]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/blame - net/mac80211/rx.c
projects / mirror_ubuntu-jammy-kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
mac80211: Add debugfs callbacks for station addition/removal
[mirror_ubuntu-jammy-kernel.git] / net / mac80211 / rx.c
CommitLineData
571ecf67
JB		 1/*
2 * Copyright 2002-2005, Instant802 Networks, Inc.
3 * Copyright 2005-2006, Devicescape Software, Inc.
4 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
84040805 5 * Copyright 2007-2010 Johannes Berg <johannes@sipsolutions.net>
571ecf67
JB		 6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
10 */
11
ab46623e 12#include <linux/jiffies.h>
5a0e3ad6 13#include <linux/slab.h>
571ecf67
JB		 14#include <linux/kernel.h>
15#include <linux/skbuff.h>
16#include <linux/netdevice.h>
17#include <linux/etherdevice.h>
d4e46a3d 18#include <linux/rcupdate.h>
bc3b2d7f 19#include <linux/export.h>
571ecf67
JB		 20#include <net/mac80211.h>
21#include <net/ieee80211_radiotap.h>
d26ad377 22#include <asm/unaligned.h>
571ecf67
JB		 23
24#include "ieee80211_i.h"
24487981 25#include "driver-ops.h"
2c8dccc7 26#include "led.h"
33b64eb2 27#include "mesh.h"
571ecf67
JB		 28#include "wep.h"
29#include "wpa.h"
30#include "tkip.h"
31#include "wme.h"
1d8d3dec 32#include "rate.h"
571ecf67 33
b2e7771e
JB		 34/*
35 * monitor mode reception
36 *
37 * This function cleans up the SKB, i.e. it removes all the stuff
38 * only useful for monitoring.
39 */
40static struct sk_buff *remove_monitor_info(struct ieee80211_local *local,
0869aea0 41 struct sk_buff *skb)
b2e7771e 42{
90b9e446
JB		 43 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
44
b2e7771e
JB		 45 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) {
46 if (likely(skb->len > FCS_LEN))
e3cf8b3f 47 __pskb_trim(skb, skb->len - FCS_LEN);
b2e7771e
JB		 48 else {
49 /* driver bug */
50 WARN_ON(1);
51 dev_kfree_skb(skb);
52 skb = NULL;
53 }
54 }
55
90b9e446
JB		 56 if (status->vendor_radiotap_len)
57 __pskb_pull(skb, status->vendor_radiotap_len);
58
b2e7771e
JB		 59 return skb;
60}
61
1df332e8 62static inline int should_drop_frame(struct sk_buff *skb, int present_fcs_len)
b2e7771e 63{
f1d58c25 64 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
182503ab 65 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
b2e7771e 66
4c298677
JB		 67 if (status->flag & (RX_FLAG_FAILED_FCS_CRC |
68 RX_FLAG_FAILED_PLCP_CRC |
69 RX_FLAG_AMPDU_IS_ZEROLEN))
b2e7771e 70 return 1;
0869aea0 71 if (unlikely(skb->len < 16 + present_fcs_len))
b2e7771e 72 return 1;
87228f57
HH		 73 if (ieee80211_is_ctl(hdr->frame_control) &&
74 !ieee80211_is_pspoll(hdr->frame_control) &&
75 !ieee80211_is_back_req(hdr->frame_control))
b2e7771e
JB		 76 return 1;
77 return 0;
78}
79
601ae7f2 80static int
90b9e446
JB		 81ieee80211_rx_radiotap_space(struct ieee80211_local *local,
82 struct ieee80211_rx_status *status)
601ae7f2
BR		 83{
84 int len;
85
86 /* always present fields */
87 len = sizeof(struct ieee80211_radiotap_header) + 9;
88
90b9e446
JB		 89 /* allocate extra bitmap */
90 if (status->vendor_radiotap_len)
91 len += 4;
92
93 if (ieee80211_have_rx_timestamp(status)) {
94 len = ALIGN(len, 8);
601ae7f2 95 len += 8;
90b9e446 96 }
7fee5372 97 if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
601ae7f2 98 len += 1;
601ae7f2 99
90b9e446
JB		 100 /* padding for RX_FLAGS if necessary */
101 len = ALIGN(len, 2);
601ae7f2 102
6d744bac
JB		 103 if (status->flag & RX_FLAG_HT) /* HT info */
104 len += 3;
105
4c298677 106 if (status->flag & RX_FLAG_AMPDU_DETAILS) {
90b9e446 107 len = ALIGN(len, 4);
4c298677
JB		 108 len += 8;
109 }
110
90b9e446
JB		 111 if (status->vendor_radiotap_len) {
112 if (WARN_ON_ONCE(status->vendor_radiotap_align == 0))
113 status->vendor_radiotap_align = 1;
114 /* align standard part of vendor namespace */
115 len = ALIGN(len, 2);
116 /* allocate standard part of vendor namespace */
117 len += 6;
118 /* align vendor-defined part */
119 len = ALIGN(len, status->vendor_radiotap_align);
120 /* vendor-defined part is already in skb */
121 }
122
601ae7f2
BR		 123 return len;
124}
125
00ea6deb 126/*
601ae7f2
BR		 127 * ieee80211_add_rx_radiotap_header - add radiotap header
128 *
129 * add a radiotap header containing all the fields which the hardware provided.
130 */
131static void
132ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
133 struct sk_buff *skb,
601ae7f2 134 struct ieee80211_rate *rate,
973ef21a 135 int rtap_len, bool has_fcs)
601ae7f2 136{
f1d58c25 137 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
601ae7f2
BR		 138 struct ieee80211_radiotap_header *rthdr;
139 unsigned char *pos;
6a86b9c7 140 u16 rx_flags = 0;
f4bda337
TP		 141 int mpdulen;
142
143 mpdulen = skb->len;
144 if (!(has_fcs && (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)))
145 mpdulen += FCS_LEN;
601ae7f2
BR		 146
147 rthdr = (struct ieee80211_radiotap_header *)skb_push(skb, rtap_len);
148 memset(rthdr, 0, rtap_len);
149
150 /* radiotap header, set always present flags */
151 rthdr->it_present =
152 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
601ae7f2
BR		 153 (1 << IEEE80211_RADIOTAP_CHANNEL) |
154 (1 << IEEE80211_RADIOTAP_ANTENNA) |
155 (1 << IEEE80211_RADIOTAP_RX_FLAGS));
90b9e446 156 rthdr->it_len = cpu_to_le16(rtap_len + status->vendor_radiotap_len);
601ae7f2 157
1df332e8 158 pos = (unsigned char *)(rthdr + 1);
601ae7f2 159
90b9e446
JB		 160 if (status->vendor_radiotap_len) {
161 rthdr->it_present |=
162 cpu_to_le32(BIT(IEEE80211_RADIOTAP_VENDOR_NAMESPACE)) |
163 cpu_to_le32(BIT(IEEE80211_RADIOTAP_EXT));
164 put_unaligned_le32(status->vendor_radiotap_bitmap, pos);
165 pos += 4;
166 }
167
601ae7f2
BR		 168 /* the order of the following fields is important */
169
170 /* IEEE80211_RADIOTAP_TSFT */
f4bda337 171 if (ieee80211_have_rx_timestamp(status)) {
90b9e446
JB		 172 /* padding */
173 while ((pos - (u8 *)rthdr) & 7)
174 *pos++ = 0;
f4bda337
TP		 175 put_unaligned_le64(
176 ieee80211_calculate_rx_timestamp(local, status,
177 mpdulen, 0),
178 pos);
1df332e8 179 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_TSFT);
601ae7f2
BR		 180 pos += 8;
181 }
182
183 /* IEEE80211_RADIOTAP_FLAGS */
973ef21a 184 if (has_fcs && (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS))
601ae7f2 185 *pos |= IEEE80211_RADIOTAP_F_FCS;
aae89831
JB		 186 if (status->flag & (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
187 *pos |= IEEE80211_RADIOTAP_F_BADFCS;
b4f28bbb
BR		 188 if (status->flag & RX_FLAG_SHORTPRE)
189 *pos |= IEEE80211_RADIOTAP_F_SHORTPRE;
601ae7f2
BR		 190 pos++;
191
192 /* IEEE80211_RADIOTAP_RATE */
f8d1ccf1 193 if (!rate || status->flag & RX_FLAG_HT) {
0fb8ca45 194 /*
f8d1ccf1 195 * Without rate information don't add it. If we have,
38f37be2 196 * MCS information is a separate field in radiotap,
73b48099
JB		 197 * added below. The byte here is needed as padding
198 * for the channel though, so initialise it to 0.
0fb8ca45
JM		 199 */
200 *pos = 0;
8d6f658e 201 } else {
ebe6c7ba 202 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_RATE);
0fb8ca45 203 *pos = rate->bitrate / 5;
8d6f658e 204 }
601ae7f2
BR		 205 pos++;
206
207 /* IEEE80211_RADIOTAP_CHANNEL */
6a86b9c7 208 put_unaligned_le16(status->freq, pos);
601ae7f2
BR		 209 pos += 2;
210 if (status->band == IEEE80211_BAND_5GHZ)
6a86b9c7
JB		 211 put_unaligned_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ,
212 pos);
5f0b7de5
JB		 213 else if (status->flag & RX_FLAG_HT)
214 put_unaligned_le16(IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ,
215 pos);
f8d1ccf1 216 else if (rate && rate->flags & IEEE80211_RATE_ERP_G)
6a86b9c7
JB		 217 put_unaligned_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_2GHZ,
218 pos);
f8d1ccf1 219 else if (rate)
6a86b9c7
JB		 220 put_unaligned_le16(IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ,
221 pos);
f8d1ccf1
JB		 222 else
223 put_unaligned_le16(IEEE80211_CHAN_2GHZ, pos);
601ae7f2
BR		 224 pos += 2;
225
226 /* IEEE80211_RADIOTAP_DBM_ANTSIGNAL */
fe8431f8
FF		 227 if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM &&
228 !(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
601ae7f2
BR		 229 *pos = status->signal;
230 rthdr->it_present |=
231 cpu_to_le32(1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL);
232 pos++;
233 }
234
601ae7f2
BR		 235 /* IEEE80211_RADIOTAP_LOCK_QUALITY is missing */
236
237 /* IEEE80211_RADIOTAP_ANTENNA */
238 *pos = status->antenna;
239 pos++;
240
601ae7f2
BR		 241 /* IEEE80211_RADIOTAP_DB_ANTNOISE is not used */
242
243 /* IEEE80211_RADIOTAP_RX_FLAGS */
244 /* ensure 2 byte alignment for the 2 byte field as required */
6a86b9c7 245 if ((pos - (u8 *)rthdr) & 1)
90b9e446 246 *pos++ = 0;
aae89831 247 if (status->flag & RX_FLAG_FAILED_PLCP_CRC)
6a86b9c7
JB		 248 rx_flags |= IEEE80211_RADIOTAP_F_RX_BADPLCP;
249 put_unaligned_le16(rx_flags, pos);
601ae7f2 250 pos += 2;
6d744bac
JB		 251
252 if (status->flag & RX_FLAG_HT) {
253 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_MCS);
ac55d2fe 254 *pos++ = local->hw.radiotap_mcs_details;
6d744bac
JB		 255 *pos = 0;
256 if (status->flag & RX_FLAG_SHORT_GI)
257 *pos |= IEEE80211_RADIOTAP_MCS_SGI;
258 if (status->flag & RX_FLAG_40MHZ)
259 *pos |= IEEE80211_RADIOTAP_MCS_BW_40;
ac55d2fe
JB		 260 if (status->flag & RX_FLAG_HT_GF)
261 *pos |= IEEE80211_RADIOTAP_MCS_FMT_GF;
6d744bac
JB		 262 pos++;
263 *pos++ = status->rate_idx;
264 }
4c298677
JB		 265
266 if (status->flag & RX_FLAG_AMPDU_DETAILS) {
267 u16 flags = 0;
268
269 /* ensure 4 byte alignment */
270 while ((pos - (u8 *)rthdr) & 3)
271 pos++;
272 rthdr->it_present |=
273 cpu_to_le32(1 << IEEE80211_RADIOTAP_AMPDU_STATUS);
274 put_unaligned_le32(status->ampdu_reference, pos);
275 pos += 4;
276 if (status->flag & RX_FLAG_AMPDU_REPORT_ZEROLEN)
277 flags |= IEEE80211_RADIOTAP_AMPDU_REPORT_ZEROLEN;
278 if (status->flag & RX_FLAG_AMPDU_IS_ZEROLEN)
279 flags |= IEEE80211_RADIOTAP_AMPDU_IS_ZEROLEN;
280 if (status->flag & RX_FLAG_AMPDU_LAST_KNOWN)
281 flags |= IEEE80211_RADIOTAP_AMPDU_LAST_KNOWN;
282 if (status->flag & RX_FLAG_AMPDU_IS_LAST)
283 flags |= IEEE80211_RADIOTAP_AMPDU_IS_LAST;
284 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_ERROR)
285 flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_ERR;
286 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
287 flags |= IEEE80211_RADIOTAP_AMPDU_DELIM_CRC_KNOWN;
288 put_unaligned_le16(flags, pos);
289 pos += 2;
290 if (status->flag & RX_FLAG_AMPDU_DELIM_CRC_KNOWN)
291 *pos++ = status->ampdu_delimiter_crc;
292 else
293 *pos++ = 0;
294 *pos++ = 0;
295 }
90b9e446
JB		 296
297 if (status->vendor_radiotap_len) {
298 /* ensure 2 byte alignment for the vendor field as required */
299 if ((pos - (u8 *)rthdr) & 1)
300 *pos++ = 0;
301 *pos++ = status->vendor_radiotap_oui[0];
302 *pos++ = status->vendor_radiotap_oui[1];
303 *pos++ = status->vendor_radiotap_oui[2];
304 *pos++ = status->vendor_radiotap_subns;
305 put_unaligned_le16(status->vendor_radiotap_len, pos);
306 pos += 2;
307 /* align the actual payload as requested */
308 while ((pos - (u8 *)rthdr) & (status->vendor_radiotap_align - 1))
309 *pos++ = 0;
310 }
601ae7f2
BR		 311}
312
b2e7771e
JB		 313/*
314 * This function copies a received frame to all monitor interfaces and
315 * returns a cleaned-up SKB that no longer includes the FCS nor the
316 * radiotap header the driver might have added.
317 */
318static struct sk_buff *
319ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
8318d78a 320 struct ieee80211_rate *rate)
b2e7771e 321{
f1d58c25 322 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(origskb);
b2e7771e 323 struct ieee80211_sub_if_data *sdata;
293702a3 324 int needed_headroom;
b2e7771e
JB		 325 struct sk_buff *skb, *skb2;
326 struct net_device *prev_dev = NULL;
327 int present_fcs_len = 0;
b2e7771e
JB		 328
329 /*
330 * First, we may need to make a copy of the skb because
331 * (1) we need to modify it for radiotap (if not present), and
332 * (2) the other RX handlers will modify the skb we got.
333 *
334 * We don't need to, of course, if we aren't going to return
335 * the SKB because it has a bad FCS/PLCP checksum.
336 */
0869aea0
JB		 337
338 /* room for the radiotap header based on driver features */
90b9e446 339 needed_headroom = ieee80211_rx_radiotap_space(local, status);
b2e7771e
JB		 340
341 if (local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS)
342 present_fcs_len = FCS_LEN;
343
e3cf8b3f
ZY		 344 /* make sure hdr->frame_control is on the linear part */
345 if (!pskb_may_pull(origskb, 2)) {
346 dev_kfree_skb(origskb);
347 return NULL;
348 }
349
b2e7771e 350 if (!local->monitors) {
0869aea0 351 if (should_drop_frame(origskb, present_fcs_len)) {
b2e7771e
JB		 352 dev_kfree_skb(origskb);
353 return NULL;
354 }
355
0869aea0 356 return remove_monitor_info(local, origskb);
b2e7771e
JB		 357 }
358
0869aea0 359 if (should_drop_frame(origskb, present_fcs_len)) {
b2e7771e
JB		 360 /* only need to expand headroom if necessary */
361 skb = origskb;
362 origskb = NULL;
363
364 /*
365 * This shouldn't trigger often because most devices have an
366 * RX header they pull before we get here, and that should
367 * be big enough for our radiotap information. We should
368 * probably export the length to drivers so that we can have
369 * them allocate enough headroom to start with.
370 */
371 if (skb_headroom(skb) < needed_headroom &&
c49e5ea3 372 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC)) {
b2e7771e
JB		 373 dev_kfree_skb(skb);
374 return NULL;
375 }
376 } else {
377 /*
378 * Need to make a copy and possibly remove radiotap header
379 * and FCS from the original.
380 */
381 skb = skb_copy_expand(origskb, needed_headroom, 0, GFP_ATOMIC);
382
0869aea0 383 origskb = remove_monitor_info(local, origskb);
b2e7771e
JB		 384
385 if (!skb)
386 return origskb;
387 }
388
0869aea0 389 /* prepend radiotap information */
973ef21a
FF		 390 ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom,
391 true);
b2e7771e 392
ce3edf6d 393 skb_reset_mac_header(skb);
b2e7771e
JB		 394 skb->ip_summed = CHECKSUM_UNNECESSARY;
395 skb->pkt_type = PACKET_OTHERHOST;
396 skb->protocol = htons(ETH_P_802_2);
397
398 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
05c914fe 399 if (sdata->vif.type != NL80211_IFTYPE_MONITOR)
b2e7771e
JB		 400 continue;
401
3d30d949
MW		 402 if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES)
403 continue;
404
9607e6b6 405 if (!ieee80211_sdata_running(sdata))
47846c9b
JB		 406 continue;
407
b2e7771e
JB		 408 if (prev_dev) {
409 skb2 = skb_clone(skb, GFP_ATOMIC);
410 if (skb2) {
411 skb2->dev = prev_dev;
5548a8a1 412 netif_receive_skb(skb2);
b2e7771e
JB		 413 }
414 }
415
416 prev_dev = sdata->dev;
417 sdata->dev->stats.rx_packets++;
418 sdata->dev->stats.rx_bytes += skb->len;
419 }
420
421 if (prev_dev) {
422 skb->dev = prev_dev;
5548a8a1 423 netif_receive_skb(skb);
b2e7771e
JB		 424 } else
425 dev_kfree_skb(skb);
426
427 return origskb;
428}
429
5cf121c3 430static void ieee80211_parse_qos(struct ieee80211_rx_data *rx)
6e0d114d 431{
238f74a2 432 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
554891e6 433 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
9e26297a 434 int tid, seqno_idx, security_idx;
6e0d114d
JB		 435
436 /* does the frame have a qos control field? */
238f74a2
HH		 437 if (ieee80211_is_data_qos(hdr->frame_control)) {
438 u8 *qc = ieee80211_get_qos_ctl(hdr);
6e0d114d 439 /* frame has qos control */
238f74a2 440 tid = *qc & IEEE80211_QOS_CTL_TID_MASK;
04b7dcf9 441 if (*qc & IEEE80211_QOS_CTL_A_MSDU_PRESENT)
554891e6 442 status->rx_flags |= IEEE80211_RX_AMSDU;
9e26297a
JB		 443
444 seqno_idx = tid;
445 security_idx = tid;
6e0d114d 446 } else {
1411f9b5
JB		 447 /*
448 * IEEE 802.11-2007, 7.1.3.4.1 ("Sequence Number field"):
449 *
450 * Sequence numbers for management frames, QoS data
451 * frames with a broadcast/multicast address in the
452 * Address 1 field, and all non-QoS data frames sent
453 * by QoS STAs are assigned using an additional single
454 * modulo-4096 counter, [...]
