present_fcs_len,
				    rtap_vendor_space);
		return origskb;
654 655
	}

656 657
	ieee80211_handle_mu_mimo_mon(monitor_sdata, origskb, rtap_vendor_space);

658
	list_for_each_entry_rcu(sdata, &local->mon_list, u.mntr.list) {
659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682
		bool last_monitor = list_is_last(&sdata->u.mntr.list,
						 &local->mon_list);

		if (!monskb)
			monskb = ieee80211_make_monitor_skb(local, &origskb,
							    rate,
							    rtap_vendor_space,
							    only_monitor &&
							    last_monitor);

		if (monskb) {
			struct sk_buff *skb;

			if (last_monitor) {
				skb = monskb;
				monskb = NULL;
			} else {
				skb = skb_clone(monskb, GFP_ATOMIC);
			}

			if (skb) {
				skb->dev = sdata->dev;
				ieee80211_rx_stats(skb->dev, skb->len);
				netif_receive_skb(skb);
683 684 685
			}
		}

686 687
		if (last_monitor)
			break;
688 689
	}

690 691 692 693 694 695
	/* this happens if last_monitor was erroneously false */
	dev_kfree_skb(monskb);

	/* ditto */
	if (!origskb)
		return NULL;
696

697
	remove_monitor_info(origskb, present_fcs_len, rtap_vendor_space);
698 699 700
	return origskb;
}

701
static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
702
{
703
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
704
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
705
	int tid, seqno_idx, security_idx;
706 707

	/* does the frame have a qos control field? */
708 709
	if (ieee80211_is_data_qos(hdr->frame_control)) {
		u8 *qc = ieee80211_get_qos_ctl(hdr);
710
		/* frame has qos control */
711
		tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
712
		if (*qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT)
713
			status->rx_flags |= IEEE80211_RX_AMSDU;
714 715 716

		seqno_idx = tid;
		security_idx = tid;
717
	} else {
718 719 720 721 722 723 724 725 726 727 728
		/*
		 * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):
		 *
		 *	Sequence numbers for management frames, QoS data
		 *	frames with a broadcast/multicast address in the
		 *	Address 1 field, and all non-QoS data frames sent
		 *	by QoS STAs are assigned using an additional single
		 *	modulo-4096 counter, [...]
		 *
		 * We also use that counter for non-QoS STAs.
		 */
729
		seqno_idx = IEEE80211_NUM_TIDS;
730 731
		security_idx = 0;
		if (ieee80211_is_mgmt(hdr->frame_control))
732
			security_idx = IEEE80211_NUM_TIDS;
733
		tid = 0;
734
	}
735

736 737
	rx->seqno_idx = seqno_idx;
	rx->security_idx = security_idx;
738 739 740
	/* Set skb->priority to 1d tag if highest order bit of TID is not set.
	 * For now, set skb->priority to 0 for other cases. */
	rx->skb->priority = (tid > 7) ? 0 : tid;
741
}
742

743 744 745 746 747 748 749 750 751 752 753
/**
 * DOC: Packet alignment
 *
 * Drivers always need to pass packets that are aligned to two-byte boundaries
 * to the stack.
 *
 * Additionally, should, if possible, align the payload data in a way that
 * guarantees that the contained IP header is aligned to a four-byte
 * boundary. In the case of regular frames, this simply means aligning the
 * payload to a four-byte boundary (because either the IP header is directly
 * contained, or IV/RFC1042 headers that have a length divisible by four are
754 755 756
 * in front of it).  If the payload data is not properly aligned and the
 * architecture doesn't support efficient unaligned operations, mac80211
 * will align the data.
757 758 759 760 761 762 763
 *
 * With A-MSDU frames, however, the payload data address must yield two modulo
 * four because there are 14-byte 802.3 headers within the A-MSDU frames that
 * push the IP header further back to a multiple of four again. Thankfully, the
 * specs were sane enough this time around to require padding each A-MSDU
 * subframe to a length that is a multiple of four.
 *
L
Lucas De Marchi 已提交
764
 * Padding like Atheros hardware adds which is between the 802.11 header and
765 766 767 768
 * the payload is not supported, the driver is required to move the 802.11
 * header to be directly in front of the payload in that case.
 */
static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
769
{
770
#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
771
	WARN_ON_ONCE((unsigned long)rx->skb->data & 1);
772
#endif
773 774
}

775

776 777
/* rx handlers */

778 779 780 781
static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
{
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;

782
	if (is_multicast_ether_addr(hdr->addr1))
783 784
		return 0;

785
	return ieee80211_is_robust_mgmt_frame(skb);
786 787 788 789 790 791 792
}


static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb)
{
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;

793
	if (!is_multicast_ether_addr(hdr->addr1))
794 795
		return 0;

796
	return ieee80211_is_robust_mgmt_frame(skb);
797 798 799 800 801 802 803 804
}


/* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */
static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
{
	struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data;
	struct ieee80211_mmie *mmie;
805
	struct ieee80211_mmie_16 *mmie16;
806

J
Johannes Berg 已提交
807
	if (skb->len < 24 + sizeof(*mmie) || !is_multicast_ether_addr(hdr->da))
808 809
		return -1;

810
	if (!ieee80211_is_robust_mgmt_frame(skb))
811 812 813 814
		return -1; /* not a robust management frame */

	mmie = (struct ieee80211_mmie *)
		(skb->data + skb->len - sizeof(*mmie));
815 816 817 818 819 820 821 822 823 824 825 826
	if (mmie->element_id == WLAN_EID_MMIE &&
	    mmie->length == sizeof(*mmie) - 2)
		return le16_to_cpu(mmie->key_id);

	mmie16 = (struct ieee80211_mmie_16 *)
		(skb->data + skb->len - sizeof(*mmie16));
	if (skb->len >= 24 + sizeof(*mmie16) &&
	    mmie16->element_id == WLAN_EID_MMIE &&
	    mmie16->length == sizeof(*mmie16) - 2)
		return le16_to_cpu(mmie16->key_id);

	return -1;
827 828
}

829 830
static int ieee80211_get_cs_keyid(const struct ieee80211_cipher_scheme *cs,
				  struct sk_buff *skb)
831 832 833 834 835 836 837 838 839 840 841 842 843 844 845 846 847 848 849
{
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
	__le16 fc;
	int hdrlen;
	u8 keyid;

	fc = hdr->frame_control;
	hdrlen = ieee80211_hdrlen(fc);

	if (skb->len < hdrlen + cs->hdr_len)
		return -EINVAL;

	skb_copy_bits(skb, hdrlen + cs->key_idx_off, &keyid, 1);
	keyid &= cs->key_idx_mask;
	keyid >>= cs->key_idx_shift;

	return keyid;
}

J
Johannes Berg 已提交
850
static ieee80211_rx_result ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
851
{
852
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
853
	char *dev_addr = rx->sdata->vif.addr;
854

855
	if (ieee80211_is_data(hdr->frame_control)) {
856 857
		if (is_multicast_ether_addr(hdr->addr1)) {
			if (ieee80211_has_tods(hdr->frame_control) ||
J
Johannes Berg 已提交
858
			    !ieee80211_has_fromds(hdr->frame_control))
859
				return RX_DROP_MONITOR;
860
			if (ether_addr_equal(hdr->addr3, dev_addr))
861 862 863 864
				return RX_DROP_MONITOR;
		} else {
			if (!ieee80211_has_a4(hdr->frame_control))
				return RX_DROP_MONITOR;
865
			if (ether_addr_equal(hdr->addr4, dev_addr))
866 867
				return RX_DROP_MONITOR;
		}
868 869 870 871 872 873
	}

	/* If there is not an established peer link and this is not a peer link
	 * establisment frame, beacon or probe, drop the frame.
	 */

874
	if (!rx->sta || sta_plink_state(rx->sta) != NL80211_PLINK_ESTAB) {
875
		struct ieee80211_mgmt *mgmt;
876

877
		if (!ieee80211_is_mgmt(hdr->frame_control))
878 879
			return RX_DROP_MONITOR;

880
		if (ieee80211_is_action(hdr->frame_control)) {
881
			u8 category;
882 883 884 885 886

			/* make sure category field is present */
			if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE)
				return RX_DROP_MONITOR;

887
			mgmt = (struct ieee80211_mgmt *)hdr;
888 889
			category = mgmt->u.action.category;
			if (category != WLAN_CATEGORY_MESH_ACTION &&
J
Johannes Berg 已提交
890
			    category != WLAN_CATEGORY_SELF_PROTECTED)
891 892 893 894
				return RX_DROP_MONITOR;
			return RX_CONTINUE;
		}

895 896
		if (ieee80211_is_probe_req(hdr->frame_control) ||
		    ieee80211_is_probe_resp(hdr->frame_control) ||
897 898
		    ieee80211_is_beacon(hdr->frame_control) ||
		    ieee80211_is_auth(hdr->frame_control))
899 900 901 902 903
			return RX_CONTINUE;

		return RX_DROP_MONITOR;
	}

J
Johannes Berg 已提交
904 905
	return RX_CONTINUE;
}
906

907 908 909 910 911 912 913
static inline bool ieee80211_rx_reorder_ready(struct tid_ampdu_rx *tid_agg_rx,
					      int index)
{
	struct sk_buff_head *frames = &tid_agg_rx->reorder_buf[index];
	struct sk_buff *tail = skb_peek_tail(frames);
	struct ieee80211_rx_status *status;

914 915 916
	if (tid_agg_rx->reorder_buf_filtered & BIT_ULL(index))
		return true;

917 918 919 920 921 922 923 924 925 926
	if (!tail)
		return false;

	status = IEEE80211_SKB_RXCB(tail);
	if (status->flag & RX_FLAG_AMSDU_MORE)
		return false;

	return true;
}

927
static void ieee80211_release_reorder_frame(struct ieee80211_sub_if_data *sdata,
928
					    struct tid_ampdu_rx *tid_agg_rx,
929 930
					    int index,
					    struct sk_buff_head *frames)
931
{
932 933
	struct sk_buff_head *skb_list = &tid_agg_rx->reorder_buf[index];
	struct sk_buff *skb;
934
	struct ieee80211_rx_status *status;
935

936 937
	lockdep_assert_held(&tid_agg_rx->reorder_lock);

938
	if (skb_queue_empty(skb_list))
939 940
		goto no_frame;

941
	if (!ieee80211_rx_reorder_ready(tid_agg_rx, index)) {
942 943 944 945 946
		__skb_queue_purge(skb_list);
		goto no_frame;
	}

	/* release frames from the reorder ring buffer */
947
	tid_agg_rx->stored_mpdu_num--;
948 949 950 951 952
	while ((skb = __skb_dequeue(skb_list))) {
		status = IEEE80211_SKB_RXCB(skb);
		status->rx_flags |= IEEE80211_RX_DEFERRED_RELEASE;
		__skb_queue_tail(frames, skb);
	}
953 954

no_frame:
955
	tid_agg_rx->reorder_buf_filtered &= ~BIT_ULL(index);
956
	tid_agg_rx->head_seq_num = ieee80211_sn_inc(tid_agg_rx->head_seq_num);
957 958
}

959
static void ieee80211_release_reorder_frames(struct ieee80211_sub_if_data *sdata,
960
					     struct tid_ampdu_rx *tid_agg_rx,
961 962
					     u16 head_seq_num,
					     struct sk_buff_head *frames)
963 964 965
{
	int index;

966 967
	lockdep_assert_held(&tid_agg_rx->reorder_lock);

968
	while (ieee80211_sn_less(tid_agg_rx->head_seq_num, head_seq_num)) {
969
		index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
970 971
		ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
						frames);
972 973 974 975 976 977 978 979 980
	}
}

/*
 * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If
 * the skb was added to the buffer longer than this time ago, the earlier
 * frames that have not yet been received are assumed to be lost and the skb
 * can be released for processing. This may also release other skb's from the
 * reorder buffer if there are no additional gaps between the frames.
981 982
 *
 * Callers must hold tid_agg_rx->reorder_lock.
983 984 985
 */
#define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)

986
static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata,
987 988
					  struct tid_ampdu_rx *tid_agg_rx,
					  struct sk_buff_head *frames)
989
{
990
	int index, i, j;
991

992 993
	lockdep_assert_held(&tid_agg_rx->reorder_lock);

994
	/* release the buffer until next missing frame */
995
	index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
996
	if (!ieee80211_rx_reorder_ready(tid_agg_rx, index) &&
997
	    tid_agg_rx->stored_mpdu_num) {
998 999 1000 1001 1002 1003 1004
		/*
		 * No buffers ready to be released, but check whether any
		 * frames in the reorder buffer have timed out.
		 */
		int skipped = 1;
		for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
		     j = (j + 1) % tid_agg_rx->buf_size) {
1005
			if (!ieee80211_rx_reorder_ready(tid_agg_rx, j)) {
1006 1007 1008
				skipped++;
				continue;
			}
1009 1010
			if (skipped &&
			    !time_after(jiffies, tid_agg_rx->reorder_time[j] +
1011
					HT_RX_REORDER_BUF_TIMEOUT))
1012
				goto set_release_timer;
1013

1014 1015 1016 1017 1018
			/* don't leave incomplete A-MSDUs around */
			for (i = (index + 1) % tid_agg_rx->buf_size; i != j;
			     i = (i + 1) % tid_agg_rx->buf_size)
				__skb_queue_purge(&tid_agg_rx->reorder_buf[i]);

J
Johannes Berg 已提交
1019 1020
			ht_dbg_ratelimited(sdata,
					   "release an RX reorder frame due to timeout on earlier frames\n");
1021 1022
			ieee80211_release_reorder_frame(sdata, tid_agg_rx, j,
							frames);
1023 1024 1025 1026 1027

			/*
			 * Increment the head seq# also for the skipped slots.
			 */
			tid_agg_rx->head_seq_num =
1028 1029
				(tid_agg_rx->head_seq_num +
				 skipped) & IEEE80211_SN_MASK;
1030 1031
			skipped = 0;
		}
1032
	} else while (ieee80211_rx_reorder_ready(tid_agg_rx, index)) {
1033 1034
		ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
						frames);
1035
		index =	tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
1036
	}
1037 1038

	if (tid_agg_rx->stored_mpdu_num) {
1039
		j = index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
1040 1041 1042

		for (; j != (index - 1) % tid_agg_rx->buf_size;
		     j = (j + 1) % tid_agg_rx->buf_size) {
1043
			if (ieee80211_rx_reorder_ready(tid_agg_rx, j))
1044 1045 1046 1047 1048
				break;
		}

 set_release_timer:

1049 1050 1051 1052
		if (!tid_agg_rx->removed)
			mod_timer(&tid_agg_rx->reorder_timer,
				  tid_agg_rx->reorder_time[j] + 1 +
				  HT_RX_REORDER_BUF_TIMEOUT);
1053 1054 1055
	} else {
		del_timer(&tid_agg_rx->reorder_timer);
	}
1056 1057
}

1058 1059 1060 1061 1062
/*
 * As this function belongs to the RX path it must be under
 * rcu_read_lock protection. It returns false if the frame
 * can be processed immediately, true if it was consumed.
 */
1063
static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata,
1064
					     struct tid_ampdu_rx *tid_agg_rx,
1065 1066
					     struct sk_buff *skb,
					     struct sk_buff_head *frames)
1067 1068
{
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1069
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1070 1071 1072 1073
	u16 sc = le16_to_cpu(hdr->seq_ctrl);
	u16 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
	u16 head_seq_num, buf_size;
	int index;
1074
	bool ret = true;
1075

1076 1077
	spin_lock(&tid_agg_rx->reorder_lock);

1078 1079 1080 1081 1082 1083 1084 1085 1086 1087
	/*
	 * Offloaded BA sessions have no known starting sequence number so pick
	 * one from first Rxed frame for this tid after BA was started.
	 */
	if (unlikely(tid_agg_rx->auto_seq)) {
		tid_agg_rx->auto_seq = false;
		tid_agg_rx->ssn = mpdu_seq_num;
		tid_agg_rx->head_seq_num = mpdu_seq_num;
	}

1088 1089 1090
	buf_size = tid_agg_rx->buf_size;
	head_seq_num = tid_agg_rx->head_seq_num;

1091 1092 1093 1094 1095 1096 1097 1098 1099 1100 1101 1102
	/*
	 * If the current MPDU's SN is smaller than the SSN, it shouldn't
	 * be reordered.
	 */
	if (unlikely(!tid_agg_rx->started)) {
		if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) {
			ret = false;
			goto out;
		}
		tid_agg_rx->started = true;
	}

1103
	/* frame with out of date sequence number */
1104
	if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) {
1105
		dev_kfree_skb(skb);
1106
		goto out;
1107 1108 1109 1110 1111 1112
	}

	/*
	 * If frame the sequence number exceeds our buffering window
	 * size release some previous frames to make room for this one.
	 */
1113 1114 1115
	if (!ieee80211_sn_less(mpdu_seq_num, head_seq_num + buf_size)) {
		head_seq_num = ieee80211_sn_inc(
				ieee80211_sn_sub(mpdu_seq_num, buf_size));
1116
		/* release stored frames up to new head to stack */
1117
		ieee80211_release_reorder_frames(sdata, tid_agg_rx,
1118
						 head_seq_num, frames);
1119 1120 1121 1122
	}

	/* Now the new frame is always in the range of the reordering buffer */

1123
	index = mpdu_seq_num % tid_agg_rx->buf_size;
1124 1125

	/* check if we already stored this frame */
1126
	if (ieee80211_rx_reorder_ready(tid_agg_rx, index)) {
1127
		dev_kfree_skb(skb);
1128
		goto out;
1129 1130 1131 1132 1133
	}

	/*
	 * If the current MPDU is in the right order and nothing else
	 * is stored we can process it directly, no need to buffer it.
1134 1135
	 * If it is first but there's something stored, we may be able
	 * to release frames after this one.
1136 1137 1138
	 */
	if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
	    tid_agg_rx->stored_mpdu_num == 0) {
1139 1140 1141
		if (!(status->flag & RX_FLAG_AMSDU_MORE))
			tid_agg_rx->head_seq_num =
				ieee80211_sn_inc(tid_agg_rx->head_seq_num);
1142 1143
		ret = false;
		goto out;
1144 1145 1146
	}

	/* put the frame in the reordering buffer */
1147 1148 1149 1150 1151 1152
	__skb_queue_tail(&tid_agg_rx->reorder_buf[index], skb);
	if (!(status->flag & RX_FLAG_AMSDU_MORE)) {
		tid_agg_rx->reorder_time[index] = jiffies;
		tid_agg_rx->stored_mpdu_num++;
		ieee80211_sta_reorder_release(sdata, tid_agg_rx, frames);
	}
1153

1154 1155 1156
 out:
	spin_unlock(&tid_agg_rx->reorder_lock);
	return ret;
1157 1158 1159 1160 1161 1162
}

