rx.c 117.6 KB
Newer Older
1 2 3 4
/*
 * Copyright 2002-2005, Instant802 Networks, Inc.
 * Copyright 2005-2006, Devicescape Software, Inc.
 * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
5
 * Copyright 2007-2010	Johannes Berg <johannes@sipsolutions.net>
6
 * Copyright 2013-2014  Intel Mobile Communications GmbH
7
 * Copyright(c) 2015 - 2016 Intel Deutschland GmbH
8 9 10 11 12 13
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

14
#include <linux/jiffies.h>
15
#include <linux/slab.h>
16 17 18 19
#include <linux/kernel.h>
#include <linux/skbuff.h>
#include <linux/netdevice.h>
#include <linux/etherdevice.h>
20
#include <linux/rcupdate.h>
21
#include <linux/export.h>
22
#include <linux/bitops.h>
23 24
#include <net/mac80211.h>
#include <net/ieee80211_radiotap.h>
25
#include <asm/unaligned.h>
26 27

#include "ieee80211_i.h"
28
#include "driver-ops.h"
J
Johannes Berg 已提交
29
#include "led.h"
30
#include "mesh.h"
31 32 33 34
#include "wep.h"
#include "wpa.h"
#include "tkip.h"
#include "wme.h"
35
#include "rate.h"
36

37 38 39 40 41 42 43 44 45 46
static inline void ieee80211_rx_stats(struct net_device *dev, u32 len)
{
	struct pcpu_sw_netstats *tstats = this_cpu_ptr(dev->tstats);

	u64_stats_update_begin(&tstats->syncp);
	tstats->rx_packets++;
	tstats->rx_bytes += len;
	u64_stats_update_end(&tstats->syncp);
}

47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91
static u8 *ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len,
			       enum nl80211_iftype type)
{
	__le16 fc = hdr->frame_control;

	if (ieee80211_is_data(fc)) {
		if (len < 24) /* drop incorrect hdr len (data) */
			return NULL;

		if (ieee80211_has_a4(fc))
			return NULL;
		if (ieee80211_has_tods(fc))
			return hdr->addr1;
		if (ieee80211_has_fromds(fc))
			return hdr->addr2;

		return hdr->addr3;
	}

	if (ieee80211_is_mgmt(fc)) {
		if (len < 24) /* drop incorrect hdr len (mgmt) */
			return NULL;
		return hdr->addr3;
	}

	if (ieee80211_is_ctl(fc)) {
		if (ieee80211_is_pspoll(fc))
			return hdr->addr1;

		if (ieee80211_is_back_req(fc)) {
			switch (type) {
			case NL80211_IFTYPE_STATION:
				return hdr->addr2;
			case NL80211_IFTYPE_AP:
			case NL80211_IFTYPE_AP_VLAN:
				return hdr->addr1;
			default:
				break; /* fall through to the return */
			}
		}
	}

	return NULL;
}

92 93 94 95 96 97 98
/*
 * monitor mode reception
 *
 * This function cleans up the SKB, i.e. it removes all the stuff
 * only useful for monitoring.
 */
static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
99 100
					   struct sk_buff *skb,
					   unsigned int rtap_vendor_space)
101
{
102
	if (ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)) {
103
		if (likely(skb->len > FCS_LEN))
Z
Zhu Yi 已提交
104
			__pskb_trim(skb, skb->len - FCS_LEN);
105 106 107 108
		else {
			/* driver bug */
			WARN_ON(1);
			dev_kfree_skb(skb);
109
			return NULL;
110 111 112
		}
	}

113 114
	__pskb_pull(skb, rtap_vendor_space);

115 116 117
	return skb;
}

118 119
static inline bool should_drop_frame(struct sk_buff *skb, int present_fcs_len,
				     unsigned int rtap_vendor_space)
120
{
121
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
122 123 124
	struct ieee80211_hdr *hdr;

	hdr = (void *)(skb->data + rtap_vendor_space);
125

126
	if (status->flag & (RX_FLAG_FAILED_FCS_CRC |
127 128
			    RX_FLAG_FAILED_PLCP_CRC |
			    RX_FLAG_ONLY_MONITOR))
129 130
		return true;

131
	if (unlikely(skb->len < 16 + present_fcs_len + rtap_vendor_space))
132 133
		return true;

H
Harvey Harrison 已提交
134 135 136
	if (ieee80211_is_ctl(hdr->frame_control) &&
	    !ieee80211_is_pspoll(hdr->frame_control) &&
	    !ieee80211_is_back_req(hdr->frame_control))
137 138 139
		return true;

	return false;
140 141
}

142
static int
143 144 145
ieee80211_rx_radiotap_hdrlen(struct ieee80211_local *local,
			     struct ieee80211_rx_status *status,
			     struct sk_buff *skb)
146 147 148 149
{
	int len;

	/* always present fields */
150
	len = sizeof(struct ieee80211_radiotap_header) + 8;
151

152 153 154
	/* allocate extra bitmaps */
	if (status->chains)
		len += 4 * hweight8(status->chains);
155 156 157

	if (ieee80211_have_rx_timestamp(status)) {
		len = ALIGN(len, 8);
158
		len += 8;
159
	}
160
	if (ieee80211_hw_check(&local->hw, SIGNAL_DBM))
161 162
		len += 1;

163 164 165 166
	/* antenna field, if we don't have per-chain info */
	if (!status->chains)
		len += 1;

167 168
	/* padding for RX_FLAGS if necessary */
	len = ALIGN(len, 2);
169

170 171 172
	if (status->flag & RX_FLAG_HT) /* HT info */
		len += 3;

173
	if (status->flag & RX_FLAG_AMPDU_DETAILS) {
174
		len = ALIGN(len, 4);
175 176 177
		len += 8;
	}

178 179 180 181 182
	if (status->flag & RX_FLAG_VHT) {
		len = ALIGN(len, 2);
		len += 12;
	}

183 184 185 186 187
	if (local->hw.radiotap_timestamp.units_pos >= 0) {
		len = ALIGN(len, 8);
		len += 12;
	}

188 189 190 191 192
	if (status->chains) {
		/* antenna and antenna signal fields */
		len += 2 * hweight8(status->chains);
	}

193 194 195 196 197 198 199 200 201 202 203 204 205 206 207
	if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
		struct ieee80211_vendor_radiotap *rtap = (void *)skb->data;

		/* vendor presence bitmap */
		len += 4;
		/* alignment for fixed 6-byte vendor data header */
		len = ALIGN(len, 2);
		/* vendor data header */
		len += 6;
		if (WARN_ON(rtap->align == 0))
			rtap->align = 1;
		len = ALIGN(len, rtap->align);
		len += rtap->len + rtap->pad;
	}

208 209 210
	return len;
}

211
/*
212 213 214 215 216 217 218 219
 * ieee80211_add_rx_radiotap_header - add radiotap header
 *
 * add a radiotap header containing all the fields which the hardware provided.
 */
static void
ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
				 struct sk_buff *skb,
				 struct ieee80211_rate *rate,
220
				 int rtap_len, bool has_fcs)
221
{
222
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
223 224
	struct ieee80211_radiotap_header *rthdr;
	unsigned char *pos;
225 226
	__le32 *it_present;
	u32 it_present_val;
227
	u16 rx_flags = 0;
228
	u16 channel_flags = 0;
229 230
	int mpdulen, chain;
	unsigned long chains = status->chains;
231 232 233 234 235 236 237
	struct ieee80211_vendor_radiotap rtap = {};

	if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
		rtap = *(struct ieee80211_vendor_radiotap *)skb->data;
		/* rtap.len and rtap.pad are undone immediately */
		skb_pull(skb, sizeof(rtap) + rtap.len + rtap.pad);
	}
238 239

	mpdulen = skb->len;
240
	if (!(has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)))
241
		mpdulen += FCS_LEN;
242 243

	rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len);
244
	memset(rthdr, 0, rtap_len - rtap.len - rtap.pad);
245
	it_present = &rthdr->it_present;
246 247

	/* radiotap header, set always present flags */
248
	rthdr->it_len = cpu_to_le16(rtap_len);
249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264
	it_present_val = BIT(IEEE80211_RADIOTAP_FLAGS) |
			 BIT(IEEE80211_RADIOTAP_CHANNEL) |
			 BIT(IEEE80211_RADIOTAP_RX_FLAGS);

	if (!status->chains)
		it_present_val |= BIT(IEEE80211_RADIOTAP_ANTENNA);

	for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
		it_present_val |=
			BIT(IEEE80211_RADIOTAP_EXT) |
			BIT(IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE);
		put_unaligned_le32(it_present_val, it_present);
		it_present++;
		it_present_val = BIT(IEEE80211_RADIOTAP_ANTENNA) |
				 BIT(IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
	}
265

266 267 268 269 270 271 272 273
	if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
		it_present_val |= BIT(IEEE80211_RADIOTAP_VENDOR_NAMESPACE) |
				  BIT(IEEE80211_RADIOTAP_EXT);
		put_unaligned_le32(it_present_val, it_present);
		it_present++;
		it_present_val = rtap.present;
	}

274 275 276 277
	put_unaligned_le32(it_present_val, it_present);

	pos = (void *)(it_present + 1);

278 279 280
	/* the order of the following fields is important */

	/* IEEE80211_RADIOTAP_TSFT */
281
	if (ieee80211_have_rx_timestamp(status)) {
282 283 284
		/* padding */
		while ((pos - (u8 *)rthdr) & 7)
			*pos++ = 0;
285 286 287 288
		put_unaligned_le64(
			ieee80211_calculate_rx_timestamp(local, status,
							 mpdulen, 0),
			pos);
J
Johannes Berg 已提交
289
		rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
290 291 292 293
		pos += 8;
	}

	/* IEEE80211_RADIOTAP_FLAGS */
294
	if (has_fcs && ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS))
295
		*pos |= IEEE80211_RADIOTAP_F_FCS;
J
Johannes Berg 已提交
296 297
	if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
		*pos |= IEEE80211_RADIOTAP_F_BADFCS;
298 299
	if (status->flag & RX_FLAG_SHORTPRE)
		*pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
300 301 302
	pos++;

	/* IEEE80211_RADIOTAP_RATE */
303
	if (!rate || status->flag & (RX_FLAG_HT | RX_FLAG_VHT)) {
304
		/*
305
		 * Without rate information don't add it. If we have,
306
		 * MCS information is a separate field in radiotap,
307 308
		 * added below. The byte here is needed as padding
		 * for the channel though, so initialise it to 0.
309 310
		 */
		*pos = 0;
311
	} else {
312
		int shift = 0;
313
		rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
314 315 316 317 318
		if (status->flag & RX_FLAG_10MHZ)
			shift = 1;
		else if (status->flag & RX_FLAG_5MHZ)
			shift = 2;
		*pos = DIV_ROUND_UP(rate->bitrate, 5 * (1 << shift));
319
	}
320 321 322
	pos++;

	/* IEEE80211_RADIOTAP_CHANNEL */
323
	put_unaligned_le16(status->freq, pos);
324
	pos += 2;
325 326 327 328 329
	if (status->flag & RX_FLAG_10MHZ)
		channel_flags |= IEEE80211_CHAN_HALF;
	else if (status->flag & RX_FLAG_5MHZ)
		channel_flags |= IEEE80211_CHAN_QUARTER;

330
	if (status->band == NL80211_BAND_5GHZ)
331
		channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ;
332
	else if (status->flag & (RX_FLAG_HT | RX_FLAG_VHT))
333
		channel_flags |= IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
334
	else if (rate && rate->flags & IEEE80211_RATE_ERP_G)
335
		channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ;
336
	else if (rate)
337
		channel_flags |= IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ;
338
	else
339 340
		channel_flags |= IEEE80211_CHAN_2GHZ;
	put_unaligned_le16(channel_flags, pos);
341 342 343
	pos += 2;

	/* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
344
	if (ieee80211_hw_check(&local->hw, SIGNAL_DBM) &&
345
	    !(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
346 347 348 349 350 351 352 353
		*pos = status->signal;
		rthdr->it_present |=
			cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
		pos++;
	}

	/* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */

354 355 356 357 358
	if (!status->chains) {
		/* IEEE80211_RADIOTAP_ANTENNA */
		*pos = status->antenna;
		pos++;
	}
359 360 361 362 363

	/* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */

	/* IEEE80211_RADIOTAP_RX_FLAGS */
	/* ensure 2 byte alignment for the 2 byte field as required */
364
	if ((pos - (u8 *)rthdr) & 1)
365
		*pos++ = 0;
J
Johannes Berg 已提交
366
	if (status->flag & RX_FLAG_FAILED_PLCP_CRC)
367 368
		rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP;
	put_unaligned_le16(rx_flags, pos);
369
	pos += 2;
370 371

	if (status->flag & RX_FLAG_HT) {
372 373
		unsigned int stbc;

374
		rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_MCS);
375
		*pos++ = local->hw.radiotap_mcs_details;
376 377 378 379 380
		*pos = 0;
		if (status->flag & RX_FLAG_SHORT_GI)
			*pos |= IEEE80211_RADIOTAP_MCS_SGI;
		if (status->flag & RX_FLAG_40MHZ)
			*pos |= IEEE80211_RADIOTAP_MCS_BW_40;
381 382
		if (status->flag & RX_FLAG_HT_GF)
			*pos |= IEEE80211_RADIOTAP_MCS_FMT_GF;
383 384
		if (status->flag & RX_FLAG_LDPC)
			*pos |= IEEE80211_RADIOTAP_MCS_FEC_LDPC;
385 386
		stbc = (status->flag & RX_FLAG_STBC_MASK) >> RX_FLAG_STBC_SHIFT;
		*pos |= stbc << IEEE80211_RADIOTAP_MCS_STBC_SHIFT;
387 388 389
		pos++;
		*pos++ = status->rate_idx;
	}
390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416

	if (status->flag & RX_FLAG_AMPDU_DETAILS) {
		u16 flags = 0;

		/* ensure 4 byte alignment */
		while ((pos - (u8 *)rthdr) & 3)
			pos++;
		rthdr->it_present |=
			cpu_to_le32(1 << IEEE80211_RADIOTAP_AMPDU_STATUS);
		put_unaligned_le32(status->ampdu_reference, pos);
		pos += 4;
		if (status->flag & RX_FLAG_AMPDU_LAST_KNOWN)
			flags |= IEEE80211_RADIOTAP_AMPDU_LAST_KNOWN;
		if (status->flag & RX_FLAG_AMPDU_IS_LAST)
			flags |= IEEE80211_RADIOTAP_AMPDU_IS_LAST;
		if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_ERROR)
			flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_ERR;
		if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
			flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_KNOWN;
		put_unaligned_le16(flags, pos);
		pos += 2;
		if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
			*pos++ = status->ampdu_delimiter_crc;
		else
			*pos++ = 0;
		*pos++ = 0;
	}
417

418 419 420 421 422 423 424 425 426
	if (status->flag & RX_FLAG_VHT) {
		u16 known = local->hw.radiotap_vht_details;

		rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_VHT);
		put_unaligned_le16(known, pos);
		pos += 2;
		/* flags */
		if (status->flag & RX_FLAG_SHORT_GI)
			*pos |= IEEE80211_RADIOTAP_VHT_FLAG_SGI;
427 428 429
		/* in VHT, STBC is binary */
		if (status->flag & RX_FLAG_STBC_MASK)
			*pos |= IEEE80211_RADIOTAP_VHT_FLAG_STBC;
430 431
		if (status->vht_flag & RX_VHT_FLAG_BF)
			*pos |= IEEE80211_RADIOTAP_VHT_FLAG_BEAMFORMED;
432 433
		pos++;
		/* bandwidth */
434
		if (status->vht_flag & RX_VHT_FLAG_80MHZ)
435
			*pos++ = 4;
436
		else if (status->vht_flag & RX_VHT_FLAG_160MHZ)
437 438 439 440 441 442 443 444 445
			*pos++ = 11;
		else if (status->flag & RX_FLAG_40MHZ)
			*pos++ = 1;
		else /* 20 MHz */
			*pos++ = 0;
		/* MCS/NSS */
		*pos = (status->rate_idx << 4) | status->vht_nss;
		pos += 4;
		/* coding field */
446 447
		if (status->flag & RX_FLAG_LDPC)
			*pos |= IEEE80211_RADIOTAP_CODING_LDPC_USER0;
448 449 450 451 452 453 454
		pos++;
		/* group ID */
		pos++;
		/* partial_aid */
		pos += 2;
	}

455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479
	if (local->hw.radiotap_timestamp.units_pos >= 0) {
		u16 accuracy = 0;
		u8 flags = IEEE80211_RADIOTAP_TIMESTAMP_FLAG_32BIT;

		rthdr->it_present |=
			cpu_to_le32(1 << IEEE80211_RADIOTAP_TIMESTAMP);

		/* ensure 8 byte alignment */
		while ((pos - (u8 *)rthdr) & 7)
			pos++;

		put_unaligned_le64(status->device_timestamp, pos);
		pos += sizeof(u64);

		if (local->hw.radiotap_timestamp.accuracy >= 0) {
			accuracy = local->hw.radiotap_timestamp.accuracy;
			flags |= IEEE80211_RADIOTAP_TIMESTAMP_FLAG_ACCURACY;
		}
		put_unaligned_le16(accuracy, pos);
		pos += sizeof(u16);

		*pos++ = local->hw.radiotap_timestamp.units_pos;
		*pos++ = flags;
	}

480 481 482 483
	for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
		*pos++ = status->chain_signal[chain];
		*pos++ = chain;
	}
484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499

	if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
		/* ensure 2 byte alignment for the vendor field as required */
		if ((pos - (u8 *)rthdr) & 1)
			*pos++ = 0;
		*pos++ = rtap.oui[0];
		*pos++ = rtap.oui[1];
		*pos++ = rtap.oui[2];
		*pos++ = rtap.subns;
		put_unaligned_le16(rtap.len, pos);
		pos += 2;
		/* align the actual payload as requested */
		while ((pos - (u8 *)rthdr) & (rtap.align - 1))
			*pos++ = 0;
		/* data (and possible padding) already follows */
	}
500 501
}

502 503 504 505 506 507 508
/*
 * This function copies a received frame to all monitor interfaces and
 * returns a cleaned-up SKB that no longer includes the FCS nor the
 * radiotap header the driver might have added.
 */
static struct sk_buff *
ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
509
		     struct ieee80211_rate *rate)
510
{
511
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb);
512
	struct ieee80211_sub_if_data *sdata;
513
	int rt_hdrlen, needed_headroom;
514 515 516
	struct sk_buff *skb, *skb2;
	struct net_device *prev_dev = NULL;
	int present_fcs_len = 0;
517
	unsigned int rtap_vendor_space = 0;
518 519 520
	struct ieee80211_mgmt *mgmt;
	struct ieee80211_sub_if_data *monitor_sdata =
		rcu_dereference(local->monitor_sdata);
521 522 523 524 525 526

	if (unlikely(status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA)) {
		struct ieee80211_vendor_radiotap *rtap = (void *)origskb->data;

		rtap_vendor_space = sizeof(*rtap) + rtap->len + rtap->pad;
	}
527 528 529 530 531 532 533 534 535

	/*
	 * First, we may need to make a copy of the skb because
	 *  (1) we need to modify it for radiotap (if not present), and
	 *  (2) the other RX handlers will modify the skb we got.
	 *
	 * We don't need to, of course, if we aren't going to return
	 * the SKB because it has a bad FCS/PLCP checksum.
	 */
J
Johannes Berg 已提交
536

537
	if (ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS))
538 539
		present_fcs_len = FCS_LEN;

540 541
	/* ensure hdr->frame_control and vendor radiotap data are in skb head */
	if (!pskb_may_pull(origskb, 2 + rtap_vendor_space)) {
Z
Zhu Yi 已提交
542 543 544 545
		dev_kfree_skb(origskb);
		return NULL;
	}

546
	if (!local->monitors || (status->flag & RX_FLAG_SKIP_MONITOR)) {
547 548
		if (should_drop_frame(origskb, present_fcs_len,
				      rtap_vendor_space)) {
549 550 551 552
			dev_kfree_skb(origskb);
			return NULL;
		}

553
		return remove_monitor_info(local, origskb, rtap_vendor_space);
554 555
	}

556
	/* room for the radiotap header based on driver features */
557 558
	rt_hdrlen = ieee80211_rx_radiotap_hdrlen(local, status, origskb);
	needed_headroom = rt_hdrlen - rtap_vendor_space;
559

560
	if (should_drop_frame(origskb, present_fcs_len, rtap_vendor_space)) {
561 562 563 564 565 566 567 568 569 570 571 572
		/* only need to expand headroom if necessary */
		skb = origskb;
		origskb = NULL;

		/*
		 * This shouldn't trigger often because most devices have an
		 * RX header they pull before we get here, and that should
		 * be big enough for our radiotap information. We should
		 * probably export the length to drivers so that we can have
		 * them allocate enough headroom to start with.
		 */
		if (skb_headroom(skb) < needed_headroom &&
573
		    pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
574 575 576 577 578 579 580 581 582 583
			dev_kfree_skb(skb);
			return NULL;
		}
	} else {
		/*
		 * Need to make a copy and possibly remove radiotap header
		 * and FCS from the original.
		 */
		skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC);

