rx.c 95.9 KB
Newer Older
1 2 3 4
/*
 * Copyright 2002-2005, Instant802 Networks, Inc.
 * Copyright 2005-2006, Devicescape Software, Inc.
 * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
5
 * Copyright 2007-2010	Johannes Berg <johannes@sipsolutions.net>
6 7 8 9 10 11
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 */

12
#include <linux/jiffies.h>
13
#include <linux/slab.h>
14 15 16 17
#include <linux/kernel.h>
#include <linux/skbuff.h>
#include <linux/netdevice.h>
#include <linux/etherdevice.h>
18
#include <linux/rcupdate.h>
19
#include <linux/export.h>
20 21
#include <net/mac80211.h>
#include <net/ieee80211_radiotap.h>
22
#include <asm/unaligned.h>
23 24

#include "ieee80211_i.h"
25
#include "driver-ops.h"
J
Johannes Berg 已提交
26
#include "led.h"
27
#include "mesh.h"
28 29 30 31
#include "wep.h"
#include "wpa.h"
#include "tkip.h"
#include "wme.h"
32
#include "rate.h"
33

34 35 36 37 38 39 40
/*
 * monitor mode reception
 *
 * This function cleans up the SKB, i.e. it removes all the stuff
 * only useful for monitoring.
 */
static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
J
Johannes Berg 已提交
41
					   struct sk_buff *skb)
42
{
43 44
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);

45 46
	if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) {
		if (likely(skb->len > FCS_LEN))
Z
Zhu Yi 已提交
47
			__pskb_trim(skb, skb->len - FCS_LEN);
48 49 50 51
		else {
			/* driver bug */
			WARN_ON(1);
			dev_kfree_skb(skb);
52
			return NULL;
53 54 55
		}
	}

56 57 58
	if (status->vendor_radiotap_len)
		__pskb_pull(skb, status->vendor_radiotap_len);

59 60 61
	return skb;
}

J
Johannes Berg 已提交
62
static inline int should_drop_frame(struct sk_buff *skb, int present_fcs_len)
63
{
64
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
65 66 67
	struct ieee80211_hdr *hdr;

	hdr = (void *)(skb->data + status->vendor_radiotap_len);
68

69 70 71
	if (status->flag & (RX_FLAG_FAILED_FCS_CRC |
			    RX_FLAG_FAILED_PLCP_CRC |
			    RX_FLAG_AMPDU_IS_ZEROLEN))
72
		return 1;
73 74
	if (unlikely(skb->len < 16 + present_fcs_len +
				status->vendor_radiotap_len))
75
		return 1;
H
Harvey Harrison 已提交
76 77 78
	if (ieee80211_is_ctl(hdr->frame_control) &&
	    !ieee80211_is_pspoll(hdr->frame_control) &&
	    !ieee80211_is_back_req(hdr->frame_control))
79 80 81 82
		return 1;
	return 0;
}

83
static int
84 85
ieee80211_rx_radiotap_space(struct ieee80211_local *local,
			    struct ieee80211_rx_status *status)
86 87 88 89
{
	int len;

	/* always present fields */
90
	len = sizeof(struct ieee80211_radiotap_header) + 8;
91

92
	/* allocate extra bitmaps */
93 94
	if (status->vendor_radiotap_len)
		len += 4;
95 96
	if (status->chains)
		len += 4 * hweight8(status->chains);
97 98 99

	if (ieee80211_have_rx_timestamp(status)) {
		len = ALIGN(len, 8);
100
		len += 8;
101
	}
J
Johannes Berg 已提交
102
	if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
103 104
		len += 1;

105 106 107 108
	/* antenna field, if we don't have per-chain info */
	if (!status->chains)
		len += 1;

109 110
	/* padding for RX_FLAGS if necessary */
	len = ALIGN(len, 2);
111

112 113 114
	if (status->flag & RX_FLAG_HT) /* HT info */
		len += 3;

115
	if (status->flag & RX_FLAG_AMPDU_DETAILS) {
116
		len = ALIGN(len, 4);
117 118 119
		len += 8;
	}

120 121 122 123 124
	if (status->flag & RX_FLAG_VHT) {
		len = ALIGN(len, 2);
		len += 12;
	}

125 126 127 128 129
	if (status->chains) {
		/* antenna and antenna signal fields */
		len += 2 * hweight8(status->chains);
	}

130 131 132 133 134 135 136 137 138 139 140 141
	if (status->vendor_radiotap_len) {
		if (WARN_ON_ONCE(status->vendor_radiotap_align == 0))
			status->vendor_radiotap_align = 1;
		/* align standard part of vendor namespace */
		len = ALIGN(len, 2);
		/* allocate standard part of vendor namespace */
		len += 6;
		/* align vendor-defined part */
		len = ALIGN(len, status->vendor_radiotap_align);
		/* vendor-defined part is already in skb */
	}

142 143 144
	return len;
}

145
/*
146 147 148 149 150 151 152 153
 * ieee80211_add_rx_radiotap_header - add radiotap header
 *
 * add a radiotap header containing all the fields which the hardware provided.
 */
static void
ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
				 struct sk_buff *skb,
				 struct ieee80211_rate *rate,
154
				 int rtap_len, bool has_fcs)
155
{
156
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
157 158
	struct ieee80211_radiotap_header *rthdr;
	unsigned char *pos;
159 160
	__le32 *it_present;
	u32 it_present_val;
161
	u16 rx_flags = 0;
162
	u16 channel_flags = 0;
163 164
	int mpdulen, chain;
	unsigned long chains = status->chains;
165 166 167 168

	mpdulen = skb->len;
	if (!(has_fcs && (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)))
		mpdulen += FCS_LEN;
169 170 171

	rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len);
	memset(rthdr, 0, rtap_len);
172
	it_present = &rthdr->it_present;
173 174

	/* radiotap header, set always present flags */
175
	rthdr->it_len = cpu_to_le16(rtap_len + status->vendor_radiotap_len);
176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191
	it_present_val = BIT(IEEE80211_RADIOTAP_FLAGS) |
			 BIT(IEEE80211_RADIOTAP_CHANNEL) |
			 BIT(IEEE80211_RADIOTAP_RX_FLAGS);

	if (!status->chains)
		it_present_val |= BIT(IEEE80211_RADIOTAP_ANTENNA);

	for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
		it_present_val |=
			BIT(IEEE80211_RADIOTAP_EXT) |
			BIT(IEEE80211_RADIOTAP_RADIOTAP_NAMESPACE);
		put_unaligned_le32(it_present_val, it_present);
		it_present++;
		it_present_val = BIT(IEEE80211_RADIOTAP_ANTENNA) |
				 BIT(IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
	}
192

193
	if (status->vendor_radiotap_len) {
194 195 196 197 198
		it_present_val |= BIT(IEEE80211_RADIOTAP_VENDOR_NAMESPACE) |
				  BIT(IEEE80211_RADIOTAP_EXT);
		put_unaligned_le32(it_present_val, it_present);
		it_present++;
		it_present_val = status->vendor_radiotap_bitmap;
199 200
	}

201 202 203 204
	put_unaligned_le32(it_present_val, it_present);

	pos = (void *)(it_present + 1);

205 206 207
	/* the order of the following fields is important */

	/* IEEE80211_RADIOTAP_TSFT */
208
	if (ieee80211_have_rx_timestamp(status)) {
209 210 211
		/* padding */
		while ((pos - (u8 *)rthdr) & 7)
			*pos++ = 0;
212 213 214 215
		put_unaligned_le64(
			ieee80211_calculate_rx_timestamp(local, status,
							 mpdulen, 0),
			pos);
J
Johannes Berg 已提交
216
		rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
217 218 219 220
		pos += 8;
	}

	/* IEEE80211_RADIOTAP_FLAGS */
221
	if (has_fcs && (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS))
222
		*pos |= IEEE80211_RADIOTAP_F_FCS;
J
Johannes Berg 已提交
223 224
	if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
		*pos |= IEEE80211_RADIOTAP_F_BADFCS;
225 226
	if (status->flag & RX_FLAG_SHORTPRE)
		*pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
227 228 229
	pos++;

	/* IEEE80211_RADIOTAP_RATE */
230
	if (!rate || status->flag & (RX_FLAG_HT | RX_FLAG_VHT)) {
231
		/*
232
		 * Without rate information don't add it. If we have,
233
		 * MCS information is a separate field in radiotap,
234 235
		 * added below. The byte here is needed as padding
		 * for the channel though, so initialise it to 0.
236 237
		 */
		*pos = 0;
238
	} else {
239
		int shift = 0;
240
		rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
241 242 243 244 245
		if (status->flag & RX_FLAG_10MHZ)
			shift = 1;
		else if (status->flag & RX_FLAG_5MHZ)
			shift = 2;
		*pos = DIV_ROUND_UP(rate->bitrate, 5 * (1 << shift));
246
	}
247 248 249
	pos++;

	/* IEEE80211_RADIOTAP_CHANNEL */
250
	put_unaligned_le16(status->freq, pos);
251
	pos += 2;
252 253 254 255 256
	if (status->flag & RX_FLAG_10MHZ)
		channel_flags |= IEEE80211_CHAN_HALF;
	else if (status->flag & RX_FLAG_5MHZ)
		channel_flags |= IEEE80211_CHAN_QUARTER;

257
	if (status->band == IEEE80211_BAND_5GHZ)
258
		channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ;
259
	else if (status->flag & (RX_FLAG_HT | RX_FLAG_VHT))
260
		channel_flags |= IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
261
	else if (rate && rate->flags & IEEE80211_RATE_ERP_G)
262
		channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ;
263
	else if (rate)
264
		channel_flags |= IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ;
265
	else
266 267
		channel_flags |= IEEE80211_CHAN_2GHZ;
	put_unaligned_le16(channel_flags, pos);
268 269 270
	pos += 2;

	/* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
271 272
	if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM &&
	    !(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
273 274 275 276 277 278 279 280
		*pos = status->signal;
		rthdr->it_present |=
			cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
		pos++;
	}

	/* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */

281 282 283 284 285
	if (!status->chains) {
		/* IEEE80211_RADIOTAP_ANTENNA */
		*pos = status->antenna;
		pos++;
	}
286 287 288 289 290

	/* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */

	/* IEEE80211_RADIOTAP_RX_FLAGS */
	/* ensure 2 byte alignment for the 2 byte field as required */
291
	if ((pos - (u8 *)rthdr) & 1)
292
		*pos++ = 0;
J
Johannes Berg 已提交
293
	if (status->flag & RX_FLAG_FAILED_PLCP_CRC)
294 295
		rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP;
	put_unaligned_le16(rx_flags, pos);
296
	pos += 2;
297 298

	if (status->flag & RX_FLAG_HT) {
299 300
		unsigned int stbc;

301
		rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_MCS);
302
		*pos++ = local->hw.radiotap_mcs_details;
303 304 305 306 307
		*pos = 0;
		if (status->flag & RX_FLAG_SHORT_GI)
			*pos |= IEEE80211_RADIOTAP_MCS_SGI;
		if (status->flag & RX_FLAG_40MHZ)
			*pos |= IEEE80211_RADIOTAP_MCS_BW_40;
308 309
		if (status->flag & RX_FLAG_HT_GF)
			*pos |= IEEE80211_RADIOTAP_MCS_FMT_GF;
310 311
		stbc = (status->flag & RX_FLAG_STBC_MASK) >> RX_FLAG_STBC_SHIFT;
		*pos |= stbc << IEEE80211_RADIOTAP_MCS_STBC_SHIFT;
312 313 314
		pos++;
		*pos++ = status->rate_idx;
	}
315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345

	if (status->flag & RX_FLAG_AMPDU_DETAILS) {
		u16 flags = 0;

		/* ensure 4 byte alignment */
		while ((pos - (u8 *)rthdr) & 3)
			pos++;
		rthdr->it_present |=
			cpu_to_le32(1 << IEEE80211_RADIOTAP_AMPDU_STATUS);
		put_unaligned_le32(status->ampdu_reference, pos);
		pos += 4;
		if (status->flag & RX_FLAG_AMPDU_REPORT_ZEROLEN)
			flags |= IEEE80211_RADIOTAP_AMPDU_REPORT_ZEROLEN;
		if (status->flag & RX_FLAG_AMPDU_IS_ZEROLEN)
			flags |= IEEE80211_RADIOTAP_AMPDU_IS_ZEROLEN;
		if (status->flag & RX_FLAG_AMPDU_LAST_KNOWN)
			flags |= IEEE80211_RADIOTAP_AMPDU_LAST_KNOWN;
		if (status->flag & RX_FLAG_AMPDU_IS_LAST)
			flags |= IEEE80211_RADIOTAP_AMPDU_IS_LAST;
		if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_ERROR)
			flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_ERR;
		if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
			flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_KNOWN;
		put_unaligned_le16(flags, pos);
		pos += 2;
		if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
			*pos++ = status->ampdu_delimiter_crc;
		else
			*pos++ = 0;
		*pos++ = 0;
	}
346

347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381
	if (status->flag & RX_FLAG_VHT) {
		u16 known = local->hw.radiotap_vht_details;

		rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_VHT);
		/* known field - how to handle 80+80? */
		if (status->flag & RX_FLAG_80P80MHZ)
			known &= ~IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH;
		put_unaligned_le16(known, pos);
		pos += 2;
		/* flags */
		if (status->flag & RX_FLAG_SHORT_GI)
			*pos |= IEEE80211_RADIOTAP_VHT_FLAG_SGI;
		pos++;
		/* bandwidth */
		if (status->flag & RX_FLAG_80MHZ)
			*pos++ = 4;
		else if (status->flag & RX_FLAG_80P80MHZ)
			*pos++ = 0; /* marked not known above */
		else if (status->flag & RX_FLAG_160MHZ)
			*pos++ = 11;
		else if (status->flag & RX_FLAG_40MHZ)
			*pos++ = 1;
		else /* 20 MHz */
			*pos++ = 0;
		/* MCS/NSS */
		*pos = (status->rate_idx << 4) | status->vht_nss;
		pos += 4;
		/* coding field */
		pos++;
		/* group ID */
		pos++;
		/* partial_aid */
		pos += 2;
	}

382 383 384 385 386
	for_each_set_bit(chain, &chains, IEEE80211_MAX_CHAINS) {
		*pos++ = status->chain_signal[chain];
		*pos++ = chain;
	}

387 388 389 390 391 392 393 394 395 396 397 398 399 400
	if (status->vendor_radiotap_len) {
		/* ensure 2 byte alignment for the vendor field as required */
		if ((pos - (u8 *)rthdr) & 1)
			*pos++ = 0;
		*pos++ = status->vendor_radiotap_oui[0];
		*pos++ = status->vendor_radiotap_oui[1];
		*pos++ = status->vendor_radiotap_oui[2];
		*pos++ = status->vendor_radiotap_subns;
		put_unaligned_le16(status->vendor_radiotap_len, pos);
		pos += 2;
		/* align the actual payload as requested */
		while ((pos - (u8 *)rthdr) & (status->vendor_radiotap_align - 1))
			*pos++ = 0;
	}
401 402
}

403 404 405 406 407 408 409
/*
 * This function copies a received frame to all monitor interfaces and
 * returns a cleaned-up SKB that no longer includes the FCS nor the
 * radiotap header the driver might have added.
 */
static struct sk_buff *
ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
410
		     struct ieee80211_rate *rate)
411
{
412
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb);
413
	struct ieee80211_sub_if_data *sdata;
414
	int needed_headroom;
415 416 417 418 419 420 421 422 423 424 425 426
	struct sk_buff *skb, *skb2;
	struct net_device *prev_dev = NULL;
	int present_fcs_len = 0;

	/*
	 * First, we may need to make a copy of the skb because
	 *  (1) we need to modify it for radiotap (if not present), and
	 *  (2) the other RX handlers will modify the skb we got.
	 *
	 * We don't need to, of course, if we aren't going to return
	 * the SKB because it has a bad FCS/PLCP checksum.
	 */
J
Johannes Berg 已提交
427

428 429 430
	if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
		present_fcs_len = FCS_LEN;

431 432
	/* ensure hdr->frame_control and vendor radiotap data are in skb head */
	if (!pskb_may_pull(origskb, 2 + status->vendor_radiotap_len)) {
Z
Zhu Yi 已提交
433 434 435 436
		dev_kfree_skb(origskb);
		return NULL;
	}

437
	if (!local->monitors) {
J
Johannes Berg 已提交
438
		if (should_drop_frame(origskb, present_fcs_len)) {
439 440 441 442
			dev_kfree_skb(origskb);
			return NULL;
		}

J
Johannes Berg 已提交
443
		return remove_monitor_info(local, origskb);
444 445
	}

446 447 448
	/* room for the radiotap header based on driver features */
	needed_headroom = ieee80211_rx_radiotap_space(local, status);

J
Johannes Berg 已提交
449
	if (should_drop_frame(origskb, present_fcs_len)) {
450 451 452 453 454 455 456 457 458 459 460 461
		/* only need to expand headroom if necessary */
		skb = origskb;
		origskb = NULL;