/*
 * Reorder MPDUs from A-MPDUs, keeping them on a buffer. Returns
 * true if the MPDU was buffered, false if it should be processed.
 */
1163 1164
static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx,
				       struct sk_buff_head *frames)
1165
{
1166 1167
	struct sk_buff *skb = rx->skb;
	struct ieee80211_local *local = rx->local;
1168
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1169
	struct sta_info *sta = rx->sta;
1170 1171
	struct tid_ampdu_rx *tid_agg_rx;
	u16 sc;
1172
	u8 tid, ack_policy;
1173

1174 1175
	if (!ieee80211_is_data_qos(hdr->frame_control) ||
	    is_multicast_ether_addr(hdr->addr1))
1176
		goto dont_reorder;
1177 1178 1179 1180 1181 1182 1183

	/*
	 * filter the QoS data rx stream according to
	 * STA/TID and check if this STA/TID is on aggregation
	 */

	if (!sta)
1184
		goto dont_reorder;
1185

1186 1187
	ack_policy = *ieee80211_get_qos_ctl(hdr) &
		     IEEE80211_QOS_CTL_ACK_POLICY_MASK;
1188 1189
	tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;

1190
	tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
1191 1192 1193 1194 1195 1196 1197
	if (!tid_agg_rx) {
		if (ack_policy == IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK &&
		    !test_bit(tid, rx->sta->ampdu_mlme.agg_session_valid) &&
		    !test_and_set_bit(tid, rx->sta->ampdu_mlme.unexpected_agg))
			ieee80211_send_delba(rx->sdata, rx->sta->sta.addr, tid,
					     WLAN_BACK_RECIPIENT,
					     WLAN_REASON_QSTA_REQUIRE_SETUP);
1198
		goto dont_reorder;
1199
	}
1200 1201 1202

	/* qos null data frames are excluded */
	if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
1203
		goto dont_reorder;
1204

1205 1206 1207 1208 1209
	/* not part of a BA session */
	if (ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK &&
	    ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_NORMAL)
		goto dont_reorder;

1210 1211 1212 1213
	/* new, potentially un-ordered, ampdu frame - process it */

	/* reset session timer */
	if (tid_agg_rx->timeout)
1214
		tid_agg_rx->last_rx = jiffies;
1215 1216 1217 1218

	/* if this mpdu is fragmented - terminate rx aggregation session */
	sc = le16_to_cpu(hdr->seq_ctrl);
	if (sc & IEEE80211_SCTL_FRAG) {
1219 1220
		skb_queue_tail(&rx->sdata->skb_queue, skb);
		ieee80211_queue_work(&local->hw, &rx->sdata->work);
1221
		return;
1222 1223
	}

1224 1225 1226 1227 1228 1229 1230
	/*
	 * No locking needed -- we will only ever process one
	 * RX packet at a time, and thus own tid_agg_rx. All
	 * other code manipulating it needs to (and does) make
	 * sure that we cannot get to it any more before doing
	 * anything with it.
	 */
1231 1232
	if (ieee80211_sta_manage_reorder_buf(rx->sdata, tid_agg_rx, skb,
					     frames))
1233 1234 1235
		return;

 dont_reorder:
1236
	__skb_queue_tail(frames, skb);
1237
}
1238

1239
static ieee80211_rx_result debug_noinline
1240
ieee80211_rx_h_check_dup(struct ieee80211_rx_data *rx)
1241
{
1242
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1243
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1244

1245 1246 1247
	if (status->flag & RX_FLAG_DUP_VALIDATED)
		return RX_CONTINUE;

1248 1249 1250 1251
	/*
	 * Drop duplicate 802.11 retransmissions
	 * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery")
	 */
1252 1253 1254 1255 1256 1257 1258 1259 1260

	if (rx->skb->len < 24)
		return RX_CONTINUE;

	if (ieee80211_is_ctl(hdr->frame_control) ||
	    ieee80211_is_qos_nullfunc(hdr->frame_control) ||
	    is_multicast_ether_addr(hdr->addr1))
		return RX_CONTINUE;

1261 1262 1263 1264 1265 1266
	if (!rx->sta)
		return RX_CONTINUE;

	if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
		     rx->sta->last_seq_ctrl[rx->seqno_idx] == hdr->seq_ctrl)) {
		I802_DEBUG_INC(rx->local->dot11FrameDuplicateCount);
1267
		rx->sta->rx_stats.num_duplicates++;
1268 1269 1270
		return RX_DROP_UNUSABLE;
	} else if (!(status->flag & RX_FLAG_AMSDU_MORE)) {
		rx->sta->last_seq_ctrl[rx->seqno_idx] = hdr->seq_ctrl;
1271 1272
	}

1273 1274 1275 1276 1277 1278 1279 1280
	return RX_CONTINUE;
}

static ieee80211_rx_result debug_noinline
ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
{
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;

1281 1282 1283
	/* Drop disallowed frame classes based on STA auth/assoc state;
	 * IEEE 802.11, Chap 5.5.
	 *
J
Johannes Berg 已提交
1284 1285
	 * mac80211 filters only based on association state, i.e. it drops
	 * Class 3 frames from not associated stations. hostapd sends
1286 1287 1288
	 * deauth/disassoc frames when needed. In addition, hostapd is
	 * responsible for filtering on both auth and assoc states.
	 */
1289

J
Johannes Berg 已提交
1290
	if (ieee80211_vif_is_mesh(&rx->sdata->vif))
1291 1292
		return ieee80211_rx_mesh_check(rx);

1293 1294
	if (unlikely((ieee80211_is_data(hdr->frame_control) ||
		      ieee80211_is_pspoll(hdr->frame_control)) &&
1295
		     rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
B
Bill Jordan 已提交
1296
		     rx->sdata->vif.type != NL80211_IFTYPE_WDS &&
1297
		     rx->sdata->vif.type != NL80211_IFTYPE_OCB &&
J
Johannes Berg 已提交
1298
		     (!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_ASSOC)))) {
1299 1300 1301 1302 1303 1304
		/*
		 * accept port control frames from the AP even when it's not
		 * yet marked ASSOC to prevent a race where we don't set the
		 * assoc bit quickly enough before it sends the first frame
		 */
		if (rx->sta && rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
1305
		    ieee80211_is_data_present(hdr->frame_control)) {
1306 1307 1308 1309 1310 1311 1312 1313 1314 1315
			unsigned int hdrlen;
			__be16 ethertype;

			hdrlen = ieee80211_hdrlen(hdr->frame_control);

			if (rx->skb->len < hdrlen + 8)
				return RX_DROP_MONITOR;

			skb_copy_bits(rx->skb, hdrlen + 6, &ethertype, 2);
			if (ethertype == rx->sdata->control_port_protocol)
1316 1317
				return RX_CONTINUE;
		}
1318 1319 1320 1321 1322 1323 1324

		if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
		    cfg80211_rx_spurious_frame(rx->sdata->dev,
					       hdr->addr2,
					       GFP_ATOMIC))
			return RX_DROP_UNUSABLE;

J
Johannes Berg 已提交
1325
		return RX_DROP_MONITOR;
1326
	}
1327

1328
	return RX_CONTINUE;
1329 1330 1331
}


1332 1333 1334 1335 1336 1337 1338 1339 1340 1341 1342 1343 1344 1345 1346 1347 1348 1349 1350 1351 1352 1353 1354 1355 1356 1357 1358 1359 1360 1361 1362 1363 1364
static ieee80211_rx_result debug_noinline
ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx)
{
	struct ieee80211_local *local;
	struct ieee80211_hdr *hdr;
	struct sk_buff *skb;

	local = rx->local;
	skb = rx->skb;
	hdr = (struct ieee80211_hdr *) skb->data;

	if (!local->pspolling)
		return RX_CONTINUE;

	if (!ieee80211_has_fromds(hdr->frame_control))
		/* this is not from AP */
		return RX_CONTINUE;

	if (!ieee80211_is_data(hdr->frame_control))
		return RX_CONTINUE;

	if (!ieee80211_has_moredata(hdr->frame_control)) {
		/* AP has no more frames buffered for us */
		local->pspolling = false;
		return RX_CONTINUE;
	}

	/* more data bit is set, let's request a new frame from the AP */
	ieee80211_send_pspoll(local, rx->sdata);

	return RX_CONTINUE;
}

1365
static void sta_ps_start(struct sta_info *sta)
1366
{
1367
	struct ieee80211_sub_if_data *sdata = sta->sdata;
1368
	struct ieee80211_local *local = sdata->local;
1369
	struct ps_data *ps;
1370
	int tid;
1371

1372 1373 1374 1375 1376 1377 1378
	if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
	    sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
		ps = &sdata->bss->ps;
	else
		return;

	atomic_inc(&ps->num_sta_ps);
J
Johannes Berg 已提交
1379
	set_sta_flag(sta, WLAN_STA_PS_STA);
1380
	if (!ieee80211_hw_check(&local->hw, AP_LINK_PS))
1381
		drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta);
J
Johannes Berg 已提交
1382 1383
	ps_dbg(sdata, "STA %pM aid %d enters power save mode\n",
	       sta->sta.addr, sta->sta.aid);
1384

J
Johannes Berg 已提交
1385 1386
	ieee80211_clear_fast_xmit(sta);

1387 1388 1389 1390
	if (!sta->sta.txq[0])
		return;

	for (tid = 0; tid < ARRAY_SIZE(sta->sta.txq); tid++) {
1391
		if (txq_has_queue(sta->sta.txq[tid]))
1392 1393 1394 1395
			set_bit(tid, &sta->txq_buffered_tids);
		else
			clear_bit(tid, &sta->txq_buffered_tids);
	}
1396 1397
}

1398
static void sta_ps_end(struct sta_info *sta)
1399
{
J
Johannes Berg 已提交
1400 1401
	ps_dbg(sta->sdata, "STA %pM aid %d exits power save mode\n",
	       sta->sta.addr, sta->sta.aid);
1402

J
Johannes Berg 已提交
1403
	if (test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
1404 1405 1406 1407 1408 1409 1410
		/*
		 * Clear the flag only if the other one is still set
		 * so that the TX path won't start TX'ing new frames
		 * directly ... In the case that the driver flag isn't
		 * set ieee80211_sta_ps_deliver_wakeup() will clear it.
		 */
		clear_sta_flag(sta, WLAN_STA_PS_STA);
J
Johannes Berg 已提交
1411 1412
		ps_dbg(sta->sdata, "STA %pM aid %d driver-ps-blocked\n",
		       sta->sta.addr, sta->sta.aid);
1413 1414 1415
		return;
	}

1416 1417
	set_sta_flag(sta, WLAN_STA_PS_DELIVER);
	clear_sta_flag(sta, WLAN_STA_PS_STA);
1418
	ieee80211_sta_ps_deliver_wakeup(sta);
1419 1420
}

1421
int ieee80211_sta_ps_transition(struct ieee80211_sta *pubsta, bool start)
1422
{
1423
	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1424 1425
	bool in_ps;

1426
	WARN_ON(!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS));
1427 1428

	/* Don't let the same PS state be set twice */
1429
	in_ps = test_sta_flag(sta, WLAN_STA_PS_STA);
1430 1431 1432 1433
	if ((start && in_ps) || (!start && !in_ps))
		return -EINVAL;

	if (start)
1434
		sta_ps_start(sta);
1435
	else
1436
		sta_ps_end(sta);
1437 1438 1439 1440 1441

	return 0;
}
EXPORT_SYMBOL(ieee80211_sta_ps_transition);

1442 1443 1444 1445 1446 1447 1448 1449 1450 1451 1452 1453 1454 1455 1456 1457 1458
void ieee80211_sta_pspoll(struct ieee80211_sta *pubsta)
{
	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);

	if (test_sta_flag(sta, WLAN_STA_SP))
		return;

	if (!test_sta_flag(sta, WLAN_STA_PS_DRIVER))
		ieee80211_sta_ps_deliver_poll_response(sta);
	else
		set_sta_flag(sta, WLAN_STA_PSPOLL);
}
EXPORT_SYMBOL(ieee80211_sta_pspoll);

void ieee80211_sta_uapsd_trigger(struct ieee80211_sta *pubsta, u8 tid)
{
	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1459
	int ac = ieee80211_ac_from_tid(tid);
1460 1461

	/*
1462 1463
	 * If this AC is not trigger-enabled do nothing unless the
	 * driver is calling us after it already checked.
1464 1465 1466 1467 1468
	 *
	 * NB: This could/should check a separate bitmap of trigger-
	 * enabled queues, but for now we only implement uAPSD w/o
	 * TSPEC changes to the ACs, so they're always the same.
	 */
1469 1470
	if (!(sta->sta.uapsd_queues & ieee80211_ac_to_qos_mask[ac]) &&
	    tid != IEEE80211_NUM_TIDS)
1471 1472 1473 1474 1475 1476 1477 1478 1479 1480 1481 1482 1483
		return;

	/* if we are in a service period, do nothing */
	if (test_sta_flag(sta, WLAN_STA_SP))
		return;

	if (!test_sta_flag(sta, WLAN_STA_PS_DRIVER))
		ieee80211_sta_ps_deliver_uapsd(sta);
	else
		set_sta_flag(sta, WLAN_STA_UAPSD);
}
EXPORT_SYMBOL(ieee80211_sta_uapsd_trigger);

J
Johannes Berg 已提交
1484 1485 1486 1487 1488 1489 1490
static ieee80211_rx_result debug_noinline
ieee80211_rx_h_uapsd_and_pspoll(struct ieee80211_rx_data *rx)
{
	struct ieee80211_sub_if_data *sdata = rx->sdata;
	struct ieee80211_hdr *hdr = (void *)rx->skb->data;
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);

1491
	if (!rx->sta)
J
Johannes Berg 已提交
1492 1493 1494 1495 1496 1497 1498 1499 1500 1501 1502
		return RX_CONTINUE;

	if (sdata->vif.type != NL80211_IFTYPE_AP &&
	    sdata->vif.type != NL80211_IFTYPE_AP_VLAN)
		return RX_CONTINUE;

	/*
	 * The device handles station powersave, so don't do anything about
	 * uAPSD and PS-Poll frames (the latter shouldn't even come up from
	 * it to mac80211 since they're handled.)
	 */
1503
	if (ieee80211_hw_check(&sdata->local->hw, AP_LINK_PS))
J
Johannes Berg 已提交
1504 1505 1506 1507 1508 1509 1510
		return RX_CONTINUE;

	/*
	 * Don't do anything if the station isn't already asleep. In
	 * the uAPSD case, the station will probably be marked asleep,
	 * in the PS-Poll case the station must be confused ...
	 */
J
Johannes Berg 已提交
1511
	if (!test_sta_flag(rx->sta, WLAN_STA_PS_STA))
J
Johannes Berg 已提交
1512 1513 1514
		return RX_CONTINUE;

	if (unlikely(ieee80211_is_pspoll(hdr->frame_control))) {
1515
		ieee80211_sta_pspoll(&rx->sta->sta);
J
Johannes Berg 已提交
1516 1517 1518 1519 1520 1521 1522 1523 1524 1525 1526

		/* Free PS Poll skb here instead of returning RX_DROP that would
		 * count as an dropped frame. */
		dev_kfree_skb(rx->skb);

		return RX_QUEUED;
	} else if (!ieee80211_has_morefrags(hdr->frame_control) &&
		   !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
		   ieee80211_has_pm(hdr->frame_control) &&
		   (ieee80211_is_data_qos(hdr->frame_control) ||
		    ieee80211_is_qos_nullfunc(hdr->frame_control))) {
1527
		u8 tid;
J
Johannes Berg 已提交
1528

1529
		tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
J
Johannes Berg 已提交
1530

1531
		ieee80211_sta_uapsd_trigger(&rx->sta->sta, tid);
J
Johannes Berg 已提交
1532 1533 1534 1535 1536
	}

	return RX_CONTINUE;
}

1537
static ieee80211_rx_result debug_noinline
1538
ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
1539 1540
{
	struct sta_info *sta = rx->sta;
J
Johannes Berg 已提交
1541 1542 1543
	struct sk_buff *skb = rx->skb;
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1544
	int i;
1545 1546

	if (!sta)
1547
		return RX_CONTINUE;
1548

J
Johannes Berg 已提交
1549 1550
	/*
	 * Update last_rx only for IBSS packets which are for the current
1551 1552 1553 1554 1555
	 * BSSID and for station already AUTHORIZED to avoid keeping the
	 * current IBSS network alive in cases where other STAs start
	 * using different BSSID. This will also give the station another
	 * chance to restart the authentication/authorization in case
	 * something went wrong the first time.
J
Johannes Berg 已提交
1556
	 */
1557
	if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
1558
		u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
1559
						NL80211_IFTYPE_ADHOC);
1560 1561
		if (ether_addr_equal(bssid, rx->sdata->u.ibss.bssid) &&
		    test_sta_flag(sta, WLAN_STA_AUTHORIZED)) {
1562
			sta->rx_stats.last_rx = jiffies;
1563
			if (ieee80211_is_data(hdr->frame_control) &&
1564 1565 1566
			    !is_multicast_ether_addr(hdr->addr1))
				sta->rx_stats.last_rate =
					sta_stats_encode_rate(status);
1567
		}
1568
	} else if (rx->sdata->vif.type == NL80211_IFTYPE_OCB) {
1569
		sta->rx_stats.last_rx = jiffies;
J
Johannes Berg 已提交
1570 1571
	} else if (!is_multicast_ether_addr(hdr->addr1)) {
		/*
1572 1573
		 * Mesh beacons will update last_rx when if they are found to
		 * match the current local configuration when processed.
1574
		 */
1575
		sta->rx_stats.last_rx = jiffies;
1576 1577
		if (ieee80211_is_data(hdr->frame_control))
			sta->rx_stats.last_rate = sta_stats_encode_rate(status);
1578 1579
	}

1580 1581 1582
	if (rx->sdata->vif.type == NL80211_IFTYPE_STATION)
		ieee80211_sta_rx_notify(rx->sdata, hdr);

1583
	sta->rx_stats.fragments++;
1584 1585

	u64_stats_update_begin(&rx->sta->rx_stats.syncp);
1586
	sta->rx_stats.bytes += rx->skb->len;
1587 1588
	u64_stats_update_end(&rx->sta->rx_stats.syncp);

1589
	if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
1590
		sta->rx_stats.last_signal = status->signal;
1591
		ewma_signal_add(&sta->rx_stats_avg.signal, -status->signal);
1592
	}
1593

1594
	if (status->chains) {
1595
		sta->rx_stats.chains = status->chains;
1596 1597 1598 1599 1600 1601
		for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {
			int signal = status->chain_signal[i];

			if (!(status->chains & BIT(i)))
				continue;

1602
			sta->rx_stats.chain_signal_last[i] = signal;
1603
			ewma_signal_add(&sta->rx_stats_avg.chain_signal[i],
1604
					-signal);
1605 1606 1607
		}
	}