584 585
		origskb = remove_monitor_info(local, origskb,
					      rtap_vendor_space);
586 587 588 589 590

		if (!skb)
			return origskb;
	}

J
Johannes Berg 已提交
591
	/* prepend radiotap information */
592
	ieee80211_add_rx_radiotap_header(local, skb, rate, rt_hdrlen, true);
593

594
	skb_reset_mac_header(skb);
595 596 597 598 599
	skb->ip_summed = CHECKSUM_UNNECESSARY;
	skb->pkt_type = PACKET_OTHERHOST;
	skb->protocol = htons(ETH_P_802_2);

	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
600
		if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
601 602
			continue;

603
		if (sdata->u.mntr.flags & MONITOR_FLAG_COOK_FRAMES)
604 605
			continue;

606
		if (!ieee80211_sdata_running(sdata))
607 608
			continue;

609 610 611 612
		if (prev_dev) {
			skb2 = skb_clone(skb, GFP_ATOMIC);
			if (skb2) {
				skb2->dev = prev_dev;
613
				netif_receive_skb(skb2);
614 615 616 617
			}
		}

		prev_dev = sdata->dev;
618
		ieee80211_rx_stats(sdata->dev, skb->len);
619 620
	}

621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637
	mgmt = (void *)skb->data;
	if (monitor_sdata &&
	    skb->len >= IEEE80211_MIN_ACTION_SIZE + 1 + VHT_MUMIMO_GROUPS_DATA_LEN &&
	    ieee80211_is_action(mgmt->frame_control) &&
	    mgmt->u.action.category == WLAN_CATEGORY_VHT &&
	    mgmt->u.action.u.vht_group_notif.action_code == WLAN_VHT_ACTION_GROUPID_MGMT &&
	    is_valid_ether_addr(monitor_sdata->u.mntr.mu_follow_addr) &&
	    ether_addr_equal(mgmt->da, monitor_sdata->u.mntr.mu_follow_addr)) {
		struct sk_buff *mu_skb = skb_copy(skb, GFP_ATOMIC);

		if (mu_skb) {
			mu_skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
			skb_queue_tail(&monitor_sdata->skb_queue, mu_skb);
			ieee80211_queue_work(&local->hw, &monitor_sdata->work);
		}
	}

638 639
	if (prev_dev) {
		skb->dev = prev_dev;
640
		netif_receive_skb(skb);
641 642 643 644 645 646
	} else
		dev_kfree_skb(skb);

	return origskb;
}

647
static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
648
{
649
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
650
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
651
	int tid, seqno_idx, security_idx;
652 653

	/* does the frame have a qos control field? */
654 655
	if (ieee80211_is_data_qos(hdr->frame_control)) {
		u8 *qc = ieee80211_get_qos_ctl(hdr);
656
		/* frame has qos control */
657
		tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
658
		if (*qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT)
659
			status->rx_flags |= IEEE80211_RX_AMSDU;
660 661 662

		seqno_idx = tid;
		security_idx = tid;
663
	} else {
664 665 666 667 668 669 670 671 672 673 674
		/*
		 * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):
		 *
		 *	Sequence numbers for management frames, QoS data
		 *	frames with a broadcast/multicast address in the
		 *	Address 1 field, and all non-QoS data frames sent
		 *	by QoS STAs are assigned using an additional single
		 *	modulo-4096 counter, [...]
		 *
		 * We also use that counter for non-QoS STAs.
		 */
675
		seqno_idx = IEEE80211_NUM_TIDS;
676 677
		security_idx = 0;
		if (ieee80211_is_mgmt(hdr->frame_control))
678
			security_idx = IEEE80211_NUM_TIDS;
679
		tid = 0;
680
	}
681

682 683
	rx->seqno_idx = seqno_idx;
	rx->security_idx = security_idx;
684 685 686
	/* Set skb->priority to 1d tag if highest order bit of TID is not set.
	 * For now, set skb->priority to 0 for other cases. */
	rx->skb->priority = (tid > 7) ? 0 : tid;
687
}
688

689 690 691 692 693 694 695 696 697 698 699
/**
 * DOC: Packet alignment
 *
 * Drivers always need to pass packets that are aligned to two-byte boundaries
 * to the stack.
 *
 * Additionally, should, if possible, align the payload data in a way that
 * guarantees that the contained IP header is aligned to a four-byte
 * boundary. In the case of regular frames, this simply means aligning the
 * payload to a four-byte boundary (because either the IP header is directly
 * contained, or IV/RFC1042 headers that have a length divisible by four are
700 701 702
 * in front of it).  If the payload data is not properly aligned and the
 * architecture doesn't support efficient unaligned operations, mac80211
 * will align the data.
703 704 705 706 707 708 709
 *
 * With A-MSDU frames, however, the payload data address must yield two modulo
 * four because there are 14-byte 802.3 headers within the A-MSDU frames that
 * push the IP header further back to a multiple of four again. Thankfully, the
 * specs were sane enough this time around to require padding each A-MSDU
 * subframe to a length that is a multiple of four.
 *
L
Lucas De Marchi 已提交
710
 * Padding like Atheros hardware adds which is between the 802.11 header and
711 712 713 714
 * the payload is not supported, the driver is required to move the 802.11
 * header to be directly in front of the payload in that case.
 */
static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
715
{
716
#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
717
	WARN_ON_ONCE((unsigned long)rx->skb->data & 1);
718
#endif
719 720
}

721

722 723
/* rx handlers */

724 725 726 727
static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
{
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;

728
	if (is_multicast_ether_addr(hdr->addr1))
729 730
		return 0;

731
	return ieee80211_is_robust_mgmt_frame(skb);
732 733 734 735 736 737 738
}


static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb)
{
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;

739
	if (!is_multicast_ether_addr(hdr->addr1))
740 741
		return 0;

742
	return ieee80211_is_robust_mgmt_frame(skb);
743 744 745 746 747 748 749 750
}


/* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */
static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
{
	struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data;
	struct ieee80211_mmie *mmie;
751
	struct ieee80211_mmie_16 *mmie16;
752

J
Johannes Berg 已提交
753
	if (skb->len < 24 + sizeof(*mmie) || !is_multicast_ether_addr(hdr->da))
754 755
		return -1;

756
	if (!ieee80211_is_robust_mgmt_frame(skb))
757 758 759 760
		return -1; /* not a robust management frame */

	mmie = (struct ieee80211_mmie *)
		(skb->data + skb->len - sizeof(*mmie));
761 762 763 764 765 766 767 768 769 770 771 772
	if (mmie->element_id == WLAN_EID_MMIE &&
	    mmie->length == sizeof(*mmie) - 2)
		return le16_to_cpu(mmie->key_id);

	mmie16 = (struct ieee80211_mmie_16 *)
		(skb->data + skb->len - sizeof(*mmie16));
	if (skb->len >= 24 + sizeof(*mmie16) &&
	    mmie16->element_id == WLAN_EID_MMIE &&
	    mmie16->length == sizeof(*mmie16) - 2)
		return le16_to_cpu(mmie16->key_id);

	return -1;
773 774
}

775 776
static int ieee80211_get_cs_keyid(const struct ieee80211_cipher_scheme *cs,
				  struct sk_buff *skb)
777 778 779 780 781 782 783 784 785 786 787 788 789 790 791 792 793 794 795
{
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
	__le16 fc;
	int hdrlen;
	u8 keyid;

	fc = hdr->frame_control;
	hdrlen = ieee80211_hdrlen(fc);

	if (skb->len < hdrlen + cs->hdr_len)
		return -EINVAL;

	skb_copy_bits(skb, hdrlen + cs->key_idx_off, &keyid, 1);
	keyid &= cs->key_idx_mask;
	keyid >>= cs->key_idx_shift;

	return keyid;
}

J
Johannes Berg 已提交
796
static ieee80211_rx_result ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
797
{
798
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
799
	char *dev_addr = rx->sdata->vif.addr;
800

801
	if (ieee80211_is_data(hdr->frame_control)) {
802 803
		if (is_multicast_ether_addr(hdr->addr1)) {
			if (ieee80211_has_tods(hdr->frame_control) ||
J
Johannes Berg 已提交
804
			    !ieee80211_has_fromds(hdr->frame_control))
805
				return RX_DROP_MONITOR;
806
			if (ether_addr_equal(hdr->addr3, dev_addr))
807 808 809 810
				return RX_DROP_MONITOR;
		} else {
			if (!ieee80211_has_a4(hdr->frame_control))
				return RX_DROP_MONITOR;
811
			if (ether_addr_equal(hdr->addr4, dev_addr))
812 813
				return RX_DROP_MONITOR;
		}
814 815 816 817 818 819
	}

	/* If there is not an established peer link and this is not a peer link
	 * establisment frame, beacon or probe, drop the frame.
	 */

820
	if (!rx->sta || sta_plink_state(rx->sta) != NL80211_PLINK_ESTAB) {
821
		struct ieee80211_mgmt *mgmt;
822

823
		if (!ieee80211_is_mgmt(hdr->frame_control))
824 825
			return RX_DROP_MONITOR;

826
		if (ieee80211_is_action(hdr->frame_control)) {
827
			u8 category;
828 829 830 831 832

			/* make sure category field is present */
			if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE)
				return RX_DROP_MONITOR;

833
			mgmt = (struct ieee80211_mgmt *)hdr;
834 835
			category = mgmt->u.action.category;
			if (category != WLAN_CATEGORY_MESH_ACTION &&
J
Johannes Berg 已提交
836
			    category != WLAN_CATEGORY_SELF_PROTECTED)
837 838 839 840
				return RX_DROP_MONITOR;
			return RX_CONTINUE;
		}

841 842
		if (ieee80211_is_probe_req(hdr->frame_control) ||
		    ieee80211_is_probe_resp(hdr->frame_control) ||
843 844
		    ieee80211_is_beacon(hdr->frame_control) ||
		    ieee80211_is_auth(hdr->frame_control))
845 846 847 848 849
			return RX_CONTINUE;

		return RX_DROP_MONITOR;
	}

J
Johannes Berg 已提交
850 851
	return RX_CONTINUE;
}
852

853 854 855 856 857 858 859
static inline bool ieee80211_rx_reorder_ready(struct tid_ampdu_rx *tid_agg_rx,
					      int index)
{
	struct sk_buff_head *frames = &tid_agg_rx->reorder_buf[index];
	struct sk_buff *tail = skb_peek_tail(frames);
	struct ieee80211_rx_status *status;

860 861 862
	if (tid_agg_rx->reorder_buf_filtered & BIT_ULL(index))
		return true;

863 864 865 866 867 868 869 870 871 872
	if (!tail)
		return false;

	status = IEEE80211_SKB_RXCB(tail);
	if (status->flag & RX_FLAG_AMSDU_MORE)
		return false;

	return true;
}

873
static void ieee80211_release_reorder_frame(struct ieee80211_sub_if_data *sdata,
874
					    struct tid_ampdu_rx *tid_agg_rx,
875 876
					    int index,
					    struct sk_buff_head *frames)
877
{
878 879
	struct sk_buff_head *skb_list = &tid_agg_rx->reorder_buf[index];
	struct sk_buff *skb;
880
	struct ieee80211_rx_status *status;
881

882 883
	lockdep_assert_held(&tid_agg_rx->reorder_lock);

884
	if (skb_queue_empty(skb_list))
885 886
		goto no_frame;

887
	if (!ieee80211_rx_reorder_ready(tid_agg_rx, index)) {
888 889 890 891 892
		__skb_queue_purge(skb_list);
		goto no_frame;
	}

	/* release frames from the reorder ring buffer */
893
	tid_agg_rx->stored_mpdu_num--;
894 895 896 897 898
	while ((skb = __skb_dequeue(skb_list))) {
		status = IEEE80211_SKB_RXCB(skb);
		status->rx_flags |= IEEE80211_RX_DEFERRED_RELEASE;
		__skb_queue_tail(frames, skb);
	}
899 900

no_frame:
901
	tid_agg_rx->reorder_buf_filtered &= ~BIT_ULL(index);
902
	tid_agg_rx->head_seq_num = ieee80211_sn_inc(tid_agg_rx->head_seq_num);
903 904
}

905
static void ieee80211_release_reorder_frames(struct ieee80211_sub_if_data *sdata,
906
					     struct tid_ampdu_rx *tid_agg_rx,
907 908
					     u16 head_seq_num,
					     struct sk_buff_head *frames)
909 910 911
{
	int index;

912 913
	lockdep_assert_held(&tid_agg_rx->reorder_lock);

914
	while (ieee80211_sn_less(tid_agg_rx->head_seq_num, head_seq_num)) {
915
		index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
916 917
		ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
						frames);
918 919 920 921 922 923 924 925 926
	}
}

/*
 * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If
 * the skb was added to the buffer longer than this time ago, the earlier
 * frames that have not yet been received are assumed to be lost and the skb
 * can be released for processing. This may also release other skb's from the
 * reorder buffer if there are no additional gaps between the frames.
927 928
 *
 * Callers must hold tid_agg_rx->reorder_lock.
929 930 931
 */
#define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)

932
static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata,
933 934
					  struct tid_ampdu_rx *tid_agg_rx,
					  struct sk_buff_head *frames)
935
{
936
	int index, i, j;
937

938 939
	lockdep_assert_held(&tid_agg_rx->reorder_lock);

940
	/* release the buffer until next missing frame */
941
	index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
942
	if (!ieee80211_rx_reorder_ready(tid_agg_rx, index) &&
943
	    tid_agg_rx->stored_mpdu_num) {
944 945 946 947 948 949 950
		/*
		 * No buffers ready to be released, but check whether any
		 * frames in the reorder buffer have timed out.
		 */
		int skipped = 1;
		for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
		     j = (j + 1) % tid_agg_rx->buf_size) {
951
			if (!ieee80211_rx_reorder_ready(tid_agg_rx, j)) {
952 953 954
				skipped++;
				continue;
			}
955 956
			if (skipped &&
			    !time_after(jiffies, tid_agg_rx->reorder_time[j] +
957
					HT_RX_REORDER_BUF_TIMEOUT))
958
				goto set_release_timer;
959

960 961 962 963 964
			/* don't leave incomplete A-MSDUs around */
			for (i = (index + 1) % tid_agg_rx->buf_size; i != j;
			     i = (i + 1) % tid_agg_rx->buf_size)
				__skb_queue_purge(&tid_agg_rx->reorder_buf[i]);

J
Johannes Berg 已提交
965 966
			ht_dbg_ratelimited(sdata,
					   "release an RX reorder frame due to timeout on earlier frames\n");
967 968
			ieee80211_release_reorder_frame(sdata, tid_agg_rx, j,
							frames);
969 970 971 972 973

			/*
			 * Increment the head seq# also for the skipped slots.
			 */
			tid_agg_rx->head_seq_num =
974 975
				(tid_agg_rx->head_seq_num +
				 skipped) & IEEE80211_SN_MASK;
976 977
			skipped = 0;
		}
978
	} else while (ieee80211_rx_reorder_ready(tid_agg_rx, index)) {
979 980
		ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
						frames);
981
		index =	tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
982
	}
983 984

	if (tid_agg_rx->stored_mpdu_num) {
985
		j = index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
986 987 988

		for (; j != (index - 1) % tid_agg_rx->buf_size;
		     j = (j + 1) % tid_agg_rx->buf_size) {
989
			if (ieee80211_rx_reorder_ready(tid_agg_rx, j))
990 991 992 993 994
				break;
		}

 set_release_timer:

995 996 997 998
		if (!tid_agg_rx->removed)
			mod_timer(&tid_agg_rx->reorder_timer,
				  tid_agg_rx->reorder_time[j] + 1 +
				  HT_RX_REORDER_BUF_TIMEOUT);
999 1000 1001
	} else {
		del_timer(&tid_agg_rx->reorder_timer);
	}
1002 1003
}

1004 1005 1006 1007 1008
/*
 * As this function belongs to the RX path it must be under
 * rcu_read_lock protection. It returns false if the frame
 * can be processed immediately, true if it was consumed.
 */
1009
static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata,
1010
					     struct tid_ampdu_rx *tid_agg_rx,
1011 1012
					     struct sk_buff *skb,
					     struct sk_buff_head *frames)
1013 1014
{
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1015
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1016 1017 1018 1019
	u16 sc = le16_to_cpu(hdr->seq_ctrl);
	u16 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
	u16 head_seq_num, buf_size;
	int index;
1020
	bool ret = true;
1021

1022 1023
	spin_lock(&tid_agg_rx->reorder_lock);

1024 1025 1026 1027 1028 1029 1030 1031 1032 1033
	/*
	 * Offloaded BA sessions have no known starting sequence number so pick
	 * one from first Rxed frame for this tid after BA was started.
	 */
	if (unlikely(tid_agg_rx->auto_seq)) {
		tid_agg_rx->auto_seq = false;
		tid_agg_rx->ssn = mpdu_seq_num;
		tid_agg_rx->head_seq_num = mpdu_seq_num;
	}

1034 1035 1036 1037
	buf_size = tid_agg_rx->buf_size;
	head_seq_num = tid_agg_rx->head_seq_num;

	/* frame with out of date sequence number */
1038
	if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) {
1039
		dev_kfree_skb(skb);
1040
		goto out;
1041 1042 1043 1044 1045 1046
	}

	/*
	 * If frame the sequence number exceeds our buffering window
	 * size release some previous frames to make room for this one.
	 */
1047 1048 1049
	if (!ieee80211_sn_less(mpdu_seq_num, head_seq_num + buf_size)) {
		head_seq_num = ieee80211_sn_inc(
				ieee80211_sn_sub(mpdu_seq_num, buf_size));
1050
		/* release stored frames up to new head to stack */
1051
		ieee80211_release_reorder_frames(sdata, tid_agg_rx,
1052
						 head_seq_num, frames);
1053 1054 1055 1056
	}

	/* Now the new frame is always in the range of the reordering buffer */

1057
	index = mpdu_seq_num % tid_agg_rx->buf_size;
1058 1059

	/* check if we already stored this frame */
1060
	if (ieee80211_rx_reorder_ready(tid_agg_rx, index)) {
1061
		dev_kfree_skb(skb);
1062
		goto out;
1063 1064 1065 1066 1067
	}

	/*
	 * If the current MPDU is in the right order and nothing else
	 * is stored we can process it directly, no need to buffer it.
1068 1069
	 * If it is first but there's something stored, we may be able
	 * to release frames after this one.
1070 1071 1072
	 */
	if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
	    tid_agg_rx->stored_mpdu_num == 0) {
1073 1074 1075
		if (!(status->flag & RX_FLAG_AMSDU_MORE))
			tid_agg_rx->head_seq_num =
				ieee80211_sn_inc(tid_agg_rx->head_seq_num);
1076 1077
		ret = false;
		goto out;
1078 1079 1080
	}

	/* put the frame in the reordering buffer */
1081 1082 1083 1084 1085 1086
	__skb_queue_tail(&tid_agg_rx->reorder_buf[index], skb);
	if (!(status->flag & RX_FLAG_AMSDU_MORE)) {
		tid_agg_rx->reorder_time[index] = jiffies;
		tid_agg_rx->stored_mpdu_num++;
		ieee80211_sta_reorder_release(sdata, tid_agg_rx, frames);
	}
1087

1088 1089 1090
 out:
	spin_unlock(&tid_agg_rx->reorder_lock);
	return ret;
1091 1092 1093 1094 1095 1096
}

/*
 * Reorder MPDUs from A-MPDUs, keeping them on a buffer. Returns
 * true if the MPDU was buffered, false if it should be processed.
 */
1097 1098
static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx,
				       struct sk_buff_head *frames)
1099
{
1100 1101
	struct sk_buff *skb = rx->skb;
	struct ieee80211_local *local = rx->local;
1102
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
1103
	struct sta_info *sta = rx->sta;
1104 1105
	struct tid_ampdu_rx *tid_agg_rx;
	u16 sc;
1106
	u8 tid, ack_policy;
1107

1108 1109
	if (!ieee80211_is_data_qos(hdr->frame_control) ||
	    is_multicast_ether_addr(hdr->addr1))
1110
		goto dont_reorder;
1111 1112 1113 1114 1115 1116 1117

	/*
	 * filter the QoS data rx stream according to
	 * STA/TID and check if this STA/TID is on aggregation
	 */

	if (!sta)
1118
		goto dont_reorder;
1119

1120 1121
	ack_policy = *ieee80211_get_qos_ctl(hdr) &
		     IEEE80211_QOS_CTL_ACK_POLICY_MASK;
1122 1123
	tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;

1124 1125 1126
	tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
	if (!tid_agg_rx)
		goto dont_reorder;
1127 1128 1129

	/* qos null data frames are excluded */
	if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
1130
		goto dont_reorder;
1131

1132 1133 1134 1135 1136
	/* not part of a BA session */
	if (ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK &&
	    ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_NORMAL)
		goto dont_reorder;

1137 1138 1139 1140
	/* new, potentially un-ordered, ampdu frame - process it */

	/* reset session timer */
	if (tid_agg_rx->timeout)
1141
		tid_agg_rx->last_rx = jiffies;
1142 1143 1144 1145