		/*
		 * This shouldn't trigger often because most devices have an
		 * RX header they pull before we get here, and that should
		 * be big enough for our radiotap information. We should
		 * probably export the length to drivers so that we can have
		 * them allocate enough headroom to start with.
		 */
		if (skb_headroom(skb) < needed_headroom &&
462
		    pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
463 464 465 466 467 468 469 470 471 472
			dev_kfree_skb(skb);
			return NULL;
		}
	} else {
		/*
		 * Need to make a copy and possibly remove radiotap header
		 * and FCS from the original.
		 */
		skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC);

J
Johannes Berg 已提交
473
		origskb = remove_monitor_info(local, origskb);
474 475 476 477 478

		if (!skb)
			return origskb;
	}

J
Johannes Berg 已提交
479
	/* prepend radiotap information */
480 481
	ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom,
					 true);
482

483
	skb_reset_mac_header(skb);
484 485 486 487 488
	skb->ip_summed = CHECKSUM_UNNECESSARY;
	skb->pkt_type = PACKET_OTHERHOST;
	skb->protocol = htons(ETH_P_802_2);

	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
489
		if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
490 491
			continue;

492 493 494
		if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES)
			continue;

495
		if (!ieee80211_sdata_running(sdata))
496 497
			continue;

498 499 500 501
		if (prev_dev) {
			skb2 = skb_clone(skb, GFP_ATOMIC);
			if (skb2) {
				skb2->dev = prev_dev;
502
				netif_receive_skb(skb2);
503 504 505 506 507 508 509 510 511 512
			}
		}

		prev_dev = sdata->dev;
		sdata->dev->stats.rx_packets++;
		sdata->dev->stats.rx_bytes += skb->len;
	}

	if (prev_dev) {
		skb->dev = prev_dev;
513
		netif_receive_skb(skb);
514 515 516 517 518 519
	} else
		dev_kfree_skb(skb);

	return origskb;
}

520
static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
521
{
522
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
523
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
524
	int tid, seqno_idx, security_idx;
525 526

	/* does the frame have a qos control field? */
527 528
	if (ieee80211_is_data_qos(hdr->frame_control)) {
		u8 *qc = ieee80211_get_qos_ctl(hdr);
529
		/* frame has qos control */
530
		tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
531
		if (*qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT)
532
			status->rx_flags |= IEEE80211_RX_AMSDU;
533 534 535

		seqno_idx = tid;
		security_idx = tid;
536
	} else {
537 538 539 540 541 542 543 544 545 546 547
		/*
		 * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):
		 *
		 *	Sequence numbers for management frames, QoS data
		 *	frames with a broadcast/multicast address in the
		 *	Address 1 field, and all non-QoS data frames sent
		 *	by QoS STAs are assigned using an additional single
		 *	modulo-4096 counter, [...]
		 *
		 * We also use that counter for non-QoS STAs.
		 */
548
		seqno_idx = IEEE80211_NUM_TIDS;
549 550
		security_idx = 0;
		if (ieee80211_is_mgmt(hdr->frame_control))
551
			security_idx = IEEE80211_NUM_TIDS;
552
		tid = 0;
553
	}
554

555 556
	rx->seqno_idx = seqno_idx;
	rx->security_idx = security_idx;
557 558 559
	/* Set skb->priority to 1d tag if highest order bit of TID is not set.
	 * For now, set skb->priority to 0 for other cases. */
	rx->skb->priority = (tid > 7) ? 0 : tid;
560
}
561

562 563 564 565 566 567 568 569 570 571 572
/**
 * DOC: Packet alignment
 *
 * Drivers always need to pass packets that are aligned to two-byte boundaries
 * to the stack.
 *
 * Additionally, should, if possible, align the payload data in a way that
 * guarantees that the contained IP header is aligned to a four-byte
 * boundary. In the case of regular frames, this simply means aligning the
 * payload to a four-byte boundary (because either the IP header is directly
 * contained, or IV/RFC1042 headers that have a length divisible by four are
573 574 575
 * in front of it).  If the payload data is not properly aligned and the
 * architecture doesn't support efficient unaligned operations, mac80211
 * will align the data.
576 577 578 579 580 581 582
 *
 * With A-MSDU frames, however, the payload data address must yield two modulo
 * four because there are 14-byte 802.3 headers within the A-MSDU frames that
 * push the IP header further back to a multiple of four again. Thankfully, the
 * specs were sane enough this time around to require padding each A-MSDU
 * subframe to a length that is a multiple of four.
 *
L
Lucas De Marchi 已提交
583
 * Padding like Atheros hardware adds which is between the 802.11 header and
584 585 586 587
 * the payload is not supported, the driver is required to move the 802.11
 * header to be directly in front of the payload in that case.
 */
static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
588
{
589 590 591
#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
	WARN_ONCE((unsigned long)rx->skb->data & 1,
		  "unaligned packet at 0x%p\n", rx->skb->data);
592
#endif
593 594
}

595

596 597
/* rx handlers */

598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625
static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
{
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;

	if (skb->len < 24 || is_multicast_ether_addr(hdr->addr1))
		return 0;

	return ieee80211_is_robust_mgmt_frame(hdr);
}


static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb)
{
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;

	if (skb->len < 24 || !is_multicast_ether_addr(hdr->addr1))
		return 0;

	return ieee80211_is_robust_mgmt_frame(hdr);
}


/* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */
static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
{
	struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data;
	struct ieee80211_mmie *mmie;

J
Johannes Berg 已提交
626
	if (skb->len < 24 + sizeof(*mmie) || !is_multicast_ether_addr(hdr->da))
627 628 629 630 631 632 633 634 635 636 637 638 639 640
		return -1;

	if (!ieee80211_is_robust_mgmt_frame((struct ieee80211_hdr *) hdr))
		return -1; /* not a robust management frame */

	mmie = (struct ieee80211_mmie *)
		(skb->data + skb->len - sizeof(*mmie));
	if (mmie->element_id != WLAN_EID_MMIE ||
	    mmie->length != sizeof(*mmie) - 2)
		return -1;

	return le16_to_cpu(mmie->key_id);
}

641 642 643 644 645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660 661
static int iwl80211_get_cs_keyid(const struct ieee80211_cipher_scheme *cs,
				 struct sk_buff *skb)
{
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
	__le16 fc;
	int hdrlen;
	u8 keyid;

	fc = hdr->frame_control;
	hdrlen = ieee80211_hdrlen(fc);

	if (skb->len < hdrlen + cs->hdr_len)
		return -EINVAL;

	skb_copy_bits(skb, hdrlen + cs->key_idx_off, &keyid, 1);
	keyid &= cs->key_idx_mask;
	keyid >>= cs->key_idx_shift;

	return keyid;
}

J
Johannes Berg 已提交
662
static ieee80211_rx_result ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
663
{
664
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
665
	char *dev_addr = rx->sdata->vif.addr;
666

667
	if (ieee80211_is_data(hdr->frame_control)) {
668 669
		if (is_multicast_ether_addr(hdr->addr1)) {
			if (ieee80211_has_tods(hdr->frame_control) ||
J
Johannes Berg 已提交
670
			    !ieee80211_has_fromds(hdr->frame_control))
671
				return RX_DROP_MONITOR;
672
			if (ether_addr_equal(hdr->addr3, dev_addr))
673 674 675 676
				return RX_DROP_MONITOR;
		} else {
			if (!ieee80211_has_a4(hdr->frame_control))
				return RX_DROP_MONITOR;
677
			if (ether_addr_equal(hdr->addr4, dev_addr))
678 679
				return RX_DROP_MONITOR;
		}
680 681 682 683 684 685
	}

	/* If there is not an established peer link and this is not a peer link
	 * establisment frame, beacon or probe, drop the frame.
	 */

686
	if (!rx->sta || sta_plink_state(rx->sta) != NL80211_PLINK_ESTAB) {
687
		struct ieee80211_mgmt *mgmt;
688

689
		if (!ieee80211_is_mgmt(hdr->frame_control))
690 691
			return RX_DROP_MONITOR;

692
		if (ieee80211_is_action(hdr->frame_control)) {
693
			u8 category;
694 695 696 697 698

			/* make sure category field is present */
			if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE)
				return RX_DROP_MONITOR;

699
			mgmt = (struct ieee80211_mgmt *)hdr;
700 701
			category = mgmt->u.action.category;
			if (category != WLAN_CATEGORY_MESH_ACTION &&
J
Johannes Berg 已提交
702
			    category != WLAN_CATEGORY_SELF_PROTECTED)
703 704 705 706
				return RX_DROP_MONITOR;
			return RX_CONTINUE;
		}

707 708
		if (ieee80211_is_probe_req(hdr->frame_control) ||
		    ieee80211_is_probe_resp(hdr->frame_control) ||
709 710
		    ieee80211_is_beacon(hdr->frame_control) ||
		    ieee80211_is_auth(hdr->frame_control))
711 712 713 714 715
			return RX_CONTINUE;

		return RX_DROP_MONITOR;
	}

J
Johannes Berg 已提交
716 717
	return RX_CONTINUE;
}
718

719
static void ieee80211_release_reorder_frame(struct ieee80211_sub_if_data *sdata,
720
					    struct tid_ampdu_rx *tid_agg_rx,
721 722
					    int index,
					    struct sk_buff_head *frames)
723 724
{
	struct sk_buff *skb = tid_agg_rx->reorder_buf[index];
725
	struct ieee80211_rx_status *status;
726

727 728
	lockdep_assert_held(&tid_agg_rx->reorder_lock);

729 730 731
	if (!skb)
		goto no_frame;

732
	/* release the frame from the reorder ring buffer */
733 734
	tid_agg_rx->stored_mpdu_num--;
	tid_agg_rx->reorder_buf[index] = NULL;
735 736
	status = IEEE80211_SKB_RXCB(skb);
	status->rx_flags |= IEEE80211_RX_DEFERRED_RELEASE;
737
	__skb_queue_tail(frames, skb);
738 739

no_frame:
740
	tid_agg_rx->head_seq_num = ieee80211_sn_inc(tid_agg_rx->head_seq_num);
741 742
}

743
static void ieee80211_release_reorder_frames(struct ieee80211_sub_if_data *sdata,
744
					     struct tid_ampdu_rx *tid_agg_rx,
745 746
					     u16 head_seq_num,
					     struct sk_buff_head *frames)
747 748 749
{
	int index;

750 751
	lockdep_assert_held(&tid_agg_rx->reorder_lock);

752
	while (ieee80211_sn_less(tid_agg_rx->head_seq_num, head_seq_num)) {
753
		index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
754 755
		ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
						frames);
756 757 758 759 760 761 762 763 764
	}
}

/*
 * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If
 * the skb was added to the buffer longer than this time ago, the earlier
 * frames that have not yet been received are assumed to be lost and the skb
 * can be released for processing. This may also release other skb's from the
 * reorder buffer if there are no additional gaps between the frames.
765 766
 *
 * Callers must hold tid_agg_rx->reorder_lock.
767 768 769
 */
#define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)

770
static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata,
771 772
					  struct tid_ampdu_rx *tid_agg_rx,
					  struct sk_buff_head *frames)
773
{
774
	int index, j;
775

776 777
	lockdep_assert_held(&tid_agg_rx->reorder_lock);

778
	/* release the buffer until next missing frame */
779
	index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
780
	if (!tid_agg_rx->reorder_buf[index] &&
781
	    tid_agg_rx->stored_mpdu_num) {
782 783 784 785 786 787 788 789 790 791 792
		/*
		 * No buffers ready to be released, but check whether any
		 * frames in the reorder buffer have timed out.
		 */
		int skipped = 1;
		for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
		     j = (j + 1) % tid_agg_rx->buf_size) {
			if (!tid_agg_rx->reorder_buf[j]) {
				skipped++;
				continue;
			}
793 794
			if (skipped &&
			    !time_after(jiffies, tid_agg_rx->reorder_time[j] +
795
					HT_RX_REORDER_BUF_TIMEOUT))
796
				goto set_release_timer;
797

J
Johannes Berg 已提交
798 799
			ht_dbg_ratelimited(sdata,
					   "release an RX reorder frame due to timeout on earlier frames\n");
800 801
			ieee80211_release_reorder_frame(sdata, tid_agg_rx, j,
							frames);
802 803 804 805 806

			/*
			 * Increment the head seq# also for the skipped slots.
			 */
			tid_agg_rx->head_seq_num =
807 808
				(tid_agg_rx->head_seq_num +
				 skipped) & IEEE80211_SN_MASK;
809 810 811
			skipped = 0;
		}
	} else while (tid_agg_rx->reorder_buf[index]) {
812 813
		ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
						frames);
814
		index =	tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
815
	}
816 817

	if (tid_agg_rx->stored_mpdu_num) {
818
		j = index = tid_agg_rx->head_seq_num % tid_agg_rx->buf_size;
819 820 821 822 823 824 825 826 827 828

		for (; j != (index - 1) % tid_agg_rx->buf_size;
		     j = (j + 1) % tid_agg_rx->buf_size) {
			if (tid_agg_rx->reorder_buf[j])
				break;
		}

 set_release_timer:

		mod_timer(&tid_agg_rx->reorder_timer,
829
			  tid_agg_rx->reorder_time[j] + 1 +
830 831 832 833
			  HT_RX_REORDER_BUF_TIMEOUT);
	} else {
		del_timer(&tid_agg_rx->reorder_timer);
	}
834 835
}

836 837 838 839 840
/*
 * As this function belongs to the RX path it must be under
 * rcu_read_lock protection. It returns false if the frame
 * can be processed immediately, true if it was consumed.
 */
841
static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata,
842
					     struct tid_ampdu_rx *tid_agg_rx,
843 844
					     struct sk_buff *skb,
					     struct sk_buff_head *frames)
845 846 847 848 849 850
{
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
	u16 sc = le16_to_cpu(hdr->seq_ctrl);
	u16 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
	u16 head_seq_num, buf_size;
	int index;
851
	bool ret = true;
852

853 854
	spin_lock(&tid_agg_rx->reorder_lock);

855 856 857 858
	buf_size = tid_agg_rx->buf_size;
	head_seq_num = tid_agg_rx->head_seq_num;

	/* frame with out of date sequence number */
859
	if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) {
860
		dev_kfree_skb(skb);
861
		goto out;
862 863 864 865 866 867
	}

	/*
	 * If frame the sequence number exceeds our buffering window
	 * size release some previous frames to make room for this one.
	 */
868 869 870
	if (!ieee80211_sn_less(mpdu_seq_num, head_seq_num + buf_size)) {
		head_seq_num = ieee80211_sn_inc(
				ieee80211_sn_sub(mpdu_seq_num, buf_size));
871
		/* release stored frames up to new head to stack */
872
		ieee80211_release_reorder_frames(sdata, tid_agg_rx,
873
						 head_seq_num, frames);
874 875 876 877
	}

	/* Now the new frame is always in the range of the reordering buffer */

878
	index = mpdu_seq_num % tid_agg_rx->buf_size;
879 880 881 882

	/* check if we already stored this frame */
	if (tid_agg_rx->reorder_buf[index]) {
		dev_kfree_skb(skb);
883
		goto out;
884 885 886 887 888
	}

	/*
	 * If the current MPDU is in the right order and nothing else
	 * is stored we can process it directly, no need to buffer it.
889 890
	 * If it is first but there's something stored, we may be able
	 * to release frames after this one.
891 892 893
	 */
	if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
	    tid_agg_rx->stored_mpdu_num == 0) {
894 895
		tid_agg_rx->head_seq_num =
			ieee80211_sn_inc(tid_agg_rx->head_seq_num);
896 897
		ret = false;
		goto out;
898 899 900 901 902 903
	}

	/* put the frame in the reordering buffer */
	tid_agg_rx->reorder_buf[index] = skb;
	tid_agg_rx->reorder_time[index] = jiffies;
	tid_agg_rx->stored_mpdu_num++;
904
	ieee80211_sta_reorder_release(sdata, tid_agg_rx, frames);
905

906 907 908
 out:
	spin_unlock(&tid_agg_rx->reorder_lock);
	return ret;
909 910 911 912 913 914
}

/*
 * Reorder MPDUs from A-MPDUs, keeping them on a buffer. Returns
 * true if the MPDU was buffered, false if it should be processed.
 */
915 916
static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx,
				       struct sk_buff_head *frames)
917
{
918 919
	struct sk_buff *skb = rx->skb;
	struct ieee80211_local *local = rx->local;
920
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
921
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
922
	struct sta_info *sta = rx->sta;
923 924
	struct tid_ampdu_rx *tid_agg_rx;
	u16 sc;
925
	u8 tid, ack_policy;
926

927 928
	if (!ieee80211_is_data_qos(hdr->frame_control) ||
	    is_multicast_ether_addr(hdr->addr1))
929
		goto dont_reorder;
930 931 932 933 934 935 936