1608 1609
	/*
	 * Change STA power saving mode only at the end of a frame
1610 1611
	 * exchange sequence, and only for a data or management
	 * frame as specified in IEEE 802.11-2016 11.2.3.2
1612
	 */
1613
	if (!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS) &&
1614
	    !ieee80211_has_morefrags(hdr->frame_control) &&
1615 1616
	    (ieee80211_is_mgmt(hdr->frame_control) ||
	     ieee80211_is_data(hdr->frame_control)) &&
1617
	    !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
1618
	    (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1619
	     rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
J
Johannes Berg 已提交
1620
		if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
1621
			if (!ieee80211_has_pm(hdr->frame_control))
1622
				sta_ps_end(sta);
1623 1624
		} else {
			if (ieee80211_has_pm(hdr->frame_control))
1625
				sta_ps_start(sta);
1626
		}
1627 1628
	}

M
Marco Porsch 已提交
1629 1630 1631 1632
	/* mesh power save support */
	if (ieee80211_vif_is_mesh(&rx->sdata->vif))
		ieee80211_mps_rx_h_sta_process(sta, hdr);

1633 1634 1635 1636 1637 1638
	/*
	 * Drop (qos-)data::nullfunc frames silently, since they
	 * are used only to control station power saving mode.
	 */
	if (ieee80211_is_nullfunc(hdr->frame_control) ||
	    ieee80211_is_qos_nullfunc(hdr->frame_control)) {
1639
		I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
1640 1641 1642

		/*
		 * If we receive a 4-addr nullfunc frame from a STA
1643 1644 1645
		 * that was not moved to a 4-addr STA vlan yet send
		 * the event to userspace and for older hostapd drop
		 * the frame to the monitor interface.
1646 1647 1648 1649
		 */
		if (ieee80211_has_a4(hdr->frame_control) &&
		    (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
		     (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1650 1651 1652 1653 1654
		      !rx->sdata->u.vlan.sta))) {
			if (!test_and_set_sta_flag(sta, WLAN_STA_4ADDR_EVENT))
				cfg80211_rx_unexpected_4addr_frame(
					rx->sdata->dev, sta->sta.addr,
					GFP_ATOMIC);
1655
			return RX_DROP_MONITOR;
1656
		}
1657 1658 1659 1660
		/*
		 * Update counter and free packet here to avoid
		 * counting this as a dropped packed.
		 */
1661
		sta->rx_stats.packets++;
1662
		dev_kfree_skb(rx->skb);
1663
		return RX_QUEUED;
1664 1665
	}

1666
	return RX_CONTINUE;
1667 1668
} /* ieee80211_rx_h_sta_process */

1669 1670 1671 1672 1673 1674 1675 1676 1677 1678 1679 1680
static ieee80211_rx_result debug_noinline
ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
{
	struct sk_buff *skb = rx->skb;
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
	int keyidx;
	int hdrlen;
	ieee80211_rx_result result = RX_DROP_UNUSABLE;
	struct ieee80211_key *sta_ptk = NULL;
	int mmie_keyidx = -1;
	__le16 fc;
1681
	const struct ieee80211_cipher_scheme *cs = NULL;
1682 1683 1684 1685 1686 1687 1688 1689 1690 1691 1692 1693 1694 1695 1696 1697 1698 1699 1700 1701 1702 1703 1704 1705 1706 1707 1708 1709 1710 1711

	/*
	 * Key selection 101
	 *
	 * There are four types of keys:
	 *  - GTK (group keys)
	 *  - IGTK (group keys for management frames)
	 *  - PTK (pairwise keys)
	 *  - STK (station-to-station pairwise keys)
	 *
	 * When selecting a key, we have to distinguish between multicast
	 * (including broadcast) and unicast frames, the latter can only
	 * use PTKs and STKs while the former always use GTKs and IGTKs.
	 * Unless, of course, actual WEP keys ("pre-RSNA") are used, then
	 * unicast frames can also use key indices like GTKs. Hence, if we
	 * don't have a PTK/STK we check the key index for a WEP key.
	 *
	 * Note that in a regular BSS, multicast frames are sent by the
	 * AP only, associated stations unicast the frame to the AP first
	 * which then multicasts it on their behalf.
	 *
	 * There is also a slight problem in IBSS mode: GTKs are negotiated
	 * with each station, that is something we don't currently handle.
	 * The spec seems to expect that one negotiates the same key with
	 * every station but there's no such requirement; VLANs could be
	 * possible.
	 */

	/* start without a key */
	rx->key = NULL;
1712
	fc = hdr->frame_control;
1713

1714 1715
	if (rx->sta) {
		int keyid = rx->sta->ptk_idx;
1716

1717 1718
		if (ieee80211_has_protected(fc) && rx->sta->cipher_scheme) {
			cs = rx->sta->cipher_scheme;
1719
			keyid = ieee80211_get_cs_keyid(cs, rx->skb);
1720 1721 1722 1723 1724
			if (unlikely(keyid < 0))
				return RX_DROP_UNUSABLE;
		}
		sta_ptk = rcu_dereference(rx->sta->ptk[keyid]);
	}
1725 1726 1727 1728 1729 1730 1731 1732 1733 1734 1735 1736 1737 1738 1739 1740 1741 1742 1743 1744 1745

	if (!ieee80211_has_protected(fc))
		mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);

	if (!is_multicast_ether_addr(hdr->addr1) && sta_ptk) {
		rx->key = sta_ptk;
		if ((status->flag & RX_FLAG_DECRYPTED) &&
		    (status->flag & RX_FLAG_IV_STRIPPED))
			return RX_CONTINUE;
		/* Skip decryption if the frame is not protected. */
		if (!ieee80211_has_protected(fc))
			return RX_CONTINUE;
	} else if (mmie_keyidx >= 0) {
		/* Broadcast/multicast robust management frame / BIP */
		if ((status->flag & RX_FLAG_DECRYPTED) &&
		    (status->flag & RX_FLAG_IV_STRIPPED))
			return RX_CONTINUE;

		if (mmie_keyidx < NUM_DEFAULT_KEYS ||
		    mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
			return RX_DROP_MONITOR; /* unexpected BIP keyidx */
1746 1747 1748 1749 1750
		if (rx->sta) {
			if (ieee80211_is_group_privacy_action(skb) &&
			    test_sta_flag(rx->sta, WLAN_STA_MFP))
				return RX_DROP_MONITOR;

1751
			rx->key = rcu_dereference(rx->sta->gtk[mmie_keyidx]);
1752
		}
1753 1754 1755 1756 1757 1758 1759 1760 1761 1762 1763 1764 1765 1766 1767 1768 1769 1770 1771 1772 1773 1774 1775 1776 1777 1778 1779 1780 1781 1782 1783 1784 1785 1786 1787 1788 1789 1790
		if (!rx->key)
			rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]);
	} else if (!ieee80211_has_protected(fc)) {
		/*
		 * The frame was not protected, so skip decryption. However, we
		 * need to set rx->key if there is a key that could have been
		 * used so that the frame may be dropped if encryption would
		 * have been expected.
		 */
		struct ieee80211_key *key = NULL;
		struct ieee80211_sub_if_data *sdata = rx->sdata;
		int i;

		if (ieee80211_is_mgmt(fc) &&
		    is_multicast_ether_addr(hdr->addr1) &&
		    (key = rcu_dereference(rx->sdata->default_mgmt_key)))
			rx->key = key;
		else {
			if (rx->sta) {
				for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
					key = rcu_dereference(rx->sta->gtk[i]);
					if (key)
						break;
				}
			}
			if (!key) {
				for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
					key = rcu_dereference(sdata->keys[i]);
					if (key)
						break;
				}
			}
			if (key)
				rx->key = key;
		}
		return RX_CONTINUE;
	} else {
		u8 keyid;
1791

1792 1793 1794 1795 1796 1797 1798 1799 1800 1801 1802 1803 1804 1805 1806
		/*
		 * The device doesn't give us the IV so we won't be
		 * able to look up the key. That's ok though, we
		 * don't need to decrypt the frame, we just won't
		 * be able to keep statistics accurate.
		 * Except for key threshold notifications, should
		 * we somehow allow the driver to tell us which key
		 * the hardware used if this flag is set?
		 */
		if ((status->flag & RX_FLAG_DECRYPTED) &&
		    (status->flag & RX_FLAG_IV_STRIPPED))
			return RX_CONTINUE;

		hdrlen = ieee80211_hdrlen(fc);

1807
		if (cs) {
1808
			keyidx = ieee80211_get_cs_keyid(cs, rx->skb);
1809

1810 1811 1812 1813 1814 1815 1816 1817 1818 1819 1820 1821
			if (unlikely(keyidx < 0))
				return RX_DROP_UNUSABLE;
		} else {
			if (rx->skb->len < 8 + hdrlen)
				return RX_DROP_UNUSABLE; /* TODO: count this? */
			/*
			 * no need to call ieee80211_wep_get_keyidx,
			 * it verifies a bunch of things we've done already
			 */
			skb_copy_bits(rx->skb, hdrlen + 3, &keyid, 1);
			keyidx = keyid >> 6;
		}
1822 1823 1824 1825 1826 1827 1828 1829 1830 1831 1832 1833 1834 1835 1836 1837 1838 1839 1840 1841 1842 1843 1844 1845 1846 1847 1848 1849 1850 1851 1852 1853 1854 1855 1856 1857 1858 1859 1860 1861

		/* check per-station GTK first, if multicast packet */
		if (is_multicast_ether_addr(hdr->addr1) && rx->sta)
			rx->key = rcu_dereference(rx->sta->gtk[keyidx]);

		/* if not found, try default key */
		if (!rx->key) {
			rx->key = rcu_dereference(rx->sdata->keys[keyidx]);

			/*
			 * RSNA-protected unicast frames should always be
			 * sent with pairwise or station-to-station keys,
			 * but for WEP we allow using a key index as well.
			 */
			if (rx->key &&
			    rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 &&
			    rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 &&
			    !is_multicast_ether_addr(hdr->addr1))
				rx->key = NULL;
		}
	}

	if (rx->key) {
		if (unlikely(rx->key->flags & KEY_FLAG_TAINTED))
			return RX_DROP_MONITOR;

		/* TODO: add threshold stuff again */
	} else {
		return RX_DROP_MONITOR;
	}

	switch (rx->key->conf.cipher) {
	case WLAN_CIPHER_SUITE_WEP40:
	case WLAN_CIPHER_SUITE_WEP104:
		result = ieee80211_crypto_wep_decrypt(rx);
		break;
	case WLAN_CIPHER_SUITE_TKIP:
		result = ieee80211_crypto_tkip_decrypt(rx);
		break;
	case WLAN_CIPHER_SUITE_CCMP:
J
Jouni Malinen 已提交
1862 1863 1864 1865 1866 1867
		result = ieee80211_crypto_ccmp_decrypt(
			rx, IEEE80211_CCMP_MIC_LEN);
		break;
	case WLAN_CIPHER_SUITE_CCMP_256:
		result = ieee80211_crypto_ccmp_decrypt(
			rx, IEEE80211_CCMP_256_MIC_LEN);
1868 1869 1870 1871
		break;
	case WLAN_CIPHER_SUITE_AES_CMAC:
		result = ieee80211_crypto_aes_cmac_decrypt(rx);
		break;
1872 1873 1874
	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
		result = ieee80211_crypto_aes_cmac_256_decrypt(rx);
		break;
1875 1876 1877 1878
	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
		result = ieee80211_crypto_aes_gmac_decrypt(rx);
		break;
1879 1880 1881 1882
	case WLAN_CIPHER_SUITE_GCMP:
	case WLAN_CIPHER_SUITE_GCMP_256:
		result = ieee80211_crypto_gcmp_decrypt(rx);
		break;
1883
	default:
1884
		result = ieee80211_crypto_hw_decrypt(rx);
1885 1886 1887 1888 1889 1890 1891 1892 1893 1894
	}

	/* the hdr variable is invalid after the decrypt handlers */

	/* either the frame has been decrypted or will be dropped */
	status->flag |= RX_FLAG_DECRYPTED;

	return result;
}

1895 1896 1897 1898 1899 1900 1901 1902 1903 1904 1905
static inline struct ieee80211_fragment_entry *
ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
			 unsigned int frag, unsigned int seq, int rx_queue,
			 struct sk_buff **skb)
{
	struct ieee80211_fragment_entry *entry;

	entry = &sdata->fragments[sdata->fragment_next++];
	if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
		sdata->fragment_next = 0;

J
Johannes Berg 已提交
1906
	if (!skb_queue_empty(&entry->skb_list))
1907 1908 1909 1910 1911 1912 1913 1914
		__skb_queue_purge(&entry->skb_list);

	__skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
	*skb = NULL;
	entry->first_frag_time = jiffies;
	entry->seq = seq;
	entry->rx_queue = rx_queue;
	entry->last_frag = frag;
1915
	entry->check_sequential_pn = false;
1916 1917 1918 1919 1920 1921 1922
	entry->extra_len = 0;

	return entry;
}

static inline struct ieee80211_fragment_entry *
ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
1923
			  unsigned int frag, unsigned int seq,
1924 1925 1926 1927 1928 1929 1930 1931 1932 1933 1934 1935 1936 1937 1938 1939 1940 1941 1942
			  int rx_queue, struct ieee80211_hdr *hdr)
{
	struct ieee80211_fragment_entry *entry;
	int i, idx;

	idx = sdata->fragment_next;
	for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
		struct ieee80211_hdr *f_hdr;

		idx--;
		if (idx < 0)
			idx = IEEE80211_FRAGMENT_MAX - 1;

		entry = &sdata->fragments[idx];
		if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
		    entry->rx_queue != rx_queue ||
		    entry->last_frag + 1 != frag)
			continue;

1943
		f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data;
1944

1945 1946 1947 1948 1949
		/*
		 * Check ftype and addresses are equal, else check next fragment
		 */
		if (((hdr->frame_control ^ f_hdr->frame_control) &
		     cpu_to_le16(IEEE80211_FCTL_FTYPE)) ||
1950 1951
		    !ether_addr_equal(hdr->addr1, f_hdr->addr1) ||
		    !ether_addr_equal(hdr->addr2, f_hdr->addr2))
1952 1953
			continue;

1954
		if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
1955 1956 1957 1958 1959 1960 1961 1962 1963
			__skb_queue_purge(&entry->skb_list);
			continue;
		}
		return entry;
	}

	return NULL;
}

1964
static ieee80211_rx_result debug_noinline
1965
ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
1966 1967 1968
{
	struct ieee80211_hdr *hdr;
	u16 sc;
1969
	__le16 fc;
1970 1971 1972 1973
	unsigned int frag, seq;
	struct ieee80211_fragment_entry *entry;
	struct sk_buff *skb;

1974
	hdr = (struct ieee80211_hdr *)rx->skb->data;
1975
	fc = hdr->frame_control;
1976 1977 1978 1979

	if (ieee80211_is_ctl(fc))
		return RX_CONTINUE;

1980 1981 1982
	sc = le16_to_cpu(hdr->seq_ctrl);
	frag = sc & IEEE80211_SCTL_FRAG;

1983
	if (is_multicast_ether_addr(hdr->addr1)) {
1984
		I802_DEBUG_INC(rx->local->dot11MulticastReceivedFrameCount);
1985
		goto out_no_led;
1986
	}
1987

1988 1989 1990
	if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
		goto out;

1991 1992
	I802_DEBUG_INC(rx->local->rx_handlers_fragments);

Z
Zhu Yi 已提交
1993 1994 1995
	if (skb_linearize(rx->skb))
		return RX_DROP_UNUSABLE;

1996 1997 1998 1999 2000 2001
	/*
	 *  skb_linearize() might change the skb->data and
	 *  previously cached variables (in this case, hdr) need to
	 *  be refreshed with the new data.
	 */
	hdr = (struct ieee80211_hdr *)rx->skb->data;
2002 2003 2004 2005 2006
	seq = (sc & IEEE80211_SCTL_SEQ) >> 4;

	if (frag == 0) {
		/* This is the first fragment of a new frame. */
		entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
2007
						 rx->seqno_idx, &(rx->skb));
J
Jouni Malinen 已提交
2008 2009
		if (rx->key &&
		    (rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP ||
2010 2011 2012
		     rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP_256 ||
		     rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP ||
		     rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP_256) &&
2013
		    ieee80211_has_protected(fc)) {
2014
			int queue = rx->security_idx;
2015 2016 2017 2018 2019

			/* Store CCMP/GCMP PN so that we can verify that the
			 * next fragment has a sequential PN value.
			 */
			entry->check_sequential_pn = true;
2020
			memcpy(entry->last_pn,
2021
			       rx->key->u.ccmp.rx_pn[queue],
2022
			       IEEE80211_CCMP_PN_LEN);
2023 2024 2025 2026 2027 2028 2029 2030
			BUILD_BUG_ON(offsetof(struct ieee80211_key,
					      u.ccmp.rx_pn) !=
				     offsetof(struct ieee80211_key,
					      u.gcmp.rx_pn));
			BUILD_BUG_ON(sizeof(rx->key->u.ccmp.rx_pn[queue]) !=
				     sizeof(rx->key->u.gcmp.rx_pn[queue]));
			BUILD_BUG_ON(IEEE80211_CCMP_PN_LEN !=
				     IEEE80211_GCMP_PN_LEN);
2031
		}
2032
		return RX_QUEUED;
2033 2034 2035 2036 2037
	}

	/* This is a fragment for a frame that should already be pending in
	 * fragment cache. Add this fragment to the end of the pending entry.
	 */
2038 2039
	entry = ieee80211_reassemble_find(rx->sdata, frag, seq,
					  rx->seqno_idx, hdr);
2040 2041
	if (!entry) {
		I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
J
Johannes Berg 已提交
2042
		return RX_DROP_MONITOR;
2043 2044
	}

2045 2046 2047 2048 2049 2050
	/* "The receiver shall discard MSDUs and MMPDUs whose constituent
	 *  MPDU PN values are not incrementing in steps of 1."
	 * see IEEE P802.11-REVmc/D5.0, 12.5.3.4.4, item d (for CCMP)
	 * and IEEE P802.11-REVmc/D5.0, 12.5.5.4.4, item d (for GCMP)
	 */
	if (entry->check_sequential_pn) {
2051
		int i;
2052
		u8 pn[IEEE80211_CCMP_PN_LEN], *rpn;
2053
		int queue;
2054

J
Jouni Malinen 已提交
2055 2056
		if (!rx->key ||
		    (rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP &&
2057 2058 2059
		     rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP_256 &&
		     rx->key->conf.cipher != WLAN_CIPHER_SUITE_GCMP &&
		     rx->key->conf.cipher != WLAN_CIPHER_SUITE_GCMP_256))
J
Johannes Berg 已提交
2060
			return RX_DROP_UNUSABLE;
2061 2062
		memcpy(pn, entry->last_pn, IEEE80211_CCMP_PN_LEN);
		for (i = IEEE80211_CCMP_PN_LEN - 1; i >= 0; i--) {
2063 2064 2065 2066
			pn[i]++;
			if (pn[i])
				break;
		}
2067
		queue = rx->security_idx;
2068
		rpn = rx->key->u.ccmp.rx_pn[queue];
2069
		if (memcmp(pn, rpn, IEEE80211_CCMP_PN_LEN))
J
Johannes Berg 已提交
2070
			return RX_DROP_UNUSABLE;
2071
		memcpy(entry->last_pn, pn, IEEE80211_CCMP_PN_LEN);
2072 2073
	}