	/* if this mpdu is fragmented - terminate rx aggregation session */
	sc = le16_to_cpu(hdr->seq_ctrl);
	if (sc & IEEE80211_SCTL_FRAG) {
1146
		skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
1147 1148
		skb_queue_tail(&rx->sdata->skb_queue, skb);
		ieee80211_queue_work(&local->hw, &rx->sdata->work);
1149
		return;
1150 1151
	}

1152 1153 1154 1155 1156 1157 1158
	/*
	 * No locking needed -- we will only ever process one
	 * RX packet at a time, and thus own tid_agg_rx. All
	 * other code manipulating it needs to (and does) make
	 * sure that we cannot get to it any more before doing
	 * anything with it.
	 */
1159 1160
	if (ieee80211_sta_manage_reorder_buf(rx->sdata, tid_agg_rx, skb,
					     frames))
1161 1162 1163
		return;

 dont_reorder:
1164
	__skb_queue_tail(frames, skb);
1165
}
1166

1167
static ieee80211_rx_result debug_noinline
1168
ieee80211_rx_h_check_dup(struct ieee80211_rx_data *rx)
1169
{
1170
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1171
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1172

1173 1174 1175
	if (status->flag & RX_FLAG_DUP_VALIDATED)
		return RX_CONTINUE;

1176 1177 1178 1179
	/*
	 * Drop duplicate 802.11 retransmissions
	 * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery")
	 */
1180 1181 1182 1183 1184 1185 1186 1187 1188

	if (rx->skb->len < 24)
		return RX_CONTINUE;

	if (ieee80211_is_ctl(hdr->frame_control) ||
	    ieee80211_is_qos_nullfunc(hdr->frame_control) ||
	    is_multicast_ether_addr(hdr->addr1))
		return RX_CONTINUE;

1189 1190 1191 1192 1193 1194
	if (!rx->sta)
		return RX_CONTINUE;

	if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
		     rx->sta->last_seq_ctrl[rx->seqno_idx] == hdr->seq_ctrl)) {
		I802_DEBUG_INC(rx->local->dot11FrameDuplicateCount);
1195
		rx->sta->rx_stats.num_duplicates++;
1196 1197 1198
		return RX_DROP_UNUSABLE;
	} else if (!(status->flag & RX_FLAG_AMSDU_MORE)) {
		rx->sta->last_seq_ctrl[rx->seqno_idx] = hdr->seq_ctrl;
1199 1200
	}

1201 1202 1203 1204 1205 1206 1207 1208
	return RX_CONTINUE;
}

static ieee80211_rx_result debug_noinline
ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
{
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;

1209 1210 1211
	/* Drop disallowed frame classes based on STA auth/assoc state;
	 * IEEE 802.11, Chap 5.5.
	 *
J
Johannes Berg 已提交
1212 1213
	 * mac80211 filters only based on association state, i.e. it drops
	 * Class 3 frames from not associated stations. hostapd sends
1214 1215 1216
	 * deauth/disassoc frames when needed. In addition, hostapd is
	 * responsible for filtering on both auth and assoc states.
	 */
1217

J
Johannes Berg 已提交
1218
	if (ieee80211_vif_is_mesh(&rx->sdata->vif))
1219 1220
		return ieee80211_rx_mesh_check(rx);

1221 1222
	if (unlikely((ieee80211_is_data(hdr->frame_control) ||
		      ieee80211_is_pspoll(hdr->frame_control)) &&
1223
		     rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
B
Bill Jordan 已提交
1224
		     rx->sdata->vif.type != NL80211_IFTYPE_WDS &&
1225
		     rx->sdata->vif.type != NL80211_IFTYPE_OCB &&
J
Johannes Berg 已提交
1226
		     (!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_ASSOC)))) {
1227 1228 1229 1230 1231 1232
		/*
		 * accept port control frames from the AP even when it's not
		 * yet marked ASSOC to prevent a race where we don't set the
		 * assoc bit quickly enough before it sends the first frame
		 */
		if (rx->sta && rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
1233
		    ieee80211_is_data_present(hdr->frame_control)) {
1234 1235 1236 1237 1238 1239 1240 1241 1242 1243
			unsigned int hdrlen;
			__be16 ethertype;

			hdrlen = ieee80211_hdrlen(hdr->frame_control);

			if (rx->skb->len < hdrlen + 8)
				return RX_DROP_MONITOR;

			skb_copy_bits(rx->skb, hdrlen + 6, &ethertype, 2);
			if (ethertype == rx->sdata->control_port_protocol)
1244 1245
				return RX_CONTINUE;
		}
1246 1247 1248 1249 1250 1251 1252

		if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
		    cfg80211_rx_spurious_frame(rx->sdata->dev,
					       hdr->addr2,
					       GFP_ATOMIC))
			return RX_DROP_UNUSABLE;

J
Johannes Berg 已提交
1253
		return RX_DROP_MONITOR;
1254
	}
1255

1256
	return RX_CONTINUE;
1257 1258 1259
}


1260 1261 1262 1263 1264 1265 1266 1267 1268 1269 1270 1271 1272 1273 1274 1275 1276 1277 1278 1279 1280 1281 1282 1283 1284 1285 1286 1287 1288 1289 1290 1291 1292
static ieee80211_rx_result debug_noinline
ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx)
{
	struct ieee80211_local *local;
	struct ieee80211_hdr *hdr;
	struct sk_buff *skb;

	local = rx->local;
	skb = rx->skb;
	hdr = (struct ieee80211_hdr *) skb->data;

	if (!local->pspolling)
		return RX_CONTINUE;

	if (!ieee80211_has_fromds(hdr->frame_control))
		/* this is not from AP */
		return RX_CONTINUE;

	if (!ieee80211_is_data(hdr->frame_control))
		return RX_CONTINUE;

	if (!ieee80211_has_moredata(hdr->frame_control)) {
		/* AP has no more frames buffered for us */
		local->pspolling = false;
		return RX_CONTINUE;
	}

	/* more data bit is set, let's request a new frame from the AP */
	ieee80211_send_pspoll(local, rx->sdata);

	return RX_CONTINUE;
}

1293
static void sta_ps_start(struct sta_info *sta)
1294
{
1295
	struct ieee80211_sub_if_data *sdata = sta->sdata;
1296
	struct ieee80211_local *local = sdata->local;
1297
	struct ps_data *ps;
1298
	int tid;
1299

1300 1301 1302 1303 1304 1305 1306
	if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
	    sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
		ps = &sdata->bss->ps;
	else
		return;

	atomic_inc(&ps->num_sta_ps);
J
Johannes Berg 已提交
1307
	set_sta_flag(sta, WLAN_STA_PS_STA);
1308
	if (!ieee80211_hw_check(&local->hw, AP_LINK_PS))
1309
		drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta);
J
Johannes Berg 已提交
1310 1311
	ps_dbg(sdata, "STA %pM aid %d enters power save mode\n",
	       sta->sta.addr, sta->sta.aid);
1312

J
Johannes Berg 已提交
1313 1314
	ieee80211_clear_fast_xmit(sta);

1315 1316 1317 1318 1319 1320
	if (!sta->sta.txq[0])
		return;

	for (tid = 0; tid < ARRAY_SIZE(sta->sta.txq); tid++) {
		struct txq_info *txqi = to_txq_info(sta->sta.txq[tid]);

1321
		if (txqi->tin.backlog_packets)
1322 1323 1324 1325
			set_bit(tid, &sta->txq_buffered_tids);
		else
			clear_bit(tid, &sta->txq_buffered_tids);
	}
1326 1327
}

1328
static void sta_ps_end(struct sta_info *sta)
1329
{
J
Johannes Berg 已提交
1330 1331
	ps_dbg(sta->sdata, "STA %pM aid %d exits power save mode\n",
	       sta->sta.addr, sta->sta.aid);
1332

J
Johannes Berg 已提交
1333
	if (test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
1334 1335 1336 1337 1338 1339 1340
		/*
		 * Clear the flag only if the other one is still set
		 * so that the TX path won't start TX'ing new frames
		 * directly ... In the case that the driver flag isn't
		 * set ieee80211_sta_ps_deliver_wakeup() will clear it.
		 */
		clear_sta_flag(sta, WLAN_STA_PS_STA);
J
Johannes Berg 已提交
1341 1342
		ps_dbg(sta->sdata, "STA %pM aid %d driver-ps-blocked\n",
		       sta->sta.addr, sta->sta.aid);
1343 1344 1345
		return;
	}

1346 1347
	set_sta_flag(sta, WLAN_STA_PS_DELIVER);
	clear_sta_flag(sta, WLAN_STA_PS_STA);
1348
	ieee80211_sta_ps_deliver_wakeup(sta);
1349 1350
}

1351
int ieee80211_sta_ps_transition(struct ieee80211_sta *pubsta, bool start)
1352
{
1353
	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
1354 1355
	bool in_ps;

1356
	WARN_ON(!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS));
1357 1358

	/* Don't let the same PS state be set twice */
1359
	in_ps = test_sta_flag(sta, WLAN_STA_PS_STA);
1360 1361 1362 1363
	if ((start && in_ps) || (!start && !in_ps))
		return -EINVAL;

	if (start)
1364
		sta_ps_start(sta);
1365
	else
1366
		sta_ps_end(sta);
1367 1368 1369 1370 1371

	return 0;
}
EXPORT_SYMBOL(ieee80211_sta_ps_transition);

1372 1373 1374 1375 1376 1377 1378 1379 1380 1381 1382 1383 1384 1385 1386 1387 1388 1389 1390 1391 1392 1393 1394 1395 1396 1397 1398 1399 1400 1401 1402 1403 1404 1405 1406 1407 1408 1409 1410 1411
void ieee80211_sta_pspoll(struct ieee80211_sta *pubsta)
{
	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);

	if (test_sta_flag(sta, WLAN_STA_SP))
		return;

	if (!test_sta_flag(sta, WLAN_STA_PS_DRIVER))
		ieee80211_sta_ps_deliver_poll_response(sta);
	else
		set_sta_flag(sta, WLAN_STA_PSPOLL);
}
EXPORT_SYMBOL(ieee80211_sta_pspoll);

void ieee80211_sta_uapsd_trigger(struct ieee80211_sta *pubsta, u8 tid)
{
	struct sta_info *sta = container_of(pubsta, struct sta_info, sta);
	u8 ac = ieee802_1d_to_ac[tid & 7];

	/*
	 * If this AC is not trigger-enabled do nothing.
	 *
	 * NB: This could/should check a separate bitmap of trigger-
	 * enabled queues, but for now we only implement uAPSD w/o
	 * TSPEC changes to the ACs, so they're always the same.
	 */
	if (!(sta->sta.uapsd_queues & BIT(ac)))
		return;

	/* if we are in a service period, do nothing */
	if (test_sta_flag(sta, WLAN_STA_SP))
		return;

	if (!test_sta_flag(sta, WLAN_STA_PS_DRIVER))
		ieee80211_sta_ps_deliver_uapsd(sta);
	else
		set_sta_flag(sta, WLAN_STA_UAPSD);
}
EXPORT_SYMBOL(ieee80211_sta_uapsd_trigger);

J
Johannes Berg 已提交
1412 1413 1414 1415 1416 1417 1418
static ieee80211_rx_result debug_noinline
ieee80211_rx_h_uapsd_and_pspoll(struct ieee80211_rx_data *rx)
{
	struct ieee80211_sub_if_data *sdata = rx->sdata;
	struct ieee80211_hdr *hdr = (void *)rx->skb->data;
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);

1419
	if (!rx->sta)
J
Johannes Berg 已提交
1420 1421 1422 1423 1424 1425 1426 1427 1428 1429 1430
		return RX_CONTINUE;

	if (sdata->vif.type != NL80211_IFTYPE_AP &&
	    sdata->vif.type != NL80211_IFTYPE_AP_VLAN)
		return RX_CONTINUE;

	/*
	 * The device handles station powersave, so don't do anything about
	 * uAPSD and PS-Poll frames (the latter shouldn't even come up from
	 * it to mac80211 since they're handled.)
	 */
1431
	if (ieee80211_hw_check(&sdata->local->hw, AP_LINK_PS))
J
Johannes Berg 已提交
1432 1433 1434 1435 1436 1437 1438
		return RX_CONTINUE;

	/*
	 * Don't do anything if the station isn't already asleep. In
	 * the uAPSD case, the station will probably be marked asleep,
	 * in the PS-Poll case the station must be confused ...
	 */
J
Johannes Berg 已提交
1439
	if (!test_sta_flag(rx->sta, WLAN_STA_PS_STA))
J
Johannes Berg 已提交
1440 1441 1442
		return RX_CONTINUE;

	if (unlikely(ieee80211_is_pspoll(hdr->frame_control))) {
1443
		ieee80211_sta_pspoll(&rx->sta->sta);
J
Johannes Berg 已提交
1444 1445 1446 1447 1448 1449 1450 1451 1452 1453 1454

		/* Free PS Poll skb here instead of returning RX_DROP that would
		 * count as an dropped frame. */
		dev_kfree_skb(rx->skb);

		return RX_QUEUED;
	} else if (!ieee80211_has_morefrags(hdr->frame_control) &&
		   !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
		   ieee80211_has_pm(hdr->frame_control) &&
		   (ieee80211_is_data_qos(hdr->frame_control) ||
		    ieee80211_is_qos_nullfunc(hdr->frame_control))) {
1455
		u8 tid;
J
Johannes Berg 已提交
1456

1457
		tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
J
Johannes Berg 已提交
1458

1459
		ieee80211_sta_uapsd_trigger(&rx->sta->sta, tid);
J
Johannes Berg 已提交
1460 1461 1462 1463 1464
	}

	return RX_CONTINUE;
}

1465
static ieee80211_rx_result debug_noinline
1466
ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
1467 1468
{
	struct sta_info *sta = rx->sta;
J
Johannes Berg 已提交
1469 1470 1471
	struct sk_buff *skb = rx->skb;
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1472
	int i;
1473 1474

	if (!sta)
1475
		return RX_CONTINUE;
1476

J
Johannes Berg 已提交
1477 1478
	/*
	 * Update last_rx only for IBSS packets which are for the current
1479 1480 1481 1482 1483
	 * BSSID and for station already AUTHORIZED to avoid keeping the
	 * current IBSS network alive in cases where other STAs start
	 * using different BSSID. This will also give the station another
	 * chance to restart the authentication/authorization in case
	 * something went wrong the first time.
J
Johannes Berg 已提交
1484
	 */
1485
	if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
1486
		u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
1487
						NL80211_IFTYPE_ADHOC);
1488 1489
		if (ether_addr_equal(bssid, rx->sdata->u.ibss.bssid) &&
		    test_sta_flag(sta, WLAN_STA_AUTHORIZED)) {
1490
			sta->rx_stats.last_rx = jiffies;
1491
			if (ieee80211_is_data(hdr->frame_control) &&
1492 1493 1494
			    !is_multicast_ether_addr(hdr->addr1))
				sta->rx_stats.last_rate =
					sta_stats_encode_rate(status);
1495
		}
1496
	} else if (rx->sdata->vif.type == NL80211_IFTYPE_OCB) {
1497
		sta->rx_stats.last_rx = jiffies;
J
Johannes Berg 已提交
1498 1499
	} else if (!is_multicast_ether_addr(hdr->addr1)) {
		/*
1500 1501
		 * Mesh beacons will update last_rx when if they are found to
		 * match the current local configuration when processed.
1502
		 */
1503
		sta->rx_stats.last_rx = jiffies;
1504 1505
		if (ieee80211_is_data(hdr->frame_control))
			sta->rx_stats.last_rate = sta_stats_encode_rate(status);
1506 1507
	}

1508 1509 1510
	if (rx->sdata->vif.type == NL80211_IFTYPE_STATION)
		ieee80211_sta_rx_notify(rx->sdata, hdr);

1511
	sta->rx_stats.fragments++;
1512 1513

	u64_stats_update_begin(&rx->sta->rx_stats.syncp);
1514
	sta->rx_stats.bytes += rx->skb->len;
1515 1516
	u64_stats_update_end(&rx->sta->rx_stats.syncp);

1517
	if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
1518
		sta->rx_stats.last_signal = status->signal;
1519
		ewma_signal_add(&sta->rx_stats_avg.signal, -status->signal);
1520
	}
1521

1522
	if (status->chains) {
1523
		sta->rx_stats.chains = status->chains;
1524 1525 1526 1527 1528 1529
		for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {
			int signal = status->chain_signal[i];

			if (!(status->chains & BIT(i)))
				continue;

1530
			sta->rx_stats.chain_signal_last[i] = signal;
1531
			ewma_signal_add(&sta->rx_stats_avg.chain_signal[i],
1532
					-signal);
1533 1534 1535
		}
	}

1536 1537 1538 1539
	/*
	 * Change STA power saving mode only at the end of a frame
	 * exchange sequence.
	 */
1540
	if (!ieee80211_hw_check(&sta->local->hw, AP_LINK_PS) &&
1541
	    !ieee80211_has_morefrags(hdr->frame_control) &&
1542
	    !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
1543
	    (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1544 1545 1546 1547 1548 1549 1550
	     rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
	    /* PM bit is only checked in frames where it isn't reserved,
	     * in AP mode it's reserved in non-bufferable management frames
	     * (cf. IEEE 802.11-2012 8.2.4.1.7 Power Management field)
	     */
	    (!ieee80211_is_mgmt(hdr->frame_control) ||
	     ieee80211_is_bufferable_mmpdu(hdr->frame_control))) {
J
Johannes Berg 已提交
1551
		if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
1552
			if (!ieee80211_has_pm(hdr->frame_control))
1553
				sta_ps_end(sta);
1554 1555
		} else {
			if (ieee80211_has_pm(hdr->frame_control))
1556
				sta_ps_start(sta);
1557
		}
1558 1559
	}

M
Marco Porsch 已提交
1560 1561 1562 1563
	/* mesh power save support */
	if (ieee80211_vif_is_mesh(&rx->sdata->vif))
		ieee80211_mps_rx_h_sta_process(sta, hdr);

1564 1565 1566 1567 1568 1569
	/*
	 * Drop (qos-)data::nullfunc frames silently, since they
	 * are used only to control station power saving mode.
	 */
	if (ieee80211_is_nullfunc(hdr->frame_control) ||
	    ieee80211_is_qos_nullfunc(hdr->frame_control)) {
1570
		I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
1571 1572 1573

		/*
		 * If we receive a 4-addr nullfunc frame from a STA
1574 1575 1576
		 * that was not moved to a 4-addr STA vlan yet send
		 * the event to userspace and for older hostapd drop
		 * the frame to the monitor interface.
1577 1578 1579 1580
		 */
		if (ieee80211_has_a4(hdr->frame_control) &&
		    (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
		     (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1581 1582 1583 1584 1585
		      !rx->sdata->u.vlan.sta))) {
			if (!test_and_set_sta_flag(sta, WLAN_STA_4ADDR_EVENT))
				cfg80211_rx_unexpected_4addr_frame(
					rx->sdata->dev, sta->sta.addr,
					GFP_ATOMIC);
1586
			return RX_DROP_MONITOR;
1587
		}
1588 1589 1590 1591
		/*
		 * Update counter and free packet here to avoid
		 * counting this as a dropped packed.
		 */
1592
		sta->rx_stats.packets++;
1593
		dev_kfree_skb(rx->skb);
1594
		return RX_QUEUED;
1595 1596
	}

1597
	return RX_CONTINUE;
1598 1599
} /* ieee80211_rx_h_sta_process */

1600 1601 1602 1603 1604 1605 1606 1607 1608 1609 1610 1611
static ieee80211_rx_result debug_noinline
ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
{
	struct sk_buff *skb = rx->skb;
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
	int keyidx;
	int hdrlen;
	ieee80211_rx_result result = RX_DROP_UNUSABLE;
	struct ieee80211_key *sta_ptk = NULL;
	int mmie_keyidx = -1;
	__le16 fc;
1612
	const struct ieee80211_cipher_scheme *cs = NULL;
1613 1614 1615 1616 1617 1618 1619 1620 1621 1622 1623 1624 1625 1626 1627 1628 1629 1630 1631 1632 1633 1634 1635 1636 1637 1638 1639 1640 1641 1642

	/*
	 * Key selection 101
	 *
	 * There are four types of keys:
	 *  - GTK (group keys)
	 *  - IGTK (group keys for management frames)
	 *  - PTK (pairwise keys)
	 *  - STK (station-to-station pairwise keys)
	 *
	 * When selecting a key, we have to distinguish between multicast
	 * (including broadcast) and unicast frames, the latter can only
	 * use PTKs and STKs while the former always use GTKs and IGTKs.
	 * Unless, of course, actual WEP keys ("pre-RSNA") are used, then
	 * unicast frames can also use key indices like GTKs. Hence, if we
	 * don't have a PTK/STK we check the key index for a WEP key.
	 *
	 * Note that in a regular BSS, multicast frames are sent by the
	 * AP only, associated stations unicast the frame to the AP first
	 * which then multicasts it on their behalf.
	 *
	 * There is also a slight problem in IBSS mode: GTKs are negotiated
	 * with each station, that is something we don't currently handle.
	 * The spec seems to expect that one negotiates the same key with
	 * every station but there's no such requirement; VLANs could be
	 * possible.
	 */