	/*
	 * filter the QoS data rx stream according to
	 * STA/TID and check if this STA/TID is on aggregation
	 */

	if (!sta)
937
		goto dont_reorder;
938

939 940
	ack_policy = *ieee80211_get_qos_ctl(hdr) &
		     IEEE80211_QOS_CTL_ACK_POLICY_MASK;
941 942
	tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;

943 944 945
	tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
	if (!tid_agg_rx)
		goto dont_reorder;
946 947 948

	/* qos null data frames are excluded */
	if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
949
		goto dont_reorder;
950

951 952 953 954 955
	/* not part of a BA session */
	if (ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK &&
	    ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_NORMAL)
		goto dont_reorder;

956 957 958 959
	/* not actually part of this BA session */
	if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
		goto dont_reorder;

960 961 962 963
	/* new, potentially un-ordered, ampdu frame - process it */

	/* reset session timer */
	if (tid_agg_rx->timeout)
964
		tid_agg_rx->last_rx = jiffies;
965 966 967 968

	/* if this mpdu is fragmented - terminate rx aggregation session */
	sc = le16_to_cpu(hdr->seq_ctrl);
	if (sc & IEEE80211_SCTL_FRAG) {
969
		skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
970 971
		skb_queue_tail(&rx->sdata->skb_queue, skb);
		ieee80211_queue_work(&local->hw, &rx->sdata->work);
972
		return;
973 974
	}

975 976 977 978 979 980 981
	/*
	 * No locking needed -- we will only ever process one
	 * RX packet at a time, and thus own tid_agg_rx. All
	 * other code manipulating it needs to (and does) make
	 * sure that we cannot get to it any more before doing
	 * anything with it.
	 */
982 983
	if (ieee80211_sta_manage_reorder_buf(rx->sdata, tid_agg_rx, skb,
					     frames))
984 985 986
		return;

 dont_reorder:
987
	__skb_queue_tail(frames, skb);
988
}
989

990
static ieee80211_rx_result debug_noinline
991
ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
992
{
993
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
994
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
995

996 997 998 999 1000 1001 1002 1003
	/*
	 * Drop duplicate 802.11 retransmissions
	 * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery")
	 */
	if (rx->skb->len >= 24 && rx->sta &&
	    !ieee80211_is_ctl(hdr->frame_control) &&
	    !ieee80211_is_qos_nullfunc(hdr->frame_control) &&
	    !is_multicast_ether_addr(hdr->addr1)) {
1004
		if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
1005
			     rx->sta->last_seq_ctrl[rx->seqno_idx] ==
1006
			     hdr->seq_ctrl)) {
1007
			if (status->rx_flags & IEEE80211_RX_RA_MATCH) {
1008 1009 1010
				rx->local->dot11FrameDuplicateCount++;
				rx->sta->num_duplicates++;
			}
1011
			return RX_DROP_UNUSABLE;
1012
		} else if (!(status->flag & RX_FLAG_AMSDU_MORE)) {
1013
			rx->sta->last_seq_ctrl[rx->seqno_idx] = hdr->seq_ctrl;
1014
		}
1015 1016 1017 1018
	}

	if (unlikely(rx->skb->len < 16)) {
		I802_DEBUG_INC(rx->local->rx_handlers_drop_short);
J
Johannes Berg 已提交
1019
		return RX_DROP_MONITOR;
1020 1021 1022 1023 1024
	}

	/* Drop disallowed frame classes based on STA auth/assoc state;
	 * IEEE 802.11, Chap 5.5.
	 *
J
Johannes Berg 已提交
1025 1026
	 * mac80211 filters only based on association state, i.e. it drops
	 * Class 3 frames from not associated stations. hostapd sends
1027 1028 1029
	 * deauth/disassoc frames when needed. In addition, hostapd is
	 * responsible for filtering on both auth and assoc states.
	 */
1030

J
Johannes Berg 已提交
1031
	if (ieee80211_vif_is_mesh(&rx->sdata->vif))
1032 1033
		return ieee80211_rx_mesh_check(rx);

1034 1035
	if (unlikely((ieee80211_is_data(hdr->frame_control) ||
		      ieee80211_is_pspoll(hdr->frame_control)) &&
1036
		     rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
B
Bill Jordan 已提交
1037
		     rx->sdata->vif.type != NL80211_IFTYPE_WDS &&
J
Johannes Berg 已提交
1038
		     (!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_ASSOC)))) {
1039 1040 1041 1042 1043 1044
		/*
		 * accept port control frames from the AP even when it's not
		 * yet marked ASSOC to prevent a race where we don't set the
		 * assoc bit quickly enough before it sends the first frame
		 */
		if (rx->sta && rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
1045
		    ieee80211_is_data_present(hdr->frame_control)) {
1046 1047 1048 1049 1050 1051 1052 1053 1054 1055
			unsigned int hdrlen;
			__be16 ethertype;

			hdrlen = ieee80211_hdrlen(hdr->frame_control);

			if (rx->skb->len < hdrlen + 8)
				return RX_DROP_MONITOR;

			skb_copy_bits(rx->skb, hdrlen + 6, &ethertype, 2);
			if (ethertype == rx->sdata->control_port_protocol)
1056 1057
				return RX_CONTINUE;
		}
1058 1059 1060 1061 1062 1063 1064

		if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
		    cfg80211_rx_spurious_frame(rx->sdata->dev,
					       hdr->addr2,
					       GFP_ATOMIC))
			return RX_DROP_UNUSABLE;

J
Johannes Berg 已提交
1065
		return RX_DROP_MONITOR;
1066
	}
1067

1068
	return RX_CONTINUE;
1069 1070 1071
}


1072 1073 1074 1075 1076 1077 1078 1079 1080 1081 1082 1083 1084 1085 1086 1087 1088 1089 1090 1091 1092 1093 1094 1095 1096 1097 1098 1099 1100 1101 1102 1103 1104
static ieee80211_rx_result debug_noinline
ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx)
{
	struct ieee80211_local *local;
	struct ieee80211_hdr *hdr;
	struct sk_buff *skb;

	local = rx->local;
	skb = rx->skb;
	hdr = (struct ieee80211_hdr *) skb->data;

	if (!local->pspolling)
		return RX_CONTINUE;

	if (!ieee80211_has_fromds(hdr->frame_control))
		/* this is not from AP */
		return RX_CONTINUE;

	if (!ieee80211_is_data(hdr->frame_control))
		return RX_CONTINUE;

	if (!ieee80211_has_moredata(hdr->frame_control)) {
		/* AP has no more frames buffered for us */
		local->pspolling = false;
		return RX_CONTINUE;
	}

	/* more data bit is set, let's request a new frame from the AP */
	ieee80211_send_pspoll(local, rx->sdata);

	return RX_CONTINUE;
}

1105
static void sta_ps_start(struct sta_info *sta)
1106
{
1107
	struct ieee80211_sub_if_data *sdata = sta->sdata;
1108
	struct ieee80211_local *local = sdata->local;
1109
	struct ps_data *ps;
1110

1111 1112 1113 1114 1115 1116 1117
	if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
	    sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
		ps = &sdata->bss->ps;
	else
		return;

	atomic_inc(&ps->num_sta_ps);
J
Johannes Berg 已提交
1118
	set_sta_flag(sta, WLAN_STA_PS_STA);
1119 1120
	if (!(local->hw.flags & IEEE80211_HW_AP_LINK_PS))
		drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta);
J
Johannes Berg 已提交
1121 1122
	ps_dbg(sdata, "STA %pM aid %d enters power save mode\n",
	       sta->sta.addr, sta->sta.aid);
1123 1124
}

1125
static void sta_ps_end(struct sta_info *sta)
1126
{
J
Johannes Berg 已提交
1127 1128
	ps_dbg(sta->sdata, "STA %pM aid %d exits power save mode\n",
	       sta->sta.addr, sta->sta.aid);
1129

J
Johannes Berg 已提交
1130
	if (test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
J
Johannes Berg 已提交
1131 1132
		ps_dbg(sta->sdata, "STA %pM aid %d driver-ps-blocked\n",
		       sta->sta.addr, sta->sta.aid);
1133 1134 1135 1136
		return;
	}

	ieee80211_sta_ps_deliver_wakeup(sta);
1137 1138
}

1139 1140 1141 1142 1143 1144 1145 1146
int ieee80211_sta_ps_transition(struct ieee80211_sta *sta, bool start)
{
	struct sta_info *sta_inf = container_of(sta, struct sta_info, sta);
	bool in_ps;

	WARN_ON(!(sta_inf->local->hw.flags & IEEE80211_HW_AP_LINK_PS));

	/* Don't let the same PS state be set twice */
J
Johannes Berg 已提交
1147
	in_ps = test_sta_flag(sta_inf, WLAN_STA_PS_STA);
1148 1149 1150 1151
	if ((start && in_ps) || (!start && !in_ps))
		return -EINVAL;

	if (start)
1152
		sta_ps_start(sta_inf);
1153
	else
1154
		sta_ps_end(sta_inf);
1155 1156 1157 1158 1159

	return 0;
}
EXPORT_SYMBOL(ieee80211_sta_ps_transition);

J
Johannes Berg 已提交
1160 1161 1162 1163 1164 1165 1166 1167 1168 1169 1170 1171 1172 1173 1174 1175 1176 1177 1178 1179 1180 1181 1182 1183 1184 1185 1186 1187
static ieee80211_rx_result debug_noinline
ieee80211_rx_h_uapsd_and_pspoll(struct ieee80211_rx_data *rx)
{
	struct ieee80211_sub_if_data *sdata = rx->sdata;
	struct ieee80211_hdr *hdr = (void *)rx->skb->data;
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
	int tid, ac;

	if (!rx->sta || !(status->rx_flags & IEEE80211_RX_RA_MATCH))
		return RX_CONTINUE;

	if (sdata->vif.type != NL80211_IFTYPE_AP &&
	    sdata->vif.type != NL80211_IFTYPE_AP_VLAN)
		return RX_CONTINUE;

	/*
	 * The device handles station powersave, so don't do anything about
	 * uAPSD and PS-Poll frames (the latter shouldn't even come up from
	 * it to mac80211 since they're handled.)
	 */
	if (sdata->local->hw.flags & IEEE80211_HW_AP_LINK_PS)
		return RX_CONTINUE;

	/*
	 * Don't do anything if the station isn't already asleep. In
	 * the uAPSD case, the station will probably be marked asleep,
	 * in the PS-Poll case the station must be confused ...
	 */
J
Johannes Berg 已提交
1188
	if (!test_sta_flag(rx->sta, WLAN_STA_PS_STA))
J
Johannes Berg 已提交
1189 1190 1191
		return RX_CONTINUE;

	if (unlikely(ieee80211_is_pspoll(hdr->frame_control))) {
J
Johannes Berg 已提交
1192 1193
		if (!test_sta_flag(rx->sta, WLAN_STA_SP)) {
			if (!test_sta_flag(rx->sta, WLAN_STA_PS_DRIVER))
1194 1195
				ieee80211_sta_ps_deliver_poll_response(rx->sta);
			else
J
Johannes Berg 已提交
1196
				set_sta_flag(rx->sta, WLAN_STA_PSPOLL);
1197
		}
J
Johannes Berg 已提交
1198 1199 1200 1201 1202 1203 1204 1205 1206 1207 1208 1209 1210 1211 1212 1213 1214 1215 1216 1217 1218 1219 1220 1221 1222

		/* Free PS Poll skb here instead of returning RX_DROP that would
		 * count as an dropped frame. */
		dev_kfree_skb(rx->skb);

		return RX_QUEUED;
	} else if (!ieee80211_has_morefrags(hdr->frame_control) &&
		   !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
		   ieee80211_has_pm(hdr->frame_control) &&
		   (ieee80211_is_data_qos(hdr->frame_control) ||
		    ieee80211_is_qos_nullfunc(hdr->frame_control))) {
		tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
		ac = ieee802_1d_to_ac[tid & 7];

		/*
		 * If this AC is not trigger-enabled do nothing.
		 *
		 * NB: This could/should check a separate bitmap of trigger-
		 * enabled queues, but for now we only implement uAPSD w/o
		 * TSPEC changes to the ACs, so they're always the same.
		 */
		if (!(rx->sta->sta.uapsd_queues & BIT(ac)))
			return RX_CONTINUE;

		/* if we are in a service period, do nothing */
J
Johannes Berg 已提交
1223
		if (test_sta_flag(rx->sta, WLAN_STA_SP))
J
Johannes Berg 已提交
1224 1225
			return RX_CONTINUE;

J
Johannes Berg 已提交
1226
		if (!test_sta_flag(rx->sta, WLAN_STA_PS_DRIVER))
J
Johannes Berg 已提交
1227 1228
			ieee80211_sta_ps_deliver_uapsd(rx->sta);
		else
J
Johannes Berg 已提交
1229
			set_sta_flag(rx->sta, WLAN_STA_UAPSD);
J
Johannes Berg 已提交
1230 1231 1232 1233 1234
	}

	return RX_CONTINUE;
}

1235
static ieee80211_rx_result debug_noinline
1236
ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
1237 1238
{
	struct sta_info *sta = rx->sta;
J
Johannes Berg 已提交
1239 1240 1241
	struct sk_buff *skb = rx->skb;
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1242
	int i;
1243 1244

	if (!sta)
1245
		return RX_CONTINUE;
1246

J
Johannes Berg 已提交
1247 1248
	/*
	 * Update last_rx only for IBSS packets which are for the current
1249 1250 1251 1252 1253
	 * BSSID and for station already AUTHORIZED to avoid keeping the
	 * current IBSS network alive in cases where other STAs start
	 * using different BSSID. This will also give the station another
	 * chance to restart the authentication/authorization in case
	 * something went wrong the first time.
J
Johannes Berg 已提交
1254
	 */
1255
	if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
1256
		u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
1257
						NL80211_IFTYPE_ADHOC);
1258 1259
		if (ether_addr_equal(bssid, rx->sdata->u.ibss.bssid) &&
		    test_sta_flag(sta, WLAN_STA_AUTHORIZED)) {
1260
			sta->last_rx = jiffies;
1261 1262 1263
			if (ieee80211_is_data(hdr->frame_control)) {
				sta->last_rx_rate_idx = status->rate_idx;
				sta->last_rx_rate_flag = status->flag;
1264
				sta->last_rx_rate_vht_nss = status->vht_nss;
1265 1266
			}
		}
J
Johannes Berg 已提交
1267 1268
	} else if (!is_multicast_ether_addr(hdr->addr1)) {
		/*
1269 1270
		 * Mesh beacons will update last_rx when if they are found to
		 * match the current local configuration when processed.
1271
		 */
J
Johannes Berg 已提交
1272
		sta->last_rx = jiffies;
1273 1274 1275
		if (ieee80211_is_data(hdr->frame_control)) {
			sta->last_rx_rate_idx = status->rate_idx;
			sta->last_rx_rate_flag = status->flag;
1276
			sta->last_rx_rate_vht_nss = status->vht_nss;
1277
		}
1278 1279
	}

1280
	if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
1281
		return RX_CONTINUE;
1282

1283 1284 1285
	if (rx->sdata->vif.type == NL80211_IFTYPE_STATION)
		ieee80211_sta_rx_notify(rx->sdata, hdr);

1286 1287
	sta->rx_fragments++;
	sta->rx_bytes += rx->skb->len;
1288 1289 1290 1291
	if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
		sta->last_signal = status->signal;
		ewma_add(&sta->avg_signal, -status->signal);
	}
1292

1293 1294 1295 1296 1297 1298 1299 1300 1301 1302 1303 1304 1305
	if (status->chains) {
		sta->chains = status->chains;
		for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {
			int signal = status->chain_signal[i];

			if (!(status->chains & BIT(i)))
				continue;

			sta->chain_signal_last[i] = signal;
			ewma_add(&sta->chain_signal_avg[i], -signal);
		}
	}

1306 1307 1308 1309
	/*
	 * Change STA power saving mode only at the end of a frame
	 * exchange sequence.
	 */
1310 1311
	if (!(sta->local->hw.flags & IEEE80211_HW_AP_LINK_PS) &&
	    !ieee80211_has_morefrags(hdr->frame_control) &&
1312
	    !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
1313 1314
	    (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
	     rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
J
Johannes Berg 已提交
1315
		if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
1316 1317 1318 1319 1320 1321 1322 1323 1324 1325
			/*
			 * Ignore doze->wake transitions that are
			 * indicated by non-data frames, the standard
			 * is unclear here, but for example going to
			 * PS mode and then scanning would cause a
			 * doze->wake transition for the probe request,
			 * and that is clearly undesirable.
			 */
			if (ieee80211_is_data(hdr->frame_control) &&
			    !ieee80211_has_pm(hdr->frame_control))
1326
				sta_ps_end(sta);
1327 1328
		} else {
			if (ieee80211_has_pm(hdr->frame_control))
1329
				sta_ps_start(sta);
1330
		}
1331 1332
	}

M
Marco Porsch 已提交
1333 1334 1335 1336
	/* mesh power save support */
	if (ieee80211_vif_is_mesh(&rx->sdata->vif))
		ieee80211_mps_rx_h_sta_process(sta, hdr);

