rx.c 100.5 KB
Newer Older
1 2 3 4
/*
 * Copyright 2002-2005, Instant802 Networks, Inc.
 * Copyright 2005-2006, Devicescape Software, Inc.
 * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
5
 * Copyright 2007-2010	Johannes Berg <johannes@sipsolutions.net>
6
 * Copyright 2013-2014  Intel Mobile Communications GmbH
7 8 9 10 11 12
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

13
#include <linux/jiffies.h>
14
#include <linux/slab.h>
15 16 17 18
#include <linux/kernel.h>
#include <linux/skbuff.h>
#include <linux/netdevice.h>
#include <linux/etherdevice.h>
19
#include <linux/rcupdate.h>
20
#include <linux/export.h>
21 22
#include <net/mac80211.h>
#include <net/ieee80211_radiotap.h>
23
#include <asm/unaligned.h>
24 25

#include "ieee80211_i.h"
26
#include "driver-ops.h"
J
Johannes Berg 已提交
27
#include "led.h"
28
#include "mesh.h"
29 30 31 32
#include "wep.h"
#include "wpa.h"
#include "tkip.h"
#include "wme.h"
33
#include "rate.h"
34

35 36 37 38 39 40 41
/*
 * monitor mode reception
 *
 * This function cleans up the SKB, i.e. it removes all the stuff
 * only useful for monitoring.
 */
static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
42 43
					   struct sk_buff *skb,
					   unsigned int rtap_vendor_space)
44 45 46
{
	if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) {
		if (likely(skb->len > FCS_LEN))
Z
Zhu Yi 已提交
47
			__pskb_trim(skb, skb->len - FCS_LEN);
48 49 50 51
		else {
			/* driver bug */
			WARN_ON(1);
			dev_kfree_skb(skb);
52
			return NULL;
53 54 55
		}
	}

56 57
	__pskb_pull(skb, rtap_vendor_space);

58 59 60
	return skb;
}

61 62
static inline bool should_drop_frame(struct sk_buff *skb, int present_fcs_len,
				     unsigned int rtap_vendor_space)
63
{
64
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
65 66 67
	struct ieee80211_hdr *hdr;

	hdr = (void *)(skb->data + rtap_vendor_space);
68

69 70 71
	if (status->flag & (RX_FLAG_FAILED_FCS_CRC |
			    RX_FLAG_FAILED_PLCP_CRC |
			    RX_FLAG_AMPDU_IS_ZEROLEN))
72 73
		return true;

74
	if (unlikely(skb->len < 16 + present_fcs_len + rtap_vendor_space))
75 76
		return true;

H
Harvey Harrison 已提交
77 78 79
	if (ieee80211_is_ctl(hdr->frame_control) &&
	    !ieee80211_is_pspoll(hdr->frame_control) &&
	    !ieee80211_is_back_req(hdr->frame_control))
80 81 82
		return true;

	return false;
83 84
}

85
static int
86 87 88
ieee80211_rx_radiotap_hdrlen(struct ieee80211_local *local,
			     struct ieee80211_rx_status *status,
			     struct sk_buff *skb)
89 90 91 92
{
	int len;

	/* always present fields */
93
	len = sizeof(struct ieee80211_radiotap_header) + 8;
94

95 96 97
	/* allocate extra bitmaps */
	if (status->chains)
		len += 4 * hweight8(status->chains);
98 99 100

	if (ieee80211_have_rx_timestamp(status)) {
		len = ALIGN(len, 8);
101
		len += 8;
102
	}
J
Johannes Berg 已提交
103
	if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
104 105
		len += 1;

106 107 108 109
	/* antenna field, if we don't have per-chain info */
	if (!status->chains)
		len += 1;

110 111
	/* padding for RX_FLAGS if necessary */
	len = ALIGN(len, 2);
112

113 114 115
	if (status->flag & RX_FLAG_HT) /* HT info */
		len += 3;

116
	if (status->flag & RX_FLAG_AMPDU_DETAILS) {
117
		len = ALIGN(len, 4);
118 119 120
		len += 8;
	}

121 122 123 124 125
	if (status->flag & RX_FLAG_VHT) {
		len = ALIGN(len, 2);
		len += 12;
	}

126 127 128 129 130
	if (status->chains) {
		/* antenna and antenna signal fields */
		len += 2 * hweight8(status->chains);
	}

131 132 133 134 135 136 137 138 139 140 141 142 143 144 145
	if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
		struct ieee80211_vendor_radiotap *rtap = (void *)skb->data;

		/* vendor presence bitmap */
		len += 4;
		/* alignment for fixed 6-byte vendor data header */
		len = ALIGN(len, 2);
		/* vendor data header */
		len += 6;
		if (WARN_ON(rtap->align == 0))
			rtap->align = 1;
		len = ALIGN(len, rtap->align);
		len += rtap->len + rtap->pad;
	}

146 147 148
	return len;
}

149
/*
150 151 152 153 154 155 156 157
 * ieee80211_add_rx_radiotap_header - add radiotap header
 *
 * add a radiotap header containing all the fields which the hardware provided.
 */
static void
ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
				 struct sk_buff *skb,
				 struct ieee80211_rate *rate,
158
				 int rtap_len, bool has_fcs)
159
{
160
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
161 162
	struct ieee80211_radiotap_header *rthdr;
	unsigned char *pos;
163 164
	__le32 *it_present;
	u32 it_present_val;
165
	u16 rx_flags = 0;
166
	u16 channel_flags = 0;
167 168
	int mpdulen, chain;
	unsigned long chains = status->chains;
169 170 171 172 173 174 175
	struct ieee80211_vendor_radiotap rtap = {};

	if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
		rtap = *(struct ieee80211_vendor_radiotap *)skb->data;
		/* rtap.len and rtap.pad are undone immediately */
		skb_pull(skb, sizeof(rtap) + rtap.len + rtap.pad);
	}
176 177 178 179

	mpdulen = skb->len;
	if (!(has_fcs && (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)))
		mpdulen += FCS_LEN;
180 181

	rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len);
182
	memset(rthdr, 0, rtap_len - rtap.len - rtap.pad);
183
	it_present = &rthdr->it_present;
184 185

	/* radiotap header, set always present flags */
186
	rthdr->it_len = cpu_to_le16(rtap_len);
187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202
	it_present_val = BIT(IEEE80211_RADIOTAP_FLAGS) |
			 BIT(IEEE80211_RADIOTAP_CHANNEL) |
			 BIT(IEEE80211_RADIOTAP_RX_FLAGS);

	if (!status->chains)
		it_present_val |= BIT(IEEE80211_RADIOTAP_ANTENNA);

	for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
		it_present_val |=
			BIT(IEEE80211_RADIOTAP_EXT) |
			BIT(IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE);
		put_unaligned_le32(it_present_val, it_present);
		it_present++;
		it_present_val = BIT(IEEE80211_RADIOTAP_ANTENNA) |
				 BIT(IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
	}
203

204 205 206 207 208 209 210 211
	if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
		it_present_val |= BIT(IEEE80211_RADIOTAP_VENDOR_NAMESPACE) |
				  BIT(IEEE80211_RADIOTAP_EXT);
		put_unaligned_le32(it_present_val, it_present);
		it_present++;
		it_present_val = rtap.present;
	}

212 213 214 215
	put_unaligned_le32(it_present_val, it_present);

	pos = (void *)(it_present + 1);

216 217 218
	/* the order of the following fields is important */

	/* IEEE80211_RADIOTAP_TSFT */
219
	if (ieee80211_have_rx_timestamp(status)) {
220 221 222
		/* padding */
		while ((pos - (u8 *)rthdr) & 7)
			*pos++ = 0;
223 224 225 226
		put_unaligned_le64(
			ieee80211_calculate_rx_timestamp(local, status,
							 mpdulen, 0),
			pos);
J
Johannes Berg 已提交
227
		rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
228 229 230 231
		pos += 8;
	}

	/* IEEE80211_RADIOTAP_FLAGS */
232
	if (has_fcs && (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS))
233
		*pos |= IEEE80211_RADIOTAP_F_FCS;
J
Johannes Berg 已提交
234 235
	if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
		*pos |= IEEE80211_RADIOTAP_F_BADFCS;
236 237
	if (status->flag & RX_FLAG_SHORTPRE)
		*pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
238 239 240
	pos++;

	/* IEEE80211_RADIOTAP_RATE */
241
	if (!rate || status->flag & (RX_FLAG_HT | RX_FLAG_VHT)) {
242
		/*
243
		 * Without rate information don't add it. If we have,
244
		 * MCS information is a separate field in radiotap,
245 246
		 * added below. The byte here is needed as padding
		 * for the channel though, so initialise it to 0.
247 248
		 */
		*pos = 0;
249
	} else {
250
		int shift = 0;
251
		rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
252 253 254 255 256
		if (status->flag & RX_FLAG_10MHZ)
			shift = 1;
		else if (status->flag & RX_FLAG_5MHZ)
			shift = 2;
		*pos = DIV_ROUND_UP(rate->bitrate, 5 * (1 << shift));
257
	}
258 259 260
	pos++;

	/* IEEE80211_RADIOTAP_CHANNEL */
261
	put_unaligned_le16(status->freq, pos);
262
	pos += 2;
263 264 265 266 267
	if (status->flag & RX_FLAG_10MHZ)
		channel_flags |= IEEE80211_CHAN_HALF;
	else if (status->flag & RX_FLAG_5MHZ)
		channel_flags |= IEEE80211_CHAN_QUARTER;

268
	if (status->band == IEEE80211_BAND_5GHZ)
269
		channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ;
270
	else if (status->flag & (RX_FLAG_HT | RX_FLAG_VHT))
271
		channel_flags |= IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
272
	else if (rate && rate->flags & IEEE80211_RATE_ERP_G)
273
		channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ;
274
	else if (rate)
275
		channel_flags |= IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ;
276
	else
277 278
		channel_flags |= IEEE80211_CHAN_2GHZ;
	put_unaligned_le16(channel_flags, pos);
279 280 281
	pos += 2;

	/* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
282 283
	if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM &&
	    !(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
284 285 286 287 288 289 290 291
		*pos = status->signal;
		rthdr->it_present |=
			cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
		pos++;
	}

	/* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */

292 293 294 295 296
	if (!status->chains) {
		/* IEEE80211_RADIOTAP_ANTENNA */
		*pos = status->antenna;
		pos++;
	}
297 298 299 300 301

	/* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */

	/* IEEE80211_RADIOTAP_RX_FLAGS */
	/* ensure 2 byte alignment for the 2 byte field as required */
302
	if ((pos - (u8 *)rthdr) & 1)
303
		*pos++ = 0;
J
Johannes Berg 已提交
304
	if (status->flag & RX_FLAG_FAILED_PLCP_CRC)
305 306
		rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP;
	put_unaligned_le16(rx_flags, pos);
307
	pos += 2;
308 309

	if (status->flag & RX_FLAG_HT) {
310 311
		unsigned int stbc;

312
		rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_MCS);
313
		*pos++ = local->hw.radiotap_mcs_details;
314 315 316 317 318
		*pos = 0;
		if (status->flag & RX_FLAG_SHORT_GI)
			*pos |= IEEE80211_RADIOTAP_MCS_SGI;
		if (status->flag & RX_FLAG_40MHZ)
			*pos |= IEEE80211_RADIOTAP_MCS_BW_40;
319 320
		if (status->flag & RX_FLAG_HT_GF)
			*pos |= IEEE80211_RADIOTAP_MCS_FMT_GF;
321 322
		if (status->flag & RX_FLAG_LDPC)
			*pos |= IEEE80211_RADIOTAP_MCS_FEC_LDPC;
323 324
		stbc = (status->flag & RX_FLAG_STBC_MASK) >> RX_FLAG_STBC_SHIFT;
		*pos |= stbc << IEEE80211_RADIOTAP_MCS_STBC_SHIFT;
325 326 327
		pos++;
		*pos++ = status->rate_idx;
	}
328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358

	if (status->flag & RX_FLAG_AMPDU_DETAILS) {
		u16 flags = 0;

		/* ensure 4 byte alignment */
		while ((pos - (u8 *)rthdr) & 3)
			pos++;
		rthdr->it_present |=
			cpu_to_le32(1 << IEEE80211_RADIOTAP_AMPDU_STATUS);
		put_unaligned_le32(status->ampdu_reference, pos);
		pos += 4;
		if (status->flag & RX_FLAG_AMPDU_REPORT_ZEROLEN)
			flags |= IEEE80211_RADIOTAP_AMPDU_REPORT_ZEROLEN;
		if (status->flag & RX_FLAG_AMPDU_IS_ZEROLEN)
			flags |= IEEE80211_RADIOTAP_AMPDU_IS_ZEROLEN;
		if (status->flag & RX_FLAG_AMPDU_LAST_KNOWN)
			flags |= IEEE80211_RADIOTAP_AMPDU_LAST_KNOWN;
		if (status->flag & RX_FLAG_AMPDU_IS_LAST)
			flags |= IEEE80211_RADIOTAP_AMPDU_IS_LAST;
		if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_ERROR)
			flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_ERR;
		if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
			flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_KNOWN;
		put_unaligned_le16(flags, pos);
		pos += 2;
		if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
			*pos++ = status->ampdu_delimiter_crc;
		else
			*pos++ = 0;
		*pos++ = 0;
	}
359

360 361 362 363 364 365 366 367 368
	if (status->flag & RX_FLAG_VHT) {
		u16 known = local->hw.radiotap_vht_details;

		rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_VHT);
		put_unaligned_le16(known, pos);
		pos += 2;
		/* flags */
		if (status->flag & RX_FLAG_SHORT_GI)
			*pos |= IEEE80211_RADIOTAP_VHT_FLAG_SGI;
369 370 371
		/* in VHT, STBC is binary */
		if (status->flag & RX_FLAG_STBC_MASK)
			*pos |= IEEE80211_RADIOTAP_VHT_FLAG_STBC;
372 373
		if (status->vht_flag & RX_VHT_FLAG_BF)
			*pos |= IEEE80211_RADIOTAP_VHT_FLAG_BEAMFORMED;
374 375
		pos++;
		/* bandwidth */
376
		if (status->vht_flag & RX_VHT_FLAG_80MHZ)
377
			*pos++ = 4;
378
		else if (status->vht_flag & RX_VHT_FLAG_160MHZ)
379 380 381 382 383 384 385 386 387
			*pos++ = 11;
		else if (status->flag & RX_FLAG_40MHZ)
			*pos++ = 1;
		else /* 20 MHz */
			*pos++ = 0;
		/* MCS/NSS */
		*pos = (status->rate_idx << 4) | status->vht_nss;
		pos += 4;
		/* coding field */
388 389
		if (status->flag & RX_FLAG_LDPC)
			*pos |= IEEE80211_RADIOTAP_CODING_LDPC_USER0;
390 391 392 393 394 395 396
		pos++;
		/* group ID */
		pos++;
		/* partial_aid */
		pos += 2;
	}

397 398 399 400
	for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
		*pos++ = status->chain_signal[chain];
		*pos++ = chain;
	}
401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416

	if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) {
		/* ensure 2 byte alignment for the vendor field as required */
		if ((pos - (u8 *)rthdr) & 1)
			*pos++ = 0;
		*pos++ = rtap.oui[0];
		*pos++ = rtap.oui[1];
		*pos++ = rtap.oui[2];
		*pos++ = rtap.subns;
		put_unaligned_le16(rtap.len, pos);
		pos += 2;
		/* align the actual payload as requested */
		while ((pos - (u8 *)rthdr) & (rtap.align - 1))
			*pos++ = 0;
		/* data (and possible padding) already follows */
	}
417 418
}

419 420 421 422 423 424 425
/*
 * This function copies a received frame to all monitor interfaces and
 * returns a cleaned-up SKB that no longer includes the FCS nor the
 * radiotap header the driver might have added.
 */
static struct sk_buff *
ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
426
		     struct ieee80211_rate *rate)
427
{
428
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb);
429
	struct ieee80211_sub_if_data *sdata;
430
	int rt_hdrlen, needed_headroom;
431 432 433
	struct sk_buff *skb, *skb2;
	struct net_device *prev_dev = NULL;
	int present_fcs_len = 0;
434 435 436 437 438 439 440
	unsigned int rtap_vendor_space = 0;

	if (unlikely(status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA)) {
		struct ieee80211_vendor_radiotap *rtap = (void *)origskb->data;

		rtap_vendor_space = sizeof(*rtap) + rtap->len + rtap->pad;
	}
441 442 443 444 445 446 447 448 449

	/*
	 * First, we may need to make a copy of the skb because
	 *  (1) we need to modify it for radiotap (if not present), and
	 *  (2) the other RX handlers will modify the skb we got.
	 *
	 * We don't need to, of course, if we aren't going to return
	 * the SKB because it has a bad FCS/PLCP checksum.
	 */
J
Johannes Berg 已提交
450

451 452 453
	if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
		present_fcs_len = FCS_LEN;

454 455
	/* ensure hdr->frame_control and vendor radiotap data are in skb head */
	if (!pskb_may_pull(origskb, 2 + rtap_vendor_space)) {
Z
Zhu Yi 已提交
456 457 458 459
		dev_kfree_skb(origskb);
		return NULL;
	}

460
	if (!local->monitors) {
461 462
		if (should_drop_frame(origskb, present_fcs_len,
				      rtap_vendor_space)) {
463 464 465 466
			dev_kfree_skb(origskb);
			return NULL;
		}

467
		return remove_monitor_info(local, origskb, rtap_vendor_space);
468 469
	}

470
	/* room for the radiotap header based on driver features */
471 472
	rt_hdrlen = ieee80211_rx_radiotap_hdrlen(local, status, origskb);
	needed_headroom = rt_hdrlen - rtap_vendor_space;
473

474
	if (should_drop_frame(origskb, present_fcs_len, rtap_vendor_space)) {
475 476 477 478 479 480 481 482 483 484 485 486
		/* only need to expand headroom if necessary */
		skb = origskb;
		origskb = NULL;