	/* start without a key */
	rx->key = NULL;
1643
	fc = hdr->frame_control;
1644

1645 1646
	if (rx->sta) {
		int keyid = rx->sta->ptk_idx;
1647

1648 1649
		if (ieee80211_has_protected(fc) && rx->sta->cipher_scheme) {
			cs = rx->sta->cipher_scheme;
1650
			keyid = ieee80211_get_cs_keyid(cs, rx->skb);
1651 1652 1653 1654 1655
			if (unlikely(keyid < 0))
				return RX_DROP_UNUSABLE;
		}
		sta_ptk = rcu_dereference(rx->sta->ptk[keyid]);
	}
1656 1657 1658 1659 1660 1661 1662 1663 1664 1665 1666 1667 1668 1669 1670 1671 1672 1673 1674 1675 1676

	if (!ieee80211_has_protected(fc))
		mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);

	if (!is_multicast_ether_addr(hdr->addr1) && sta_ptk) {
		rx->key = sta_ptk;
		if ((status->flag & RX_FLAG_DECRYPTED) &&
		    (status->flag & RX_FLAG_IV_STRIPPED))
			return RX_CONTINUE;
		/* Skip decryption if the frame is not protected. */
		if (!ieee80211_has_protected(fc))
			return RX_CONTINUE;
	} else if (mmie_keyidx >= 0) {
		/* Broadcast/multicast robust management frame / BIP */
		if ((status->flag & RX_FLAG_DECRYPTED) &&
		    (status->flag & RX_FLAG_IV_STRIPPED))
			return RX_CONTINUE;

		if (mmie_keyidx < NUM_DEFAULT_KEYS ||
		    mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
			return RX_DROP_MONITOR; /* unexpected BIP keyidx */
1677 1678 1679 1680 1681
		if (rx->sta) {
			if (ieee80211_is_group_privacy_action(skb) &&
			    test_sta_flag(rx->sta, WLAN_STA_MFP))
				return RX_DROP_MONITOR;

1682
			rx->key = rcu_dereference(rx->sta->gtk[mmie_keyidx]);
1683
		}
1684 1685 1686 1687 1688 1689 1690 1691 1692 1693 1694 1695 1696 1697 1698 1699 1700 1701 1702 1703 1704 1705 1706 1707 1708 1709 1710 1711 1712 1713 1714 1715 1716 1717 1718 1719 1720 1721
		if (!rx->key)
			rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]);
	} else if (!ieee80211_has_protected(fc)) {
		/*
		 * The frame was not protected, so skip decryption. However, we
		 * need to set rx->key if there is a key that could have been
		 * used so that the frame may be dropped if encryption would
		 * have been expected.
		 */
		struct ieee80211_key *key = NULL;
		struct ieee80211_sub_if_data *sdata = rx->sdata;
		int i;

		if (ieee80211_is_mgmt(fc) &&
		    is_multicast_ether_addr(hdr->addr1) &&
		    (key = rcu_dereference(rx->sdata->default_mgmt_key)))
			rx->key = key;
		else {
			if (rx->sta) {
				for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
					key = rcu_dereference(rx->sta->gtk[i]);
					if (key)
						break;
				}
			}
			if (!key) {
				for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
					key = rcu_dereference(sdata->keys[i]);
					if (key)
						break;
				}
			}
			if (key)
				rx->key = key;
		}
		return RX_CONTINUE;
	} else {
		u8 keyid;
1722

1723 1724 1725 1726 1727 1728 1729 1730 1731 1732 1733 1734 1735 1736 1737
		/*
		 * The device doesn't give us the IV so we won't be
		 * able to look up the key. That's ok though, we
		 * don't need to decrypt the frame, we just won't
		 * be able to keep statistics accurate.
		 * Except for key threshold notifications, should
		 * we somehow allow the driver to tell us which key
		 * the hardware used if this flag is set?
		 */
		if ((status->flag & RX_FLAG_DECRYPTED) &&
		    (status->flag & RX_FLAG_IV_STRIPPED))
			return RX_CONTINUE;

		hdrlen = ieee80211_hdrlen(fc);

1738
		if (cs) {
1739
			keyidx = ieee80211_get_cs_keyid(cs, rx->skb);
1740

1741 1742 1743 1744 1745 1746 1747 1748 1749 1750 1751 1752
			if (unlikely(keyidx < 0))
				return RX_DROP_UNUSABLE;
		} else {
			if (rx->skb->len < 8 + hdrlen)
				return RX_DROP_UNUSABLE; /* TODO: count this? */
			/*
			 * no need to call ieee80211_wep_get_keyidx,
			 * it verifies a bunch of things we've done already
			 */
			skb_copy_bits(rx->skb, hdrlen + 3, &keyid, 1);
			keyidx = keyid >> 6;
		}
1753 1754 1755 1756 1757 1758 1759 1760 1761 1762 1763 1764 1765 1766 1767 1768 1769 1770 1771 1772 1773 1774 1775 1776 1777 1778 1779 1780 1781 1782 1783 1784 1785 1786 1787 1788 1789 1790 1791 1792

		/* check per-station GTK first, if multicast packet */
		if (is_multicast_ether_addr(hdr->addr1) && rx->sta)
			rx->key = rcu_dereference(rx->sta->gtk[keyidx]);

		/* if not found, try default key */
		if (!rx->key) {
			rx->key = rcu_dereference(rx->sdata->keys[keyidx]);

			/*
			 * RSNA-protected unicast frames should always be
			 * sent with pairwise or station-to-station keys,
			 * but for WEP we allow using a key index as well.
			 */
			if (rx->key &&
			    rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 &&
			    rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 &&
			    !is_multicast_ether_addr(hdr->addr1))
				rx->key = NULL;
		}
	}

	if (rx->key) {
		if (unlikely(rx->key->flags & KEY_FLAG_TAINTED))
			return RX_DROP_MONITOR;

		/* TODO: add threshold stuff again */
	} else {
		return RX_DROP_MONITOR;
	}

	switch (rx->key->conf.cipher) {
	case WLAN_CIPHER_SUITE_WEP40:
	case WLAN_CIPHER_SUITE_WEP104:
		result = ieee80211_crypto_wep_decrypt(rx);
		break;
	case WLAN_CIPHER_SUITE_TKIP:
		result = ieee80211_crypto_tkip_decrypt(rx);
		break;
	case WLAN_CIPHER_SUITE_CCMP:
J
Jouni Malinen 已提交
1793 1794 1795 1796 1797 1798
		result = ieee80211_crypto_ccmp_decrypt(
			rx, IEEE80211_CCMP_MIC_LEN);
		break;
	case WLAN_CIPHER_SUITE_CCMP_256:
		result = ieee80211_crypto_ccmp_decrypt(
			rx, IEEE80211_CCMP_256_MIC_LEN);
1799 1800 1801 1802
		break;
	case WLAN_CIPHER_SUITE_AES_CMAC:
		result = ieee80211_crypto_aes_cmac_decrypt(rx);
		break;
1803 1804 1805
	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
		result = ieee80211_crypto_aes_cmac_256_decrypt(rx);
		break;
1806 1807 1808 1809
	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
		result = ieee80211_crypto_aes_gmac_decrypt(rx);
		break;
1810 1811 1812 1813
	case WLAN_CIPHER_SUITE_GCMP:
	case WLAN_CIPHER_SUITE_GCMP_256:
		result = ieee80211_crypto_gcmp_decrypt(rx);
		break;
1814
	default:
1815
		result = ieee80211_crypto_hw_decrypt(rx);
1816 1817 1818 1819 1820 1821 1822 1823 1824 1825
	}

	/* the hdr variable is invalid after the decrypt handlers */

	/* either the frame has been decrypted or will be dropped */
	status->flag |= RX_FLAG_DECRYPTED;

	return result;
}

1826 1827 1828 1829 1830 1831 1832 1833 1834 1835 1836
static inline struct ieee80211_fragment_entry *
ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
			 unsigned int frag, unsigned int seq, int rx_queue,
			 struct sk_buff **skb)
{
	struct ieee80211_fragment_entry *entry;

	entry = &sdata->fragments[sdata->fragment_next++];
	if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
		sdata->fragment_next = 0;

J
Johannes Berg 已提交
1837
	if (!skb_queue_empty(&entry->skb_list))
1838 1839 1840 1841 1842 1843 1844 1845
		__skb_queue_purge(&entry->skb_list);

	__skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
	*skb = NULL;
	entry->first_frag_time = jiffies;
	entry->seq = seq;
	entry->rx_queue = rx_queue;
	entry->last_frag = frag;
1846
	entry->check_sequential_pn = false;
1847 1848 1849 1850 1851 1852 1853
	entry->extra_len = 0;

	return entry;
}

static inline struct ieee80211_fragment_entry *
ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
1854
			  unsigned int frag, unsigned int seq,
1855 1856 1857 1858 1859 1860 1861 1862 1863 1864 1865 1866 1867 1868 1869 1870 1871 1872 1873
			  int rx_queue, struct ieee80211_hdr *hdr)
{
	struct ieee80211_fragment_entry *entry;
	int i, idx;

	idx = sdata->fragment_next;
	for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
		struct ieee80211_hdr *f_hdr;

		idx--;
		if (idx < 0)
			idx = IEEE80211_FRAGMENT_MAX - 1;

		entry = &sdata->fragments[idx];
		if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
		    entry->rx_queue != rx_queue ||
		    entry->last_frag + 1 != frag)
			continue;

1874
		f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data;
1875

1876 1877 1878 1879 1880
		/*
		 * Check ftype and addresses are equal, else check next fragment
		 */
		if (((hdr->frame_control ^ f_hdr->frame_control) &
		     cpu_to_le16(IEEE80211_FCTL_FTYPE)) ||
1881 1882
		    !ether_addr_equal(hdr->addr1, f_hdr->addr1) ||
		    !ether_addr_equal(hdr->addr2, f_hdr->addr2))
1883 1884
			continue;

1885
		if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
1886 1887 1888 1889 1890 1891 1892 1893 1894
			__skb_queue_purge(&entry->skb_list);
			continue;
		}
		return entry;
	}

	return NULL;
}

1895
static ieee80211_rx_result debug_noinline
1896
ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
1897 1898 1899
{
	struct ieee80211_hdr *hdr;
	u16 sc;
1900
	__le16 fc;
1901 1902 1903
	unsigned int frag, seq;
	struct ieee80211_fragment_entry *entry;
	struct sk_buff *skb;
1904
	struct ieee80211_rx_status *status;
1905

1906
	hdr = (struct ieee80211_hdr *)rx->skb->data;
1907
	fc = hdr->frame_control;
1908 1909 1910 1911

	if (ieee80211_is_ctl(fc))
		return RX_CONTINUE;

1912 1913 1914
	sc = le16_to_cpu(hdr->seq_ctrl);
	frag = sc & IEEE80211_SCTL_FRAG;

1915
	if (is_multicast_ether_addr(hdr->addr1)) {
1916
		I802_DEBUG_INC(rx->local->dot11MulticastReceivedFrameCount);
1917
		goto out_no_led;
1918
	}
1919

1920 1921 1922
	if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
		goto out;

1923 1924
	I802_DEBUG_INC(rx->local->rx_handlers_fragments);

Z
Zhu Yi 已提交
1925 1926 1927
	if (skb_linearize(rx->skb))
		return RX_DROP_UNUSABLE;

1928 1929 1930 1931 1932 1933
	/*
	 *  skb_linearize() might change the skb->data and
	 *  previously cached variables (in this case, hdr) need to
	 *  be refreshed with the new data.
	 */
	hdr = (struct ieee80211_hdr *)rx->skb->data;
1934 1935 1936 1937 1938
	seq = (sc & IEEE80211_SCTL_SEQ) >> 4;

	if (frag == 0) {
		/* This is the first fragment of a new frame. */
		entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
1939
						 rx->seqno_idx, &(rx->skb));
J
Jouni Malinen 已提交
1940 1941
		if (rx->key &&
		    (rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP ||
1942 1943 1944
		     rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP_256 ||
		     rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP ||
		     rx->key->conf.cipher == WLAN_CIPHER_SUITE_GCMP_256) &&
1945
		    ieee80211_has_protected(fc)) {
1946
			int queue = rx->security_idx;
1947 1948 1949 1950 1951

			/* Store CCMP/GCMP PN so that we can verify that the
			 * next fragment has a sequential PN value.
			 */
			entry->check_sequential_pn = true;
1952
			memcpy(entry->last_pn,
1953
			       rx->key->u.ccmp.rx_pn[queue],
1954
			       IEEE80211_CCMP_PN_LEN);
1955 1956 1957 1958 1959 1960 1961 1962
			BUILD_BUG_ON(offsetof(struct ieee80211_key,
					      u.ccmp.rx_pn) !=
				     offsetof(struct ieee80211_key,
					      u.gcmp.rx_pn));
			BUILD_BUG_ON(sizeof(rx->key->u.ccmp.rx_pn[queue]) !=
				     sizeof(rx->key->u.gcmp.rx_pn[queue]));
			BUILD_BUG_ON(IEEE80211_CCMP_PN_LEN !=
				     IEEE80211_GCMP_PN_LEN);
1963
		}
1964
		return RX_QUEUED;
1965 1966 1967 1968 1969
	}

	/* This is a fragment for a frame that should already be pending in
	 * fragment cache. Add this fragment to the end of the pending entry.
	 */
1970 1971
	entry = ieee80211_reassemble_find(rx->sdata, frag, seq,
					  rx->seqno_idx, hdr);
1972 1973
	if (!entry) {
		I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
J
Johannes Berg 已提交
1974
		return RX_DROP_MONITOR;
1975 1976
	}

1977 1978 1979 1980 1981 1982
	/* "The receiver shall discard MSDUs and MMPDUs whose constituent
	 *  MPDU PN values are not incrementing in steps of 1."
	 * see IEEE P802.11-REVmc/D5.0, 12.5.3.4.4, item d (for CCMP)
	 * and IEEE P802.11-REVmc/D5.0, 12.5.5.4.4, item d (for GCMP)
	 */
	if (entry->check_sequential_pn) {
1983
		int i;
1984
		u8 pn[IEEE80211_CCMP_PN_LEN], *rpn;
1985
		int queue;
1986

J
Jouni Malinen 已提交
1987 1988
		if (!rx->key ||
		    (rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP &&
1989 1990 1991
		     rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP_256 &&
		     rx->key->conf.cipher != WLAN_CIPHER_SUITE_GCMP &&
		     rx->key->conf.cipher != WLAN_CIPHER_SUITE_GCMP_256))
J
Johannes Berg 已提交
1992
			return RX_DROP_UNUSABLE;
1993 1994
		memcpy(pn, entry->last_pn, IEEE80211_CCMP_PN_LEN);
		for (i = IEEE80211_CCMP_PN_LEN - 1; i >= 0; i--) {
1995 1996 1997 1998
			pn[i]++;
			if (pn[i])
				break;
		}
1999
		queue = rx->security_idx;
2000
		rpn = rx->key->u.ccmp.rx_pn[queue];
2001
		if (memcmp(pn, rpn, IEEE80211_CCMP_PN_LEN))
J
Johannes Berg 已提交
2002
			return RX_DROP_UNUSABLE;
2003
		memcpy(entry->last_pn, pn, IEEE80211_CCMP_PN_LEN);
2004 2005
	}

2006
	skb_pull(rx->skb, ieee80211_hdrlen(fc));
2007 2008 2009
	__skb_queue_tail(&entry->skb_list, rx->skb);
	entry->last_frag = frag;
	entry->extra_len += rx->skb->len;
2010
	if (ieee80211_has_morefrags(fc)) {
2011
		rx->skb = NULL;
2012
		return RX_QUEUED;
2013 2014 2015 2016
	}

	rx->skb = __skb_dequeue(&entry->skb_list);
	if (skb_tailroom(rx->skb) < entry->extra_len) {
2017
		I802_DEBUG_INC(rx->local->rx_expand_skb_head_defrag);
2018 2019 2020 2021
		if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
					      GFP_ATOMIC))) {
			I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
			__skb_queue_purge(&entry->skb_list);
J
Johannes Berg 已提交
2022
			return RX_DROP_UNUSABLE;
2023 2024 2025 2026 2027 2028 2029 2030
		}
	}
	while ((skb = __skb_dequeue(&entry->skb_list))) {
		memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len);
		dev_kfree_skb(skb);
	}

	/* Complete frame has been reassembled - process it now */
2031
	status = IEEE80211_SKB_RXCB(rx->skb);
2032 2033

 out:
2034 2035
	ieee80211_led_rx(rx->local);
 out_no_led:
2036
	if (rx->sta)
2037
		rx->sta->rx_stats.packets++;
2038
	return RX_CONTINUE;
2039 2040
}

J
Johannes Berg 已提交
2041
static int ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
2042
{
J
Johannes Berg 已提交
2043
	if (unlikely(!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_AUTHORIZED)))
2044
		return -EACCES;
2045

2046
	return 0;
2047 2048
}

J
Johannes Berg 已提交
2049
static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
2050
{
J
Johannes Berg 已提交
2051 2052 2053
	struct sk_buff *skb = rx->skb;
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);

2054
	/*
2055 2056
	 * Pass through unencrypted frames if the hardware has
	 * decrypted them already.
2057
	 */
J
Johannes Berg 已提交
2058
	if (status->flag & RX_FLAG_DECRYPTED)
2059
		return 0;
2060 2061

	/* Drop unencrypted frames if key is set. */
2062 2063
	if (unlikely(!ieee80211_has_protected(fc) &&
		     !ieee80211_is_nullfunc(fc) &&
2064
		     ieee80211_is_data(fc) && rx->key))
2065
		return -EACCES;
2066 2067 2068 2069

	return 0;
}

J
Johannes Berg 已提交
2070
static int ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)
2071 2072
{
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
2073
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2074 2075
	__le16 fc = hdr->frame_control;

2076 2077 2078 2079 2080 2081
	/*
	 * Pass through unencrypted frames if the hardware has
	 * decrypted them already.
	 */
	if (status->flag & RX_FLAG_DECRYPTED)
		return 0;
2082

J
Johannes Berg 已提交
2083
	if (rx->sta && test_sta_flag(rx->sta, WLAN_STA_MFP)) {
2084 2085
		if (unlikely(!ieee80211_has_protected(fc) &&
			     ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
2086
			     rx->key)) {
2087 2088 2089 2090 2091
			if (ieee80211_is_deauth(fc) ||
			    ieee80211_is_disassoc(fc))
				cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
							     rx->skb->data,
							     rx->skb->len);
2092
			return -EACCES;
2093
		}
2094
		/* BIP does not use Protected field, so need to check MMIE */
2095
		if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
2096
			     ieee80211_get_mmie_keyidx(rx->skb) < 0)) {
2097 2098 2099 2100 2101
			if (ieee80211_is_deauth(fc) ||
			    ieee80211_is_disassoc(fc))
				cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
							     rx->skb->data,
							     rx->skb->len);
2102
			return -EACCES;
2103
		}
2104 2105 2106 2107 2108
		/*
		 * When using MFP, Action frames are not allowed prior to
		 * having configured keys.
		 */
		if (unlikely(ieee80211_is_action(fc) && !rx->key &&
2109
			     ieee80211_is_robust_mgmt_frame(rx->skb)))
2110 2111
			return -EACCES;
	}
2112

2113
	return 0;
2114 2115
}

2116
static int
2117
__ieee80211_data_to_8023(struct ieee80211_rx_data *rx, bool *port_control)
2118
{
J
Johannes Berg 已提交
2119
	struct ieee80211_sub_if_data *sdata = rx->sdata;
2120
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
2121 2122 2123
	bool check_port_control = false;
	struct ethhdr *ehdr;
	int ret;
2124

2125
	*port_control = false;
2126 2127
	if (ieee80211_has_a4(hdr->frame_control) &&
	    sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta)
2128
		return -1;
2129

2130 2131 2132 2133 2134 2135 2136 2137 2138
	if (sdata->vif.type == NL80211_IFTYPE_STATION &&
	    !!sdata->u.mgd.use_4addr != !!ieee80211_has_a4(hdr->frame_control)) {

		if (!sdata->u.mgd.use_4addr)
			return -1;
		else
			check_port_control = true;
	}

2139
	if (is_multicast_ether_addr(hdr->addr1) &&
2140
	    sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta)
2141
		return -1;
2142

2143
	ret = ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type);
2144
	if (ret < 0)
2145 2146 2147
		return ret;

	ehdr = (struct ethhdr *) rx->skb->data;
2148 2149 2150
	if (ehdr->h_proto == rx->sdata->control_port_protocol)
		*port_control = true;
	else if (check_port_control)
2151 2152 2153
		return -1;

	return 0;
2154
}
2155

2156 2157 2158
/*
 * requires that rx->skb is a frame with ethernet header
 */
2159
static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
2160
{
2161
	static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
2162 2163 2164 2165 2166 2167 2168
		= { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
	struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;