1337 1338 1339 1340 1341 1342
	/*
	 * Drop (qos-)data::nullfunc frames silently, since they
	 * are used only to control station power saving mode.
	 */
	if (ieee80211_is_nullfunc(hdr->frame_control) ||
	    ieee80211_is_qos_nullfunc(hdr->frame_control)) {
1343
		I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
1344 1345 1346

		/*
		 * If we receive a 4-addr nullfunc frame from a STA
1347 1348 1349
		 * that was not moved to a 4-addr STA vlan yet send
		 * the event to userspace and for older hostapd drop
		 * the frame to the monitor interface.
1350 1351 1352 1353
		 */
		if (ieee80211_has_a4(hdr->frame_control) &&
		    (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
		     (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1354 1355 1356 1357 1358
		      !rx->sdata->u.vlan.sta))) {
			if (!test_and_set_sta_flag(sta, WLAN_STA_4ADDR_EVENT))
				cfg80211_rx_unexpected_4addr_frame(
					rx->sdata->dev, sta->sta.addr,
					GFP_ATOMIC);
1359
			return RX_DROP_MONITOR;
1360
		}
1361 1362 1363 1364
		/*
		 * Update counter and free packet here to avoid
		 * counting this as a dropped packed.
		 */
1365 1366
		sta->rx_packets++;
		dev_kfree_skb(rx->skb);
1367
		return RX_QUEUED;
1368 1369
	}

1370
	return RX_CONTINUE;
1371 1372
} /* ieee80211_rx_h_sta_process */

1373 1374 1375 1376 1377 1378 1379 1380 1381 1382 1383 1384
static ieee80211_rx_result debug_noinline
ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
{
	struct sk_buff *skb = rx->skb;
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
	int keyidx;
	int hdrlen;
	ieee80211_rx_result result = RX_DROP_UNUSABLE;
	struct ieee80211_key *sta_ptk = NULL;
	int mmie_keyidx = -1;
	__le16 fc;
1385
	const struct ieee80211_cipher_scheme *cs = NULL;
1386 1387 1388 1389 1390 1391 1392 1393 1394 1395 1396 1397 1398 1399 1400 1401 1402 1403 1404 1405 1406 1407 1408 1409 1410 1411 1412 1413 1414 1415 1416 1417 1418 1419 1420 1421 1422

	/*
	 * Key selection 101
	 *
	 * There are four types of keys:
	 *  - GTK (group keys)
	 *  - IGTK (group keys for management frames)
	 *  - PTK (pairwise keys)
	 *  - STK (station-to-station pairwise keys)
	 *
	 * When selecting a key, we have to distinguish between multicast
	 * (including broadcast) and unicast frames, the latter can only
	 * use PTKs and STKs while the former always use GTKs and IGTKs.
	 * Unless, of course, actual WEP keys ("pre-RSNA") are used, then
	 * unicast frames can also use key indices like GTKs. Hence, if we
	 * don't have a PTK/STK we check the key index for a WEP key.
	 *
	 * Note that in a regular BSS, multicast frames are sent by the
	 * AP only, associated stations unicast the frame to the AP first
	 * which then multicasts it on their behalf.
	 *
	 * There is also a slight problem in IBSS mode: GTKs are negotiated
	 * with each station, that is something we don't currently handle.
	 * The spec seems to expect that one negotiates the same key with
	 * every station but there's no such requirement; VLANs could be
	 * possible.
	 */

	/*
	 * No point in finding a key and decrypting if the frame is neither
	 * addressed to us nor a multicast frame.
	 */
	if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
		return RX_CONTINUE;

	/* start without a key */
	rx->key = NULL;
1423
	fc = hdr->frame_control;
1424

1425 1426
	if (rx->sta) {
		int keyid = rx->sta->ptk_idx;
1427

1428 1429 1430 1431 1432 1433 1434 1435
		if (ieee80211_has_protected(fc) && rx->sta->cipher_scheme) {
			cs = rx->sta->cipher_scheme;
			keyid = iwl80211_get_cs_keyid(cs, rx->skb);
			if (unlikely(keyid < 0))
				return RX_DROP_UNUSABLE;
		}
		sta_ptk = rcu_dereference(rx->sta->ptk[keyid]);
	}
1436 1437 1438 1439 1440 1441 1442 1443 1444 1445 1446 1447 1448 1449 1450 1451 1452 1453 1454 1455 1456 1457 1458 1459 1460 1461 1462 1463 1464 1465 1466 1467 1468 1469 1470 1471 1472 1473 1474 1475 1476 1477 1478 1479 1480 1481 1482 1483 1484 1485 1486 1487 1488 1489 1490 1491 1492 1493 1494 1495 1496

	if (!ieee80211_has_protected(fc))
		mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);

	if (!is_multicast_ether_addr(hdr->addr1) && sta_ptk) {
		rx->key = sta_ptk;
		if ((status->flag & RX_FLAG_DECRYPTED) &&
		    (status->flag & RX_FLAG_IV_STRIPPED))
			return RX_CONTINUE;
		/* Skip decryption if the frame is not protected. */
		if (!ieee80211_has_protected(fc))
			return RX_CONTINUE;
	} else if (mmie_keyidx >= 0) {
		/* Broadcast/multicast robust management frame / BIP */
		if ((status->flag & RX_FLAG_DECRYPTED) &&
		    (status->flag & RX_FLAG_IV_STRIPPED))
			return RX_CONTINUE;

		if (mmie_keyidx < NUM_DEFAULT_KEYS ||
		    mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
			return RX_DROP_MONITOR; /* unexpected BIP keyidx */
		if (rx->sta)
			rx->key = rcu_dereference(rx->sta->gtk[mmie_keyidx]);
		if (!rx->key)
			rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]);
	} else if (!ieee80211_has_protected(fc)) {
		/*
		 * The frame was not protected, so skip decryption. However, we
		 * need to set rx->key if there is a key that could have been
		 * used so that the frame may be dropped if encryption would
		 * have been expected.
		 */
		struct ieee80211_key *key = NULL;
		struct ieee80211_sub_if_data *sdata = rx->sdata;
		int i;

		if (ieee80211_is_mgmt(fc) &&
		    is_multicast_ether_addr(hdr->addr1) &&
		    (key = rcu_dereference(rx->sdata->default_mgmt_key)))
			rx->key = key;
		else {
			if (rx->sta) {
				for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
					key = rcu_dereference(rx->sta->gtk[i]);
					if (key)
						break;
				}
			}
			if (!key) {
				for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
					key = rcu_dereference(sdata->keys[i]);
					if (key)
						break;
				}
			}
			if (key)
				rx->key = key;
		}
		return RX_CONTINUE;
	} else {
		u8 keyid;
1497

1498 1499 1500 1501 1502 1503 1504 1505 1506 1507 1508 1509 1510 1511 1512
		/*
		 * The device doesn't give us the IV so we won't be
		 * able to look up the key. That's ok though, we
		 * don't need to decrypt the frame, we just won't
		 * be able to keep statistics accurate.
		 * Except for key threshold notifications, should
		 * we somehow allow the driver to tell us which key
		 * the hardware used if this flag is set?
		 */
		if ((status->flag & RX_FLAG_DECRYPTED) &&
		    (status->flag & RX_FLAG_IV_STRIPPED))
			return RX_CONTINUE;

		hdrlen = ieee80211_hdrlen(fc);

1513 1514
		if (cs) {
			keyidx = iwl80211_get_cs_keyid(cs, rx->skb);
1515

1516 1517 1518 1519 1520 1521 1522 1523 1524 1525 1526 1527
			if (unlikely(keyidx < 0))
				return RX_DROP_UNUSABLE;
		} else {
			if (rx->skb->len < 8 + hdrlen)
				return RX_DROP_UNUSABLE; /* TODO: count this? */
			/*
			 * no need to call ieee80211_wep_get_keyidx,
			 * it verifies a bunch of things we've done already
			 */
			skb_copy_bits(rx->skb, hdrlen + 3, &keyid, 1);
			keyidx = keyid >> 6;
		}
1528 1529 1530 1531 1532 1533 1534 1535 1536 1537 1538 1539 1540 1541 1542 1543 1544 1545 1546 1547 1548 1549 1550 1551 1552 1553 1554 1555 1556 1557 1558 1559 1560 1561 1562 1563 1564 1565 1566 1567 1568 1569 1570 1571 1572 1573 1574

		/* check per-station GTK first, if multicast packet */
		if (is_multicast_ether_addr(hdr->addr1) && rx->sta)
			rx->key = rcu_dereference(rx->sta->gtk[keyidx]);

		/* if not found, try default key */
		if (!rx->key) {
			rx->key = rcu_dereference(rx->sdata->keys[keyidx]);

			/*
			 * RSNA-protected unicast frames should always be
			 * sent with pairwise or station-to-station keys,
			 * but for WEP we allow using a key index as well.
			 */
			if (rx->key &&
			    rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 &&
			    rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 &&
			    !is_multicast_ether_addr(hdr->addr1))
				rx->key = NULL;
		}
	}

	if (rx->key) {
		if (unlikely(rx->key->flags & KEY_FLAG_TAINTED))
			return RX_DROP_MONITOR;

		rx->key->tx_rx_count++;
		/* TODO: add threshold stuff again */
	} else {
		return RX_DROP_MONITOR;
	}

	switch (rx->key->conf.cipher) {
	case WLAN_CIPHER_SUITE_WEP40:
	case WLAN_CIPHER_SUITE_WEP104:
		result = ieee80211_crypto_wep_decrypt(rx);
		break;
	case WLAN_CIPHER_SUITE_TKIP:
		result = ieee80211_crypto_tkip_decrypt(rx);
		break;
	case WLAN_CIPHER_SUITE_CCMP:
		result = ieee80211_crypto_ccmp_decrypt(rx);
		break;
	case WLAN_CIPHER_SUITE_AES_CMAC:
		result = ieee80211_crypto_aes_cmac_decrypt(rx);
		break;
	default:
1575
		result = ieee80211_crypto_hw_decrypt(rx);
1576 1577 1578 1579 1580 1581 1582 1583 1584 1585
	}

	/* the hdr variable is invalid after the decrypt handlers */

	/* either the frame has been decrypted or will be dropped */
	status->flag |= RX_FLAG_DECRYPTED;

	return result;
}

1586 1587 1588 1589 1590 1591 1592 1593 1594 1595 1596
static inline struct ieee80211_fragment_entry *
ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
			 unsigned int frag, unsigned int seq, int rx_queue,
			 struct sk_buff **skb)
{
	struct ieee80211_fragment_entry *entry;

	entry = &sdata->fragments[sdata->fragment_next++];
	if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
		sdata->fragment_next = 0;

J
Johannes Berg 已提交
1597
	if (!skb_queue_empty(&entry->skb_list))
1598 1599 1600 1601 1602 1603 1604 1605 1606 1607 1608 1609 1610 1611 1612 1613
		__skb_queue_purge(&entry->skb_list);

	__skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
	*skb = NULL;
	entry->first_frag_time = jiffies;
	entry->seq = seq;
	entry->rx_queue = rx_queue;
	entry->last_frag = frag;
	entry->ccmp = 0;
	entry->extra_len = 0;

	return entry;
}

static inline struct ieee80211_fragment_entry *
ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
1614
			  unsigned int frag, unsigned int seq,
1615 1616 1617 1618 1619 1620 1621 1622 1623 1624 1625 1626 1627 1628 1629 1630 1631 1632 1633
			  int rx_queue, struct ieee80211_hdr *hdr)
{
	struct ieee80211_fragment_entry *entry;
	int i, idx;

	idx = sdata->fragment_next;
	for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
		struct ieee80211_hdr *f_hdr;

		idx--;
		if (idx < 0)
			idx = IEEE80211_FRAGMENT_MAX - 1;

		entry = &sdata->fragments[idx];
		if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
		    entry->rx_queue != rx_queue ||
		    entry->last_frag + 1 != frag)
			continue;

1634
		f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data;
1635

1636 1637 1638 1639 1640
		/*
		 * Check ftype and addresses are equal, else check next fragment
		 */
		if (((hdr->frame_control ^ f_hdr->frame_control) &
		     cpu_to_le16(IEEE80211_FCTL_FTYPE)) ||
1641 1642
		    !ether_addr_equal(hdr->addr1, f_hdr->addr1) ||
		    !ether_addr_equal(hdr->addr2, f_hdr->addr2))
1643 1644
			continue;

1645
		if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
1646 1647 1648 1649 1650 1651 1652 1653 1654
			__skb_queue_purge(&entry->skb_list);
			continue;
		}
		return entry;
	}

	return NULL;
}

1655
static ieee80211_rx_result debug_noinline
1656
ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
1657 1658 1659
{
	struct ieee80211_hdr *hdr;
	u16 sc;
1660
	__le16 fc;
1661 1662 1663
	unsigned int frag, seq;
	struct ieee80211_fragment_entry *entry;
	struct sk_buff *skb;
1664
	struct ieee80211_rx_status *status;
1665

1666
	hdr = (struct ieee80211_hdr *)rx->skb->data;
1667
	fc = hdr->frame_control;
1668 1669 1670 1671

	if (ieee80211_is_ctl(fc))
		return RX_CONTINUE;

1672 1673 1674
	sc = le16_to_cpu(hdr->seq_ctrl);
	frag = sc & IEEE80211_SCTL_FRAG;

1675
	if (likely((!ieee80211_has_morefrags(fc) && frag == 0) ||
1676 1677 1678 1679 1680 1681
		   is_multicast_ether_addr(hdr->addr1))) {
		/* not fragmented */
		goto out;
	}
	I802_DEBUG_INC(rx->local->rx_handlers_fragments);

Z
Zhu Yi 已提交
1682 1683 1684
	if (skb_linearize(rx->skb))
		return RX_DROP_UNUSABLE;

1685 1686 1687 1688 1689 1690
	/*
	 *  skb_linearize() might change the skb->data and
	 *  previously cached variables (in this case, hdr) need to
	 *  be refreshed with the new data.
	 */
	hdr = (struct ieee80211_hdr *)rx->skb->data;
1691 1692 1693 1694 1695
	seq = (sc & IEEE80211_SCTL_SEQ) >> 4;

	if (frag == 0) {
		/* This is the first fragment of a new frame. */
		entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
1696
						 rx->seqno_idx, &(rx->skb));
1697
		if (rx->key && rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP &&
1698
		    ieee80211_has_protected(fc)) {
1699
			int queue = rx->security_idx;
1700 1701 1702 1703
			/* Store CCMP PN so that we can verify that the next
			 * fragment has a sequential PN value. */
			entry->ccmp = 1;
			memcpy(entry->last_pn,
1704
			       rx->key->u.ccmp.rx_pn[queue],
1705
			       IEEE80211_CCMP_PN_LEN);
1706
		}
1707
		return RX_QUEUED;
1708 1709 1710 1711 1712
	}

	/* This is a fragment for a frame that should already be pending in
	 * fragment cache. Add this fragment to the end of the pending entry.
	 */
1713 1714
	entry = ieee80211_reassemble_find(rx->sdata, frag, seq,
					  rx->seqno_idx, hdr);
1715 1716
	if (!entry) {
		I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
J
Johannes Berg 已提交
1717
		return RX_DROP_MONITOR;
1718 1719 1720 1721 1722 1723
	}

	/* Verify that MPDUs within one MSDU have sequential PN values.
	 * (IEEE 802.11i, 8.3.3.4.5) */
	if (entry->ccmp) {
		int i;
1724
		u8 pn[IEEE80211_CCMP_PN_LEN], *rpn;
1725
		int queue;
1726
		if (!rx->key || rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP)
J
Johannes Berg 已提交
1727
			return RX_DROP_UNUSABLE;
1728 1729
		memcpy(pn, entry->last_pn, IEEE80211_CCMP_PN_LEN);
		for (i = IEEE80211_CCMP_PN_LEN - 1; i >= 0; i--) {
1730 1731 1732 1733
			pn[i]++;
			if (pn[i])
				break;
		}
1734
		queue = rx->security_idx;
1735
		rpn = rx->key->u.ccmp.rx_pn[queue];
1736
		if (memcmp(pn, rpn, IEEE80211_CCMP_PN_LEN))
J
Johannes Berg 已提交
1737
			return RX_DROP_UNUSABLE;
1738
		memcpy(entry->last_pn, pn, IEEE80211_CCMP_PN_LEN);
1739 1740
	}

1741
	skb_pull(rx->skb, ieee80211_hdrlen(fc));
1742 1743 1744
	__skb_queue_tail(&entry->skb_list, rx->skb);
	entry->last_frag = frag;
	entry->extra_len += rx->skb->len;
1745
	if (ieee80211_has_morefrags(fc)) {
1746
		rx->skb = NULL;
1747
		return RX_QUEUED;
1748 1749 1750 1751 1752 1753 1754 1755 1756
	}

	rx->skb = __skb_dequeue(&entry->skb_list);
	if (skb_tailroom(rx->skb) < entry->extra_len) {
		I802_DEBUG_INC(rx->local->rx_expand_skb_head2);
		if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
					      GFP_ATOMIC))) {
			I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
			__skb_queue_purge(&entry->skb_list);
J
Johannes Berg 已提交
1757
			return RX_DROP_UNUSABLE;
1758 1759 1760 1761 1762 1763 1764 1765
		}
	}
	while ((skb = __skb_dequeue(&entry->skb_list))) {
		memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len);
		dev_kfree_skb(skb);
	}