455 *
456 * We also use that counter for non-QoS STAs.
457 */
5a306f58 458 seqno_idx = IEEE80211_NUM_TIDS;
9e26297a
JB		 459 security_idx = 0;
460 if (ieee80211_is_mgmt(hdr->frame_control))
5a306f58 461 security_idx = IEEE80211_NUM_TIDS;
9e26297a 462 tid = 0;
6e0d114d 463 }
52865dfd 464
9e26297a
JB		 465 rx->seqno_idx = seqno_idx;
466 rx->security_idx = security_idx;
6e0d114d
JB		 467 /* Set skb->priority to 1d tag if highest order bit of TID is not set.
468 * For now, set skb->priority to 0 for other cases. */
469 rx->skb->priority = (tid > 7) ? 0 : tid;
38f3714d 470}
6e0d114d 471
d1c3a37c
JB		 472/**
473 * DOC: Packet alignment
474 *
475 * Drivers always need to pass packets that are aligned to two-byte boundaries
476 * to the stack.
477 *
478 * Additionally, should, if possible, align the payload data in a way that
479 * guarantees that the contained IP header is aligned to a four-byte
480 * boundary. In the case of regular frames, this simply means aligning the
481 * payload to a four-byte boundary (because either the IP header is directly
482 * contained, or IV/RFC1042 headers that have a length divisible by four are
59d9cb07
KV		 483 * in front of it). If the payload data is not properly aligned and the
484 * architecture doesn't support efficient unaligned operations, mac80211
485 * will align the data.
d1c3a37c
JB		 486 *
487 * With A-MSDU frames, however, the payload data address must yield two modulo
488 * four because there are 14-byte 802.3 headers within the A-MSDU frames that
489 * push the IP header further back to a multiple of four again. Thankfully, the
490 * specs were sane enough this time around to require padding each A-MSDU
491 * subframe to a length that is a multiple of four.
492 *
25985edc 493 * Padding like Atheros hardware adds which is between the 802.11 header and
d1c3a37c
JB		 494 * the payload is not supported, the driver is required to move the 802.11
495 * header to be directly in front of the payload in that case.
496 */
497static void ieee80211_verify_alignment(struct ieee80211_rx_data *rx)
38f3714d 498{
59d9cb07
KV		 499#ifdef CONFIG_MAC80211_VERBOSE_DEBUG
500 WARN_ONCE((unsigned long)rx->skb->data & 1,
501 "unaligned packet at 0x%p\n", rx->skb->data);
d1c3a37c 502#endif
6e0d114d
JB		 503}
504
6368e4b1 505
571ecf67
JB		 506/* rx handlers */
507
3cfcf6ac
JM		 508static int ieee80211_is_unicast_robust_mgmt_frame(struct sk_buff *skb)
509{
510 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
511
512 if (skb->len < 24 || is_multicast_ether_addr(hdr->addr1))
513 return 0;
514
515 return ieee80211_is_robust_mgmt_frame(hdr);
516}
517
518
519static int ieee80211_is_multicast_robust_mgmt_frame(struct sk_buff *skb)
520{
521 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
522
523 if (skb->len < 24 || !is_multicast_ether_addr(hdr->addr1))
524 return 0;
525
526 return ieee80211_is_robust_mgmt_frame(hdr);
527}
528
529
530/* Get the BIP key index from MMIE; return -1 if this is not a BIP frame */
531static int ieee80211_get_mmie_keyidx(struct sk_buff *skb)
532{
533 struct ieee80211_mgmt *hdr = (struct ieee80211_mgmt *) skb->data;
534 struct ieee80211_mmie *mmie;
535
1df332e8 536 if (skb->len < 24 + sizeof(*mmie) || !is_multicast_ether_addr(hdr->da))
3cfcf6ac
JM		 537 return -1;
538
539 if (!ieee80211_is_robust_mgmt_frame((struct ieee80211_hdr *) hdr))
540 return -1; /* not a robust management frame */
541
542 mmie = (struct ieee80211_mmie *)
543 (skb->data + skb->len - sizeof(*mmie));
544 if (mmie->element_id != WLAN_EID_MMIE ||
545 mmie->length != sizeof(*mmie) - 2)
546 return -1;
547
548 return le16_to_cpu(mmie->key_id);
549}
550
1df332e8 551static ieee80211_rx_result ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
33b64eb2 552{
a7767f95 553 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
47846c9b 554 char *dev_addr = rx->sdata->vif.addr;
d6d1a5a7 555
a7767f95 556 if (ieee80211_is_data(hdr->frame_control)) {
3c5772a5
JC		 557 if (is_multicast_ether_addr(hdr->addr1)) {
558 if (ieee80211_has_tods(hdr->frame_control) ||
1df332e8 559 !ieee80211_has_fromds(hdr->frame_control))
3c5772a5 560 return RX_DROP_MONITOR;
b203ca39 561 if (ether_addr_equal(hdr->addr3, dev_addr))
3c5772a5
JC		 562 return RX_DROP_MONITOR;
563 } else {
564 if (!ieee80211_has_a4(hdr->frame_control))
565 return RX_DROP_MONITOR;
b203ca39 566 if (ether_addr_equal(hdr->addr4, dev_addr))
3c5772a5
JC		 567 return RX_DROP_MONITOR;
568 }
33b64eb2
LCC		 569 }
570
571 /* If there is not an established peer link and this is not a peer link
572 * establisment frame, beacon or probe, drop the frame.
573 */
574
57cf8043 575 if (!rx->sta || sta_plink_state(rx->sta) != NL80211_PLINK_ESTAB) {
33b64eb2 576 struct ieee80211_mgmt *mgmt;
d6d1a5a7 577
a7767f95 578 if (!ieee80211_is_mgmt(hdr->frame_control))
33b64eb2
LCC		 579 return RX_DROP_MONITOR;
580
a7767f95 581 if (ieee80211_is_action(hdr->frame_control)) {
d3aaec8a 582 u8 category;
9b395bc3
JB		 583
584 /* make sure category field is present */
585 if (rx->skb->len < IEEE80211_MIN_ACTION_SIZE)
586 return RX_DROP_MONITOR;
587
33b64eb2 588 mgmt = (struct ieee80211_mgmt *)hdr;
d3aaec8a
JC		 589 category = mgmt->u.action.category;
590 if (category != WLAN_CATEGORY_MESH_ACTION &&
1df332e8 591 category != WLAN_CATEGORY_SELF_PROTECTED)
33b64eb2 592 return RX_DROP_MONITOR;
33b64eb2 593 return RX_CONTINUE;
33b64eb2
LCC		 594 }
595
a7767f95
HH		 596 if (ieee80211_is_probe_req(hdr->frame_control) ||
597 ieee80211_is_probe_resp(hdr->frame_control) ||
71839121
JC		 598 ieee80211_is_beacon(hdr->frame_control) ||
599 ieee80211_is_auth(hdr->frame_control))
a7767f95
HH		 600 return RX_CONTINUE;
601
602 return RX_DROP_MONITOR;
a7767f95
HH		 603 }
604
902acc78
JB		 605 return RX_CONTINUE;
606}
33b64eb2 607
1edfb1af
JB		 608#define SEQ_MODULO 0x1000
609#define SEQ_MASK 0xfff
610
611static inline int seq_less(u16 sq1, u16 sq2)
612{
613 return ((sq1 - sq2) & SEQ_MASK) > (SEQ_MODULO >> 1);
614}
615
616static inline u16 seq_inc(u16 sq)
617{
618 return (sq + 1) & SEQ_MASK;
619}
620
621static inline u16 seq_sub(u16 sq1, u16 sq2)
622{
623 return (sq1 - sq2) & SEQ_MASK;
624}
625
d3b2fb53 626static void ieee80211_release_reorder_frame(struct ieee80211_sub_if_data *sdata,
1edfb1af 627 struct tid_ampdu_rx *tid_agg_rx,
24a8fdad 628 int index)
1edfb1af 629{
d3b2fb53 630 struct ieee80211_local *local = sdata->local;
1edfb1af 631 struct sk_buff *skb = tid_agg_rx->reorder_buf[index];
4cfda47b 632 struct ieee80211_rx_status *status;
1edfb1af 633
dd318575
JB		 634 lockdep_assert_held(&tid_agg_rx->reorder_lock);
635
1edfb1af
JB		 636 if (!skb)
637 goto no_frame;
638
071d9ac2 639 /* release the frame from the reorder ring buffer */
1edfb1af
JB		 640 tid_agg_rx->stored_mpdu_num--;
641 tid_agg_rx->reorder_buf[index] = NULL;
4cfda47b
CL		 642 status = IEEE80211_SKB_RXCB(skb);
643 status->rx_flags |= IEEE80211_RX_DEFERRED_RELEASE;
24a8fdad 644 skb_queue_tail(&local->rx_skb_queue, skb);
1edfb1af
JB		 645
646no_frame:
647 tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
648}
649
d3b2fb53 650static void ieee80211_release_reorder_frames(struct ieee80211_sub_if_data *sdata,
1edfb1af 651 struct tid_ampdu_rx *tid_agg_rx,
24a8fdad 652 u16 head_seq_num)
1edfb1af
JB		 653{
654 int index;
655
dd318575
JB		 656 lockdep_assert_held(&tid_agg_rx->reorder_lock);
657
1edfb1af
JB		 658 while (seq_less(tid_agg_rx->head_seq_num, head_seq_num)) {
659 index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
660 tid_agg_rx->buf_size;
d3b2fb53 661 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index);
1edfb1af
JB		 662 }
663}
664
665/*
666 * Timeout (in jiffies) for skb's that are waiting in the RX reorder buffer. If
667 * the skb was added to the buffer longer than this time ago, the earlier
668 * frames that have not yet been received are assumed to be lost and the skb
669 * can be released for processing. This may also release other skb's from the
670 * reorder buffer if there are no additional gaps between the frames.
2bff8ebf
CL		 671 *
672 * Callers must hold tid_agg_rx->reorder_lock.
1edfb1af
JB		 673 */
674#define HT_RX_REORDER_BUF_TIMEOUT (HZ / 10)
675
d3b2fb53 676static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata,
24a8fdad 677 struct tid_ampdu_rx *tid_agg_rx)
aa0c8636 678{
2bff8ebf 679 int index, j;
aa0c8636 680
dd318575
JB		 681 lockdep_assert_held(&tid_agg_rx->reorder_lock);
682
aa0c8636
CL		 683 /* release the buffer until next missing frame */
684 index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
685 tid_agg_rx->buf_size;
686 if (!tid_agg_rx->reorder_buf[index] &&
07ae2dfc 687 tid_agg_rx->stored_mpdu_num) {
aa0c8636
CL		 688 /*
689 * No buffers ready to be released, but check whether any
690 * frames in the reorder buffer have timed out.
691 */
aa0c8636
CL		 692 int skipped = 1;
693 for (j = (index + 1) % tid_agg_rx->buf_size; j != index;
694 j = (j + 1) % tid_agg_rx->buf_size) {
695 if (!tid_agg_rx->reorder_buf[j]) {
696 skipped++;
697 continue;
698 }
499fe9a4
DH		 699 if (skipped &&
700 !time_after(jiffies, tid_agg_rx->reorder_time[j] +
aa0c8636 701 HT_RX_REORDER_BUF_TIMEOUT))
2bff8ebf 702 goto set_release_timer;
aa0c8636 703
bdcbd8e0
JB		 704 ht_dbg_ratelimited(sdata,
705 "release an RX reorder frame due to timeout on earlier frames\n");
d3b2fb53 706 ieee80211_release_reorder_frame(sdata, tid_agg_rx, j);
aa0c8636
CL		 707
708 /*
709 * Increment the head seq# also for the skipped slots.
710 */
711 tid_agg_rx->head_seq_num =
712 (tid_agg_rx->head_seq_num + skipped) & SEQ_MASK;
713 skipped = 0;
714 }
715 } else while (tid_agg_rx->reorder_buf[index]) {
d3b2fb53 716 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index);
aa0c8636
CL		 717 index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
718 tid_agg_rx->buf_size;
719 }
2bff8ebf
CL		 720
721 if (tid_agg_rx->stored_mpdu_num) {
722 j = index = seq_sub(tid_agg_rx->head_seq_num,
723 tid_agg_rx->ssn) % tid_agg_rx->buf_size;
724
725 for (; j != (index - 1) % tid_agg_rx->buf_size;
726 j = (j + 1) % tid_agg_rx->buf_size) {
727 if (tid_agg_rx->reorder_buf[j])
728 break;
729 }
730
731 set_release_timer:
732
733 mod_timer(&tid_agg_rx->reorder_timer,
334df731 734 tid_agg_rx->reorder_time[j] + 1 +
2bff8ebf
CL		 735 HT_RX_REORDER_BUF_TIMEOUT);
736 } else {
737 del_timer(&tid_agg_rx->reorder_timer);
738 }
aa0c8636
CL		 739}
740
1edfb1af
JB		 741/*
742 * As this function belongs to the RX path it must be under
743 * rcu_read_lock protection. It returns false if the frame
744 * can be processed immediately, true if it was consumed.
745 */
d3b2fb53 746static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata,
1edfb1af 747 struct tid_ampdu_rx *tid_agg_rx,
24a8fdad 748 struct sk_buff *skb)
1edfb1af
JB		 749{
750 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
751 u16 sc = le16_to_cpu(hdr->seq_ctrl);
752 u16 mpdu_seq_num = (sc & IEEE80211_SCTL_SEQ) >> 4;
753 u16 head_seq_num, buf_size;
754 int index;
2bff8ebf 755 bool ret = true;
1edfb1af 756
dd318575
JB		 757 spin_lock(&tid_agg_rx->reorder_lock);
758
1edfb1af
JB		 759 buf_size = tid_agg_rx->buf_size;
760 head_seq_num = tid_agg_rx->head_seq_num;
761
762 /* frame with out of date sequence number */
763 if (seq_less(mpdu_seq_num, head_seq_num)) {
764 dev_kfree_skb(skb);
2bff8ebf 765 goto out;
1edfb1af
JB		 766 }
767
768 /*
769 * If frame the sequence number exceeds our buffering window
770 * size release some previous frames to make room for this one.
771 */
772 if (!seq_less(mpdu_seq_num, head_seq_num + buf_size)) {
773 head_seq_num = seq_inc(seq_sub(mpdu_seq_num, buf_size));
774 /* release stored frames up to new head to stack */
d3b2fb53
JB		 775 ieee80211_release_reorder_frames(sdata, tid_agg_rx,
776 head_seq_num);
1edfb1af
JB		 777 }
778
779 /* Now the new frame is always in the range of the reordering buffer */
780
781 index = seq_sub(mpdu_seq_num, tid_agg_rx->ssn) % tid_agg_rx->buf_size;
782
783 /* check if we already stored this frame */
784 if (tid_agg_rx->reorder_buf[index]) {
785 dev_kfree_skb(skb);
2bff8ebf 786 goto out;
1edfb1af
JB		 787 }
788
789 /*
790 * If the current MPDU is in the right order and nothing else
791 * is stored we can process it directly, no need to buffer it.
c835b214
JB		 792 * If it is first but there's something stored, we may be able
793 * to release frames after this one.
1edfb1af
JB		 794 */
795 if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
796 tid_agg_rx->stored_mpdu_num == 0) {
797 tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
2bff8ebf
CL		 798 ret = false;
799 goto out;
1edfb1af
JB		 800 }
801
802 /* put the frame in the reordering buffer */
803 tid_agg_rx->reorder_buf[index] = skb;
804 tid_agg_rx->reorder_time[index] = jiffies;
805 tid_agg_rx->stored_mpdu_num++;
d3b2fb53 806 ieee80211_sta_reorder_release(sdata, tid_agg_rx);
1edfb1af 807
2bff8ebf
CL		 808 out:
809 spin_unlock(&tid_agg_rx->reorder_lock);
810 return ret;
1edfb1af
JB		 811}
812
813/*
814 * Reorder MPDUs from A-MPDUs, keeping them on a buffer. Returns
815 * true if the MPDU was buffered, false if it should be processed.