	/*
	 * Allow EAPOL frames to us/the PAE group address regardless
	 * of whether the frame was encrypted or not.
	 */
2169
	if (ehdr->h_proto == rx->sdata->control_port_protocol &&
2170 2171
	    (ether_addr_equal(ehdr->h_dest, rx->sdata->vif.addr) ||
	     ether_addr_equal(ehdr->h_dest, pae_group_addr)))
2172 2173 2174
		return true;

	if (ieee80211_802_1x_port_control(rx) ||
2175
	    ieee80211_drop_unencrypted(rx, fc))
2176 2177 2178 2179 2180 2181 2182 2183
		return false;

	return true;
}

/*
 * requires that rx->skb is a frame with ethernet header
 */
2184
static void
2185
ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
2186
{
J
Johannes Berg 已提交
2187 2188
	struct ieee80211_sub_if_data *sdata = rx->sdata;
	struct net_device *dev = sdata->dev;
2189
	struct sk_buff *skb, *xmit_skb;
2190 2191
	struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
	struct sta_info *dsta;
2192

2193 2194
	skb = rx->skb;
	xmit_skb = NULL;
2195

2196 2197
	ieee80211_rx_stats(dev, skb->len);

2198 2199 2200 2201 2202 2203
	if (rx->sta) {
		/* The seqno index has the same property as needed
		 * for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS
		 * for non-QoS-data frames. Here we know it's a data
		 * frame, so count MSDUs.
		 */
2204
		u64_stats_update_begin(&rx->sta->rx_stats.syncp);
2205
		rx->sta->rx_stats.msdu[rx->seqno_idx]++;
2206
		u64_stats_update_end(&rx->sta->rx_stats.syncp);
2207 2208
	}

2209 2210
	if ((sdata->vif.type == NL80211_IFTYPE_AP ||
	     sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
2211
	    !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
2212
	    (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) {
2213 2214 2215 2216 2217
		if (is_multicast_ether_addr(ehdr->h_dest)) {
			/*
			 * send multicast frames both to higher layers in
			 * local net stack and back to the wireless medium
			 */
2218
			xmit_skb = skb_copy(skb, GFP_ATOMIC);
2219
			if (!xmit_skb)
J
Johannes Berg 已提交
2220
				net_info_ratelimited("%s: failed to clone multicast frame\n",
2221
						    dev->name);
2222
		} else {
2223 2224
			dsta = sta_info_get(sdata, skb->data);
			if (dsta) {
2225 2226 2227 2228 2229
				/*
				 * The destination station is associated to
				 * this AP (in this VLAN), so send the frame
				 * directly to it and do not pass it to local
				 * net stack.
2230
				 */
2231
				xmit_skb = skb;
2232 2233 2234 2235 2236
				skb = NULL;
			}
		}
	}

2237
#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
2238 2239 2240 2241 2242 2243
	if (skb) {
		/* 'align' will only take the values 0 or 2 here since all
		 * frames are required to be aligned to 2-byte boundaries
		 * when being passed to mac80211; the code here works just
		 * as well if that isn't true, but mac80211 assumes it can
		 * access fields as 2-byte aligned (e.g. for ether_addr_equal)
2244
		 */
2245 2246 2247
		int align;

		align = (unsigned long)(skb->data + sizeof(struct ethhdr)) & 3;
2248 2249 2250 2251 2252 2253
		if (align) {
			if (WARN_ON(skb_headroom(skb) < 3)) {
				dev_kfree_skb(skb);
				skb = NULL;
			} else {
				u8 *data = skb->data;
2254 2255 2256 2257
				size_t len = skb_headlen(skb);
				skb->data -= align;
				memmove(skb->data, data, len);
				skb_set_tail_pointer(skb, len);
2258 2259
			}
		}
2260
	}
2261 2262
#endif

2263 2264 2265 2266
	if (skb) {
		/* deliver to local stack */
		skb->protocol = eth_type_trans(skb, dev);
		memset(skb->cb, 0, sizeof(skb->cb));
2267 2268
		if (rx->napi)
			napi_gro_receive(rx->napi, skb);
J
Johannes Berg 已提交
2269 2270
		else
			netif_receive_skb(skb);
2271 2272
	}

2273
	if (xmit_skb) {
2274 2275 2276 2277 2278 2279
		/*
		 * Send to wireless media and increase priority by 256 to
		 * keep the received priority instead of reclassifying
		 * the frame (see cfg80211_classify8021d).
		 */
		xmit_skb->priority += 256;
2280
		xmit_skb->protocol = htons(ETH_P_802_3);
2281 2282
		skb_reset_network_header(xmit_skb);
		skb_reset_mac_header(xmit_skb);
2283
		dev_queue_xmit(xmit_skb);
2284
	}
2285 2286
}

2287
static ieee80211_rx_result debug_noinline
2288
ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
2289
{
J
Johannes Berg 已提交
2290
	struct net_device *dev = rx->sdata->dev;
Z
Zhu Yi 已提交
2291
	struct sk_buff *skb = rx->skb;
2292 2293
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
	__le16 fc = hdr->frame_control;
Z
Zhu Yi 已提交
2294
	struct sk_buff_head frame_list;
2295
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2296

2297
	if (unlikely(!ieee80211_is_data(fc)))
2298
		return RX_CONTINUE;
2299

2300
	if (unlikely(!ieee80211_is_data_present(fc)))
J
Johannes Berg 已提交
2301
		return RX_DROP_MONITOR;
2302

2303
	if (!(status->rx_flags & IEEE80211_RX_AMSDU))
2304
		return RX_CONTINUE;
2305

Z
Zhu Yi 已提交
2306 2307 2308
	if (ieee80211_has_a4(hdr->frame_control) &&
	    rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
	    !rx->sdata->u.vlan.sta)
J
Johannes Berg 已提交
2309
		return RX_DROP_UNUSABLE;
2310

Z
Zhu Yi 已提交
2311 2312 2313 2314 2315
	if (is_multicast_ether_addr(hdr->addr1) &&
	    ((rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
	      rx->sdata->u.vlan.sta) ||
	     (rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
	      rx->sdata->u.mgd.use_4addr)))
J
Johannes Berg 已提交
2316
		return RX_DROP_UNUSABLE;
2317

Z
Zhu Yi 已提交
2318 2319
	skb->dev = dev;
	__skb_queue_head_init(&frame_list);
2320

Z
Zhu Yi 已提交
2321 2322
	ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
				 rx->sdata->vif.type,
2323
				 rx->local->hw.extra_tx_headroom, true);
2324

Z
Zhu Yi 已提交
2325 2326
	while (!skb_queue_empty(&frame_list)) {
		rx->skb = __skb_dequeue(&frame_list);
2327

2328
		if (!ieee80211_frame_allowed(rx, fc)) {
Z
Zhu Yi 已提交
2329
			dev_kfree_skb(rx->skb);
2330 2331
			continue;
		}
2332 2333 2334 2335

		ieee80211_deliver_skb(rx);
	}

2336
	return RX_QUEUED;
2337 2338
}

I
Ingo Molnar 已提交
2339
#ifdef CONFIG_MAC80211_MESH
2340
static ieee80211_rx_result
2341 2342
ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
{
2343 2344
	struct ieee80211_hdr *fwd_hdr, *hdr;
	struct ieee80211_tx_info *info;
2345 2346
	struct ieee80211s_hdr *mesh_hdr;
	struct sk_buff *skb = rx->skb, *fwd_skb;
J
Johannes Berg 已提交
2347
	struct ieee80211_local *local = rx->local;
J
Johannes Berg 已提交
2348
	struct ieee80211_sub_if_data *sdata = rx->sdata;
2349
	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
2350
	u16 ac, q, hdrlen;
2351 2352 2353

	hdr = (struct ieee80211_hdr *) skb->data;
	hdrlen = ieee80211_hdrlen(hdr->frame_control);
2354 2355 2356 2357 2358 2359 2360 2361 2362 2363 2364 2365 2366 2367

	/* make sure fixed part of mesh header is there, also checks skb len */
	if (!pskb_may_pull(rx->skb, hdrlen + 6))
		return RX_DROP_MONITOR;

	mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);

	/* make sure full mesh header is there, also checks skb len */
	if (!pskb_may_pull(rx->skb,
			   hdrlen + ieee80211_get_mesh_hdrlen(mesh_hdr)))
		return RX_DROP_MONITOR;

	/* reload pointers */
	hdr = (struct ieee80211_hdr *) skb->data;
2368 2369
	mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);

2370 2371 2372
	if (ieee80211_drop_unencrypted(rx, hdr->frame_control))
		return RX_DROP_MONITOR;

2373 2374 2375
	/* frame is in RMC, don't forward */
	if (ieee80211_is_data(hdr->frame_control) &&
	    is_multicast_ether_addr(hdr->addr1) &&
J
Johannes Berg 已提交
2376
	    mesh_rmc_check(rx->sdata, hdr->addr3, mesh_hdr))
2377 2378
		return RX_DROP_MONITOR;

2379
	if (!ieee80211_is_data(hdr->frame_control))
2380 2381 2382 2383 2384
		return RX_CONTINUE;

	if (!mesh_hdr->ttl)
		return RX_DROP_MONITOR;

2385
	if (mesh_hdr->flags & MESH_FLAGS_AE) {
2386
		struct mesh_path *mppath;
2387 2388 2389 2390 2391 2392
		char *proxied_addr;
		char *mpp_addr;

		if (is_multicast_ether_addr(hdr->addr1)) {
			mpp_addr = hdr->addr3;
			proxied_addr = mesh_hdr->eaddr1;
2393 2394
		} else if (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6) {
			/* has_a4 already checked in ieee80211_rx_mesh_check */
2395 2396
			mpp_addr = hdr->addr4;
			proxied_addr = mesh_hdr->eaddr2;
2397 2398
		} else {
			return RX_DROP_MONITOR;
2399
		}
2400 2401

		rcu_read_lock();
J
Johannes Berg 已提交
2402
		mppath = mpp_path_lookup(sdata, proxied_addr);
2403
		if (!mppath) {
J
Johannes Berg 已提交
2404
			mpp_path_add(sdata, proxied_addr, mpp_addr);
2405 2406
		} else {
			spin_lock_bh(&mppath->state_lock);
2407
			if (!ether_addr_equal(mppath->mpp, mpp_addr))
2408
				memcpy(mppath->mpp, mpp_addr, ETH_ALEN);
2409
			mppath->exp_time = jiffies;
2410 2411 2412 2413 2414
			spin_unlock_bh(&mppath->state_lock);
		}
		rcu_read_unlock();
	}

2415 2416
	/* Frame has reached destination.  Don't forward */
	if (!is_multicast_ether_addr(hdr->addr1) &&
2417
	    ether_addr_equal(sdata->vif.addr, hdr->addr3))
2418 2419
		return RX_CONTINUE;

2420 2421
	ac = ieee80211_select_queue_80211(sdata, skb, hdr);
	q = sdata->vif.hw_queue[ac];
2422
	if (ieee80211_queue_stopped(&local->hw, q)) {
2423
		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion);
2424 2425 2426
		return RX_DROP_MONITOR;
	}
	skb_set_queue_mapping(skb, q);
2427

2428 2429
	if (!--mesh_hdr->ttl) {
		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl);
2430
		goto out;
2431 2432
	}

2433 2434 2435
	if (!ifmsh->mshcfg.dot11MeshForwarding)
		goto out;

2436 2437
	fwd_skb = skb_copy(skb, GFP_ATOMIC);
	if (!fwd_skb) {
J
Johannes Berg 已提交
2438
		net_info_ratelimited("%s: failed to clone mesh frame\n",
2439
				    sdata->name);
2440 2441 2442 2443
		goto out;
	}

	fwd_hdr =  (struct ieee80211_hdr *) fwd_skb->data;
2444
	fwd_hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_RETRY);
2445 2446 2447 2448 2449 2450 2451 2452
	info = IEEE80211_SKB_CB(fwd_skb);
	memset(info, 0, sizeof(*info));
	info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
	info->control.vif = &rx->sdata->vif;
	info->control.jiffies = jiffies;
	if (is_multicast_ether_addr(fwd_hdr->addr1)) {
		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_mcast);
		memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
M
Marco Porsch 已提交
2453 2454
		/* update power mode indication when forwarding */
		ieee80211_mps_set_frame_flags(sdata, NULL, fwd_hdr);
J
Johannes Berg 已提交
2455
	} else if (!mesh_nexthop_lookup(sdata, fwd_skb)) {
M
Marco Porsch 已提交
2456
		/* mesh power mode flags updated in mesh_nexthop_lookup */
2457 2458 2459
		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast);
	} else {
		/* unable to resolve next hop */
J
Johannes Berg 已提交
2460
		mesh_path_error_tx(sdata, ifmsh->mshcfg.element_ttl,
2461 2462 2463
				   fwd_hdr->addr3, 0,
				   WLAN_REASON_MESH_PATH_NOFORWARD,
				   fwd_hdr->addr2);
2464
		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_no_route);
2465
		kfree_skb(fwd_skb);
2466
		return RX_DROP_MONITOR;
2467 2468
	}

2469 2470
	IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
	ieee80211_add_pending_skb(local, fwd_skb);
J
Johannes Berg 已提交
2471
 out:
2472
	if (is_multicast_ether_addr(hdr->addr1))
2473
		return RX_CONTINUE;
2474
	return RX_DROP_MONITOR;
2475
}
I
Ingo Molnar 已提交
2476
#endif
2477

2478
static ieee80211_rx_result debug_noinline
2479
ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
2480
{
J
Johannes Berg 已提交
2481
	struct ieee80211_sub_if_data *sdata = rx->sdata;
2482
	struct ieee80211_local *local = rx->local;
J
Johannes Berg 已提交
2483
	struct net_device *dev = sdata->dev;
2484 2485
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
	__le16 fc = hdr->frame_control;
2486
	bool port_control;
2487
	int err;
2488

2489
	if (unlikely(!ieee80211_is_data(hdr->frame_control)))
2490
		return RX_CONTINUE;
2491

2492
	if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
J
Johannes Berg 已提交
2493
		return RX_DROP_MONITOR;
2494

2495
	/*
2496 2497
	 * Send unexpected-4addr-frame event to hostapd. For older versions,
	 * also drop the frame to cooked monitor interfaces.
2498 2499
	 */
	if (ieee80211_has_a4(hdr->frame_control) &&
2500 2501 2502 2503 2504
	    sdata->vif.type == NL80211_IFTYPE_AP) {
		if (rx->sta &&
		    !test_and_set_sta_flag(rx->sta, WLAN_STA_4ADDR_EVENT))
			cfg80211_rx_unexpected_4addr_frame(
				rx->sdata->dev, rx->sta->sta.addr, GFP_ATOMIC);
2505
		return RX_DROP_MONITOR;
2506
	}
2507

2508
	err = __ieee80211_data_to_8023(rx, &port_control);
2509
	if (unlikely(err))
J
Johannes Berg 已提交
2510
		return RX_DROP_UNUSABLE;
2511

2512
	if (!ieee80211_frame_allowed(rx, fc))
J
Johannes Berg 已提交
2513
		return RX_DROP_MONITOR;
2514

2515 2516 2517 2518 2519 2520 2521 2522 2523 2524 2525
	/* directly handle TDLS channel switch requests/responses */
	if (unlikely(((struct ethhdr *)rx->skb->data)->h_proto ==
						cpu_to_be16(ETH_P_TDLS))) {
		struct ieee80211_tdls_data *tf = (void *)rx->skb->data;

		if (pskb_may_pull(rx->skb,
				  offsetof(struct ieee80211_tdls_data, u)) &&
		    tf->payload_type == WLAN_TDLS_SNAP_RFTYPE &&
		    tf->category == WLAN_CATEGORY_TDLS &&
		    (tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_REQUEST ||
		     tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_RESPONSE)) {
2526 2527
			skb_queue_tail(&local->skb_queue_tdls_chsw, rx->skb);
			schedule_work(&local->tdls_chsw_work);
2528
			if (rx->sta)
2529
				rx->sta->rx_stats.packets++;
2530 2531 2532 2533 2534

			return RX_QUEUED;
		}
	}

2535 2536 2537 2538 2539 2540 2541 2542
	if (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
	    unlikely(port_control) && sdata->bss) {
		sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
				     u.ap);
		dev = sdata->dev;
		rx->sdata = sdata;
	}

2543 2544
	rx->skb->dev = dev;

2545 2546
	if (!ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS) &&
	    local->ps_sdata && local->hw.conf.dynamic_ps_timeout > 0 &&
2547 2548 2549
	    !is_multicast_ether_addr(
		    ((struct ethhdr *)rx->skb->data)->h_dest) &&
	    (!local->scanning &&
2550 2551 2552
	     !test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state)))
		mod_timer(&local->dynamic_ps_timer, jiffies +
			  msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
2553

2554
	ieee80211_deliver_skb(rx);
2555

2556
	return RX_QUEUED;
2557 2558
}

2559
static ieee80211_rx_result debug_noinline
2560
ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames)
2561 2562
{
	struct sk_buff *skb = rx->skb;
2563
	struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
2564 2565 2566 2567
	struct tid_ampdu_rx *tid_agg_rx;
	u16 start_seq_num;
	u16 tid;

2568
	if (likely(!ieee80211_is_ctl(bar->frame_control)))
2569
		return RX_CONTINUE;
2570

2571
	if (ieee80211_is_back_req(bar->frame_control)) {
2572 2573 2574
		struct {
			__le16 control, start_seq_num;
		} __packed bar_data;
2575 2576 2577
		struct ieee80211_event event = {
			.type = BAR_RX_EVENT,
		};
2578

2579
		if (!rx->sta)
2580
			return RX_DROP_MONITOR;
2581 2582 2583 2584 2585 2586

		if (skb_copy_bits(skb, offsetof(struct ieee80211_bar, control),
				  &bar_data, sizeof(bar_data)))
			return RX_DROP_MONITOR;

		tid = le16_to_cpu(bar_data.control) >> 12;
2587 2588 2589

		tid_agg_rx = rcu_dereference(rx->sta->ampdu_mlme.tid_rx[tid]);
		if (!tid_agg_rx)
2590
			return RX_DROP_MONITOR;
2591

2592
		start_seq_num = le16_to_cpu(bar_data.start_seq_num) >> 4;
2593 2594 2595
		event.u.ba.tid = tid;
		event.u.ba.ssn = start_seq_num;
		event.u.ba.sta = &rx->sta->sta;
2596 2597

		/* reset session timer */
2598 2599 2600
		if (tid_agg_rx->timeout)
			mod_timer(&tid_agg_rx->session_timer,
				  TU_TO_EXP_TIME(tid_agg_rx->timeout));
2601

2602
		spin_lock(&tid_agg_rx->reorder_lock);
2603
		/* release stored frames up to start of BAR */
2604
		ieee80211_release_reorder_frames(rx->sdata, tid_agg_rx,
2605
						 start_seq_num, frames);
2606 2607
		spin_unlock(&tid_agg_rx->reorder_lock);

2608 2609
		drv_event_callback(rx->local, rx->sdata, &event);

2610 2611
		kfree_skb(skb);
		return RX_QUEUED;
2612 2613
	}

2614 2615 2616 2617 2618 2619
	/*
	 * After this point, we only want management frames,
	 * so we can drop all remaining control frames to
	 * cooked monitor interfaces.
	 */
	return RX_DROP_MONITOR;
2620 2621
}

2622 2623 2624
static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
					   struct ieee80211_mgmt *mgmt,
					   size_t len)
2625 2626 2627 2628 2629
{
	struct ieee80211_local *local = sdata->local;
	struct sk_buff *skb;
	struct ieee80211_mgmt *resp;

2630
	if (!ether_addr_equal(mgmt->da, sdata->vif.addr)) {
2631 2632 2633 2634
		/* Not to own unicast address */
		return;
	}

2635 2636
	if (!ether_addr_equal(mgmt->sa, sdata->u.mgd.bssid) ||
	    !ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid)) {
2637
		/* Not from the current AP or not associated yet. */
2638 2639 2640 2641 2642 2643 2644 2645 2646 2647 2648 2649 2650 2651 2652 2653
		return;
	}

	if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) {
		/* Too short SA Query request frame */
		return;
	}

	skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom);
	if (skb == NULL)
		return;

	skb_reserve(skb, local->hw.extra_tx_headroom);
	resp = (struct ieee80211_mgmt *) skb_put(skb, 24);
	memset(resp, 0, 24);
	memcpy(resp->da, mgmt->sa, ETH_ALEN);
2654
	memcpy(resp->sa, sdata->vif.addr, ETH_ALEN);
2655
	memcpy(resp->bssid, sdata->u.mgd.bssid, ETH_ALEN);
2656 2657 2658 2659 2660 2661 2662 2663 2664
	resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
					  IEEE80211_STYPE_ACTION);
	skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query));
	resp->u.action.category = WLAN_CATEGORY_SA_QUERY;
	resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE;
	memcpy(resp->u.action.u.sa_query.trans_id,
	       mgmt->u.action.u.sa_query.trans_id,
	       WLAN_SA_QUERY_TR_ID_LEN);

2665
	ieee80211_tx_skb(sdata, skb);
2666 2667
}

2668 2669 2670 2671
static ieee80211_rx_result debug_noinline
ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx)
{
	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
2672
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2673 2674 2675 2676 2677 2678 2679 2680 2681 2682 2683 2684