2074
	skb_pull(rx->skb, ieee80211_hdrlen(fc));
2075 2076 2077
	__skb_queue_tail(&entry->skb_list, rx->skb);
	entry->last_frag = frag;
	entry->extra_len += rx->skb->len;
2078
	if (ieee80211_has_morefrags(fc)) {
2079
		rx->skb = NULL;
2080
		return RX_QUEUED;
2081 2082 2083 2084
	}

	rx->skb = __skb_dequeue(&entry->skb_list);
	if (skb_tailroom(rx->skb) < entry->extra_len) {
2085
		I802_DEBUG_INC(rx->local->rx_expand_skb_head_defrag);
2086 2087 2088 2089
		if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
					      GFP_ATOMIC))) {
			I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
			__skb_queue_purge(&entry->skb_list);
J
Johannes Berg 已提交
2090
			return RX_DROP_UNUSABLE;
2091 2092 2093
		}
	}
	while ((skb = __skb_dequeue(&entry->skb_list))) {
2094
		skb_put_data(rx->skb, skb->data, skb->len);
2095 2096 2097 2098
		dev_kfree_skb(skb);
	}

 out:
2099 2100
	ieee80211_led_rx(rx->local);
 out_no_led:
2101
	if (rx->sta)
2102
		rx->sta->rx_stats.packets++;
2103
	return RX_CONTINUE;
2104 2105
}

J
Johannes Berg 已提交
2106
static int ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
2107
{
J
Johannes Berg 已提交
2108
	if (unlikely(!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_AUTHORIZED)))
2109
		return -EACCES;
2110

2111
	return 0;
2112 2113
}

J
Johannes Berg 已提交
2114
static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
2115
{
J
Johannes Berg 已提交
2116 2117 2118
	struct sk_buff *skb = rx->skb;
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);

2119
	/*
2120 2121
	 * Pass through unencrypted frames if the hardware has
	 * decrypted them already.
2122
	 */
J
Johannes Berg 已提交
2123
	if (status->flag & RX_FLAG_DECRYPTED)
2124
		return 0;
2125 2126

	/* Drop unencrypted frames if key is set. */
2127 2128
	if (unlikely(!ieee80211_has_protected(fc) &&
		     !ieee80211_is_nullfunc(fc) &&
2129
		     ieee80211_is_data(fc) && rx->key))
2130
		return -EACCES;
2131 2132 2133 2134

	return 0;
}

J
Johannes Berg 已提交
2135
static int ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)
2136 2137
{
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
2138
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2139 2140
	__le16 fc = hdr->frame_control;

2141 2142 2143 2144 2145 2146
	/*
	 * Pass through unencrypted frames if the hardware has
	 * decrypted them already.
	 */
	if (status->flag & RX_FLAG_DECRYPTED)
		return 0;
2147

J
Johannes Berg 已提交
2148
	if (rx->sta && test_sta_flag(rx->sta, WLAN_STA_MFP)) {
2149 2150
		if (unlikely(!ieee80211_has_protected(fc) &&
			     ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
2151
			     rx->key)) {
2152 2153 2154 2155 2156
			if (ieee80211_is_deauth(fc) ||
			    ieee80211_is_disassoc(fc))
				cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
							     rx->skb->data,
							     rx->skb->len);
2157
			return -EACCES;
2158
		}
2159
		/* BIP does not use Protected field, so need to check MMIE */
2160
		if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
2161
			     ieee80211_get_mmie_keyidx(rx->skb) < 0)) {
2162 2163 2164 2165 2166
			if (ieee80211_is_deauth(fc) ||
			    ieee80211_is_disassoc(fc))
				cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
							     rx->skb->data,
							     rx->skb->len);
2167
			return -EACCES;
2168
		}
2169 2170 2171 2172 2173
		/*
		 * When using MFP, Action frames are not allowed prior to
		 * having configured keys.
		 */
		if (unlikely(ieee80211_is_action(fc) && !rx->key &&
2174
			     ieee80211_is_robust_mgmt_frame(rx->skb)))
2175 2176
			return -EACCES;
	}
2177

2178
	return 0;
2179 2180
}

2181
static int
2182
__ieee80211_data_to_8023(struct ieee80211_rx_data *rx, bool *port_control)
2183
{
J
Johannes Berg 已提交
2184
	struct ieee80211_sub_if_data *sdata = rx->sdata;
2185
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
2186 2187 2188
	bool check_port_control = false;
	struct ethhdr *ehdr;
	int ret;
2189

2190
	*port_control = false;
2191 2192
	if (ieee80211_has_a4(hdr->frame_control) &&
	    sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta)
2193
		return -1;
2194

2195 2196 2197 2198 2199 2200 2201 2202 2203
	if (sdata->vif.type == NL80211_IFTYPE_STATION &&
	    !!sdata->u.mgd.use_4addr != !!ieee80211_has_a4(hdr->frame_control)) {

		if (!sdata->u.mgd.use_4addr)
			return -1;
		else
			check_port_control = true;
	}

2204
	if (is_multicast_ether_addr(hdr->addr1) &&
2205
	    sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta)
2206
		return -1;
2207

2208
	ret = ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type);
2209
	if (ret < 0)
2210 2211 2212
		return ret;

	ehdr = (struct ethhdr *) rx->skb->data;
2213 2214 2215
	if (ehdr->h_proto == rx->sdata->control_port_protocol)
		*port_control = true;
	else if (check_port_control)
2216 2217 2218
		return -1;

	return 0;
2219
}
2220

2221 2222 2223
/*
 * requires that rx->skb is a frame with ethernet header
 */
2224
static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
2225
{
2226
	static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
2227 2228 2229 2230 2231 2232 2233
		= { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
	struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;

	/*
	 * Allow EAPOL frames to us/the PAE group address regardless
	 * of whether the frame was encrypted or not.
	 */
2234
	if (ehdr->h_proto == rx->sdata->control_port_protocol &&
2235 2236
	    (ether_addr_equal(ehdr->h_dest, rx->sdata->vif.addr) ||
	     ether_addr_equal(ehdr->h_dest, pae_group_addr)))
2237 2238 2239
		return true;

	if (ieee80211_802_1x_port_control(rx) ||
2240
	    ieee80211_drop_unencrypted(rx, fc))
2241 2242 2243 2244 2245 2246 2247 2248
		return false;

	return true;
}

/*
 * requires that rx->skb is a frame with ethernet header
 */
2249
static void
2250
ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
2251
{
J
Johannes Berg 已提交
2252 2253
	struct ieee80211_sub_if_data *sdata = rx->sdata;
	struct net_device *dev = sdata->dev;
2254
	struct sk_buff *skb, *xmit_skb;
2255 2256
	struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
	struct sta_info *dsta;
2257

2258 2259
	skb = rx->skb;
	xmit_skb = NULL;
2260

2261 2262
	ieee80211_rx_stats(dev, skb->len);

2263 2264 2265 2266 2267 2268
	if (rx->sta) {
		/* The seqno index has the same property as needed
		 * for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS
		 * for non-QoS-data frames. Here we know it's a data
		 * frame, so count MSDUs.
		 */
2269
		u64_stats_update_begin(&rx->sta->rx_stats.syncp);
2270
		rx->sta->rx_stats.msdu[rx->seqno_idx]++;
2271
		u64_stats_update_end(&rx->sta->rx_stats.syncp);
2272 2273
	}

2274 2275
	if ((sdata->vif.type == NL80211_IFTYPE_AP ||
	     sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
2276
	    !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
2277
	    (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) {
2278 2279
		if (is_multicast_ether_addr(ehdr->h_dest) &&
		    ieee80211_vif_get_num_mcast_if(sdata) != 0) {
2280 2281 2282 2283
			/*
			 * send multicast frames both to higher layers in
			 * local net stack and back to the wireless medium
			 */
2284
			xmit_skb = skb_copy(skb, GFP_ATOMIC);
2285
			if (!xmit_skb)
J
Johannes Berg 已提交
2286
				net_info_ratelimited("%s: failed to clone multicast frame\n",
2287
						    dev->name);
2288
		} else if (!is_multicast_ether_addr(ehdr->h_dest)) {
2289 2290
			dsta = sta_info_get(sdata, skb->data);
			if (dsta) {
2291 2292 2293 2294 2295
				/*
				 * The destination station is associated to
				 * this AP (in this VLAN), so send the frame
				 * directly to it and do not pass it to local
				 * net stack.
2296
				 */
2297
				xmit_skb = skb;
2298 2299 2300 2301 2302
				skb = NULL;
			}
		}
	}

2303
#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
2304 2305 2306 2307 2308 2309
	if (skb) {
		/* 'align' will only take the values 0 or 2 here since all
		 * frames are required to be aligned to 2-byte boundaries
		 * when being passed to mac80211; the code here works just
		 * as well if that isn't true, but mac80211 assumes it can
		 * access fields as 2-byte aligned (e.g. for ether_addr_equal)
2310
		 */
2311 2312 2313
		int align;

		align = (unsigned long)(skb->data + sizeof(struct ethhdr)) & 3;
2314 2315 2316 2317 2318 2319
		if (align) {
			if (WARN_ON(skb_headroom(skb) < 3)) {
				dev_kfree_skb(skb);
				skb = NULL;
			} else {
				u8 *data = skb->data;
2320 2321 2322 2323
				size_t len = skb_headlen(skb);
				skb->data -= align;
				memmove(skb->data, data, len);
				skb_set_tail_pointer(skb, len);
2324 2325
			}
		}
2326
	}
2327 2328
#endif

2329 2330 2331 2332
	if (skb) {
		/* deliver to local stack */
		skb->protocol = eth_type_trans(skb, dev);
		memset(skb->cb, 0, sizeof(skb->cb));
2333 2334
		if (rx->napi)
			napi_gro_receive(rx->napi, skb);
J
Johannes Berg 已提交
2335 2336
		else
			netif_receive_skb(skb);
2337 2338
	}

2339
	if (xmit_skb) {
2340 2341 2342 2343 2344 2345
		/*
		 * Send to wireless media and increase priority by 256 to
		 * keep the received priority instead of reclassifying
		 * the frame (see cfg80211_classify8021d).
		 */
		xmit_skb->priority += 256;
2346
		xmit_skb->protocol = htons(ETH_P_802_3);
2347 2348
		skb_reset_network_header(xmit_skb);
		skb_reset_mac_header(xmit_skb);
2349
		dev_queue_xmit(xmit_skb);
2350
	}
2351 2352
}

2353
static ieee80211_rx_result debug_noinline
2354
ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
2355
{
J
Johannes Berg 已提交
2356
	struct net_device *dev = rx->sdata->dev;
Z
Zhu Yi 已提交
2357
	struct sk_buff *skb = rx->skb;
2358 2359
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
	__le16 fc = hdr->frame_control;
Z
Zhu Yi 已提交
2360
	struct sk_buff_head frame_list;
2361
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2362
	struct ethhdr ethhdr;
2363
	const u8 *check_da = ethhdr.h_dest, *check_sa = ethhdr.h_source;
2364

2365
	if (unlikely(!ieee80211_is_data(fc)))
2366
		return RX_CONTINUE;
2367

2368
	if (unlikely(!ieee80211_is_data_present(fc)))
J
Johannes Berg 已提交
2369
		return RX_DROP_MONITOR;
2370

2371
	if (!(status->rx_flags & IEEE80211_RX_AMSDU))
2372
		return RX_CONTINUE;
2373

2374 2375 2376 2377 2378 2379 2380 2381 2382 2383 2384 2385 2386
	if (unlikely(ieee80211_has_a4(hdr->frame_control))) {
		switch (rx->sdata->vif.type) {
		case NL80211_IFTYPE_AP_VLAN:
			if (!rx->sdata->u.vlan.sta)
				return RX_DROP_UNUSABLE;
			break;
		case NL80211_IFTYPE_STATION:
			if (!rx->sdata->u.mgd.use_4addr)
				return RX_DROP_UNUSABLE;
			break;
		default:
			return RX_DROP_UNUSABLE;
		}
2387 2388 2389 2390 2391 2392 2393 2394 2395 2396 2397 2398 2399 2400 2401 2402 2403
		check_da = NULL;
		check_sa = NULL;
	} else switch (rx->sdata->vif.type) {
		case NL80211_IFTYPE_AP:
		case NL80211_IFTYPE_AP_VLAN:
			check_da = NULL;
			break;
		case NL80211_IFTYPE_STATION:
			if (!rx->sta ||
			    !test_sta_flag(rx->sta, WLAN_STA_TDLS_PEER))
				check_sa = NULL;
			break;
		case NL80211_IFTYPE_MESH_POINT:
			check_sa = NULL;
			break;
		default:
			break;
2404
	}
2405

2406
	if (is_multicast_ether_addr(hdr->addr1))
J
Johannes Berg 已提交
2407
		return RX_DROP_UNUSABLE;
2408

Z
Zhu Yi 已提交
2409 2410
	skb->dev = dev;
	__skb_queue_head_init(&frame_list);
2411

2412 2413 2414 2415 2416
	if (ieee80211_data_to_8023_exthdr(skb, &ethhdr,
					  rx->sdata->vif.addr,
					  rx->sdata->vif.type))
		return RX_DROP_UNUSABLE;

Z
Zhu Yi 已提交
2417 2418
	ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
				 rx->sdata->vif.type,
2419
				 rx->local->hw.extra_tx_headroom,
2420
				 check_da, check_sa);
2421

Z
Zhu Yi 已提交
2422 2423
	while (!skb_queue_empty(&frame_list)) {
		rx->skb = __skb_dequeue(&frame_list);
2424

2425
		if (!ieee80211_frame_allowed(rx, fc)) {
Z
Zhu Yi 已提交
2426
			dev_kfree_skb(rx->skb);
2427 2428
			continue;
		}
2429 2430 2431 2432

		ieee80211_deliver_skb(rx);
	}

2433
	return RX_QUEUED;
2434 2435
}

I
Ingo Molnar 已提交
2436
#ifdef CONFIG_MAC80211_MESH
2437
static ieee80211_rx_result
2438 2439
ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
{
2440 2441
	struct ieee80211_hdr *fwd_hdr, *hdr;
	struct ieee80211_tx_info *info;
2442 2443
	struct ieee80211s_hdr *mesh_hdr;
	struct sk_buff *skb = rx->skb, *fwd_skb;
J
Johannes Berg 已提交
2444
	struct ieee80211_local *local = rx->local;
J
Johannes Berg 已提交
2445
	struct ieee80211_sub_if_data *sdata = rx->sdata;
2446
	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
2447
	u16 ac, q, hdrlen;
2448 2449 2450

	hdr = (struct ieee80211_hdr *) skb->data;
	hdrlen = ieee80211_hdrlen(hdr->frame_control);
2451 2452 2453 2454 2455 2456 2457 2458 2459 2460 2461 2462 2463 2464

	/* make sure fixed part of mesh header is there, also checks skb len */
	if (!pskb_may_pull(rx->skb, hdrlen + 6))
		return RX_DROP_MONITOR;

	mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);

	/* make sure full mesh header is there, also checks skb len */
	if (!pskb_may_pull(rx->skb,
			   hdrlen + ieee80211_get_mesh_hdrlen(mesh_hdr)))
		return RX_DROP_MONITOR;

	/* reload pointers */
	hdr = (struct ieee80211_hdr *) skb->data;
2465 2466
	mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);

2467 2468 2469
	if (ieee80211_drop_unencrypted(rx, hdr->frame_control))
		return RX_DROP_MONITOR;

2470 2471 2472
	/* frame is in RMC, don't forward */
	if (ieee80211_is_data(hdr->frame_control) &&
	    is_multicast_ether_addr(hdr->addr1) &&
J
Johannes Berg 已提交
2473
	    mesh_rmc_check(rx->sdata, hdr->addr3, mesh_hdr))
2474 2475
		return RX_DROP_MONITOR;

2476
	if (!ieee80211_is_data(hdr->frame_control))
2477 2478 2479 2480 2481
		return RX_CONTINUE;

	if (!mesh_hdr->ttl)
		return RX_DROP_MONITOR;

2482
	if (mesh_hdr->flags & MESH_FLAGS_AE) {
2483
		struct mesh_path *mppath;
2484 2485 2486 2487 2488 2489
		char *proxied_addr;
		char *mpp_addr;

		if (is_multicast_ether_addr(hdr->addr1)) {
			mpp_addr = hdr->addr3;
			proxied_addr = mesh_hdr->eaddr1;
2490 2491
		} else if ((mesh_hdr->flags & MESH_FLAGS_AE) ==
			    MESH_FLAGS_AE_A5_A6) {
2492
			/* has_a4 already checked in ieee80211_rx_mesh_check */
2493 2494
			mpp_addr = hdr->addr4;
			proxied_addr = mesh_hdr->eaddr2;
2495 2496
		} else {
			return RX_DROP_MONITOR;
2497
		}
2498 2499

		rcu_read_lock();
J
Johannes Berg 已提交
2500
		mppath = mpp_path_lookup(sdata, proxied_addr);
2501
		if (!mppath) {
J
Johannes Berg 已提交
2502
			mpp_path_add(sdata, proxied_addr, mpp_addr);
2503 2504
		} else {
			spin_lock_bh(&mppath->state_lock);
2505
			if (!ether_addr_equal(mppath->mpp, mpp_addr))
2506
				memcpy(mppath->mpp, mpp_addr, ETH_ALEN);
2507
			mppath->exp_time = jiffies;
2508 2509 2510 2511 2512
			spin_unlock_bh(&mppath->state_lock);
		}
		rcu_read_unlock();
	}

2513 2514
	/* Frame has reached destination.  Don't forward */
	if (!is_multicast_ether_addr(hdr->addr1) &&
2515
	    ether_addr_equal(sdata->vif.addr, hdr->addr3))
2516 2517
		return RX_CONTINUE;

2518 2519
	ac = ieee80211_select_queue_80211(sdata, skb, hdr);
	q = sdata->vif.hw_queue[ac];
2520
	if (ieee80211_queue_stopped(&local->hw, q)) {
2521
		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion);
2522 2523 2524
		return RX_DROP_MONITOR;
	}
	skb_set_queue_mapping(skb, q);
2525

2526 2527
	if (!--mesh_hdr->ttl) {
		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl);
2528
		goto out;
2529 2530
	}

2531 2532 2533
	if (!ifmsh->mshcfg.dot11MeshForwarding)
		goto out;