816 */
24a8fdad 817static void ieee80211_rx_reorder_ampdu(struct ieee80211_rx_data *rx)
1edfb1af 818{
2569a826
JB		 819 struct sk_buff *skb = rx->skb;
820 struct ieee80211_local *local = rx->local;
1edfb1af 821 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
660c6a44 822 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2569a826 823 struct sta_info *sta = rx->sta;
1edfb1af
JB		 824 struct tid_ampdu_rx *tid_agg_rx;
825 u16 sc;
6cc00d54 826 u8 tid, ack_policy;
1edfb1af
JB		 827
828 if (!ieee80211_is_data_qos(hdr->frame_control))
2569a826 829 goto dont_reorder;
1edfb1af
JB		 830
831 /*
832 * filter the QoS data rx stream according to
833 * STA/TID and check if this STA/TID is on aggregation
834 */
835
1edfb1af 836 if (!sta)
2569a826 837 goto dont_reorder;
1edfb1af 838
6cc00d54
TP		 839 ack_policy = *ieee80211_get_qos_ctl(hdr) &
840 IEEE80211_QOS_CTL_ACK_POLICY_MASK;
1edfb1af
JB		 841 tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
842
a87f736d
JB		 843 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
844 if (!tid_agg_rx)
845 goto dont_reorder;
1edfb1af
JB		 846
847 /* qos null data frames are excluded */
848 if (unlikely(hdr->frame_control & cpu_to_le16(IEEE80211_STYPE_NULLFUNC)))
a87f736d 849 goto dont_reorder;
1edfb1af 850
6cc00d54
TP		 851 /* not part of a BA session */
852 if (ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_BLOCKACK &&
853 ack_policy != IEEE80211_QOS_CTL_ACK_POLICY_NORMAL)
854 goto dont_reorder;
855
660c6a44
TP		 856 /* not actually part of this BA session */
857 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
858 goto dont_reorder;
859
1edfb1af
JB		 860 /* new, potentially un-ordered, ampdu frame - process it */
861
862 /* reset session timer */
863 if (tid_agg_rx->timeout)
12d3952f 864 tid_agg_rx->last_rx = jiffies;
1edfb1af
JB		 865
866 /* if this mpdu is fragmented - terminate rx aggregation session */
867 sc = le16_to_cpu(hdr->seq_ctrl);
868 if (sc & IEEE80211_SCTL_FRAG) {
c1475ca9 869 skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
344eec67
JB		 870 skb_queue_tail(&rx->sdata->skb_queue, skb);
871 ieee80211_queue_work(&local->hw, &rx->sdata->work);
2569a826 872 return;
1edfb1af
JB		 873 }
874
a87f736d
JB		 875 /*
876 * No locking needed -- we will only ever process one
877 * RX packet at a time, and thus own tid_agg_rx. All
878 * other code manipulating it needs to (and does) make
879 * sure that we cannot get to it any more before doing
880 * anything with it.
881 */
d3b2fb53 882 if (ieee80211_sta_manage_reorder_buf(rx->sdata, tid_agg_rx, skb))
2569a826
JB		 883 return;
884
885 dont_reorder:
24a8fdad 886 skb_queue_tail(&local->rx_skb_queue, skb);
1edfb1af 887}
33b64eb2 888
49461622 889static ieee80211_rx_result debug_noinline
5cf121c3 890ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
571ecf67 891{
a7767f95 892 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
554891e6 893 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
571ecf67
JB		 894
895 /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
896 if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
a7767f95 897 if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
9e26297a 898 rx->sta->last_seq_ctrl[rx->seqno_idx] ==
571ecf67 899 hdr->seq_ctrl)) {
554891e6 900 if (status->rx_flags & IEEE80211_RX_RA_MATCH) {
571ecf67
JB		 901 rx->local->dot11FrameDuplicateCount++;
902 rx->sta->num_duplicates++;
903 }
b1f93314 904 return RX_DROP_UNUSABLE;
571ecf67 905 } else
9e26297a 906 rx->sta->last_seq_ctrl[rx->seqno_idx] = hdr->seq_ctrl;
571ecf67
JB		 907 }
908
571ecf67
JB		 909 if (unlikely(rx->skb->len < 16)) {
910 I802_DEBUG_INC(rx->local->rx_handlers_drop_short);
e4c26add 911 return RX_DROP_MONITOR;
571ecf67
JB		 912 }
913
571ecf67
JB		 914 /* Drop disallowed frame classes based on STA auth/assoc state;
915 * IEEE 802.11, Chap 5.5.
916 *
ccd7b362
JB		 917 * mac80211 filters only based on association state, i.e. it drops
918 * Class 3 frames from not associated stations. hostapd sends
571ecf67
JB		 919 * deauth/disassoc frames when needed. In addition, hostapd is
920 * responsible for filtering on both auth and assoc states.
921 */
33b64eb2 922
902acc78 923 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
33b64eb2 924 return ieee80211_rx_mesh_check(rx);
33b64eb2 925
a7767f95
HH		 926 if (unlikely((ieee80211_is_data(hdr->frame_control) ||
927 ieee80211_is_pspoll(hdr->frame_control)) &&
05c914fe 928 rx->sdata->vif.type != NL80211_IFTYPE_ADHOC &&
1be7fe8d 929 rx->sdata->vif.type != NL80211_IFTYPE_WDS &&
c2c98fde 930 (!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_ASSOC)))) {
7852e361
JB		 931 /*
932 * accept port control frames from the AP even when it's not
933 * yet marked ASSOC to prevent a race where we don't set the
934 * assoc bit quickly enough before it sends the first frame
935 */
936 if (rx->sta && rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
2a33bee2 937 ieee80211_is_data_present(hdr->frame_control)) {
6dbda2d0
JB		 938 unsigned int hdrlen;
939 __be16 ethertype;
940
941 hdrlen = ieee80211_hdrlen(hdr->frame_control);
942
943 if (rx->skb->len < hdrlen + 8)
944 return RX_DROP_MONITOR;
945
946 skb_copy_bits(rx->skb, hdrlen + 6, &ethertype, 2);
947 if (ethertype == rx->sdata->control_port_protocol)
2a33bee2
GE		 948 return RX_CONTINUE;
949 }
21fc7560
JB		 950
951 if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
952 cfg80211_rx_spurious_frame(rx->sdata->dev,
953 hdr->addr2,
954 GFP_ATOMIC))
955 return RX_DROP_UNUSABLE;
956
e4c26add 957 return RX_DROP_MONITOR;
2a33bee2 958 }
571ecf67 959
9ae54c84 960 return RX_CONTINUE;
570bd537
JB		 961}
962
963
49461622 964static ieee80211_rx_result debug_noinline
5cf121c3 965ieee80211_rx_h_decrypt(struct ieee80211_rx_data *rx)
570bd537 966{
eb9fb5b8
JB		 967 struct sk_buff *skb = rx->skb;
968 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
969 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
3017b80b
JB		 970 int keyidx;
971 int hdrlen;
e4c26add 972 ieee80211_rx_result result = RX_DROP_UNUSABLE;
e31b8213 973 struct ieee80211_key *sta_ptk = NULL;
3cfcf6ac 974 int mmie_keyidx = -1;
761ab470 975 __le16 fc;
570bd537 976
3017b80b
JB		 977 /*
978 * Key selection 101
979 *
3cfcf6ac 980 * There are four types of keys:
3017b80b 981 * - GTK (group keys)
3cfcf6ac 982 * - IGTK (group keys for management frames)
3017b80b
JB		 983 * - PTK (pairwise keys)
984 * - STK (station-to-station pairwise keys)
985 *
986 * When selecting a key, we have to distinguish between multicast
987 * (including broadcast) and unicast frames, the latter can only
3cfcf6ac
JM		 988 * use PTKs and STKs while the former always use GTKs and IGTKs.
989 * Unless, of course, actual WEP keys ("pre-RSNA") are used, then
990 * unicast frames can also use key indices like GTKs. Hence, if we
991 * don't have a PTK/STK we check the key index for a WEP key.
3017b80b 992 *
8dc06a1c
JB		 993 * Note that in a regular BSS, multicast frames are sent by the
994 * AP only, associated stations unicast the frame to the AP first
995 * which then multicasts it on their behalf.
996 *
3017b80b
JB		 997 * There is also a slight problem in IBSS mode: GTKs are negotiated
998 * with each station, that is something we don't currently handle.
8dc06a1c
JB		 999 * The spec seems to expect that one negotiates the same key with
1000 * every station but there's no such requirement; VLANs could be
1001 * possible.
3017b80b
JB		 1002 */
1003
3017b80b 1004 /*
1990af8d 1005 * No point in finding a key and decrypting if the frame is neither
3017b80b
JB		 1006 * addressed to us nor a multicast frame.
1007 */
554891e6 1008 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
9ae54c84 1009 return RX_CONTINUE;
3017b80b 1010
2569a826
JB		 1011 /* start without a key */
1012 rx->key = NULL;
1013
d4e46a3d 1014 if (rx->sta)
e31b8213 1015 sta_ptk = rcu_dereference(rx->sta->ptk);
d4e46a3d 1016
761ab470
JB		 1017 fc = hdr->frame_control;
1018
1019 if (!ieee80211_has_protected(fc))
0c7c10c7
JM		 1020 mmie_keyidx = ieee80211_get_mmie_keyidx(rx->skb);
1021
e31b8213
JB		 1022 if (!is_multicast_ether_addr(hdr->addr1) && sta_ptk) {
1023 rx->key = sta_ptk;
dc1580dd
JB		 1024 if ((status->flag & RX_FLAG_DECRYPTED) &&
1025 (status->flag & RX_FLAG_IV_STRIPPED))
1026 return RX_CONTINUE;
0c7c10c7 1027 /* Skip decryption if the frame is not protected. */
761ab470 1028 if (!ieee80211_has_protected(fc))
0c7c10c7 1029 return RX_CONTINUE;
3cfcf6ac
JM		 1030 } else if (mmie_keyidx >= 0) {
1031 /* Broadcast/multicast robust management frame / BIP */
eb9fb5b8
JB		 1032 if ((status->flag & RX_FLAG_DECRYPTED) &&
1033 (status->flag & RX_FLAG_IV_STRIPPED))
3cfcf6ac
JM		 1034 return RX_CONTINUE;
1035
1036 if (mmie_keyidx < NUM_DEFAULT_KEYS ||
1037 mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS)
1038 return RX_DROP_MONITOR; /* unexpected BIP keyidx */
e31b8213
JB		 1039 if (rx->sta)
1040 rx->key = rcu_dereference(rx->sta->gtk[mmie_keyidx]);
1041 if (!rx->key)
1042 rx->key = rcu_dereference(rx->sdata->keys[mmie_keyidx]);
761ab470 1043 } else if (!ieee80211_has_protected(fc)) {
0c7c10c7
JM		 1044 /*
1045 * The frame was not protected, so skip decryption. However, we
1046 * need to set rx->key if there is a key that could have been
1047 * used so that the frame may be dropped if encryption would
1048 * have been expected.
1049 */
1050 struct ieee80211_key *key = NULL;
897bed8b
JB		 1051 struct ieee80211_sub_if_data *sdata = rx->sdata;
1052 int i;
1053
761ab470 1054 if (ieee80211_is_mgmt(fc) &&
0c7c10c7
JM		 1055 is_multicast_ether_addr(hdr->addr1) &&
1056 (key = rcu_dereference(rx->sdata->default_mgmt_key)))
1057 rx->key = key;
897bed8b
JB		 1058 else {
1059 if (rx->sta) {
1060 for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
1061 key = rcu_dereference(rx->sta->gtk[i]);
1062 if (key)
1063 break;
1064 }
1065 }
1066 if (!key) {
1067 for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
1068 key = rcu_dereference(sdata->keys[i]);
1069 if (key)
1070 break;
1071 }
1072 }
1073 if (key)
1074 rx->key = key;
1075 }
0c7c10c7 1076 return RX_CONTINUE;
571ecf67 1077 } else {
39184b15 1078 u8 keyid;
3017b80b
JB		 1079 /*
1080 * The device doesn't give us the IV so we won't be
1081 * able to look up the key. That's ok though, we
1082 * don't need to decrypt the frame, we just won't
1083 * be able to keep statistics accurate.
1084 * Except for key threshold notifications, should
1085 * we somehow allow the driver to tell us which key
1086 * the hardware used if this flag is set?
1087 */
eb9fb5b8
JB		 1088 if ((status->flag & RX_FLAG_DECRYPTED) &&
1089 (status->flag & RX_FLAG_IV_STRIPPED))
9ae54c84 1090 return RX_CONTINUE;
3017b80b 1091
761ab470 1092 hdrlen = ieee80211_hdrlen(fc);
3017b80b
JB		 1093
1094 if (rx->skb->len < 8 + hdrlen)
e4c26add 1095 return RX_DROP_UNUSABLE; /* TODO: count this? */
3017b80b
JB		 1096
1097 /*
1098 * no need to call ieee80211_wep_get_keyidx,
1099 * it verifies a bunch of things we've done already
1100 */
39184b15
ZY		 1101 skb_copy_bits(rx->skb, hdrlen + 3, &keyid, 1);
1102 keyidx = keyid >> 6;
3017b80b 1103
e31b8213
JB		 1104 /* check per-station GTK first, if multicast packet */
1105 if (is_multicast_ether_addr(hdr->addr1) && rx->sta)
1106 rx->key = rcu_dereference(rx->sta->gtk[keyidx]);
3017b80b 1107
e31b8213
JB		 1108 /* if not found, try default key */
1109 if (!rx->key) {
1110 rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
1111
1112 /*
1113 * RSNA-protected unicast frames should always be
1114 * sent with pairwise or station-to-station keys,
1115 * but for WEP we allow using a key index as well.
1116 */
1117 if (rx->key &&
1118 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1119 rx->key->conf.cipher != WLAN_CIPHER_SUITE_WEP104 &&
1120 !is_multicast_ether_addr(hdr->addr1))
1121 rx->key = NULL;
1122 }
571ecf67
JB		 1123 }
1124
3017b80b 1125 if (rx->key) {
95acac61
JB		 1126 if (unlikely(rx->key->flags & KEY_FLAG_TAINTED))
1127 return RX_DROP_MONITOR;
1128
571ecf67 1129 rx->key->tx_rx_count++;
011bfcc4 1130 /* TODO: add threshold stuff again */
1990af8d 1131 } else {
e4c26add 1132 return RX_DROP_MONITOR;
70f08765
JB		 1133 }
1134
97359d12
JB		 1135 switch (rx->key->conf.cipher) {
1136 case WLAN_CIPHER_SUITE_WEP40:
1137 case WLAN_CIPHER_SUITE_WEP104:
e2f036da
MN		 1138 result = ieee80211_crypto_wep_decrypt(rx);
1139 break;
97359d12 1140 case WLAN_CIPHER_SUITE_TKIP:
e2f036da
MN		 1141 result = ieee80211_crypto_tkip_decrypt(rx);
1142 break;
97359d12 1143 case WLAN_CIPHER_SUITE_CCMP:
e2f036da
MN		 1144 result = ieee80211_crypto_ccmp_decrypt(rx);
1145 break;
97359d12 1146 case WLAN_CIPHER_SUITE_AES_CMAC:
3cfcf6ac
JM		 1147 result = ieee80211_crypto_aes_cmac_decrypt(rx);
1148 break;
3ffc2a90
JB		 1149 default:
1150 /*
1151 * We can reach here only with HW-only algorithms
1152 * but why didn't it decrypt the frame?!
1153 */
1154 return RX_DROP_UNUSABLE;
70f08765
JB		 1155 }
1156
a8286911
JB		 1157 /* the hdr variable is invalid after the decrypt handlers */
1158
e2f036da 1159 /* either the frame has been decrypted or will be dropped */
eb9fb5b8 1160 status->flag |= RX_FLAG_DECRYPTED;
e2f036da
MN		 1161
1162 return result;
70f08765
JB		 1163}
1164
572e0012
KV		 1165static ieee80211_rx_result debug_noinline
1166ieee80211_rx_h_check_more_data(struct ieee80211_rx_data *rx)
1167{
1168 struct ieee80211_local *local;
1169 struct ieee80211_hdr *hdr;
1170 struct sk_buff *skb;
1171
1172 local = rx->local;
1173 skb = rx->skb;
1174 hdr = (struct ieee80211_hdr *) skb->data;
1175
1176 if (!local->pspolling)
1177 return RX_CONTINUE;
1178
1179 if (!ieee80211_has_fromds(hdr->frame_control))
1180 /* this is not from AP */
1181 return RX_CONTINUE;
1182
1183 if (!ieee80211_is_data(hdr->frame_control))
1184 return RX_CONTINUE;
1185
1186 if (!ieee80211_has_moredata(hdr->frame_control)) {
1187 /* AP has no more frames buffered for us */
1188 local->pspolling = false;
1189 return RX_CONTINUE;
1190 }
1191
1192 /* more data bit is set, let's request a new frame from the AP */
1193 ieee80211_send_pspoll(local, rx->sdata);
1194
1195 return RX_CONTINUE;
1196}
1197
d012a605 1198static void sta_ps_start(struct sta_info *sta)
571ecf67 1199{
133b8226 1200 struct ieee80211_sub_if_data *sdata = sta->sdata;
4571d3bf 1201 struct ieee80211_local *local = sdata->local;
d012a605 1202 struct ps_data *ps;
0795af57 1203
d012a605
MP		 1204 if (sta->sdata->vif.type == NL80211_IFTYPE_AP ||
1205 sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
1206 ps = &sdata->bss->ps;
1207 else
1208 return;
1209
1210 atomic_inc(&ps->num_sta_ps);
c2c98fde 1211 set_sta_flag(sta, WLAN_STA_PS_STA);
d057e5a3
AN		 1212 if (!(local->hw.flags & IEEE80211_HW_AP_LINK_PS))
1213 drv_sta_notify(local, sdata, STA_NOTIFY_SLEEP, &sta->sta);
bdcbd8e0
JB		 1214 ps_dbg(sdata, "STA %pM aid %d enters power save mode\n",
1215 sta->sta.addr, sta->sta.aid);
571ecf67
JB		 1216}
1217
d012a605 1218static void sta_ps_end(struct sta_info *sta)
571ecf67 1219{
bdcbd8e0
JB		 1220 ps_dbg(sta->sdata, "STA %pM aid %d exits power save mode\n",
1221 sta->sta.addr, sta->sta.aid);
004c872e 1222
c2c98fde 1223 if (test_sta_flag(sta, WLAN_STA_PS_DRIVER)) {
bdcbd8e0
JB		 1224 ps_dbg(sta->sdata, "STA %pM aid %d driver-ps-blocked\n",
1225 sta->sta.addr, sta->sta.aid);
af818581
JB		 1226 return;
1227 }
1228
1229 ieee80211_sta_ps_deliver_wakeup(sta);
571ecf67
JB		 1230}
1231
d057e5a3
AN		 1232int ieee80211_sta_ps_transition(struct ieee80211_sta *sta, bool start)
1233{
1234 struct sta_info *sta_inf = container_of(sta, struct sta_info, sta);
1235 bool in_ps;
1236
1237 WARN_ON(!(sta_inf->local->hw.flags & IEEE80211_HW_AP_LINK_PS));
1238
1239 /* Don't let the same PS state be set twice */
c2c98fde 1240 in_ps = test_sta_flag(sta_inf, WLAN_STA_PS_STA);
d057e5a3
AN		 1241 if ((start && in_ps) || (!start && !in_ps))
1242 return -EINVAL;
1243
1244 if (start)
d012a605 1245 sta_ps_start(sta_inf);
d057e5a3 1246 else
d012a605 1247 sta_ps_end(sta_inf);
d057e5a3
AN		 1248
1249 return 0;
1250}
1251EXPORT_SYMBOL(ieee80211_sta_ps_transition);
1252
47086fc5
JB		 1253static ieee80211_rx_result debug_noinline
1254ieee80211_rx_h_uapsd_and_pspoll(struct ieee80211_rx_data *rx)
1255{
1256 struct ieee80211_sub_if_data *sdata = rx->sdata;
1257 struct ieee80211_hdr *hdr = (void *)rx->skb->data;
1258 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
1259 int tid, ac;
1260
1261 if (!rx->sta || !(status->rx_flags & IEEE80211_RX_RA_MATCH))
1262 return RX_CONTINUE;
1263
1264 if (sdata->vif.type != NL80211_IFTYPE_AP &&
1265 sdata->vif.type != NL80211_IFTYPE_AP_VLAN)
1266 return RX_CONTINUE;
1267
1268 /*
1269 * The device handles station powersave, so don't do anything about
1270 * uAPSD and PS-Poll frames (the latter shouldn't even come up from
1271 * it to mac80211 since they're handled.)