	/*
	 * From here on, look only at management frames.
	 * Data and control frames are already handled,
	 * and unknown (reserved) frames are useless.
	 */
	if (rx->skb->len < 24)
		return RX_DROP_MONITOR;

	if (!ieee80211_is_mgmt(mgmt->frame_control))
		return RX_DROP_MONITOR;

J
Johannes Berg 已提交
2685 2686 2687
	if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
	    ieee80211_is_beacon(mgmt->frame_control) &&
	    !(rx->flags & IEEE80211_RX_BEACON_REPORTED)) {
2688 2689
		int sig = 0;

2690
		if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM))
2691 2692
			sig = status->signal;

J
Johannes Berg 已提交
2693 2694
		cfg80211_report_obss_beacon(rx->local->hw.wiphy,
					    rx->skb->data, rx->skb->len,
2695
					    status->freq, sig);
J
Johannes Berg 已提交
2696 2697 2698
		rx->flags |= IEEE80211_RX_BEACON_REPORTED;
	}

2699 2700 2701 2702 2703 2704
	if (ieee80211_drop_unencrypted_mgmt(rx))
		return RX_DROP_UNUSABLE;

	return RX_CONTINUE;
}

2705 2706 2707 2708
static ieee80211_rx_result debug_noinline
ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
{
	struct ieee80211_local *local = rx->local;
J
Johannes Berg 已提交
2709
	struct ieee80211_sub_if_data *sdata = rx->sdata;
2710
	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
2711
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2712 2713 2714 2715 2716
	int len = rx->skb->len;

	if (!ieee80211_is_action(mgmt->frame_control))
		return RX_CONTINUE;

2717 2718
	/* drop too small frames */
	if (len < IEEE80211_MIN_ACTION_SIZE)
2719
		return RX_DROP_UNUSABLE;
2720

2721
	if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC &&
2722 2723
	    mgmt->u.action.category != WLAN_CATEGORY_SELF_PROTECTED &&
	    mgmt->u.action.category != WLAN_CATEGORY_SPECTRUM_MGMT)
2724
		return RX_DROP_UNUSABLE;
2725 2726

	switch (mgmt->u.action.category) {
2727 2728 2729 2730 2731 2732 2733 2734 2735 2736 2737 2738
	case WLAN_CATEGORY_HT:
		/* reject HT action frames from stations not supporting HT */
		if (!rx->sta->sta.ht_cap.ht_supported)
			goto invalid;

		if (sdata->vif.type != NL80211_IFTYPE_STATION &&
		    sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
		    sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
		    sdata->vif.type != NL80211_IFTYPE_AP &&
		    sdata->vif.type != NL80211_IFTYPE_ADHOC)
			break;

2739
		/* verify action & smps_control/chanwidth are present */
2740 2741 2742 2743 2744 2745
		if (len < IEEE80211_MIN_ACTION_SIZE + 2)
			goto invalid;

		switch (mgmt->u.action.u.ht_smps.action) {
		case WLAN_HT_ACTION_SMPS: {
			struct ieee80211_supported_band *sband;
2746
			enum ieee80211_smps_mode smps_mode;
2747 2748 2749 2750

			/* convert to HT capability */
			switch (mgmt->u.action.u.ht_smps.smps_control) {
			case WLAN_HT_SMPS_CONTROL_DISABLED:
2751
				smps_mode = IEEE80211_SMPS_OFF;
2752 2753
				break;
			case WLAN_HT_SMPS_CONTROL_STATIC:
2754
				smps_mode = IEEE80211_SMPS_STATIC;
2755 2756
				break;
			case WLAN_HT_SMPS_CONTROL_DYNAMIC:
2757
				smps_mode = IEEE80211_SMPS_DYNAMIC;
2758 2759 2760 2761 2762 2763
				break;
			default:
				goto invalid;
			}

			/* if no change do nothing */
2764
			if (rx->sta->sta.smps_mode == smps_mode)
2765
				goto handled;
2766
			rx->sta->sta.smps_mode = smps_mode;
2767 2768 2769

			sband = rx->local->hw.wiphy->bands[status->band];

2770 2771
			rate_control_rate_update(local, sband, rx->sta,
						 IEEE80211_RC_SMPS_CHANGED);
2772 2773
			goto handled;
		}
2774 2775 2776
		case WLAN_HT_ACTION_NOTIFY_CHANWIDTH: {
			struct ieee80211_supported_band *sband;
			u8 chanwidth = mgmt->u.action.u.ht_notify_cw.chanwidth;
2777
			enum ieee80211_sta_rx_bandwidth max_bw, new_bw;
2778 2779

			/* If it doesn't support 40 MHz it can't change ... */
2780 2781
			if (!(rx->sta->sta.ht_cap.cap &
					IEEE80211_HT_CAP_SUP_WIDTH_20_40))
2782 2783
				goto handled;

2784
			if (chanwidth == IEEE80211_HT_CHANWIDTH_20MHZ)
2785
				max_bw = IEEE80211_STA_RX_BW_20;
2786
			else
2787 2788 2789 2790 2791
				max_bw = ieee80211_sta_cap_rx_bw(rx->sta);

			/* set cur_max_bandwidth and recalc sta bw */
			rx->sta->cur_max_bandwidth = max_bw;
			new_bw = ieee80211_sta_cur_vht_bw(rx->sta);
2792

2793
			if (rx->sta->sta.bandwidth == new_bw)
2794 2795
				goto handled;

2796
			rx->sta->sta.bandwidth = new_bw;
2797 2798 2799 2800 2801 2802
			sband = rx->local->hw.wiphy->bands[status->band];

			rate_control_rate_update(local, sband, rx->sta,
						 IEEE80211_RC_BW_CHANGED);
			goto handled;
		}
2803 2804 2805 2806
		default:
			goto invalid;
		}

2807
		break;
2808 2809 2810 2811 2812 2813 2814 2815 2816 2817 2818 2819 2820 2821 2822 2823
	case WLAN_CATEGORY_PUBLIC:
		if (len < IEEE80211_MIN_ACTION_SIZE + 1)
			goto invalid;
		if (sdata->vif.type != NL80211_IFTYPE_STATION)
			break;
		if (!rx->sta)
			break;
		if (!ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid))
			break;
		if (mgmt->u.action.u.ext_chan_switch.action_code !=
				WLAN_PUB_ACTION_EXT_CHANSW_ANN)
			break;
		if (len < offsetof(struct ieee80211_mgmt,
				   u.action.u.ext_chan_switch.variable))
			goto invalid;
		goto queue;
2824 2825 2826 2827 2828 2829 2830 2831 2832 2833 2834 2835 2836 2837 2838 2839 2840 2841 2842 2843 2844 2845 2846
	case WLAN_CATEGORY_VHT:
		if (sdata->vif.type != NL80211_IFTYPE_STATION &&
		    sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
		    sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
		    sdata->vif.type != NL80211_IFTYPE_AP &&
		    sdata->vif.type != NL80211_IFTYPE_ADHOC)
			break;

		/* verify action code is present */
		if (len < IEEE80211_MIN_ACTION_SIZE + 1)
			goto invalid;

		switch (mgmt->u.action.u.vht_opmode_notif.action_code) {
		case WLAN_VHT_ACTION_OPMODE_NOTIF: {
			u8 opmode;

			/* verify opmode is present */
			if (len < IEEE80211_MIN_ACTION_SIZE + 2)
				goto invalid;

			opmode = mgmt->u.action.u.vht_opmode_notif.operating_mode;

			ieee80211_vht_handle_opmode(rx->sdata, rx->sta,
2847
						    opmode, status->band);
2848 2849
			goto handled;
		}
2850 2851 2852 2853 2854
		case WLAN_VHT_ACTION_GROUPID_MGMT: {
			if (len < IEEE80211_MIN_ACTION_SIZE + 25)
				goto invalid;
			goto queue;
		}
2855 2856 2857
		default:
			break;
		}
2858
		break;
2859
	case WLAN_CATEGORY_BACK:
2860
		if (sdata->vif.type != NL80211_IFTYPE_STATION &&
2861
		    sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
2862
		    sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
2863 2864
		    sdata->vif.type != NL80211_IFTYPE_AP &&
		    sdata->vif.type != NL80211_IFTYPE_ADHOC)
2865
			break;
2866

2867 2868 2869 2870
		/* verify action_code is present */
		if (len < IEEE80211_MIN_ACTION_SIZE + 1)
			break;

2871 2872 2873 2874
		switch (mgmt->u.action.u.addba_req.action_code) {
		case WLAN_ACTION_ADDBA_REQ:
			if (len < (IEEE80211_MIN_ACTION_SIZE +
				   sizeof(mgmt->u.action.u.addba_req)))
2875 2876
				goto invalid;
			break;
2877 2878 2879
		case WLAN_ACTION_ADDBA_RESP:
			if (len < (IEEE80211_MIN_ACTION_SIZE +
				   sizeof(mgmt->u.action.u.addba_resp)))
2880 2881
				goto invalid;
			break;
2882 2883 2884
		case WLAN_ACTION_DELBA:
			if (len < (IEEE80211_MIN_ACTION_SIZE +
				   sizeof(mgmt->u.action.u.delba)))
2885 2886 2887 2888
				goto invalid;
			break;
		default:
			goto invalid;
2889
		}
2890

2891
		goto queue;
2892
	case WLAN_CATEGORY_SPECTRUM_MGMT:
2893 2894 2895 2896
		/* verify action_code is present */
		if (len < IEEE80211_MIN_ACTION_SIZE + 1)
			break;

2897 2898
		switch (mgmt->u.action.u.measurement.action_code) {
		case WLAN_ACTION_SPCT_MSR_REQ:
2899
			if (status->band != NL80211_BAND_5GHZ)
2900 2901
				break;

2902 2903
			if (len < (IEEE80211_MIN_ACTION_SIZE +
				   sizeof(mgmt->u.action.u.measurement)))
2904
				break;
2905 2906 2907 2908

			if (sdata->vif.type != NL80211_IFTYPE_STATION)
				break;

2909
			ieee80211_process_measurement_req(sdata, mgmt, len);
2910
			goto handled;
2911 2912 2913 2914
		case WLAN_ACTION_SPCT_CHL_SWITCH: {
			u8 *bssid;
			if (len < (IEEE80211_MIN_ACTION_SIZE +
				   sizeof(mgmt->u.action.u.chan_switch)))
2915
				break;
2916

2917
			if (sdata->vif.type != NL80211_IFTYPE_STATION &&
2918 2919
			    sdata->vif.type != NL80211_IFTYPE_ADHOC &&
			    sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
2920 2921 2922 2923 2924 2925
				break;

			if (sdata->vif.type == NL80211_IFTYPE_STATION)
				bssid = sdata->u.mgd.bssid;
			else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
				bssid = sdata->u.ibss.bssid;
2926 2927
			else if (sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
				bssid = mgmt->sa;
2928 2929 2930 2931
			else
				break;

			if (!ether_addr_equal(mgmt->bssid, bssid))
2932
				break;
S
Sujith 已提交
2933

2934
			goto queue;
2935
			}
2936 2937
		}
		break;
2938 2939 2940
	case WLAN_CATEGORY_SA_QUERY:
		if (len < (IEEE80211_MIN_ACTION_SIZE +
			   sizeof(mgmt->u.action.u.sa_query)))
2941 2942
			break;

2943 2944 2945
		switch (mgmt->u.action.u.sa_query.action) {
		case WLAN_ACTION_SA_QUERY_REQUEST:
			if (sdata->vif.type != NL80211_IFTYPE_STATION)
2946
				break;
2947
			ieee80211_process_sa_query_req(sdata, mgmt, len);
2948
			goto handled;
2949 2950
		}
		break;
2951
	case WLAN_CATEGORY_SELF_PROTECTED:
2952 2953 2954 2955
		if (len < (IEEE80211_MIN_ACTION_SIZE +
			   sizeof(mgmt->u.action.u.self_prot.action_code)))
			break;

2956 2957 2958 2959 2960 2961
		switch (mgmt->u.action.u.self_prot.action_code) {
		case WLAN_SP_MESH_PEERING_OPEN:
		case WLAN_SP_MESH_PEERING_CLOSE:
		case WLAN_SP_MESH_PEERING_CONFIRM:
			if (!ieee80211_vif_is_mesh(&sdata->vif))
				goto invalid;
2962
			if (sdata->u.mesh.user_mpm)
2963 2964 2965 2966 2967 2968 2969 2970 2971 2972
				/* userspace handles this frame */
				break;
			goto queue;
		case WLAN_SP_MGK_INFORM:
		case WLAN_SP_MGK_ACK:
			if (!ieee80211_vif_is_mesh(&sdata->vif))
				goto invalid;
			break;
		}
		break;
2973
	case WLAN_CATEGORY_MESH_ACTION:
2974 2975 2976 2977
		if (len < (IEEE80211_MIN_ACTION_SIZE +
			   sizeof(mgmt->u.action.u.mesh_action.action_code)))
			break;

2978 2979
		if (!ieee80211_vif_is_mesh(&sdata->vif))
			break;
2980
		if (mesh_action_is_path_sel(mgmt) &&
J
Johannes Berg 已提交
2981
		    !mesh_path_sel_is_hwmp(sdata))
2982 2983
			break;
		goto queue;
2984
	}
2985

2986 2987
	return RX_CONTINUE;

2988
 invalid:
2989
	status->rx_flags |= IEEE80211_RX_MALFORMED_ACTION_FRM;
2990 2991 2992 2993 2994
	/* will return in the next handlers */
	return RX_CONTINUE;

 handled:
	if (rx->sta)
2995
		rx->sta->rx_stats.packets++;
2996 2997 2998 2999 3000 3001 3002 3003
	dev_kfree_skb(rx->skb);
	return RX_QUEUED;

 queue:
	rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
	skb_queue_tail(&sdata->skb_queue, rx->skb);
	ieee80211_queue_work(&local->hw, &sdata->work);
	if (rx->sta)
3004
		rx->sta->rx_stats.packets++;
3005 3006 3007 3008 3009 3010
	return RX_QUEUED;
}

static ieee80211_rx_result debug_noinline
ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx)
{
3011
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
3012
	int sig = 0;
3013 3014

	/* skip known-bad action frames and return them in the next handler */
3015
	if (status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM)
3016
		return RX_CONTINUE;
3017

3018 3019 3020 3021 3022 3023 3024
	/*
	 * Getting here means the kernel doesn't know how to handle
	 * it, but maybe userspace does ... include returned frames
	 * so userspace can register for those to know whether ones
	 * it transmitted were processed or returned.
	 */

3025
	if (ieee80211_hw_check(&rx->local->hw, SIGNAL_DBM))
3026 3027
		sig = status->signal;

3028
	if (cfg80211_rx_mgmt(&rx->sdata->wdev, status->freq, sig,
3029
			     rx->skb->data, rx->skb->len, 0)) {
3030
		if (rx->sta)
3031
			rx->sta->rx_stats.packets++;
3032 3033 3034 3035 3036 3037 3038 3039 3040 3041 3042 3043 3044 3045
		dev_kfree_skb(rx->skb);
		return RX_QUEUED;
	}

	return RX_CONTINUE;
}

static ieee80211_rx_result debug_noinline
ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
{
	struct ieee80211_local *local = rx->local;
	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
	struct sk_buff *nskb;
	struct ieee80211_sub_if_data *sdata = rx->sdata;
3046
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
3047 3048 3049 3050 3051 3052 3053 3054 3055

	if (!ieee80211_is_action(mgmt->frame_control))
		return RX_CONTINUE;

	/*
	 * For AP mode, hostapd is responsible for handling any action
	 * frames that we didn't handle, including returning unknown
	 * ones. For all other modes we will return them to the sender,
	 * setting the 0x80 bit in the action category, as required by
3056
	 * 802.11-2012 9.24.4.
3057 3058 3059 3060
	 * Newer versions of hostapd shall also use the management frame
	 * registration mechanisms, but older ones still use cooked
	 * monitor interfaces so push all frames there.
	 */
3061
	if (!(status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) &&
3062 3063 3064
	    (sdata->vif.type == NL80211_IFTYPE_AP ||
	     sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
		return RX_DROP_MONITOR;
3065

3066 3067 3068
	if (is_multicast_ether_addr(mgmt->da))
		return RX_DROP_MONITOR;

3069 3070 3071 3072 3073 3074 3075
	/* do not return rejected action frames */
	if (mgmt->u.action.category & 0x80)
		return RX_DROP_UNUSABLE;

	nskb = skb_copy_expand(rx->skb, local->hw.extra_tx_headroom, 0,
			       GFP_ATOMIC);
	if (nskb) {
3076
		struct ieee80211_mgmt *nmgmt = (void *)nskb->data;
3077

3078 3079 3080
		nmgmt->u.action.category |= 0x80;
		memcpy(nmgmt->da, nmgmt->sa, ETH_ALEN);
		memcpy(nmgmt->sa, rx->sdata->vif.addr, ETH_ALEN);
3081 3082 3083

		memset(nskb->cb, 0, sizeof(nskb->cb));

3084 3085 3086 3087 3088 3089
		if (rx->sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) {
			struct ieee80211_tx_info *info = IEEE80211_SKB_CB(nskb);

			info->flags = IEEE80211_TX_CTL_TX_OFFCHAN |
				      IEEE80211_TX_INTFL_OFFCHAN_TX_OK |
				      IEEE80211_TX_CTL_NO_CCK_RATE;
3090
			if (ieee80211_hw_check(&local->hw, QUEUE_CONTROL))
3091 3092 3093 3094 3095 3096
				info->hw_queue =
					local->hw.offchannel_tx_hw_queue;
		}

		__ieee80211_tx_skb_tid_band(rx->sdata, nskb, 7,
					    status->band);
3097
	}
3098 3099
	dev_kfree_skb(rx->skb);
	return RX_QUEUED;
3100 3101
}

3102
static ieee80211_rx_result debug_noinline
3103
ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
3104
{
J
Johannes Berg 已提交
3105
	struct ieee80211_sub_if_data *sdata = rx->sdata;
3106 3107
	struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
	__le16 stype;
3108

3109
	stype = mgmt->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE);
3110

3111 3112
	if (!ieee80211_vif_is_mesh(&sdata->vif) &&
	    sdata->vif.type != NL80211_IFTYPE_ADHOC &&
3113
	    sdata->vif.type != NL80211_IFTYPE_OCB &&
3114 3115
	    sdata->vif.type != NL80211_IFTYPE_STATION)
		return RX_DROP_MONITOR;
3116

3117
	switch (stype) {
J
Johannes Berg 已提交
3118
	case cpu_to_le16(IEEE80211_STYPE_AUTH):
3119 3120 3121 3122
	case cpu_to_le16(IEEE80211_STYPE_BEACON):
	case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
		/* process for all: mesh, mlme, ibss */
		break;
J
Johannes Berg 已提交
3123 3124
	case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
	case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
3125 3126
	case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
	case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
3127 3128 3129 3130
		if (is_multicast_ether_addr(mgmt->da) &&
		    !is_broadcast_ether_addr(mgmt->da))
			return RX_DROP_MONITOR;

3131 3132 3133 3134 3135
		/* process only for station */
		if (sdata->vif.type != NL80211_IFTYPE_STATION)
			return RX_DROP_MONITOR;
		break;
	case cpu_to_le16(IEEE80211_STYPE_PROBE_REQ):
3136 3137 3138
		/* process only for ibss and mesh */
		if (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
		    sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
3139 3140 3141 3142 3143
			return RX_DROP_MONITOR;
		break;
	default:
		return RX_DROP_MONITOR;
	}
3144

3145
	/* queue up frame and kick off work to process it */
3146
	rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
3147 3148
	skb_queue_tail(&sdata->skb_queue, rx->skb);
	ieee80211_queue_work(&rx->local->hw, &sdata->work);
3149
	if (rx->sta)
3150
		rx->sta->rx_stats.packets++;
3151

3152
	return RX_QUEUED;
3153 3154
}

J
Johannes Berg 已提交
3155 3156
static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
					struct ieee80211_rate *rate)
3157 3158 3159 3160 3161
{
	struct ieee80211_sub_if_data *sdata;
	struct ieee80211_local *local = rx->local;
	struct sk_buff *skb = rx->skb, *skb2;
	struct net_device *prev_dev = NULL;
J
Johannes Berg 已提交
3162
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
3163
	int needed_headroom;
3164

3165 3166 3167 3168 3169
	/*
	 * If cooked monitor has been processed already, then
	 * don't do it again. If not, set the flag.
	 */
	if (rx->flags & IEEE80211_RX_CMNTR)
3170
		goto out_free_skb;
3171
	rx->flags |= IEEE80211_RX_CMNTR;
3172

3173 3174 3175 3176
	/* If there are no cooked monitor interfaces, just free the SKB */
	if (!local->cooked_mntrs)
		goto out_free_skb;

3177 3178
	/* vendor data is long removed here */
	status->flag &= ~RX_FLAG_RADIOTAP_VENDOR_DATA;
3179
	/* room for the radiotap header based on driver features */
3180
	needed_headroom = ieee80211_rx_radiotap_hdrlen(local, status, skb);
3181