2534 2535
	fwd_skb = skb_copy_expand(skb, local->tx_headroom +
				       sdata->encrypt_headroom, 0, GFP_ATOMIC);
2536
	if (!fwd_skb) {
J
Johannes Berg 已提交
2537
		net_info_ratelimited("%s: failed to clone mesh frame\n",
2538
				    sdata->name);
2539 2540 2541 2542
		goto out;
	}

	fwd_hdr =  (struct ieee80211_hdr *) fwd_skb->data;
2543
	fwd_hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_RETRY);
2544 2545 2546 2547 2548 2549 2550 2551
	info = IEEE80211_SKB_CB(fwd_skb);
	memset(info, 0, sizeof(*info));
	info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
	info->control.vif = &rx->sdata->vif;
	info->control.jiffies = jiffies;
	if (is_multicast_ether_addr(fwd_hdr->addr1)) {
		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_mcast);
		memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
M
Marco Porsch 已提交
2552 2553
		/* update power mode indication when forwarding */
		ieee80211_mps_set_frame_flags(sdata, NULL, fwd_hdr);
J
Johannes Berg 已提交
2554
	} else if (!mesh_nexthop_lookup(sdata, fwd_skb)) {
M
Marco Porsch 已提交
2555
		/* mesh power mode flags updated in mesh_nexthop_lookup */
2556 2557 2558
		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast);
	} else {
		/* unable to resolve next hop */
J
Johannes Berg 已提交
2559
		mesh_path_error_tx(sdata, ifmsh->mshcfg.element_ttl,
2560 2561 2562
				   fwd_hdr->addr3, 0,
				   WLAN_REASON_MESH_PATH_NOFORWARD,
				   fwd_hdr->addr2);
2563
		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_no_route);
2564
		kfree_skb(fwd_skb);
2565
		return RX_DROP_MONITOR;
2566 2567
	}

2568 2569
	IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
	ieee80211_add_pending_skb(local, fwd_skb);
J
Johannes Berg 已提交
2570
 out:
2571
	if (is_multicast_ether_addr(hdr->addr1))
2572
		return RX_CONTINUE;
2573
	return RX_DROP_MONITOR;
2574
}
I
Ingo Molnar 已提交
2575
#endif
2576

2577
static ieee80211_rx_result debug_noinline
2578
ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
2579
{
J
Johannes Berg 已提交
2580
	struct ieee80211_sub_if_data *sdata = rx->sdata;
2581
	struct ieee80211_local *local = rx->local;
J
Johannes Berg 已提交
2582
	struct net_device *dev = sdata->dev;
2583 2584
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
	__le16 fc = hdr->frame_control;
2585
	bool port_control;
2586
	int err;
2587

2588
	if (unlikely(!ieee80211_is_data(hdr->frame_control)))
2589
		return RX_CONTINUE;
2590

2591
	if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
J
Johannes Berg 已提交
2592
		return RX_DROP_MONITOR;
2593

2594
	/*
2595 2596
	 * Send unexpected-4addr-frame event to hostapd. For older versions,
	 * also drop the frame to cooked monitor interfaces.
2597 2598
	 */
	if (ieee80211_has_a4(hdr->frame_control) &&
2599 2600 2601 2602 2603
	    sdata->vif.type == NL80211_IFTYPE_AP) {
		if (rx->sta &&
		    !test_and_set_sta_flag(rx->sta, WLAN_STA_4ADDR_EVENT))
			cfg80211_rx_unexpected_4addr_frame(
				rx->sdata->dev, rx->sta->sta.addr, GFP_ATOMIC);
2604
		return RX_DROP_MONITOR;
2605
	}
2606

2607
	err = __ieee80211_data_to_8023(rx, &port_control);
2608
	if (unlikely(err))
J
Johannes Berg 已提交
2609
		return RX_DROP_UNUSABLE;
2610

2611
	if (!ieee80211_frame_allowed(rx, fc))
J
Johannes Berg 已提交
2612
		return RX_DROP_MONITOR;
2613

2614 2615 2616 2617 2618 2619 2620 2621 2622 2623 2624
	/* directly handle TDLS channel switch requests/responses */
	if (unlikely(((struct ethhdr *)rx->skb->data)->h_proto ==
						cpu_to_be16(ETH_P_TDLS))) {
		struct ieee80211_tdls_data *tf = (void *)rx->skb->data;

		if (pskb_may_pull(rx->skb,
				  offsetof(struct ieee80211_tdls_data, u)) &&
		    tf->payload_type == WLAN_TDLS_SNAP_RFTYPE &&
		    tf->category == WLAN_CATEGORY_TDLS &&
		    (tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_REQUEST ||
		     tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_RESPONSE)) {
2625 2626
			skb_queue_tail(&local->skb_queue_tdls_chsw, rx->skb);
			schedule_work(&local->tdls_chsw_work);
2627
			if (rx->sta)
2628
				rx->sta->rx_stats.packets++;
2629 2630 2631 2632 2633

			return RX_QUEUED;
		}
	}

2634 2635 2636 2637 2638 2639 2640 2641
	if (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
	    unlikely(port_control) && sdata->bss) {
		sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
				     u.ap);
		dev = sdata->dev;
		rx->sdata = sdata;
	}

2642 2643
	rx->skb->dev = dev;

2644 2645
	if (!ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS) &&
	    local->ps_sdata && local->hw.conf.dynamic_ps_timeout > 0 &&
2646 2647 2648
	    !is_multicast_ether_addr(
		    ((struct ethhdr *)rx->skb->data)->h_dest) &&
	    (!local->scanning &&
2649 2650 2651
	     !test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state)))
		mod_timer(&local->dynamic_ps_timer, jiffies +
			  msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
2652

2653
	ieee80211_deliver_skb(rx);
2654

2655
	return RX_QUEUED;
2656 2657
}

2658
static ieee80211_rx_result debug_noinline
2659
ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames)
2660 2661
{
	struct sk_buff *skb = rx->skb;
2662
	struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
2663 2664 2665 2666
	struct tid_ampdu_rx *tid_agg_rx;
	u16 start_seq_num;
	u16 tid;

2667
	if (likely(!ieee80211_is_ctl(bar->frame_control)))
2668
		return RX_CONTINUE;
2669

2670
	if (ieee80211_is_back_req(bar->frame_control)) {
2671 2672 2673
		struct {
			__le16 control, start_seq_num;
		} __packed bar_data;
2674 2675 2676
		struct ieee80211_event event = {
			.type = BAR_RX_EVENT,
		};
2677

2678
		if (!rx->sta)
2679
			return RX_DROP_MONITOR;
2680 2681 2682 2683 2684 2685

		if (skb_copy_bits(skb, offsetof(struct ieee80211_bar, control),
				  &bar_data, sizeof(bar_data)))
			return RX_DROP_MONITOR;

		tid = le16_to_cpu(bar_data.control) >> 12;
2686

2687 2688 2689 2690 2691 2692
		if (!test_bit(tid, rx->sta->ampdu_mlme.agg_session_valid) &&
		    !test_and_set_bit(tid, rx->sta->ampdu_mlme.unexpected_agg))
			ieee80211_send_delba(rx->sdata, rx->sta->sta.addr, tid,
					     WLAN_BACK_RECIPIENT,
					     WLAN_REASON_QSTA_REQUIRE_SETUP);

2693 2694
		tid_agg_rx = rcu_dereference(rx->sta->ampdu_mlme.tid_rx[tid]);
		if (!tid_agg_rx)
2695
			return RX_DROP_MONITOR;
2696

2697
		start_seq_num = le16_to_cpu(bar_data.start_seq_num) >> 4;
2698 2699 2700
		event.u.ba.tid = tid;
		event.u.ba.ssn = start_seq_num;
		event.u.ba.sta = &rx->sta->sta;
2701 2702

		/* reset session timer */
2703 2704 2705
		if (tid_agg_rx->timeout)
			mod_timer(&tid_agg_rx->session_timer,
				  TU_TO_EXP_TIME(tid_agg_rx->timeout));
2706

2707
		spin_lock(&tid_agg_rx->reorder_lock);
2708
		/* release stored frames up to start of BAR */
2709
		ieee80211_release_reorder_frames(rx->sdata, tid_agg_rx,
2710
						 start_seq_num, frames);
2711 2712
		spin_unlock(&tid_agg_rx->reorder_lock);

2713 2714
		drv_event_callback(rx->local, rx->sdata, &event);

2715 2716
		kfree_skb(skb);
		return RX_QUEUED;
2717 2718
	}

2719 2720 2721 2722 2723 2724
	/*
	 * After this point, we only want management frames,
	 * so we can drop all remaining control frames to
	 * cooked monitor interfaces.
	 */
	return RX_DROP_MONITOR;
2725 2726
}

2727 2728 2729
static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
					   struct ieee80211_mgmt *mgmt,
					   size_t len)
2730 2731 2732 2733 2734
{
	struct ieee80211_local *local = sdata->local;
	struct sk_buff *skb;
	struct ieee80211_mgmt *resp;

2735
	if (!ether_addr_equal(mgmt->da, sdata->vif.addr)) {
2736 2737 2738 2739
		/* Not to own unicast address */
		return;
	}

2740 2741
	if (!ether_addr_equal(mgmt->sa, sdata->u.mgd.bssid) ||
	    !ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid)) {
2742
		/* Not from the current AP or not associated yet. */
2743 2744 2745 2746 2747 2748 2749 2750 2751 2752 2753 2754 2755
		return;
	}

	if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) {
		/* Too short SA Query request frame */
		return;
	}

	skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom);
	if (skb == NULL)
		return;

	skb_reserve(skb, local->hw.extra_tx_headroom);
2756
	resp = skb_put_zero(skb, 24);
2757
	memcpy(resp->da, mgmt->sa, ETH_ALEN);
2758
	memcpy(resp->sa, sdata->vif.addr, ETH_ALEN);
2759
	memcpy(resp->bssid, sdata->u.mgd.bssid, ETH_ALEN);
2760 2761 2762 2763 2764 2765 2766 2767 2768
	resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
					  IEEE80211_STYPE_ACTION);
	skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query));
	resp->u.action.category = WLAN_CATEGORY_SA_QUERY;
	resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE;
	memcpy(resp->u.action.u.sa_query.trans_id,
	       mgmt->u.action.u.sa_query.trans_id,
	       WLAN_SA_QUERY_TR_ID_LEN);

2769
	ieee80211_tx_skb(sdata, skb);
2770 2771
}

2772 2773 2774 2775
static ieee80211_rx_result debug_noinline
ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx)
{
	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
2776
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2777 2778 2779 2780 2781 2782 2783 2784 2785 2786 2787 2788

	/*
	 * From here on, look only at management frames.
	 * Data and control frames are already handled,
	 * and unknown (reserved) frames are useless.
	 */
	if (rx->skb->len < 24)
		return RX_DROP_MONITOR;

	if (!ieee80211_is_mgmt(mgmt->frame_control))
		return RX_DROP_MONITOR;

J
Johannes Berg 已提交
2789 2790 2791
	if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
	    ieee80211_is_beacon(mgmt->frame_control) &&
	    !(rx->flags & IEEE80211_RX_BEACON_REPORTED)) {
2792 2793
		int sig = 0;

2794
		if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM))
2795 2796
			sig = status->signal;

J
Johannes Berg 已提交
2797 2798
		cfg80211_report_obss_beacon(rx->local->hw.wiphy,
					    rx->skb->data, rx->skb->len,
2799
					    status->freq, sig);
J
Johannes Berg 已提交
2800 2801 2802
		rx->flags |= IEEE80211_RX_BEACON_REPORTED;
	}

2803 2804 2805 2806 2807 2808
	if (ieee80211_drop_unencrypted_mgmt(rx))
		return RX_DROP_UNUSABLE;

	return RX_CONTINUE;
}

2809 2810 2811 2812
static ieee80211_rx_result debug_noinline
ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
{
	struct ieee80211_local *local = rx->local;
J
Johannes Berg 已提交
2813
	struct ieee80211_sub_if_data *sdata = rx->sdata;
2814
	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
2815
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2816 2817 2818 2819 2820
	int len = rx->skb->len;

	if (!ieee80211_is_action(mgmt->frame_control))
		return RX_CONTINUE;

2821 2822
	/* drop too small frames */
	if (len < IEEE80211_MIN_ACTION_SIZE)
2823
		return RX_DROP_UNUSABLE;
2824

2825
	if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC &&
2826 2827
	    mgmt->u.action.category != WLAN_CATEGORY_SELF_PROTECTED &&
	    mgmt->u.action.category != WLAN_CATEGORY_SPECTRUM_MGMT)
2828
		return RX_DROP_UNUSABLE;
2829 2830

	switch (mgmt->u.action.category) {
2831 2832 2833 2834 2835 2836 2837 2838 2839 2840 2841 2842
	case WLAN_CATEGORY_HT:
		/* reject HT action frames from stations not supporting HT */
		if (!rx->sta->sta.ht_cap.ht_supported)
			goto invalid;

		if (sdata->vif.type != NL80211_IFTYPE_STATION &&
		    sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
		    sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
		    sdata->vif.type != NL80211_IFTYPE_AP &&
		    sdata->vif.type != NL80211_IFTYPE_ADHOC)
			break;

2843
		/* verify action & smps_control/chanwidth are present */
2844 2845 2846 2847 2848 2849
		if (len < IEEE80211_MIN_ACTION_SIZE + 2)
			goto invalid;

		switch (mgmt->u.action.u.ht_smps.action) {
		case WLAN_HT_ACTION_SMPS: {
			struct ieee80211_supported_band *sband;
2850
			enum ieee80211_smps_mode smps_mode;
2851
			struct sta_opmode_info sta_opmode = {};
2852 2853 2854 2855

			/* convert to HT capability */
			switch (mgmt->u.action.u.ht_smps.smps_control) {
			case WLAN_HT_SMPS_CONTROL_DISABLED:
2856
				smps_mode = IEEE80211_SMPS_OFF;
2857 2858
				break;
			case WLAN_HT_SMPS_CONTROL_STATIC:
2859
				smps_mode = IEEE80211_SMPS_STATIC;
2860 2861
				break;
			case WLAN_HT_SMPS_CONTROL_DYNAMIC:
2862
				smps_mode = IEEE80211_SMPS_DYNAMIC;
2863 2864 2865 2866 2867 2868
				break;
			default:
				goto invalid;
			}

			/* if no change do nothing */
2869
			if (rx->sta->sta.smps_mode == smps_mode)
2870
				goto handled;
2871
			rx->sta->sta.smps_mode = smps_mode;
2872 2873
			sta_opmode.smps_mode = smps_mode;
			sta_opmode.changed = STA_OPMODE_SMPS_MODE_CHANGED;
2874 2875 2876

			sband = rx->local->hw.wiphy->bands[status->band];

2877 2878
			rate_control_rate_update(local, sband, rx->sta,
						 IEEE80211_RC_SMPS_CHANGED);
2879 2880 2881 2882
			cfg80211_sta_opmode_change_notify(sdata->dev,
							  rx->sta->addr,
							  &sta_opmode,
							  GFP_KERNEL);
2883 2884
			goto handled;
		}
2885 2886 2887
		case WLAN_HT_ACTION_NOTIFY_CHANWIDTH: {
			struct ieee80211_supported_band *sband;
			u8 chanwidth = mgmt->u.action.u.ht_notify_cw.chanwidth;
2888
			enum ieee80211_sta_rx_bandwidth max_bw, new_bw;
2889
			struct sta_opmode_info sta_opmode = {};
2890 2891

			/* If it doesn't support 40 MHz it can't change ... */
2892 2893
			if (!(rx->sta->sta.ht_cap.cap &
					IEEE80211_HT_CAP_SUP_WIDTH_20_40))
2894 2895
				goto handled;

2896
			if (chanwidth == IEEE80211_HT_CHANWIDTH_20MHZ)
2897
				max_bw = IEEE80211_STA_RX_BW_20;
2898
			else
2899 2900 2901 2902 2903
				max_bw = ieee80211_sta_cap_rx_bw(rx->sta);

			/* set cur_max_bandwidth and recalc sta bw */
			rx->sta->cur_max_bandwidth = max_bw;
			new_bw = ieee80211_sta_cur_vht_bw(rx->sta);
2904

2905
			if (rx->sta->sta.bandwidth == new_bw)
2906 2907
				goto handled;

2908
			rx->sta->sta.bandwidth = new_bw;
2909
			sband = rx->local->hw.wiphy->bands[status->band];
2910 2911
			sta_opmode.bw = new_bw;
			sta_opmode.changed = STA_OPMODE_MAX_BW_CHANGED;
2912 2913 2914

			rate_control_rate_update(local, sband, rx->sta,
						 IEEE80211_RC_BW_CHANGED);
2915 2916 2917 2918
			cfg80211_sta_opmode_change_notify(sdata->dev,
							  rx->sta->addr,
							  &sta_opmode,
							  GFP_KERNEL);
2919 2920
			goto handled;
		}
2921 2922 2923 2924
		default:
			goto invalid;
		}

2925
		break;
2926 2927 2928 2929 2930 2931 2932 2933 2934 2935 2936 2937 2938 2939 2940 2941
	case WLAN_CATEGORY_PUBLIC:
		if (len < IEEE80211_MIN_ACTION_SIZE + 1)
			goto invalid;
		if (sdata->vif.type != NL80211_IFTYPE_STATION)
			break;
		if (!rx->sta)
			break;
		if (!ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid))
			break;
		if (mgmt->u.action.u.ext_chan_switch.action_code !=
				WLAN_PUB_ACTION_EXT_CHANSW_ANN)
			break;
		if (len < offsetof(struct ieee80211_mgmt,
				   u.action.u.ext_chan_switch.variable))
			goto invalid;
		goto queue;
2942 2943 2944 2945 2946 2947 2948 2949 2950 2951 2952 2953 2954 2955 2956 2957 2958
	case WLAN_CATEGORY_VHT:
		if (sdata->vif.type != NL80211_IFTYPE_STATION &&
		    sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
		    sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
		    sdata->vif.type != NL80211_IFTYPE_AP &&
		    sdata->vif.type != NL80211_IFTYPE_ADHOC)
			break;

		/* verify action code is present */
		if (len < IEEE80211_MIN_ACTION_SIZE + 1)
			goto invalid;

		switch (mgmt->u.action.u.vht_opmode_notif.action_code) {
		case WLAN_VHT_ACTION_OPMODE_NOTIF: {
			/* verify opmode is present */
			if (len < IEEE80211_MIN_ACTION_SIZE + 2)
				goto invalid;
2959
			goto queue;
2960
		}
2961 2962 2963 2964 2965
		case WLAN_VHT_ACTION_GROUPID_MGMT: {
			if (len < IEEE80211_MIN_ACTION_SIZE + 25)
				goto invalid;
			goto queue;
		}
2966 2967 2968
		default:
			break;
		}
2969
		break;
2970
	case WLAN_CATEGORY_BACK:
2971
		if (sdata->vif.type != NL80211_IFTYPE_STATION &&
2972
		    sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
2973
		    sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
2974 2975
		    sdata->vif.type != NL80211_IFTYPE_AP &&
		    sdata->vif.type != NL80211_IFTYPE_ADHOC)
2976
			break;
2977