	/* Complete frame has been reassembled - process it now */
1766 1767
	status = IEEE80211_SKB_RXCB(rx->skb);
	status->rx_flags |= IEEE80211_RX_FRAGMENTED;
1768 1769 1770 1771 1772 1773 1774 1775

 out:
	if (rx->sta)
		rx->sta->rx_packets++;
	if (is_multicast_ether_addr(hdr->addr1))
		rx->local->dot11MulticastReceivedFrameCount++;
	else
		ieee80211_led_rx(rx->local);
1776
	return RX_CONTINUE;
1777 1778
}

J
Johannes Berg 已提交
1779
static int ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
1780
{
J
Johannes Berg 已提交
1781
	if (unlikely(!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_AUTHORIZED)))
1782
		return -EACCES;
1783

1784
	return 0;
1785 1786
}

J
Johannes Berg 已提交
1787
static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
1788
{
J
Johannes Berg 已提交
1789 1790 1791
	struct sk_buff *skb = rx->skb;
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);

1792
	/*
1793 1794
	 * Pass through unencrypted frames if the hardware has
	 * decrypted them already.
1795
	 */
J
Johannes Berg 已提交
1796
	if (status->flag & RX_FLAG_DECRYPTED)
1797
		return 0;
1798 1799

	/* Drop unencrypted frames if key is set. */
1800 1801
	if (unlikely(!ieee80211_has_protected(fc) &&
		     !ieee80211_is_nullfunc(fc) &&
1802
		     ieee80211_is_data(fc) &&
1803
		     (rx->key || rx->sdata->drop_unencrypted)))
1804
		return -EACCES;
1805 1806 1807 1808

	return 0;
}

J
Johannes Berg 已提交
1809
static int ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)
1810 1811
{
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1812
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1813 1814
	__le16 fc = hdr->frame_control;

1815 1816 1817 1818 1819 1820
	/*
	 * Pass through unencrypted frames if the hardware has
	 * decrypted them already.
	 */
	if (status->flag & RX_FLAG_DECRYPTED)
		return 0;
1821

J
Johannes Berg 已提交
1822
	if (rx->sta && test_sta_flag(rx->sta, WLAN_STA_MFP)) {
1823 1824
		if (unlikely(!ieee80211_has_protected(fc) &&
			     ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
1825
			     rx->key)) {
1826 1827 1828 1829 1830
			if (ieee80211_is_deauth(fc) ||
			    ieee80211_is_disassoc(fc))
				cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
							     rx->skb->data,
							     rx->skb->len);
1831
			return -EACCES;
1832
		}
1833
		/* BIP does not use Protected field, so need to check MMIE */
1834
		if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
1835
			     ieee80211_get_mmie_keyidx(rx->skb) < 0)) {
1836 1837 1838 1839 1840
			if (ieee80211_is_deauth(fc) ||
			    ieee80211_is_disassoc(fc))
				cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
							     rx->skb->data,
							     rx->skb->len);
1841
			return -EACCES;
1842
		}
1843 1844 1845 1846 1847 1848 1849 1850 1851
		/*
		 * When using MFP, Action frames are not allowed prior to
		 * having configured keys.
		 */
		if (unlikely(ieee80211_is_action(fc) && !rx->key &&
			     ieee80211_is_robust_mgmt_frame(
				     (struct ieee80211_hdr *) rx->skb->data)))
			return -EACCES;
	}
1852

1853
	return 0;
1854 1855
}

1856
static int
1857
__ieee80211_data_to_8023(struct ieee80211_rx_data *rx, bool *port_control)
1858
{
J
Johannes Berg 已提交
1859
	struct ieee80211_sub_if_data *sdata = rx->sdata;
1860
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
1861 1862 1863
	bool check_port_control = false;
	struct ethhdr *ehdr;
	int ret;
1864

1865
	*port_control = false;
1866 1867
	if (ieee80211_has_a4(hdr->frame_control) &&
	    sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta)
1868
		return -1;
1869

1870 1871 1872 1873 1874 1875 1876 1877 1878
	if (sdata->vif.type == NL80211_IFTYPE_STATION &&
	    !!sdata->u.mgd.use_4addr != !!ieee80211_has_a4(hdr->frame_control)) {

		if (!sdata->u.mgd.use_4addr)
			return -1;
		else
			check_port_control = true;
	}

1879
	if (is_multicast_ether_addr(hdr->addr1) &&
1880
	    sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta)
1881
		return -1;
1882

1883
	ret = ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type);
1884
	if (ret < 0)
1885 1886 1887
		return ret;

	ehdr = (struct ethhdr *) rx->skb->data;
1888 1889 1890
	if (ehdr->h_proto == rx->sdata->control_port_protocol)
		*port_control = true;
	else if (check_port_control)
1891 1892 1893
		return -1;

	return 0;
1894
}
1895

1896 1897 1898
/*
 * requires that rx->skb is a frame with ethernet header
 */
1899
static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
1900
{
1901
	static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
1902 1903 1904 1905 1906 1907 1908
		= { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
	struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;

	/*
	 * Allow EAPOL frames to us/the PAE group address regardless
	 * of whether the frame was encrypted or not.
	 */
1909
	if (ehdr->h_proto == rx->sdata->control_port_protocol &&
1910 1911
	    (ether_addr_equal(ehdr->h_dest, rx->sdata->vif.addr) ||
	     ether_addr_equal(ehdr->h_dest, pae_group_addr)))
1912 1913 1914
		return true;

	if (ieee80211_802_1x_port_control(rx) ||
1915
	    ieee80211_drop_unencrypted(rx, fc))
1916 1917 1918 1919 1920 1921 1922 1923
		return false;

	return true;
}

/*
 * requires that rx->skb is a frame with ethernet header
 */
1924
static void
1925
ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
1926
{
J
Johannes Berg 已提交
1927 1928
	struct ieee80211_sub_if_data *sdata = rx->sdata;
	struct net_device *dev = sdata->dev;
1929
	struct sk_buff *skb, *xmit_skb;
1930 1931
	struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
	struct sta_info *dsta;
1932
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1933

1934 1935
	skb = rx->skb;
	xmit_skb = NULL;
1936

1937 1938
	if ((sdata->vif.type == NL80211_IFTYPE_AP ||
	     sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
1939
	    !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
1940
	    (status->rx_flags & IEEE80211_RX_RA_MATCH) &&
1941
	    (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) {
1942 1943 1944 1945 1946
		if (is_multicast_ether_addr(ehdr->h_dest)) {
			/*
			 * send multicast frames both to higher layers in
			 * local net stack and back to the wireless medium
			 */
1947
			xmit_skb = skb_copy(skb, GFP_ATOMIC);
1948
			if (!xmit_skb)
J
Johannes Berg 已提交
1949
				net_info_ratelimited("%s: failed to clone multicast frame\n",
1950
						    dev->name);
1951
		} else {
1952 1953
			dsta = sta_info_get(sdata, skb->data);
			if (dsta) {
1954 1955 1956 1957 1958
				/*
				 * The destination station is associated to
				 * this AP (in this VLAN), so send the frame
				 * directly to it and do not pass it to local
				 * net stack.
1959
				 */
1960
				xmit_skb = skb;
1961 1962 1963 1964 1965
				skb = NULL;
			}
		}
	}

1966
#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
1967 1968 1969 1970 1971 1972
	if (skb) {
		/* 'align' will only take the values 0 or 2 here since all
		 * frames are required to be aligned to 2-byte boundaries
		 * when being passed to mac80211; the code here works just
		 * as well if that isn't true, but mac80211 assumes it can
		 * access fields as 2-byte aligned (e.g. for ether_addr_equal)
1973
		 */
1974 1975 1976
		int align;

		align = (unsigned long)(skb->data + sizeof(struct ethhdr)) & 3;
1977 1978 1979 1980 1981 1982
		if (align) {
			if (WARN_ON(skb_headroom(skb) < 3)) {
				dev_kfree_skb(skb);
				skb = NULL;
			} else {
				u8 *data = skb->data;
1983 1984 1985 1986
				size_t len = skb_headlen(skb);
				skb->data -= align;
				memmove(skb->data, data, len);
				skb_set_tail_pointer(skb, len);
1987 1988
			}
		}
1989
	}
1990 1991
#endif

1992 1993 1994 1995 1996
	if (skb) {
		/* deliver to local stack */
		skb->protocol = eth_type_trans(skb, dev);
		memset(skb->cb, 0, sizeof(skb->cb));
		netif_receive_skb(skb);
1997 1998
	}

1999
	if (xmit_skb) {
2000 2001 2002 2003 2004 2005
		/*
		 * Send to wireless media and increase priority by 256 to
		 * keep the received priority instead of reclassifying
		 * the frame (see cfg80211_classify8021d).
		 */
		xmit_skb->priority += 256;
2006
		xmit_skb->protocol = htons(ETH_P_802_3);
2007 2008
		skb_reset_network_header(xmit_skb);
		skb_reset_mac_header(xmit_skb);
2009
		dev_queue_xmit(xmit_skb);
2010
	}
2011 2012
}

2013
static ieee80211_rx_result debug_noinline
2014
ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
2015
{
J
Johannes Berg 已提交
2016
	struct net_device *dev = rx->sdata->dev;
Z
Zhu Yi 已提交
2017
	struct sk_buff *skb = rx->skb;
2018 2019
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
	__le16 fc = hdr->frame_control;
Z
Zhu Yi 已提交
2020
	struct sk_buff_head frame_list;
2021
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2022

2023
	if (unlikely(!ieee80211_is_data(fc)))
2024
		return RX_CONTINUE;
2025

2026
	if (unlikely(!ieee80211_is_data_present(fc)))
J
Johannes Berg 已提交
2027
		return RX_DROP_MONITOR;
2028

2029
	if (!(status->rx_flags & IEEE80211_RX_AMSDU))
2030
		return RX_CONTINUE;
2031

Z
Zhu Yi 已提交
2032 2033 2034
	if (ieee80211_has_a4(hdr->frame_control) &&
	    rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
	    !rx->sdata->u.vlan.sta)
J
Johannes Berg 已提交
2035
		return RX_DROP_UNUSABLE;
2036

Z
Zhu Yi 已提交
2037 2038 2039 2040 2041
	if (is_multicast_ether_addr(hdr->addr1) &&
	    ((rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
	      rx->sdata->u.vlan.sta) ||
	     (rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
	      rx->sdata->u.mgd.use_4addr)))
J
Johannes Berg 已提交
2042
		return RX_DROP_UNUSABLE;
2043

Z
Zhu Yi 已提交
2044 2045
	skb->dev = dev;
	__skb_queue_head_init(&frame_list);
2046

Z
Zhu Yi 已提交
2047 2048 2049
	if (skb_linearize(skb))
		return RX_DROP_UNUSABLE;

Z
Zhu Yi 已提交
2050 2051
	ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
				 rx->sdata->vif.type,
2052
				 rx->local->hw.extra_tx_headroom, true);
2053

Z
Zhu Yi 已提交
2054 2055
	while (!skb_queue_empty(&frame_list)) {
		rx->skb = __skb_dequeue(&frame_list);
2056

2057
		if (!ieee80211_frame_allowed(rx, fc)) {
Z
Zhu Yi 已提交
2058
			dev_kfree_skb(rx->skb);
2059 2060
			continue;
		}
Z
Zhu Yi 已提交
2061 2062
		dev->stats.rx_packets++;
		dev->stats.rx_bytes += rx->skb->len;
2063 2064 2065 2066

		ieee80211_deliver_skb(rx);
	}

2067
	return RX_QUEUED;
2068 2069
}

I
Ingo Molnar 已提交
2070
#ifdef CONFIG_MAC80211_MESH
2071
static ieee80211_rx_result
2072 2073
ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
{
2074 2075
	struct ieee80211_hdr *fwd_hdr, *hdr;
	struct ieee80211_tx_info *info;
2076 2077
	struct ieee80211s_hdr *mesh_hdr;
	struct sk_buff *skb = rx->skb, *fwd_skb;
J
Johannes Berg 已提交
2078
	struct ieee80211_local *local = rx->local;
J
Johannes Berg 已提交
2079
	struct ieee80211_sub_if_data *sdata = rx->sdata;
2080
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2081 2082
	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
	u16 q, hdrlen;
2083 2084 2085

	hdr = (struct ieee80211_hdr *) skb->data;
	hdrlen = ieee80211_hdrlen(hdr->frame_control);
2086 2087 2088 2089 2090 2091 2092 2093 2094 2095 2096 2097 2098 2099

	/* make sure fixed part of mesh header is there, also checks skb len */
	if (!pskb_may_pull(rx->skb, hdrlen + 6))
		return RX_DROP_MONITOR;

	mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);

	/* make sure full mesh header is there, also checks skb len */
	if (!pskb_may_pull(rx->skb,
			   hdrlen + ieee80211_get_mesh_hdrlen(mesh_hdr)))
		return RX_DROP_MONITOR;

	/* reload pointers */
	hdr = (struct ieee80211_hdr *) skb->data;
2100 2101
	mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);

2102 2103 2104
	/* frame is in RMC, don't forward */
	if (ieee80211_is_data(hdr->frame_control) &&
	    is_multicast_ether_addr(hdr->addr1) &&
J
Johannes Berg 已提交
2105
	    mesh_rmc_check(rx->sdata, hdr->addr3, mesh_hdr))
2106 2107
		return RX_DROP_MONITOR;

2108 2109
	if (!ieee80211_is_data(hdr->frame_control) ||
	    !(status->rx_flags & IEEE80211_RX_RA_MATCH))
2110 2111 2112 2113 2114
		return RX_CONTINUE;

	if (!mesh_hdr->ttl)
		return RX_DROP_MONITOR;

2115
	if (mesh_hdr->flags & MESH_FLAGS_AE) {
2116
		struct mesh_path *mppath;
2117 2118 2119 2120 2121 2122
		char *proxied_addr;
		char *mpp_addr;

		if (is_multicast_ether_addr(hdr->addr1)) {
			mpp_addr = hdr->addr3;
			proxied_addr = mesh_hdr->eaddr1;
2123 2124
		} else if (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6) {
			/* has_a4 already checked in ieee80211_rx_mesh_check */
2125 2126
			mpp_addr = hdr->addr4;
			proxied_addr = mesh_hdr->eaddr2;
2127 2128
		} else {
			return RX_DROP_MONITOR;
2129
		}
2130 2131

		rcu_read_lock();
J
Johannes Berg 已提交
2132
		mppath = mpp_path_lookup(sdata, proxied_addr);
2133
		if (!mppath) {
J
Johannes Berg 已提交
2134
			mpp_path_add(sdata, proxied_addr, mpp_addr);
2135 2136
		} else {
			spin_lock_bh(&mppath->state_lock);
2137
			if (!ether_addr_equal(mppath->mpp, mpp_addr))
2138
				memcpy(mppath->mpp, mpp_addr, ETH_ALEN);
2139 2140 2141 2142 2143
			spin_unlock_bh(&mppath->state_lock);
		}
		rcu_read_unlock();
	}

2144 2145
	/* Frame has reached destination.  Don't forward */
	if (!is_multicast_ether_addr(hdr->addr1) &&
2146
	    ether_addr_equal(sdata->vif.addr, hdr->addr3))
2147 2148
		return RX_CONTINUE;

Y
Yoni Divinsky 已提交
2149
	q = ieee80211_select_queue_80211(sdata, skb, hdr);
2150
	if (ieee80211_queue_stopped(&local->hw, q)) {
2151
		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion);
2152 2153 2154
		return RX_DROP_MONITOR;
	}
	skb_set_queue_mapping(skb, q);
2155

2156 2157
	if (!--mesh_hdr->ttl) {
		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl);
2158
		goto out;
2159 2160
	}

2161 2162 2163
	if (!ifmsh->mshcfg.dot11MeshForwarding)
		goto out;