3182 3183 3184
	if (skb_headroom(skb) < needed_headroom &&
	    pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC))
		goto out_free_skb;
3185

3186
	/* prepend radiotap information */
3187 3188
	ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom,
					 false);
3189

3190
	skb_reset_mac_header(skb);
3191 3192 3193 3194 3195
	skb->ip_summed = CHECKSUM_UNNECESSARY;
	skb->pkt_type = PACKET_OTHERHOST;
	skb->protocol = htons(ETH_P_802_2);

	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
3196
		if (!ieee80211_sdata_running(sdata))
3197 3198
			continue;

3199
		if (sdata->vif.type != NL80211_IFTYPE_MONITOR ||
3200
		    !(sdata->u.mntr.flags & MONITOR_FLAG_COOK_FRAMES))
3201 3202 3203 3204 3205 3206
			continue;

		if (prev_dev) {
			skb2 = skb_clone(skb, GFP_ATOMIC);
			if (skb2) {
				skb2->dev = prev_dev;
3207
				netif_receive_skb(skb2);
3208 3209 3210 3211
			}
		}

		prev_dev = sdata->dev;
3212
		ieee80211_rx_stats(sdata->dev, skb->len);
3213 3214 3215 3216
	}

	if (prev_dev) {
		skb->dev = prev_dev;
3217
		netif_receive_skb(skb);
3218 3219
		return;
	}
3220 3221 3222 3223 3224

 out_free_skb:
	dev_kfree_skb(skb);
}

3225 3226 3227 3228 3229 3230 3231
static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx,
					 ieee80211_rx_result res)
{
	switch (res) {
	case RX_DROP_MONITOR:
		I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
		if (rx->sta)
3232
			rx->sta->rx_stats.dropped++;
3233 3234 3235 3236 3237 3238 3239 3240 3241
		/* fall through */
	case RX_CONTINUE: {
		struct ieee80211_rate *rate = NULL;
		struct ieee80211_supported_band *sband;
		struct ieee80211_rx_status *status;

		status = IEEE80211_SKB_RXCB((rx->skb));

		sband = rx->local->hw.wiphy->bands[status->band];
3242 3243
		if (!(status->flag & RX_FLAG_HT) &&
		    !(status->flag & RX_FLAG_VHT))
3244 3245 3246 3247 3248 3249 3250 3251
			rate = &sband->bitrates[status->rate_idx];

		ieee80211_rx_cooked_monitor(rx, rate);
		break;
		}
	case RX_DROP_UNUSABLE:
		I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
		if (rx->sta)
3252
			rx->sta->rx_stats.dropped++;
3253 3254 3255 3256 3257 3258 3259
		dev_kfree_skb(rx->skb);
		break;
	case RX_QUEUED:
		I802_DEBUG_INC(rx->sdata->local->rx_handlers_queued);
		break;
	}
}
3260

3261 3262
static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx,
				  struct sk_buff_head *frames)
3263 3264
{
	ieee80211_rx_result res = RX_DROP_MONITOR;
3265
	struct sk_buff *skb;
3266

3267 3268 3269 3270
#define CALL_RXH(rxh)			\
	do {				\
		res = rxh(rx);		\
		if (res != RX_CONTINUE)	\
3271
			goto rxh_next;  \
3272
	} while (0)
3273

3274 3275 3276 3277 3278 3279
	/* Lock here to avoid hitting all of the data used in the RX
	 * path (e.g. key data, station data, ...) concurrently when
	 * a frame is released from the reorder buffer due to timeout
	 * from the timer, potentially concurrently with RX from the
	 * driver.
	 */
3280
	spin_lock_bh(&rx->local->rx_path_lock);
3281

3282
	while ((skb = __skb_dequeue(frames))) {
3283 3284 3285 3286 3287 3288 3289
		/*
		 * all the other fields are valid across frames
		 * that belong to an aMPDU since they are on the
		 * same TID from the same station
		 */
		rx->skb = skb;

3290 3291 3292 3293 3294 3295
		CALL_RXH(ieee80211_rx_h_check_more_data);
		CALL_RXH(ieee80211_rx_h_uapsd_and_pspoll);
		CALL_RXH(ieee80211_rx_h_sta_process);
		CALL_RXH(ieee80211_rx_h_decrypt);
		CALL_RXH(ieee80211_rx_h_defragment);
		CALL_RXH(ieee80211_rx_h_michael_mic_verify);
3296
		/* must be after MMIC verify so header is counted in MPDU mic */
I
Ingo Molnar 已提交
3297
#ifdef CONFIG_MAC80211_MESH
3298
		if (ieee80211_vif_is_mesh(&rx->sdata->vif))
3299
			CALL_RXH(ieee80211_rx_h_mesh_fwding);
I
Ingo Molnar 已提交
3300
#endif
3301 3302
		CALL_RXH(ieee80211_rx_h_amsdu);
		CALL_RXH(ieee80211_rx_h_data);
3303 3304 3305 3306 3307 3308

		/* special treatment -- needs the queue */
		res = ieee80211_rx_h_ctrl(rx, frames);
		if (res != RX_CONTINUE)
			goto rxh_next;

3309 3310 3311 3312 3313
		CALL_RXH(ieee80211_rx_h_mgmt_check);
		CALL_RXH(ieee80211_rx_h_action);
		CALL_RXH(ieee80211_rx_h_userspace_mgmt);
		CALL_RXH(ieee80211_rx_h_action_return);
		CALL_RXH(ieee80211_rx_h_mgmt);
3314

3315 3316
 rxh_next:
		ieee80211_rx_handlers_result(rx, res);
3317

3318
#undef CALL_RXH
3319
	}
3320

3321
	spin_unlock_bh(&rx->local->rx_path_lock);
3322 3323
}

3324
static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
3325
{
3326
	struct sk_buff_head reorder_release;
3327 3328
	ieee80211_rx_result res = RX_DROP_MONITOR;

3329 3330
	__skb_queue_head_init(&reorder_release);

3331 3332 3333 3334 3335
#define CALL_RXH(rxh)			\
	do {				\
		res = rxh(rx);		\
		if (res != RX_CONTINUE)	\
			goto rxh_next;  \
3336
	} while (0)
3337

3338 3339
	CALL_RXH(ieee80211_rx_h_check_dup);
	CALL_RXH(ieee80211_rx_h_check);
3340

3341
	ieee80211_rx_reorder_ampdu(rx, &reorder_release);
3342

3343
	ieee80211_rx_handlers(rx, &reorder_release);
3344
	return;
3345

3346
 rxh_next:
3347 3348 3349
	ieee80211_rx_handlers_result(rx, res);

#undef CALL_RXH
3350 3351
}

3352
/*
3353 3354
 * This function makes calls into the RX path, therefore
 * it has to be invoked under RCU read lock.
3355 3356 3357
 */
void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
{
3358
	struct sk_buff_head frames;
3359 3360 3361 3362
	struct ieee80211_rx_data rx = {
		.sta = sta,
		.sdata = sta->sdata,
		.local = sta->local,
3363 3364 3365
		/* This is OK -- must be QoS data frame */
		.security_idx = tid,
		.seqno_idx = tid,
3366
		.napi = NULL, /* must be NULL to not have races */
3367
	};
3368 3369 3370 3371 3372
	struct tid_ampdu_rx *tid_agg_rx;

	tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
	if (!tid_agg_rx)
		return;
3373

3374 3375
	__skb_queue_head_init(&frames);

3376
	spin_lock(&tid_agg_rx->reorder_lock);
3377
	ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames);
3378
	spin_unlock(&tid_agg_rx->reorder_lock);
3379

3380 3381 3382 3383 3384 3385 3386 3387 3388
	if (!skb_queue_empty(&frames)) {
		struct ieee80211_event event = {
			.type = BA_FRAME_TIMEOUT,
			.u.ba.tid = tid,
			.u.ba.sta = &sta->sta,
		};
		drv_event_callback(rx.local, rx.sdata, &event);
	}

3389
	ieee80211_rx_handlers(&rx, &frames);
3390 3391
}

3392 3393 3394 3395 3396 3397 3398 3399 3400 3401 3402 3403 3404 3405 3406 3407 3408 3409 3410 3411 3412 3413 3414 3415 3416 3417 3418 3419 3420 3421 3422 3423 3424 3425 3426 3427 3428 3429 3430 3431 3432 3433 3434 3435 3436 3437 3438 3439 3440 3441 3442 3443 3444 3445 3446 3447 3448 3449 3450 3451 3452 3453 3454 3455 3456 3457 3458 3459 3460 3461 3462 3463 3464 3465 3466 3467 3468 3469 3470
void ieee80211_mark_rx_ba_filtered_frames(struct ieee80211_sta *pubsta, u8 tid,
					  u16 ssn, u64 filtered,
					  u16 received_mpdus)
{
	struct sta_info *sta;
	struct tid_ampdu_rx *tid_agg_rx;
	struct sk_buff_head frames;
	struct ieee80211_rx_data rx = {
		/* This is OK -- must be QoS data frame */
		.security_idx = tid,
		.seqno_idx = tid,
	};
	int i, diff;

	if (WARN_ON(!pubsta || tid >= IEEE80211_NUM_TIDS))
		return;

	__skb_queue_head_init(&frames);

	sta = container_of(pubsta, struct sta_info, sta);

	rx.sta = sta;
	rx.sdata = sta->sdata;
	rx.local = sta->local;

	rcu_read_lock();
	tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
	if (!tid_agg_rx)
		goto out;

	spin_lock_bh(&tid_agg_rx->reorder_lock);

	if (received_mpdus >= IEEE80211_SN_MODULO >> 1) {
		int release;

		/* release all frames in the reorder buffer */
		release = (tid_agg_rx->head_seq_num + tid_agg_rx->buf_size) %
			   IEEE80211_SN_MODULO;
		ieee80211_release_reorder_frames(sta->sdata, tid_agg_rx,
						 release, &frames);
		/* update ssn to match received ssn */
		tid_agg_rx->head_seq_num = ssn;
	} else {
		ieee80211_release_reorder_frames(sta->sdata, tid_agg_rx, ssn,
						 &frames);
	}

	/* handle the case that received ssn is behind the mac ssn.
	 * it can be tid_agg_rx->buf_size behind and still be valid */
	diff = (tid_agg_rx->head_seq_num - ssn) & IEEE80211_SN_MASK;
	if (diff >= tid_agg_rx->buf_size) {
		tid_agg_rx->reorder_buf_filtered = 0;
		goto release;
	}
	filtered = filtered >> diff;
	ssn += diff;

	/* update bitmap */
	for (i = 0; i < tid_agg_rx->buf_size; i++) {
		int index = (ssn + i) % tid_agg_rx->buf_size;

		tid_agg_rx->reorder_buf_filtered &= ~BIT_ULL(index);
		if (filtered & BIT_ULL(i))
			tid_agg_rx->reorder_buf_filtered |= BIT_ULL(index);
	}

	/* now process also frames that the filter marking released */
	ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames);

release:
	spin_unlock_bh(&tid_agg_rx->reorder_lock);

	ieee80211_rx_handlers(&rx, &frames);

 out:
	rcu_read_unlock();
}
EXPORT_SYMBOL(ieee80211_mark_rx_ba_filtered_frames);

3471 3472
/* main receive path */

3473
static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx)
3474
{
3475
	struct ieee80211_sub_if_data *sdata = rx->sdata;
J
Johannes Berg 已提交
3476
	struct sk_buff *skb = rx->skb;
3477
	struct ieee80211_hdr *hdr = (void *)skb->data;
J
Johannes Berg 已提交
3478 3479
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
	u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
3480 3481
	int multicast = is_multicast_ether_addr(hdr->addr1);

3482
	switch (sdata->vif.type) {
3483
	case NL80211_IFTYPE_STATION:
3484
		if (!bssid && !sdata->u.mgd.use_4addr)
3485
			return false;
3486 3487 3488
		if (multicast)
			return true;
		return ether_addr_equal(sdata->vif.addr, hdr->addr1);
3489
	case NL80211_IFTYPE_ADHOC:
3490
		if (!bssid)
3491
			return false;
3492 3493
		if (ether_addr_equal(sdata->vif.addr, hdr->addr2) ||
		    ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2))
3494
			return false;
3495
		if (ieee80211_is_beacon(hdr->frame_control))
3496
			return true;
3497
		if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid))
3498
			return false;
3499 3500
		if (!multicast &&
		    !ether_addr_equal(sdata->vif.addr, hdr->addr1))
3501
			return false;
3502
		if (!rx->sta) {
3503
			int rate_idx;
3504 3505
			if (status->flag & (RX_FLAG_HT | RX_FLAG_VHT))
				rate_idx = 0; /* TODO: HT/VHT rates */
3506
			else
J
Johannes Berg 已提交
3507
				rate_idx = status->rate_idx;
3508 3509
			ieee80211_ibss_rx_no_sta(sdata, bssid, hdr->addr2,
						 BIT(rate_idx));
3510
		}
3511
		return true;
3512 3513 3514
	case NL80211_IFTYPE_OCB:
		if (!bssid)
			return false;
3515
		if (!ieee80211_is_data_present(hdr->frame_control))
3516
			return false;
3517
		if (!is_broadcast_ether_addr(bssid))
3518
			return false;
3519 3520
		if (!multicast &&
		    !ether_addr_equal(sdata->dev->dev_addr, hdr->addr1))
3521
			return false;
3522
		if (!rx->sta) {
3523 3524 3525 3526 3527 3528 3529 3530
			int rate_idx;
			if (status->flag & RX_FLAG_HT)
				rate_idx = 0; /* TODO: HT rates */
			else
				rate_idx = status->rate_idx;
			ieee80211_ocb_rx_no_sta(sdata, bssid, hdr->addr2,
						BIT(rate_idx));
		}
3531
		return true;
3532
	case NL80211_IFTYPE_MESH_POINT:
3533 3534 3535
		if (multicast)
			return true;
		return ether_addr_equal(sdata->vif.addr, hdr->addr1);
3536 3537
	case NL80211_IFTYPE_AP_VLAN:
	case NL80211_IFTYPE_AP:
3538 3539 3540 3541
		if (!bssid)
			return ether_addr_equal(sdata->vif.addr, hdr->addr1);

		if (!ieee80211_bssid_match(bssid, sdata->vif.addr)) {
3542 3543 3544 3545 3546 3547
			/*
			 * Accept public action frames even when the
			 * BSSID doesn't match, this is used for P2P
			 * and location updates. Note that mac80211
			 * itself never looks at these frames.
			 */
3548 3549
			if (!multicast &&
			    !ether_addr_equal(sdata->vif.addr, hdr->addr1))
3550
				return false;
J
Johannes Berg 已提交
3551
			if (ieee80211_is_public_action(hdr, skb->len))
3552
				return true;
3553
			return ieee80211_is_beacon(hdr->frame_control);
3554 3555 3556
		}

		if (!ieee80211_has_tods(hdr->frame_control)) {
3557 3558 3559 3560 3561
			/* ignore data frames to TDLS-peers */
			if (ieee80211_is_data(hdr->frame_control))
				return false;
			/* ignore action frames to TDLS-peers */
			if (ieee80211_is_action(hdr->frame_control) &&
3562
			    !is_broadcast_ether_addr(bssid) &&
3563 3564
			    !ether_addr_equal(bssid, hdr->addr1))
				return false;
3565
		}
3566
		return true;
3567
	case NL80211_IFTYPE_WDS:
3568
		if (bssid || !ieee80211_is_data(hdr->frame_control))
3569
			return false;
3570
		return ether_addr_equal(sdata->u.wds.remote_addr, hdr->addr2);
3571
	case NL80211_IFTYPE_P2P_DEVICE:
3572 3573 3574 3575
		return ieee80211_is_public_action(hdr, skb->len) ||
		       ieee80211_is_probe_req(hdr->frame_control) ||
		       ieee80211_is_probe_resp(hdr->frame_control) ||
		       ieee80211_is_beacon(hdr->frame_control);
3576
	default:
J
Johannes Berg 已提交
3577
		break;
3578 3579
	}

3580 3581
	WARN_ON_ONCE(1);
	return false;
3582 3583
}

J
Johannes Berg 已提交
3584 3585 3586 3587 3588 3589 3590 3591 3592 3593 3594 3595 3596 3597 3598 3599 3600 3601 3602 3603
void ieee80211_check_fast_rx(struct sta_info *sta)
{
	struct ieee80211_sub_if_data *sdata = sta->sdata;
	struct ieee80211_local *local = sdata->local;
	struct ieee80211_key *key;
	struct ieee80211_fast_rx fastrx = {
		.dev = sdata->dev,
		.vif_type = sdata->vif.type,
		.control_port_protocol = sdata->control_port_protocol,
	}, *old, *new = NULL;
	bool assign = false;

	/* use sparse to check that we don't return without updating */
	__acquire(check_fast_rx);

	BUILD_BUG_ON(sizeof(fastrx.rfc1042_hdr) != sizeof(rfc1042_header));
	BUILD_BUG_ON(sizeof(fastrx.rfc1042_hdr) != ETH_ALEN);
	ether_addr_copy(fastrx.rfc1042_hdr, rfc1042_header);
	ether_addr_copy(fastrx.vif_addr, sdata->vif.addr);

3604 3605
	fastrx.uses_rss = ieee80211_hw_check(&local->hw, USES_RSS);

J
Johannes Berg 已提交
3606 3607 3608 3609 3610 3611 3612 3613 3614 3615 3616 3617 3618 3619 3620 3621 3622 3623 3624 3625 3626 3627 3628 3629 3630 3631 3632 3633 3634 3635 3636 3637 3638 3639 3640 3641 3642 3643 3644 3645 3646 3647 3648 3649 3650 3651 3652 3653 3654 3655 3656 3657 3658 3659 3660 3661 3662 3663 3664 3665 3666 3667 3668 3669 3670 3671 3672 3673 3674 3675 3676 3677 3678 3679 3680 3681 3682 3683 3684 3685 3686 3687 3688 3689 3690 3691 3692 3693 3694 3695 3696 3697 3698 3699 3700 3701 3702 3703 3704 3705 3706 3707 3708 3709 3710 3711 3712 3713 3714 3715 3716 3717 3718 3719 3720 3721 3722 3723 3724 3725 3726 3727 3728 3729 3730 3731 3732 3733 3734 3735 3736 3737 3738 3739 3740 3741 3742 3743 3744 3745 3746 3747 3748 3749 3750 3751 3752 3753 3754 3755
	/* fast-rx doesn't do reordering */
	if (ieee80211_hw_check(&local->hw, AMPDU_AGGREGATION) &&
	    !ieee80211_hw_check(&local->hw, SUPPORTS_REORDERING_BUFFER))
		goto clear;

	switch (sdata->vif.type) {
	case NL80211_IFTYPE_STATION:
		/* 4-addr is harder to deal with, later maybe */
		if (sdata->u.mgd.use_4addr)
			goto clear;
		/* software powersave is a huge mess, avoid all of it */
		if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK))
			goto clear;
		if (ieee80211_hw_check(&local->hw, SUPPORTS_PS) &&
		    !ieee80211_hw_check(&local->hw, SUPPORTS_DYNAMIC_PS))
			goto clear;
		if (sta->sta.tdls) {
			fastrx.da_offs = offsetof(struct ieee80211_hdr, addr1);
			fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr2);
			fastrx.expected_ds_bits = 0;
		} else {
			fastrx.sta_notify = sdata->u.mgd.probe_send_count > 0;
			fastrx.da_offs = offsetof(struct ieee80211_hdr, addr1);
			fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr3);
			fastrx.expected_ds_bits =
				cpu_to_le16(IEEE80211_FCTL_FROMDS);
		}
		break;
	case NL80211_IFTYPE_AP_VLAN:
	case NL80211_IFTYPE_AP:
		/* parallel-rx requires this, at least with calls to
		 * ieee80211_sta_ps_transition()
		 */
		if (!ieee80211_hw_check(&local->hw, AP_LINK_PS))
			goto clear;
		fastrx.da_offs = offsetof(struct ieee80211_hdr, addr3);
		fastrx.sa_offs = offsetof(struct ieee80211_hdr, addr2);
		fastrx.expected_ds_bits = cpu_to_le16(IEEE80211_FCTL_TODS);

		fastrx.internal_forward =
			!(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
			(sdata->vif.type != NL80211_IFTYPE_AP_VLAN ||
			 !sdata->u.vlan.sta);
		break;
	default:
		goto clear;
	}

	if (!test_sta_flag(sta, WLAN_STA_AUTHORIZED))
		goto clear;

	rcu_read_lock();
	key = rcu_dereference(sta->ptk[sta->ptk_idx]);
	if (key) {
		switch (key->conf.cipher) {
		case WLAN_CIPHER_SUITE_TKIP:
			/* we don't want to deal with MMIC in fast-rx */
			goto clear_rcu;
		case WLAN_CIPHER_SUITE_CCMP:
		case WLAN_CIPHER_SUITE_CCMP_256:
		case WLAN_CIPHER_SUITE_GCMP:
		case WLAN_CIPHER_SUITE_GCMP_256:
			break;
		default:
			/* we also don't want to deal with WEP or cipher scheme
			 * since those require looking up the key idx in the
			 * frame, rather than assuming the PTK is used
			 * (we need to revisit this once we implement the real
			 * PTK index, which is now valid in the spec, but we
			 * haven't implemented that part yet)
			 */
			goto clear_rcu;
		}