2978 2979 2980 2981
		/* verify action_code is present */
		if (len < IEEE80211_MIN_ACTION_SIZE + 1)
			break;

2982 2983 2984 2985
		switch (mgmt->u.action.u.addba_req.action_code) {
		case WLAN_ACTION_ADDBA_REQ:
			if (len < (IEEE80211_MIN_ACTION_SIZE +
				   sizeof(mgmt->u.action.u.addba_req)))
2986 2987
				goto invalid;
			break;
2988 2989 2990
		case WLAN_ACTION_ADDBA_RESP:
			if (len < (IEEE80211_MIN_ACTION_SIZE +
				   sizeof(mgmt->u.action.u.addba_resp)))
2991 2992
				goto invalid;
			break;
2993 2994 2995
		case WLAN_ACTION_DELBA:
			if (len < (IEEE80211_MIN_ACTION_SIZE +
				   sizeof(mgmt->u.action.u.delba)))
2996 2997 2998 2999
				goto invalid;
			break;
		default:
			goto invalid;
3000
		}
3001

3002
		goto queue;
3003
	case WLAN_CATEGORY_SPECTRUM_MGMT:
3004 3005 3006 3007
		/* verify action_code is present */
		if (len < IEEE80211_MIN_ACTION_SIZE + 1)
			break;

3008 3009
		switch (mgmt->u.action.u.measurement.action_code) {
		case WLAN_ACTION_SPCT_MSR_REQ:
3010
			if (status->band != NL80211_BAND_5GHZ)
3011 3012
				break;

3013 3014
			if (len < (IEEE80211_MIN_ACTION_SIZE +
				   sizeof(mgmt->u.action.u.measurement)))
3015
				break;
3016 3017 3018 3019

			if (sdata->vif.type != NL80211_IFTYPE_STATION)
				break;

3020
			ieee80211_process_measurement_req(sdata, mgmt, len);
3021
			goto handled;
3022 3023 3024 3025
		case WLAN_ACTION_SPCT_CHL_SWITCH: {
			u8 *bssid;
			if (len < (IEEE80211_MIN_ACTION_SIZE +
				   sizeof(mgmt->u.action.u.chan_switch)))
3026
				break;
3027

3028
			if (sdata->vif.type != NL80211_IFTYPE_STATION &&
3029 3030
			    sdata->vif.type != NL80211_IFTYPE_ADHOC &&
			    sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
3031 3032 3033 3034 3035 3036
				break;

			if (sdata->vif.type == NL80211_IFTYPE_STATION)
				bssid = sdata->u.mgd.bssid;
			else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
				bssid = sdata->u.ibss.bssid;
3037 3038
			else if (sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
				bssid = mgmt->sa;
3039 3040 3041 3042
			else
				break;

			if (!ether_addr_equal(mgmt->bssid, bssid))
3043
				break;
S
Sujith 已提交
3044

3045
			goto queue;
3046
			}
3047 3048
		}
		break;
3049 3050 3051
	case WLAN_CATEGORY_SA_QUERY:
		if (len < (IEEE80211_MIN_ACTION_SIZE +
			   sizeof(mgmt->u.action.u.sa_query)))
3052 3053
			break;

3054 3055 3056
		switch (mgmt->u.action.u.sa_query.action) {
		case WLAN_ACTION_SA_QUERY_REQUEST:
			if (sdata->vif.type != NL80211_IFTYPE_STATION)
3057
				break;
3058
			ieee80211_process_sa_query_req(sdata, mgmt, len);
3059
			goto handled;
3060 3061
		}
		break;
3062
	case WLAN_CATEGORY_SELF_PROTECTED:
3063 3064 3065 3066
		if (len < (IEEE80211_MIN_ACTION_SIZE +
			   sizeof(mgmt->u.action.u.self_prot.action_code)))
			break;

3067 3068 3069 3070 3071 3072
		switch (mgmt->u.action.u.self_prot.action_code) {
		case WLAN_SP_MESH_PEERING_OPEN:
		case WLAN_SP_MESH_PEERING_CLOSE:
		case WLAN_SP_MESH_PEERING_CONFIRM:
			if (!ieee80211_vif_is_mesh(&sdata->vif))
				goto invalid;
3073
			if (sdata->u.mesh.user_mpm)
3074 3075 3076 3077 3078 3079 3080 3081 3082 3083
				/* userspace handles this frame */
				break;
			goto queue;
		case WLAN_SP_MGK_INFORM:
		case WLAN_SP_MGK_ACK:
			if (!ieee80211_vif_is_mesh(&sdata->vif))
				goto invalid;
			break;
		}
		break;
3084
	case WLAN_CATEGORY_MESH_ACTION:
3085 3086 3087 3088
		if (len < (IEEE80211_MIN_ACTION_SIZE +
			   sizeof(mgmt->u.action.u.mesh_action.action_code)))
			break;

3089 3090
		if (!ieee80211_vif_is_mesh(&sdata->vif))
			break;
3091
		if (mesh_action_is_path_sel(mgmt) &&
J
Johannes Berg 已提交
3092
		    !mesh_path_sel_is_hwmp(sdata))
3093 3094
			break;
		goto queue;
3095
	}
3096

3097 3098
	return RX_CONTINUE;

3099
 invalid:
3100
	status->rx_flags |= IEEE80211_RX_MALFORMED_ACTION_FRM;
3101 3102 3103 3104 3105
	/* will return in the next handlers */
	return RX_CONTINUE;

 handled:
	if (rx->sta)
3106
		rx->sta->rx_stats.packets++;
3107 3108 3109 3110 3111 3112 3113
	dev_kfree_skb(rx->skb);
	return RX_QUEUED;

 queue:
	skb_queue_tail(&sdata->skb_queue, rx->skb);
	ieee80211_queue_work(&local->hw, &sdata->work);
	if (rx->sta)
3114
		rx->sta->rx_stats.packets++;
3115 3116 3117 3118 3119 3120
	return RX_QUEUED;
}

static ieee80211_rx_result debug_noinline
ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx)
{
3121
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
3122
	int sig = 0;
3123 3124

	/* skip known-bad action frames and return them in the next handler */
3125
	if (status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM)
3126
		return RX_CONTINUE;
3127

3128 3129 3130 3131 3132 3133 3134
	/*
	 * Getting here means the kernel doesn't know how to handle
	 * it, but maybe userspace does ... include returned frames
	 * so userspace can register for those to know whether ones
	 * it transmitted were processed or returned.
	 */

3135
	if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM))
3136 3137
		sig = status->signal;

3138
	if (cfg80211_rx_mgmt(&rx->sdata->wdev, status->freq, sig,
3139
			     rx->skb->data, rx->skb->len, 0)) {
3140
		if (rx->sta)
3141
			rx->sta->rx_stats.packets++;
3142 3143 3144 3145 3146 3147 3148 3149 3150 3151 3152 3153 3154 3155
		dev_kfree_skb(rx->skb);
		return RX_QUEUED;
	}

	return RX_CONTINUE;
}

static ieee80211_rx_result debug_noinline
ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
{
	struct ieee80211_local *local = rx->local;
	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
	struct sk_buff *nskb;
	struct ieee80211_sub_if_data *sdata = rx->sdata;
3156
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
3157 3158 3159 3160 3161 3162 3163 3164 3165

	if (!ieee80211_is_action(mgmt->frame_control))
		return RX_CONTINUE;

	/*
	 * For AP mode, hostapd is responsible for handling any action
	 * frames that we didn't handle, including returning unknown
	 * ones. For all other modes we will return them to the sender,
	 * setting the 0x80 bit in the action category, as required by
3166
	 * 802.11-2012 9.24.4.
3167 3168 3169 3170
	 * Newer versions of hostapd shall also use the management frame
	 * registration mechanisms, but older ones still use cooked
	 * monitor interfaces so push all frames there.
	 */
3171
	if (!(status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) &&
3172 3173 3174
	    (sdata->vif.type == NL80211_IFTYPE_AP ||
	     sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
		return RX_DROP_MONITOR;
3175

3176 3177 3178
	if (is_multicast_ether_addr(mgmt->da))
		return RX_DROP_MONITOR;

3179 3180 3181 3182 3183 3184 3185
	/* do not return rejected action frames */
	if (mgmt->u.action.category & 0x80)
		return RX_DROP_UNUSABLE;

	nskb = skb_copy_expand(rx->skb, local->hw.extra_tx_headroom, 0,
			       GFP_ATOMIC);
	if (nskb) {
3186
		struct ieee80211_mgmt *nmgmt = (void *)nskb->data;
3187

3188 3189 3190
		nmgmt->u.action.category |= 0x80;
		memcpy(nmgmt->da, nmgmt->sa, ETH_ALEN);
		memcpy(nmgmt->sa, rx->sdata->vif.addr, ETH_ALEN);
3191 3192 3193

		memset(nskb->cb, 0, sizeof(nskb->cb));

3194 3195 3196 3197 3198 3199
		if (rx->sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) {
			struct ieee80211_tx_info *info = IEEE80211_SKB_CB(nskb);

			info->flags = IEEE80211_TX_CTL_TX_OFFCHAN |
				      IEEE80211_TX_INTFL_OFFCHAN_TX_OK |
				      IEEE80211_TX_CTL_NO_CCK_RATE;
3200
			if (ieee80211_hw_check(&local->hw, QUEUE_CONTROL))
3201 3202 3203 3204 3205 3206
				info->hw_queue =
					local->hw.offchannel_tx_hw_queue;
		}

		__ieee80211_tx_skb_tid_band(rx->sdata, nskb, 7,
					    status->band);
3207
	}
3208 3209
	dev_kfree_skb(rx->skb);
	return RX_QUEUED;
3210 3211
}

3212
static ieee80211_rx_result debug_noinline
3213
ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
3214
{
J
Johannes Berg 已提交
3215
	struct ieee80211_sub_if_data *sdata = rx->sdata;
3216 3217
	struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
	__le16 stype;
3218

3219
	stype = mgmt->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE);
3220

3221 3222
	if (!ieee80211_vif_is_mesh(&sdata->vif) &&
	    sdata->vif.type != NL80211_IFTYPE_ADHOC &&
3223
	    sdata->vif.type != NL80211_IFTYPE_OCB &&
3224 3225
	    sdata->vif.type != NL80211_IFTYPE_STATION)
		return RX_DROP_MONITOR;
3226

3227
	switch (stype) {
J
Johannes Berg 已提交
3228
	case cpu_to_le16(IEEE80211_STYPE_AUTH):
3229 3230 3231 3232
	case cpu_to_le16(IEEE80211_STYPE_BEACON):
	case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
		/* process for all: mesh, mlme, ibss */
		break;
J
Johannes Berg 已提交
3233 3234
	case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
	case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
3235 3236
	case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
	case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
3237 3238 3239 3240
		if (is_multicast_ether_addr(mgmt->da) &&
		    !is_broadcast_ether_addr(mgmt->da))
			return RX_DROP_MONITOR;

3241 3242 3243 3244 3245
		/* process only for station */
		if (sdata->vif.type != NL80211_IFTYPE_STATION)
			return RX_DROP_MONITOR;
		break;
	case cpu_to_le16(IEEE80211_STYPE_PROBE_REQ):
3246 3247 3248
		/* process only for ibss and mesh */
		if (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
		    sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
3249 3250 3251 3252 3253
			return RX_DROP_MONITOR;
		break;
	default:
		return RX_DROP_MONITOR;
	}
3254

3255 3256 3257
	/* queue up frame and kick off work to process it */
	skb_queue_tail(&sdata->skb_queue, rx->skb);
	ieee80211_queue_work(&rx->local->hw, &sdata->work);
3258
	if (rx->sta)
3259
		rx->sta->rx_stats.packets++;
3260

3261
	return RX_QUEUED;
3262 3263
}

J
Johannes Berg 已提交
3264 3265
static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
					struct ieee80211_rate *rate)
3266 3267 3268 3269 3270
{
	struct ieee80211_sub_if_data *sdata;
	struct ieee80211_local *local = rx->local;
	struct sk_buff *skb = rx->skb, *skb2;
	struct net_device *prev_dev = NULL;
J
Johannes Berg 已提交
3271
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
3272
	int needed_headroom;
3273

3274 3275 3276 3277 3278
	/*
	 * If cooked monitor has been processed already, then
	 * don't do it again. If not, set the flag.
	 */
	if (rx->flags & IEEE80211_RX_CMNTR)
3279
		goto out_free_skb;
3280
	rx->flags |= IEEE80211_RX_CMNTR;
3281

3282 3283 3284 3285
	/* If there are no cooked monitor interfaces, just free the SKB */
	if (!local->cooked_mntrs)
		goto out_free_skb;

3286 3287
	/* vendor data is long removed here */
	status->flag &= ~RX_FLAG_RADIOTAP_VENDOR_DATA;
3288
	/* room for the radiotap header based on driver features */
3289
	needed_headroom = ieee80211_rx_radiotap_hdrlen(local, status, skb);
3290

3291 3292 3293
	if (skb_headroom(skb) < needed_headroom &&
	    pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC))
		goto out_free_skb;
3294

3295
	/* prepend radiotap information */
3296 3297
	ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom,
					 false);
3298

3299
	skb_reset_mac_header(skb);
3300 3301 3302 3303 3304
	skb->ip_summed = CHECKSUM_UNNECESSARY;
	skb->pkt_type = PACKET_OTHERHOST;
	skb->protocol = htons(ETH_P_802_2);

	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
3305
		if (!ieee80211_sdata_running(sdata))
3306 3307
			continue;

3308
		if (sdata->vif.type != NL80211_IFTYPE_MONITOR ||
3309
		    !(sdata->u.mntr.flags & MONITOR_FLAG_COOK_FRAMES))
3310 3311 3312 3313 3314 3315
			continue;

		if (prev_dev) {
			skb2 = skb_clone(skb, GFP_ATOMIC);
			if (skb2) {
				skb2->dev = prev_dev;
3316
				netif_receive_skb(skb2);
3317 3318 3319 3320
			}
		}

		prev_dev = sdata->dev;
3321
		ieee80211_rx_stats(sdata->dev, skb->len);
3322 3323 3324 3325
	}

	if (prev_dev) {
		skb->dev = prev_dev;
3326
		netif_receive_skb(skb);
3327 3328
		return;
	}
3329 3330 3331 3332 3333

 out_free_skb:
	dev_kfree_skb(skb);
}

3334 3335 3336 3337 3338 3339 3340
static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx,
					 ieee80211_rx_result res)
{
	switch (res) {
	case RX_DROP_MONITOR:
		I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
		if (rx->sta)
3341
			rx->sta->rx_stats.dropped++;
3342 3343 3344 3345 3346 3347 3348 3349 3350
		/* fall through */
	case RX_CONTINUE: {
		struct ieee80211_rate *rate = NULL;
		struct ieee80211_supported_band *sband;
		struct ieee80211_rx_status *status;

		status = IEEE80211_SKB_RXCB((rx->skb));

		sband = rx->local->hw.wiphy->bands[status->band];
3351 3352
		if (!(status->encoding == RX_ENC_HT) &&
		    !(status->encoding == RX_ENC_VHT))
3353 3354 3355 3356 3357 3358 3359 3360
			rate = &sband->bitrates[status->rate_idx];

		ieee80211_rx_cooked_monitor(rx, rate);
		break;
		}
	case RX_DROP_UNUSABLE:
		I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
		if (rx->sta)
3361
			rx->sta->rx_stats.dropped++;
3362 3363 3364 3365 3366 3367 3368
		dev_kfree_skb(rx->skb);
		break;
	case RX_QUEUED:
		I802_DEBUG_INC(rx->sdata->local->rx_handlers_queued);
		break;
	}
}
3369

3370 3371
static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx,
				  struct sk_buff_head *frames)
3372 3373
{
	ieee80211_rx_result res = RX_DROP_MONITOR;
3374
	struct sk_buff *skb;
3375

3376 3377 3378 3379
#define CALL_RXH(rxh)			\
	do {				\
		res = rxh(rx);		\
		if (res != RX_CONTINUE)	\
3380
			goto rxh_next;  \
3381
	} while (0)
3382

3383 3384 3385 3386 3387 3388
	/* Lock here to avoid hitting all of the data used in the RX
	 * path (e.g. key data, station data, ...) concurrently when
	 * a frame is released from the reorder buffer due to timeout
	 * from the timer, potentially concurrently with RX from the
	 * driver.
	 */
3389
	spin_lock_bh(&rx->local->rx_path_lock);
3390

3391
	while ((skb = __skb_dequeue(frames))) {
3392 3393 3394 3395 3396 3397 3398
		/*
		 * all the other fields are valid across frames
		 * that belong to an aMPDU since they are on the
		 * same TID from the same station
		 */
		rx->skb = skb;

3399 3400 3401 3402 3403 3404
		CALL_RXH(ieee80211_rx_h_check_more_data);
		CALL_RXH(ieee80211_rx_h_uapsd_and_pspoll);
		CALL_RXH(ieee80211_rx_h_sta_process);
		CALL_RXH(ieee80211_rx_h_decrypt);
		CALL_RXH(ieee80211_rx_h_defragment);
		CALL_RXH(ieee80211_rx_h_michael_mic_verify);
3405
		/* must be after MMIC verify so header is counted in MPDU mic */
I
Ingo Molnar 已提交
3406
#ifdef CONFIG_MAC80211_MESH
3407
		if (ieee80211_vif_is_mesh(&rx->sdata->vif))
3408
			CALL_RXH(ieee80211_rx_h_mesh_fwding);
I
Ingo Molnar 已提交
3409
#endif
3410 3411
		CALL_RXH(ieee80211_rx_h_amsdu);
		CALL_RXH(ieee80211_rx_h_data);
3412 3413 3414 3415 3416 3417

		/* special treatment -- needs the queue */
		res = ieee80211_rx_h_ctrl(rx, frames);
		if (res != RX_CONTINUE)
			goto rxh_next;

3418 3419 3420 3421 3422
		CALL_RXH(ieee80211_rx_h_mgmt_check);
		CALL_RXH(ieee80211_rx_h_action);
		CALL_RXH(ieee80211_rx_h_userspace_mgmt);
		CALL_RXH(ieee80211_rx_h_action_return);
		CALL_RXH(ieee80211_rx_h_mgmt);
3423

3424 3425
 rxh_next:
		ieee80211_rx_handlers_result(rx, res);
3426

3427
#undef CALL_RXH
3428
	}
3429

3430
	spin_unlock_bh(&rx->local->rx_path_lock);
3431 3432
}

3433
static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
3434
{
3435
	struct sk_buff_head reorder_release;
3436 3437
	ieee80211_rx_result res = RX_DROP_MONITOR;

3438 3439
	__skb_queue_head_init(&reorder_release);