1272 */
1273 if (sdata->local->hw.flags & IEEE80211_HW_AP_LINK_PS)
1274 return RX_CONTINUE;
1275
1276 /*
1277 * Don't do anything if the station isn't already asleep. In
1278 * the uAPSD case, the station will probably be marked asleep,
1279 * in the PS-Poll case the station must be confused ...
1280 */
c2c98fde 1281 if (!test_sta_flag(rx->sta, WLAN_STA_PS_STA))
47086fc5
JB		 1282 return RX_CONTINUE;
1283
1284 if (unlikely(ieee80211_is_pspoll(hdr->frame_control))) {
c2c98fde
JB		 1285 if (!test_sta_flag(rx->sta, WLAN_STA_SP)) {
1286 if (!test_sta_flag(rx->sta, WLAN_STA_PS_DRIVER))
deeaee19
JB		 1287 ieee80211_sta_ps_deliver_poll_response(rx->sta);
1288 else
c2c98fde 1289 set_sta_flag(rx->sta, WLAN_STA_PSPOLL);
deeaee19 1290 }
47086fc5
JB		 1291
1292 /* Free PS Poll skb here instead of returning RX_DROP that would
1293 * count as an dropped frame. */
1294 dev_kfree_skb(rx->skb);
1295
1296 return RX_QUEUED;
1297 } else if (!ieee80211_has_morefrags(hdr->frame_control) &&
1298 !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
1299 ieee80211_has_pm(hdr->frame_control) &&
1300 (ieee80211_is_data_qos(hdr->frame_control) ||
1301 ieee80211_is_qos_nullfunc(hdr->frame_control))) {
1302 tid = *ieee80211_get_qos_ctl(hdr) & IEEE80211_QOS_CTL_TID_MASK;
1303 ac = ieee802_1d_to_ac[tid & 7];
1304
1305 /*
1306 * If this AC is not trigger-enabled do nothing.
1307 *
1308 * NB: This could/should check a separate bitmap of trigger-
1309 * enabled queues, but for now we only implement uAPSD w/o
1310 * TSPEC changes to the ACs, so they're always the same.
1311 */
1312 if (!(rx->sta->sta.uapsd_queues & BIT(ac)))
1313 return RX_CONTINUE;
1314
1315 /* if we are in a service period, do nothing */
c2c98fde 1316 if (test_sta_flag(rx->sta, WLAN_STA_SP))
47086fc5
JB		 1317 return RX_CONTINUE;
1318
c2c98fde 1319 if (!test_sta_flag(rx->sta, WLAN_STA_PS_DRIVER))
47086fc5
JB		 1320 ieee80211_sta_ps_deliver_uapsd(rx->sta);
1321 else
c2c98fde 1322 set_sta_flag(rx->sta, WLAN_STA_UAPSD);
47086fc5
JB		 1323 }
1324
1325 return RX_CONTINUE;
1326}
1327
49461622 1328static ieee80211_rx_result debug_noinline
5cf121c3 1329ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
571ecf67
JB		 1330{
1331 struct sta_info *sta = rx->sta;
eb9fb5b8
JB		 1332 struct sk_buff *skb = rx->skb;
1333 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1334 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
571ecf67
JB		 1335
1336 if (!sta)
9ae54c84 1337 return RX_CONTINUE;
571ecf67 1338
b291ba11
JB		 1339 /*
1340 * Update last_rx only for IBSS packets which are for the current
1341 * BSSID to avoid keeping the current IBSS network alive in cases
1342 * where other STAs start using different BSSID.
1343 */
05c914fe 1344 if (rx->sdata->vif.type == NL80211_IFTYPE_ADHOC) {
71364716 1345 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len,
05c914fe 1346 NL80211_IFTYPE_ADHOC);
b203ca39 1347 if (ether_addr_equal(bssid, rx->sdata->u.ibss.bssid)) {
571ecf67 1348 sta->last_rx = jiffies;
3af6334c
FF		 1349 if (ieee80211_is_data(hdr->frame_control)) {
1350 sta->last_rx_rate_idx = status->rate_idx;
1351 sta->last_rx_rate_flag = status->flag;
1352 }
1353 }
b291ba11
JB		 1354 } else if (!is_multicast_ether_addr(hdr->addr1)) {
1355 /*
33b64eb2
LCC		 1356 * Mesh beacons will update last_rx when if they are found to
1357 * match the current local configuration when processed.
571ecf67 1358 */
b291ba11 1359 sta->last_rx = jiffies;
3af6334c
FF		 1360 if (ieee80211_is_data(hdr->frame_control)) {
1361 sta->last_rx_rate_idx = status->rate_idx;
1362 sta->last_rx_rate_flag = status->flag;
1363 }
571ecf67
JB		 1364 }
1365
554891e6 1366 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
9ae54c84 1367 return RX_CONTINUE;
571ecf67 1368
3cf335d5
KV		 1369 if (rx->sdata->vif.type == NL80211_IFTYPE_STATION)
1370 ieee80211_sta_rx_notify(rx->sdata, hdr);
1371
571ecf67
JB		 1372 sta->rx_fragments++;
1373 sta->rx_bytes += rx->skb->len;
fe8431f8
FF		 1374 if (!(status->flag & RX_FLAG_NO_SIGNAL_VAL)) {
1375 sta->last_signal = status->signal;
1376 ewma_add(&sta->avg_signal, -status->signal);
1377 }
571ecf67 1378
72eaa43a
JB		 1379 /*
1380 * Change STA power saving mode only at the end of a frame
1381 * exchange sequence.
1382 */
d057e5a3
AN		 1383 if (!(sta->local->hw.flags & IEEE80211_HW_AP_LINK_PS) &&
1384 !ieee80211_has_morefrags(hdr->frame_control) &&
4cfda47b 1385 !(status->rx_flags & IEEE80211_RX_DEFERRED_RELEASE) &&
05c914fe
JB		 1386 (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1387 rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN)) {
c2c98fde 1388 if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
72eaa43a
JB		 1389 /*
1390 * Ignore doze->wake transitions that are
1391 * indicated by non-data frames, the standard
1392 * is unclear here, but for example going to
1393 * PS mode and then scanning would cause a
1394 * doze->wake transition for the probe request,
1395 * and that is clearly undesirable.
1396 */
1397 if (ieee80211_is_data(hdr->frame_control) &&
1398 !ieee80211_has_pm(hdr->frame_control))
d012a605 1399 sta_ps_end(sta);
72eaa43a
JB		 1400 } else {
1401 if (ieee80211_has_pm(hdr->frame_control))
d012a605 1402 sta_ps_start(sta);
72eaa43a 1403 }
571ecf67
JB		 1404 }
1405
22403def
JB		 1406 /*
1407 * Drop (qos-)data::nullfunc frames silently, since they
1408 * are used only to control station power saving mode.
1409 */
1410 if (ieee80211_is_nullfunc(hdr->frame_control) ||
1411 ieee80211_is_qos_nullfunc(hdr->frame_control)) {
571ecf67 1412 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
d524215f
FF		 1413
1414 /*
1415 * If we receive a 4-addr nullfunc frame from a STA
e7f4a940
JB		 1416 * that was not moved to a 4-addr STA vlan yet send
1417 * the event to userspace and for older hostapd drop
1418 * the frame to the monitor interface.
d524215f
FF		 1419 */
1420 if (ieee80211_has_a4(hdr->frame_control) &&
1421 (rx->sdata->vif.type == NL80211_IFTYPE_AP ||
1422 (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
e7f4a940
JB		 1423 !rx->sdata->u.vlan.sta))) {
1424 if (!test_and_set_sta_flag(sta, WLAN_STA_4ADDR_EVENT))
1425 cfg80211_rx_unexpected_4addr_frame(
1426 rx->sdata->dev, sta->sta.addr,
1427 GFP_ATOMIC);
d524215f 1428 return RX_DROP_MONITOR;
e7f4a940 1429 }
22403def
JB		 1430 /*
1431 * Update counter and free packet here to avoid
1432 * counting this as a dropped packed.
1433 */
571ecf67
JB		 1434 sta->rx_packets++;
1435 dev_kfree_skb(rx->skb);
9ae54c84 1436 return RX_QUEUED;
571ecf67
JB		 1437 }
1438
9ae54c84 1439 return RX_CONTINUE;
571ecf67
JB		 1440} /* ieee80211_rx_h_sta_process */
1441
571ecf67
JB		 1442static inline struct ieee80211_fragment_entry *
1443ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
1444 unsigned int frag, unsigned int seq, int rx_queue,
1445 struct sk_buff **skb)
1446{
1447 struct ieee80211_fragment_entry *entry;
571ecf67 1448
571ecf67
JB		 1449 entry = &sdata->fragments[sdata->fragment_next++];
1450 if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
1451 sdata->fragment_next = 0;
1452
bdcbd8e0 1453 if (!skb_queue_empty(&entry->skb_list))
571ecf67 1454 __skb_queue_purge(&entry->skb_list);
571ecf67
JB		 1455
1456 __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
1457 *skb = NULL;
1458 entry->first_frag_time = jiffies;
1459 entry->seq = seq;
1460 entry->rx_queue = rx_queue;
1461 entry->last_frag = frag;
1462 entry->ccmp = 0;
1463 entry->extra_len = 0;
1464
1465 return entry;
1466}
1467
1468static inline struct ieee80211_fragment_entry *
1469ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
b73d70ad 1470 unsigned int frag, unsigned int seq,
571ecf67
JB		 1471 int rx_queue, struct ieee80211_hdr *hdr)
1472{
1473 struct ieee80211_fragment_entry *entry;
1474 int i, idx;
1475
1476 idx = sdata->fragment_next;
1477 for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
1478 struct ieee80211_hdr *f_hdr;
571ecf67
JB		 1479
1480 idx--;
1481 if (idx < 0)
1482 idx = IEEE80211_FRAGMENT_MAX - 1;
1483
1484 entry = &sdata->fragments[idx];
1485 if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
1486 entry->rx_queue != rx_queue ||
1487 entry->last_frag + 1 != frag)
1488 continue;
1489
b73d70ad 1490 f_hdr = (struct ieee80211_hdr *)entry->skb_list.next->data;
571ecf67 1491
b73d70ad
HH		 1492 /*
1493 * Check ftype and addresses are equal, else check next fragment
1494 */
1495 if (((hdr->frame_control ^ f_hdr->frame_control) &
1496 cpu_to_le16(IEEE80211_FCTL_FTYPE)) ||
b203ca39
JP		 1497 !ether_addr_equal(hdr->addr1, f_hdr->addr1) ||
1498 !ether_addr_equal(hdr->addr2, f_hdr->addr2))
571ecf67
JB		 1499 continue;
1500
ab46623e 1501 if (time_after(jiffies, entry->first_frag_time + 2 * HZ)) {
571ecf67
JB		 1502 __skb_queue_purge(&entry->skb_list);
1503 continue;
1504 }
1505 return entry;
1506 }
1507
1508 return NULL;
1509}
1510
49461622 1511static ieee80211_rx_result debug_noinline
5cf121c3 1512ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
571ecf67
JB		 1513{
1514 struct ieee80211_hdr *hdr;
1515 u16 sc;
358c8d9d 1516 __le16 fc;
571ecf67
JB		 1517 unsigned int frag, seq;
1518 struct ieee80211_fragment_entry *entry;
1519 struct sk_buff *skb;
554891e6 1520 struct ieee80211_rx_status *status;
571ecf67 1521
b73d70ad 1522 hdr = (struct ieee80211_hdr *)rx->skb->data;
358c8d9d 1523 fc = hdr->frame_control;
f7fbf70e
JC		 1524
1525 if (ieee80211_is_ctl(fc))
1526 return RX_CONTINUE;
1527
571ecf67
JB		 1528 sc = le16_to_cpu(hdr->seq_ctrl);
1529 frag = sc & IEEE80211_SCTL_FRAG;
1530
358c8d9d 1531 if (likely((!ieee80211_has_morefrags(fc) && frag == 0) ||
571ecf67
JB		 1532 is_multicast_ether_addr(hdr->addr1))) {
1533 /* not fragmented */
1534 goto out;
1535 }
1536 I802_DEBUG_INC(rx->local->rx_handlers_fragments);
1537
e3cf8b3f
ZY		 1538 if (skb_linearize(rx->skb))
1539 return RX_DROP_UNUSABLE;
1540
058897a4
AK		 1541 /*
1542 * skb_linearize() might change the skb->data and
1543 * previously cached variables (in this case, hdr) need to
1544 * be refreshed with the new data.
1545 */
1546 hdr = (struct ieee80211_hdr *)rx->skb->data;
571ecf67
JB		 1547 seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
1548
1549 if (frag == 0) {
1550 /* This is the first fragment of a new frame. */
1551 entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
9e26297a 1552 rx->seqno_idx, &(rx->skb));
97359d12 1553 if (rx->key && rx->key->conf.cipher == WLAN_CIPHER_SUITE_CCMP &&
358c8d9d 1554 ieee80211_has_protected(fc)) {
9e26297a 1555 int queue = rx->security_idx;
571ecf67
JB		 1556 /* Store CCMP PN so that we can verify that the next
1557 * fragment has a sequential PN value. */
1558 entry->ccmp = 1;
1559 memcpy(entry->last_pn,
9190252c 1560 rx->key->u.ccmp.rx_pn[queue],
571ecf67
JB		 1561 CCMP_PN_LEN);
1562 }
9ae54c84 1563 return RX_QUEUED;
571ecf67
JB		 1564 }
1565
1566 /* This is a fragment for a frame that should already be pending in
1567 * fragment cache. Add this fragment to the end of the pending entry.
1568 */
9e26297a
JB		 1569 entry = ieee80211_reassemble_find(rx->sdata, frag, seq,
1570 rx->seqno_idx, hdr);
571ecf67
JB		 1571 if (!entry) {
1572 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
e4c26add 1573 return RX_DROP_MONITOR;
571ecf67
JB		 1574 }
1575
1576 /* Verify that MPDUs within one MSDU have sequential PN values.
1577 * (IEEE 802.11i, 8.3.3.4.5) */
1578 if (entry->ccmp) {
1579 int i;
1580 u8 pn[CCMP_PN_LEN], *rpn;
9190252c 1581 int queue;
97359d12 1582 if (!rx->key || rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP)
e4c26add 1583 return RX_DROP_UNUSABLE;
571ecf67
JB		 1584 memcpy(pn, entry->last_pn, CCMP_PN_LEN);
1585 for (i = CCMP_PN_LEN - 1; i >= 0; i--) {
1586 pn[i]++;
1587 if (pn[i])
1588 break;
1589 }
9e26297a 1590 queue = rx->security_idx;
9190252c 1591 rpn = rx->key->u.ccmp.rx_pn[queue];
f4ea83dd 1592 if (memcmp(pn, rpn, CCMP_PN_LEN))
e4c26add 1593 return RX_DROP_UNUSABLE;
571ecf67
JB		 1594 memcpy(entry->last_pn, pn, CCMP_PN_LEN);
1595 }
1596
358c8d9d 1597 skb_pull(rx->skb, ieee80211_hdrlen(fc));
571ecf67
JB		 1598 __skb_queue_tail(&entry->skb_list, rx->skb);
1599 entry->last_frag = frag;
1600 entry->extra_len += rx->skb->len;
358c8d9d 1601 if (ieee80211_has_morefrags(fc)) {
571ecf67 1602 rx->skb = NULL;
9ae54c84 1603 return RX_QUEUED;
571ecf67
JB		 1604 }
1605
1606 rx->skb = __skb_dequeue(&entry->skb_list);
1607 if (skb_tailroom(rx->skb) < entry->extra_len) {
1608 I802_DEBUG_INC(rx->local->rx_expand_skb_head2);
1609 if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
1610 GFP_ATOMIC))) {
1611 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
1612 __skb_queue_purge(&entry->skb_list);
e4c26add 1613 return RX_DROP_UNUSABLE;
571ecf67
JB		 1614 }
1615 }
1616 while ((skb = __skb_dequeue(&entry->skb_list))) {
1617 memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len);
1618 dev_kfree_skb(skb);
1619 }
1620
1621 /* Complete frame has been reassembled - process it now */
554891e6
JB		 1622 status = IEEE80211_SKB_RXCB(rx->skb);
1623 status->rx_flags |= IEEE80211_RX_FRAGMENTED;
571ecf67
JB		 1624
1625 out:
1626 if (rx->sta)
1627 rx->sta->rx_packets++;
1628 if (is_multicast_ether_addr(hdr->addr1))
1629 rx->local->dot11MulticastReceivedFrameCount++;
1630 else
1631 ieee80211_led_rx(rx->local);
9ae54c84 1632 return RX_CONTINUE;
571ecf67
JB		 1633}
1634
1df332e8 1635static int ieee80211_802_1x_port_control(struct ieee80211_rx_data *rx)
571ecf67 1636{
1df332e8 1637 if (unlikely(!rx->sta || !test_sta_flag(rx->sta, WLAN_STA_AUTHORIZED)))
76ee65bf 1638 return -EACCES;
571ecf67 1639
76ee65bf 1640 return 0;
571ecf67
JB		 1641}
1642
1df332e8 1643static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
571ecf67 1644{
eb9fb5b8
JB		 1645 struct sk_buff *skb = rx->skb;
1646 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
1647
3017b80b 1648 /*
7848ba7d
JB		 1649 * Pass through unencrypted frames if the hardware has
1650 * decrypted them already.