		fastrx.key = true;
		fastrx.icv_len = key->conf.icv_len;
	}

	assign = true;
 clear_rcu:
	rcu_read_unlock();
 clear:
	__release(check_fast_rx);

	if (assign)
		new = kmemdup(&fastrx, sizeof(fastrx), GFP_KERNEL);

	spin_lock_bh(&sta->lock);
	old = rcu_dereference_protected(sta->fast_rx, true);
	rcu_assign_pointer(sta->fast_rx, new);
	spin_unlock_bh(&sta->lock);

	if (old)
		kfree_rcu(old, rcu_head);
}

void ieee80211_clear_fast_rx(struct sta_info *sta)
{
	struct ieee80211_fast_rx *old;

	spin_lock_bh(&sta->lock);
	old = rcu_dereference_protected(sta->fast_rx, true);
	RCU_INIT_POINTER(sta->fast_rx, NULL);
	spin_unlock_bh(&sta->lock);

	if (old)
		kfree_rcu(old, rcu_head);
}

void __ieee80211_check_fast_rx_iface(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;
	struct sta_info *sta;

	lockdep_assert_held(&local->sta_mtx);

	list_for_each_entry_rcu(sta, &local->sta_list, list) {
		if (sdata != sta->sdata &&
		    (!sta->sdata->bss || sta->sdata->bss != sdata->bss))
			continue;
		ieee80211_check_fast_rx(sta);
	}
}

void ieee80211_check_fast_rx_iface(struct ieee80211_sub_if_data *sdata)
{
	struct ieee80211_local *local = sdata->local;

	mutex_lock(&local->sta_mtx);
	__ieee80211_check_fast_rx_iface(sdata);
	mutex_unlock(&local->sta_mtx);
}

static bool ieee80211_invoke_fast_rx(struct ieee80211_rx_data *rx,
				     struct ieee80211_fast_rx *fast_rx)
{
	struct sk_buff *skb = rx->skb;
	struct ieee80211_hdr *hdr = (void *)skb->data;
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
	struct sta_info *sta = rx->sta;
	int orig_len = skb->len;
	int snap_offs = ieee80211_hdrlen(hdr->frame_control);
	struct {
		u8 snap[sizeof(rfc1042_header)];
		__be16 proto;
	} *payload __aligned(2);
	struct {
		u8 da[ETH_ALEN];
		u8 sa[ETH_ALEN];
	} addrs __aligned(2);
3756 3757 3758 3759
	struct ieee80211_sta_rx_stats *stats = &sta->rx_stats;

	if (fast_rx->uses_rss)
		stats = this_cpu_ptr(sta->pcpu_rx_stats);
J
Johannes Berg 已提交
3760 3761 3762 3763 3764 3765 3766 3767 3768 3769 3770 3771 3772 3773 3774 3775 3776 3777 3778 3779 3780 3781 3782 3783 3784 3785 3786 3787 3788 3789 3790 3791 3792 3793 3794 3795 3796 3797 3798 3799 3800 3801 3802 3803 3804 3805 3806 3807 3808 3809 3810 3811 3812 3813 3814 3815 3816 3817 3818 3819 3820 3821 3822 3823 3824 3825 3826 3827 3828 3829 3830 3831 3832 3833 3834 3835 3836 3837 3838 3839 3840

	/* for parallel-rx, we need to have DUP_VALIDATED, otherwise we write
	 * to a common data structure; drivers can implement that per queue
	 * but we don't have that information in mac80211
	 */
	if (!(status->flag & RX_FLAG_DUP_VALIDATED))
		return false;

#define FAST_RX_CRYPT_FLAGS	(RX_FLAG_PN_VALIDATED | RX_FLAG_DECRYPTED)

	/* If using encryption, we also need to have:
	 *  - PN_VALIDATED: similar, but the implementation is tricky
	 *  - DECRYPTED: necessary for PN_VALIDATED
	 */
	if (fast_rx->key &&
	    (status->flag & FAST_RX_CRYPT_FLAGS) != FAST_RX_CRYPT_FLAGS)
		return false;

	/* we don't deal with A-MSDU deaggregation here */
	if (status->rx_flags & IEEE80211_RX_AMSDU)
		return false;

	if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
		return false;

	if (unlikely(ieee80211_is_frag(hdr)))
		return false;

	/* Since our interface address cannot be multicast, this
	 * implicitly also rejects multicast frames without the
	 * explicit check.
	 *
	 * We shouldn't get any *data* frames not addressed to us
	 * (AP mode will accept multicast *management* frames), but
	 * punting here will make it go through the full checks in
	 * ieee80211_accept_frame().
	 */
	if (!ether_addr_equal(fast_rx->vif_addr, hdr->addr1))
		return false;

	if ((hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_FROMDS |
					      IEEE80211_FCTL_TODS)) !=
	    fast_rx->expected_ds_bits)
		goto drop;

	/* assign the key to drop unencrypted frames (later)
	 * and strip the IV/MIC if necessary
	 */
	if (fast_rx->key && !(status->flag & RX_FLAG_IV_STRIPPED)) {
		/* GCMP header length is the same */
		snap_offs += IEEE80211_CCMP_HDR_LEN;
	}

	if (!pskb_may_pull(skb, snap_offs + sizeof(*payload)))
		goto drop;
	payload = (void *)(skb->data + snap_offs);

	if (!ether_addr_equal(payload->snap, fast_rx->rfc1042_hdr))
		return false;

	/* Don't handle these here since they require special code.
	 * Accept AARP and IPX even though they should come with a
	 * bridge-tunnel header - but if we get them this way then
	 * there's little point in discarding them.
	 */
	if (unlikely(payload->proto == cpu_to_be16(ETH_P_TDLS) ||
		     payload->proto == fast_rx->control_port_protocol))
		return false;

	/* after this point, don't punt to the slowpath! */

	if (rx->key && !(status->flag & RX_FLAG_MIC_STRIPPED) &&
	    pskb_trim(skb, skb->len - fast_rx->icv_len))
		goto drop;

	if (unlikely(fast_rx->sta_notify)) {
		ieee80211_sta_rx_notify(rx->sdata, hdr);
		fast_rx->sta_notify = false;
	}

	/* statistics part of ieee80211_rx_h_sta_process() */
3841 3842
	stats->last_rx = jiffies;
	stats->last_rate = sta_stats_encode_rate(status);
J
Johannes Berg 已提交
3843

3844
	stats->fragments++;
J
Johannes Berg 已提交
3845 3846

	if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
3847 3848 3849 3850
		stats->last_signal = status->signal;
		if (!fast_rx->uses_rss)
			ewma_signal_add(&sta->rx_stats_avg.signal,
					-status->signal);
J
Johannes Berg 已提交
3851 3852 3853 3854 3855
	}

	if (status->chains) {
		int i;

3856
		stats->chains = status->chains;
J
Johannes Berg 已提交
3857 3858 3859 3860 3861 3862
		for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {
			int signal = status->chain_signal[i];

			if (!(status->chains & BIT(i)))
				continue;

3863 3864 3865 3866
			stats->chain_signal_last[i] = signal;
			if (!fast_rx->uses_rss)
				ewma_signal_add(&sta->rx_stats_avg.chain_signal[i],
						-signal);
J
Johannes Berg 已提交
3867 3868 3869 3870 3871 3872 3873 3874 3875 3876 3877 3878 3879 3880 3881 3882 3883 3884 3885 3886 3887 3888 3889 3890
		}
	}
	/* end of statistics */

	if (rx->key && !ieee80211_has_protected(hdr->frame_control))
		goto drop;

	/* do the header conversion - first grab the addresses */
	ether_addr_copy(addrs.da, skb->data + fast_rx->da_offs);
	ether_addr_copy(addrs.sa, skb->data + fast_rx->sa_offs);
	/* remove the SNAP but leave the ethertype */
	skb_pull(skb, snap_offs + sizeof(rfc1042_header));
	/* push the addresses in front */
	memcpy(skb_push(skb, sizeof(addrs)), &addrs, sizeof(addrs));

	skb->dev = fast_rx->dev;

	ieee80211_rx_stats(fast_rx->dev, skb->len);

	/* The seqno index has the same property as needed
	 * for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS
	 * for non-QoS-data frames. Here we know it's a data
	 * frame, so count MSDUs.
	 */
3891 3892 3893 3894
	u64_stats_update_begin(&stats->syncp);
	stats->msdu[rx->seqno_idx]++;
	stats->bytes += orig_len;
	u64_stats_update_end(&stats->syncp);
J
Johannes Berg 已提交
3895 3896 3897 3898 3899 3900 3901 3902 3903 3904 3905 3906 3907 3908 3909 3910 3911 3912 3913 3914 3915 3916 3917 3918 3919 3920 3921 3922 3923 3924

	if (fast_rx->internal_forward) {
		struct sta_info *dsta = sta_info_get(rx->sdata, skb->data);

		if (dsta) {
			/*
			 * Send to wireless media and increase priority by 256
			 * to keep the received priority instead of
			 * reclassifying the frame (see cfg80211_classify8021d).
			 */
			skb->priority += 256;
			skb->protocol = htons(ETH_P_802_3);
			skb_reset_network_header(skb);
			skb_reset_mac_header(skb);
			dev_queue_xmit(skb);
			return true;
		}
	}

	/* deliver to local stack */
	skb->protocol = eth_type_trans(skb, fast_rx->dev);
	memset(skb->cb, 0, sizeof(skb->cb));
	if (rx->napi)
		napi_gro_receive(rx->napi, skb);
	else
		netif_receive_skb(skb);

	return true;
 drop:
	dev_kfree_skb(skb);
3925
	stats->dropped++;
J
Johannes Berg 已提交
3926 3927 3928
	return true;
}

3929 3930 3931 3932 3933 3934 3935 3936 3937 3938 3939 3940 3941 3942
/*
 * This function returns whether or not the SKB
 * was destined for RX processing or not, which,
 * if consume is true, is equivalent to whether
 * or not the skb was consumed.
 */
static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,
					    struct sk_buff *skb, bool consume)
{
	struct ieee80211_local *local = rx->local;
	struct ieee80211_sub_if_data *sdata = rx->sdata;

	rx->skb = skb;

J
Johannes Berg 已提交
3943 3944 3945 3946 3947 3948 3949 3950 3951 3952 3953 3954 3955 3956 3957
	/* See if we can do fast-rx; if we have to copy we already lost,
	 * so punt in that case. We should never have to deliver a data
	 * frame to multiple interfaces anyway.
	 *
	 * We skip the ieee80211_accept_frame() call and do the necessary
	 * checking inside ieee80211_invoke_fast_rx().
	 */
	if (consume && rx->sta) {
		struct ieee80211_fast_rx *fast_rx;

		fast_rx = rcu_dereference(rx->sta->fast_rx);
		if (fast_rx && ieee80211_invoke_fast_rx(rx, fast_rx))
			return true;
	}

3958
	if (!ieee80211_accept_frame(rx))
3959 3960 3961 3962 3963 3964 3965
		return false;

	if (!consume) {
		skb = skb_copy(skb, GFP_ATOMIC);
		if (!skb) {
			if (net_ratelimit())
				wiphy_debug(local->hw.wiphy,
3966
					"failed to copy skb for %s\n",
3967 3968 3969 3970 3971 3972 3973 3974 3975 3976 3977
					sdata->name);
			return true;
		}

		rx->skb = skb;
	}

	ieee80211_invoke_rx_handlers(rx);
	return true;
}

3978
/*
3979
 * This is the actual Rx frames handler. as it belongs to Rx path it must
3980
 * be called with rcu_read_lock protection.
3981
 */
3982
static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
3983
					 struct ieee80211_sta *pubsta,
3984 3985
					 struct sk_buff *skb,
					 struct napi_struct *napi)
3986 3987 3988 3989
{
	struct ieee80211_local *local = hw_to_local(hw);
	struct ieee80211_sub_if_data *sdata;
	struct ieee80211_hdr *hdr;
Z
Zhu Yi 已提交
3990
	__le16 fc;
3991
	struct ieee80211_rx_data rx;
3992
	struct ieee80211_sub_if_data *prev;
3993
	struct rhash_head *tmp;
Z
Zhu Yi 已提交
3994
	int err = 0;
3995

Z
Zhu Yi 已提交
3996
	fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
3997 3998 3999
	memset(&rx, 0, sizeof(rx));
	rx.skb = skb;
	rx.local = local;
4000
	rx.napi = napi;
4001

Z
Zhu Yi 已提交
4002
	if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc))
4003
		I802_DEBUG_INC(local->dot11ReceivedFragmentCount);
4004

4005 4006 4007 4008 4009 4010 4011
	if (ieee80211_is_mgmt(fc)) {
		/* drop frame if too short for header */
		if (skb->len < ieee80211_hdrlen(fc))
			err = -ENOBUFS;
		else
			err = skb_linearize(skb);
	} else {
Z
Zhu Yi 已提交
4012
		err = !pskb_may_pull(skb, ieee80211_hdrlen(fc));
4013
	}
Z
Zhu Yi 已提交
4014 4015 4016 4017 4018 4019 4020

	if (err) {
		dev_kfree_skb(skb);
		return;
	}

	hdr = (struct ieee80211_hdr *)skb->data;
4021
	ieee80211_parse_qos(&rx);
4022
	ieee80211_verify_alignment(&rx);
4023

J
Johannes Berg 已提交
4024 4025 4026 4027
	if (unlikely(ieee80211_is_probe_resp(hdr->frame_control) ||
		     ieee80211_is_beacon(hdr->frame_control)))
		ieee80211_scan_rx(local, skb);

4028 4029 4030 4031 4032 4033 4034 4035
	if (pubsta) {
		rx.sta = container_of(pubsta, struct sta_info, sta);
		rx.sdata = rx.sta->sdata;
		if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
			return;
		goto out;
	} else if (ieee80211_is_data(fc)) {
		struct sta_info *sta, *prev_sta;
4036 4037
		const struct bucket_table *tbl;

4038
		prev_sta = NULL;
4039

4040 4041 4042
		tbl = rht_dereference_rcu(local->sta_hash.tbl, &local->sta_hash);

		for_each_sta_info(local, tbl, hdr->addr2, sta, tmp) {
4043 4044 4045 4046 4047 4048 4049
			if (!prev_sta) {
				prev_sta = sta;
				continue;
			}

			rx.sta = prev_sta;
			rx.sdata = prev_sta->sdata;
4050
			ieee80211_prepare_and_rx_handle(&rx, skb, false);
4051

4052
			prev_sta = sta;
4053
		}
4054 4055 4056 4057 4058

		if (prev_sta) {
			rx.sta = prev_sta;
			rx.sdata = prev_sta->sdata;

4059
			if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
4060
				return;
4061
			goto out;
4062
		}
4063 4064
	}

4065
	prev = NULL;
4066

4067 4068 4069
	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
		if (!ieee80211_sdata_running(sdata))
			continue;
J
Johannes Berg 已提交
4070

4071 4072 4073
		if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
		    sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
			continue;
J
Johannes Berg 已提交
4074

4075 4076 4077 4078 4079
		/*
		 * frame is destined for this interface, but if it's
		 * not also for the previous one we handle that after
		 * the loop to avoid copying the SKB once too much
		 */
4080

4081
		if (!prev) {
4082
			prev = sdata;
4083
			continue;
J
Johannes Berg 已提交
4084
		}
4085

4086
		rx.sta = sta_info_get_bss(prev, hdr->addr2);
4087 4088
		rx.sdata = prev;
		ieee80211_prepare_and_rx_handle(&rx, skb, false);
4089

4090 4091 4092 4093
		prev = sdata;
	}

	if (prev) {
4094
		rx.sta = sta_info_get_bss(prev, hdr->addr2);
4095
		rx.sdata = prev;
4096

4097 4098
		if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
			return;
4099
	}
4100

4101
 out:
4102
	dev_kfree_skb(skb);
4103
}
4104 4105 4106 4107 4108

/*
 * This is the receive path handler. It is called by a low level driver when an
 * 802.11 MPDU is received from the hardware.
 */
4109 4110
void ieee80211_rx_napi(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta,
		       struct sk_buff *skb, struct napi_struct *napi)
4111 4112
{
	struct ieee80211_local *local = hw_to_local(hw);
4113 4114
	struct ieee80211_rate *rate = NULL;
	struct ieee80211_supported_band *sband;
4115
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
4116

4117 4118
	WARN_ON_ONCE(softirq_count() == 0);

4119
	if (WARN_ON(status->band >= NUM_NL80211_BANDS))
J
Johannes Berg 已提交
4120
		goto drop;
4121 4122

	sband = local->hw.wiphy->bands[status->band];
J
Johannes Berg 已提交
4123 4124
	if (WARN_ON(!sband))
		goto drop;
4125

J
Johannes Berg 已提交
4126 4127 4128 4129 4130 4131 4132
	/*
	 * If we're suspending, it is possible although not too likely
	 * that we'd be receiving frames after having already partially
	 * quiesced the stack. We can't process such frames then since
	 * that might, for example, cause stations to be added or other
	 * driver callbacks be invoked.
	 */
J
Johannes Berg 已提交
4133 4134
	if (unlikely(local->quiescing || local->suspended))
		goto drop;
J
Johannes Berg 已提交
4135

4136 4137 4138 4139
	/* We might be during a HW reconfig, prevent Rx for the same reason */
	if (unlikely(local->in_reconfig))
		goto drop;

4140 4141 4142 4143
	/*
	 * The same happens when we're not even started,
	 * but that's worth a warning.
	 */
J
Johannes Berg 已提交
4144 4145
	if (WARN_ON(!local->started))
		goto drop;
4146

4147
	if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC))) {
4148
		/*
4149 4150
		 * Validate the rate, unless a PLCP error means that
		 * we probably can't have a valid rate here anyway.
4151
		 */
4152 4153 4154 4155 4156 4157 4158 4159 4160 4161 4162 4163

		if (status->flag & RX_FLAG_HT) {
			/*
			 * rate_idx is MCS index, which can be [0-76]
			 * as documented on:
			 *
			 * http://wireless.kernel.org/en/developers/Documentation/ieee80211/802.11n
			 *
			 * Anything else would be some sort of driver or
			 * hardware error. The driver should catch hardware
			 * errors.
			 */
J
Johannes Berg 已提交
4164
			if (WARN(status->rate_idx > 76,
4165 4166 4167 4168 4169 4170
				 "Rate marked as an HT rate but passed "
				 "status->rate_idx is not "
				 "an MCS index [0-76]: %d (0x%02x)\n",
				 status->rate_idx,
				 status->rate_idx))
				goto drop;
4171 4172 4173 4174 4175 4176 4177
		} else if (status->flag & RX_FLAG_VHT) {
			if (WARN_ONCE(status->rate_idx > 9 ||
				      !status->vht_nss ||
				      status->vht_nss > 8,
				      "Rate marked as a VHT rate but data is invalid: MCS: %d, NSS: %d\n",
				      status->rate_idx, status->vht_nss))
				goto drop;
4178
		} else {
J
Johannes Berg 已提交
4179
			if (WARN_ON(status->rate_idx >= sband->n_bitrates))
4180 4181 4182
				goto drop;
			rate = &sband->bitrates[status->rate_idx];
		}
4183
	}
4184

4185 4186
	status->rx_flags = 0;

4187 4188 4189 4190 4191 4192 4193 4194 4195 4196 4197 4198 4199
	/*
	 * key references and virtual interfaces are protected using RCU
	 * and this requires that we are in a read-side RCU section during
	 * receive processing
	 */
	rcu_read_lock();

	/*
	 * Frames with failed FCS/PLCP checksum are not returned,
	 * all other frames are returned without radiotap header
	 * if it was previously present.
	 * Also, frames with less than 16 bytes are dropped.
	 */
4200
	skb = ieee80211_rx_monitor(local, skb, rate);
4201 4202 4203 4204 4205
	if (!skb) {
		rcu_read_unlock();
		return;
	}

4206 4207 4208
	ieee80211_tpt_led_trig_rx(local,
			((struct ieee80211_hdr *)skb->data)->frame_control,
			skb->len);
4209 4210

	__ieee80211_rx_handle_packet(hw, pubsta, skb, napi);
4211 4212

	rcu_read_unlock();
J
Johannes Berg 已提交
4213 4214 4215 4216

	return;
 drop:
	kfree_skb(skb);
4217
}
4218
EXPORT_SYMBOL(ieee80211_rx_napi);
4219 4220 4221

/* This is a version of the rx handler that can be called from hard irq
 * context. Post the skb on the queue and schedule the tasklet */
4222
void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb)
4223 4224 4225 4226 4227 4228 4229 4230 4231 4232
{
	struct ieee80211_local *local = hw_to_local(hw);

	BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));

	skb->pkt_type = IEEE80211_RX_MSG;
	skb_queue_tail(&local->skb_queue, skb);
	tasklet_schedule(&local->tasklet);
}
EXPORT_SYMBOL(ieee80211_rx_irqsafe);