		/*
		 * This shouldn't trigger often because most devices have an
		 * RX header they pull before we get here, and that should
		 * be big enough for our radiotap information. We should
		 * probably export the length to drivers so that we can have
		 * them allocate enough headroom to start with.
		 */
		if (skb_headroom(skb) < needed_headroom &&
487
		    pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
488 489 490 491 492 493 494 495 496 497
			dev_kfree_skb(skb);
			return NULL;
		}
	} else {
		/*
		 * Need to make a copy and possibly remove radiotap header
		 * and FCS from the original.
		 */
		skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC);

498 499
		origskb = remove_monitor_info(local, origskb,
					      rtap_vendor_space);
500 501 502 503 504

		if (!skb)
			return origskb;
	}

J
Johannes Berg 已提交
505
	/* prepend radiotap information */
506
	ieee80211_add_rx_radiotap_header(local, skb, rate, rt_hdrlen, true);
507

508
	skb_reset_mac_header(skb);
509 510 511 512 513
	skb->ip_summed = CHECKSUM_UNNECESSARY;
	skb->pkt_type = PACKET_OTHERHOST;
	skb->protocol = htons(ETH_P_802_2);

	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
514
		if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
515 516
			continue;

517 518 519
		if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES)
			continue;

520
		if (!ieee80211_sdata_running(sdata))
521 522
			continue;

523 524 525 526
		if (prev_dev) {
			skb2 = skb_clone(skb, GFP_ATOMIC);
			if (skb2) {
				skb2->dev = prev_dev;
527
				netif_receive_skb(skb2);
528 529 530 531 532 533 534 535 536 537
			}
		}

		prev_dev = sdata->dev;
		sdata->dev->stats.rx_packets++;
		sdata->dev->stats.rx_bytes += skb->len;
	}

	if (prev_dev) {
		skb->dev = prev_dev;
538
		netif_receive_skb(skb);
539 540 541 542 543 544
	} else
		dev_kfree_skb(skb);

	return origskb;
}

545
static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
546
{
547
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
548
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
549
	int tid, seqno_idx, security_idx;
550 551

	/* does the frame have a qos control field? */
552 553
	if (ieee80211_is_data_qos(hdr->frame_control)) {
		u8 *qc = ieee80211_get_qos_ctl(hdr);
554
		/* frame has qos control */
555
		tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
556
		if (*qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT)
557
			status->rx_flags |= IEEE80211_RX_AMSDU;
558 559 560

		seqno_idx = tid;
		security_idx = tid;
561
	} else {
562 563 564 565 566 567 568 569 570 571 572
		/*
		 * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):
		 *
		 *	Sequence numbers for management frames, QoS data
		 *	frames with a broadcast/multicast address in the
		 *	Address 1 field, and all non-QoS data frames sent
		 *	by QoS STAs are assigned using an additional single
		 *	modulo-4096 counter, [...]
		 *
		 * We also use that counter for non-QoS STAs.
		 */
573
		seqno_idx = IEEE80211_NUM_TIDS;
574 575
		security_idx = 0;
		if (ieee80211_is_mgmt(hdr->frame_control))
576
			security_idx = IEEE80211_NUM_TIDS;
577
		tid = 0;
578
	}
579

580 581
	rx->seqno_idx = seqno_idx;
	rx->security_idx = security_idx;
582 583 584
	/* Set skb->priority to 1d tag if highest order bit of TID is not set.
	 * For now, set skb->priority to 0 for other cases. */
	rx->skb->priority = (tid > 7) ? 0 : tid;
585
}
586

587 588 589 590 591 592 593 594 595 596 597
/**
 * DOC: Packet alignment
 *
 * Drivers always need to pass packets that are aligned to two-byte boundaries
 * to the stack.
 *
 * Additionally, should, if possible, align the payload data in a way that
 * guarantees that the contained IP header is aligned to a four-byte
 * boundary. In the case of regular frames, this simply means aligning the
 * payload to a four-byte boundary (because either the IP header is directly
 * contained, or IV/RFC1042 headers that have a length divisible by four are
598 599 600
 * in front of it).  If the payload data is not properly aligned and the
 * architecture doesn't support efficient unaligned operations, mac80211
 * will align the data.
601 602 603 604 605 606 607
 *
 * With A-MSDU frames, however, the payload data address must yield two modulo
 * four because there are 14-byte 802.3 headers within the A-MSDU frames that
 * push the IP header further back to a multiple of four again. Thankfully, the
 * specs were sane enough this time around to require padding each A-MSDU
 * subframe to a length that is a multiple of four.
 *
L
Lucas De Marchi 已提交
608
 * Padding like Atheros hardware adds which is between the 802.11 header and
609 610 611 612
 * the payload is not supported, the driver is required to move the 802.11
 * header to be directly in front of the payload in that case.
 */
static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
613
{
614 615 616
#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
	WARN_ONCE((unsigned long)rx->skb->data & 1,
		  "unaligned packet at 0x%p\n", rx->skb->data);
617
#endif
618 619
}

620

621 622
/* rx handlers */

623 624 625 626
static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
{
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;

627
	if (is_multicast_ether_addr(hdr->addr1))
628 629
		return 0;

630
	return ieee80211_is_robust_mgmt_frame(skb);
631 632 633 634 635 636 637
}


static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb)
{
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;

638
	if (!is_multicast_ether_addr(hdr->addr1))
639 640
		return 0;

641
	return ieee80211_is_robust_mgmt_frame(skb);
642 643 644 645 646 647 648 649
}


/* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */
static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
{
	struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data;
	struct ieee80211_mmie *mmie;
650
	struct ieee80211_mmie_16 *mmie16;
651

J
Johannes Berg 已提交
652
	if (skb->len < 24 + sizeof(*mmie) || !is_multicast_ether_addr(hdr->da))
653 654
		return -1;

655
	if (!ieee80211_is_robust_mgmt_frame(skb))
656 657 658 659
		return -1; /* not a robust management frame */

	mmie = (struct ieee80211_mmie *)
		(skb->data + skb->len - sizeof(*mmie));
660 661 662 663 664 665 666 667 668 669 670 671
	if (mmie->element_id == WLAN_EID_MMIE &&
	    mmie->length == sizeof(*mmie) - 2)
		return le16_to_cpu(mmie->key_id);

	mmie16 = (struct ieee80211_mmie_16 *)
		(skb->data + skb->len - sizeof(*mmie16));
	if (skb->len >= 24 + sizeof(*mmie16) &&
	    mmie16->element_id == WLAN_EID_MMIE &&
	    mmie16->length == sizeof(*mmie16) - 2)
		return le16_to_cpu(mmie16->key_id);

	return -1;
672 673
}

674 675 676 677 678 679 680 681 682 683 684 685 686 687 688 689 690 691 692 693 694
static int iwl80211_get_cs_keyid(const struct ieee80211_cipher_scheme *cs,
				 struct sk_buff *skb)
{
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
	__le16 fc;
	int hdrlen;
	u8 keyid;

	fc = hdr->frame_control;
	hdrlen = ieee80211_hdrlen(fc);

	if (skb->len < hdrlen + cs->hdr_len)
		return -EINVAL;

	skb_copy_bits(skb, hdrlen + cs->key_idx_off, &keyid, 1);
	keyid &= cs->key_idx_mask;
	keyid >>= cs->key_idx_shift;

	return keyid;
}

J
Johannes Berg 已提交
695
static ieee80211_rx_result ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
696
{
697
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
698
	char *dev_addr = rx->sdata->vif.addr;
699

700
	if (ieee80211_is_data(hdr->frame_control)) {
701 702
		if (is_multicast_ether_addr(hdr->addr1)) {
			if (ieee80211_has_tods(hdr->frame_control) ||
J
Johannes Berg 已提交
703
			    !ieee80211_has_fromds(hdr->frame_control))
704
				return RX_DROP_MONITOR;
705
			if (ether_addr_equal(hdr->addr3, dev_addr))
706 707 708 709
				return RX_DROP_MONITOR;
		} else {
			if (!ieee80211_has_a4(hdr->frame_control))
				return RX_DROP_MONITOR;
710
			if (ether_addr_equal(hdr->addr4, dev_addr))
711 712
				return RX_DROP_MONITOR;
		}
713 714 715 716 717 718
	}

	/* If there is not an established peer link and this is not a peer link
	 * establisment frame, beacon or probe, drop the frame.
	 */

719
	if (!rx->sta || sta_plink_state(rx->sta) != NL80211_PLINK_ESTAB) {
720
		struct ieee80211_mgmt *mgmt;
721

722
		if (!ieee80211_is_mgmt(hdr->frame_control))
723 724
			return RX_DROP_MONITOR;

725
		if (ieee80211_is_action(hdr->frame_control)) {
726
			u8 category;
727 728 729 730 731

			/* make sure category field is present */
			if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE)
				return RX_DROP_MONITOR;

732
			mgmt = (struct ieee80211_mgmt *)hdr;
733 734
			category = mgmt->u.action.category;
			if (category != WLAN_CATEGORY_MESH_ACTION &&
J
Johannes Berg 已提交
735
			    category != WLAN_CATEGORY_SELF_PROTECTED)
736 737 738 739
				return RX_DROP_MONITOR;
			return RX_CONTINUE;
		}

740 741
		if (ieee80211_is_probe_req(hdr->frame_control) ||
		    ieee80211_is_probe_resp(hdr->frame_control) ||
742 743
		    ieee80211_is_beacon(hdr->frame_control) ||
		    ieee80211_is_auth(hdr->frame_control))
744 745 746 747 748
			return RX_CONTINUE;

		return RX_DROP_MONITOR;
	}

J
Johannes Berg 已提交
749 750
	return RX_CONTINUE;
}
751

752
static void ieee80211_release_reorder_frame(struct ieee80211_sub_if_data *sdata,
753
					    struct tid_ampdu_rx *tid_agg_rx,
754 755
					    int index,
					    struct sk_buff_head *frames)
756
{
757 758
	struct sk_buff_head *skb_list = &tid_agg_rx->reorder_buf[index];
	struct sk_buff *skb;
759
	struct ieee80211_rx_status *status;
760

761 762
	lockdep_assert_held(&tid_agg_rx->reorder_lock);

763
	if (skb_queue_empty(skb_list))
764 765
		goto no_frame;

766 767 768 769 770 771
	if (!ieee80211_rx_reorder_ready(skb_list)) {
		__skb_queue_purge(skb_list);
		goto no_frame;
	}

	/* release frames from the reorder ring buffer */
772
	tid_agg_rx->stored_mpdu_num--;
773 774 775 776 777
	while ((skb = __skb_dequeue(skb_list))) {
		status = IEEE80211_SKB_RXCB(skb);
		status->rx_flags |= IEEE80211_RX_DEFERRED_RELEASE;
		__skb_queue_tail(frames, skb);
	}
778 779

no_frame:
780
	tid_agg_rx->head_seq_num = ieee80211_sn_inc(tid_agg_rx->head_seq_num);
781 782
}

783
static void ieee80211_release_reorder_frames(struct ieee80211_sub_if_data *sdata,
784
					     struct tid_ampdu_rx *tid_agg_rx,
785 786
					     u16 head_seq_num,
					     struct sk_buff_head *frames)
787 788 789
{
	int index;

790 791
	lockdep_assert_held(&tid_agg_rx->reorder_lock);

792
	while (ieee80211_sn_less(tid_agg_rx->head_seq_num, head_seq_num)) {
793
		index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
794 795
		ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
						frames);
796 797 798 799 800 801 802 803 804
	}
}

/*
 * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If
 * the skb was added to the buffer longer than this time ago, the earlier
 * frames that have not yet been received are assumed to be lost and the skb
 * can be released for processing. This may also release other skb's from the
 * reorder buffer if there are no additional gaps between the frames.
805 806
 *
 * Callers must hold tid_agg_rx->reorder_lock.
807 808 809
 */
#define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)

810
static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata,
811 812
					  struct tid_ampdu_rx *tid_agg_rx,
					  struct sk_buff_head *frames)
813
{
814
	int index, i, j;
815

816 817
	lockdep_assert_held(&tid_agg_rx->reorder_lock);

818
	/* release the buffer until next missing frame */
819
	index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
820
	if (!ieee80211_rx_reorder_ready(&tid_agg_rx->reorder_buf[index]) &&
821
	    tid_agg_rx->stored_mpdu_num) {
822 823 824 825 826 827 828
		/*
		 * No buffers ready to be released, but check whether any
		 * frames in the reorder buffer have timed out.
		 */
		int skipped = 1;
		for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
		     j = (j + 1) % tid_agg_rx->buf_size) {
829 830
			if (!ieee80211_rx_reorder_ready(
					&tid_agg_rx->reorder_buf[j])) {
831 832 833
				skipped++;
				continue;
			}
834 835
			if (skipped &&
			    !time_after(jiffies, tid_agg_rx->reorder_time[j] +
836
					HT_RX_REORDER_BUF_TIMEOUT))
837
				goto set_release_timer;
838

839 840 841 842 843
			/* don't leave incomplete A-MSDUs around */
			for (i = (index + 1) % tid_agg_rx->buf_size; i != j;
			     i = (i + 1) % tid_agg_rx->buf_size)
				__skb_queue_purge(&tid_agg_rx->reorder_buf[i]);

J
Johannes Berg 已提交
844 845
			ht_dbg_ratelimited(sdata,
					   "release an RX reorder frame due to timeout on earlier frames\n");
846 847
			ieee80211_release_reorder_frame(sdata, tid_agg_rx, j,
							frames);
848 849 850 851 852

			/*
			 * Increment the head seq# also for the skipped slots.
			 */
			tid_agg_rx->head_seq_num =
853 854
				(tid_agg_rx->head_seq_num +
				 skipped) & IEEE80211_SN_MASK;
855 856
			skipped = 0;
		}
857 858
	} else while (ieee80211_rx_reorder_ready(
				&tid_agg_rx->reorder_buf[index])) {
859 860
		ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
						frames);
861
		index =	tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
862
	}
863 864

	if (tid_agg_rx->stored_mpdu_num) {
865
		j = index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
866 867 868

		for (; j != (index - 1) % tid_agg_rx->buf_size;
		     j = (j + 1) % tid_agg_rx->buf_size) {
869 870
			if (ieee80211_rx_reorder_ready(
					&tid_agg_rx->reorder_buf[j]))
871 872 873 874 875
				break;
		}

 set_release_timer:

876 877 878 879
		if (!tid_agg_rx->removed)
			mod_timer(&tid_agg_rx->reorder_timer,
				  tid_agg_rx->reorder_time[j] + 1 +
				  HT_RX_REORDER_BUF_TIMEOUT);
880 881 882
	} else {
		del_timer(&tid_agg_rx->reorder_timer);
	}
883 884
}

885 886 887 888 889
/*
 * As this function belongs to the RX path it must be under
 * rcu_read_lock protection. It returns false if the frame
 * can be processed immediately, true if it was consumed.
 */
890
static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata,
891
					     struct tid_ampdu_rx *tid_agg_rx,
892 893
					     struct sk_buff *skb,
					     struct sk_buff_head *frames)
894 895
{
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
896
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
897 898 899 900
	u16 sc = le16_to_cpu(hdr->seq_ctrl);
	u16 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
	u16 head_seq_num, buf_size;
	int index;
901
	bool ret = true;
902

903 904
	spin_lock(&tid_agg_rx->reorder_lock);

905 906 907 908 909 910 911 912 913 914
	/*
	 * Offloaded BA sessions have no known starting sequence number so pick
	 * one from first Rxed frame for this tid after BA was started.
	 */
	if (unlikely(tid_agg_rx->auto_seq)) {
		tid_agg_rx->auto_seq = false;
		tid_agg_rx->ssn = mpdu_seq_num;
		tid_agg_rx->head_seq_num = mpdu_seq_num;
	}

915 916 917 918
	buf_size = tid_agg_rx->buf_size;
	head_seq_num = tid_agg_rx->head_seq_num;

	/* frame with out of date sequence number */
919
	if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) {
920
		dev_kfree_skb(skb);
921
		goto out;
922 923 924 925 926 927
	}

	/*
	 * If frame the sequence number exceeds our buffering window
	 * size release some previous frames to make room for this one.
	 */
928 929 930
	if (!ieee80211_sn_less(mpdu_seq_num, head_seq_num + buf_size)) {
		head_seq_num = ieee80211_sn_inc(
				ieee80211_sn_sub(mpdu_seq_num, buf_size));
931
		/* release stored frames up to new head to stack */
932
		ieee80211_release_reorder_frames(sdata, tid_agg_rx,
933
						 head_seq_num, frames);
934 935 936 937
	}

	/* Now the new frame is always in the range of the reordering buffer */

938
	index = mpdu_seq_num % tid_agg_rx->buf_size;
939 940

	/* check if we already stored this frame */
941
	if (ieee80211_rx_reorder_ready(&tid_agg_rx->reorder_buf[index])) {
942
		dev_kfree_skb(skb);
943
		goto out;
944 945 946 947 948
	}

	/*
	 * If the current MPDU is in the right order and nothing else
	 * is stored we can process it directly, no need to buffer it.
949 950
	 * If it is first but there's something stored, we may be able
	 * to release frames after this one.
951 952 953
	 */
	if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
	    tid_agg_rx->stored_mpdu_num == 0) {
954 955 956
		if (!(status->flag & RX_FLAG_AMSDU_MORE))
			tid_agg_rx->head_seq_num =
				ieee80211_sn_inc(tid_agg_rx->head_seq_num);
957 958
		ret = false;
		goto out;
959 960 961
	}

	/* put the frame in the reordering buffer */
962 963 964 965 966 967
	__skb_queue_tail(&tid_agg_rx->reorder_buf[index], skb);
	if (!(status->flag & RX_FLAG_AMSDU_MORE)) {
		tid_agg_rx->reorder_time[index] = jiffies;
		tid_agg_rx->stored_mpdu_num++;
		ieee80211_sta_reorder_release(sdata, tid_agg_rx, frames);
	}
968