2164 2165
	fwd_skb = skb_copy(skb, GFP_ATOMIC);
	if (!fwd_skb) {
J
Johannes Berg 已提交
2166
		net_info_ratelimited("%s: failed to clone mesh frame\n",
2167
				    sdata->name);
2168 2169 2170 2171
		goto out;
	}

	fwd_hdr =  (struct ieee80211_hdr *) fwd_skb->data;
2172
	fwd_hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_RETRY);
2173 2174 2175 2176 2177 2178 2179 2180
	info = IEEE80211_SKB_CB(fwd_skb);
	memset(info, 0, sizeof(*info));
	info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
	info->control.vif = &rx->sdata->vif;
	info->control.jiffies = jiffies;
	if (is_multicast_ether_addr(fwd_hdr->addr1)) {
		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_mcast);
		memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
M
Marco Porsch 已提交
2181 2182
		/* update power mode indication when forwarding */
		ieee80211_mps_set_frame_flags(sdata, NULL, fwd_hdr);
J
Johannes Berg 已提交
2183
	} else if (!mesh_nexthop_lookup(sdata, fwd_skb)) {
M
Marco Porsch 已提交
2184
		/* mesh power mode flags updated in mesh_nexthop_lookup */
2185 2186 2187
		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast);
	} else {
		/* unable to resolve next hop */
J
Johannes Berg 已提交
2188
		mesh_path_error_tx(sdata, ifmsh->mshcfg.element_ttl,
2189 2190 2191
				   fwd_hdr->addr3, 0,
				   WLAN_REASON_MESH_PATH_NOFORWARD,
				   fwd_hdr->addr2);
2192
		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_no_route);
2193
		kfree_skb(fwd_skb);
2194
		return RX_DROP_MONITOR;
2195 2196
	}

2197 2198
	IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
	ieee80211_add_pending_skb(local, fwd_skb);
J
Johannes Berg 已提交
2199
 out:
2200
	if (is_multicast_ether_addr(hdr->addr1) ||
J
Johannes Berg 已提交
2201
	    sdata->dev->flags & IFF_PROMISC)
2202 2203 2204 2205
		return RX_CONTINUE;
	else
		return RX_DROP_MONITOR;
}
I
Ingo Molnar 已提交
2206
#endif
2207

2208
static ieee80211_rx_result debug_noinline
2209
ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
2210
{
J
Johannes Berg 已提交
2211
	struct ieee80211_sub_if_data *sdata = rx->sdata;
2212
	struct ieee80211_local *local = rx->local;
J
Johannes Berg 已提交
2213
	struct net_device *dev = sdata->dev;
2214 2215
	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
	__le16 fc = hdr->frame_control;
2216
	bool port_control;
2217
	int err;
2218

2219
	if (unlikely(!ieee80211_is_data(hdr->frame_control)))
2220
		return RX_CONTINUE;
2221

2222
	if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
J
Johannes Berg 已提交
2223
		return RX_DROP_MONITOR;
2224

2225
	/*
2226 2227
	 * Send unexpected-4addr-frame event to hostapd. For older versions,
	 * also drop the frame to cooked monitor interfaces.
2228 2229
	 */
	if (ieee80211_has_a4(hdr->frame_control) &&
2230 2231 2232 2233 2234
	    sdata->vif.type == NL80211_IFTYPE_AP) {
		if (rx->sta &&
		    !test_and_set_sta_flag(rx->sta, WLAN_STA_4ADDR_EVENT))
			cfg80211_rx_unexpected_4addr_frame(
				rx->sdata->dev, rx->sta->sta.addr, GFP_ATOMIC);
2235
		return RX_DROP_MONITOR;
2236
	}
2237

2238
	err = __ieee80211_data_to_8023(rx, &port_control);
2239
	if (unlikely(err))
J
Johannes Berg 已提交
2240
		return RX_DROP_UNUSABLE;
2241

2242
	if (!ieee80211_frame_allowed(rx, fc))
J
Johannes Berg 已提交
2243
		return RX_DROP_MONITOR;
2244

2245 2246 2247 2248 2249 2250 2251 2252
	if (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
	    unlikely(port_control) && sdata->bss) {
		sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
				     u.ap);
		dev = sdata->dev;
		rx->sdata = sdata;
	}

2253 2254 2255 2256 2257
	rx->skb->dev = dev;

	dev->stats.rx_packets++;
	dev->stats.rx_bytes += rx->skb->len;

2258
	if (local->ps_sdata && local->hw.conf.dynamic_ps_timeout > 0 &&
2259 2260 2261 2262
	    !is_multicast_ether_addr(
		    ((struct ethhdr *)rx->skb->data)->h_dest) &&
	    (!local->scanning &&
	     !test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))) {
2263 2264 2265 2266
			mod_timer(&local->dynamic_ps_timer, jiffies +
			 msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
	}

2267
	ieee80211_deliver_skb(rx);
2268

2269
	return RX_QUEUED;
2270 2271
}

2272
static ieee80211_rx_result debug_noinline
2273
ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx, struct sk_buff_head *frames)
2274 2275
{
	struct sk_buff *skb = rx->skb;
2276
	struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
2277 2278 2279 2280
	struct tid_ampdu_rx *tid_agg_rx;
	u16 start_seq_num;
	u16 tid;

2281
	if (likely(!ieee80211_is_ctl(bar->frame_control)))
2282
		return RX_CONTINUE;
2283

2284
	if (ieee80211_is_back_req(bar->frame_control)) {
2285 2286 2287 2288
		struct {
			__le16 control, start_seq_num;
		} __packed bar_data;

2289
		if (!rx->sta)
2290
			return RX_DROP_MONITOR;
2291 2292 2293 2294 2295 2296

		if (skb_copy_bits(skb, offsetof(struct ieee80211_bar, control),
				  &bar_data, sizeof(bar_data)))
			return RX_DROP_MONITOR;

		tid = le16_to_cpu(bar_data.control) >> 12;
2297 2298 2299

		tid_agg_rx = rcu_dereference(rx->sta->ampdu_mlme.tid_rx[tid]);
		if (!tid_agg_rx)
2300
			return RX_DROP_MONITOR;
2301

2302
		start_seq_num = le16_to_cpu(bar_data.start_seq_num) >> 4;
2303 2304

		/* reset session timer */
2305 2306 2307
		if (tid_agg_rx->timeout)
			mod_timer(&tid_agg_rx->session_timer,
				  TU_TO_EXP_TIME(tid_agg_rx->timeout));
2308

2309
		spin_lock(&tid_agg_rx->reorder_lock);
2310
		/* release stored frames up to start of BAR */
2311
		ieee80211_release_reorder_frames(rx->sdata, tid_agg_rx,
2312
						 start_seq_num, frames);
2313 2314
		spin_unlock(&tid_agg_rx->reorder_lock);

2315 2316
		kfree_skb(skb);
		return RX_QUEUED;
2317 2318
	}

2319 2320 2321 2322 2323 2324
	/*
	 * After this point, we only want management frames,
	 * so we can drop all remaining control frames to
	 * cooked monitor interfaces.
	 */
	return RX_DROP_MONITOR;
2325 2326
}

2327 2328 2329
static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
					   struct ieee80211_mgmt *mgmt,
					   size_t len)
2330 2331 2332 2333 2334
{
	struct ieee80211_local *local = sdata->local;
	struct sk_buff *skb;
	struct ieee80211_mgmt *resp;

2335
	if (!ether_addr_equal(mgmt->da, sdata->vif.addr)) {
2336 2337 2338 2339
		/* Not to own unicast address */
		return;
	}

2340 2341
	if (!ether_addr_equal(mgmt->sa, sdata->u.mgd.bssid) ||
	    !ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid)) {
2342
		/* Not from the current AP or not associated yet. */
2343 2344 2345 2346 2347 2348 2349 2350 2351 2352 2353 2354 2355 2356 2357 2358
		return;
	}

	if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) {
		/* Too short SA Query request frame */
		return;
	}

	skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom);
	if (skb == NULL)
		return;

	skb_reserve(skb, local->hw.extra_tx_headroom);
	resp = (struct ieee80211_mgmt *) skb_put(skb, 24);
	memset(resp, 0, 24);
	memcpy(resp->da, mgmt->sa, ETH_ALEN);
2359
	memcpy(resp->sa, sdata->vif.addr, ETH_ALEN);
2360
	memcpy(resp->bssid, sdata->u.mgd.bssid, ETH_ALEN);
2361 2362 2363 2364 2365 2366 2367 2368 2369
	resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
					  IEEE80211_STYPE_ACTION);
	skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query));
	resp->u.action.category = WLAN_CATEGORY_SA_QUERY;
	resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE;
	memcpy(resp->u.action.u.sa_query.trans_id,
	       mgmt->u.action.u.sa_query.trans_id,
	       WLAN_SA_QUERY_TR_ID_LEN);

2370
	ieee80211_tx_skb(sdata, skb);
2371 2372
}

2373 2374 2375 2376
static ieee80211_rx_result debug_noinline
ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx)
{
	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
2377
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2378 2379 2380 2381 2382 2383 2384 2385 2386 2387 2388 2389

	/*
	 * From here on, look only at management frames.
	 * Data and control frames are already handled,
	 * and unknown (reserved) frames are useless.
	 */
	if (rx->skb->len < 24)
		return RX_DROP_MONITOR;

	if (!ieee80211_is_mgmt(mgmt->frame_control))
		return RX_DROP_MONITOR;

J
Johannes Berg 已提交
2390 2391 2392
	if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
	    ieee80211_is_beacon(mgmt->frame_control) &&
	    !(rx->flags & IEEE80211_RX_BEACON_REPORTED)) {
2393 2394 2395 2396 2397
		int sig = 0;

		if (rx->local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
			sig = status->signal;

J
Johannes Berg 已提交
2398 2399
		cfg80211_report_obss_beacon(rx->local->hw.wiphy,
					    rx->skb->data, rx->skb->len,
2400
					    status->freq, sig);
J
Johannes Berg 已提交
2401 2402 2403
		rx->flags |= IEEE80211_RX_BEACON_REPORTED;
	}

2404
	if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
2405 2406 2407 2408 2409 2410 2411 2412
		return RX_DROP_MONITOR;

	if (ieee80211_drop_unencrypted_mgmt(rx))
		return RX_DROP_UNUSABLE;

	return RX_CONTINUE;
}

2413 2414 2415 2416
static ieee80211_rx_result debug_noinline
ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
{
	struct ieee80211_local *local = rx->local;
J
Johannes Berg 已提交
2417
	struct ieee80211_sub_if_data *sdata = rx->sdata;
2418
	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
2419
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2420 2421 2422 2423 2424
	int len = rx->skb->len;

	if (!ieee80211_is_action(mgmt->frame_control))
		return RX_CONTINUE;

2425 2426
	/* drop too small frames */
	if (len < IEEE80211_MIN_ACTION_SIZE)
2427
		return RX_DROP_UNUSABLE;
2428

2429
	if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC &&
2430 2431
	    mgmt->u.action.category != WLAN_CATEGORY_SELF_PROTECTED &&
	    mgmt->u.action.category != WLAN_CATEGORY_SPECTRUM_MGMT)
2432
		return RX_DROP_UNUSABLE;
2433

2434
	if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
2435
		return RX_DROP_UNUSABLE;
2436

2437
	switch (mgmt->u.action.category) {
2438 2439 2440 2441 2442 2443 2444 2445 2446 2447 2448 2449
	case WLAN_CATEGORY_HT:
		/* reject HT action frames from stations not supporting HT */
		if (!rx->sta->sta.ht_cap.ht_supported)
			goto invalid;

		if (sdata->vif.type != NL80211_IFTYPE_STATION &&
		    sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
		    sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
		    sdata->vif.type != NL80211_IFTYPE_AP &&
		    sdata->vif.type != NL80211_IFTYPE_ADHOC)
			break;

2450
		/* verify action & smps_control/chanwidth are present */
2451 2452 2453 2454 2455 2456
		if (len < IEEE80211_MIN_ACTION_SIZE + 2)
			goto invalid;

		switch (mgmt->u.action.u.ht_smps.action) {
		case WLAN_HT_ACTION_SMPS: {
			struct ieee80211_supported_band *sband;
2457
			enum ieee80211_smps_mode smps_mode;
2458 2459 2460 2461

			/* convert to HT capability */
			switch (mgmt->u.action.u.ht_smps.smps_control) {
			case WLAN_HT_SMPS_CONTROL_DISABLED:
2462
				smps_mode = IEEE80211_SMPS_OFF;
2463 2464
				break;
			case WLAN_HT_SMPS_CONTROL_STATIC:
2465
				smps_mode = IEEE80211_SMPS_STATIC;
2466 2467
				break;
			case WLAN_HT_SMPS_CONTROL_DYNAMIC:
2468
				smps_mode = IEEE80211_SMPS_DYNAMIC;
2469 2470 2471 2472 2473 2474
				break;
			default:
				goto invalid;
			}

			/* if no change do nothing */
2475
			if (rx->sta->sta.smps_mode == smps_mode)
2476
				goto handled;
2477
			rx->sta->sta.smps_mode = smps_mode;
2478 2479 2480

			sband = rx->local->hw.wiphy->bands[status->band];

2481 2482
			rate_control_rate_update(local, sband, rx->sta,
						 IEEE80211_RC_SMPS_CHANGED);
2483 2484
			goto handled;
		}
2485 2486 2487
		case WLAN_HT_ACTION_NOTIFY_CHANWIDTH: {
			struct ieee80211_supported_band *sband;
			u8 chanwidth = mgmt->u.action.u.ht_notify_cw.chanwidth;
2488
			enum ieee80211_sta_rx_bandwidth new_bw;
2489 2490

			/* If it doesn't support 40 MHz it can't change ... */
2491 2492
			if (!(rx->sta->sta.ht_cap.cap &
					IEEE80211_HT_CAP_SUP_WIDTH_20_40))
2493 2494
				goto handled;

2495 2496 2497 2498
			if (chanwidth == IEEE80211_HT_CHANWIDTH_20MHZ)
				new_bw = IEEE80211_STA_RX_BW_20;
			else
				new_bw = ieee80211_sta_cur_vht_bw(rx->sta);
2499

2500
			if (rx->sta->sta.bandwidth == new_bw)
2501 2502 2503 2504 2505 2506 2507 2508
				goto handled;

			sband = rx->local->hw.wiphy->bands[status->band];

			rate_control_rate_update(local, sband, rx->sta,
						 IEEE80211_RC_BW_CHANGED);
			goto handled;
		}
2509 2510 2511 2512
		default:
			goto invalid;
		}

2513
		break;
2514 2515 2516 2517 2518 2519 2520 2521 2522 2523 2524 2525 2526 2527 2528 2529
	case WLAN_CATEGORY_PUBLIC:
		if (len < IEEE80211_MIN_ACTION_SIZE + 1)
			goto invalid;
		if (sdata->vif.type != NL80211_IFTYPE_STATION)
			break;
		if (!rx->sta)
			break;
		if (!ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid))
			break;
		if (mgmt->u.action.u.ext_chan_switch.action_code !=
				WLAN_PUB_ACTION_EXT_CHANSW_ANN)
			break;
		if (len < offsetof(struct ieee80211_mgmt,
				   u.action.u.ext_chan_switch.variable))
			goto invalid;
		goto queue;
2530 2531 2532 2533 2534 2535 2536 2537 2538 2539 2540 2541 2542 2543 2544 2545 2546 2547 2548 2549 2550 2551 2552
	case WLAN_CATEGORY_VHT:
		if (sdata->vif.type != NL80211_IFTYPE_STATION &&
		    sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
		    sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
		    sdata->vif.type != NL80211_IFTYPE_AP &&
		    sdata->vif.type != NL80211_IFTYPE_ADHOC)
			break;

		/* verify action code is present */
		if (len < IEEE80211_MIN_ACTION_SIZE + 1)
			goto invalid;

		switch (mgmt->u.action.u.vht_opmode_notif.action_code) {
		case WLAN_VHT_ACTION_OPMODE_NOTIF: {
			u8 opmode;

			/* verify opmode is present */
			if (len < IEEE80211_MIN_ACTION_SIZE + 2)
				goto invalid;

			opmode = mgmt->u.action.u.vht_opmode_notif.operating_mode;

			ieee80211_vht_handle_opmode(rx->sdata, rx->sta,
2553 2554
						    opmode, status->band,
						    false);
2555 2556 2557 2558 2559
			goto handled;
		}
		default:
			break;
		}
2560
		break;
2561
	case WLAN_CATEGORY_BACK:
2562
		if (sdata->vif.type != NL80211_IFTYPE_STATION &&
2563
		    sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
2564
		    sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
2565 2566
		    sdata->vif.type != NL80211_IFTYPE_AP &&
		    sdata->vif.type != NL80211_IFTYPE_ADHOC)
2567
			break;
2568

2569 2570 2571 2572
		/* verify action_code is present */
		if (len < IEEE80211_MIN_ACTION_SIZE + 1)
			break;

2573 2574 2575 2576
		switch (mgmt->u.action.u.addba_req.action_code) {
		case WLAN_ACTION_ADDBA_REQ:
			if (len < (IEEE80211_MIN_ACTION_SIZE +
				   sizeof(mgmt->u.action.u.addba_req)))
2577 2578
				goto invalid;
			break;
2579 2580 2581
		case WLAN_ACTION_ADDBA_RESP:
			if (len < (IEEE80211_MIN_ACTION_SIZE +
				   sizeof(mgmt->u.action.u.addba_resp)))
2582 2583
				goto invalid;
			break;
2584 2585 2586
		case WLAN_ACTION_DELBA:
			if (len < (IEEE80211_MIN_ACTION_SIZE +
				   sizeof(mgmt->u.action.u.delba)))
2587 2588 2589 2590
				goto invalid;
			break;
		default:
			goto invalid;
2591
		}
2592