3440 3441 3442 3443 3444
#define CALL_RXH(rxh)			\
	do {				\
		res = rxh(rx);		\
		if (res != RX_CONTINUE)	\
			goto rxh_next;  \
3445
	} while (0)
3446

3447 3448
	CALL_RXH(ieee80211_rx_h_check_dup);
	CALL_RXH(ieee80211_rx_h_check);
3449

3450
	ieee80211_rx_reorder_ampdu(rx, &reorder_release);
3451

3452
	ieee80211_rx_handlers(rx, &reorder_release);
3453
	return;
3454

3455
 rxh_next:
3456 3457 3458
	ieee80211_rx_handlers_result(rx, res);

#undef CALL_RXH
3459 3460
}

3461
/*
3462 3463
 * This function makes calls into the RX path, therefore
 * it has to be invoked under RCU read lock.
3464 3465 3466
 */
void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
{
3467
	struct sk_buff_head frames;
3468 3469 3470 3471
	struct ieee80211_rx_data rx = {
		.sta = sta,
		.sdata = sta->sdata,
		.local = sta->local,
3472 3473 3474
		/* This is OK -- must be QoS data frame */
		.security_idx = tid,
		.seqno_idx = tid,
3475
		.napi = NULL, /* must be NULL to not have races */
3476
	};
3477 3478 3479 3480 3481
	struct tid_ampdu_rx *tid_agg_rx;

	tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
	if (!tid_agg_rx)
		return;
3482

3483 3484
	__skb_queue_head_init(&frames);

3485
	spin_lock(&tid_agg_rx->reorder_lock);
3486
	ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames);
3487
	spin_unlock(&tid_agg_rx->reorder_lock);
3488

3489 3490 3491 3492 3493 3494 3495 3496 3497
	if (!skb_queue_empty(&frames)) {
		struct ieee80211_event event = {
			.type = BA_FRAME_TIMEOUT,
			.u.ba.tid = tid,
			.u.ba.sta = &sta->sta,
		};
		drv_event_callback(rx.local, rx.sdata, &event);
	}

3498
	ieee80211_rx_handlers(&rx, &frames);
3499 3500
}

3501 3502 3503 3504 3505 3506 3507 3508 3509 3510 3511 3512 3513 3514 3515 3516 3517 3518 3519 3520 3521 3522 3523 3524 3525 3526 3527 3528 3529 3530 3531 3532 3533 3534 3535 3536 3537 3538 3539 3540 3541 3542 3543 3544 3545 3546 3547 3548 3549 3550 3551 3552 3553 3554 3555 3556 3557 3558 3559 3560 3561 3562 3563 3564 3565 3566 3567 3568 3569 3570 3571 3572 3573 3574 3575 3576 3577 3578 3579
void ieee80211_mark_rx_ba_filtered_frames(struct ieee80211_sta *pubsta, u8 tid,
					  u16 ssn, u64 filtered,
					  u16 received_mpdus)
{
	struct sta_info *sta;
	struct tid_ampdu_rx *tid_agg_rx;
	struct sk_buff_head frames;
	struct ieee80211_rx_data rx = {
		/* This is OK -- must be QoS data frame */
		.security_idx = tid,
		.seqno_idx = tid,
	};
	int i, diff;

	if (WARN_ON(!pubsta || tid >= IEEE80211_NUM_TIDS))
		return;

	__skb_queue_head_init(&frames);

	sta = container_of(pubsta, struct sta_info, sta);

	rx.sta = sta;
	rx.sdata = sta->sdata;
	rx.local = sta->local;

	rcu_read_lock();
	tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
	if (!tid_agg_rx)
		goto out;

	spin_lock_bh(&tid_agg_rx->reorder_lock);

	if (received_mpdus >= IEEE80211_SN_MODULO >> 1) {
		int release;

		/* release all frames in the reorder buffer */
		release = (tid_agg_rx->head_seq_num + tid_agg_rx->buf_size) %
			   IEEE80211_SN_MODULO;
		ieee80211_release_reorder_frames(sta->sdata, tid_agg_rx,
						 release, &frames);
		/* update ssn to match received ssn */
		tid_agg_rx->head_seq_num = ssn;
	} else {
		ieee80211_release_reorder_frames(sta->sdata, tid_agg_rx, ssn,
						 &frames);
	}

	/* handle the case that received ssn is behind the mac ssn.
	 * it can be tid_agg_rx->buf_size behind and still be valid */
	diff = (tid_agg_rx->head_seq_num - ssn) & IEEE80211_SN_MASK;
	if (diff >= tid_agg_rx->buf_size) {
		tid_agg_rx->reorder_buf_filtered = 0;
		goto release;
	}
	filtered = filtered >> diff;
	ssn += diff;

	/* update bitmap */
	for (i = 0; i < tid_agg_rx->buf_size; i++) {
		int index = (ssn + i) % tid_agg_rx->buf_size;

		tid_agg_rx->reorder_buf_filtered &= ~BIT_ULL(index);
		if (filtered & BIT_ULL(i))
			tid_agg_rx->reorder_buf_filtered |= BIT_ULL(index);
	}

	/* now process also frames that the filter marking released */
	ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames);

release:
	spin_unlock_bh(&tid_agg_rx->reorder_lock);

	ieee80211_rx_handlers(&rx, &frames);

 out:
	rcu_read_unlock();
}
EXPORT_SYMBOL(ieee80211_mark_rx_ba_filtered_frames);

3580 3581
/* main receive path */

3582
static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx)
3583
{
3584
	struct ieee80211_sub_if_data *sdata = rx->sdata;
J
Johannes Berg 已提交
3585
	struct sk_buff *skb = rx->skb;
3586
	struct ieee80211_hdr *hdr = (void *)skb->data;
J
Johannes Berg 已提交
3587 3588
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
	u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
3589
	bool multicast = is_multicast_ether_addr(hdr->addr1);
3590

3591
	switch (sdata->vif.type) {
3592
	case NL80211_IFTYPE_STATION:
3593
		if (!bssid && !sdata->u.mgd.use_4addr)
3594
			return false;
3595 3596 3597
		if (multicast)
			return true;
		return ether_addr_equal(sdata->vif.addr, hdr->addr1);
3598
	case NL80211_IFTYPE_ADHOC:
3599
		if (!bssid)
3600
			return false;
3601 3602
		if (ether_addr_equal(sdata->vif.addr, hdr->addr2) ||
		    ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2))
3603
			return false;
3604
		if (ieee80211_is_beacon(hdr->frame_control))
3605
			return true;
3606
		if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid))
3607
			return false;
3608 3609
		if (!multicast &&
		    !ether_addr_equal(sdata->vif.addr, hdr->addr1))
3610
			return false;
3611
		if (!rx->sta) {
3612
			int rate_idx;
3613
			if (status->encoding != RX_ENC_LEGACY)
3614
				rate_idx = 0; /* TODO: HT/VHT rates */
3615
			else
J
Johannes Berg 已提交
3616
				rate_idx = status->rate_idx;
3617 3618
			ieee80211_ibss_rx_no_sta(sdata, bssid, hdr->addr2,
						 BIT(rate_idx));
3619
		}
3620
		return true;
3621 3622 3623
	case NL80211_IFTYPE_OCB:
		if (!bssid)
			return false;
3624
		if (!ieee80211_is_data_present(hdr->frame_control))
3625
			return false;
3626
		if (!is_broadcast_ether_addr(bssid))
3627
			return false;
3628 3629
		if (!multicast &&
		    !ether_addr_equal(sdata->dev->dev_addr, hdr->addr1))
3630
			return false;
3631
		if (!rx->sta) {
3632
			int rate_idx;
3633
			if (status->encoding != RX_ENC_LEGACY)
3634 3635 3636 3637 3638 3639
				rate_idx = 0; /* TODO: HT rates */
			else
				rate_idx = status->rate_idx;
			ieee80211_ocb_rx_no_sta(sdata, bssid, hdr->addr2,
						BIT(rate_idx));
		}
3640
		return true;
3641
	case NL80211_IFTYPE_MESH_POINT:
3642 3643
		if (ether_addr_equal(sdata->vif.addr, hdr->addr2))
			return false;
3644 3645 3646
		if (multicast)
			return true;
		return ether_addr_equal(sdata->vif.addr, hdr->addr1);
3647 3648
	case NL80211_IFTYPE_AP_VLAN:
	case NL80211_IFTYPE_AP:
3649 3650 3651 3652
		if (!bssid)
			return ether_addr_equal(sdata->vif.addr, hdr->addr1);

		if (!ieee80211_bssid_match(bssid, sdata->vif.addr)) {
3653 3654 3655 3656 3657 3658
			/*
			 * Accept public action frames even when the
			 * BSSID doesn't match, this is used for P2P
			 * and location updates. Note that mac80211
			 * itself never looks at these frames.
			 */
3659 3660
			if (!multicast &&
			    !ether_addr_equal(sdata->vif.addr, hdr->addr1))
3661
				return false;
J
Johannes Berg 已提交
3662
			if (ieee80211_is_public_action(hdr, skb->len))
3663
				return true;
3664
			return ieee80211_is_beacon(hdr->frame_control);
3665 3666 3667
		}

		if (!ieee80211_has_tods(hdr->frame_control)) {
3668 3669 3670 3671 3672
			/* ignore data frames to TDLS-peers */
			if (ieee80211_is_data(hdr->frame_control))
				return false;
			/* ignore action frames to TDLS-peers */
			if (ieee80211_is_action(hdr->frame_control) &&
3673
			    !is_broadcast_ether_addr(bssid) &&
3674 3675
			    !ether_addr_equal(bssid, hdr->addr1))
				return false;
3676
		}
3677 3678 3679 3680 3681 3682 3683 3684 3685 3686 3687 3688 3689 3690 3691 3692 3693 3694 3695 3696 3697

		/*
		 * 802.11-2016 Table 9-26 says that for data frames, A1 must be
		 * the BSSID - we've checked that already but may have accepted
		 * the wildcard (ff:ff:ff:ff:ff:ff).
		 *
		 * It also says:
		 *	The BSSID of the Data frame is determined as follows:
		 *	a) If the STA is contained within an AP or is associated
		 *	   with an AP, the BSSID is the address currently in use
		 *	   by the STA contained in the AP.
		 *
		 * So we should not accept data frames with an address that's
		 * multicast.
		 *
		 * Accepting it also opens a security problem because stations
		 * could encrypt it with the GTK and inject traffic that way.
		 */
		if (ieee80211_is_data(hdr->frame_control) && multicast)
			return false;

3698
		return true;
3699
	case NL80211_IFTYPE_WDS:
3700
		if (bssid || !ieee80211_is_data(hdr->frame_control))
3701
			return false;
3702
		return ether_addr_equal(sdata->u.wds.remote_addr, hdr->addr2);
3703
	case NL80211_IFTYPE_P2P_DEVICE:
3704 3705 3706 3707
		return ieee80211_is_public_action(hdr, skb->len) ||
		       ieee80211_is_probe_req(hdr->frame_control) ||
		       ieee80211_is_probe_resp(hdr->frame_control) ||
		       ieee80211_is_beacon(hdr->frame_control);
3708 3709 3710
	case NL80211_IFTYPE_NAN:
		/* Currently no frames on NAN interface are allowed */
		return false;
3711
	default:
J
Johannes Berg 已提交
3712
		break;
3713 3714
	}

3715 3716
	WARN_ON_ONCE(1);
	return false;
3717 3718
}

J
Johannes Berg 已提交
3719 3720 3721 3722 3723 3724 3725 3726 3727 3728 3729 3730 3731 3732 3733 3734 3735 3736 3737 3738
void ieee80211_check_fast_rx(struct sta_info *sta)
{
	struct ieee80211_sub_if_data *sdata = sta->sdata;
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_key *key;
	struct ieee80211_fast_rx fastrx = {
		.dev = sdata->dev,
		.vif_type = sdata->vif.type,
		.control_port_protocol = sdata->control_port_protocol,
	}, *old, *new = NULL;
	bool assign = false;

	/* use sparse to check that we don't return without updating */
	__acquire(check_fast_rx);

	BUILD_BUG_ON(sizeof(fastrx.rfc1042_hdr) != sizeof(rfc1042_header));
	BUILD_BUG_ON(sizeof(fastrx.rfc1042_hdr) != ETH_ALEN);
	ether_addr_copy(fastrx.rfc1042_hdr, rfc1042_header);
	ether_addr_copy(fastrx.vif_addr, sdata->vif.addr);

3739 3740
	fastrx.uses_rss = ieee80211_hw_check(&local->hw, USES_RSS);

J
Johannes Berg 已提交
3741 3742 3743 3744 3745 3746 3747 3748 3749 3750 3751 3752 3753 3754 3755 3756 3757 3758 3759 3760 3761 3762 3763 3764 3765 3766 3767 3768 3769 3770 3771 3772 3773 3774 3775 3776 3777 3778 3779 3780 3781 3782 3783 3784 3785 3786 3787 3788 3789 3790 3791 3792 3793 3794 3795 3796 3797 3798 3799 3800 3801 3802 3803 3804 3805 3806 3807 3808 3809 3810 3811 3812 3813 3814 3815 3816 3817 3818 3819 3820 3821 3822 3823 3824 3825 3826 3827 3828 3829 3830 3831 3832 3833 3834 3835 3836 3837 3838 3839 3840 3841 3842 3843 3844 3845 3846 3847 3848 3849 3850 3851 3852 3853 3854 3855 3856 3857 3858 3859 3860 3861 3862 3863 3864 3865 3866 3867 3868 3869 3870 3871 3872 3873 3874 3875 3876 3877 3878 3879 3880 3881 3882 3883 3884 3885 3886 3887 3888 3889 3890
	/* fast-rx doesn't do reordering */
	if (ieee80211_hw_check(&local->hw, AMPDU_AGGREGATION) &&
	    !ieee80211_hw_check(&local->hw, SUPPORTS_REORDERING_BUFFER))
		goto clear;

	switch (sdata->vif.type) {
	case NL80211_IFTYPE_STATION:
		/* 4-addr is harder to deal with, later maybe */
		if (sdata->u.mgd.use_4addr)
			goto clear;
		/* software powersave is a huge mess, avoid all of it */
		if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK))
			goto clear;
		if (ieee80211_hw_check(&local->hw, SUPPORTS_PS) &&
		    !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS))
			goto clear;
		if (sta->sta.tdls) {
			fastrx.da_offs = offsetof(struct ieee80211_hdr, addr1);
			fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr2);
			fastrx.expected_ds_bits = 0;
		} else {
			fastrx.sta_notify = sdata->u.mgd.probe_send_count > 0;
			fastrx.da_offs = offsetof(struct ieee80211_hdr, addr1);
			fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr3);
			fastrx.expected_ds_bits =
				cpu_to_le16(IEEE80211_FCTL_FROMDS);
		}
		break;
	case NL80211_IFTYPE_AP_VLAN:
	case NL80211_IFTYPE_AP:
		/* parallel-rx requires this, at least with calls to
		 * ieee80211_sta_ps_transition()
		 */
		if (!ieee80211_hw_check(&local->hw, AP_LINK_PS))
			goto clear;
		fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3);
		fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr2);
		fastrx.expected_ds_bits = cpu_to_le16(IEEE80211_FCTL_TODS);

		fastrx.internal_forward =
			!(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
			(sdata->vif.type != NL80211_IFTYPE_AP_VLAN ||
			 !sdata->u.vlan.sta);
		break;
	default:
		goto clear;
	}

	if (!test_sta_flag(sta, WLAN_STA_AUTHORIZED))
		goto clear;

	rcu_read_lock();
	key = rcu_dereference(sta->ptk[sta->ptk_idx]);
	if (key) {
		switch (key->conf.cipher) {
		case WLAN_CIPHER_SUITE_TKIP:
			/* we don't want to deal with MMIC in fast-rx */
			goto clear_rcu;
		case WLAN_CIPHER_SUITE_CCMP:
		case WLAN_CIPHER_SUITE_CCMP_256:
		case WLAN_CIPHER_SUITE_GCMP:
		case WLAN_CIPHER_SUITE_GCMP_256:
			break;
		default:
			/* we also don't want to deal with WEP or cipher scheme
			 * since those require looking up the key idx in the
			 * frame, rather than assuming the PTK is used
			 * (we need to revisit this once we implement the real
			 * PTK index, which is now valid in the spec, but we
			 * haven't implemented that part yet)
			 */
			goto clear_rcu;
		}

		fastrx.key = true;
		fastrx.icv_len = key->conf.icv_len;
	}

	assign = true;
 clear_rcu:
	rcu_read_unlock();
 clear:
	__release(check_fast_rx);

	if (assign)
		new = kmemdup(&fastrx, sizeof(fastrx), GFP_KERNEL);

	spin_lock_bh(&sta->lock);
	old = rcu_dereference_protected(sta->fast_rx, true);
	rcu_assign_pointer(sta->fast_rx, new);
	spin_unlock_bh(&sta->lock);

	if (old)
		kfree_rcu(old, rcu_head);
}

void ieee80211_clear_fast_rx(struct sta_info *sta)
{
	struct ieee80211_fast_rx *old;

	spin_lock_bh(&sta->lock);
	old = rcu_dereference_protected(sta->fast_rx, true);
	RCU_INIT_POINTER(sta->fast_rx, NULL);
	spin_unlock_bh(&sta->lock);

	if (old)
		kfree_rcu(old, rcu_head);
}

void __ieee80211_check_fast_rx_iface(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;
	struct sta_info *sta;

	lockdep_assert_held(&local->sta_mtx);

	list_for_each_entry_rcu(sta, &local->sta_list, list) {
		if (sdata != sta->sdata &&
		    (!sta->sdata->bss || sta->sdata->bss != sdata->bss))
			continue;
		ieee80211_check_fast_rx(sta);
	}
}

void ieee80211_check_fast_rx_iface(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;

	mutex_lock(&local->sta_mtx);
	__ieee80211_check_fast_rx_iface(sdata);
	mutex_unlock(&local->sta_mtx);
}

static bool ieee80211_invoke_fast_rx(struct ieee80211_rx_data *rx,
				     struct ieee80211_fast_rx *fast_rx)
{
	struct sk_buff *skb = rx->skb;
	struct ieee80211_hdr *hdr = (void *)skb->data;
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
	struct sta_info *sta = rx->sta;
	int orig_len = skb->len;
	int snap_offs = ieee80211_hdrlen(hdr->frame_control);
	struct {
		u8 snap[sizeof(rfc1042_header)];
		__be16 proto;
	} *payload __aligned(2);
	struct {
		u8 da[ETH_ALEN];
		u8 sa[ETH_ALEN];
	} addrs __aligned(2);
3891 3892 3893 3894
	struct ieee80211_sta_rx_stats *stats = &sta->rx_stats;

	if (fast_rx->uses_rss)
		stats = this_cpu_ptr(sta->pcpu_rx_stats);
J
Johannes Berg 已提交
3895 3896 3897 3898 3899 3900 3901 3902 3903 3904 3905 3906 3907 3908 3909 3910 3911 3912 3913 3914 3915 3916 3917 3918 3919 3920 3921 3922 3923 3924 3925 3926 3927 3928 3929 3930 3931 3932 3933 3934 3935 3936 3937 3938 3939 3940 3941 3942 3943 3944 3945 3946 3947 3948 3949 3950 3951 3952 3953 3954 3955 3956 3957 3958 3959 3960 3961 3962 3963 3964 3965 3966 3967 3968 3969 3970 3971 3972 3973 3974 3975