969 970 971
 out:
	spin_unlock(&tid_agg_rx->reorder_lock);
	return ret;
972 973 974 975 976 977
}

/*
 * Reorder MPDUs from A-MPDUs, keeping them on a buffer. Returns
 * true if the MPDU was buffered, false if it should be processed.
 */
978 979
static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx,
				       struct sk_buff_head *frames)
980
{
981 982
	struct sk_buff *skb = rx->skb;
	struct ieee80211_local *local = rx->local;
983
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
984
	struct sta_info *sta = rx->sta;
985 986
	struct tid_ampdu_rx *tid_agg_rx;
	u16 sc;
987
	u8 tid, ack_policy;
988

989 990
	if (!ieee80211_is_data_qos(hdr->frame_control) ||
	    is_multicast_ether_addr(hdr->addr1))
991
		goto dont_reorder;
992 993 994 995 996 997 998

	/*
	 * filter the QoS data rx stream according to
	 * STA/TID and check if this STA/TID is on aggregation
	 */

	if (!sta)
999
		goto dont_reorder;
1000

1001 1002
	ack_policy = *ieee80211_get_qos_ctl(hdr) &
		     IEEE80211_QOS_CTL_ACK_POLICY_MASK;
1003 1004
	tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;

1005 1006 1007
	tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
	if (!tid_agg_rx)
		goto dont_reorder;
1008 1009 1010

	/* qos null data frames are excluded */
	if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
1011
		goto dont_reorder;
1012

1013 1014 1015 1016 1017
	/* not part of a BA session */
	if (ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK &&
	    ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_NORMAL)
		goto dont_reorder;

1018 1019 1020 1021
	/* new, potentially un-ordered, ampdu frame - process it */

	/* reset session timer */
	if (tid_agg_rx->timeout)
1022
		tid_agg_rx->last_rx = jiffies;
1023 1024 1025 1026

	/* if this mpdu is fragmented - terminate rx aggregation session */
	sc = le16_to_cpu(hdr->seq_ctrl);
	if (sc & IEEE80211_SCTL_FRAG) {
1027
		skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
1028 1029
		skb_queue_tail(&rx->sdata->skb_queue, skb);
		ieee80211_queue_work(&local->hw, &rx->sdata->work);
1030
		return;
1031 1032
	}

1033 1034 1035 1036 1037 1038 1039
	/*
	 * No locking needed -- we will only ever process one
	 * RX packet at a time, and thus own tid_agg_rx. All
	 * other code manipulating it needs to (and does) make
	 * sure that we cannot get to it any more before doing
	 * anything with it.
	 */
1040 1041
	if (ieee80211_sta_manage_reorder_buf(rx->sdata, tid_agg_rx, skb,
					     frames))
1042 1043 1044
		return;

 dont_reorder:
1045
	__skb_queue_tail(frames, skb);
1046
}
1047

1048
static ieee80211_rx_result debug_noinline
1049
ieee80211_rx_h_check_dup(struct ieee80211_rx_data *rx)
1050
{
1051
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1052
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1053

1054 1055 1056 1057
	/*
	 * Drop duplicate 802.11 retransmissions
	 * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery")
	 */
1058 1059 1060 1061 1062 1063 1064 1065 1066 1067

	if (rx->skb->len < 24)
		return RX_CONTINUE;

	if (ieee80211_is_ctl(hdr->frame_control) ||
	    ieee80211_is_qos_nullfunc(hdr->frame_control) ||
	    is_multicast_ether_addr(hdr->addr1))
		return RX_CONTINUE;

	if (rx->sta) {
1068
		if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
1069
			     rx->sta->last_seq_ctrl[rx->seqno_idx] ==
1070
			     hdr->seq_ctrl)) {
1071 1072
			rx->local->dot11FrameDuplicateCount++;
			rx->sta->num_duplicates++;
1073
			return RX_DROP_UNUSABLE;
1074
		} else if (!(status->flag & RX_FLAG_AMSDU_MORE)) {
1075
			rx->sta->last_seq_ctrl[rx->seqno_idx] = hdr->seq_ctrl;
1076
		}
1077 1078
	}

1079 1080 1081 1082 1083 1084 1085 1086
	return RX_CONTINUE;
}

static ieee80211_rx_result debug_noinline
ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
{
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;

1087 1088
	if (unlikely(rx->skb->len < 16)) {
		I802_DEBUG_INC(rx->local->rx_handlers_drop_short);
J
Johannes Berg 已提交
1089
		return RX_DROP_MONITOR;
1090 1091 1092 1093 1094
	}

	/* Drop disallowed frame classes based on STA auth/assoc state;
	 * IEEE 802.11, Chap 5.5.
	 *
J
Johannes Berg 已提交
1095 1096
	 * mac80211 filters only based on association state, i.e. it drops
	 * Class 3 frames from not associated stations. hostapd sends
1097 1098 1099
	 * deauth/disassoc frames when needed. In addition, hostapd is
	 * responsible for filtering on both auth and assoc states.
	 */
1100

J
Johannes Berg 已提交
1101
	if (ieee80211_vif_is_mesh(&rx->sdata->vif))
1102 1103
		return ieee80211_rx_mesh_check(rx);

1104 1105
	if (unlikely((ieee80211_is_data(hdr->frame_control) ||
		      ieee80211_is_pspoll(hdr->frame_control)) &&
1106
		     rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
B
Bill Jordan 已提交
1107
		     rx->sdata->vif.type != NL80211_IFTYPE_WDS &&
1108
		     rx->sdata->vif.type != NL80211_IFTYPE_OCB &&
J
Johannes Berg 已提交
1109
		     (!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_ASSOC)))) {
1110 1111 1112 1113 1114 1115
		/*
		 * accept port control frames from the AP even when it's not
		 * yet marked ASSOC to prevent a race where we don't set the
		 * assoc bit quickly enough before it sends the first frame
		 */
		if (rx->sta && rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
1116
		    ieee80211_is_data_present(hdr->frame_control)) {
1117 1118 1119 1120 1121 1122 1123 1124 1125 1126
			unsigned int hdrlen;
			__be16 ethertype;

			hdrlen = ieee80211_hdrlen(hdr->frame_control);

			if (rx->skb->len < hdrlen + 8)
				return RX_DROP_MONITOR;

			skb_copy_bits(rx->skb, hdrlen + 6, &ethertype, 2);
			if (ethertype == rx->sdata->control_port_protocol)
1127 1128
				return RX_CONTINUE;
		}
1129 1130 1131 1132 1133 1134 1135

		if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
		    cfg80211_rx_spurious_frame(rx->sdata->dev,
					       hdr->addr2,
					       GFP_ATOMIC))
			return RX_DROP_UNUSABLE;

J
Johannes Berg 已提交
1136
		return RX_DROP_MONITOR;
1137
	}
1138

1139
	return RX_CONTINUE;
1140 1141 1142
}


1143 1144 1145 1146 1147 1148 1149 1150 1151 1152 1153 1154 1155 1156 1157 1158 1159 1160 1161 1162 1163 1164 1165 1166 1167 1168 1169 1170 1171 1172 1173 1174 1175
static ieee80211_rx_result debug_noinline
ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx)
{
	struct ieee80211_local *local;
	struct ieee80211_hdr *hdr;
	struct sk_buff *skb;

	local = rx->local;
	skb = rx->skb;
	hdr = (struct ieee80211_hdr *) skb->data;

	if (!local->pspolling)
		return RX_CONTINUE;

	if (!ieee80211_has_fromds(hdr->frame_control))
		/* this is not from AP */
		return RX_CONTINUE;

	if (!ieee80211_is_data(hdr->frame_control))
		return RX_CONTINUE;

	if (!ieee80211_has_moredata(hdr->frame_control)) {
		/* AP has no more frames buffered for us */
		local->pspolling = false;
		return RX_CONTINUE;
	}

	/* more data bit is set, let's request a new frame from the AP */
	ieee80211_send_pspoll(local, rx->sdata);

	return RX_CONTINUE;
}

1176
static void sta_ps_start(struct sta_info *sta)
1177
{
1178
	struct ieee80211_sub_if_data *sdata = sta->sdata;
1179
	struct ieee80211_local *local = sdata->local;
1180
	struct ps_data *ps;
1181
	int tid;
1182

1183 1184 1185 1186 1187 1188 1189
	if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
	    sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
		ps = &sdata->bss->ps;
	else
		return;

	atomic_inc(&ps->num_sta_ps);
J
Johannes Berg 已提交
1190
	set_sta_flag(sta, WLAN_STA_PS_STA);
1191 1192
	if (!(local->hw.flags & IEEE80211_HW_AP_LINK_PS))
		drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta);
J
Johannes Berg 已提交
1193 1194
	ps_dbg(sdata, "STA %pM aid %d enters power save mode\n",
	       sta->sta.addr, sta->sta.aid);
1195

J
Johannes Berg 已提交
1196 1197
	ieee80211_clear_fast_xmit(sta);

1198 1199 1200 1201 1202 1203 1204 1205 1206 1207 1208
	if (!sta->sta.txq[0])
		return;

	for (tid = 0; tid < ARRAY_SIZE(sta->sta.txq); tid++) {
		struct txq_info *txqi = to_txq_info(sta->sta.txq[tid]);

		if (!skb_queue_len(&txqi->queue))
			set_bit(tid, &sta->txq_buffered_tids);
		else
			clear_bit(tid, &sta->txq_buffered_tids);
	}
1209 1210
}

1211
static void sta_ps_end(struct sta_info *sta)
1212
{
J
Johannes Berg 已提交
1213 1214
	ps_dbg(sta->sdata, "STA %pM aid %d exits power save mode\n",
	       sta->sta.addr, sta->sta.aid);
1215

J
Johannes Berg 已提交
1216
	if (test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
1217 1218 1219 1220 1221 1222 1223
		/*
		 * Clear the flag only if the other one is still set
		 * so that the TX path won't start TX'ing new frames
		 * directly ... In the case that the driver flag isn't
		 * set ieee80211_sta_ps_deliver_wakeup() will clear it.
		 */
		clear_sta_flag(sta, WLAN_STA_PS_STA);
J
Johannes Berg 已提交
1224 1225
		ps_dbg(sta->sdata, "STA %pM aid %d driver-ps-blocked\n",
		       sta->sta.addr, sta->sta.aid);
1226 1227 1228
		return;
	}

1229 1230
	set_sta_flag(sta, WLAN_STA_PS_DELIVER);
	clear_sta_flag(sta, WLAN_STA_PS_STA);
1231
	ieee80211_sta_ps_deliver_wakeup(sta);
1232 1233
}

1234 1235 1236 1237 1238 1239 1240 1241
int ieee80211_sta_ps_transition(struct ieee80211_sta *sta, bool start)
{
	struct sta_info *sta_inf = container_of(sta, struct sta_info, sta);
	bool in_ps;

	WARN_ON(!(sta_inf->local->hw.flags & IEEE80211_HW_AP_LINK_PS));

	/* Don't let the same PS state be set twice */
J
Johannes Berg 已提交
1242
	in_ps = test_sta_flag(sta_inf, WLAN_STA_PS_STA);
1243 1244 1245 1246
	if ((start && in_ps) || (!start && !in_ps))
		return -EINVAL;

	if (start)
1247
		sta_ps_start(sta_inf);
1248
	else
1249
		sta_ps_end(sta_inf);
1250 1251 1252 1253 1254

	return 0;
}
EXPORT_SYMBOL(ieee80211_sta_ps_transition);

J
Johannes Berg 已提交
1255 1256 1257 1258 1259 1260 1261 1262
static ieee80211_rx_result debug_noinline
ieee80211_rx_h_uapsd_and_pspoll(struct ieee80211_rx_data *rx)
{
	struct ieee80211_sub_if_data *sdata = rx->sdata;
	struct ieee80211_hdr *hdr = (void *)rx->skb->data;
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
	int tid, ac;

1263
	if (!rx->sta)
J
Johannes Berg 已提交
1264 1265 1266 1267 1268 1269 1270 1271 1272 1273 1274 1275 1276 1277 1278 1279 1280 1281 1282
		return RX_CONTINUE;

	if (sdata->vif.type != NL80211_IFTYPE_AP &&
	    sdata->vif.type != NL80211_IFTYPE_AP_VLAN)
		return RX_CONTINUE;

	/*
	 * The device handles station powersave, so don't do anything about
	 * uAPSD and PS-Poll frames (the latter shouldn't even come up from
	 * it to mac80211 since they're handled.)
	 */
	if (sdata->local->hw.flags & IEEE80211_HW_AP_LINK_PS)
		return RX_CONTINUE;

	/*
	 * Don't do anything if the station isn't already asleep. In
	 * the uAPSD case, the station will probably be marked asleep,
	 * in the PS-Poll case the station must be confused ...
	 */
J
Johannes Berg 已提交
1283
	if (!test_sta_flag(rx->sta, WLAN_STA_PS_STA))
J
Johannes Berg 已提交
1284 1285 1286
		return RX_CONTINUE;

	if (unlikely(ieee80211_is_pspoll(hdr->frame_control))) {
J
Johannes Berg 已提交
1287 1288
		if (!test_sta_flag(rx->sta, WLAN_STA_SP)) {
			if (!test_sta_flag(rx->sta, WLAN_STA_PS_DRIVER))
1289 1290
				ieee80211_sta_ps_deliver_poll_response(rx->sta);
			else
J
Johannes Berg 已提交
1291
				set_sta_flag(rx->sta, WLAN_STA_PSPOLL);
1292
		}
J
Johannes Berg 已提交
1293 1294 1295 1296 1297 1298 1299 1300 1301 1302 1303 1304 1305 1306 1307 1308 1309 1310 1311 1312 1313 1314 1315 1316 1317

		/* Free PS Poll skb here instead of returning RX_DROP that would
		 * count as an dropped frame. */
		dev_kfree_skb(rx->skb);

		return RX_QUEUED;
	} else if (!ieee80211_has_morefrags(hdr->frame_control) &&
		   !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
		   ieee80211_has_pm(hdr->frame_control) &&
		   (ieee80211_is_data_qos(hdr->frame_control) ||
		    ieee80211_is_qos_nullfunc(hdr->frame_control))) {
		tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
		ac = ieee802_1d_to_ac[tid & 7];

		/*
		 * If this AC is not trigger-enabled do nothing.
		 *
		 * NB: This could/should check a separate bitmap of trigger-
		 * enabled queues, but for now we only implement uAPSD w/o
		 * TSPEC changes to the ACs, so they're always the same.
		 */
		if (!(rx->sta->sta.uapsd_queues & BIT(ac)))
			return RX_CONTINUE;

		/* if we are in a service period, do nothing */
J
Johannes Berg 已提交
1318
		if (test_sta_flag(rx->sta, WLAN_STA_SP))
J
Johannes Berg 已提交
1319 1320
			return RX_CONTINUE;

J
Johannes Berg 已提交
1321
		if (!test_sta_flag(rx->sta, WLAN_STA_PS_DRIVER))
J
Johannes Berg 已提交
1322 1323
			ieee80211_sta_ps_deliver_uapsd(rx->sta);
		else
J
Johannes Berg 已提交
1324
			set_sta_flag(rx->sta, WLAN_STA_UAPSD);
J
Johannes Berg 已提交
1325 1326 1327 1328 1329
	}

	return RX_CONTINUE;
}

1330
static ieee80211_rx_result debug_noinline
1331
ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
1332 1333
{
	struct sta_info *sta = rx->sta;
J
Johannes Berg 已提交
1334 1335 1336
	struct sk_buff *skb = rx->skb;
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1337
	int i;
1338 1339

	if (!sta)
1340
		return RX_CONTINUE;
1341

J
Johannes Berg 已提交
1342 1343
	/*
	 * Update last_rx only for IBSS packets which are for the current
1344 1345 1346 1347 1348
	 * BSSID and for station already AUTHORIZED to avoid keeping the
	 * current IBSS network alive in cases where other STAs start
	 * using different BSSID. This will also give the station another
	 * chance to restart the authentication/authorization in case
	 * something went wrong the first time.
J
Johannes Berg 已提交
1349
	 */
1350
	if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
1351
		u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
1352
						NL80211_IFTYPE_ADHOC);
1353 1354
		if (ether_addr_equal(bssid, rx->sdata->u.ibss.bssid) &&
		    test_sta_flag(sta, WLAN_STA_AUTHORIZED)) {
1355
			sta->last_rx = jiffies;
1356 1357
			if (ieee80211_is_data(hdr->frame_control) &&
			    !is_multicast_ether_addr(hdr->addr1)) {
1358 1359
				sta->last_rx_rate_idx = status->rate_idx;
				sta->last_rx_rate_flag = status->flag;
1360
				sta->last_rx_rate_vht_flag = status->vht_flag;
1361
				sta->last_rx_rate_vht_nss = status->vht_nss;
1362 1363
			}
		}
1364 1365 1366 1367 1368 1369
	} else if (rx->sdata->vif.type == NL80211_IFTYPE_OCB) {
		u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
						NL80211_IFTYPE_OCB);
		/* OCB uses wild-card BSSID */
		if (is_broadcast_ether_addr(bssid))
			sta->last_rx = jiffies;
J
Johannes Berg 已提交
1370 1371
	} else if (!is_multicast_ether_addr(hdr->addr1)) {
		/*
1372 1373
		 * Mesh beacons will update last_rx when if they are found to
		 * match the current local configuration when processed.
1374
		 */
J
Johannes Berg 已提交
1375
		sta->last_rx = jiffies;
1376 1377 1378
		if (ieee80211_is_data(hdr->frame_control)) {
			sta->last_rx_rate_idx = status->rate_idx;
			sta->last_rx_rate_flag = status->flag;
1379
			sta->last_rx_rate_vht_flag = status->vht_flag;
1380
			sta->last_rx_rate_vht_nss = status->vht_nss;
1381
		}
1382 1383
	}