2593
		goto queue;
2594
	case WLAN_CATEGORY_SPECTRUM_MGMT:
2595 2596 2597 2598
		/* verify action_code is present */
		if (len < IEEE80211_MIN_ACTION_SIZE + 1)
			break;

2599 2600
		switch (mgmt->u.action.u.measurement.action_code) {
		case WLAN_ACTION_SPCT_MSR_REQ:
2601 2602 2603
			if (status->band != IEEE80211_BAND_5GHZ)
				break;

2604 2605
			if (len < (IEEE80211_MIN_ACTION_SIZE +
				   sizeof(mgmt->u.action.u.measurement)))
2606
				break;
2607 2608 2609 2610

			if (sdata->vif.type != NL80211_IFTYPE_STATION)
				break;

2611
			ieee80211_process_measurement_req(sdata, mgmt, len);
2612
			goto handled;
2613 2614 2615 2616
		case WLAN_ACTION_SPCT_CHL_SWITCH: {
			u8 *bssid;
			if (len < (IEEE80211_MIN_ACTION_SIZE +
				   sizeof(mgmt->u.action.u.chan_switch)))
2617
				break;
2618

2619
			if (sdata->vif.type != NL80211_IFTYPE_STATION &&
2620 2621
			    sdata->vif.type != NL80211_IFTYPE_ADHOC &&
			    sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
2622 2623 2624 2625 2626 2627
				break;

			if (sdata->vif.type == NL80211_IFTYPE_STATION)
				bssid = sdata->u.mgd.bssid;
			else if (sdata->vif.type == NL80211_IFTYPE_ADHOC)
				bssid = sdata->u.ibss.bssid;
2628 2629
			else if (sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
				bssid = mgmt->sa;
2630 2631 2632 2633
			else
				break;

			if (!ether_addr_equal(mgmt->bssid, bssid))
2634
				break;
S
Sujith 已提交
2635

2636
			goto queue;
2637
			}
2638 2639
		}
		break;
2640 2641 2642
	case WLAN_CATEGORY_SA_QUERY:
		if (len < (IEEE80211_MIN_ACTION_SIZE +
			   sizeof(mgmt->u.action.u.sa_query)))
2643 2644
			break;

2645 2646 2647
		switch (mgmt->u.action.u.sa_query.action) {
		case WLAN_ACTION_SA_QUERY_REQUEST:
			if (sdata->vif.type != NL80211_IFTYPE_STATION)
2648
				break;
2649
			ieee80211_process_sa_query_req(sdata, mgmt, len);
2650
			goto handled;
2651 2652
		}
		break;
2653
	case WLAN_CATEGORY_SELF_PROTECTED:
2654 2655 2656 2657
		if (len < (IEEE80211_MIN_ACTION_SIZE +
			   sizeof(mgmt->u.action.u.self_prot.action_code)))
			break;

2658 2659 2660 2661 2662 2663
		switch (mgmt->u.action.u.self_prot.action_code) {
		case WLAN_SP_MESH_PEERING_OPEN:
		case WLAN_SP_MESH_PEERING_CLOSE:
		case WLAN_SP_MESH_PEERING_CONFIRM:
			if (!ieee80211_vif_is_mesh(&sdata->vif))
				goto invalid;
2664
			if (sdata->u.mesh.user_mpm)
2665 2666 2667 2668 2669 2670 2671 2672 2673 2674
				/* userspace handles this frame */
				break;
			goto queue;
		case WLAN_SP_MGK_INFORM:
		case WLAN_SP_MGK_ACK:
			if (!ieee80211_vif_is_mesh(&sdata->vif))
				goto invalid;
			break;
		}
		break;
2675
	case WLAN_CATEGORY_MESH_ACTION:
2676 2677 2678 2679
		if (len < (IEEE80211_MIN_ACTION_SIZE +
			   sizeof(mgmt->u.action.u.mesh_action.action_code)))
			break;

2680 2681
		if (!ieee80211_vif_is_mesh(&sdata->vif))
			break;
2682
		if (mesh_action_is_path_sel(mgmt) &&
J
Johannes Berg 已提交
2683
		    !mesh_path_sel_is_hwmp(sdata))
2684 2685
			break;
		goto queue;
2686
	}
2687

2688 2689
	return RX_CONTINUE;

2690
 invalid:
2691
	status->rx_flags |= IEEE80211_RX_MALFORMED_ACTION_FRM;
2692 2693 2694 2695 2696 2697 2698 2699 2700 2701 2702 2703 2704 2705 2706 2707 2708 2709 2710 2711 2712
	/* will return in the next handlers */
	return RX_CONTINUE;

 handled:
	if (rx->sta)
		rx->sta->rx_packets++;
	dev_kfree_skb(rx->skb);
	return RX_QUEUED;

 queue:
	rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
	skb_queue_tail(&sdata->skb_queue, rx->skb);
	ieee80211_queue_work(&local->hw, &sdata->work);
	if (rx->sta)
		rx->sta->rx_packets++;
	return RX_QUEUED;
}

static ieee80211_rx_result debug_noinline
ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx)
{
2713
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2714
	int sig = 0;
2715 2716

	/* skip known-bad action frames and return them in the next handler */
2717
	if (status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM)
2718
		return RX_CONTINUE;
2719

2720 2721 2722 2723 2724 2725 2726
	/*
	 * Getting here means the kernel doesn't know how to handle
	 * it, but maybe userspace does ... include returned frames
	 * so userspace can register for those to know whether ones
	 * it transmitted were processed or returned.
	 */

2727 2728 2729
	if (rx->local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
		sig = status->signal;

2730
	if (cfg80211_rx_mgmt(&rx->sdata->wdev, status->freq, sig,
2731
			     rx->skb->data, rx->skb->len, 0, GFP_ATOMIC)) {
2732 2733 2734 2735 2736 2737 2738 2739 2740 2741 2742 2743 2744 2745 2746 2747
		if (rx->sta)
			rx->sta->rx_packets++;
		dev_kfree_skb(rx->skb);
		return RX_QUEUED;
	}

	return RX_CONTINUE;
}

static ieee80211_rx_result debug_noinline
ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
{
	struct ieee80211_local *local = rx->local;
	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
	struct sk_buff *nskb;
	struct ieee80211_sub_if_data *sdata = rx->sdata;
2748
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2749 2750 2751 2752 2753 2754 2755 2756 2757

	if (!ieee80211_is_action(mgmt->frame_control))
		return RX_CONTINUE;

	/*
	 * For AP mode, hostapd is responsible for handling any action
	 * frames that we didn't handle, including returning unknown
	 * ones. For all other modes we will return them to the sender,
	 * setting the 0x80 bit in the action category, as required by
2758
	 * 802.11-2012 9.24.4.
2759 2760 2761 2762
	 * Newer versions of hostapd shall also use the management frame
	 * registration mechanisms, but older ones still use cooked
	 * monitor interfaces so push all frames there.
	 */
2763
	if (!(status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) &&
2764 2765 2766
	    (sdata->vif.type == NL80211_IFTYPE_AP ||
	     sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
		return RX_DROP_MONITOR;
2767

2768 2769 2770
	if (is_multicast_ether_addr(mgmt->da))
		return RX_DROP_MONITOR;

2771 2772 2773 2774 2775 2776 2777
	/* do not return rejected action frames */
	if (mgmt->u.action.category & 0x80)
		return RX_DROP_UNUSABLE;

	nskb = skb_copy_expand(rx->skb, local->hw.extra_tx_headroom, 0,
			       GFP_ATOMIC);
	if (nskb) {
2778
		struct ieee80211_mgmt *nmgmt = (void *)nskb->data;
2779

2780 2781 2782
		nmgmt->u.action.category |= 0x80;
		memcpy(nmgmt->da, nmgmt->sa, ETH_ALEN);
		memcpy(nmgmt->sa, rx->sdata->vif.addr, ETH_ALEN);
2783 2784 2785

		memset(nskb->cb, 0, sizeof(nskb->cb));

2786 2787 2788 2789 2790 2791 2792 2793 2794 2795 2796 2797 2798
		if (rx->sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE) {
			struct ieee80211_tx_info *info = IEEE80211_SKB_CB(nskb);

			info->flags = IEEE80211_TX_CTL_TX_OFFCHAN |
				      IEEE80211_TX_INTFL_OFFCHAN_TX_OK |
				      IEEE80211_TX_CTL_NO_CCK_RATE;
			if (local->hw.flags & IEEE80211_HW_QUEUE_CONTROL)
				info->hw_queue =
					local->hw.offchannel_tx_hw_queue;
		}

		__ieee80211_tx_skb_tid_band(rx->sdata, nskb, 7,
					    status->band);
2799
	}
2800 2801
	dev_kfree_skb(rx->skb);
	return RX_QUEUED;
2802 2803
}

2804
static ieee80211_rx_result debug_noinline
2805
ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
2806
{
J
Johannes Berg 已提交
2807
	struct ieee80211_sub_if_data *sdata = rx->sdata;
2808 2809
	struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
	__le16 stype;
2810

2811
	stype = mgmt->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE);
2812

2813 2814 2815 2816
	if (!ieee80211_vif_is_mesh(&sdata->vif) &&
	    sdata->vif.type != NL80211_IFTYPE_ADHOC &&
	    sdata->vif.type != NL80211_IFTYPE_STATION)
		return RX_DROP_MONITOR;
2817

2818
	switch (stype) {
J
Johannes Berg 已提交
2819
	case cpu_to_le16(IEEE80211_STYPE_AUTH):
2820 2821 2822 2823
	case cpu_to_le16(IEEE80211_STYPE_BEACON):
	case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
		/* process for all: mesh, mlme, ibss */
		break;
J
Johannes Berg 已提交
2824 2825
	case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
	case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
2826 2827
	case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
	case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
2828 2829 2830 2831
		if (is_multicast_ether_addr(mgmt->da) &&
		    !is_broadcast_ether_addr(mgmt->da))
			return RX_DROP_MONITOR;

2832 2833 2834 2835 2836
		/* process only for station */
		if (sdata->vif.type != NL80211_IFTYPE_STATION)
			return RX_DROP_MONITOR;
		break;
	case cpu_to_le16(IEEE80211_STYPE_PROBE_REQ):
2837 2838 2839
		/* process only for ibss and mesh */
		if (sdata->vif.type != NL80211_IFTYPE_ADHOC &&
		    sdata->vif.type != NL80211_IFTYPE_MESH_POINT)
2840 2841 2842 2843 2844
			return RX_DROP_MONITOR;
		break;
	default:
		return RX_DROP_MONITOR;
	}
2845

2846
	/* queue up frame and kick off work to process it */
2847
	rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
2848 2849
	skb_queue_tail(&sdata->skb_queue, rx->skb);
	ieee80211_queue_work(&rx->local->hw, &sdata->work);
2850 2851
	if (rx->sta)
		rx->sta->rx_packets++;
2852

2853
	return RX_QUEUED;
2854 2855
}

2856
/* TODO: use IEEE80211_RX_FRAGMENTED */
J
Johannes Berg 已提交
2857 2858
static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
					struct ieee80211_rate *rate)
2859 2860 2861 2862 2863
{
	struct ieee80211_sub_if_data *sdata;
	struct ieee80211_local *local = rx->local;
	struct sk_buff *skb = rx->skb, *skb2;
	struct net_device *prev_dev = NULL;
J
Johannes Berg 已提交
2864
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2865
	int needed_headroom;
2866

2867 2868 2869 2870 2871
	/*
	 * If cooked monitor has been processed already, then
	 * don't do it again. If not, set the flag.
	 */
	if (rx->flags & IEEE80211_RX_CMNTR)
2872
		goto out_free_skb;
2873
	rx->flags |= IEEE80211_RX_CMNTR;
2874

2875 2876 2877 2878
	/* If there are no cooked monitor interfaces, just free the SKB */
	if (!local->cooked_mntrs)
		goto out_free_skb;

2879
	/* room for the radiotap header based on driver features */
2880
	needed_headroom = ieee80211_rx_radiotap_space(local, status);
2881

2882 2883 2884
	if (skb_headroom(skb) < needed_headroom &&
	    pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC))
		goto out_free_skb;
2885

2886
	/* prepend radiotap information */
2887 2888
	ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom,
					 false);
2889 2890 2891 2892 2893 2894 2895

	skb_set_mac_header(skb, 0);
	skb->ip_summed = CHECKSUM_UNNECESSARY;
	skb->pkt_type = PACKET_OTHERHOST;
	skb->protocol = htons(ETH_P_802_2);

	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
2896
		if (!ieee80211_sdata_running(sdata))
2897 2898
			continue;

2899
		if (sdata->vif.type != NL80211_IFTYPE_MONITOR ||
2900 2901 2902 2903 2904 2905 2906
		    !(sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES))
			continue;

		if (prev_dev) {
			skb2 = skb_clone(skb, GFP_ATOMIC);
			if (skb2) {
				skb2->dev = prev_dev;
2907
				netif_receive_skb(skb2);
2908 2909 2910 2911 2912 2913 2914 2915 2916 2917
			}
		}

		prev_dev = sdata->dev;
		sdata->dev->stats.rx_packets++;
		sdata->dev->stats.rx_bytes += skb->len;
	}

	if (prev_dev) {
		skb->dev = prev_dev;
2918
		netif_receive_skb(skb);
2919 2920
		return;
	}
2921 2922 2923 2924 2925

 out_free_skb:
	dev_kfree_skb(skb);
}

2926 2927 2928 2929 2930 2931 2932 2933 2934 2935 2936 2937 2938 2939 2940 2941 2942
static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx,
					 ieee80211_rx_result res)
{
	switch (res) {
	case RX_DROP_MONITOR:
		I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
		if (rx->sta)
			rx->sta->rx_dropped++;
		/* fall through */
	case RX_CONTINUE: {
		struct ieee80211_rate *rate = NULL;
		struct ieee80211_supported_band *sband;
		struct ieee80211_rx_status *status;

		status = IEEE80211_SKB_RXCB((rx->skb));

		sband = rx->local->hw.wiphy->bands[status->band];
2943 2944
		if (!(status->flag & RX_FLAG_HT) &&
		    !(status->flag & RX_FLAG_VHT))
2945 2946 2947 2948 2949 2950 2951 2952 2953 2954 2955 2956 2957 2958 2959 2960
			rate = &sband->bitrates[status->rate_idx];

		ieee80211_rx_cooked_monitor(rx, rate);
		break;
		}
	case RX_DROP_UNUSABLE:
		I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
		if (rx->sta)
			rx->sta->rx_dropped++;
		dev_kfree_skb(rx->skb);
		break;
	case RX_QUEUED:
		I802_DEBUG_INC(rx->sdata->local->rx_handlers_queued);
		break;
	}
}
2961

2962 2963
static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx,
				  struct sk_buff_head *frames)
2964 2965
{
	ieee80211_rx_result res = RX_DROP_MONITOR;
2966
	struct sk_buff *skb;
2967

2968 2969 2970 2971
#define CALL_RXH(rxh)			\
	do {				\
		res = rxh(rx);		\
		if (res != RX_CONTINUE)	\
2972
			goto rxh_next;  \
2973
	} while (0);
2974

2975
	spin_lock_bh(&rx->local->rx_path_lock);
2976

2977
	while ((skb = __skb_dequeue(frames))) {
2978 2979 2980 2981 2982 2983 2984 2985
		/*
		 * all the other fields are valid across frames
		 * that belong to an aMPDU since they are on the
		 * same TID from the same station
		 */
		rx->skb = skb;

		CALL_RXH(ieee80211_rx_h_check_more_data)
J
Johannes Berg 已提交
2986
		CALL_RXH(ieee80211_rx_h_uapsd_and_pspoll)
2987
		CALL_RXH(ieee80211_rx_h_sta_process)
2988
		CALL_RXH(ieee80211_rx_h_decrypt)
2989 2990 2991
		CALL_RXH(ieee80211_rx_h_defragment)
		CALL_RXH(ieee80211_rx_h_michael_mic_verify)
		/* must be after MMIC verify so header is counted in MPDU mic */
I
Ingo Molnar 已提交
2992
#ifdef CONFIG_MAC80211_MESH
2993
		if (ieee80211_vif_is_mesh(&rx->sdata->vif))
2994
			CALL_RXH(ieee80211_rx_h_mesh_fwding);
I
Ingo Molnar 已提交
2995
#endif
2996
		CALL_RXH(ieee80211_rx_h_amsdu)
2997
		CALL_RXH(ieee80211_rx_h_data)
2998 2999 3000 3001 3002 3003

		/* special treatment -- needs the queue */
		res = ieee80211_rx_h_ctrl(rx, frames);
		if (res != RX_CONTINUE)
			goto rxh_next;