3017b80b 1651 */
eb9fb5b8 1652 if (status->flag & RX_FLAG_DECRYPTED)
76ee65bf 1653 return 0;
571ecf67
JB		 1654
1655 /* Drop unencrypted frames if key is set. */
358c8d9d
HH		 1656 if (unlikely(!ieee80211_has_protected(fc) &&
1657 !ieee80211_is_nullfunc(fc) &&
f2ca3ea4 1658 ieee80211_is_data(fc) &&
b3fc9c6c 1659 (rx->key || rx->sdata->drop_unencrypted)))
76ee65bf 1660 return -EACCES;
bef5d1c7
JB		 1661
1662 return 0;
1663}
1664
1df332e8 1665static int ieee80211_drop_unencrypted_mgmt(struct ieee80211_rx_data *rx)
bef5d1c7
JB		 1666{
1667 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
e3efca0a 1668 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
bef5d1c7 1669 __le16 fc = hdr->frame_control;
bef5d1c7 1670
e3efca0a
JM		 1671 /*
1672 * Pass through unencrypted frames if the hardware has
1673 * decrypted them already.
1674 */
1675 if (status->flag & RX_FLAG_DECRYPTED)
1676 return 0;
bef5d1c7 1677
c2c98fde 1678 if (rx->sta && test_sta_flag(rx->sta, WLAN_STA_MFP)) {
d211e90e
JM		 1679 if (unlikely(!ieee80211_has_protected(fc) &&
1680 ieee80211_is_unicast_robust_mgmt_frame(rx->skb) &&
cf4e594e
JM		 1681 rx->key)) {
1682 if (ieee80211_is_deauth(fc))
1683 cfg80211_send_unprot_deauth(rx->sdata->dev,
1684 rx->skb->data,
1685 rx->skb->len);
1686 else if (ieee80211_is_disassoc(fc))
1687 cfg80211_send_unprot_disassoc(rx->sdata->dev,
1688 rx->skb->data,
1689 rx->skb->len);
f2ca3ea4 1690 return -EACCES;
cf4e594e 1691 }
f2ca3ea4 1692 /* BIP does not use Protected field, so need to check MMIE */
f64f9e71 1693 if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
cf4e594e
JM		 1694 ieee80211_get_mmie_keyidx(rx->skb) < 0)) {
1695 if (ieee80211_is_deauth(fc))
1696 cfg80211_send_unprot_deauth(rx->sdata->dev,
1697 rx->skb->data,
1698 rx->skb->len);
1699 else if (ieee80211_is_disassoc(fc))
1700 cfg80211_send_unprot_disassoc(rx->sdata->dev,
1701 rx->skb->data,
1702 rx->skb->len);
f2ca3ea4 1703 return -EACCES;
cf4e594e 1704 }
f2ca3ea4
JM		 1705 /*
1706 * When using MFP, Action frames are not allowed prior to
1707 * having configured keys.
1708 */
1709 if (unlikely(ieee80211_is_action(fc) && !rx->key &&
1710 ieee80211_is_robust_mgmt_frame(
1711 (struct ieee80211_hdr *) rx->skb->data)))
1712 return -EACCES;
1713 }
b3fc9c6c 1714
76ee65bf 1715 return 0;
571ecf67
JB		 1716}
1717
76ee65bf 1718static int
4114fa21 1719__ieee80211_data_to_8023(struct ieee80211_rx_data *rx, bool *port_control)
571ecf67 1720{
eb9fb5b8 1721 struct ieee80211_sub_if_data *sdata = rx->sdata;
f14543ee 1722 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
fbb327c5
FF		 1723 bool check_port_control = false;
1724 struct ethhdr *ehdr;
1725 int ret;
f14543ee 1726
4114fa21 1727 *port_control = false;
9bc383de
JB		 1728 if (ieee80211_has_a4(hdr->frame_control) &&
1729 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && !sdata->u.vlan.sta)
f14543ee 1730 return -1;
9bc383de 1731
fbb327c5
FF		 1732 if (sdata->vif.type == NL80211_IFTYPE_STATION &&
1733 !!sdata->u.mgd.use_4addr != !!ieee80211_has_a4(hdr->frame_control)) {
1734
1735 if (!sdata->u.mgd.use_4addr)
1736 return -1;
1737 else
1738 check_port_control = true;
1739 }
1740
9bc383de 1741 if (is_multicast_ether_addr(hdr->addr1) &&
fbb327c5 1742 sdata->vif.type == NL80211_IFTYPE_AP_VLAN && sdata->u.vlan.sta)
f14543ee 1743 return -1;
571ecf67 1744
fbb327c5 1745 ret = ieee80211_data_to_8023(rx->skb, sdata->vif.addr, sdata->vif.type);
4114fa21 1746 if (ret < 0)
fbb327c5
FF		 1747 return ret;
1748
1749 ehdr = (struct ethhdr *) rx->skb->data;
4114fa21
FF		 1750 if (ehdr->h_proto == rx->sdata->control_port_protocol)
1751 *port_control = true;
1752 else if (check_port_control)
fbb327c5
FF		 1753 return -1;
1754
1755 return 0;
76ee65bf 1756}
571ecf67 1757
ce3edf6d
JB		 1758/*
1759 * requires that rx->skb is a frame with ethernet header
1760 */
358c8d9d 1761static bool ieee80211_frame_allowed(struct ieee80211_rx_data *rx, __le16 fc)
ce3edf6d 1762{
c97c23e3 1763 static const u8 pae_group_addr[ETH_ALEN] __aligned(2)
ce3edf6d
JB		 1764 = { 0x01, 0x80, 0xC2, 0x00, 0x00, 0x03 };
1765 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
1766
1767 /*
1768 * Allow EAPOL frames to us/the PAE group address regardless
1769 * of whether the frame was encrypted or not.
1770 */
a621fa4d 1771 if (ehdr->h_proto == rx->sdata->control_port_protocol &&
3bc7945e
JP		 1772 (ether_addr_equal(ehdr->h_dest, rx->sdata->vif.addr) ||
1773 ether_addr_equal(ehdr->h_dest, pae_group_addr)))
ce3edf6d
JB		 1774 return true;
1775
1776 if (ieee80211_802_1x_port_control(rx) ||
358c8d9d 1777 ieee80211_drop_unencrypted(rx, fc))
ce3edf6d
JB		 1778 return false;
1779
1780 return true;
1781}
1782
1783/*
1784 * requires that rx->skb is a frame with ethernet header
1785 */
76ee65bf 1786static void
5cf121c3 1787ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
76ee65bf 1788{
eb9fb5b8
JB		 1789 struct ieee80211_sub_if_data *sdata = rx->sdata;
1790 struct net_device *dev = sdata->dev;
76ee65bf 1791 struct sk_buff *skb, *xmit_skb;
ce3edf6d
JB		 1792 struct ethhdr *ehdr = (struct ethhdr *) rx->skb->data;
1793 struct sta_info *dsta;
554891e6 1794 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
571ecf67 1795
76ee65bf
RR		 1796 skb = rx->skb;
1797 xmit_skb = NULL;
571ecf67 1798
05c914fe
JB		 1799 if ((sdata->vif.type == NL80211_IFTYPE_AP ||
1800 sdata->vif.type == NL80211_IFTYPE_AP_VLAN) &&
213cd118 1801 !(sdata->flags & IEEE80211_SDATA_DONT_BRIDGE_PACKETS) &&
554891e6 1802 (status->rx_flags & IEEE80211_RX_RA_MATCH) &&
9bc383de 1803 (sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->u.vlan.sta)) {
ce3edf6d
JB		 1804 if (is_multicast_ether_addr(ehdr->h_dest)) {
1805 /*
1806 * send multicast frames both to higher layers in
1807 * local net stack and back to the wireless medium
1808 */
76ee65bf 1809 xmit_skb = skb_copy(skb, GFP_ATOMIC);
e87cc472 1810 if (!xmit_skb)
bdcbd8e0 1811 net_info_ratelimited("%s: failed to clone multicast frame\n",
e87cc472 1812 dev->name);
571ecf67 1813 } else {
abe60632
JB		 1814 dsta = sta_info_get(sdata, skb->data);
1815 if (dsta) {
ce3edf6d
JB		 1816 /*
1817 * The destination station is associated to
1818 * this AP (in this VLAN), so send the frame
1819 * directly to it and do not pass it to local
1820 * net stack.
571ecf67 1821 */
76ee65bf 1822 xmit_skb = skb;
571ecf67
JB		 1823 skb = NULL;
1824 }
571ecf67
JB		 1825 }
1826 }
1827
1828 if (skb) {
d1c3a37c
JB		 1829 int align __maybe_unused;
1830
59d9cb07 1831#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
d1c3a37c
JB		 1832 /*
1833 * 'align' will only take the values 0 or 2 here
1834 * since all frames are required to be aligned
1835 * to 2-byte boundaries when being passed to
1836 * mac80211. That also explains the __skb_push()
1837 * below.
1838 */
dacb6f1d 1839 align = ((unsigned long)(skb->data + sizeof(struct ethhdr))) & 3;
d1c3a37c
JB		 1840 if (align) {
1841 if (WARN_ON(skb_headroom(skb) < 3)) {
1842 dev_kfree_skb(skb);
1843 skb = NULL;
1844 } else {
1845 u8 *data = skb->data;
8ce0b589
ZY		 1846 size_t len = skb_headlen(skb);
1847 skb->data -= align;
1848 memmove(skb->data, data, len);
1849 skb_set_tail_pointer(skb, len);
d1c3a37c
JB		 1850 }
1851 }
1852#endif
1853
1854 if (skb) {
1855 /* deliver to local stack */
1856 skb->protocol = eth_type_trans(skb, dev);
1857 memset(skb->cb, 0, sizeof(skb->cb));
5548a8a1 1858 netif_receive_skb(skb);
d1c3a37c 1859 }
571ecf67
JB		 1860 }
1861
76ee65bf 1862 if (xmit_skb) {
aef6c928
HS		 1863 /*
1864 * Send to wireless media and increase priority by 256 to
1865 * keep the received priority instead of reclassifying
1866 * the frame (see cfg80211_classify8021d).
1867 */
1868 xmit_skb->priority += 256;
f831e909 1869 xmit_skb->protocol = htons(ETH_P_802_3);
ce3edf6d
JB		 1870 skb_reset_network_header(xmit_skb);
1871 skb_reset_mac_header(xmit_skb);
76ee65bf 1872 dev_queue_xmit(xmit_skb);
571ecf67 1873 }
76ee65bf
RR		 1874}
1875
49461622 1876static ieee80211_rx_result debug_noinline
5cf121c3 1877ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
fd4c7f2f 1878{
eb9fb5b8 1879 struct net_device *dev = rx->sdata->dev;
eaf85ca7 1880 struct sk_buff *skb = rx->skb;
358c8d9d
HH		 1881 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
1882 __le16 fc = hdr->frame_control;
eaf85ca7 1883 struct sk_buff_head frame_list;
554891e6 1884 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
fd4c7f2f 1885
358c8d9d 1886 if (unlikely(!ieee80211_is_data(fc)))
9ae54c84 1887 return RX_CONTINUE;
fd4c7f2f 1888
358c8d9d 1889 if (unlikely(!ieee80211_is_data_present(fc)))
e4c26add 1890 return RX_DROP_MONITOR;
fd4c7f2f 1891
554891e6 1892 if (!(status->rx_flags & IEEE80211_RX_AMSDU))
9ae54c84 1893 return RX_CONTINUE;
fd4c7f2f 1894
eaf85ca7
ZY		 1895 if (ieee80211_has_a4(hdr->frame_control) &&
1896 rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1897 !rx->sdata->u.vlan.sta)
e4c26add 1898 return RX_DROP_UNUSABLE;
fd4c7f2f 1899
eaf85ca7
ZY		 1900 if (is_multicast_ether_addr(hdr->addr1) &&
1901 ((rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
1902 rx->sdata->u.vlan.sta) ||
1903 (rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
1904 rx->sdata->u.mgd.use_4addr)))
e4c26add 1905 return RX_DROP_UNUSABLE;
fd4c7f2f 1906
eaf85ca7
ZY		 1907 skb->dev = dev;
1908 __skb_queue_head_init(&frame_list);
fd4c7f2f 1909
e3cf8b3f
ZY		 1910 if (skb_linearize(skb))
1911 return RX_DROP_UNUSABLE;
1912
eaf85ca7
ZY		 1913 ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
1914 rx->sdata->vif.type,
8b3becad 1915 rx->local->hw.extra_tx_headroom, true);
fd4c7f2f 1916
eaf85ca7
ZY		 1917 while (!skb_queue_empty(&frame_list)) {
1918 rx->skb = __skb_dequeue(&frame_list);
fd4c7f2f 1919
358c8d9d 1920 if (!ieee80211_frame_allowed(rx, fc)) {
eaf85ca7 1921 dev_kfree_skb(rx->skb);
ce3edf6d
JB		 1922 continue;
1923 }
eaf85ca7
ZY		 1924 dev->stats.rx_packets++;
1925 dev->stats.rx_bytes += rx->skb->len;
fd4c7f2f
RR		 1926
1927 ieee80211_deliver_skb(rx);
1928 }
1929
9ae54c84 1930 return RX_QUEUED;
fd4c7f2f
RR		 1931}
1932
bf94e17b 1933#ifdef CONFIG_MAC80211_MESH
b0dee578 1934static ieee80211_rx_result
e32f85f7
LCC		 1935ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
1936{
30789eb6
TP		 1937 struct ieee80211_hdr *fwd_hdr, *hdr;
1938 struct ieee80211_tx_info *info;
e32f85f7 1939 struct ieee80211s_hdr *mesh_hdr;
e32f85f7 1940 struct sk_buff *skb = rx->skb, *fwd_skb;
3b8d81e0 1941 struct ieee80211_local *local = rx->local;
eb9fb5b8 1942 struct ieee80211_sub_if_data *sdata = rx->sdata;
554891e6 1943 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
30789eb6 1944 struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
0cfda851 1945 __le16 reason = cpu_to_le16(WLAN_REASON_MESH_PATH_NOFORWARD);
30789eb6 1946 u16 q, hdrlen;
e32f85f7
LCC		 1947
1948 hdr = (struct ieee80211_hdr *) skb->data;
1949 hdrlen = ieee80211_hdrlen(hdr->frame_control);
9b395bc3
JB		 1950
1951 /* make sure fixed part of mesh header is there, also checks skb len */
1952 if (!pskb_may_pull(rx->skb, hdrlen + 6))
1953 return RX_DROP_MONITOR;
1954
1955 mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
1956
1957 /* make sure full mesh header is there, also checks skb len */
1958 if (!pskb_may_pull(rx->skb,
1959 hdrlen + ieee80211_get_mesh_hdrlen(mesh_hdr)))
1960 return RX_DROP_MONITOR;
1961
1962 /* reload pointers */
1963 hdr = (struct ieee80211_hdr *) skb->data;
e32f85f7
LCC		 1964 mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
1965
2157fdd6
TP		 1966 /* frame is in RMC, don't forward */
1967 if (ieee80211_is_data(hdr->frame_control) &&
1968 is_multicast_ether_addr(hdr->addr1) &&
1969 mesh_rmc_check(hdr->addr3, mesh_hdr, rx->sdata))
1970 return RX_DROP_MONITOR;
1971
555cb715
JC		 1972 if (!ieee80211_is_data(hdr->frame_control) ||
1973 !(status->rx_flags & IEEE80211_RX_RA_MATCH))
e32f85f7
LCC		 1974 return RX_CONTINUE;
1975
1976 if (!mesh_hdr->ttl)
e32f85f7
LCC		 1977 return RX_DROP_MONITOR;
1978
43b7b314 1979 if (mesh_hdr->flags & MESH_FLAGS_AE) {
79617dee 1980 struct mesh_path *mppath;
43b7b314
JC		 1981 char *proxied_addr;
1982 char *mpp_addr;
1983
1984 if (is_multicast_ether_addr(hdr->addr1)) {
1985 mpp_addr = hdr->addr3;
1986 proxied_addr = mesh_hdr->eaddr1;
9b395bc3
JB		 1987 } else if (mesh_hdr->flags & MESH_FLAGS_AE_A5_A6) {
1988 /* has_a4 already checked in ieee80211_rx_mesh_check */
43b7b314
JC		 1989 mpp_addr = hdr->addr4;
1990 proxied_addr = mesh_hdr->eaddr2;
9b395bc3
JB		 1991 } else {
1992 return RX_DROP_MONITOR;
43b7b314 1993 }
79617dee 1994
79617dee 1995 rcu_read_lock();
43b7b314 1996 mppath = mpp_path_lookup(proxied_addr, sdata);
79617dee 1997 if (!mppath) {
43b7b314 1998 mpp_path_add(proxied_addr, mpp_addr, sdata);
79617dee
Y		 1999 } else {
2000 spin_lock_bh(&mppath->state_lock);
b203ca39 2001 if (!ether_addr_equal(mppath->mpp, mpp_addr))
43b7b314 2002 memcpy(mppath->mpp, mpp_addr, ETH_ALEN);
79617dee
Y		 2003 spin_unlock_bh(&mppath->state_lock);
2004 }
2005 rcu_read_unlock();
2006 }
2007
3c5772a5
JC		 2008 /* Frame has reached destination. Don't forward */
2009 if (!is_multicast_ether_addr(hdr->addr1) &&
b203ca39 2010 ether_addr_equal(sdata->vif.addr, hdr->addr3))
e32f85f7
LCC		 2011 return RX_CONTINUE;
2012
00e96dec 2013 q = ieee80211_select_queue_80211(sdata, skb, hdr);
d3c1597b 2014 if (ieee80211_queue_stopped(&local->hw, q)) {
30789eb6 2015 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion);
d3c1597b
TP		 2016 return RX_DROP_MONITOR;
2017 }
2018 skb_set_queue_mapping(skb, q);
e32f85f7 2019
30789eb6
TP		 2020 if (!--mesh_hdr->ttl) {
2021 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl);
2ac64cd1 2022 goto out;
30789eb6
TP		 2023 }
2024
d665508b
CYY		 2025 if (!ifmsh->mshcfg.dot11MeshForwarding)
2026 goto out;
2027
30789eb6
TP		 2028 fwd_skb = skb_copy(skb, GFP_ATOMIC);
2029 if (!fwd_skb) {
bdcbd8e0 2030 net_info_ratelimited("%s: failed to clone mesh frame\n",
e87cc472 2031 sdata->name);
30789eb6
TP		 2032 goto out;
2033 }
2034
2035 fwd_hdr = (struct ieee80211_hdr *) fwd_skb->data;
2036 info = IEEE80211_SKB_CB(fwd_skb);
2037 memset(info, 0, sizeof(*info));
2038 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
2039 info->control.vif = &rx->sdata->vif;
2040 info->control.jiffies = jiffies;
2041 if (is_multicast_ether_addr(fwd_hdr->addr1)) {
2042 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_mcast);
2043 memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
2044 } else if (!mesh_nexthop_lookup(fwd_skb, sdata)) {
2045 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast);
2046 } else {
2047 /* unable to resolve next hop */
2048 mesh_path_error_tx(ifmsh->mshcfg.element_ttl, fwd_hdr->addr3,
1df332e8 2049 0, reason, fwd_hdr->addr2, sdata);
30789eb6 2050 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_no_route);
74b8cc3d 2051 kfree_skb(fwd_skb);
30789eb6 2052 return RX_DROP_MONITOR;
e32f85f7
LCC		 2053 }
2054
30789eb6
TP		 2055 IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
2056 ieee80211_add_pending_skb(local, fwd_skb);
b51aff05 2057 out:
3c5772a5 2058 if (is_multicast_ether_addr(hdr->addr1) ||
eb9fb5b8 2059 sdata->dev->flags & IFF_PROMISC)
e32f85f7
LCC		 2060 return RX_CONTINUE;
2061 else
2062 return RX_DROP_MONITOR;
2063}
bf94e17b 2064#endif
e32f85f7 2065
49461622 2066static ieee80211_rx_result debug_noinline
5cf121c3 2067ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
76ee65bf 2068{
eb9fb5b8 2069 struct ieee80211_sub_if_data *sdata = rx->sdata;
e15276a4 2070 struct ieee80211_local *local = rx->local;
eb9fb5b8 2071 struct net_device *dev = sdata->dev;
358c8d9d
HH		 2072 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
2073 __le16 fc = hdr->frame_control;
4114fa21 2074 bool port_control;
ce3edf6d 2075 int err;
76ee65bf 2076
358c8d9d 2077 if (unlikely(!ieee80211_is_data(hdr->frame_control)))
9ae54c84 2078 return RX_CONTINUE;
76ee65bf 2079
358c8d9d 2080 if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
e4c26add 2081 return RX_DROP_MONITOR;
76ee65bf 2082
f14543ee 2083 /*
e7f4a940
JB		 2084 * Send unexpected-4addr-frame event to hostapd. For older versions,
2085 * also drop the frame to cooked monitor interfaces.