1384 1385 1386
	if (rx->sdata->vif.type == NL80211_IFTYPE_STATION)
		ieee80211_sta_rx_notify(rx->sdata, hdr);

1387 1388
	sta->rx_fragments++;
	sta->rx_bytes += rx->skb->len;
1389 1390 1391 1392
	if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
		sta->last_signal = status->signal;
		ewma_add(&sta->avg_signal, -status->signal);
	}
1393

1394 1395 1396 1397 1398 1399 1400 1401 1402 1403 1404 1405 1406
	if (status->chains) {
		sta->chains = status->chains;
		for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {
			int signal = status->chain_signal[i];

			if (!(status->chains & BIT(i)))
				continue;

			sta->chain_signal_last[i] = signal;
			ewma_add(&sta->chain_signal_avg[i], -signal);
		}
	}

1407 1408 1409 1410
	/*
	 * Change STA power saving mode only at the end of a frame
	 * exchange sequence.
	 */
1411 1412
	if (!(sta->local->hw.flags & IEEE80211_HW_AP_LINK_PS) &&
	    !ieee80211_has_morefrags(hdr->frame_control) &&
1413
	    !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
1414
	    (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1415 1416 1417 1418 1419 1420 1421
	     rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
	    /* PM bit is only checked in frames where it isn't reserved,
	     * in AP mode it's reserved in non-bufferable management frames
	     * (cf. IEEE 802.11-2012 8.2.4.1.7 Power Management field)
	     */
	    (!ieee80211_is_mgmt(hdr->frame_control) ||
	     ieee80211_is_bufferable_mmpdu(hdr->frame_control))) {
J
Johannes Berg 已提交
1422
		if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
1423
			if (!ieee80211_has_pm(hdr->frame_control))
1424
				sta_ps_end(sta);
1425 1426
		} else {
			if (ieee80211_has_pm(hdr->frame_control))
1427
				sta_ps_start(sta);
1428
		}
1429 1430
	}

M
Marco Porsch 已提交
1431 1432 1433 1434
	/* mesh power save support */
	if (ieee80211_vif_is_mesh(&rx->sdata->vif))
		ieee80211_mps_rx_h_sta_process(sta, hdr);

1435 1436 1437 1438 1439 1440
	/*
	 * Drop (qos-)data::nullfunc frames silently, since they
	 * are used only to control station power saving mode.
	 */
	if (ieee80211_is_nullfunc(hdr->frame_control) ||
	    ieee80211_is_qos_nullfunc(hdr->frame_control)) {
1441
		I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
1442 1443 1444

		/*
		 * If we receive a 4-addr nullfunc frame from a STA
1445 1446 1447
		 * that was not moved to a 4-addr STA vlan yet send
		 * the event to userspace and for older hostapd drop
		 * the frame to the monitor interface.
1448 1449 1450 1451
		 */
		if (ieee80211_has_a4(hdr->frame_control) &&
		    (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
		     (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1452 1453 1454 1455 1456
		      !rx->sdata->u.vlan.sta))) {
			if (!test_and_set_sta_flag(sta, WLAN_STA_4ADDR_EVENT))
				cfg80211_rx_unexpected_4addr_frame(
					rx->sdata->dev, sta->sta.addr,
					GFP_ATOMIC);
1457
			return RX_DROP_MONITOR;
1458
		}
1459 1460 1461 1462
		/*
		 * Update counter and free packet here to avoid
		 * counting this as a dropped packed.
		 */
1463 1464
		sta->rx_packets++;
		dev_kfree_skb(rx->skb);
1465
		return RX_QUEUED;
1466 1467
	}

1468
	return RX_CONTINUE;
1469 1470
} /* ieee80211_rx_h_sta_process */

1471 1472 1473 1474 1475 1476 1477 1478 1479 1480 1481 1482
static ieee80211_rx_result debug_noinline
ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
{
	struct sk_buff *skb = rx->skb;
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
	int keyidx;
	int hdrlen;
	ieee80211_rx_result result = RX_DROP_UNUSABLE;
	struct ieee80211_key *sta_ptk = NULL;
	int mmie_keyidx = -1;
	__le16 fc;
1483
	const struct ieee80211_cipher_scheme *cs = NULL;
1484 1485 1486 1487 1488 1489 1490 1491 1492 1493 1494 1495 1496 1497 1498 1499 1500 1501 1502 1503 1504 1505 1506 1507 1508 1509 1510 1511 1512 1513

	/*
	 * Key selection 101
	 *
	 * There are four types of keys:
	 *  - GTK (group keys)
	 *  - IGTK (group keys for management frames)
	 *  - PTK (pairwise keys)
	 *  - STK (station-to-station pairwise keys)
	 *
	 * When selecting a key, we have to distinguish between multicast
	 * (including broadcast) and unicast frames, the latter can only
	 * use PTKs and STKs while the former always use GTKs and IGTKs.
	 * Unless, of course, actual WEP keys ("pre-RSNA") are used, then
	 * unicast frames can also use key indices like GTKs. Hence, if we
	 * don't have a PTK/STK we check the key index for a WEP key.
	 *
	 * Note that in a regular BSS, multicast frames are sent by the
	 * AP only, associated stations unicast the frame to the AP first
	 * which then multicasts it on their behalf.
	 *
	 * There is also a slight problem in IBSS mode: GTKs are negotiated
	 * with each station, that is something we don't currently handle.
	 * The spec seems to expect that one negotiates the same key with
	 * every station but there's no such requirement; VLANs could be
	 * possible.
	 */

	/* start without a key */
	rx->key = NULL;
1514
	fc = hdr->frame_control;
1515

1516 1517
	if (rx->sta) {
		int keyid = rx->sta->ptk_idx;
1518

1519 1520 1521 1522 1523 1524 1525 1526
		if (ieee80211_has_protected(fc) && rx->sta->cipher_scheme) {
			cs = rx->sta->cipher_scheme;
			keyid = iwl80211_get_cs_keyid(cs, rx->skb);
			if (unlikely(keyid < 0))
				return RX_DROP_UNUSABLE;
		}
		sta_ptk = rcu_dereference(rx->sta->ptk[keyid]);
	}
1527 1528 1529 1530 1531 1532 1533 1534 1535 1536 1537 1538 1539 1540 1541 1542 1543 1544 1545 1546 1547 1548 1549 1550 1551 1552 1553 1554 1555 1556 1557 1558 1559 1560 1561 1562 1563 1564 1565 1566 1567 1568 1569 1570 1571 1572 1573 1574 1575 1576 1577 1578 1579 1580 1581 1582 1583 1584 1585 1586 1587

	if (!ieee80211_has_protected(fc))
		mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);

	if (!is_multicast_ether_addr(hdr->addr1) && sta_ptk) {
		rx->key = sta_ptk;
		if ((status->flag & RX_FLAG_DECRYPTED) &&
		    (status->flag & RX_FLAG_IV_STRIPPED))
			return RX_CONTINUE;
		/* Skip decryption if the frame is not protected. */
		if (!ieee80211_has_protected(fc))
			return RX_CONTINUE;
	} else if (mmie_keyidx >= 0) {
		/* Broadcast/multicast robust management frame / BIP */
		if ((status->flag & RX_FLAG_DECRYPTED) &&
		    (status->flag & RX_FLAG_IV_STRIPPED))
			return RX_CONTINUE;

		if (mmie_keyidx < NUM_DEFAULT_KEYS ||
		    mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
			return RX_DROP_MONITOR; /* unexpected BIP keyidx */
		if (rx->sta)
			rx->key = rcu_dereference(rx->sta->gtk[mmie_keyidx]);
		if (!rx->key)
			rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]);
	} else if (!ieee80211_has_protected(fc)) {
		/*
		 * The frame was not protected, so skip decryption. However, we
		 * need to set rx->key if there is a key that could have been
		 * used so that the frame may be dropped if encryption would
		 * have been expected.
		 */
		struct ieee80211_key *key = NULL;
		struct ieee80211_sub_if_data *sdata = rx->sdata;
		int i;

		if (ieee80211_is_mgmt(fc) &&
		    is_multicast_ether_addr(hdr->addr1) &&
		    (key = rcu_dereference(rx->sdata->default_mgmt_key)))
			rx->key = key;
		else {
			if (rx->sta) {
				for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
					key = rcu_dereference(rx->sta->gtk[i]);
					if (key)
						break;
				}
			}
			if (!key) {
				for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
					key = rcu_dereference(sdata->keys[i]);
					if (key)
						break;
				}
			}
			if (key)
				rx->key = key;
		}
		return RX_CONTINUE;
	} else {
		u8 keyid;
1588

1589 1590 1591 1592 1593 1594 1595 1596 1597 1598 1599 1600 1601 1602 1603
		/*
		 * The device doesn't give us the IV so we won't be
		 * able to look up the key. That's ok though, we
		 * don't need to decrypt the frame, we just won't
		 * be able to keep statistics accurate.
		 * Except for key threshold notifications, should
		 * we somehow allow the driver to tell us which key
		 * the hardware used if this flag is set?
		 */
		if ((status->flag & RX_FLAG_DECRYPTED) &&
		    (status->flag & RX_FLAG_IV_STRIPPED))
			return RX_CONTINUE;

		hdrlen = ieee80211_hdrlen(fc);

1604 1605
		if (cs) {
			keyidx = iwl80211_get_cs_keyid(cs, rx->skb);
1606

1607 1608 1609 1610 1611 1612 1613 1614 1615 1616 1617 1618
			if (unlikely(keyidx < 0))
				return RX_DROP_UNUSABLE;
		} else {
			if (rx->skb->len < 8 + hdrlen)
				return RX_DROP_UNUSABLE; /* TODO: count this? */
			/*
			 * no need to call ieee80211_wep_get_keyidx,
			 * it verifies a bunch of things we've done already
			 */
			skb_copy_bits(rx->skb, hdrlen + 3, &keyid, 1);
			keyidx = keyid >> 6;
		}
1619 1620 1621 1622 1623 1624 1625 1626 1627 1628 1629 1630 1631 1632 1633 1634 1635 1636 1637 1638 1639 1640 1641 1642 1643 1644 1645 1646 1647 1648 1649 1650 1651 1652 1653 1654 1655 1656 1657 1658 1659

		/* check per-station GTK first, if multicast packet */
		if (is_multicast_ether_addr(hdr->addr1) && rx->sta)
			rx->key = rcu_dereference(rx->sta->gtk[keyidx]);

		/* if not found, try default key */
		if (!rx->key) {
			rx->key = rcu_dereference(rx->sdata->keys[keyidx]);

			/*
			 * RSNA-protected unicast frames should always be
			 * sent with pairwise or station-to-station keys,
			 * but for WEP we allow using a key index as well.
			 */
			if (rx->key &&
			    rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 &&
			    rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 &&
			    !is_multicast_ether_addr(hdr->addr1))
				rx->key = NULL;
		}
	}

	if (rx->key) {
		if (unlikely(rx->key->flags & KEY_FLAG_TAINTED))
			return RX_DROP_MONITOR;

		rx->key->tx_rx_count++;
		/* TODO: add threshold stuff again */
	} else {
		return RX_DROP_MONITOR;
	}

	switch (rx->key->conf.cipher) {
	case WLAN_CIPHER_SUITE_WEP40:
	case WLAN_CIPHER_SUITE_WEP104:
		result = ieee80211_crypto_wep_decrypt(rx);
		break;
	case WLAN_CIPHER_SUITE_TKIP:
		result = ieee80211_crypto_tkip_decrypt(rx);
		break;
	case WLAN_CIPHER_SUITE_CCMP:
J
Jouni Malinen 已提交
1660 1661 1662 1663 1664 1665
		result = ieee80211_crypto_ccmp_decrypt(
			rx, IEEE80211_CCMP_MIC_LEN);
		break;
	case WLAN_CIPHER_SUITE_CCMP_256:
		result = ieee80211_crypto_ccmp_decrypt(
			rx, IEEE80211_CCMP_256_MIC_LEN);
1666 1667 1668 1669
		break;
	case WLAN_CIPHER_SUITE_AES_CMAC:
		result = ieee80211_crypto_aes_cmac_decrypt(rx);
		break;
1670 1671 1672
	case WLAN_CIPHER_SUITE_BIP_CMAC_256:
		result = ieee80211_crypto_aes_cmac_256_decrypt(rx);
		break;
1673 1674 1675 1676
	case WLAN_CIPHER_SUITE_BIP_GMAC_128:
	case WLAN_CIPHER_SUITE_BIP_GMAC_256:
		result = ieee80211_crypto_aes_gmac_decrypt(rx);
		break;
1677 1678 1679 1680
	case WLAN_CIPHER_SUITE_GCMP:
	case WLAN_CIPHER_SUITE_GCMP_256:
		result = ieee80211_crypto_gcmp_decrypt(rx);
		break;
1681
	default:
1682
		result = ieee80211_crypto_hw_decrypt(rx);
1683 1684 1685 1686 1687 1688 1689 1690 1691 1692
	}

	/* the hdr variable is invalid after the decrypt handlers */

	/* either the frame has been decrypted or will be dropped */
	status->flag |= RX_FLAG_DECRYPTED;

	return result;
}

1693 1694 1695 1696 1697 1698 1699 1700 1701 1702 1703
static inline struct ieee80211_fragment_entry *
ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
			 unsigned int frag, unsigned int seq, int rx_queue,
			 struct sk_buff **skb)
{
	struct ieee80211_fragment_entry *entry;

	entry = &sdata->fragments[sdata->fragment_next++];
	if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
		sdata->fragment_next = 0;

J
Johannes Berg 已提交
1704
	if (!skb_queue_empty(&entry->skb_list))
1705 1706 1707 1708 1709 1710 1711 1712 1713 1714 1715 1716 1717 1718 1719 1720
		__skb_queue_purge(&entry->skb_list);

	__skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
	*skb = NULL;
	entry->first_frag_time = jiffies;
	entry->seq = seq;
	entry->rx_queue = rx_queue;
	entry->last_frag = frag;
	entry->ccmp = 0;
	entry->extra_len = 0;

	return entry;
}

static inline struct ieee80211_fragment_entry *
ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
1721
			  unsigned int frag, unsigned int seq,
1722 1723 1724 1725 1726 1727 1728 1729 1730 1731 1732 1733 1734 1735 1736 1737 1738 1739 1740
			  int rx_queue, struct ieee80211_hdr *hdr)
{
	struct ieee80211_fragment_entry *entry;
	int i, idx;

	idx = sdata->fragment_next;
	for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
		struct ieee80211_hdr *f_hdr;

		idx--;
		if (idx < 0)
			idx = IEEE80211_FRAGMENT_MAX - 1;

		entry = &sdata->fragments[idx];
		if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
		    entry->rx_queue != rx_queue ||
		    entry->last_frag + 1 != frag)
			continue;

1741
		f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data;
1742

1743 1744 1745 1746 1747
		/*
		 * Check ftype and addresses are equal, else check next fragment
		 */
		if (((hdr->frame_control ^ f_hdr->frame_control) &
		     cpu_to_le16(IEEE80211_FCTL_FTYPE)) ||
1748 1749
		    !ether_addr_equal(hdr->addr1, f_hdr->addr1) ||
		    !ether_addr_equal(hdr->addr2, f_hdr->addr2))
1750 1751
			continue;

1752
		if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
1753 1754 1755 1756 1757 1758 1759 1760 1761
			__skb_queue_purge(&entry->skb_list);
			continue;
		}
		return entry;
	}

	return NULL;
}

1762
static ieee80211_rx_result debug_noinline
1763
ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
1764 1765 1766
{
	struct ieee80211_hdr *hdr;
	u16 sc;
1767
	__le16 fc;
1768 1769 1770
	unsigned int frag, seq;
	struct ieee80211_fragment_entry *entry;
	struct sk_buff *skb;
1771
	struct ieee80211_rx_status *status;
1772

1773
	hdr = (struct ieee80211_hdr *)rx->skb->data;
1774
	fc = hdr->frame_control;
1775 1776 1777 1778

	if (ieee80211_is_ctl(fc))
		return RX_CONTINUE;

1779 1780 1781
	sc = le16_to_cpu(hdr->seq_ctrl);
	frag = sc & IEEE80211_SCTL_FRAG;

1782 1783
	if (is_multicast_ether_addr(hdr->addr1)) {
		rx->local->dot11MulticastReceivedFrameCount++;
1784
		goto out_no_led;
1785
	}
1786

1787 1788 1789
	if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
		goto out;

1790 1791
	I802_DEBUG_INC(rx->local->rx_handlers_fragments);

Z
Zhu Yi 已提交
1792 1793 1794
	if (skb_linearize(rx->skb))
		return RX_DROP_UNUSABLE;

1795 1796 1797 1798 1799 1800
	/*
	 *  skb_linearize() might change the skb->data and
	 *  previously cached variables (in this case, hdr) need to
	 *  be refreshed with the new data.
	 */
	hdr = (struct ieee80211_hdr *)rx->skb->data;
1801 1802 1803 1804 1805
	seq = (sc & IEEE80211_SCTL_SEQ) >> 4;

	if (frag == 0) {
		/* This is the first fragment of a new frame. */
		entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
1806
						 rx->seqno_idx, &(rx->skb));
J
Jouni Malinen 已提交
1807 1808 1809
		if (rx->key &&
		    (rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP ||
		     rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP_256) &&
1810
		    ieee80211_has_protected(fc)) {
1811
			int queue = rx->security_idx;
1812 1813 1814 1815
			/* Store CCMP PN so that we can verify that the next
			 * fragment has a sequential PN value. */
			entry->ccmp = 1;
			memcpy(entry->last_pn,
1816
			       rx->key->u.ccmp.rx_pn[queue],
1817
			       IEEE80211_CCMP_PN_LEN);
1818
		}
1819
		return RX_QUEUED;
1820 1821 1822 1823 1824
	}

	/* This is a fragment for a frame that should already be pending in
	 * fragment cache. Add this fragment to the end of the pending entry.
	 */
1825 1826
	entry = ieee80211_reassemble_find(rx->sdata, frag, seq,
					  rx->seqno_idx, hdr);
1827 1828
	if (!entry) {
		I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
J
Johannes Berg 已提交
1829
		return RX_DROP_MONITOR;
1830 1831 1832 1833 1834 1835
	}