3004
		CALL_RXH(ieee80211_rx_h_mgmt_check)
3005
		CALL_RXH(ieee80211_rx_h_action)
3006 3007
		CALL_RXH(ieee80211_rx_h_userspace_mgmt)
		CALL_RXH(ieee80211_rx_h_action_return)
3008
		CALL_RXH(ieee80211_rx_h_mgmt)
3009

3010 3011
 rxh_next:
		ieee80211_rx_handlers_result(rx, res);
3012

3013
#undef CALL_RXH
3014
	}
3015

3016
	spin_unlock_bh(&rx->local->rx_path_lock);
3017 3018
}

3019
static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
3020
{
3021
	struct sk_buff_head reorder_release;
3022 3023
	ieee80211_rx_result res = RX_DROP_MONITOR;

3024 3025
	__skb_queue_head_init(&reorder_release);

3026 3027 3028 3029 3030 3031 3032 3033 3034
#define CALL_RXH(rxh)			\
	do {				\
		res = rxh(rx);		\
		if (res != RX_CONTINUE)	\
			goto rxh_next;  \
	} while (0);

	CALL_RXH(ieee80211_rx_h_check)

3035
	ieee80211_rx_reorder_ampdu(rx, &reorder_release);
3036

3037
	ieee80211_rx_handlers(rx, &reorder_release);
3038
	return;
3039

3040
 rxh_next:
3041 3042 3043
	ieee80211_rx_handlers_result(rx, res);

#undef CALL_RXH
3044 3045
}

3046
/*
3047 3048
 * This function makes calls into the RX path, therefore
 * it has to be invoked under RCU read lock.
3049 3050 3051
 */
void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
{
3052
	struct sk_buff_head frames;
3053 3054 3055 3056
	struct ieee80211_rx_data rx = {
		.sta = sta,
		.sdata = sta->sdata,
		.local = sta->local,
3057 3058 3059
		/* This is OK -- must be QoS data frame */
		.security_idx = tid,
		.seqno_idx = tid,
3060
		.flags = 0,
3061
	};
3062 3063 3064 3065 3066
	struct tid_ampdu_rx *tid_agg_rx;

	tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
	if (!tid_agg_rx)
		return;
3067

3068 3069
	__skb_queue_head_init(&frames);

3070
	spin_lock(&tid_agg_rx->reorder_lock);
3071
	ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx, &frames);
3072
	spin_unlock(&tid_agg_rx->reorder_lock);
3073

3074
	ieee80211_rx_handlers(&rx, &frames);
3075 3076
}

3077 3078
/* main receive path */

3079 3080
static bool prepare_for_handlers(struct ieee80211_rx_data *rx,
				 struct ieee80211_hdr *hdr)
3081
{
3082
	struct ieee80211_sub_if_data *sdata = rx->sdata;
J
Johannes Berg 已提交
3083 3084 3085
	struct sk_buff *skb = rx->skb;
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
	u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
3086 3087
	int multicast = is_multicast_ether_addr(hdr->addr1);

3088
	switch (sdata->vif.type) {
3089
	case NL80211_IFTYPE_STATION:
3090
		if (!bssid && !sdata->u.mgd.use_4addr)
3091
			return false;
3092
		if (!multicast &&
3093
		    !ether_addr_equal(sdata->vif.addr, hdr->addr1)) {
3094 3095
			if (!(sdata->dev->flags & IFF_PROMISC) ||
			    sdata->u.mgd.use_4addr)
3096
				return false;
3097
			status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
3098 3099
		}
		break;
3100
	case NL80211_IFTYPE_ADHOC:
3101
		if (!bssid)
3102
			return false;
3103 3104
		if (ether_addr_equal(sdata->vif.addr, hdr->addr2) ||
		    ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2))
3105
			return false;
3106
		if (ieee80211_is_beacon(hdr->frame_control)) {
3107
			return true;
J
Johannes Berg 已提交
3108
		} else if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid)) {
3109
			return false;
3110
		} else if (!multicast &&
3111
			   !ether_addr_equal(sdata->vif.addr, hdr->addr1)) {
3112
			if (!(sdata->dev->flags & IFF_PROMISC))
3113
				return false;
3114
			status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
3115 3116
		} else if (!rx->sta) {
			int rate_idx;
3117 3118
			if (status->flag & (RX_FLAG_HT | RX_FLAG_VHT))
				rate_idx = 0; /* TODO: HT/VHT rates */
3119
			else
J
Johannes Berg 已提交
3120
				rate_idx = status->rate_idx;
3121 3122
			ieee80211_ibss_rx_no_sta(sdata, bssid, hdr->addr2,
						 BIT(rate_idx));
3123
		}
3124
		break;
3125
	case NL80211_IFTYPE_MESH_POINT:
3126
		if (!multicast &&
3127
		    !ether_addr_equal(sdata->vif.addr, hdr->addr1)) {
3128
			if (!(sdata->dev->flags & IFF_PROMISC))
3129
				return false;
3130

3131
			status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
3132 3133
		}
		break;
3134 3135
	case NL80211_IFTYPE_AP_VLAN:
	case NL80211_IFTYPE_AP:
3136
		if (!bssid) {
3137
			if (!ether_addr_equal(sdata->vif.addr, hdr->addr1))
3138
				return false;
3139
		} else if (!ieee80211_bssid_match(bssid, sdata->vif.addr)) {
3140 3141 3142 3143 3144 3145
			/*
			 * Accept public action frames even when the
			 * BSSID doesn't match, this is used for P2P
			 * and location updates. Note that mac80211
			 * itself never looks at these frames.
			 */
3146 3147
			if (!multicast &&
			    !ether_addr_equal(sdata->vif.addr, hdr->addr1))
3148
				return false;
J
Johannes Berg 已提交
3149
			if (ieee80211_is_public_action(hdr, skb->len))
3150
				return true;
J
Johannes Berg 已提交
3151
			if (!ieee80211_is_beacon(hdr->frame_control))
3152
				return false;
3153
			status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
3154 3155
		}
		break;
3156
	case NL80211_IFTYPE_WDS:
3157
		if (bssid || !ieee80211_is_data(hdr->frame_control))
3158
			return false;
3159
		if (!ether_addr_equal(sdata->u.wds.remote_addr, hdr->addr2))
3160
			return false;
3161
		break;
3162 3163 3164 3165 3166
	case NL80211_IFTYPE_P2P_DEVICE:
		if (!ieee80211_is_public_action(hdr, skb->len) &&
		    !ieee80211_is_probe_req(hdr->frame_control) &&
		    !ieee80211_is_probe_resp(hdr->frame_control) &&
		    !ieee80211_is_beacon(hdr->frame_control))
3167
			return false;
3168 3169
		if (!ether_addr_equal(sdata->vif.addr, hdr->addr1) &&
		    !multicast)
3170 3171
			status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
		break;
3172
	default:
J
Johannes Berg 已提交
3173
		/* should never get here */
3174
		WARN_ON_ONCE(1);
J
Johannes Berg 已提交
3175
		break;
3176 3177
	}

3178
	return true;
3179 3180
}

3181 3182 3183 3184 3185 3186 3187 3188 3189 3190 3191 3192 3193 3194 3195
/*
 * This function returns whether or not the SKB
 * was destined for RX processing or not, which,
 * if consume is true, is equivalent to whether
 * or not the skb was consumed.
 */
static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,
					    struct sk_buff *skb, bool consume)
{
	struct ieee80211_local *local = rx->local;
	struct ieee80211_sub_if_data *sdata = rx->sdata;
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
	struct ieee80211_hdr *hdr = (void *)skb->data;

	rx->skb = skb;
3196
	status->rx_flags |= IEEE80211_RX_RA_MATCH;
3197

3198
	if (!prepare_for_handlers(rx, hdr))
3199 3200 3201 3202 3203 3204 3205
		return false;

	if (!consume) {
		skb = skb_copy(skb, GFP_ATOMIC);
		if (!skb) {
			if (net_ratelimit())
				wiphy_debug(local->hw.wiphy,
3206
					"failed to copy skb for %s\n",
3207 3208 3209 3210 3211 3212 3213 3214 3215 3216 3217
					sdata->name);
			return true;
		}

		rx->skb = skb;
	}

	ieee80211_invoke_rx_handlers(rx);
	return true;
}

3218
/*
3219 3220
 * This is the actual Rx frames handler. as it blongs to Rx path it must
 * be called with rcu_read_lock protection.
3221
 */
3222
static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
3223
					 struct sk_buff *skb)
3224 3225 3226 3227
{
	struct ieee80211_local *local = hw_to_local(hw);
	struct ieee80211_sub_if_data *sdata;
	struct ieee80211_hdr *hdr;
Z
Zhu Yi 已提交
3228
	__le16 fc;
3229
	struct ieee80211_rx_data rx;
3230
	struct ieee80211_sub_if_data *prev;
3231
	struct sta_info *sta, *tmp, *prev_sta;
Z
Zhu Yi 已提交
3232
	int err = 0;
3233

Z
Zhu Yi 已提交
3234
	fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
3235 3236 3237
	memset(&rx, 0, sizeof(rx));
	rx.skb = skb;
	rx.local = local;
3238

Z
Zhu Yi 已提交
3239
	if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc))
3240 3241
		local->dot11ReceivedFragmentCount++;

3242 3243 3244 3245 3246 3247 3248
	if (ieee80211_is_mgmt(fc)) {
		/* drop frame if too short for header */
		if (skb->len < ieee80211_hdrlen(fc))
			err = -ENOBUFS;
		else
			err = skb_linearize(skb);
	} else {
Z
Zhu Yi 已提交
3249
		err = !pskb_may_pull(skb, ieee80211_hdrlen(fc));
3250
	}
Z
Zhu Yi 已提交
3251 3252 3253 3254 3255 3256 3257

	if (err) {
		dev_kfree_skb(skb);
		return;
	}

	hdr = (struct ieee80211_hdr *)skb->data;
3258
	ieee80211_parse_qos(&rx);
3259
	ieee80211_verify_alignment(&rx);
3260

J
Johannes Berg 已提交
3261 3262 3263 3264
	if (unlikely(ieee80211_is_probe_resp(hdr->frame_control) ||
		     ieee80211_is_beacon(hdr->frame_control)))
		ieee80211_scan_rx(local, skb);

Z
Zhu Yi 已提交
3265
	if (ieee80211_is_data(fc)) {
3266
		prev_sta = NULL;
3267

3268
		for_each_sta_info(local, hdr->addr2, sta, tmp) {
3269 3270 3271 3272 3273 3274 3275
			if (!prev_sta) {
				prev_sta = sta;
				continue;
			}

			rx.sta = prev_sta;
			rx.sdata = prev_sta->sdata;
3276
			ieee80211_prepare_and_rx_handle(&rx, skb, false);
3277

3278
			prev_sta = sta;
3279
		}
3280 3281 3282 3283 3284

		if (prev_sta) {
			rx.sta = prev_sta;
			rx.sdata = prev_sta->sdata;

3285
			if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
3286
				return;
3287
			goto out;
3288
		}
3289 3290
	}

3291
	prev = NULL;
3292

3293 3294 3295
	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
		if (!ieee80211_sdata_running(sdata))
			continue;
J
Johannes Berg 已提交
3296

3297 3298 3299
		if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
		    sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
			continue;
J
Johannes Berg 已提交
3300

3301 3302 3303 3304 3305
		/*
		 * frame is destined for this interface, but if it's
		 * not also for the previous one we handle that after
		 * the loop to avoid copying the SKB once too much
		 */
3306

3307
		if (!prev) {
3308
			prev = sdata;
3309
			continue;
J
Johannes Berg 已提交
3310
		}
3311

3312
		rx.sta = sta_info_get_bss(prev, hdr->addr2);
3313 3314
		rx.sdata = prev;
		ieee80211_prepare_and_rx_handle(&rx, skb, false);
3315

3316 3317 3318 3319
		prev = sdata;
	}

	if (prev) {
3320
		rx.sta = sta_info_get_bss(prev, hdr->addr2);
3321
		rx.sdata = prev;
3322

3323 3324
		if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
			return;
3325
	}
3326

3327
 out:
3328
	dev_kfree_skb(skb);
3329
}
3330 3331 3332 3333 3334

/*
 * This is the receive path handler. It is called by a low level driver when an
 * 802.11 MPDU is received from the hardware.
 */
3335
void ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb)
3336 3337
{
	struct ieee80211_local *local = hw_to_local(hw);
3338 3339
	struct ieee80211_rate *rate = NULL;
	struct ieee80211_supported_band *sband;
3340
	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
3341

3342 3343
	WARN_ON_ONCE(softirq_count() == 0);

J
Johannes Berg 已提交
3344
	if (WARN_ON(status->band >= IEEE80211_NUM_BANDS))
J
Johannes Berg 已提交
3345
		goto drop;
3346 3347

	sband = local->hw.wiphy->bands[status->band];
J
Johannes Berg 已提交
3348 3349
	if (WARN_ON(!sband))
		goto drop;
3350

J
Johannes Berg 已提交
3351 3352 3353 3354 3355 3356 3357
	/*
	 * If we're suspending, it is possible although not too likely
	 * that we'd be receiving frames after having already partially
	 * quiesced the stack. We can't process such frames then since
	 * that might, for example, cause stations to be added or other
	 * driver callbacks be invoked.
	 */
J
Johannes Berg 已提交
3358 3359
	if (unlikely(local->quiescing || local->suspended))
		goto drop;
J
Johannes Berg 已提交
3360

3361 3362 3363 3364
	/* We might be during a HW reconfig, prevent Rx for the same reason */
	if (unlikely(local->in_reconfig))
		goto drop;

3365 3366 3367 3368
	/*
	 * The same happens when we're not even started,
	 * but that's worth a warning.
	 */
J
Johannes Berg 已提交
3369 3370
	if (WARN_ON(!local->started))
		goto drop;
3371

3372
	if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC))) {
3373
		/*
3374 3375
		 * Validate the rate, unless a PLCP error means that
		 * we probably can't have a valid rate here anyway.
3376
		 */
3377 3378 3379 3380 3381 3382 3383 3384 3385 3386 3387 3388

		if (status->flag & RX_FLAG_HT) {
			/*
			 * rate_idx is MCS index, which can be [0-76]
			 * as documented on:
			 *
			 * http://wireless.kernel.org/en/developers/Documentation/ieee80211/802.11n
			 *
			 * Anything else would be some sort of driver or
			 * hardware error. The driver should catch hardware
			 * errors.
			 */
J
Johannes Berg 已提交
3389
			if (WARN(status->rate_idx > 76,
3390 3391 3392 3393 3394 3395
				 "Rate marked as an HT rate but passed "
				 "status->rate_idx is not "
				 "an MCS index [0-76]: %d (0x%02x)\n",
				 status->rate_idx,
				 status->rate_idx))
				goto drop;
3396 3397 3398 3399 3400 3401 3402
		} else if (status->flag & RX_FLAG_VHT) {
			if (WARN_ONCE(status->rate_idx > 9 ||
				      !status->vht_nss ||
				      status->vht_nss > 8,
				      "Rate marked as a VHT rate but data is invalid: MCS: %d, NSS: %d\n",
				      status->rate_idx, status->vht_nss))
				goto drop;
3403
		} else {
J
Johannes Berg 已提交
3404
			if (WARN_ON(status->rate_idx >= sband->n_bitrates))
3405 3406 3407
				goto drop;
			rate = &sband->bitrates[status->rate_idx];
		}
3408
	}
3409

3410 3411
	status->rx_flags = 0;

3412 3413 3414 3415 3416 3417 3418 3419 3420 3421 3422 3423 3424
	/*
	 * key references and virtual interfaces are protected using RCU
	 * and this requires that we are in a read-side RCU section during
	 * receive processing
	 */
	rcu_read_lock();

	/*
	 * Frames with failed FCS/PLCP checksum are not returned,
	 * all other frames are returned without radiotap header
	 * if it was previously present.
	 * Also, frames with less than 16 bytes are dropped.
	 */
3425
	skb = ieee80211_rx_monitor(local, skb, rate);
3426 3427 3428 3429 3430
	if (!skb) {
		rcu_read_unlock();
		return;
	}

3431 3432 3433
	ieee80211_tpt_led_trig_rx(local,
			((struct ieee80211_hdr *)skb->data)->frame_control,
			skb->len);
3434
	__ieee80211_rx_handle_packet(hw, skb);
3435 3436

	rcu_read_unlock();
J
Johannes Berg 已提交
3437 3438 3439 3440

	return;
 drop:
	kfree_skb(skb);
3441
}
3442
EXPORT_SYMBOL(ieee80211_rx);
3443 3444 3445

/* This is a version of the rx handler that can be called from hard irq
 * context. Post the skb on the queue and schedule the tasklet */
3446
void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb)
3447 3448 3449 3450 3451 3452 3453 3454 3455 3456
{
	struct ieee80211_local *local = hw_to_local(hw);

	BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));

	skb->pkt_type = IEEE80211_RX_MSG;
	skb_queue_tail(&local->skb_queue, skb);
	tasklet_schedule(&local->tasklet);
}
EXPORT_SYMBOL(ieee80211_rx_irqsafe);