	/* for parallel-rx, we need to have DUP_VALIDATED, otherwise we write
	 * to a common data structure; drivers can implement that per queue
	 * but we don't have that information in mac80211
	 */
	if (!(status->flag & RX_FLAG_DUP_VALIDATED))
		return false;

#define FAST_RX_CRYPT_FLAGS	(RX_FLAG_PN_VALIDATED | RX_FLAG_DECRYPTED)

	/* If using encryption, we also need to have:
	 *  - PN_VALIDATED: similar, but the implementation is tricky
	 *  - DECRYPTED: necessary for PN_VALIDATED
	 */
	if (fast_rx->key &&
	    (status->flag & FAST_RX_CRYPT_FLAGS) != FAST_RX_CRYPT_FLAGS)
		return false;

	/* we don't deal with A-MSDU deaggregation here */
	if (status->rx_flags & IEEE80211_RX_AMSDU)
		return false;

	if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
		return false;

	if (unlikely(ieee80211_is_frag(hdr)))
		return false;

	/* Since our interface address cannot be multicast, this
	 * implicitly also rejects multicast frames without the
	 * explicit check.
	 *
	 * We shouldn't get any *data* frames not addressed to us
	 * (AP mode will accept multicast *management* frames), but
	 * punting here will make it go through the full checks in
	 * ieee80211_accept_frame().
	 */
	if (!ether_addr_equal(fast_rx->vif_addr, hdr->addr1))
		return false;

	if ((hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_FROMDS |
					      IEEE80211_FCTL_TODS)) !=
	    fast_rx->expected_ds_bits)
		goto drop;

	/* assign the key to drop unencrypted frames (later)
	 * and strip the IV/MIC if necessary
	 */
	if (fast_rx->key && !(status->flag & RX_FLAG_IV_STRIPPED)) {
		/* GCMP header length is the same */
		snap_offs += IEEE80211_CCMP_HDR_LEN;
	}

	if (!pskb_may_pull(skb, snap_offs + sizeof(*payload)))
		goto drop;
	payload = (void *)(skb->data + snap_offs);

	if (!ether_addr_equal(payload->snap, fast_rx->rfc1042_hdr))
		return false;

	/* Don't handle these here since they require special code.
	 * Accept AARP and IPX even though they should come with a
	 * bridge-tunnel header - but if we get them this way then
	 * there's little point in discarding them.
	 */
	if (unlikely(payload->proto == cpu_to_be16(ETH_P_TDLS) ||
		     payload->proto == fast_rx->control_port_protocol))
		return false;

	/* after this point, don't punt to the slowpath! */

	if (rx->key && !(status->flag & RX_FLAG_MIC_STRIPPED) &&
	    pskb_trim(skb, skb->len - fast_rx->icv_len))
		goto drop;

	if (unlikely(fast_rx->sta_notify)) {
		ieee80211_sta_rx_notify(rx->sdata, hdr);
		fast_rx->sta_notify = false;
	}

	/* statistics part of ieee80211_rx_h_sta_process() */
3976 3977
	stats->last_rx = jiffies;
	stats->last_rate = sta_stats_encode_rate(status);
J
Johannes Berg 已提交
3978

3979
	stats->fragments++;
3980
	stats->packets++;
J
Johannes Berg 已提交
3981 3982

	if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
3983 3984 3985 3986
		stats->last_signal = status->signal;
		if (!fast_rx->uses_rss)
			ewma_signal_add(&sta->rx_stats_avg.signal,
					-status->signal);
J
Johannes Berg 已提交
3987 3988 3989 3990 3991
	}

	if (status->chains) {
		int i;

3992
		stats->chains = status->chains;
J
Johannes Berg 已提交
3993 3994 3995 3996 3997 3998
		for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {
			int signal = status->chain_signal[i];

			if (!(status->chains & BIT(i)))
				continue;

3999 4000 4001 4002
			stats->chain_signal_last[i] = signal;
			if (!fast_rx->uses_rss)
				ewma_signal_add(&sta->rx_stats_avg.chain_signal[i],
						-signal);
J
Johannes Berg 已提交
4003 4004 4005 4006 4007 4008 4009 4010 4011 4012 4013 4014 4015 4016 4017 4018 4019 4020 4021 4022 4023 4024 4025 4026
		}
	}
	/* end of statistics */

	if (rx->key && !ieee80211_has_protected(hdr->frame_control))
		goto drop;

	/* do the header conversion - first grab the addresses */
	ether_addr_copy(addrs.da, skb->data + fast_rx->da_offs);
	ether_addr_copy(addrs.sa, skb->data + fast_rx->sa_offs);
	/* remove the SNAP but leave the ethertype */
	skb_pull(skb, snap_offs + sizeof(rfc1042_header));
	/* push the addresses in front */
	memcpy(skb_push(skb, sizeof(addrs)), &addrs, sizeof(addrs));

	skb->dev = fast_rx->dev;

	ieee80211_rx_stats(fast_rx->dev, skb->len);

	/* The seqno index has the same property as needed
	 * for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS
	 * for non-QoS-data frames. Here we know it's a data
	 * frame, so count MSDUs.
	 */
4027 4028 4029 4030
	u64_stats_update_begin(&stats->syncp);
	stats->msdu[rx->seqno_idx]++;
	stats->bytes += orig_len;
	u64_stats_update_end(&stats->syncp);
J
Johannes Berg 已提交
4031 4032

	if (fast_rx->internal_forward) {
4033 4034
		struct sk_buff *xmit_skb = NULL;
		bool multicast = is_multicast_ether_addr(skb->data);
J
Johannes Berg 已提交
4035

4036 4037 4038 4039 4040 4041
		if (multicast) {
			xmit_skb = skb_copy(skb, GFP_ATOMIC);
		} else if (sta_info_get(rx->sdata, skb->data)) {
			xmit_skb = skb;
			skb = NULL;
		}
J
Johannes Berg 已提交
4042

4043
		if (xmit_skb) {
J
Johannes Berg 已提交
4044 4045 4046 4047 4048
			/*
			 * Send to wireless media and increase priority by 256
			 * to keep the received priority instead of
			 * reclassifying the frame (see cfg80211_classify8021d).
			 */
4049 4050 4051 4052 4053
			xmit_skb->priority += 256;
			xmit_skb->protocol = htons(ETH_P_802_3);
			skb_reset_network_header(xmit_skb);
			skb_reset_mac_header(xmit_skb);
			dev_queue_xmit(xmit_skb);
J
Johannes Berg 已提交
4054
		}
4055 4056 4057

		if (!skb)
			return true;
J
Johannes Berg 已提交
4058 4059 4060 4061 4062 4063 4064 4065 4066 4067 4068 4069 4070
	}

	/* deliver to local stack */
	skb->protocol = eth_type_trans(skb, fast_rx->dev);
	memset(skb->cb, 0, sizeof(skb->cb));
	if (rx->napi)
		napi_gro_receive(rx->napi, skb);
	else
		netif_receive_skb(skb);

	return true;
 drop:
	dev_kfree_skb(skb);
4071
	stats->dropped++;
J
Johannes Berg 已提交
4072 4073 4074
	return true;
}

4075 4076 4077 4078 4079 4080 4081 4082 4083 4084 4085 4086 4087 4088
/*
 * This function returns whether or not the SKB
 * was destined for RX processing or not, which,
 * if consume is true, is equivalent to whether
 * or not the skb was consumed.
 */
static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,
					    struct sk_buff *skb, bool consume)
{
	struct ieee80211_local *local = rx->local;
	struct ieee80211_sub_if_data *sdata = rx->sdata;

	rx->skb = skb;

J
Johannes Berg 已提交
4089 4090 4091 4092 4093 4094 4095 4096 4097 4098 4099 4100 4101 4102 4103
	/* See if we can do fast-rx; if we have to copy we already lost,
	 * so punt in that case. We should never have to deliver a data
	 * frame to multiple interfaces anyway.
	 *
	 * We skip the ieee80211_accept_frame() call and do the necessary
	 * checking inside ieee80211_invoke_fast_rx().
	 */
	if (consume && rx->sta) {
		struct ieee80211_fast_rx *fast_rx;

		fast_rx = rcu_dereference(rx->sta->fast_rx);
		if (fast_rx && ieee80211_invoke_fast_rx(rx, fast_rx))
			return true;
	}

4104
	if (!ieee80211_accept_frame(rx))
4105 4106 4107 4108 4109 4110 4111
		return false;

	if (!consume) {
		skb = skb_copy(skb, GFP_ATOMIC);
		if (!skb) {
			if (net_ratelimit())
				wiphy_debug(local->hw.wiphy,
4112
					"failed to copy skb for %s\n",
4113 4114 4115 4116 4117 4118 4119 4120 4121 4122 4123
					sdata->name);
			return true;
		}

		rx->skb = skb;
	}

	ieee80211_invoke_rx_handlers(rx);
	return true;
}

4124
/*
4125
 * This is the actual Rx frames handler. as it belongs to Rx path it must
4126
 * be called with rcu_read_lock protection.
4127
 */
4128
static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
4129
					 struct ieee80211_sta *pubsta,
4130 4131
					 struct sk_buff *skb,
					 struct napi_struct *napi)
4132 4133 4134 4135
{
	struct ieee80211_local *local = hw_to_local(hw);
	struct ieee80211_sub_if_data *sdata;
	struct ieee80211_hdr *hdr;
Z
Zhu Yi 已提交
4136
	__le16 fc;
4137
	struct ieee80211_rx_data rx;
4138
	struct ieee80211_sub_if_data *prev;
4139
	struct rhlist_head *tmp;
Z
Zhu Yi 已提交
4140
	int err = 0;
4141

Z
Zhu Yi 已提交
4142
	fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
4143 4144 4145
	memset(&rx, 0, sizeof(rx));
	rx.skb = skb;
	rx.local = local;
4146
	rx.napi = napi;
4147

Z
Zhu Yi 已提交
4148
	if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc))
4149
		I802_DEBUG_INC(local->dot11ReceivedFragmentCount);
4150

4151 4152 4153 4154 4155 4156 4157
	if (ieee80211_is_mgmt(fc)) {
		/* drop frame if too short for header */
		if (skb->len < ieee80211_hdrlen(fc))
			err = -ENOBUFS;
		else
			err = skb_linearize(skb);
	} else {
Z
Zhu Yi 已提交
4158
		err = !pskb_may_pull(skb, ieee80211_hdrlen(fc));
4159
	}
Z
Zhu Yi 已提交
4160 4161 4162 4163 4164 4165 4166

	if (err) {
		dev_kfree_skb(skb);
		return;
	}

	hdr = (struct ieee80211_hdr *)skb->data;
4167
	ieee80211_parse_qos(&rx);
4168
	ieee80211_verify_alignment(&rx);
4169

J
Johannes Berg 已提交
4170 4171 4172 4173
	if (unlikely(ieee80211_is_probe_resp(hdr->frame_control) ||
		     ieee80211_is_beacon(hdr->frame_control)))
		ieee80211_scan_rx(local, skb);

4174
	if (ieee80211_is_data(fc)) {
4175
		struct sta_info *sta, *prev_sta;
4176

4177 4178 4179 4180 4181 4182 4183 4184
		if (pubsta) {
			rx.sta = container_of(pubsta, struct sta_info, sta);
			rx.sdata = rx.sta->sdata;
			if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
				return;
			goto out;
		}

4185
		prev_sta = NULL;
4186

4187
		for_each_sta_info(local, hdr->addr2, sta, tmp) {
4188 4189 4190 4191 4192 4193 4194
			if (!prev_sta) {
				prev_sta = sta;
				continue;
			}

			rx.sta = prev_sta;
			rx.sdata = prev_sta->sdata;
4195
			ieee80211_prepare_and_rx_handle(&rx, skb, false);
4196

4197
			prev_sta = sta;
4198
		}
4199 4200 4201 4202 4203

		if (prev_sta) {
			rx.sta = prev_sta;
			rx.sdata = prev_sta->sdata;

4204
			if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
4205
				return;
4206
			goto out;
4207
		}
4208 4209
	}

4210
	prev = NULL;
4211

4212 4213 4214
	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
		if (!ieee80211_sdata_running(sdata))
			continue;
J
Johannes Berg 已提交
4215

4216 4217 4218
		if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
		    sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
			continue;
J
Johannes Berg 已提交
4219

4220 4221 4222 4223 4224
		/*
		 * frame is destined for this interface, but if it's
		 * not also for the previous one we handle that after
		 * the loop to avoid copying the SKB once too much
		 */
4225

4226
		if (!prev) {
4227
			prev = sdata;
4228
			continue;
J
Johannes Berg 已提交
4229
		}
4230

4231
		rx.sta = sta_info_get_bss(prev, hdr->addr2);
4232 4233
		rx.sdata = prev;
		ieee80211_prepare_and_rx_handle(&rx, skb, false);
4234

4235 4236 4237 4238
		prev = sdata;
	}

	if (prev) {
4239
		rx.sta = sta_info_get_bss(prev, hdr->addr2);
4240
		rx.sdata = prev;
4241

4242 4243
		if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
			return;
4244
	}
4245

4246
 out:
4247
	dev_kfree_skb(skb);
4248
}
4249 4250 4251 4252 4253

/*
 * This is the receive path handler. It is called by a low level driver when an
 * 802.11 MPDU is received from the hardware.
 */
4254 4255
void ieee80211_rx_napi(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta,
		       struct sk_buff *skb, struct napi_struct *napi)
4256 4257
{
	struct ieee80211_local *local = hw_to_local(hw);
4258 4259
	struct ieee80211_rate *rate = NULL;
	struct ieee80211_supported_band *sband;
4260
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
4261

4262 4263
	WARN_ON_ONCE(softirq_count() == 0);

4264
	if (WARN_ON(status->band >= NUM_NL80211_BANDS))
J
Johannes Berg 已提交
4265
		goto drop;
4266 4267

	sband = local->hw.wiphy->bands[status->band];
J
Johannes Berg 已提交
4268 4269
	if (WARN_ON(!sband))
		goto drop;
4270

J
Johannes Berg 已提交
4271 4272 4273 4274 4275 4276 4277
	/*
	 * If we're suspending, it is possible although not too likely
	 * that we'd be receiving frames after having already partially
	 * quiesced the stack. We can't process such frames then since
	 * that might, for example, cause stations to be added or other
	 * driver callbacks be invoked.
	 */
J
Johannes Berg 已提交
4278 4279
	if (unlikely(local->quiescing || local->suspended))
		goto drop;
J
Johannes Berg 已提交
4280

4281 4282 4283 4284
	/* We might be during a HW reconfig, prevent Rx for the same reason */
	if (unlikely(local->in_reconfig))
		goto drop;

4285 4286 4287 4288
	/*
	 * The same happens when we're not even started,
	 * but that's worth a warning.
	 */
J
Johannes Berg 已提交
4289 4290
	if (WARN_ON(!local->started))
		goto drop;
4291

4292
	if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC))) {
4293
		/*
4294 4295
		 * Validate the rate, unless a PLCP error means that
		 * we probably can't have a valid rate here anyway.
4296
		 */
4297

4298 4299
		switch (status->encoding) {
		case RX_ENC_HT:
4300 4301 4302 4303 4304 4305 4306 4307 4308 4309
			/*
			 * rate_idx is MCS index, which can be [0-76]
			 * as documented on:
			 *
			 * http://wireless.kernel.org/en/developers/Documentation/ieee80211/802.11n
			 *
			 * Anything else would be some sort of driver or
			 * hardware error. The driver should catch hardware
			 * errors.
			 */
J
Johannes Berg 已提交
4310
			if (WARN(status->rate_idx > 76,
4311 4312 4313 4314 4315 4316
				 "Rate marked as an HT rate but passed "
				 "status->rate_idx is not "
				 "an MCS index [0-76]: %d (0x%02x)\n",
				 status->rate_idx,
				 status->rate_idx))
				goto drop;
4317 4318
			break;
		case RX_ENC_VHT:
4319
			if (WARN_ONCE(status->rate_idx > 9 ||
4320 4321
				      !status->nss ||
				      status->nss > 8,
4322
				      "Rate marked as a VHT rate but data is invalid: MCS: %d, NSS: %d\n",
4323
				      status->rate_idx, status->nss))
4324
				goto drop;
4325 4326 4327 4328 4329
			break;
		default:
			WARN_ON_ONCE(1);
			/* fall through */
		case RX_ENC_LEGACY:
J
Johannes Berg 已提交
4330
			if (WARN_ON(status->rate_idx >= sband->n_bitrates))
4331 4332 4333
				goto drop;
			rate = &sband->bitrates[status->rate_idx];
		}
4334
	}
4335

4336 4337
	status->rx_flags = 0;

4338 4339 4340 4341 4342 4343 4344 4345 4346 4347 4348 4349 4350
	/*
	 * key references and virtual interfaces are protected using RCU
	 * and this requires that we are in a read-side RCU section during
	 * receive processing
	 */
	rcu_read_lock();

	/*
	 * Frames with failed FCS/PLCP checksum are not returned,
	 * all other frames are returned without radiotap header
	 * if it was previously present.
	 * Also, frames with less than 16 bytes are dropped.
	 */
4351
	skb = ieee80211_rx_monitor(local, skb, rate);
4352 4353 4354 4355 4356
	if (!skb) {
		rcu_read_unlock();
		return;
	}

4357 4358 4359
	ieee80211_tpt_led_trig_rx(local,
			((struct ieee80211_hdr *)skb->data)->frame_control,
			skb->len);
4360 4361

	__ieee80211_rx_handle_packet(hw, pubsta, skb, napi);
4362 4363

	rcu_read_unlock();
J
Johannes Berg 已提交
4364 4365 4366 4367

	return;
 drop:
	kfree_skb(skb);
4368
}
4369
EXPORT_SYMBOL(ieee80211_rx_napi);
4370 4371 4372

/* This is a version of the rx handler that can be called from hard irq
 * context. Post the skb on the queue and schedule the tasklet */
4373
void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb)
4374 4375 4376 4377 4378 4379 4380 4381 4382 4383
{
	struct ieee80211_local *local = hw_to_local(hw);

	BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));

	skb->pkt_type = IEEE80211_RX_MSG;
	skb_queue_tail(&local->skb_queue, skb);
	tasklet_schedule(&local->tasklet);
}
EXPORT_SYMBOL(ieee80211_rx_irqsafe);