	/* Verify that MPDUs within one MSDU have sequential PN values.
	 * (IEEE 802.11i, 8.3.3.4.5) */
	if (entry->ccmp) {
		int i;
1836
		u8 pn[IEEE80211_CCMP_PN_LEN], *rpn;
1837
		int queue;
J
Jouni Malinen 已提交
1838 1839 1840
		if (!rx->key ||
		    (rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP &&
		     rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP_256))
J
Johannes Berg 已提交
1841
			return RX_DROP_UNUSABLE;
1842 1843
		memcpy(pn, entry->last_pn, IEEE80211_CCMP_PN_LEN);
		for (i = IEEE80211_CCMP_PN_LEN - 1; i >= 0; i--) {
1844 1845 1846 1847
			pn[i]++;
			if (pn[i])
				break;
		}
1848
		queue = rx->security_idx;
1849
		rpn = rx->key->u.ccmp.rx_pn[queue];
1850
		if (memcmp(pn, rpn, IEEE80211_CCMP_PN_LEN))
J
Johannes Berg 已提交
1851
			return RX_DROP_UNUSABLE;
1852
		memcpy(entry->last_pn, pn, IEEE80211_CCMP_PN_LEN);
1853 1854
	}

1855
	skb_pull(rx->skb, ieee80211_hdrlen(fc));
1856 1857 1858
	__skb_queue_tail(&entry->skb_list, rx->skb);
	entry->last_frag = frag;
	entry->extra_len += rx->skb->len;
1859
	if (ieee80211_has_morefrags(fc)) {
1860
		rx->skb = NULL;
1861
		return RX_QUEUED;
1862 1863 1864 1865 1866 1867 1868 1869 1870
	}

	rx->skb = __skb_dequeue(&entry->skb_list);
	if (skb_tailroom(rx->skb) < entry->extra_len) {
		I802_DEBUG_INC(rx->local->rx_expand_skb_head2);
		if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
					      GFP_ATOMIC))) {
			I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
			__skb_queue_purge(&entry->skb_list);
J
Johannes Berg 已提交
1871
			return RX_DROP_UNUSABLE;
1872 1873 1874 1875 1876 1877 1878 1879
		}
	}
	while ((skb = __skb_dequeue(&entry->skb_list))) {
		memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len);
		dev_kfree_skb(skb);
	}

	/* Complete frame has been reassembled - process it now */
1880 1881
	status = IEEE80211_SKB_RXCB(rx->skb);
	status->rx_flags |= IEEE80211_RX_FRAGMENTED;
1882 1883

 out:
1884 1885
	ieee80211_led_rx(rx->local);
 out_no_led:
1886 1887
	if (rx->sta)
		rx->sta->rx_packets++;
1888
	return RX_CONTINUE;
1889 1890
}

J
Johannes Berg 已提交
1891
static int ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
1892
{
J
Johannes Berg 已提交
1893
	if (unlikely(!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_AUTHORIZED)))
1894
		return -EACCES;
1895

1896
	return 0;
1897 1898
}

J
Johannes Berg 已提交
1899
static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
1900
{
J
Johannes Berg 已提交
1901 1902 1903
	struct sk_buff *skb = rx->skb;
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);

1904
	/*
1905 1906
	 * Pass through unencrypted frames if the hardware has
	 * decrypted them already.
1907
	 */
J
Johannes Berg 已提交
1908
	if (status->flag & RX_FLAG_DECRYPTED)
1909
		return 0;
1910 1911

	/* Drop unencrypted frames if key is set. */
1912 1913
	if (unlikely(!ieee80211_has_protected(fc) &&
		     !ieee80211_is_nullfunc(fc) &&
1914
		     ieee80211_is_data(fc) && rx->key))
1915
		return -EACCES;
1916 1917 1918 1919

	return 0;
}

J
Johannes Berg 已提交
1920
static int ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)
1921 1922
{
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1923
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1924 1925
	__le16 fc = hdr->frame_control;

1926 1927 1928 1929 1930 1931
	/*
	 * Pass through unencrypted frames if the hardware has
	 * decrypted them already.
	 */
	if (status->flag & RX_FLAG_DECRYPTED)
		return 0;
1932

J
Johannes Berg 已提交
1933
	if (rx->sta && test_sta_flag(rx->sta, WLAN_STA_MFP)) {
1934 1935
		if (unlikely(!ieee80211_has_protected(fc) &&
			     ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
1936
			     rx->key)) {
1937 1938 1939 1940 1941
			if (ieee80211_is_deauth(fc) ||
			    ieee80211_is_disassoc(fc))
				cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
							     rx->skb->data,
							     rx->skb->len);
1942
			return -EACCES;
1943
		}
1944
		/* BIP does not use Protected field, so need to check MMIE */
1945
		if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
1946
			     ieee80211_get_mmie_keyidx(rx->skb) < 0)) {
1947 1948 1949 1950 1951
			if (ieee80211_is_deauth(fc) ||
			    ieee80211_is_disassoc(fc))
				cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
							     rx->skb->data,
							     rx->skb->len);
1952
			return -EACCES;
1953
		}
1954 1955 1956 1957 1958
		/*
		 * When using MFP, Action frames are not allowed prior to
		 * having configured keys.
		 */
		if (unlikely(ieee80211_is_action(fc) && !rx->key &&
1959
			     ieee80211_is_robust_mgmt_frame(rx->skb)))
1960 1961
			return -EACCES;
	}
1962

1963
	return 0;
1964 1965
}

1966
static int
1967
__ieee80211_data_to_8023(struct ieee80211_rx_data *rx, bool *port_control)
1968
{
J
Johannes Berg 已提交
1969
	struct ieee80211_sub_if_data *sdata = rx->sdata;
1970
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1971 1972 1973
	bool check_port_control = false;
	struct ethhdr *ehdr;
	int ret;
1974

1975
	*port_control = false;
1976 1977
	if (ieee80211_has_a4(hdr->frame_control) &&
	    sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta)
1978
		return -1;
1979

1980 1981 1982 1983 1984 1985 1986 1987 1988
	if (sdata->vif.type == NL80211_IFTYPE_STATION &&
	    !!sdata->u.mgd.use_4addr != !!ieee80211_has_a4(hdr->frame_control)) {

		if (!sdata->u.mgd.use_4addr)
			return -1;
		else
			check_port_control = true;
	}

1989
	if (is_multicast_ether_addr(hdr->addr1) &&
1990
	    sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta)
1991
		return -1;
1992

1993
	ret = ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type);
1994
	if (ret < 0)
1995 1996 1997
		return ret;

	ehdr = (struct ethhdr *) rx->skb->data;
1998 1999 2000
	if (ehdr->h_proto == rx->sdata->control_port_protocol)
		*port_control = true;
	else if (check_port_control)
2001 2002 2003
		return -1;

	return 0;
2004
}
2005

2006 2007 2008
/*
 * requires that rx->skb is a frame with ethernet header
 */
2009
static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
2010
{
2011
	static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
2012 2013 2014 2015 2016 2017 2018
		= { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
	struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;

	/*
	 * Allow EAPOL frames to us/the PAE group address regardless
	 * of whether the frame was encrypted or not.
	 */
2019
	if (ehdr->h_proto == rx->sdata->control_port_protocol &&
2020 2021
	    (ether_addr_equal(ehdr->h_dest, rx->sdata->vif.addr) ||
	     ether_addr_equal(ehdr->h_dest, pae_group_addr)))
2022 2023 2024
		return true;

	if (ieee80211_802_1x_port_control(rx) ||
2025
	    ieee80211_drop_unencrypted(rx, fc))
2026 2027 2028 2029 2030 2031 2032 2033
		return false;

	return true;
}

/*
 * requires that rx->skb is a frame with ethernet header
 */
2034
static void
2035
ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
2036
{
J
Johannes Berg 已提交
2037 2038
	struct ieee80211_sub_if_data *sdata = rx->sdata;
	struct net_device *dev = sdata->dev;
2039
	struct sk_buff *skb, *xmit_skb;
2040 2041
	struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
	struct sta_info *dsta;
2042

2043 2044 2045
	dev->stats.rx_packets++;
	dev->stats.rx_bytes += rx->skb->len;

2046 2047
	skb = rx->skb;
	xmit_skb = NULL;
2048

2049 2050
	if ((sdata->vif.type == NL80211_IFTYPE_AP ||
	     sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
2051
	    !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
2052
	    (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) {
2053 2054 2055 2056 2057
		if (is_multicast_ether_addr(ehdr->h_dest)) {
			/*
			 * send multicast frames both to higher layers in
			 * local net stack and back to the wireless medium
			 */
2058
			xmit_skb = skb_copy(skb, GFP_ATOMIC);
2059
			if (!xmit_skb)
J
Johannes Berg 已提交
2060
				net_info_ratelimited("%s: failed to clone multicast frame\n",
2061
						    dev->name);
2062
		} else {
2063 2064
			dsta = sta_info_get(sdata, skb->data);
			if (dsta) {
2065 2066 2067 2068 2069
				/*
				 * The destination station is associated to
				 * this AP (in this VLAN), so send the frame
				 * directly to it and do not pass it to local
				 * net stack.
2070
				 */
2071
				xmit_skb = skb;
2072 2073 2074 2075 2076
				skb = NULL;
			}
		}
	}

2077
#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
2078 2079 2080 2081 2082 2083
	if (skb) {
		/* 'align' will only take the values 0 or 2 here since all
		 * frames are required to be aligned to 2-byte boundaries
		 * when being passed to mac80211; the code here works just
		 * as well if that isn't true, but mac80211 assumes it can
		 * access fields as 2-byte aligned (e.g. for ether_addr_equal)
2084
		 */
2085 2086 2087
		int align;

		align = (unsigned long)(skb->data + sizeof(struct ethhdr)) & 3;
2088 2089 2090 2091 2092 2093
		if (align) {
			if (WARN_ON(skb_headroom(skb) < 3)) {
				dev_kfree_skb(skb);
				skb = NULL;
			} else {
				u8 *data = skb->data;
2094 2095 2096 2097
				size_t len = skb_headlen(skb);
				skb->data -= align;
				memmove(skb->data, data, len);
				skb_set_tail_pointer(skb, len);
2098 2099
			}
		}
2100
	}
2101 2102
#endif

2103 2104 2105 2106
	if (skb) {
		/* deliver to local stack */
		skb->protocol = eth_type_trans(skb, dev);
		memset(skb->cb, 0, sizeof(skb->cb));
J
Johannes Berg 已提交
2107 2108 2109 2110
		if (rx->local->napi)
			napi_gro_receive(rx->local->napi, skb);
		else
			netif_receive_skb(skb);
2111 2112
	}

2113
	if (xmit_skb) {
2114 2115 2116 2117 2118 2119
		/*
		 * Send to wireless media and increase priority by 256 to
		 * keep the received priority instead of reclassifying
		 * the frame (see cfg80211_classify8021d).
		 */
		xmit_skb->priority += 256;
2120
		xmit_skb->protocol = htons(ETH_P_802_3);
2121 2122
		skb_reset_network_header(xmit_skb);
		skb_reset_mac_header(xmit_skb);
2123
		dev_queue_xmit(xmit_skb);
2124
	}
2125 2126
}

2127
static ieee80211_rx_result debug_noinline
2128
ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
2129
{
J
Johannes Berg 已提交
2130
	struct net_device *dev = rx->sdata->dev;
Z
Zhu Yi 已提交
2131
	struct sk_buff *skb = rx->skb;
2132 2133
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
	__le16 fc = hdr->frame_control;
Z
Zhu Yi 已提交
2134
	struct sk_buff_head frame_list;
2135
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2136

2137
	if (unlikely(!ieee80211_is_data(fc)))
2138
		return RX_CONTINUE;
2139

2140
	if (unlikely(!ieee80211_is_data_present(fc)))
J
Johannes Berg 已提交
2141
		return RX_DROP_MONITOR;
2142

2143
	if (!(status->rx_flags & IEEE80211_RX_AMSDU))
2144
		return RX_CONTINUE;
2145

Z
Zhu Yi 已提交
2146 2147 2148
	if (ieee80211_has_a4(hdr->frame_control) &&
	    rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
	    !rx->sdata->u.vlan.sta)
J
Johannes Berg 已提交
2149
		return RX_DROP_UNUSABLE;
2150

Z
Zhu Yi 已提交
2151 2152 2153 2154 2155
	if (is_multicast_ether_addr(hdr->addr1) &&
	    ((rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
	      rx->sdata->u.vlan.sta) ||
	     (rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
	      rx->sdata->u.mgd.use_4addr)))
J
Johannes Berg 已提交
2156
		return RX_DROP_UNUSABLE;
2157

Z
Zhu Yi 已提交
2158 2159
	skb->dev = dev;
	__skb_queue_head_init(&frame_list);
2160

Z
Zhu Yi 已提交
2161 2162 2163
	if (skb_linearize(skb))
		return RX_DROP_UNUSABLE;

Z
Zhu Yi 已提交
2164 2165
	ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
				 rx->sdata->vif.type,
2166
				 rx->local->hw.extra_tx_headroom, true);
2167

Z
Zhu Yi 已提交
2168 2169
	while (!skb_queue_empty(&frame_list)) {
		rx->skb = __skb_dequeue(&frame_list);
2170

2171
		if (!ieee80211_frame_allowed(rx, fc)) {
Z
Zhu Yi 已提交
2172
			dev_kfree_skb(rx->skb);
2173 2174
			continue;
		}
2175 2176 2177 2178

		ieee80211_deliver_skb(rx);
	}

2179
	return RX_QUEUED;
2180 2181
}

I
Ingo Molnar 已提交
2182
#ifdef CONFIG_MAC80211_MESH
2183
static ieee80211_rx_result
2184 2185
ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
{
2186 2187
	struct ieee80211_hdr *fwd_hdr, *hdr;
	struct ieee80211_tx_info *info;
2188 2189
	struct ieee80211s_hdr *mesh_hdr;
	struct sk_buff *skb = rx->skb, *fwd_skb;
J
Johannes Berg 已提交
2190
	struct ieee80211_local *local = rx->local;
J
Johannes Berg 已提交
2191
	struct ieee80211_sub_if_data *sdata = rx->sdata;
2192 2193
	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
	u16 q, hdrlen;
2194 2195 2196

	hdr = (struct ieee80211_hdr *) skb->data;
	hdrlen = ieee80211_hdrlen(hdr->frame_control);
2197 2198 2199 2200 2201 2202 2203 2204 2205 2206 2207 2208 2209 2210

	/* make sure fixed part of mesh header is there, also checks skb len */
	if (!pskb_may_pull(rx->skb, hdrlen + 6))
		return RX_DROP_MONITOR;

	mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);

	/* make sure full mesh header is there, also checks skb len */
	if (!pskb_may_pull(rx->skb,
			   hdrlen + ieee80211_get_mesh_hdrlen(mesh_hdr)))
		return RX_DROP_MONITOR;

	/* reload pointers */
	hdr = (struct ieee80211_hdr *) skb->data;
2211 2212
	mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);

2213 2214 2215
	if (ieee80211_drop_unencrypted(rx, hdr->frame_control))
		return RX_DROP_MONITOR;

2216 2217 2218
	/* frame is in RMC, don't forward */
	if (ieee80211_is_data(hdr->frame_control) &&
	    is_multicast_ether_addr(hdr->addr1) &&
J
Johannes Berg 已提交
2219
	    mesh_rmc_check(rx->sdata, hdr->addr3, mesh_hdr))
2220 2221
		return RX_DROP_MONITOR;

2222
	if (!ieee80211_is_data(hdr->frame_control))
2223 2224 2225 2226 2227
		return RX_CONTINUE;

	if (!mesh_hdr->ttl)
		return RX_DROP_MONITOR;

2228
	if (mesh_hdr->flags & MESH_FLAGS_AE) {
2229
		struct mesh_path *mppath;
2230 2231 2232 2233 2234 2235
		char *proxied_addr;
		char *mpp_addr;

		if (is_multicast_ether_addr(hdr->addr1)) {
			mpp_addr = hdr->addr3;
			proxied_addr = mesh_hdr->eaddr1;
2236 2237
		} else if (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6) {
			/* has_a4 already checked in ieee80211_rx_mesh_check */
2238 2239
			mpp_addr = hdr->addr4;
			proxied_addr = mesh_hdr->eaddr2;
2240 2241
		} else {
			return RX_DROP_MONITOR;
2242
		}
2243 2244

		rcu_read_lock();
J
Johannes Berg 已提交
2245
		mppath = mpp_path_lookup(sdata, proxied_addr);
2246
		if (!mppath) {
J
Johannes Berg 已提交
2247
			mpp_path_add(sdata, proxied_addr, mpp_addr);
2248 2249
		} else {
			spin_lock_bh(&mppath->state_lock);
2250
			if (!ether_addr_equal(mppath->mpp, mpp_addr))
2251
				memcpy(mppath->mpp, mpp_addr, ETH_ALEN);
2252 2253 2254 2255 2256
			spin_unlock_bh(&mppath->state_lock);
		}
		rcu_read_unlock();
	}

2257 2258
	/* Frame has reached destination.  Don't forward */
	if (!is_multicast_ether_addr(hdr->addr1) &&
2259
	    ether_addr_equal(sdata->vif.addr, hdr->addr3))
2260 2261
		return RX_CONTINUE;

Y
Yoni Divinsky 已提交
2262
	q = ieee80211_select_queue_80211(sdata, skb, hdr);
2263
	if (ieee80211_queue_stopped(&local->hw, q)) {
2264
		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion);
2265 2266 2267
		return RX_DROP_MONITOR;
	}
	skb_set_queue_mapping(skb, q);
2268

2269 2270
	if (!--mesh_hdr->ttl) {
		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl);
2271
		goto out;
2272 2273
	}