f14543ee
FF		 2086 */
2087 if (ieee80211_has_a4(hdr->frame_control) &&
e7f4a940
JB		 2088 sdata->vif.type == NL80211_IFTYPE_AP) {
2089 if (rx->sta &&
2090 !test_and_set_sta_flag(rx->sta, WLAN_STA_4ADDR_EVENT))
2091 cfg80211_rx_unexpected_4addr_frame(
2092 rx->sdata->dev, rx->sta->sta.addr, GFP_ATOMIC);
f14543ee 2093 return RX_DROP_MONITOR;
e7f4a940 2094 }
f14543ee 2095
4114fa21 2096 err = __ieee80211_data_to_8023(rx, &port_control);
76ee65bf 2097 if (unlikely(err))
e4c26add 2098 return RX_DROP_UNUSABLE;
76ee65bf 2099
358c8d9d 2100 if (!ieee80211_frame_allowed(rx, fc))
e4c26add 2101 return RX_DROP_MONITOR;
ce3edf6d 2102
4114fa21
FF		 2103 if (rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
2104 unlikely(port_control) && sdata->bss) {
2105 sdata = container_of(sdata->bss, struct ieee80211_sub_if_data,
2106 u.ap);
2107 dev = sdata->dev;
2108 rx->sdata = sdata;
2109 }
2110
76ee65bf
RR		 2111 rx->skb->dev = dev;
2112
2113 dev->stats.rx_packets++;
2114 dev->stats.rx_bytes += rx->skb->len;
2115
08ca944e 2116 if (local->ps_sdata && local->hw.conf.dynamic_ps_timeout > 0 &&
8c99f691
RM		 2117 !is_multicast_ether_addr(
2118 ((struct ethhdr *)rx->skb->data)->h_dest) &&
2119 (!local->scanning &&
2120 !test_bit(SDATA_STATE_OFFCHANNEL, &sdata->state))) {
e15276a4
VN		 2121 mod_timer(&local->dynamic_ps_timer, jiffies +
2122 msecs_to_jiffies(local->hw.conf.dynamic_ps_timeout));
2123 }
2124
76ee65bf 2125 ieee80211_deliver_skb(rx);
571ecf67 2126
9ae54c84 2127 return RX_QUEUED;
571ecf67
JB		 2128}
2129
49461622 2130static ieee80211_rx_result debug_noinline
24a8fdad 2131ieee80211_rx_h_ctrl(struct ieee80211_rx_data *rx)
71364716 2132{
71364716 2133 struct sk_buff *skb = rx->skb;
a7767f95 2134 struct ieee80211_bar *bar = (struct ieee80211_bar *)skb->data;
71364716
RR		 2135 struct tid_ampdu_rx *tid_agg_rx;
2136 u16 start_seq_num;
2137 u16 tid;
2138
a7767f95 2139 if (likely(!ieee80211_is_ctl(bar->frame_control)))
9ae54c84 2140 return RX_CONTINUE;
71364716 2141
a7767f95 2142 if (ieee80211_is_back_req(bar->frame_control)) {
8ae5977f
JB		 2143 struct {
2144 __le16 control, start_seq_num;
2145 } __packed bar_data;
2146
71364716 2147 if (!rx->sta)
a02ae758 2148 return RX_DROP_MONITOR;
8ae5977f
JB		 2149
2150 if (skb_copy_bits(skb, offsetof(struct ieee80211_bar, control),
2151 &bar_data, sizeof(bar_data)))
2152 return RX_DROP_MONITOR;
2153
8ae5977f 2154 tid = le16_to_cpu(bar_data.control) >> 12;
a87f736d
JB		 2155
2156 tid_agg_rx = rcu_dereference(rx->sta->ampdu_mlme.tid_rx[tid]);
2157 if (!tid_agg_rx)
a02ae758 2158 return RX_DROP_MONITOR;
71364716 2159
8ae5977f 2160 start_seq_num = le16_to_cpu(bar_data.start_seq_num) >> 4;
71364716
RR		 2161
2162 /* reset session timer */
20ad19d0
JB		 2163 if (tid_agg_rx->timeout)
2164 mod_timer(&tid_agg_rx->session_timer,
2165 TU_TO_EXP_TIME(tid_agg_rx->timeout));
71364716 2166
dd318575 2167 spin_lock(&tid_agg_rx->reorder_lock);
a02ae758 2168 /* release stored frames up to start of BAR */
d3b2fb53
JB		 2169 ieee80211_release_reorder_frames(rx->sdata, tid_agg_rx,
2170 start_seq_num);
dd318575
JB		 2171 spin_unlock(&tid_agg_rx->reorder_lock);
2172
a02ae758
JB		 2173 kfree_skb(skb);
2174 return RX_QUEUED;
71364716
RR		 2175 }
2176
08daecae
JB		 2177 /*
2178 * After this point, we only want management frames,
2179 * so we can drop all remaining control frames to
2180 * cooked monitor interfaces.
2181 */
2182 return RX_DROP_MONITOR;
71364716
RR		 2183}
2184
f4f727a6
JM		 2185static void ieee80211_process_sa_query_req(struct ieee80211_sub_if_data *sdata,
2186 struct ieee80211_mgmt *mgmt,
2187 size_t len)
fea14732
JM		 2188{
2189 struct ieee80211_local *local = sdata->local;
2190 struct sk_buff *skb;
2191 struct ieee80211_mgmt *resp;
2192
b203ca39 2193 if (!ether_addr_equal(mgmt->da, sdata->vif.addr)) {
fea14732
JM		 2194 /* Not to own unicast address */
2195 return;
2196 }
2197
b203ca39
JP		 2198 if (!ether_addr_equal(mgmt->sa, sdata->u.mgd.bssid) ||
2199 !ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid)) {
77fdaa12 2200 /* Not from the current AP or not associated yet. */
fea14732
JM		 2201 return;
2202 }
2203
2204 if (len < 24 + 1 + sizeof(resp->u.action.u.sa_query)) {
2205 /* Too short SA Query request frame */
2206 return;
2207 }
2208
2209 skb = dev_alloc_skb(sizeof(*resp) + local->hw.extra_tx_headroom);
2210 if (skb == NULL)
2211 return;
2212
2213 skb_reserve(skb, local->hw.extra_tx_headroom);
2214 resp = (struct ieee80211_mgmt *) skb_put(skb, 24);
2215 memset(resp, 0, 24);
2216 memcpy(resp->da, mgmt->sa, ETH_ALEN);
47846c9b 2217 memcpy(resp->sa, sdata->vif.addr, ETH_ALEN);
46900298 2218 memcpy(resp->bssid, sdata->u.mgd.bssid, ETH_ALEN);
fea14732
JM		 2219 resp->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
2220 IEEE80211_STYPE_ACTION);
2221 skb_put(skb, 1 + sizeof(resp->u.action.u.sa_query));
2222 resp->u.action.category = WLAN_CATEGORY_SA_QUERY;
2223 resp->u.action.u.sa_query.action = WLAN_ACTION_SA_QUERY_RESPONSE;
2224 memcpy(resp->u.action.u.sa_query.trans_id,
2225 mgmt->u.action.u.sa_query.trans_id,
2226 WLAN_SA_QUERY_TR_ID_LEN);
2227
62ae67be 2228 ieee80211_tx_skb(sdata, skb);
fea14732
JM		 2229}
2230
2e161f78
JB		 2231static ieee80211_rx_result debug_noinline
2232ieee80211_rx_h_mgmt_check(struct ieee80211_rx_data *rx)
2233{
2234 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
554891e6 2235 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2e161f78
JB		 2236
2237 /*
2238 * From here on, look only at management frames.
2239 * Data and control frames are already handled,
2240 * and unknown (reserved) frames are useless.
2241 */
2242 if (rx->skb->len < 24)
2243 return RX_DROP_MONITOR;
2244
2245 if (!ieee80211_is_mgmt(mgmt->frame_control))
2246 return RX_DROP_MONITOR;
2247
ee971924
JB		 2248 if (rx->sdata->vif.type == NL80211_IFTYPE_AP &&
2249 ieee80211_is_beacon(mgmt->frame_control) &&
2250 !(rx->flags & IEEE80211_RX_BEACON_REPORTED)) {
804483e9
JB		 2251 int sig = 0;
2252
2253 if (rx->local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
2254 sig = status->signal;
2255
ee971924
JB		 2256 cfg80211_report_obss_beacon(rx->local->hw.wiphy,
2257 rx->skb->data, rx->skb->len,
37c73b5f 2258 status->freq, sig);
ee971924
JB		 2259 rx->flags |= IEEE80211_RX_BEACON_REPORTED;
2260 }
2261
554891e6 2262 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
2e161f78
JB		 2263 return RX_DROP_MONITOR;
2264
2265 if (ieee80211_drop_unencrypted_mgmt(rx))
2266 return RX_DROP_UNUSABLE;
2267
2268 return RX_CONTINUE;
2269}
2270
de1ede7a
JB		 2271static ieee80211_rx_result debug_noinline
2272ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
2273{
2274 struct ieee80211_local *local = rx->local;
eb9fb5b8 2275 struct ieee80211_sub_if_data *sdata = rx->sdata;
de1ede7a 2276 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
554891e6 2277 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
de1ede7a
JB		 2278 int len = rx->skb->len;
2279
2280 if (!ieee80211_is_action(mgmt->frame_control))
2281 return RX_CONTINUE;
2282
026331c4
JM		 2283 /* drop too small frames */
2284 if (len < IEEE80211_MIN_ACTION_SIZE)
84040805 2285 return RX_DROP_UNUSABLE;
de1ede7a 2286
026331c4 2287 if (!rx->sta && mgmt->u.action.category != WLAN_CATEGORY_PUBLIC)
84040805 2288 return RX_DROP_UNUSABLE;
de1ede7a 2289
554891e6 2290 if (!(status->rx_flags & IEEE80211_RX_RA_MATCH))
84040805 2291 return RX_DROP_UNUSABLE;
97ebe12a 2292
de1ede7a 2293 switch (mgmt->u.action.category) {
1d8d3dec
JB		 2294 case WLAN_CATEGORY_HT:
2295 /* reject HT action frames from stations not supporting HT */
2296 if (!rx->sta->sta.ht_cap.ht_supported)
2297 goto invalid;
2298
2299 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
2300 sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
2301 sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
2302 sdata->vif.type != NL80211_IFTYPE_AP &&
2303 sdata->vif.type != NL80211_IFTYPE_ADHOC)
2304 break;
2305
2306 /* verify action & smps_control are present */
2307 if (len < IEEE80211_MIN_ACTION_SIZE + 2)
2308 goto invalid;
2309
2310 switch (mgmt->u.action.u.ht_smps.action) {
2311 case WLAN_HT_ACTION_SMPS: {
2312 struct ieee80211_supported_band *sband;
2313 u8 smps;
2314
2315 /* convert to HT capability */
2316 switch (mgmt->u.action.u.ht_smps.smps_control) {
2317 case WLAN_HT_SMPS_CONTROL_DISABLED:
2318 smps = WLAN_HT_CAP_SM_PS_DISABLED;
2319 break;
2320 case WLAN_HT_SMPS_CONTROL_STATIC:
2321 smps = WLAN_HT_CAP_SM_PS_STATIC;
2322 break;
2323 case WLAN_HT_SMPS_CONTROL_DYNAMIC:
2324 smps = WLAN_HT_CAP_SM_PS_DYNAMIC;
2325 break;
2326 default:
2327 goto invalid;
2328 }
2329 smps <<= IEEE80211_HT_CAP_SM_PS_SHIFT;
2330
2331 /* if no change do nothing */
2332 if ((rx->sta->sta.ht_cap.cap &
2333 IEEE80211_HT_CAP_SM_PS) == smps)
2334 goto handled;
2335
2336 rx->sta->sta.ht_cap.cap &= ~IEEE80211_HT_CAP_SM_PS;
2337 rx->sta->sta.ht_cap.cap |= smps;
2338
2339 sband = rx->local->hw.wiphy->bands[status->band];
2340
64f68e5d
JB		 2341 rate_control_rate_update(local, sband, rx->sta,
2342 IEEE80211_RC_SMPS_CHANGED);
1d8d3dec
JB		 2343 goto handled;
2344 }
2345 default:
2346 goto invalid;
2347 }
2348
2349 break;
de1ede7a 2350 case WLAN_CATEGORY_BACK:
8abd3f9b 2351 if (sdata->vif.type != NL80211_IFTYPE_STATION &&
ae2772b3 2352 sdata->vif.type != NL80211_IFTYPE_MESH_POINT &&
8abd3f9b 2353 sdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
13c40c54
AS		 2354 sdata->vif.type != NL80211_IFTYPE_AP &&
2355 sdata->vif.type != NL80211_IFTYPE_ADHOC)
84040805 2356 break;
8abd3f9b 2357
026331c4
JM		 2358 /* verify action_code is present */
2359 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
2360 break;
2361
de1ede7a
JB		 2362 switch (mgmt->u.action.u.addba_req.action_code) {
2363 case WLAN_ACTION_ADDBA_REQ:
2364 if (len < (IEEE80211_MIN_ACTION_SIZE +
2365 sizeof(mgmt->u.action.u.addba_req)))
bed7ee6e
JB		 2366 goto invalid;
2367 break;
de1ede7a
JB		 2368 case WLAN_ACTION_ADDBA_RESP:
2369 if (len < (IEEE80211_MIN_ACTION_SIZE +
2370 sizeof(mgmt->u.action.u.addba_resp)))
bed7ee6e
JB		 2371 goto invalid;
2372 break;
de1ede7a
JB		 2373 case WLAN_ACTION_DELBA:
2374 if (len < (IEEE80211_MIN_ACTION_SIZE +
2375 sizeof(mgmt->u.action.u.delba)))
bed7ee6e
JB		 2376 goto invalid;
2377 break;
2378 default:
2379 goto invalid;
de1ede7a 2380 }
bed7ee6e 2381
8b58ff83 2382 goto queue;
39192c0b 2383 case WLAN_CATEGORY_SPECTRUM_MGMT:
4797c7ba 2384 if (status->band != IEEE80211_BAND_5GHZ)
84040805 2385 break;
46900298
JB		 2386
2387 if (sdata->vif.type != NL80211_IFTYPE_STATION)
84040805 2388 break;
46900298 2389
026331c4
JM		 2390 /* verify action_code is present */
2391 if (len < IEEE80211_MIN_ACTION_SIZE + 1)
2392 break;
2393
39192c0b
JB		 2394 switch (mgmt->u.action.u.measurement.action_code) {
2395 case WLAN_ACTION_SPCT_MSR_REQ:
2396 if (len < (IEEE80211_MIN_ACTION_SIZE +
2397 sizeof(mgmt->u.action.u.measurement)))
84040805 2398 break;
39192c0b 2399 ieee80211_process_measurement_req(sdata, mgmt, len);
84040805 2400 goto handled;
c481ec97
S		 2401 case WLAN_ACTION_SPCT_CHL_SWITCH:
2402 if (len < (IEEE80211_MIN_ACTION_SIZE +
2403 sizeof(mgmt->u.action.u.chan_switch)))
84040805 2404 break;
c481ec97 2405
cc32abd4 2406 if (sdata->vif.type != NL80211_IFTYPE_STATION)
84040805 2407 break;
cc32abd4 2408
b203ca39 2409 if (!ether_addr_equal(mgmt->bssid, sdata->u.mgd.bssid))
84040805 2410 break;
c481ec97 2411
8b58ff83 2412 goto queue;
39192c0b
JB		 2413 }
2414 break;
fea14732
JM		 2415 case WLAN_CATEGORY_SA_QUERY:
2416 if (len < (IEEE80211_MIN_ACTION_SIZE +
2417 sizeof(mgmt->u.action.u.sa_query)))
84040805
JB		 2418 break;
2419
fea14732
JM		 2420 switch (mgmt->u.action.u.sa_query.action) {
2421 case WLAN_ACTION_SA_QUERY_REQUEST:
2422 if (sdata->vif.type != NL80211_IFTYPE_STATION)
84040805 2423 break;
fea14732 2424 ieee80211_process_sa_query_req(sdata, mgmt, len);
84040805 2425 goto handled;
fea14732
JM		 2426 }
2427 break;
8db09850 2428 case WLAN_CATEGORY_SELF_PROTECTED:
9b395bc3
JB		 2429 if (len < (IEEE80211_MIN_ACTION_SIZE +
2430 sizeof(mgmt->u.action.u.self_prot.action_code)))
2431 break;
2432
8db09850
TP		 2433 switch (mgmt->u.action.u.self_prot.action_code) {
2434 case WLAN_SP_MESH_PEERING_OPEN:
2435 case WLAN_SP_MESH_PEERING_CLOSE:
2436 case WLAN_SP_MESH_PEERING_CONFIRM:
2437 if (!ieee80211_vif_is_mesh(&sdata->vif))
2438 goto invalid;
2439 if (sdata->u.mesh.security != IEEE80211_MESH_SEC_NONE)
2440 /* userspace handles this frame */
2441 break;
2442 goto queue;
2443 case WLAN_SP_MGK_INFORM:
2444 case WLAN_SP_MGK_ACK:
2445 if (!ieee80211_vif_is_mesh(&sdata->vif))
2446 goto invalid;
2447 break;
2448 }
2449 break;
d3aaec8a 2450 case WLAN_CATEGORY_MESH_ACTION:
9b395bc3
JB		 2451 if (len < (IEEE80211_MIN_ACTION_SIZE +
2452 sizeof(mgmt->u.action.u.mesh_action.action_code)))
2453 break;
2454
77a121c3
JB		 2455 if (!ieee80211_vif_is_mesh(&sdata->vif))
2456 break;
25d49e4d 2457 if (mesh_action_is_path_sel(mgmt) &&
1df332e8 2458 !mesh_path_sel_is_hwmp(sdata))
c7108a71
JC		 2459 break;
2460 goto queue;
84040805 2461 }
026331c4 2462
2e161f78
JB		 2463 return RX_CONTINUE;
2464
bed7ee6e 2465 invalid:
554891e6 2466 status->rx_flags |= IEEE80211_RX_MALFORMED_ACTION_FRM;
2e161f78
JB		 2467 /* will return in the next handlers */
2468 return RX_CONTINUE;
2469
2470 handled:
2471 if (rx->sta)
2472 rx->sta->rx_packets++;
2473 dev_kfree_skb(rx->skb);
2474 return RX_QUEUED;
2475
2476 queue:
2477 rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
2478 skb_queue_tail(&sdata->skb_queue, rx->skb);
2479 ieee80211_queue_work(&local->hw, &sdata->work);
2480 if (rx->sta)
2481 rx->sta->rx_packets++;
2482 return RX_QUEUED;
2483}
2484
2485static ieee80211_rx_result debug_noinline
2486ieee80211_rx_h_userspace_mgmt(struct ieee80211_rx_data *rx)
2487{
554891e6 2488 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
804483e9 2489 int sig = 0;
2e161f78
JB		 2490
2491 /* skip known-bad action frames and return them in the next handler */
554891e6 2492 if (status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM)
2e161f78 2493 return RX_CONTINUE;
d7907448 2494
026331c4
JM		 2495 /*
2496 * Getting here means the kernel doesn't know how to handle
2497 * it, but maybe userspace does ... include returned frames
2498 * so userspace can register for those to know whether ones
2499 * it transmitted were processed or returned.