2274 2275 2276
	if (!ifmsh->mshcfg.dot11MeshForwarding)
		goto out;

2277 2278
	fwd_skb = skb_copy(skb, GFP_ATOMIC);
	if (!fwd_skb) {
J
Johannes Berg 已提交
2279
		net_info_ratelimited("%s: failed to clone mesh frame\n",
2280
				    sdata->name);
2281 2282 2283 2284
		goto out;
	}

	fwd_hdr =  (struct ieee80211_hdr *) fwd_skb->data;
2285
	fwd_hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_RETRY);
2286 2287 2288 2289 2290 2291 2292 2293
	info = IEEE80211_SKB_CB(fwd_skb);
	memset(info, 0, sizeof(*info));
	info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
	info->control.vif = &rx->sdata->vif;
	info->control.jiffies = jiffies;
	if (is_multicast_ether_addr(fwd_hdr->addr1)) {
		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_mcast);
		memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
M
Marco Porsch 已提交
2294 2295
		/* update power mode indication when forwarding */
		ieee80211_mps_set_frame_flags(sdata, NULL, fwd_hdr);
J
Johannes Berg 已提交
2296
	} else if (!mesh_nexthop_lookup(sdata, fwd_skb)) {
M
Marco Porsch 已提交
2297
		/* mesh power mode flags updated in mesh_nexthop_lookup */
2298 2299 2300
		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast);
	} else {
		/* unable to resolve next hop */
J
Johannes Berg 已提交
2301
		mesh_path_error_tx(sdata, ifmsh->mshcfg.element_ttl,
2302 2303 2304
				   fwd_hdr->addr3, 0,
				   WLAN_REASON_MESH_PATH_NOFORWARD,
				   fwd_hdr->addr2);
2305
		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_no_route);
2306
		kfree_skb(fwd_skb);
2307
		return RX_DROP_MONITOR;
2308 2309
	}

2310 2311
	IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
	ieee80211_add_pending_skb(local, fwd_skb);
J
Johannes Berg 已提交
2312
 out:
2313
	if (is_multicast_ether_addr(hdr->addr1))
2314
		return RX_CONTINUE;
2315
	return RX_DROP_MONITOR;
2316
}
I
Ingo Molnar 已提交
2317
#endif
2318

2319
static ieee80211_rx_result debug_noinline
2320
ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
2321
{
J
Johannes Berg 已提交
2322
	struct ieee80211_sub_if_data *sdata = rx->sdata;
2323
	struct ieee80211_local *local = rx->local;
J
Johannes Berg 已提交
2324
	struct net_device *dev = sdata->dev;
2325 2326
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
	__le16 fc = hdr->frame_control;
2327
	bool port_control;
2328
	int err;
2329

2330
	if (unlikely(!ieee80211_is_data(hdr->frame_control)))
2331
		return RX_CONTINUE;
2332

2333
	if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
J
Johannes Berg 已提交
2334
		return RX_DROP_MONITOR;
2335

2336
	if (rx->sta) {
2337
		/* The seqno index has the same property as needed
2338 2339 2340 2341
		 * for the rx_msdu field, i.e. it is IEEE80211_NUM_TIDS
		 * for non-QoS-data frames. Here we know it's a data
		 * frame, so count MSDUs.
		 */
2342
		rx->sta->rx_msdu[rx->seqno_idx]++;
2343 2344
	}

2345
	/*
2346 2347
	 * Send unexpected-4addr-frame event to hostapd. For older versions,
	 * also drop the frame to cooked monitor interfaces.
2348 2349
	 */
	if (ieee80211_has_a4(hdr->frame_control) &&
2350 2351 2352 2353 2354
	    sdata->vif.type == NL80211_IFTYPE_AP) {
		if (rx->sta &&
		    !test_and_set_sta_flag(rx->sta, WLAN_STA_4ADDR_EVENT))
			cfg80211_rx_unexpected_4addr_frame(
				rx->sdata->dev, rx->sta->sta.addr, GFP_ATOMIC);
2355
		return RX_DROP_MONITOR;
2356
	}
2357

2358
	err = __ieee80211_data_to_8023(rx, &port_control);
2359
	if (unlikely(err))
J
Johannes Berg 已提交
2360
		return RX_DROP_UNUSABLE;
2361

2362
	if (!ieee80211_frame_allowed(rx, fc))
J
Johannes Berg 已提交
2363
		return RX_DROP_MONITOR;
2364

2365 2366 2367 2368 2369 2370 2371 2372 2373 2374 2375 2376 2377 2378 2379 2380 2381 2382 2383 2384 2385
	/* directly handle TDLS channel switch requests/responses */
	if (unlikely(((struct ethhdr *)rx->skb->data)->h_proto ==
						cpu_to_be16(ETH_P_TDLS))) {
		struct ieee80211_tdls_data *tf = (void *)rx->skb->data;

		if (pskb_may_pull(rx->skb,
				  offsetof(struct ieee80211_tdls_data, u)) &&
		    tf->payload_type == WLAN_TDLS_SNAP_RFTYPE &&
		    tf->category == WLAN_CATEGORY_TDLS &&
		    (tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_REQUEST ||
		     tf->action_code == WLAN_TDLS_CHANNEL_SWITCH_RESPONSE)) {
			rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TDLS_CHSW;
			skb_queue_tail(&sdata->skb_queue, rx->skb);
			ieee80211_queue_work(&rx->local->hw, &sdata->work);
			if (rx->sta)
				rx->sta->rx_packets++;

			return RX_QUEUED;
		}
	}

2386 2387 2388 2389 2390 2391 2392 2393
	if (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
	    unlikely(port_control) && sdata->bss) {
		sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
				     u.ap);
		dev = sdata->dev;
		rx->sdata = sdata;
	}

2394 2395
	rx->skb->dev = dev;

2396
	if (local->ps_sdata && local->hw.conf.dynamic_ps_timeout > 0 &&
2397 2398 2399 2400
	    !is_multicast_ether_addr(
		    ((struct ethhdr *)rx->skb->data)->h_dest) &&
	    (!local->scanning &&
	     !test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))) {
2401 2402 2403 2404
			mod_timer(&local->dynamic_ps_timer, jiffies +
			 msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
	}

2405
	ieee80211_deliver_skb(rx);
2406

2407
	return RX_QUEUED;
2408 2409
}

2410
static ieee80211_rx_result debug_noinline
2411
ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames)
2412 2413
{
	struct sk_buff *skb = rx->skb;
2414
	struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
2415 2416 2417 2418
	struct tid_ampdu_rx *tid_agg_rx;
	u16 start_seq_num;
	u16 tid;

2419
	if (likely(!ieee80211_is_ctl(bar->frame_control)))
2420
		return RX_CONTINUE;
2421

2422
	if (ieee80211_is_back_req(bar->frame_control)) {
2423 2424 2425 2426
		struct {
			__le16 control, start_seq_num;
		} __packed bar_data;

2427
		if (!rx->sta)
2428
			return RX_DROP_MONITOR;
2429 2430 2431 2432 2433 2434

		if (skb_copy_bits(skb, offsetof(struct ieee80211_bar, control),
				  &bar_data, sizeof(bar_data)))
			return RX_DROP_MONITOR;

		tid = le16_to_cpu(bar_data.control) >> 12;
2435 2436 2437

		tid_agg_rx = rcu_dereference(rx->sta->ampdu_mlme.tid_rx[tid]);
		if (!tid_agg_rx)
2438
			return RX_DROP_MONITOR;
2439

2440
		start_seq_num = le16_to_cpu(bar_data.start_seq_num) >> 4;
2441 2442

		/* reset session timer */
2443 2444 2445
		if (tid_agg_rx->timeout)
			mod_timer(&tid_agg_rx->session_timer,
				  TU_TO_EXP_TIME(tid_agg_rx->timeout));
2446

2447
		spin_lock(&tid_agg_rx->reorder_lock);
2448
		/* release stored frames up to start of BAR */
2449
		ieee80211_release_reorder_frames(rx->sdata, tid_agg_rx,
2450
						 start_seq_num, frames);
2451 2452
		spin_unlock(&tid_agg_rx->reorder_lock);

2453 2454
		kfree_skb(skb);
		return RX_QUEUED;
2455 2456
	}

2457 2458 2459 2460 2461 2462
	/*
	 * After this point, we only want management frames,
	 * so we can drop all remaining control frames to
	 * cooked monitor interfaces.
	 */
	return RX_DROP_MONITOR;
2463 2464
}

2465 2466 2467
static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
					   struct ieee80211_mgmt *mgmt,
					   size_t len)
2468 2469 2470 2471 2472
{
	struct ieee80211_local *local = sdata->local;
	struct sk_buff *skb;
	struct ieee80211_mgmt *resp;

2473
	if (!ether_addr_equal(mgmt->da, sdata->vif.addr)) {
2474 2475 2476 2477
		/* Not to own unicast address */
		return;
	}

2478 2479
	if (!ether_addr_equal(mgmt->sa, sdata->u.mgd.bssid) ||
	    !ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid)) {
2480
		/* Not from the current AP or not associated yet. */
2481 2482 2483 2484 2485 2486 2487 2488 2489 2490 2491 2492 2493 2494 2495 2496
		return;
	}

	if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) {
		/* Too short SA Query request frame */
		return;
	}

	skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom);
	if (skb == NULL)
		return;

	skb_reserve(skb, local->hw.extra_tx_headroom);
	resp = (struct ieee80211_mgmt *) skb_put(skb, 24);
	memset(resp, 0, 24);
	memcpy(resp->da, mgmt->sa, ETH_ALEN);
2497
	memcpy(resp->sa, sdata->vif.addr, ETH_ALEN);
2498
	memcpy(resp->bssid, sdata->u.mgd.bssid, ETH_ALEN);
2499 2500 2501 2502 2503 2504 2505 2506 2507
	resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
					  IEEE80211_STYPE_ACTION);
	skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query));
	resp->u.action.category = WLAN_CATEGORY_SA_QUERY;
	resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE;
	memcpy(resp->u.action.u.sa_query.trans_id,
	       mgmt->u.action.u.sa_query.trans_id,
	       WLAN_SA_QUERY_TR_ID_LEN);

2508
	ieee80211_tx_skb(sdata, skb);
2509 2510
}

2511 2512 2513 2514
static ieee80211_rx_result debug_noinline
ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx)
{
	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
2515
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2516 2517 2518 2519 2520 2521 2522 2523 2524 2525 2526 2527

	/*
	 * From here on, look only at management frames.
	 * Data and control frames are already handled,
	 * and unknown (reserved) frames are useless.
	 */
	if (rx->skb->len < 24)
		return RX_DROP_MONITOR;

	if (!ieee80211_is_mgmt(mgmt->frame_control))
		return RX_DROP_MONITOR;

J
Johannes Berg 已提交
2528 2529 2530
	if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
	    ieee80211_is_beacon(mgmt->frame_control) &&
	    !(rx->flags & IEEE80211_RX_BEACON_REPORTED)) {
2531 2532 2533 2534 2535
		int sig = 0;

		if (rx->local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
			sig = status->signal;

J
Johannes Berg 已提交
2536 2537
		cfg80211_report_obss_beacon(rx->local->hw.wiphy,
					    rx->skb->data, rx->skb->len,
2538
					    status->freq, sig);
J
Johannes Berg 已提交
2539 2540 2541
		rx->flags |= IEEE80211_RX_BEACON_REPORTED;
	}

2542 2543 2544 2545 2546 2547
	if (ieee80211_drop_unencrypted_mgmt(rx))
		return RX_DROP_UNUSABLE;

	return RX_CONTINUE;
}

2548 2549 2550 2551
static ieee80211_rx_result debug_noinline
ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
{
	struct ieee80211_local *local = rx->local;
J
Johannes Berg 已提交
2552
	struct ieee80211_sub_if_data *sdata = rx->sdata;
2553
	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
2554
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2555 2556 2557 2558 2559
	int len = rx->skb->len;

	if (!ieee80211_is_action(mgmt->frame_control))
		return RX_CONTINUE;

2560 2561
	/* drop too small frames */
	if (len < IEEE80211_MIN_ACTION_SIZE)
2562
		return RX_DROP_UNUSABLE;
2563

2564
	if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC &&
2565 2566
	    mgmt->u.action.category != WLAN_CATEGORY_SELF_PROTECTED &&
	    mgmt->u.action.category != WLAN_CATEGORY_SPECTRUM_MGMT)
2567
		return RX_DROP_UNUSABLE;
2568 2569

	switch (mgmt->u.action.category) {
2570 2571 2572 2573 2574 2575 2576 2577 2578 2579 2580 2581
	case WLAN_CATEGORY_HT:
		/* reject HT action frames from stations not supporting HT */
		if (!rx->sta->sta.ht_cap.ht_supported)
			goto invalid;

		if (sdata->vif.type != NL80211_IFTYPE_STATION &&
		    sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
		    sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
		    sdata->vif.type != NL80211_IFTYPE_AP &&
		    sdata->vif.type != NL80211_IFTYPE_ADHOC)
			break;

2582
		/* verify action & smps_control/chanwidth are present */
2583 2584 2585 2586 2587 2588
		if (len < IEEE80211_MIN_ACTION_SIZE + 2)
			goto invalid;

		switch (mgmt->u.action.u.ht_smps.action) {
		case WLAN_HT_ACTION_SMPS: {
			struct ieee80211_supported_band *sband;
2589
			enum ieee80211_smps_mode smps_mode;
2590 2591 2592 2593

			/* convert to HT capability */
			switch (mgmt->u.action.u.ht_smps.smps_control) {
			case WLAN_HT_SMPS_CONTROL_DISABLED:
2594
				smps_mode = IEEE80211_SMPS_OFF;
2595 2596
				break;
			case WLAN_HT_SMPS_CONTROL_STATIC:
2597
				smps_mode = IEEE80211_SMPS_STATIC;
2598 2599
				break;
			case WLAN_HT_SMPS_CONTROL_DYNAMIC:
2600
				smps_mode = IEEE80211_SMPS_DYNAMIC;
2601 2602 2603 2604 2605 2606
				break;
			default:
				goto invalid;
			}

			/* if no change do nothing */
2607
			if (rx->sta->sta.smps_mode == smps_mode)
2608
				goto handled;
2609
			rx->sta->sta.smps_mode = smps_mode;
2610 2611 2612

			sband = rx->local->hw.wiphy->bands[status->band];

2613 2614
			rate_control_rate_update(local, sband, rx->sta,
						 IEEE80211_RC_SMPS_CHANGED);
2615 2616
			goto handled;
		}
2617 2618 2619
		case WLAN_HT_ACTION_NOTIFY_CHANWIDTH: {
			struct ieee80211_supported_band *sband;
			u8 chanwidth = mgmt->u.action.u.ht_notify_cw.chanwidth;
2620
			enum ieee80211_sta_rx_bandwidth max_bw, new_bw;
2621 2622

			/* If it doesn't support 40 MHz it can't change ... */
2623 2624
			if (!(rx->sta->sta.ht_cap.cap &
					IEEE80211_HT_CAP_SUP_WIDTH_20_40))
2625 2626
				goto handled;

2627
			if (chanwidth == IEEE80211_HT_CHANWIDTH_20MHZ)
2628
				max_bw = IEEE80211_STA_RX_BW_20;
2629
			else
2630 2631 2632 2633 2634
				max_bw = ieee80211_sta_cap_rx_bw(rx->sta);

			/* set cur_max_bandwidth and recalc sta bw */
			rx->sta->cur_max_bandwidth = max_bw;
			new_bw = ieee80211_sta_cur_vht_bw(rx->sta);
2635

2636
			if (rx->sta->sta.bandwidth == new_bw)
2637 2638
				goto handled;

2639
			rx->sta->sta.bandwidth = new_bw;
2640 2641 2642 2643 2644 2645
			sband = rx->local->hw.wiphy->bands[status->band];

			rate_control_rate_update(local, sband, rx->sta,
						 IEEE80211_RC_BW_CHANGED);
			goto handled;
		}
2646 2647 2648 2649
		default:
			goto invalid;
		}

2650
		break;
2651 2652 2653 2654 2655 2656 2657 2658 2659 2660 2661 2662 2663 2664 2665 2666
	case WLAN_CATEGORY_PUBLIC:
		if (len < IEEE80211_MIN_ACTION_SIZE + 1)
			goto invalid;
		if (sdata->vif.type != NL80211_IFTYPE_STATION)
			break;
		if (!rx->sta)
			break;
		if (!ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid))
			break;
		if (mgmt->u.action.u.ext_chan_switch.action_code !=
				WLAN_PUB_ACTION_EXT_CHANSW_ANN)
			break;
		if (len < offsetof(struct ieee80211_mgmt,
				   u.action.u.ext_chan_switch.variable))
			goto invalid;
		goto queue;
2667 2668 2669 2670 2671 2672 2673 2674 2675 2676 2677 2678 2679 2680 2681 2682 2683 2684 2685 2686 2687 2688 2689
	case WLAN_CATEGORY_VHT:
		if (sdata->vif.type != NL80211_IFTYPE_STATION &&
		    sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
		    sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
		    sdata->vif.type != NL80211_IFTYPE_AP &&
		    sdata->vif.type != NL80211_IFTYPE_ADHOC)
			break;

		/* verify action code is present */
		if (len < IEEE80211_MIN_ACTION_SIZE + 1)
			goto invalid;

		switch (mgmt->u.action.u.vht_opmode_notif.action_code) {
		case WLAN_VHT_ACTION_OPMODE_NOTIF: {
			u8 opmode;

			/* verify opmode is present */
			if (len < IEEE80211_MIN_ACTION_SIZE + 2)
				goto invalid;

			opmode = mgmt->u.action.u.vht_opmode_notif.operating_mode;

			ieee80211_vht_handle_opmode(rx->sdata, rx->sta,
2690 2691
						    opmode, status->band,
						    false);
2692 2693 2694 2695 2696
			goto handled;
		}
		default:
			break;
		}
2697
		break;
2698
	case WLAN_CATEGORY_BACK:
2699
		if (sdata->vif.type != NL80211_IFTYPE_STATION &&
2700
		    sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
2701
		    sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
2702 2703
		    sdata->vif.type != NL80211_IFTYPE_AP &&
		    sdata->vif.type != NL80211_IFTYPE_ADHOC)
2704
			break;
2705

2706 2707 2708 2709
		/* verify action_code is present */
		if (len < IEEE80211_MIN_ACTION_SIZE + 1)
			break;

2710 2711 2712 2713
		switch (mgmt->u.action.u.addba_req.action_code) {
		case WLAN_ACTION_ADDBA_REQ:
			if (len < (IEEE80211_MIN_ACTION_SIZE +
				   sizeof(mgmt->u.action.u.addba_req)))
2714 2715
				goto invalid;
			break;
2716 2717 2718
		case WLAN_ACTION_ADDBA_RESP:
			if (len < (IEEE80211_MIN_ACTION_SIZE +
				   sizeof(mgmt->u.action.u.addba_resp)))
2719 2720
				goto invalid;
			break;
2721 2722 2723
		case WLAN_ACTION_DELBA:
			if (len < (IEEE80211_MIN_ACTION_SIZE +
				   sizeof(mgmt->u.action.u.delba)))
2724 2725 2726 2727
				goto invalid;
			break;
		default:
			goto invalid;
2728
		}
2729

2730
		goto queue;
2731
	case WLAN_CATEGORY_SPECTRUM_MGMT:
2732 2733 2734 2735
		/* verify action_code is present */
		if (len < IEEE80211_MIN_ACTION_SIZE + 1)
			break;

2736 2737
		switch (mgmt->u.action.u.measurement.action_code) {
		case WLAN_ACTION_SPCT_MSR_REQ:
2738 2739 2740
			if (status->band != IEEE80211_BAND_5GHZ)
				break;

2741 2742
			if (len < (IEEE80211_MIN_ACTION_SIZE +
				   sizeof(mgmt->u.action.u.measurement)))
2743
				break;
2744 2745 2746 2747

			if (sdata->vif.type != NL80211_IFTYPE_STATION)
				break;

2748
			ieee80211_process_measurement_req(sdata, mgmt, len);
2749
			goto handled;
2750 2751 2752 2753
		case WLAN_ACTION_SPCT_CHL_SWITCH: {
			u8 *bssid;
			if (len < (IEEE80211_MIN_ACTION_SIZE +
				   sizeof(mgmt->u.action.u.chan_switch)))
2754
				break;
2755

2756
			if (sdata->vif.type != NL80211_IFTYPE_STATION &&
2757 2758
			    sdata->vif.type != NL80211_IFTYPE_ADHOC &&
			    sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
2759 2760 2761 2762 2763 2764
				break;

			if (sdata->vif.type == NL80211_IFTYPE_STATION)
				bssid = sdata->u.mgd.bssid;
			else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
				bssid = sdata->u.ibss.bssid;
2765 2766
			else if (sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
				bssid = mgmt->sa;
2767 2768 2769 2770
			else
				break;

			if (!ether_addr_equal(mgmt->bssid, bssid))
2771
				break;
S
Sujith 已提交
2772

2773
			goto queue;
2774
			}
2775 2776
		}
		break;
2777 2778 2779
	case WLAN_CATEGORY_SA_QUERY:
		if (len < (IEEE80211_MIN_ACTION_SIZE +
			   sizeof(mgmt->u.action.u.sa_query)))
2780 2781
			break;

2782 2783 2784
		switch (mgmt->u.action.u.sa_query.action) {
		case WLAN_ACTION_SA_QUERY_REQUEST:
			if (sdata->vif.type != NL80211_IFTYPE_STATION)
2785
				break;
2786
			ieee80211_process_sa_query_req(sdata, mgmt, len);
2787
			goto handled;
2788 2789
		}
		break;
2790
	case WLAN_CATEGORY_SELF_PROTECTED:
2791 2792 2793 2794
		if (len < (IEEE80211_MIN_ACTION_SIZE +
			   sizeof(mgmt->u.action.u.self_prot.action_code)))
			break;

2795 2796 2797 2798 2799 2800
		switch (mgmt->u.action.u.self_prot.action_code) {
		case WLAN_SP_MESH_PEERING_OPEN:
		case WLAN_SP_MESH_PEERING_CLOSE:
		case WLAN_SP_MESH_PEERING_CONFIRM:
			if (!ieee80211_vif_is_mesh(&sdata->vif))
				goto invalid;
2801
			if (sdata->u.mesh.user_mpm)
2802 2803 2804 2805 2806 2807 2808 2809 2810 2811
				/* userspace handles this frame */
				break;
			goto queue;
		case WLAN_SP_MGK_INFORM:
		case WLAN_SP_MGK_ACK:
			if (!ieee80211_vif_is_mesh(&sdata->vif))
				goto invalid;
			break;
		}
		break;
2812
	case WLAN_CATEGORY_MESH_ACTION:
2813 2814 2815 2816
		if (len < (IEEE80211_MIN_ACTION_SIZE +
			   sizeof(mgmt->u.action.u.mesh_action.action_code)))
			break;

2817 2818
		if (!ieee80211_vif_is_mesh(&sdata->vif))
			break;
2819
		if (mesh_action_is_path_sel(mgmt) &&
J
Johannes Berg 已提交
2820
		    !mesh_path_sel_is_hwmp(sdata))
2821 2822
			break;
		goto queue;
2823
	}
2824

2825 2826
	return RX_CONTINUE;

2827
 invalid:
2828
	status->rx_flags |= IEEE80211_RX_MALFORMED_ACTION_FRM;
2829 2830 2831 2832 2833 2834 2835 2836 2837 2838 2839 2840 2841 2842 2843 2844 2845 2846 2847 2848 2849
	/* will return in the next handlers */
	return RX_CONTINUE;

 handled:
	if (rx->sta)
		rx->sta->rx_packets++;
	dev_kfree_skb(rx->skb);
	return RX_QUEUED;

 queue:
	rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
	skb_queue_tail(&sdata->skb_queue, rx->skb);
	ieee80211_queue_work(&local->hw, &sdata->work);
	if (rx->sta)
		rx->sta->rx_packets++;
	return RX_QUEUED;
}

static ieee80211_rx_result debug_noinline
ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx)
{
2850
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2851
	int sig = 0;
2852 2853

	/* skip known-bad action frames and return them in the next handler */
2854
	if (status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM)
2855
		return RX_CONTINUE;
2856

2857 2858 2859 2860 2861 2862 2863
	/*
	 * Getting here means the kernel doesn't know how to handle
	 * it, but maybe userspace does ... include returned frames
	 * so userspace can register for those to know whether ones
	 * it transmitted were processed or returned.
	 */

2864 2865 2866
	if (rx->local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
		sig = status->signal;

2867
	if (cfg80211_rx_mgmt(&rx->sdata->wdev, status->freq, sig,
2868
			     rx->skb->data, rx->skb->len, 0)) {
2869 2870 2871 2872 2873 2874 2875 2876 2877 2878 2879 2880 2881 2882 2883 2884
		if (rx->sta)
			rx->sta->rx_packets++;
		dev_kfree_skb(rx->skb);
		return RX_QUEUED;
	}

	return RX_CONTINUE;
}

static ieee80211_rx_result debug_noinline
ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
{
	struct ieee80211_local *local = rx->local;
	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
	struct sk_buff *nskb;
	struct ieee80211_sub_if_data *sdata = rx->sdata;
2885
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2886 2887 2888 2889 2890 2891 2892 2893 2894

	if (!ieee80211_is_action(mgmt->frame_control))
		return RX_CONTINUE;

	/*
	 * For AP mode, hostapd is responsible for handling any action
	 * frames that we didn't handle, including returning unknown
	 * ones. For all other modes we will return them to the sender,
	 * setting the 0x80 bit in the action category, as required by
2895
	 * 802.11-2012 9.24.4.
2896 2897 2898 2899
	 * Newer versions of hostapd shall also use the management frame
	 * registration mechanisms, but older ones still use cooked
	 * monitor interfaces so push all frames there.
	 */
2900
	if (!(status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) &&
2901 2902 2903
	    (sdata->vif.type == NL80211_IFTYPE_AP ||
	     sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
		return RX_DROP_MONITOR;
2904

2905 2906 2907
	if (is_multicast_ether_addr(mgmt->da))
		return RX_DROP_MONITOR;

2908 2909 2910 2911 2912 2913 2914
	/* do not return rejected action frames */
	if (mgmt->u.action.category & 0x80)
		return RX_DROP_UNUSABLE;

	nskb = skb_copy_expand(rx->skb, local->hw.extra_tx_headroom, 0,
			       GFP_ATOMIC);
	if (nskb) {
2915
		struct ieee80211_mgmt *nmgmt = (void *)nskb->data;
2916

2917 2918 2919
		nmgmt->u.action.category |= 0x80;
		memcpy(nmgmt->da, nmgmt->sa, ETH_ALEN);
		memcpy(nmgmt->sa, rx->sdata->vif.addr, ETH_ALEN);
2920 2921 2922

		memset(nskb->cb, 0, sizeof(nskb->cb));

2923 2924 2925 2926 2927 2928 2929 2930 2931 2932 2933 2934 2935
		if (rx->sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) {
			struct ieee80211_tx_info *info = IEEE80211_SKB_CB(nskb);

			info->flags = IEEE80211_TX_CTL_TX_OFFCHAN |
				      IEEE80211_TX_INTFL_OFFCHAN_TX_OK |
				      IEEE80211_TX_CTL_NO_CCK_RATE;
			if (local->hw.flags & IEEE80211_HW_QUEUE_CONTROL)
				info->hw_queue =
					local->hw.offchannel_tx_hw_queue;
		}

		__ieee80211_tx_skb_tid_band(rx->sdata, nskb, 7,
					    status->band);
2936
	}
2937 2938
	dev_kfree_skb(rx->skb);
	return RX_QUEUED;
2939 2940
}

2941
static ieee80211_rx_result debug_noinline
2942
ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
2943
{
J
Johannes Berg 已提交
2944
	struct ieee80211_sub_if_data *sdata = rx->sdata;
2945 2946
	struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
	__le16 stype;
2947

2948
	stype = mgmt->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE);
2949

2950 2951
	if (!ieee80211_vif_is_mesh(&sdata->vif) &&
	    sdata->vif.type != NL80211_IFTYPE_ADHOC &&
2952
	    sdata->vif.type != NL80211_IFTYPE_OCB &&
2953 2954
	    sdata->vif.type != NL80211_IFTYPE_STATION)
		return RX_DROP_MONITOR;
2955

2956
	switch (stype) {
J
Johannes Berg 已提交
2957
	case cpu_to_le16(IEEE80211_STYPE_AUTH):
2958 2959 2960 2961
	case cpu_to_le16(IEEE80211_STYPE_BEACON):
	case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
		/* process for all: mesh, mlme, ibss */
		break;
J
Johannes Berg 已提交
2962 2963
	case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
	case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
2964 2965
	case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
	case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
2966 2967 2968 2969
		if (is_multicast_ether_addr(mgmt->da) &&
		    !is_broadcast_ether_addr(mgmt->da))
			return RX_DROP_MONITOR;

2970 2971 2972 2973 2974
		/* process only for station */
		if (sdata->vif.type != NL80211_IFTYPE_STATION)
			return RX_DROP_MONITOR;
		break;
	case cpu_to_le16(IEEE80211_STYPE_PROBE_REQ):
2975 2976 2977
		/* process only for ibss and mesh */
		if (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
		    sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
2978 2979 2980 2981 2982
			return RX_DROP_MONITOR;
		break;
	default:
		return RX_DROP_MONITOR;
	}
2983

2984
	/* queue up frame and kick off work to process it */
2985
	rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
2986 2987
	skb_queue_tail(&sdata->skb_queue, rx->skb);
	ieee80211_queue_work(&rx->local->hw, &sdata->work);
2988 2989
	if (rx->sta)
		rx->sta->rx_packets++;
2990

2991
	return RX_QUEUED;
2992 2993
}

2994
/* TODO: use IEEE80211_RX_FRAGMENTED */
J
Johannes Berg 已提交
2995 2996
static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
					struct ieee80211_rate *rate)
2997 2998 2999 3000 3001
{
	struct ieee80211_sub_if_data *sdata;
	struct ieee80211_local *local = rx->local;
	struct sk_buff *skb = rx->skb, *skb2;
	struct net_device *prev_dev = NULL;
J
Johannes Berg 已提交
3002
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
3003
	int needed_headroom;
3004

3005 3006 3007 3008 3009
	/*
	 * If cooked monitor has been processed already, then
	 * don't do it again. If not, set the flag.
	 */
	if (rx->flags & IEEE80211_RX_CMNTR)
3010
		goto out_free_skb;
3011
	rx->flags |= IEEE80211_RX_CMNTR;
3012

3013 3014 3015 3016
	/* If there are no cooked monitor interfaces, just free the SKB */
	if (!local->cooked_mntrs)
		goto out_free_skb;

3017 3018
	/* vendor data is long removed here */
	status->flag &= ~RX_FLAG_RADIOTAP_VENDOR_DATA;
3019
	/* room for the radiotap header based on driver features */
3020
	needed_headroom = ieee80211_rx_radiotap_hdrlen(local, status, skb);
3021

3022 3023 3024
	if (skb_headroom(skb) < needed_headroom &&
	    pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC))
		goto out_free_skb;
3025

3026
	/* prepend radiotap information */
3027 3028
	ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom,
					 false);
3029 3030 3031 3032 3033 3034 3035

	skb_set_mac_header(skb, 0);
	skb->ip_summed = CHECKSUM_UNNECESSARY;
	skb->pkt_type = PACKET_OTHERHOST;
	skb->protocol = htons(ETH_P_802_2);

	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
3036
		if (!ieee80211_sdata_running(sdata))
3037 3038
			continue;

3039
		if (sdata->vif.type != NL80211_IFTYPE_MONITOR ||
3040 3041 3042 3043 3044 3045 3046
		    !(sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES))
			continue;

		if (prev_dev) {
			skb2 = skb_clone(skb, GFP_ATOMIC);
			if (skb2) {
				skb2->dev = prev_dev;
3047
				netif_receive_skb(skb2);
3048 3049 3050 3051 3052 3053 3054 3055 3056 3057
			}
		}

		prev_dev = sdata->dev;
		sdata->dev->stats.rx_packets++;
		sdata->dev->stats.rx_bytes += skb->len;
	}

	if (prev_dev) {
		skb->dev = prev_dev;
3058
		netif_receive_skb(skb);
3059 3060
		return;
	}
3061 3062 3063 3064 3065

 out_free_skb:
	dev_kfree_skb(skb);
}

3066 3067 3068 3069 3070 3071 3072 3073 3074 3075 3076 3077 3078 3079 3080 3081 3082
static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx,
					 ieee80211_rx_result res)
{
	switch (res) {
	case RX_DROP_MONITOR:
		I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
		if (rx->sta)
			rx->sta->rx_dropped++;
		/* fall through */
	case RX_CONTINUE: {
		struct ieee80211_rate *rate = NULL;
		struct ieee80211_supported_band *sband;
		struct ieee80211_rx_status *status;

		status = IEEE80211_SKB_RXCB((rx->skb));

		sband = rx->local->hw.wiphy->bands[status->band];
3083 3084
		if (!(status->flag & RX_FLAG_HT) &&
		    !(status->flag & RX_FLAG_VHT))
3085 3086 3087 3088 3089 3090 3091 3092 3093 3094 3095 3096 3097 3098 3099 3100
			rate = &sband->bitrates[status->rate_idx];

		ieee80211_rx_cooked_monitor(rx, rate);
		break;
		}
	case RX_DROP_UNUSABLE:
		I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
		if (rx->sta)
			rx->sta->rx_dropped++;
		dev_kfree_skb(rx->skb);
		break;
	case RX_QUEUED:
		I802_DEBUG_INC(rx->sdata->local->rx_handlers_queued);
		break;
	}
}
3101

3102 3103
static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx,
				  struct sk_buff_head *frames)
3104 3105
{
	ieee80211_rx_result res = RX_DROP_MONITOR;
3106
	struct sk_buff *skb;
3107

3108 3109 3110 3111
#define CALL_RXH(rxh)			\
	do {				\
		res = rxh(rx);		\
		if (res != RX_CONTINUE)	\
3112
			goto rxh_next;  \
3113
	} while (0);
3114

3115 3116 3117 3118 3119 3120
	/* Lock here to avoid hitting all of the data used in the RX
	 * path (e.g. key data, station data, ...) concurrently when
	 * a frame is released from the reorder buffer due to timeout
	 * from the timer, potentially concurrently with RX from the
	 * driver.
	 */
3121
	spin_lock_bh(&rx->local->rx_path_lock);
3122

3123
	while ((skb = __skb_dequeue(frames))) {
3124 3125 3126 3127 3128 3129 3130 3131
		/*
		 * all the other fields are valid across frames
		 * that belong to an aMPDU since they are on the
		 * same TID from the same station
		 */
		rx->skb = skb;

		CALL_RXH(ieee80211_rx_h_check_more_data)
J
Johannes Berg 已提交
3132
		CALL_RXH(ieee80211_rx_h_uapsd_and_pspoll)
3133
		CALL_RXH(ieee80211_rx_h_sta_process)
3134
		CALL_RXH(ieee80211_rx_h_decrypt)
3135 3136 3137
		CALL_RXH(ieee80211_rx_h_defragment)
		CALL_RXH(ieee80211_rx_h_michael_mic_verify)
		/* must be after MMIC verify so header is counted in MPDU mic */
I
Ingo Molnar 已提交
3138
#ifdef CONFIG_MAC80211_MESH
3139
		if (ieee80211_vif_is_mesh(&rx->sdata->vif))
3140
			CALL_RXH(ieee80211_rx_h_mesh_fwding);
I
Ingo Molnar 已提交
3141
#endif
3142
		CALL_RXH(ieee80211_rx_h_amsdu)
3143
		CALL_RXH(ieee80211_rx_h_data)
3144 3145 3146 3147 3148 3149