2500 */
026331c4 2501
804483e9
JB		 2502 if (rx->local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
2503 sig = status->signal;
2504
71bbc994 2505 if (cfg80211_rx_mgmt(&rx->sdata->wdev, status->freq, sig,
2e161f78
JB		 2506 rx->skb->data, rx->skb->len,
2507 GFP_ATOMIC)) {
2508 if (rx->sta)
2509 rx->sta->rx_packets++;
2510 dev_kfree_skb(rx->skb);
2511 return RX_QUEUED;
2512 }
2513
2e161f78
JB		 2514 return RX_CONTINUE;
2515}
2516
2517static ieee80211_rx_result debug_noinline
2518ieee80211_rx_h_action_return(struct ieee80211_rx_data *rx)
2519{
2520 struct ieee80211_local *local = rx->local;
2521 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) rx->skb->data;
2522 struct sk_buff *nskb;
2523 struct ieee80211_sub_if_data *sdata = rx->sdata;
554891e6 2524 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
2e161f78
JB		 2525
2526 if (!ieee80211_is_action(mgmt->frame_control))
2527 return RX_CONTINUE;
2528
2529 /*
2530 * For AP mode, hostapd is responsible for handling any action
2531 * frames that we didn't handle, including returning unknown
2532 * ones. For all other modes we will return them to the sender,
2533 * setting the 0x80 bit in the action category, as required by
4b5ebccc 2534 * 802.11-2012 9.24.4.
2e161f78
JB		 2535 * Newer versions of hostapd shall also use the management frame
2536 * registration mechanisms, but older ones still use cooked
2537 * monitor interfaces so push all frames there.
2538 */
554891e6 2539 if (!(status->rx_flags & IEEE80211_RX_MALFORMED_ACTION_FRM) &&
2e161f78
JB		 2540 (sdata->vif.type == NL80211_IFTYPE_AP ||
2541 sdata->vif.type == NL80211_IFTYPE_AP_VLAN))
2542 return RX_DROP_MONITOR;
026331c4 2543
4b5ebccc
JB		 2544 if (is_multicast_ether_addr(mgmt->da))
2545 return RX_DROP_MONITOR;
2546
84040805
JB		 2547 /* do not return rejected action frames */
2548 if (mgmt->u.action.category & 0x80)
2549 return RX_DROP_UNUSABLE;
2550
2551 nskb = skb_copy_expand(rx->skb, local->hw.extra_tx_headroom, 0,
2552 GFP_ATOMIC);
2553 if (nskb) {
292b4df6 2554 struct ieee80211_mgmt *nmgmt = (void *)nskb->data;
84040805 2555
292b4df6
JL		 2556 nmgmt->u.action.category |= 0x80;
2557 memcpy(nmgmt->da, nmgmt->sa, ETH_ALEN);
2558 memcpy(nmgmt->sa, rx->sdata->vif.addr, ETH_ALEN);
84040805
JB		 2559
2560 memset(nskb->cb, 0, sizeof(nskb->cb));
2561
2562 ieee80211_tx_skb(rx->sdata, nskb);
de1ede7a 2563 }
39192c0b
JB		 2564 dev_kfree_skb(rx->skb);
2565 return RX_QUEUED;
de1ede7a
JB		 2566}
2567
49461622 2568static ieee80211_rx_result debug_noinline
5cf121c3 2569ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
571ecf67 2570{
eb9fb5b8 2571 struct ieee80211_sub_if_data *sdata = rx->sdata;
77a121c3
JB		 2572 struct ieee80211_mgmt *mgmt = (void *)rx->skb->data;
2573 __le16 stype;
571ecf67 2574
77a121c3 2575 stype = mgmt->frame_control & cpu_to_le16(IEEE80211_FCTL_STYPE);
472dbc45 2576
77a121c3
JB		 2577 if (!ieee80211_vif_is_mesh(&sdata->vif) &&
2578 sdata->vif.type != NL80211_IFTYPE_ADHOC &&
2579 sdata->vif.type != NL80211_IFTYPE_STATION)
2580 return RX_DROP_MONITOR;
472dbc45 2581
77a121c3 2582 switch (stype) {
66e67e41 2583 case cpu_to_le16(IEEE80211_STYPE_AUTH):
77a121c3
JB		 2584 case cpu_to_le16(IEEE80211_STYPE_BEACON):
2585 case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP):
2586 /* process for all: mesh, mlme, ibss */
2587 break;
66e67e41
JB		 2588 case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP):
2589 case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP):
77a121c3
JB		 2590 case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
2591 case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
2c31333a
CL		 2592 if (is_multicast_ether_addr(mgmt->da) &&
2593 !is_broadcast_ether_addr(mgmt->da))
2594 return RX_DROP_MONITOR;
2595
77a121c3
JB		 2596 /* process only for station */
2597 if (sdata->vif.type != NL80211_IFTYPE_STATION)
2598 return RX_DROP_MONITOR;
2599 break;
2600 case cpu_to_le16(IEEE80211_STYPE_PROBE_REQ):
77a121c3
JB		 2601 /* process only for ibss */
2602 if (sdata->vif.type != NL80211_IFTYPE_ADHOC)
2603 return RX_DROP_MONITOR;
2604 break;
2605 default:
2606 return RX_DROP_MONITOR;
2607 }
f9d540ee 2608
77a121c3 2609 /* queue up frame and kick off work to process it */
c1475ca9 2610 rx->skb->pkt_type = IEEE80211_SDATA_QUEUE_TYPE_FRAME;
77a121c3
JB		 2611 skb_queue_tail(&sdata->skb_queue, rx->skb);
2612 ieee80211_queue_work(&rx->local->hw, &sdata->work);
8b58ff83
JB		 2613 if (rx->sta)
2614 rx->sta->rx_packets++;
46900298 2615
77a121c3 2616 return RX_QUEUED;
571ecf67
JB		 2617}
2618
5cf121c3 2619/* TODO: use IEEE80211_RX_FRAGMENTED */
5f0b7de5
JB		 2620static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
2621 struct ieee80211_rate *rate)
3d30d949
MW		 2622{
2623 struct ieee80211_sub_if_data *sdata;
2624 struct ieee80211_local *local = rx->local;
3d30d949
MW		 2625 struct sk_buff *skb = rx->skb, *skb2;
2626 struct net_device *prev_dev = NULL;
eb9fb5b8 2627 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
293702a3 2628 int needed_headroom;
3d30d949 2629
554891e6
JB		 2630 /*
2631 * If cooked monitor has been processed already, then
2632 * don't do it again. If not, set the flag.
2633 */
2634 if (rx->flags & IEEE80211_RX_CMNTR)
7c1e1831 2635 goto out_free_skb;
554891e6 2636 rx->flags |= IEEE80211_RX_CMNTR;
7c1e1831 2637
152c477a
JB		 2638 /* If there are no cooked monitor interfaces, just free the SKB */
2639 if (!local->cooked_mntrs)
2640 goto out_free_skb;
2641
293702a3 2642 /* room for the radiotap header based on driver features */
90b9e446 2643 needed_headroom = ieee80211_rx_radiotap_space(local, status);
3d30d949 2644
293702a3
JB		 2645 if (skb_headroom(skb) < needed_headroom &&
2646 pskb_expand_head(skb, needed_headroom, 0, GFP_ATOMIC))
2647 goto out_free_skb;
3d30d949 2648
293702a3 2649 /* prepend radiotap information */
973ef21a
FF		 2650 ieee80211_add_rx_radiotap_header(local, skb, rate, needed_headroom,
2651 false);
3d30d949
MW		 2652
2653 skb_set_mac_header(skb, 0);
2654 skb->ip_summed = CHECKSUM_UNNECESSARY;
2655 skb->pkt_type = PACKET_OTHERHOST;
2656 skb->protocol = htons(ETH_P_802_2);
2657
2658 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
9607e6b6 2659 if (!ieee80211_sdata_running(sdata))
3d30d949
MW		 2660 continue;
2661
05c914fe 2662 if (sdata->vif.type != NL80211_IFTYPE_MONITOR ||
3d30d949
MW		 2663 !(sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES))
2664 continue;
2665
2666 if (prev_dev) {
2667 skb2 = skb_clone(skb, GFP_ATOMIC);
2668 if (skb2) {
2669 skb2->dev = prev_dev;
5548a8a1 2670 netif_receive_skb(skb2);
3d30d949
MW		 2671 }
2672 }
2673
2674 prev_dev = sdata->dev;
2675 sdata->dev->stats.rx_packets++;
2676 sdata->dev->stats.rx_bytes += skb->len;
2677 }
2678
2679 if (prev_dev) {
2680 skb->dev = prev_dev;
5548a8a1 2681 netif_receive_skb(skb);
554891e6
JB		 2682 return;
2683 }
3d30d949
MW		 2684
2685 out_free_skb:
2686 dev_kfree_skb(skb);
2687}
2688
aa0c8636
CL		 2689static void ieee80211_rx_handlers_result(struct ieee80211_rx_data *rx,
2690 ieee80211_rx_result res)
2691{
2692 switch (res) {
2693 case RX_DROP_MONITOR:
2694 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
2695 if (rx->sta)
2696 rx->sta->rx_dropped++;
2697 /* fall through */
2698 case RX_CONTINUE: {
2699 struct ieee80211_rate *rate = NULL;
2700 struct ieee80211_supported_band *sband;
2701 struct ieee80211_rx_status *status;
2702
2703 status = IEEE80211_SKB_RXCB((rx->skb));
2704
2705 sband = rx->local->hw.wiphy->bands[status->band];
2706 if (!(status->flag & RX_FLAG_HT))
2707 rate = &sband->bitrates[status->rate_idx];
2708
2709 ieee80211_rx_cooked_monitor(rx, rate);
2710 break;
2711 }
2712 case RX_DROP_UNUSABLE:
2713 I802_DEBUG_INC(rx->sdata->local->rx_handlers_drop);
2714 if (rx->sta)
2715 rx->sta->rx_dropped++;
2716 dev_kfree_skb(rx->skb);
2717 break;
2718 case RX_QUEUED:
2719 I802_DEBUG_INC(rx->sdata->local->rx_handlers_queued);
2720 break;
2721 }
2722}
571ecf67 2723
24a8fdad 2724static void ieee80211_rx_handlers(struct ieee80211_rx_data *rx)
58905290 2725{
58905290 2726 ieee80211_rx_result res = RX_DROP_MONITOR;
aa0c8636 2727 struct sk_buff *skb;
8944b79f 2728
e32f85f7
LCC		 2729#define CALL_RXH(rxh) \
2730 do { \
2731 res = rxh(rx); \
2732 if (res != RX_CONTINUE) \
2569a826 2733 goto rxh_next; \
e32f85f7 2734 } while (0);
49461622 2735
24a8fdad
CL		 2736 spin_lock(&rx->local->rx_skb_queue.lock);
2737 if (rx->local->running_rx_handler)
2738 goto unlock;
2739
2740 rx->local->running_rx_handler = true;
2741
2742 while ((skb = __skb_dequeue(&rx->local->rx_skb_queue))) {
2743 spin_unlock(&rx->local->rx_skb_queue.lock);
2744
2569a826
JB		 2745 /*
2746 * all the other fields are valid across frames
2747 * that belong to an aMPDU since they are on the
2748 * same TID from the same station
2749 */
2750 rx->skb = skb;
2751
2752 CALL_RXH(ieee80211_rx_h_decrypt)
2753 CALL_RXH(ieee80211_rx_h_check_more_data)
47086fc5 2754 CALL_RXH(ieee80211_rx_h_uapsd_and_pspoll)
2569a826
JB		 2755 CALL_RXH(ieee80211_rx_h_sta_process)
2756 CALL_RXH(ieee80211_rx_h_defragment)
2569a826
JB		 2757 CALL_RXH(ieee80211_rx_h_michael_mic_verify)
2758 /* must be after MMIC verify so header is counted in MPDU mic */
bf94e17b 2759#ifdef CONFIG_MAC80211_MESH
aa0c8636 2760 if (ieee80211_vif_is_mesh(&rx->sdata->vif))
2569a826 2761 CALL_RXH(ieee80211_rx_h_mesh_fwding);
bf94e17b 2762#endif
2154c81c 2763 CALL_RXH(ieee80211_rx_h_amsdu)
2569a826 2764 CALL_RXH(ieee80211_rx_h_data)
24a8fdad 2765 CALL_RXH(ieee80211_rx_h_ctrl);
2e161f78 2766 CALL_RXH(ieee80211_rx_h_mgmt_check)
2569a826 2767 CALL_RXH(ieee80211_rx_h_action)
2e161f78
JB		 2768 CALL_RXH(ieee80211_rx_h_userspace_mgmt)
2769 CALL_RXH(ieee80211_rx_h_action_return)
2569a826 2770 CALL_RXH(ieee80211_rx_h_mgmt)
49461622 2771
aa0c8636
CL		 2772 rxh_next:
2773 ieee80211_rx_handlers_result(rx, res);
24a8fdad 2774 spin_lock(&rx->local->rx_skb_queue.lock);
49461622 2775#undef CALL_RXH
aa0c8636 2776 }
24a8fdad
CL		 2777
2778 rx->local->running_rx_handler = false;
2779
2780 unlock:
2781 spin_unlock(&rx->local->rx_skb_queue.lock);
aa0c8636
CL		 2782}
2783
4406c376 2784static void ieee80211_invoke_rx_handlers(struct ieee80211_rx_data *rx)
aa0c8636 2785{
aa0c8636
CL		 2786 ieee80211_rx_result res = RX_DROP_MONITOR;
2787
aa0c8636
CL		 2788#define CALL_RXH(rxh) \
2789 do { \
2790 res = rxh(rx); \
2791 if (res != RX_CONTINUE) \
2792 goto rxh_next; \
2793 } while (0);
2794
aa0c8636
CL		 2795 CALL_RXH(ieee80211_rx_h_check)
2796
24a8fdad 2797 ieee80211_rx_reorder_ampdu(rx);
aa0c8636 2798
24a8fdad 2799 ieee80211_rx_handlers(rx);
aa0c8636 2800 return;
49461622 2801
2569a826 2802 rxh_next:
aa0c8636
CL		 2803 ieee80211_rx_handlers_result(rx, res);
2804
2805#undef CALL_RXH
58905290
JB		 2806}
2807
2bff8ebf 2808/*
dd318575
JB		 2809 * This function makes calls into the RX path, therefore
2810 * it has to be invoked under RCU read lock.