		/* special treatment -- needs the queue */
		res = ieee80211_rx_h_ctrl(rx, frames);
		if (res != RX_CONTINUE)
			goto rxh_next;

3150
		CALL_RXH(ieee80211_rx_h_mgmt_check)
3151
		CALL_RXH(ieee80211_rx_h_action)
3152 3153
		CALL_RXH(ieee80211_rx_h_userspace_mgmt)
		CALL_RXH(ieee80211_rx_h_action_return)
3154
		CALL_RXH(ieee80211_rx_h_mgmt)
3155

3156 3157
 rxh_next:
		ieee80211_rx_handlers_result(rx, res);
3158

3159
#undef CALL_RXH
3160
	}
3161

3162
	spin_unlock_bh(&rx->local->rx_path_lock);
3163 3164
}

3165
static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
3166
{
3167
	struct sk_buff_head reorder_release;
3168 3169
	ieee80211_rx_result res = RX_DROP_MONITOR;

3170 3171
	__skb_queue_head_init(&reorder_release);

3172 3173 3174 3175 3176 3177 3178
#define CALL_RXH(rxh)			\
	do {				\
		res = rxh(rx);		\
		if (res != RX_CONTINUE)	\
			goto rxh_next;  \
	} while (0);

3179
	CALL_RXH(ieee80211_rx_h_check_dup)
3180 3181
	CALL_RXH(ieee80211_rx_h_check)

3182
	ieee80211_rx_reorder_ampdu(rx, &reorder_release);
3183

3184
	ieee80211_rx_handlers(rx, &reorder_release);
3185
	return;
3186

3187
 rxh_next:
3188 3189 3190
	ieee80211_rx_handlers_result(rx, res);

#undef CALL_RXH
3191 3192
}

3193
/*
3194 3195
 * This function makes calls into the RX path, therefore
 * it has to be invoked under RCU read lock.
3196 3197 3198
 */
void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
{
3199
	struct sk_buff_head frames;
3200 3201 3202 3203
	struct ieee80211_rx_data rx = {
		.sta = sta,
		.sdata = sta->sdata,
		.local = sta->local,
3204 3205 3206
		/* This is OK -- must be QoS data frame */
		.security_idx = tid,
		.seqno_idx = tid,
3207
		.flags = 0,
3208
	};
3209 3210 3211 3212 3213
	struct tid_ampdu_rx *tid_agg_rx;

	tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
	if (!tid_agg_rx)
		return;
3214

3215 3216
	__skb_queue_head_init(&frames);

3217
	spin_lock(&tid_agg_rx->reorder_lock);
3218
	ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames);
3219
	spin_unlock(&tid_agg_rx->reorder_lock);
3220

3221
	ieee80211_rx_handlers(&rx, &frames);
3222 3223
}

3224 3225
/* main receive path */

3226
static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx)
3227
{
3228
	struct ieee80211_sub_if_data *sdata = rx->sdata;
J
Johannes Berg 已提交
3229
	struct sk_buff *skb = rx->skb;
3230
	struct ieee80211_hdr *hdr = (void *)skb->data;
J
Johannes Berg 已提交
3231 3232
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
	u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
3233 3234
	int multicast = is_multicast_ether_addr(hdr->addr1);

3235
	switch (sdata->vif.type) {
3236
	case NL80211_IFTYPE_STATION:
3237
		if (!bssid && !sdata->u.mgd.use_4addr)
3238
			return false;
3239 3240 3241
		if (multicast)
			return true;
		return ether_addr_equal(sdata->vif.addr, hdr->addr1);
3242
	case NL80211_IFTYPE_ADHOC:
3243
		if (!bssid)
3244
			return false;
3245 3246
		if (ether_addr_equal(sdata->vif.addr, hdr->addr2) ||
		    ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2))
3247
			return false;
3248
		if (ieee80211_is_beacon(hdr->frame_control))
3249
			return true;
3250
		if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid))
3251
			return false;
3252 3253
		if (!multicast &&
		    !ether_addr_equal(sdata->vif.addr, hdr->addr1))
3254
			return false;
3255
		if (!rx->sta) {
3256
			int rate_idx;
3257 3258
			if (status->flag & (RX_FLAG_HT | RX_FLAG_VHT))
				rate_idx = 0; /* TODO: HT/VHT rates */
3259
			else
J
Johannes Berg 已提交
3260
				rate_idx = status->rate_idx;
3261 3262
			ieee80211_ibss_rx_no_sta(sdata, bssid, hdr->addr2,
						 BIT(rate_idx));
3263
		}
3264
		return true;
3265 3266 3267
	case NL80211_IFTYPE_OCB:
		if (!bssid)
			return false;
3268
		if (ieee80211_is_beacon(hdr->frame_control))
3269
			return false;
3270
		if (!is_broadcast_ether_addr(bssid))
3271
			return false;
3272 3273
		if (!multicast &&
		    !ether_addr_equal(sdata->dev->dev_addr, hdr->addr1))
3274
			return false;
3275
		if (!rx->sta) {
3276 3277 3278 3279 3280 3281 3282 3283
			int rate_idx;
			if (status->flag & RX_FLAG_HT)
				rate_idx = 0; /* TODO: HT rates */
			else
				rate_idx = status->rate_idx;
			ieee80211_ocb_rx_no_sta(sdata, bssid, hdr->addr2,
						BIT(rate_idx));
		}
3284
		return true;
3285
	case NL80211_IFTYPE_MESH_POINT:
3286 3287 3288
		if (multicast)
			return true;
		return ether_addr_equal(sdata->vif.addr, hdr->addr1);
3289 3290
	case NL80211_IFTYPE_AP_VLAN:
	case NL80211_IFTYPE_AP:
3291 3292 3293 3294
		if (!bssid)
			return ether_addr_equal(sdata->vif.addr, hdr->addr1);

		if (!ieee80211_bssid_match(bssid, sdata->vif.addr)) {
3295 3296 3297 3298 3299 3300
			/*
			 * Accept public action frames even when the
			 * BSSID doesn't match, this is used for P2P
			 * and location updates. Note that mac80211
			 * itself never looks at these frames.
			 */
3301 3302
			if (!multicast &&
			    !ether_addr_equal(sdata->vif.addr, hdr->addr1))
3303
				return false;
J
Johannes Berg 已提交
3304
			if (ieee80211_is_public_action(hdr, skb->len))
3305
				return true;
3306
			return ieee80211_is_beacon(hdr->frame_control);
3307 3308 3309
		}

		if (!ieee80211_has_tods(hdr->frame_control)) {
3310 3311 3312 3313 3314 3315 3316
			/* ignore data frames to TDLS-peers */
			if (ieee80211_is_data(hdr->frame_control))
				return false;
			/* ignore action frames to TDLS-peers */
			if (ieee80211_is_action(hdr->frame_control) &&
			    !ether_addr_equal(bssid, hdr->addr1))
				return false;
3317
		}
3318
		return true;
3319
	case NL80211_IFTYPE_WDS:
3320
		if (bssid || !ieee80211_is_data(hdr->frame_control))
3321
			return false;
3322
		return ether_addr_equal(sdata->u.wds.remote_addr, hdr->addr2);
3323
	case NL80211_IFTYPE_P2P_DEVICE:
3324 3325 3326 3327
		return ieee80211_is_public_action(hdr, skb->len) ||
		       ieee80211_is_probe_req(hdr->frame_control) ||
		       ieee80211_is_probe_resp(hdr->frame_control) ||
		       ieee80211_is_beacon(hdr->frame_control);
3328
	default:
J
Johannes Berg 已提交
3329
		break;
3330 3331
	}

3332 3333
	WARN_ON_ONCE(1);
	return false;
3334 3335
}

3336 3337 3338 3339 3340 3341 3342 3343 3344 3345 3346 3347 3348 3349
/*
 * This function returns whether or not the SKB
 * was destined for RX processing or not, which,
 * if consume is true, is equivalent to whether
 * or not the skb was consumed.
 */
static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,
					    struct sk_buff *skb, bool consume)
{
	struct ieee80211_local *local = rx->local;
	struct ieee80211_sub_if_data *sdata = rx->sdata;

	rx->skb = skb;

3350
	if (!ieee80211_accept_frame(rx))
3351 3352 3353 3354 3355 3356 3357
		return false;

	if (!consume) {
		skb = skb_copy(skb, GFP_ATOMIC);
		if (!skb) {
			if (net_ratelimit())
				wiphy_debug(local->hw.wiphy,
3358
					"failed to copy skb for %s\n",
3359 3360 3361 3362 3363 3364 3365 3366 3367 3368 3369
					sdata->name);
			return true;
		}

		rx->skb = skb;
	}

	ieee80211_invoke_rx_handlers(rx);
	return true;
}

3370
/*
3371
 * This is the actual Rx frames handler. as it belongs to Rx path it must
3372
 * be called with rcu_read_lock protection.
3373
 */
3374
static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
3375
					 struct sk_buff *skb)
3376 3377 3378 3379
{
	struct ieee80211_local *local = hw_to_local(hw);
	struct ieee80211_sub_if_data *sdata;
	struct ieee80211_hdr *hdr;
Z
Zhu Yi 已提交
3380
	__le16 fc;
3381
	struct ieee80211_rx_data rx;
3382
	struct ieee80211_sub_if_data *prev;
3383 3384
	struct sta_info *sta, *prev_sta;
	struct rhash_head *tmp;
Z
Zhu Yi 已提交
3385
	int err = 0;
3386

Z
Zhu Yi 已提交
3387
	fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
3388 3389 3390
	memset(&rx, 0, sizeof(rx));
	rx.skb = skb;
	rx.local = local;
3391

Z
Zhu Yi 已提交
3392
	if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc))
3393 3394
		local->dot11ReceivedFragmentCount++;

3395 3396 3397 3398 3399 3400 3401
	if (ieee80211_is_mgmt(fc)) {
		/* drop frame if too short for header */
		if (skb->len < ieee80211_hdrlen(fc))
			err = -ENOBUFS;
		else
			err = skb_linearize(skb);
	} else {
Z
Zhu Yi 已提交
3402
		err = !pskb_may_pull(skb, ieee80211_hdrlen(fc));
3403
	}
Z
Zhu Yi 已提交
3404 3405 3406 3407 3408 3409 3410

	if (err) {
		dev_kfree_skb(skb);
		return;
	}

	hdr = (struct ieee80211_hdr *)skb->data;
3411
	ieee80211_parse_qos(&rx);
3412
	ieee80211_verify_alignment(&rx);
3413

J
Johannes Berg 已提交
3414 3415 3416 3417
	if (unlikely(ieee80211_is_probe_resp(hdr->frame_control) ||
		     ieee80211_is_beacon(hdr->frame_control)))
		ieee80211_scan_rx(local, skb);

Z
Zhu Yi 已提交
3418
	if (ieee80211_is_data(fc)) {
3419 3420
		const struct bucket_table *tbl;

3421
		prev_sta = NULL;
3422

3423 3424 3425
		tbl = rht_dereference_rcu(local->sta_hash.tbl, &local->sta_hash);

		for_each_sta_info(local, tbl, hdr->addr2, sta, tmp) {
3426 3427 3428 3429 3430 3431 3432
			if (!prev_sta) {
				prev_sta = sta;
				continue;
			}

			rx.sta = prev_sta;
			rx.sdata = prev_sta->sdata;
3433
			ieee80211_prepare_and_rx_handle(&rx, skb, false);
3434

3435
			prev_sta = sta;
3436
		}
3437 3438 3439 3440 3441

		if (prev_sta) {
			rx.sta = prev_sta;
			rx.sdata = prev_sta->sdata;

3442
			if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
3443
				return;
3444
			goto out;
3445
		}
3446 3447
	}

3448
	prev = NULL;
3449

3450 3451 3452
	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
		if (!ieee80211_sdata_running(sdata))
			continue;
J
Johannes Berg 已提交
3453

3454 3455 3456
		if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
		    sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
			continue;
J
Johannes Berg 已提交
3457

3458 3459 3460 3461 3462
		/*
		 * frame is destined for this interface, but if it's
		 * not also for the previous one we handle that after
		 * the loop to avoid copying the SKB once too much
		 */
3463

3464
		if (!prev) {
3465
			prev = sdata;
3466
			continue;
J
Johannes Berg 已提交
3467
		}
3468

3469
		rx.sta = sta_info_get_bss(prev, hdr->addr2);
3470 3471
		rx.sdata = prev;
		ieee80211_prepare_and_rx_handle(&rx, skb, false);
3472

3473 3474 3475 3476
		prev = sdata;
	}

	if (prev) {
3477
		rx.sta = sta_info_get_bss(prev, hdr->addr2);
3478
		rx.sdata = prev;
3479

3480 3481
		if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
			return;
3482
	}
3483

3484
 out:
3485
	dev_kfree_skb(skb);
3486
}
3487 3488 3489 3490 3491

/*
 * This is the receive path handler. It is called by a low level driver when an
 * 802.11 MPDU is received from the hardware.
 */
3492
void ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb)
3493 3494
{
	struct ieee80211_local *local = hw_to_local(hw);
3495 3496
	struct ieee80211_rate *rate = NULL;
	struct ieee80211_supported_band *sband;
3497
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
3498

3499 3500
	WARN_ON_ONCE(softirq_count() == 0);

J
Johannes Berg 已提交
3501
	if (WARN_ON(status->band >= IEEE80211_NUM_BANDS))
J
Johannes Berg 已提交
3502
		goto drop;
3503 3504

	sband = local->hw.wiphy->bands[status->band];
J
Johannes Berg 已提交
3505 3506
	if (WARN_ON(!sband))
		goto drop;
3507

J
Johannes Berg 已提交
3508 3509 3510 3511 3512 3513 3514
	/*
	 * If we're suspending, it is possible although not too likely
	 * that we'd be receiving frames after having already partially
	 * quiesced the stack. We can't process such frames then since
	 * that might, for example, cause stations to be added or other
	 * driver callbacks be invoked.
	 */
J
Johannes Berg 已提交
3515 3516
	if (unlikely(local->quiescing || local->suspended))
		goto drop;
J
Johannes Berg 已提交
3517

3518 3519 3520 3521
	/* We might be during a HW reconfig, prevent Rx for the same reason */
	if (unlikely(local->in_reconfig))
		goto drop;

3522 3523 3524 3525
	/*
	 * The same happens when we're not even started,
	 * but that's worth a warning.
	 */
J
Johannes Berg 已提交
3526 3527
	if (WARN_ON(!local->started))
		goto drop;
3528

3529
	if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC))) {
3530
		/*
3531 3532
		 * Validate the rate, unless a PLCP error means that
		 * we probably can't have a valid rate here anyway.
3533
		 */
3534 3535 3536 3537 3538 3539 3540 3541 3542 3543 3544 3545

		if (status->flag & RX_FLAG_HT) {
			/*
			 * rate_idx is MCS index, which can be [0-76]
			 * as documented on:
			 *
			 * http://wireless.kernel.org/en/developers/Documentation/ieee80211/802.11n
			 *
			 * Anything else would be some sort of driver or
			 * hardware error. The driver should catch hardware
			 * errors.
			 */
J
Johannes Berg 已提交
3546
			if (WARN(status->rate_idx > 76,
3547 3548 3549 3550 3551 3552
				 "Rate marked as an HT rate but passed "
				 "status->rate_idx is not "
				 "an MCS index [0-76]: %d (0x%02x)\n",
				 status->rate_idx,
				 status->rate_idx))
				goto drop;
3553 3554 3555 3556 3557 3558 3559
		} else if (status->flag & RX_FLAG_VHT) {
			if (WARN_ONCE(status->rate_idx > 9 ||
				      !status->vht_nss ||
				      status->vht_nss > 8,
				      "Rate marked as a VHT rate but data is invalid: MCS: %d, NSS: %d\n",
				      status->rate_idx, status->vht_nss))
				goto drop;
3560
		} else {
J
Johannes Berg 已提交
3561
			if (WARN_ON(status->rate_idx >= sband->n_bitrates))
3562 3563 3564
				goto drop;
			rate = &sband->bitrates[status->rate_idx];
		}
3565
	}
3566

3567 3568
	status->rx_flags = 0;

3569 3570 3571 3572 3573 3574 3575 3576 3577 3578 3579 3580 3581
	/*
	 * key references and virtual interfaces are protected using RCU
	 * and this requires that we are in a read-side RCU section during
	 * receive processing
	 */
	rcu_read_lock();

	/*
	 * Frames with failed FCS/PLCP checksum are not returned,
	 * all other frames are returned without radiotap header
	 * if it was previously present.
	 * Also, frames with less than 16 bytes are dropped.
	 */
3582
	skb = ieee80211_rx_monitor(local, skb, rate);
3583 3584 3585 3586 3587
	if (!skb) {
		rcu_read_unlock();
		return;
	}

3588 3589 3590
	ieee80211_tpt_led_trig_rx(local,
			((struct ieee80211_hdr *)skb->data)->frame_control,
			skb->len);
3591
	__ieee80211_rx_handle_packet(hw, skb);
3592 3593

	rcu_read_unlock();
J
Johannes Berg 已提交
3594 3595 3596 3597

	return;
 drop:
	kfree_skb(skb);
3598
}
3599
EXPORT_SYMBOL(ieee80211_rx);
3600 3601 3602

/* This is a version of the rx handler that can be called from hard irq
 * context. Post the skb on the queue and schedule the tasklet */
3603
void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb)
3604 3605 3606 3607 3608 3609 3610 3611 3612 3613
{
	struct ieee80211_local *local = hw_to_local(hw);

	BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));

	skb->pkt_type = IEEE80211_RX_MSG;
	skb_queue_tail(&local->skb_queue, skb);
	tasklet_schedule(&local->tasklet);
}
EXPORT_SYMBOL(ieee80211_rx_irqsafe);