2bff8ebf
CL		 2811 */
2812void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
2813{
554891e6
JB		 2814 struct ieee80211_rx_data rx = {
2815 .sta = sta,
2816 .sdata = sta->sdata,
2817 .local = sta->local,
9e26297a
JB		 2818 /* This is OK -- must be QoS data frame */
2819 .security_idx = tid,
2820 .seqno_idx = tid,
fcf8bd3b 2821 .flags = 0,
554891e6 2822 };
2c15a0cf
CL		 2823 struct tid_ampdu_rx *tid_agg_rx;
2824
2825 tid_agg_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[tid]);
2826 if (!tid_agg_rx)
2827 return;
2bff8ebf 2828
2c15a0cf 2829 spin_lock(&tid_agg_rx->reorder_lock);
d3b2fb53 2830 ieee80211_sta_reorder_release(sta->sdata, tid_agg_rx);
2c15a0cf 2831 spin_unlock(&tid_agg_rx->reorder_lock);
2bff8ebf 2832
24a8fdad 2833 ieee80211_rx_handlers(&rx);
2bff8ebf
CL		 2834}
2835
571ecf67
JB		 2836/* main receive path */
2837
20b01f80 2838static int prepare_for_handlers(struct ieee80211_rx_data *rx,
23a24def
JB		 2839 struct ieee80211_hdr *hdr)
2840{
20b01f80 2841 struct ieee80211_sub_if_data *sdata = rx->sdata;
eb9fb5b8
JB		 2842 struct sk_buff *skb = rx->skb;
2843 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2844 u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type);
23a24def
JB		 2845 int multicast = is_multicast_ether_addr(hdr->addr1);
2846
51fb61e7 2847 switch (sdata->vif.type) {
05c914fe 2848 case NL80211_IFTYPE_STATION:
9bc383de 2849 if (!bssid && !sdata->u.mgd.use_4addr)
23a24def 2850 return 0;
77fdaa12 2851 if (!multicast &&
b203ca39 2852 !ether_addr_equal(sdata->vif.addr, hdr->addr1)) {
4f312336
FF		 2853 if (!(sdata->dev->flags & IFF_PROMISC) ||
2854 sdata->u.mgd.use_4addr)
23a24def 2855 return 0;
554891e6 2856 status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
23a24def
JB		 2857 }
2858 break;
05c914fe 2859 case NL80211_IFTYPE_ADHOC:
23a24def
JB		 2860 if (!bssid)
2861 return 0;
a7767f95 2862 if (ieee80211_is_beacon(hdr->frame_control)) {
9d9bf77d 2863 return 1;
d48b2968
JB		 2864 } else if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid)) {
2865 return 0;
23a24def 2866 } else if (!multicast &&
b203ca39 2867 !ether_addr_equal(sdata->vif.addr, hdr->addr1)) {
4150c572 2868 if (!(sdata->dev->flags & IFF_PROMISC))
23a24def 2869 return 0;
554891e6 2870 status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
0fb8ca45
JM		 2871 } else if (!rx->sta) {
2872 int rate_idx;
eb9fb5b8 2873 if (status->flag & RX_FLAG_HT)
0fb8ca45
JM		 2874 rate_idx = 0; /* TODO: HT rates */
2875 else
eb9fb5b8 2876 rate_idx = status->rate_idx;
8bf11d8d
JB		 2877 ieee80211_ibss_rx_no_sta(sdata, bssid, hdr->addr2,
2878 BIT(rate_idx));
0fb8ca45 2879 }
23a24def 2880 break;
05c914fe 2881 case NL80211_IFTYPE_MESH_POINT:
6032f934 2882 if (!multicast &&
b203ca39 2883 !ether_addr_equal(sdata->vif.addr, hdr->addr1)) {
6032f934
JB		 2884 if (!(sdata->dev->flags & IFF_PROMISC))
2885 return 0;
2886
554891e6 2887 status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
6032f934
JB		 2888 }
2889 break;
05c914fe
JB		 2890 case NL80211_IFTYPE_AP_VLAN:
2891 case NL80211_IFTYPE_AP:
23a24def 2892 if (!bssid) {
b203ca39 2893 if (!ether_addr_equal(sdata->vif.addr, hdr->addr1))
23a24def 2894 return 0;
f142c6b9 2895 } else if (!ieee80211_bssid_match(bssid, sdata->vif.addr)) {
3df6eaea
JB		 2896 /*
2897 * Accept public action frames even when the
2898 * BSSID doesn't match, this is used for P2P
2899 * and location updates. Note that mac80211
2900 * itself never looks at these frames.
2901 */
d48b2968 2902 if (ieee80211_is_public_action(hdr, skb->len))
3df6eaea 2903 return 1;
d48b2968 2904 if (!ieee80211_is_beacon(hdr->frame_control))
23a24def 2905 return 0;
554891e6 2906 status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
23a24def 2907 }
23a24def 2908 break;
05c914fe 2909 case NL80211_IFTYPE_WDS:
a7767f95 2910 if (bssid || !ieee80211_is_data(hdr->frame_control))
23a24def 2911 return 0;
b203ca39 2912 if (!ether_addr_equal(sdata->u.wds.remote_addr, hdr->addr2))
23a24def
JB		 2913 return 0;
2914 break;
f142c6b9
JB		 2915 case NL80211_IFTYPE_P2P_DEVICE:
2916 if (!ieee80211_is_public_action(hdr, skb->len) &&
2917 !ieee80211_is_probe_req(hdr->frame_control) &&
2918 !ieee80211_is_probe_resp(hdr->frame_control) &&
2919 !ieee80211_is_beacon(hdr->frame_control))
2920 return 0;
2921 if (!ether_addr_equal(sdata->vif.addr, hdr->addr1))
2922 status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
2923 break;
2ca27bcf 2924 default:
fb1c1cd6 2925 /* should never get here */
f142c6b9 2926 WARN_ON_ONCE(1);
fb1c1cd6 2927 break;
23a24def
JB		 2928 }
2929
2930 return 1;
2931}
2932
4406c376
JB		 2933/*
2934 * This function returns whether or not the SKB
2935 * was destined for RX processing or not, which,
2936 * if consume is true, is equivalent to whether
2937 * or not the skb was consumed.
2938 */
2939static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,
2940 struct sk_buff *skb, bool consume)
2941{
2942 struct ieee80211_local *local = rx->local;
2943 struct ieee80211_sub_if_data *sdata = rx->sdata;
2944 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
2945 struct ieee80211_hdr *hdr = (void *)skb->data;
2946 int prepares;
2947
2948 rx->skb = skb;
554891e6 2949 status->rx_flags |= IEEE80211_RX_RA_MATCH;
4406c376
JB		 2950 prepares = prepare_for_handlers(rx, hdr);
2951
2952 if (!prepares)
2953 return false;
2954
4406c376
JB		 2955 if (!consume) {
2956 skb = skb_copy(skb, GFP_ATOMIC);
2957 if (!skb) {
2958 if (net_ratelimit())
2959 wiphy_debug(local->hw.wiphy,
b305dae4 2960 "failed to copy skb for %s\n",
4406c376
JB		 2961 sdata->name);
2962 return true;
2963 }
2964
2965 rx->skb = skb;
2966 }
2967
2968 ieee80211_invoke_rx_handlers(rx);
2969 return true;
2970}
2971
571ecf67 2972/*
6368e4b1
RR		 2973 * This is the actual Rx frames handler. as it blongs to Rx path it must
2974 * be called with rcu_read_lock protection.
571ecf67 2975 */
71ebb4aa 2976static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
071d9ac2 2977 struct sk_buff *skb)
571ecf67
JB		 2978{
2979 struct ieee80211_local *local = hw_to_local(hw);
2980 struct ieee80211_sub_if_data *sdata;
571ecf67 2981 struct ieee80211_hdr *hdr;
e3cf8b3f 2982 __le16 fc;
5cf121c3 2983 struct ieee80211_rx_data rx;
4406c376 2984 struct ieee80211_sub_if_data *prev;
56af3268 2985 struct sta_info *sta, *tmp, *prev_sta;
e3cf8b3f 2986 int err = 0;
571ecf67 2987
e3cf8b3f 2988 fc = ((struct ieee80211_hdr *)skb->data)->frame_control;
571ecf67
JB		 2989 memset(&rx, 0, sizeof(rx));
2990 rx.skb = skb;
2991 rx.local = local;
72abd81b 2992
e3cf8b3f 2993 if (ieee80211_is_data(fc) || ieee80211_is_mgmt(fc))
571ecf67 2994 local->dot11ReceivedFragmentCount++;
571ecf67 2995
4a4f1a58
JB		 2996 if (ieee80211_is_mgmt(fc)) {
2997 /* drop frame if too short for header */
2998 if (skb->len < ieee80211_hdrlen(fc))
2999 err = -ENOBUFS;
3000 else
3001 err = skb_linearize(skb);
3002 } else {
e3cf8b3f 3003 err = !pskb_may_pull(skb, ieee80211_hdrlen(fc));
4a4f1a58 3004 }
e3cf8b3f
ZY		 3005
3006 if (err) {
3007 dev_kfree_skb(skb);
3008 return;
3009 }
3010
3011 hdr = (struct ieee80211_hdr *)skb->data;
38f3714d 3012 ieee80211_parse_qos(&rx);
d1c3a37c 3013 ieee80211_verify_alignment(&rx);
38f3714d 3014
d48b2968
JB		 3015 if (unlikely(ieee80211_is_probe_resp(hdr->frame_control) ||
3016 ieee80211_is_beacon(hdr->frame_control)))
3017 ieee80211_scan_rx(local, skb);
3018
e3cf8b3f 3019 if (ieee80211_is_data(fc)) {
56af3268 3020 prev_sta = NULL;
4406c376 3021
7852e361 3022 for_each_sta_info(local, hdr->addr2, sta, tmp) {
56af3268
BG		 3023 if (!prev_sta) {
3024 prev_sta = sta;
3025 continue;
3026 }
3027
3028 rx.sta = prev_sta;
3029 rx.sdata = prev_sta->sdata;
4406c376 3030 ieee80211_prepare_and_rx_handle(&rx, skb, false);
abe60632 3031
56af3268 3032 prev_sta = sta;
4406c376 3033 }
56af3268
BG		 3034
3035 if (prev_sta) {
3036 rx.sta = prev_sta;
3037 rx.sdata = prev_sta->sdata;
3038
4406c376 3039 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
56af3268 3040 return;
8e26d5ad 3041 goto out;
56af3268 3042 }
4406c376
JB		 3043 }
3044
4b0dd98e 3045 prev = NULL;
b2e7771e 3046
4b0dd98e
JB		 3047 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
3048 if (!ieee80211_sdata_running(sdata))
3049 continue;
340e11f3 3050
4b0dd98e
JB		 3051 if (sdata->vif.type == NL80211_IFTYPE_MONITOR ||
3052 sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
3053 continue;
340e11f3 3054
4b0dd98e
JB		 3055 /*
3056 * frame is destined for this interface, but if it's
3057 * not also for the previous one we handle that after
3058 * the loop to avoid copying the SKB once too much
3059 */
4bb29f8c 3060
4b0dd98e 3061 if (!prev) {
abe60632 3062 prev = sdata;
4b0dd98e 3063 continue;
340e11f3 3064 }
4bb29f8c 3065
7852e361 3066 rx.sta = sta_info_get_bss(prev, hdr->addr2);
4b0dd98e
JB		 3067 rx.sdata = prev;
3068 ieee80211_prepare_and_rx_handle(&rx, skb, false);
4bb29f8c 3069
4b0dd98e
JB		 3070 prev = sdata;
3071 }
3072
3073 if (prev) {
7852e361 3074 rx.sta = sta_info_get_bss(prev, hdr->addr2);
4b0dd98e 3075 rx.sdata = prev;
4406c376 3076
4b0dd98e
JB		 3077 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
3078 return;
571ecf67 3079 }
4406c376 3080
8e26d5ad 3081 out:
4406c376 3082 dev_kfree_skb(skb);
571ecf67 3083}
6368e4b1
RR		 3084
3085/*
3086 * This is the receive path handler. It is called by a low level driver when an
3087 * 802.11 MPDU is received from the hardware.
3088 */
103bf9f7 3089void ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb)
6368e4b1
RR		 3090{
3091 struct ieee80211_local *local = hw_to_local(hw);
8318d78a
JB		 3092 struct ieee80211_rate *rate = NULL;
3093 struct ieee80211_supported_band *sband;
f1d58c25 3094 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
8318d78a 3095
d20ef63d
JB		 3096 WARN_ON_ONCE(softirq_count() == 0);
3097
444e3803 3098 if (WARN_ON(status->band >= IEEE80211_NUM_BANDS))
77a980dc 3099 goto drop;
8318d78a
JB		 3100
3101 sband = local->hw.wiphy->bands[status->band];
77a980dc
JB		 3102 if (WARN_ON(!sband))
3103 goto drop;
8318d78a 3104
89c3a8ac
JB		 3105 /*
3106 * If we're suspending, it is possible although not too likely
3107 * that we'd be receiving frames after having already partially
3108 * quiesced the stack. We can't process such frames then since
3109 * that might, for example, cause stations to be added or other
3110 * driver callbacks be invoked.
3111 */
77a980dc
JB		 3112 if (unlikely(local->quiescing || local->suspended))
3113 goto drop;
89c3a8ac 3114
04800ada
AN		 3115 /* We might be during a HW reconfig, prevent Rx for the same reason */
3116 if (unlikely(local->in_reconfig))
3117 goto drop;
3118
ea77f12f
JB		 3119 /*
3120 * The same happens when we're not even started,
3121 * but that's worth a warning.
3122 */
77a980dc
JB		 3123 if (WARN_ON(!local->started))
3124 goto drop;
ea77f12f 3125
fc885189 3126 if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC))) {
e5d6eb83 3127 /*
fc885189
JB		 3128 * Validate the rate, unless a PLCP error means that
3129 * we probably can't have a valid rate here anyway.
e5d6eb83 3130 */
fc885189
JB		 3131
3132 if (status->flag & RX_FLAG_HT) {
3133 /*
3134 * rate_idx is MCS index, which can be [0-76]
3135 * as documented on:
3136 *
3137 * http://wireless.kernel.org/en/developers/Documentation/ieee80211/802.11n
3138 *
3139 * Anything else would be some sort of driver or
3140 * hardware error. The driver should catch hardware
3141 * errors.
3142 */
444e3803 3143 if (WARN(status->rate_idx > 76,
fc885189
JB		 3144 "Rate marked as an HT rate but passed "
3145 "status->rate_idx is not "
3146 "an MCS index [0-76]: %d (0x%02x)\n",
3147 status->rate_idx,
3148 status->rate_idx))
3149 goto drop;
3150 } else {
444e3803 3151 if (WARN_ON(status->rate_idx >= sband->n_bitrates))
fc885189
JB		 3152 goto drop;
3153 rate = &sband->bitrates[status->rate_idx];
3154 }
0fb8ca45 3155 }
6368e4b1 3156
554891e6
JB		 3157 status->rx_flags = 0;
3158
6368e4b1
RR		 3159 /*
3160 * key references and virtual interfaces are protected using RCU
3161 * and this requires that we are in a read-side RCU section during
3162 * receive processing
3163 */
3164 rcu_read_lock();
3165
3166 /*
3167 * Frames with failed FCS/PLCP checksum are not returned,
3168 * all other frames are returned without radiotap header
3169 * if it was previously present.
3170 * Also, frames with less than 16 bytes are dropped.
3171 */
f1d58c25 3172 skb = ieee80211_rx_monitor(local, skb, rate);
6368e4b1
RR		 3173 if (!skb) {
3174 rcu_read_unlock();
3175 return;
3176 }
3177
e1e54068
JB		 3178 ieee80211_tpt_led_trig_rx(local,
3179 ((struct ieee80211_hdr *)skb->data)->frame_control,
3180 skb->len);
071d9ac2 3181 __ieee80211_rx_handle_packet(hw, skb);
6368e4b1
RR		 3182
3183 rcu_read_unlock();
77a980dc
JB		 3184
3185 return;
3186 drop:
3187 kfree_skb(skb);
6368e4b1 3188}
103bf9f7 3189EXPORT_SYMBOL(ieee80211_rx);
571ecf67
JB		 3190
3191/* This is a version of the rx handler that can be called from hard irq
3192 * context. Post the skb on the queue and schedule the tasklet */
f1d58c25 3193void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb)
571ecf67
JB		 3194{
3195 struct ieee80211_local *local = hw_to_local(hw);
3196
3197 BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));
3198
571ecf67
JB		 3199 skb->pkt_type = IEEE80211_RX_MSG;
3200 skb_queue_tail(&local->skb_queue, skb);
3201 tasklet_schedule(&local->tasklet);
3202}
3203EXPORT_SYMBOL(ieee80211_rx_irqsafe);
Ubuntu Jammy Linux kernel mirror